@depup/payload 3.79.1-depup.0

package/dist/utilities/getFieldPermissions.spec.js

@@ -0,0 +1,78 @@
+import { getFieldPermissions } from './getFieldPermissions.js';
+import { describe, expect, it } from 'vitest';
+describe('getFieldPermissions with collection fallback', ()=>{
+    const mockField = {
+        name: 'testField',
+        type: 'text'
+    };
+    describe('fallback to collection permissions', ()=>{
+        it('should enable read-only mode when field permissions are missing but collection has read access', ()=>{
+            const fieldPermissions = {} // Empty/sanitized field permissions
+            ;
+            const collectionPermissions = {
+                read: true,
+                fields: {}
+            };
+            const result = getFieldPermissions({
+                field: mockField,
+                operation: 'update',
+                parentName: '',
+                permissions: fieldPermissions,
+                collectionPermissions
+            });
+            expect(result.read).toBe(true);
+            expect(result.operation).toBe(false); // Should be read-only
+            expect(result.permissions).toEqual({
+                read: true
+            });
+        });
+        it('should respect existing field permissions when they exist', ()=>{
+            const fieldPermissions = true // All permissions are true
+            ;
+            const collectionPermissions = {
+                read: true,
+                fields: {}
+            };
+            const result = getFieldPermissions({
+                field: mockField,
+                operation: 'update',
+                parentName: '',
+                permissions: fieldPermissions
+            });
+            expect(result.read).toBe(true);
+            expect(result.operation).toBe(true); // Should have operation permission
+            expect(result.permissions).toBe(true);
+        });
+        it('should not provide access when neither field nor collection has read permission', ()=>{
+            const fieldPermissions = {};
+            const collectionPermissions = {
+                // No read permission at collection level
+                fields: {}
+            };
+            const result = getFieldPermissions({
+                field: mockField,
+                operation: 'update',
+                parentName: '',
+                permissions: fieldPermissions,
+                collectionPermissions
+            });
+            expect(result.read).toBe(false);
+            expect(result.operation).toBe(false);
+        });
+        it('should work without collection permissions (backward compatibility)', ()=>{
+            const fieldPermissions = true // All permissions
+            ;
+            const result = getFieldPermissions({
+                field: mockField,
+                operation: 'update',
+                parentName: '',
+                permissions: fieldPermissions
+            });
+            expect(result.read).toBe(true);
+            expect(result.operation).toBe(true);
+            expect(result.permissions).toBe(true);
+        });
+    });
+});
+
+//# sourceMappingURL=getFieldPermissions.spec.js.map

package/dist/utilities/getFieldPermissions.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getFieldPermissions.spec.ts"],"sourcesContent":["import type { SanitizedDocumentPermissions } from '../auth/types.js'\n\nimport { getFieldPermissions } from './getFieldPermissions.js'\nimport { describe, expect, it } from 'vitest'\n\ndescribe('getFieldPermissions with collection fallback', () => {\n  const mockField = {\n    name: 'testField',\n    type: 'text' as const,\n  }\n\n  describe('fallback to collection permissions', () => {\n    it('should enable read-only mode when field permissions are missing but collection has read access', () => {\n      const fieldPermissions = {} // Empty/sanitized field permissions\n      const collectionPermissions: SanitizedDocumentPermissions = {\n        read: true,\n        fields: {},\n      }\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n        collectionPermissions,\n      })\n\n      expect(result.read).toBe(true)\n      expect(result.operation).toBe(false) // Should be read-only\n      expect(result.permissions).toEqual({ read: true })\n    })\n\n    it('should respect existing field permissions when they exist', () => {\n      const fieldPermissions = true // All permissions are true\n      const collectionPermissions: SanitizedDocumentPermissions = {\n        read: true,\n        fields: {},\n      }\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n      })\n\n      expect(result.read).toBe(true)\n      expect(result.operation).toBe(true) // Should have operation permission\n      expect(result.permissions).toBe(true)\n    })\n\n    it('should not provide access when neither field nor collection has read permission', () => {\n      const fieldPermissions = {}\n      const collectionPermissions: SanitizedDocumentPermissions = {\n        // No read permission at collection level\n        fields: {},\n      }\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n        collectionPermissions,\n      })\n\n      expect(result.read).toBe(false)\n      expect(result.operation).toBe(false)\n    })\n\n    it('should work without collection permissions (backward compatibility)', () => {\n      const fieldPermissions = true // All permissions\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n        // No collectionPermissions provided\n      })\n\n      expect(result.read).toBe(true)\n      expect(result.operation).toBe(true)\n      expect(result.permissions).toBe(true)\n    })\n  })\n})\n"],"names":["getFieldPermissions","describe","expect","it","mockField","name","type","fieldPermissions","collectionPermissions","read","fields","result","field","operation","parentName","permissions","toBe","toEqual"],"mappings":"AAEA,SAASA,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7CF,SAAS,gDAAgD;IACvD,MAAMG,YAAY;QAChBC,MAAM;QACNC,MAAM;IACR;IAEAL,SAAS,sCAAsC;QAC7CE,GAAG,kGAAkG;YACnG,MAAMI,mBAAmB,CAAC,EAAE,oCAAoC;;YAChE,MAAMC,wBAAsD;gBAC1DC,MAAM;gBACNC,QAAQ,CAAC;YACX;YAEA,MAAMC,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;gBACbC;YACF;YAEAN,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC,QAAO,sBAAsB;YAC3Dd,OAAOS,OAAOI,WAAW,EAAEE,OAAO,CAAC;gBAAER,MAAM;YAAK;QAClD;QAEAN,GAAG,6DAA6D;YAC9D,MAAMI,mBAAmB,KAAK,2BAA2B;;YACzD,MAAMC,wBAAsD;gBAC1DC,MAAM;gBACNC,QAAQ,CAAC;YACX;YAEA,MAAMC,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;YACf;YAEAL,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC,OAAM,mCAAmC;YACvEd,OAAOS,OAAOI,WAAW,EAAEC,IAAI,CAAC;QAClC;QAEAb,GAAG,mFAAmF;YACpF,MAAMI,mBAAmB,CAAC;YAC1B,MAAMC,wBAAsD;gBAC1D,yCAAyC;gBACzCE,QAAQ,CAAC;YACX;YAEA,MAAMC,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;gBACbC;YACF;YAEAN,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC;QAChC;QAEAb,GAAG,uEAAuE;YACxE,MAAMI,mBAAmB,KAAK,kBAAkB;;YAEhD,MAAMI,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;YAEf;YAEAL,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC;YAC9Bd,OAAOS,OAAOI,WAAW,EAAEC,IAAI,CAAC;QAClC;IACF;AACF"}

package/dist/utilities/getObjectDotNotation.d.ts

@@ -0,0 +1,16 @@
+/**
+ *
+ * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`
+ *
+ * @example
+ *
+ * ```ts
+ * import { getObjectDotNotation } from 'payload/shared'
+ *
+ * const obj = { a: { b: { c: 42 } } }
+ * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42
+ * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0
+ * ```
+ */
+export declare const getObjectDotNotation: <T>(obj: Record<string, unknown>, path: string, defaultValue?: T) => T;
+//# sourceMappingURL=getObjectDotNotation.d.ts.map

package/dist/utilities/getObjectDotNotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAMF,CAAA"}

package/dist/utilities/getObjectDotNotation.js

@@ -0,0 +1,22 @@
+/**
+ *
+ * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`
+ *
+ * @example
+ *
+ * ```ts
+ * import { getObjectDotNotation } from 'payload/shared'
+ *
+ * const obj = { a: { b: { c: 42 } } }
+ * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42
+ * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0
+ * ```
+ */ export const getObjectDotNotation = (obj, path, defaultValue)=>{
+    if (!path || !obj) {
+        return defaultValue;
+    }
+    const result = path.split('.').reduce((o, i)=>o?.[i], obj);
+    return result === undefined ? defaultValue : result;
+};
+
+//# sourceMappingURL=getObjectDotNotation.js.map

package/dist/utilities/getObjectDotNotation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/**\n *\n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n *\n * @example\n *\n * ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n *\n * const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n  obj: Record<string, unknown>,\n  path: string,\n  defaultValue?: T,\n): T => {\n  if (!path || !obj) {\n    return defaultValue!\n  }\n  const result = path.split('.').reduce((o, i) => o?.[i] as Record<string, unknown>, obj)\n  return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","split","reduce","o","i","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IACA,MAAMC,SAASF,KAAKG,KAAK,CAAC,KAAKC,MAAM,CAAC,CAACC,GAAGC,IAAMD,GAAG,CAACC,EAAE,EAA6BP;IACnF,OAAOG,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}

package/dist/utilities/getRequestEntity.d.ts

@@ -0,0 +1,13 @@
+import type { Collection } from '../collections/config/types.js';
+import type { SanitizedGlobalConfig } from '../globals/config/types.js';
+import type { PayloadRequest } from '../types/index.js';
+export declare const getRequestCollection: (req: PayloadRequest) => Collection;
+export declare const getRequestCollectionWithID: <T extends boolean>(req: PayloadRequest, { disableSanitize, optionalID, }?: {
+    disableSanitize?: T;
+    optionalID?: boolean;
+}) => {
+    collection: Collection;
+    id: T extends true ? string : number | string;
+};
+export declare const getRequestGlobal: (req: PayloadRequest) => SanitizedGlobalConfig;
+//# sourceMappingURL=getRequestEntity.d.ts.map

package/dist/utilities/getRequestEntity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRequestEntity.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestEntity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,eAAO,MAAM,oBAAoB,QAAS,cAAc,KAAG,UAc1D,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,CAAC,SAAS,OAAO,OACrD,cAAc,qCAIhB;IACD,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,KACA;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,EAAE,EAAE,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CA2C9C,CAAA;AAED,eAAO,MAAM,gBAAgB,QAAS,cAAc,KAAG,qBActD,CAAA"}

package/dist/utilities/getRequestEntity.js

@@ -0,0 +1,60 @@
+import { APIError } from '../errors/APIError.js';
+export const getRequestCollection = (req)=>{
+    const collectionSlug = req.routeParams?.collection;
+    if (typeof collectionSlug !== 'string') {
+        throw new APIError(`No collection was specified`, 400);
+    }
+    const collection = req.payload.collections[collectionSlug];
+    if (!collection) {
+        throw new APIError(`Collection with the slug ${collectionSlug} was not found`, 404);
+    }
+    return collection;
+};
+export const getRequestCollectionWithID = (req, { disableSanitize, optionalID } = {})=>{
+    const collection = getRequestCollection(req);
+    const id = req.routeParams?.id;
+    if (typeof id !== 'string') {
+        if (optionalID) {
+            return {
+                id: undefined,
+                collection
+            };
+        }
+        throw new APIError(`ID was not specified`, 400);
+    }
+    if (disableSanitize === true) {
+        return {
+            id,
+            collection
+        };
+    }
+    let sanitizedID = id;
+    // If default db ID type is a number, we should sanitize
+    let shouldSanitize = Boolean(req.payload.db.defaultIDType === 'number');
+    // UNLESS the customIDType for this collection is text.... then we leave it
+    if (shouldSanitize && collection.customIDType === 'text') {
+        shouldSanitize = false;
+    }
+    // If we still should sanitize, parse float
+    if (shouldSanitize) {
+        sanitizedID = parseFloat(sanitizedID);
+    }
+    return {
+        // @ts-expect-error generic return
+        id: sanitizedID,
+        collection
+    };
+};
+export const getRequestGlobal = (req)=>{
+    const globalSlug = req.routeParams?.global;
+    if (typeof globalSlug !== 'string') {
+        throw new APIError(`No global was specified`, 400);
+    }
+    const globalConfig = req.payload.globals.config.find((each)=>each.slug === globalSlug);
+    if (!globalConfig) {
+        throw new APIError(`Global with the slug ${globalSlug} was not found`, 404);
+    }
+    return globalConfig;
+};
+
+//# sourceMappingURL=getRequestEntity.js.map

package/dist/utilities/getRequestEntity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getRequestEntity.ts"],"sourcesContent":["import type { Collection } from '../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { APIError } from '../errors/APIError.js'\n\nexport const getRequestCollection = (req: PayloadRequest): Collection => {\n  const collectionSlug = req.routeParams?.collection\n\n  if (typeof collectionSlug !== 'string') {\n    throw new APIError(`No collection was specified`, 400)\n  }\n\n  const collection = req.payload.collections[collectionSlug]\n\n  if (!collection) {\n    throw new APIError(`Collection with the slug ${collectionSlug} was not found`, 404)\n  }\n\n  return collection\n}\n\nexport const getRequestCollectionWithID = <T extends boolean>(\n  req: PayloadRequest,\n  {\n    disableSanitize,\n    optionalID,\n  }: {\n    disableSanitize?: T\n    optionalID?: boolean\n  } = {},\n): {\n  collection: Collection\n  id: T extends true ? string : number | string\n} => {\n  const collection = getRequestCollection(req)\n  const id = req.routeParams?.id\n\n  if (typeof id !== 'string') {\n    if (optionalID) {\n      return {\n        id: undefined!,\n        collection,\n      }\n    }\n\n    throw new APIError(`ID was not specified`, 400)\n  }\n\n  if (disableSanitize === true) {\n    return {\n      id,\n      collection,\n    }\n  }\n\n  let sanitizedID: number | string = id\n\n  // If default db ID type is a number, we should sanitize\n  let shouldSanitize = Boolean(req.payload.db.defaultIDType === 'number')\n\n  // UNLESS the customIDType for this collection is text.... then we leave it\n  if (shouldSanitize && collection.customIDType === 'text') {\n    shouldSanitize = false\n  }\n\n  // If we still should sanitize, parse float\n  if (shouldSanitize) {\n    sanitizedID = parseFloat(sanitizedID)\n  }\n\n  return {\n    // @ts-expect-error generic return\n    id: sanitizedID,\n    collection,\n  }\n}\n\nexport const getRequestGlobal = (req: PayloadRequest): SanitizedGlobalConfig => {\n  const globalSlug = req.routeParams?.global\n\n  if (typeof globalSlug !== 'string') {\n    throw new APIError(`No global was specified`, 400)\n  }\n\n  const globalConfig = req.payload.globals.config.find((each) => each.slug === globalSlug)\n\n  if (!globalConfig) {\n    throw new APIError(`Global with the slug ${globalSlug} was not found`, 404)\n  }\n\n  return globalConfig\n}\n"],"names":["APIError","getRequestCollection","req","collectionSlug","routeParams","collection","payload","collections","getRequestCollectionWithID","disableSanitize","optionalID","id","undefined","sanitizedID","shouldSanitize","Boolean","db","defaultIDType","customIDType","parseFloat","getRequestGlobal","globalSlug","global","globalConfig","globals","config","find","each","slug"],"mappings":"AAIA,SAASA,QAAQ,QAAQ,wBAAuB;AAEhD,OAAO,MAAMC,uBAAuB,CAACC;IACnC,MAAMC,iBAAiBD,IAAIE,WAAW,EAAEC;IAExC,IAAI,OAAOF,mBAAmB,UAAU;QACtC,MAAM,IAAIH,SAAS,CAAC,2BAA2B,CAAC,EAAE;IACpD;IAEA,MAAMK,aAAaH,IAAII,OAAO,CAACC,WAAW,CAACJ,eAAe;IAE1D,IAAI,CAACE,YAAY;QACf,MAAM,IAAIL,SAAS,CAAC,yBAAyB,EAAEG,eAAe,cAAc,CAAC,EAAE;IACjF;IAEA,OAAOE;AACT,EAAC;AAED,OAAO,MAAMG,6BAA6B,CACxCN,KACA,EACEO,eAAe,EACfC,UAAU,EAIX,GAAG,CAAC,CAAC;IAKN,MAAML,aAAaJ,qBAAqBC;IACxC,MAAMS,KAAKT,IAAIE,WAAW,EAAEO;IAE5B,IAAI,OAAOA,OAAO,UAAU;QAC1B,IAAID,YAAY;YACd,OAAO;gBACLC,IAAIC;gBACJP;YACF;QACF;QAEA,MAAM,IAAIL,SAAS,CAAC,oBAAoB,CAAC,EAAE;IAC7C;IAEA,IAAIS,oBAAoB,MAAM;QAC5B,OAAO;YACLE;YACAN;QACF;IACF;IAEA,IAAIQ,cAA+BF;IAEnC,wDAAwD;IACxD,IAAIG,iBAAiBC,QAAQb,IAAII,OAAO,CAACU,EAAE,CAACC,aAAa,KAAK;IAE9D,2EAA2E;IAC3E,IAAIH,kBAAkBT,WAAWa,YAAY,KAAK,QAAQ;QACxDJ,iBAAiB;IACnB;IAEA,2CAA2C;IAC3C,IAAIA,gBAAgB;QAClBD,cAAcM,WAAWN;IAC3B;IAEA,OAAO;QACL,kCAAkC;QAClCF,IAAIE;QACJR;IACF;AACF,EAAC;AAED,OAAO,MAAMe,mBAAmB,CAAClB;IAC/B,MAAMmB,aAAanB,IAAIE,WAAW,EAAEkB;IAEpC,IAAI,OAAOD,eAAe,UAAU;QAClC,MAAM,IAAIrB,SAAS,CAAC,uBAAuB,CAAC,EAAE;IAChD;IAEA,MAAMuB,eAAerB,IAAII,OAAO,CAACkB,OAAO,CAACC,MAAM,CAACC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKP;IAE7E,IAAI,CAACE,cAAc;QACjB,MAAM,IAAIvB,SAAS,CAAC,qBAAqB,EAAEqB,WAAW,cAAc,CAAC,EAAE;IACzE;IAEA,OAAOE;AACT,EAAC"}

package/dist/utilities/getRequestLanguage.d.ts

@@ -0,0 +1,12 @@
+import type { AcceptedLanguages } from '@payloadcms/translations';
+import type { ReadonlyRequestCookies } from 'next/dist/server/web/spec-extension/adapters/request-cookies.js';
+import type { SanitizedConfig } from '../config/types.js';
+type GetRequestLanguageArgs = {
+    config: SanitizedConfig;
+    cookies: Map<string, string> | ReadonlyRequestCookies;
+    defaultLanguage?: AcceptedLanguages;
+    headers: Request['headers'];
+};
+export declare const getRequestLanguage: ({ config, cookies, headers, }: GetRequestLanguageArgs) => AcceptedLanguages;
+export {};
+//# sourceMappingURL=getRequestLanguage.d.ts.map

package/dist/utilities/getRequestLanguage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRequestLanguage.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestLanguage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iEAAiE,CAAA;AAI7G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,eAAe,CAAA;IACvB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,sBAAsB,CAAA;IACrD,eAAe,CAAC,EAAE,iBAAiB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CAC5B,CAAA;AAED,eAAO,MAAM,kBAAkB,kCAI5B,sBAAsB,KAAG,iBAqB3B,CAAA"}

package/dist/utilities/getRequestLanguage.js

@@ -0,0 +1,16 @@
+import { extractHeaderLanguage } from '@payloadcms/translations';
+export const getRequestLanguage = ({ config, cookies, headers })=>{
+    const supportedLanguageKeys = Object.keys(config.i18n.supportedLanguages);
+    const langCookie = cookies.get(`${config.cookiePrefix || 'payload'}-lng`);
+    const languageFromCookie = typeof langCookie === 'string' ? langCookie : langCookie?.value;
+    if (languageFromCookie && supportedLanguageKeys.includes(languageFromCookie)) {
+        return languageFromCookie;
+    }
+    const languageFromHeader = headers.get('Accept-Language') ? extractHeaderLanguage(headers.get('Accept-Language')) : undefined;
+    if (languageFromHeader && supportedLanguageKeys.includes(languageFromHeader)) {
+        return languageFromHeader;
+    }
+    return config.i18n.fallbackLanguage;
+};
+
+//# sourceMappingURL=getRequestLanguage.js.map

package/dist/utilities/getRequestLanguage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getRequestLanguage.ts"],"sourcesContent":["import type { AcceptedLanguages } from '@payloadcms/translations'\nimport type { ReadonlyRequestCookies } from 'next/dist/server/web/spec-extension/adapters/request-cookies.js'\n\nimport { extractHeaderLanguage } from '@payloadcms/translations'\n\nimport type { SanitizedConfig } from '../config/types.js'\n\ntype GetRequestLanguageArgs = {\n  config: SanitizedConfig\n  cookies: Map<string, string> | ReadonlyRequestCookies\n  defaultLanguage?: AcceptedLanguages\n  headers: Request['headers']\n}\n\nexport const getRequestLanguage = ({\n  config,\n  cookies,\n  headers,\n}: GetRequestLanguageArgs): AcceptedLanguages => {\n  const supportedLanguageKeys = Object.keys(config.i18n.supportedLanguages) as AcceptedLanguages[]\n  const langCookie = cookies.get(`${config.cookiePrefix || 'payload'}-lng`)\n\n  const languageFromCookie: AcceptedLanguages = (\n    typeof langCookie === 'string' ? langCookie : langCookie?.value\n  ) as AcceptedLanguages\n\n  if (languageFromCookie && supportedLanguageKeys.includes(languageFromCookie)) {\n    return languageFromCookie\n  }\n\n  const languageFromHeader = headers.get('Accept-Language')\n    ? extractHeaderLanguage(headers.get('Accept-Language')!)\n    : undefined\n\n  if (languageFromHeader && supportedLanguageKeys.includes(languageFromHeader)) {\n    return languageFromHeader\n  }\n\n  return config.i18n.fallbackLanguage\n}\n"],"names":["extractHeaderLanguage","getRequestLanguage","config","cookies","headers","supportedLanguageKeys","Object","keys","i18n","supportedLanguages","langCookie","get","cookiePrefix","languageFromCookie","value","includes","languageFromHeader","undefined","fallbackLanguage"],"mappings":"AAGA,SAASA,qBAAqB,QAAQ,2BAA0B;AAWhE,OAAO,MAAMC,qBAAqB,CAAC,EACjCC,MAAM,EACNC,OAAO,EACPC,OAAO,EACgB;IACvB,MAAMC,wBAAwBC,OAAOC,IAAI,CAACL,OAAOM,IAAI,CAACC,kBAAkB;IACxE,MAAMC,aAAaP,QAAQQ,GAAG,CAAC,GAAGT,OAAOU,YAAY,IAAI,UAAU,IAAI,CAAC;IAExE,MAAMC,qBACJ,OAAOH,eAAe,WAAWA,aAAaA,YAAYI;IAG5D,IAAID,sBAAsBR,sBAAsBU,QAAQ,CAACF,qBAAqB;QAC5E,OAAOA;IACT;IAEA,MAAMG,qBAAqBZ,QAAQO,GAAG,CAAC,qBACnCX,sBAAsBI,QAAQO,GAAG,CAAC,sBAClCM;IAEJ,IAAID,sBAAsBX,sBAAsBU,QAAQ,CAACC,qBAAqB;QAC5E,OAAOA;IACT;IAEA,OAAOd,OAAOM,IAAI,CAACU,gBAAgB;AACrC,EAAC"}

package/dist/utilities/getRequestOrigin.d.ts

@@ -0,0 +1,10 @@
+import type { SanitizedConfig } from '../config/types.js';
+import type { PayloadRequest } from '../types/index.js';
+/**
+ * Returns a trusted request origin
+ */
+export declare const getRequestOrigin: ({ config, req, }: {
+    config: Pick<SanitizedConfig, "cors" | "csrf" | "serverURL">;
+    req: Pick<PayloadRequest, "headers" | "payload" | "url">;
+}) => string;
+//# sourceMappingURL=getRequestOrigin.d.ts.map

package/dist/utilities/getRequestOrigin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,qBAG1B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}

package/dist/utilities/getRequestOrigin.js

@@ -0,0 +1,50 @@
+const getTrustedOrigins = (config)=>{
+    const origins = new Set();
+    const { cors, csrf } = config;
+    if (cors === '*') {
+        return null;
+    }
+    if (Array.isArray(cors)) {
+        cors.forEach((o)=>origins.add(o));
+    } else if (cors && typeof cors === 'object') {
+        const corsOrigins = cors.origins;
+        if (corsOrigins === '*') {
+            return null;
+        }
+        if (Array.isArray(corsOrigins)) {
+            corsOrigins.forEach((o)=>origins.add(o));
+        }
+    }
+    if (Array.isArray(csrf)) {
+        csrf.forEach((o)=>origins.add(o));
+    }
+    return [
+        ...origins
+    ];
+};
+/**
+ * Returns a trusted request origin
+ */ export const getRequestOrigin = ({ config, req })=>{
+    if (config.serverURL !== null && config.serverURL !== '') {
+        return config.serverURL;
+    }
+    let origin = '';
+    try {
+        const protocol = new URL(req.url).protocol;
+        const host = req.headers?.get('host');
+        if (host) {
+            origin = `${protocol}//${host}`;
+        }
+    } catch  {
+    // req.url is malformed; origin stays empty
+    }
+    const trustedOrigins = getTrustedOrigins(config);
+    if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {
+        // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.
+        return origin;
+    }
+    req.payload.logger.warn(`Request origin "${origin}" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`);
+    return '';
+};
+
+//# sourceMappingURL=getRequestOrigin.js.map

package/dist/utilities/getRequestOrigin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { CORSConfig, SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' | 'csrf'>): null | string[] => {\n  const origins = new Set<string>()\n\n  const { cors, csrf } = config\n\n  if (cors === '*') {\n    return null\n  }\n\n  if (Array.isArray(cors)) {\n    cors.forEach((o) => origins.add(o))\n  } else if (cors && typeof cors === 'object') {\n    const corsOrigins = (cors as CORSConfig).origins\n    if (corsOrigins === '*') {\n      return null\n    }\n    if (Array.isArray(corsOrigins)) {\n      corsOrigins.forEach((o) => origins.add(o))\n    }\n  }\n\n  if (Array.isArray(csrf)) {\n    csrf.forEach((o) => origins.add(o))\n  }\n\n  return [...origins]\n}\n\n/**\n * Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n  config,\n  req,\n}: {\n  config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>\n  req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n}): string => {\n  if (config.serverURL !== null && config.serverURL !== '') {\n    return config.serverURL\n  }\n\n  let origin = ''\n  try {\n    const protocol = new URL(req.url!).protocol\n    const host = req.headers?.get('host')\n    if (host) {\n      origin = `${protocol}//${host}`\n    }\n  } catch {\n    // req.url is malformed; origin stays empty\n  }\n\n  const trustedOrigins = getTrustedOrigins(config)\n\n  if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n    // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n    return origin\n  }\n\n  req.payload.logger.warn(\n    `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n  )\n\n  return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAc,AAACP,KAAoBF,OAAO;QAChD,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}

package/dist/utilities/getRequestOrigin.spec.js

@@ -0,0 +1,151 @@
+import { describe, expect, it } from 'vitest';
+import { getRequestOrigin } from './getRequestOrigin';
+const makeReq = (url, hostOverride)=>{
+    let host = hostOverride;
+    if (host === undefined) {
+        try {
+            host = new URL(url).host;
+        } catch  {
+            host = undefined;
+        }
+    }
+    return {
+        url,
+        headers: new Headers(host !== undefined ? {
+            host
+        } : {}),
+        payload: {
+            logger: {
+                warn: ()=>{}
+            }
+        }
+    };
+};
+describe('getRequestOrigin', ()=>{
+    describe('when config.serverURL is set', ()=>{
+        it('should return serverURL regardless of Host header', ()=>{
+            const req = makeReq('https://ignored.com/api/forgot-password', 'attacker.com');
+            const result = getRequestOrigin({
+                config: {
+                    serverURL: 'https://myapp.com',
+                    cors: '*',
+                    csrf: []
+                },
+                req
+            });
+            expect(result).toBe('https://myapp.com');
+        });
+    });
+    describe('when config.serverURL is not set', ()=>{
+        describe('CORS allowlist validation', ()=>{
+            it('should return origin when Host header matches a CORS string array entry', ()=>{
+                const req = makeReq('https://myapp.com/api/forgot-password');
+                const result = getRequestOrigin({
+                    config: {
+                        serverURL: '',
+                        cors: [
+                            'https://myapp.com',
+                            'https://other.com'
+                        ],
+                        csrf: []
+                    },
+                    req
+                });
+                expect(result).toBe('https://myapp.com');
+            });
+            it('should return origin when Host header matches a CORSConfig origins entry', ()=>{
+                const req = makeReq('https://myapp.com/api/verify');
+                const result = getRequestOrigin({
+                    config: {
+                        serverURL: '',
+                        cors: {
+                            headers: [],
+                            origins: [
+                                'https://myapp.com'
+                            ]
+                        },
+                        csrf: []
+                    },
+                    req
+                });
+                expect(result).toBe('https://myapp.com');
+            });
+            it('should return empty string when Host header is forged and not in CORS allowlist', ()=>{
+                const req = makeReq('https://myapp.com/api/forgot-password', 'attacker.com');
+                const result = getRequestOrigin({
+                    config: {
+                        serverURL: '',
+                        cors: [
+                            'https://myapp.com'
+                        ],
+                        csrf: []
+                    },
+                    req
+                });
+                expect(result).toBe('');
+            });
+        });
+        describe('CSRF allowlist validation', ()=>{
+            it('should return origin when Host header matches a CSRF entry', ()=>{
+                const req = makeReq('https://myapp.com/api/verify');
+                const result = getRequestOrigin({
+                    config: {
+                        serverURL: '',
+                        cors: [],
+                        csrf: [
+                            'https://myapp.com'
+                        ]
+                    },
+                    req
+                });
+                expect(result).toBe('https://myapp.com');
+            });
+            it('should return origin when Host header is in CSRF but not in CORS', ()=>{
+                const req = makeReq('https://myapp.com/api/verify');
+                const result = getRequestOrigin({
+                    config: {
+                        serverURL: '',
+                        cors: [
+                            'https://other.com'
+                        ],
+                        csrf: [
+                            'https://myapp.com'
+                        ]
+                    },
+                    req
+                });
+                expect(result).toBe('https://myapp.com');
+            });
+        });
+        describe('malformed or missing Host header', ()=>{
+            it('should return empty string when req.url is not a valid URL', ()=>{
+                const req = makeReq('not-a-url');
+                const result = getRequestOrigin({
+                    config: {
+                        serverURL: '',
+                        cors: [],
+                        csrf: []
+                    },
+                    req
+                });
+                expect(result).toBe('');
+            });
+            it('should return empty string when Host header is absent', ()=>{
+                const req = makeReq('https://myapp.com/api/forgot-password', '');
+                const result = getRequestOrigin({
+                    config: {
+                        serverURL: '',
+                        cors: [
+                            'https://myapp.com'
+                        ],
+                        csrf: []
+                    },
+                    req
+                });
+                expect(result).toBe('');
+            });
+        });
+    });
+});
+
+//# sourceMappingURL=getRequestOrigin.spec.js.map

package/dist/utilities/getRequestOrigin.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getRequestOrigin.spec.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { getRequestOrigin } from './getRequestOrigin'\n\ntype MinimalReq = Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n\nconst makeReq = (url: string, hostOverride?: string): MinimalReq => {\n  let host = hostOverride\n  if (host === undefined) {\n    try {\n      host = new URL(url).host\n    } catch {\n      host = undefined\n    }\n  }\n  return {\n    url,\n    headers: new Headers(host !== undefined ? { host } : {}),\n    payload: {\n      logger: {\n        warn: () => {},\n      },\n    },\n  } as unknown as MinimalReq\n}\n\ndescribe('getRequestOrigin', () => {\n  describe('when config.serverURL is set', () => {\n    it('should return serverURL regardless of Host header', () => {\n      const req = makeReq('https://ignored.com/api/forgot-password', 'attacker.com')\n      const result = getRequestOrigin({\n        config: { serverURL: 'https://myapp.com', cors: '*', csrf: [] },\n        req,\n      })\n      expect(result).toBe('https://myapp.com')\n    })\n  })\n\n  describe('when config.serverURL is not set', () => {\n    describe('CORS allowlist validation', () => {\n      it('should return origin when Host header matches a CORS string array entry', () => {\n        const req = makeReq('https://myapp.com/api/forgot-password')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: ['https://myapp.com', 'https://other.com'], csrf: [] },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n\n      it('should return origin when Host header matches a CORSConfig origins entry', () => {\n        const req = makeReq('https://myapp.com/api/verify')\n        const result = getRequestOrigin({\n          config: {\n            serverURL: '',\n            cors: { headers: [], origins: ['https://myapp.com'] },\n            csrf: [],\n          },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n\n      it('should return empty string when Host header is forged and not in CORS allowlist', () => {\n        const req = makeReq('https://myapp.com/api/forgot-password', 'attacker.com')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: ['https://myapp.com'], csrf: [] },\n          req,\n        })\n        expect(result).toBe('')\n      })\n    })\n\n    describe('CSRF allowlist validation', () => {\n      it('should return origin when Host header matches a CSRF entry', () => {\n        const req = makeReq('https://myapp.com/api/verify')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: [], csrf: ['https://myapp.com'] },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n\n      it('should return origin when Host header is in CSRF but not in CORS', () => {\n        const req = makeReq('https://myapp.com/api/verify')\n        const result = getRequestOrigin({\n          config: {\n            serverURL: '',\n            cors: ['https://other.com'],\n            csrf: ['https://myapp.com'],\n          },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n    })\n\n    describe('malformed or missing Host header', () => {\n      it('should return empty string when req.url is not a valid URL', () => {\n        const req = makeReq('not-a-url')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: [], csrf: [] },\n          req,\n        })\n        expect(result).toBe('')\n      })\n\n      it('should return empty string when Host header is absent', () => {\n        const req = makeReq('https://myapp.com/api/forgot-password', '')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: ['https://myapp.com'], csrf: [] },\n          req,\n        })\n        expect(result).toBe('')\n      })\n    })\n  })\n})\n"],"names":["describe","expect","it","getRequestOrigin","makeReq","url","hostOverride","host","undefined","URL","headers","Headers","payload","logger","warn","req","result","config","serverURL","cors","csrf","toBe","origins"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,gBAAgB,QAAQ,qBAAoB;AAIrD,MAAMC,UAAU,CAACC,KAAaC;IAC5B,IAAIC,OAAOD;IACX,IAAIC,SAASC,WAAW;QACtB,IAAI;YACFD,OAAO,IAAIE,IAAIJ,KAAKE,IAAI;QAC1B,EAAE,OAAM;YACNA,OAAOC;QACT;IACF;IACA,OAAO;QACLH;QACAK,SAAS,IAAIC,QAAQJ,SAASC,YAAY;YAAED;QAAK,IAAI,CAAC;QACtDK,SAAS;YACPC,QAAQ;gBACNC,MAAM,KAAO;YACf;QACF;IACF;AACF;AAEAd,SAAS,oBAAoB;IAC3BA,SAAS,gCAAgC;QACvCE,GAAG,qDAAqD;YACtD,MAAMa,MAAMX,QAAQ,2CAA2C;YAC/D,MAAMY,SAASb,iBAAiB;gBAC9Bc,QAAQ;oBAAEC,WAAW;oBAAqBC,MAAM;oBAAKC,MAAM,EAAE;gBAAC;gBAC9DL;YACF;YACAd,OAAOe,QAAQK,IAAI,CAAC;QACtB;IACF;IAEArB,SAAS,oCAAoC;QAC3CA,SAAS,6BAA6B;YACpCE,GAAG,2EAA2E;gBAC5E,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM;4BAAC;4BAAqB;yBAAoB;wBAAEC,MAAM,EAAE;oBAAC;oBACpFL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,4EAA4E;gBAC7E,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBACNC,WAAW;wBACXC,MAAM;4BAAET,SAAS,EAAE;4BAAEY,SAAS;gCAAC;6BAAoB;wBAAC;wBACpDF,MAAM,EAAE;oBACV;oBACAL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,mFAAmF;gBACpF,MAAMa,MAAMX,QAAQ,yCAAyC;gBAC7D,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM;4BAAC;yBAAoB;wBAAEC,MAAM,EAAE;oBAAC;oBAC/DL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;QACF;QAEArB,SAAS,6BAA6B;YACpCE,GAAG,8DAA8D;gBAC/D,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM,EAAE;wBAAEC,MAAM;4BAAC;yBAAoB;oBAAC;oBAC/DL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,oEAAoE;gBACrE,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBACNC,WAAW;wBACXC,MAAM;4BAAC;yBAAoB;wBAC3BC,MAAM;4BAAC;yBAAoB;oBAC7B;oBACAL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;QACF;QAEArB,SAAS,oCAAoC;YAC3CE,GAAG,8DAA8D;gBAC/D,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM,EAAE;wBAAEC,MAAM,EAAE;oBAAC;oBAC5CL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,yDAAyD;gBAC1D,MAAMa,MAAMX,QAAQ,yCAAyC;gBAC7D,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM;4BAAC;yBAAoB;wBAAEC,MAAM,EAAE;oBAAC;oBAC/DL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;QACF;IACF;AACF"}

package/dist/utilities/getSafeRedirect.d.ts

@@ -0,0 +1,6 @@
+export declare const getSafeRedirect: ({ allowAbsoluteUrls, fallbackTo, redirectTo, }: {
+    allowAbsoluteUrls?: boolean;
+    fallbackTo?: string;
+    redirectTo: string | string[];
+}) => string;
+//# sourceMappingURL=getSafeRedirect.d.ts.map

package/dist/utilities/getSafeRedirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,mDAIzB;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAmCH,CAAA"}

package/dist/utilities/getSafeRedirect.js

@@ -0,0 +1,25 @@
+export const getSafeRedirect = ({ allowAbsoluteUrls = false, fallbackTo = '/', redirectTo })=>{
+    if (typeof redirectTo !== 'string') {
+        return fallbackTo;
+    }
+    // Normalize and decode the path
+    let redirectPath;
+    try {
+        redirectPath = decodeURIComponent(redirectTo.trim());
+    } catch  {
+        return fallbackTo // invalid encoding
+        ;
+    }
+    const isSafeRedirect = // Must start with a single forward slash (e.g., "/admin")
+    redirectPath.startsWith('/') && // Prevent protocol-relative URLs (e.g., "//example.com")
+    !redirectPath.startsWith('//') && // Prevent encoded slashes that could resolve to protocol-relative
+    !redirectPath.startsWith('/%2F') && // Prevent backslash-based escape attempts (e.g., "/\\/example.com", "/\\\\example.com", "/\\example.com")
+    !redirectPath.startsWith('/\\/') && !redirectPath.startsWith('/\\\\') && !redirectPath.startsWith('/\\') && // Prevent javascript-based schemes (e.g., "/javascript:alert(1)")
+    !redirectPath.toLowerCase().startsWith('/javascript:') && // Prevent attempts to redirect to full URLs using "/http:" or "/https:"
+    !redirectPath.toLowerCase().startsWith('/http');
+    const isAbsoluteSafeRedirect = allowAbsoluteUrls && // Must be a valid absolute URL with http or https
+    /^https?:\/\/\S+$/i.test(redirectPath);
+    return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo;
+};
+
+//# sourceMappingURL=getSafeRedirect.js.map

package/dist/utilities/getSafeRedirect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  // Normalize and decode the path\n  let redirectPath: string\n  try {\n    redirectPath = decodeURIComponent(redirectTo.trim())\n  } catch {\n    return fallbackTo // invalid encoding\n  }\n\n  const isSafeRedirect =\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath)\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","decodeURIComponent","trim","isSafeRedirect","startsWith","toLowerCase","isAbsoluteSafeRedirect","test"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,gCAAgC;IAChC,IAAIE;IACJ,IAAI;QACFA,eAAeC,mBAAmBF,WAAWG,IAAI;IACnD,EAAE,OAAM;QACN,OAAOJ,WAAW,mBAAmB;;IACvC;IAEA,MAAMK,iBACJ,0DAA0D;IAC1DH,aAAaI,UAAU,CAAC,QACxB,yDAAyD;IACzD,CAACJ,aAAaI,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACJ,aAAaI,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACJ,aAAaI,UAAU,CAAC,WACzB,CAACJ,aAAaI,UAAU,CAAC,YACzB,CAACJ,aAAaI,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC;IAEzC,MAAME,yBACJT,qBACA,kDAAkD;IAClD,oBAAoBU,IAAI,CAACP;IAE3B,OAAOG,kBAAkBG,yBAAyBN,eAAeF;AACnE,EAAC"}