@dyrected/core 2.5.41 → 2.5.43

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './index-DfkPT4NR.cjs';
-export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './index-DfkPT4NR.cjs';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './app-config-2vF6W56z.cjs';
+export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './app-config-2vF6W56z.cjs';
 import 'lucide-react';
 
 type Prettify<T> = {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './index-DfkPT4NR.js';
-export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './index-DfkPT4NR.js';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './app-config-2vF6W56z.js';
+export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './app-config-2vF6W56z.js';
 import 'lucide-react';
 
 type Prettify<T> = {

package/dist/server.cjs

@@ -2137,11 +2137,12 @@ var AdminAuthController = class {
     return c.json(getPublicAdminAuthConfig(this.config.adminAuth));
   }
   async start(c) {
-    const provider = this.getProvider(c.req.param("provider"));
+    const requestConfig = await this.getRequestConfig(c);
+    const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
       return c.json({ error: true, message: "Admin auth provider not found." }, 404);
     }
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const siteId = this.getSiteId(c);
     const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
     if (provider.type === "oidc") {
       const redirectUrl = await this.buildOidcStartUrl(
@@ -2155,19 +2156,29 @@ var AdminAuthController = class {
     if (!provider.startUrl) {
       return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
     }
-    const url = new URL(provider.startUrl);
+    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    if (!url) {
+      return c.json(
+        {
+          error: true,
+          message: `Admin auth provider "${provider.id}" has an invalid start URL.`
+        },
+        500
+      );
+    }
     url.searchParams.set("returnTo", returnTo);
     if (siteId) url.searchParams.set("siteId", siteId);
     url.searchParams.set("provider", provider.id);
     return c.redirect(url.toString(), 302);
   }
   async callback(c) {
-    const provider = this.getProvider(c.req.param("provider"));
+    const requestConfig = await this.getRequestConfig(c);
+    const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
       return c.json({ error: true, message: "Admin auth provider not found." }, 404);
     }
     try {
-      const exchange = await this.completeProviderAuth(provider, c);
+      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
       const redirectUrl = new URL(exchange.returnTo);
       redirectUrl.searchParams.set("dyrectedExternalToken", exchange.token);
       redirectUrl.searchParams.set("dyrectedAdminCollection", exchange.collectionSlug);
@@ -2181,12 +2192,13 @@ var AdminAuthController = class {
     }
   }
   async exchange(c) {
-    const provider = this.getProvider(c.req.param("provider"));
+    const requestConfig = await this.getRequestConfig(c);
+    const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
       return c.json({ error: true, message: "Admin auth provider not found." }, 404);
     }
     try {
-      const exchange = await this.completeProviderAuth(provider, c);
+      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
       return c.json({
         token: exchange.token,
         collectionSlug: exchange.collectionSlug,
@@ -2201,15 +2213,15 @@ var AdminAuthController = class {
   async logout(c) {
     return c.json({ success: true, message: "Logged out. Discard your token." });
   }
-  getProvider(id) {
-    if (this.config.adminAuth?.mode !== "external") return void 0;
-    return this.config.adminAuth.providers.find((provider) => provider.id === id);
+  getProvider(config, id) {
+    if (config.adminAuth?.mode !== "external") return void 0;
+    return config.adminAuth.providers.find((provider) => provider.id === id);
   }
-  async completeProviderAuth(provider, c) {
+  async completeProviderAuth(requestConfig, provider, c) {
     const resolved = provider.type === "oidc" ? await this.resolveOidcIdentity(provider, c) : await this.resolveCustomIdentity(provider, c);
     const identity = resolved.identity;
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-    const adminCollection = getAdminAuthCollection(this.config);
+    const siteId = this.getSiteId(c);
+    const adminCollection = getAdminAuthCollection(requestConfig);
     if (!adminCollection?.auth) {
       throw new Error("Admin auth collection is not configured.");
     }
@@ -2220,12 +2232,12 @@ var AdminAuthController = class {
       where: { email: identity.email },
       limit: 1
     })).docs[0] : null);
-    const provisioningMode = this.config.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
+    const provisioningMode = requestConfig.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
     const allowJitProvisioning = provisioningMode !== "preprovisioned_only" && provider.allowJitProvisioning !== false;
     if (!user && !allowJitProvisioning) {
       throw new Error("This account has not been provisioned for admin access.");
     }
-    const access = await this.resolveAccess(identity, provider.id, siteId, c, user);
+    const access = await this.resolveAccess(requestConfig, identity, provider.id, siteId, c, user);
     if (!access.allowed) {
       throw new Error("Access denied for this site.");
     }
@@ -2260,8 +2272,8 @@ var AdminAuthController = class {
       returnTo: resolved.returnTo
     };
   }
-  async resolveAccess(identity, providerId, siteId, c, user) {
-    const resolved = await this.config.adminAuth?.resolveAccess?.({
+  async resolveAccess(requestConfig, identity, providerId, siteId, c, user) {
+    const resolved = await requestConfig.adminAuth?.resolveAccess?.({
       identity,
       providerId,
       siteId,
@@ -2300,6 +2312,21 @@ var AdminAuthController = class {
     });
     return result.docs[0] ?? null;
   }
+  getSiteId(c) {
+    return c.req.header("X-Site-Id") || c.get("siteId");
+  }
+  async getRequestConfig(c) {
+    const siteId = this.getSiteId(c);
+    if (!siteId || !this.config.onSchemaFetch) return this.config;
+    const dynamic = await this.config.onSchemaFetch(siteId);
+    return {
+      ...this.config,
+      ...dynamic.admin ? { admin: { ...this.config.admin, ...dynamic.admin } } : {},
+      ...dynamic.adminAuth ? { adminAuth: { ...this.config.adminAuth, ...dynamic.adminAuth } } : {},
+      collections: dynamic.collections ? [...this.config.collections, ...dynamic.collections] : this.config.collections,
+      globals: dynamic.globals ? [...this.config.globals, ...dynamic.globals] : this.config.globals
+    };
+  }
   async buildOidcStartUrl(provider, returnTo, siteId, origin) {
     const discovery = await this.getOidcDiscovery(provider);
     const nonce = (0, import_node_crypto2.randomBytes)(16).toString("hex");
@@ -2452,6 +2479,17 @@ var AdminAuthController = class {
   defaultCallbackPath(providerId, origin = "") {
     return `${origin}/api/admin/auth/${providerId}/callback`;
   }
+  buildCustomProviderStartUrl(startUrl, origin) {
+    const value = startUrl.trim();
+    if (!value || /^(undefined|null)(\/|$)/i.test(value)) return null;
+    try {
+      const url = new URL(value, origin);
+      if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+      return url;
+    } catch {
+      return null;
+    }
+  }
   async signState(payload) {
     return new import_jose2.SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
   }

package/dist/server.d.cts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DfkPT4NR.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-2vF6W56z.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DfkPT4NR.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-2vF6W56z.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.js

@@ -1636,11 +1636,12 @@ var AdminAuthController = class {
     return c.json(getPublicAdminAuthConfig(this.config.adminAuth));
   }
   async start(c) {
-    const provider = this.getProvider(c.req.param("provider"));
+    const requestConfig = await this.getRequestConfig(c);
+    const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
       return c.json({ error: true, message: "Admin auth provider not found." }, 404);
     }
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const siteId = this.getSiteId(c);
     const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
     if (provider.type === "oidc") {
       const redirectUrl = await this.buildOidcStartUrl(
@@ -1654,19 +1655,29 @@ var AdminAuthController = class {
     if (!provider.startUrl) {
       return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
     }
-    const url = new URL(provider.startUrl);
+    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    if (!url) {
+      return c.json(
+        {
+          error: true,
+          message: `Admin auth provider "${provider.id}" has an invalid start URL.`
+        },
+        500
+      );
+    }
     url.searchParams.set("returnTo", returnTo);
     if (siteId) url.searchParams.set("siteId", siteId);
     url.searchParams.set("provider", provider.id);
     return c.redirect(url.toString(), 302);
   }
   async callback(c) {
-    const provider = this.getProvider(c.req.param("provider"));
+    const requestConfig = await this.getRequestConfig(c);
+    const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
       return c.json({ error: true, message: "Admin auth provider not found." }, 404);
     }
     try {
-      const exchange = await this.completeProviderAuth(provider, c);
+      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
       const redirectUrl = new URL(exchange.returnTo);
       redirectUrl.searchParams.set("dyrectedExternalToken", exchange.token);
       redirectUrl.searchParams.set("dyrectedAdminCollection", exchange.collectionSlug);
@@ -1680,12 +1691,13 @@ var AdminAuthController = class {
     }
   }
   async exchange(c) {
-    const provider = this.getProvider(c.req.param("provider"));
+    const requestConfig = await this.getRequestConfig(c);
+    const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
       return c.json({ error: true, message: "Admin auth provider not found." }, 404);
     }
     try {
-      const exchange = await this.completeProviderAuth(provider, c);
+      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
       return c.json({
         token: exchange.token,
         collectionSlug: exchange.collectionSlug,
@@ -1700,15 +1712,15 @@ var AdminAuthController = class {
   async logout(c) {
     return c.json({ success: true, message: "Logged out. Discard your token." });
   }
-  getProvider(id) {
-    if (this.config.adminAuth?.mode !== "external") return void 0;
-    return this.config.adminAuth.providers.find((provider) => provider.id === id);
+  getProvider(config, id) {
+    if (config.adminAuth?.mode !== "external") return void 0;
+    return config.adminAuth.providers.find((provider) => provider.id === id);
   }
-  async completeProviderAuth(provider, c) {
+  async completeProviderAuth(requestConfig, provider, c) {
     const resolved = provider.type === "oidc" ? await this.resolveOidcIdentity(provider, c) : await this.resolveCustomIdentity(provider, c);
     const identity = resolved.identity;
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-    const adminCollection = getAdminAuthCollection(this.config);
+    const siteId = this.getSiteId(c);
+    const adminCollection = getAdminAuthCollection(requestConfig);
     if (!adminCollection?.auth) {
       throw new Error("Admin auth collection is not configured.");
     }
@@ -1719,12 +1731,12 @@ var AdminAuthController = class {
       where: { email: identity.email },
       limit: 1
     })).docs[0] : null);
-    const provisioningMode = this.config.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
+    const provisioningMode = requestConfig.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
     const allowJitProvisioning = provisioningMode !== "preprovisioned_only" && provider.allowJitProvisioning !== false;
     if (!user && !allowJitProvisioning) {
       throw new Error("This account has not been provisioned for admin access.");
     }
-    const access = await this.resolveAccess(identity, provider.id, siteId, c, user);
+    const access = await this.resolveAccess(requestConfig, identity, provider.id, siteId, c, user);
     if (!access.allowed) {
       throw new Error("Access denied for this site.");
     }
@@ -1759,8 +1771,8 @@ var AdminAuthController = class {
       returnTo: resolved.returnTo
     };
   }
-  async resolveAccess(identity, providerId, siteId, c, user) {
-    const resolved = await this.config.adminAuth?.resolveAccess?.({
+  async resolveAccess(requestConfig, identity, providerId, siteId, c, user) {
+    const resolved = await requestConfig.adminAuth?.resolveAccess?.({
       identity,
       providerId,
       siteId,
@@ -1799,6 +1811,21 @@ var AdminAuthController = class {
     });
     return result.docs[0] ?? null;
   }
+  getSiteId(c) {
+    return c.req.header("X-Site-Id") || c.get("siteId");
+  }
+  async getRequestConfig(c) {
+    const siteId = this.getSiteId(c);
+    if (!siteId || !this.config.onSchemaFetch) return this.config;
+    const dynamic = await this.config.onSchemaFetch(siteId);
+    return {
+      ...this.config,
+      ...dynamic.admin ? { admin: { ...this.config.admin, ...dynamic.admin } } : {},
+      ...dynamic.adminAuth ? { adminAuth: { ...this.config.adminAuth, ...dynamic.adminAuth } } : {},
+      collections: dynamic.collections ? [...this.config.collections, ...dynamic.collections] : this.config.collections,
+      globals: dynamic.globals ? [...this.config.globals, ...dynamic.globals] : this.config.globals
+    };
+  }
   async buildOidcStartUrl(provider, returnTo, siteId, origin) {
     const discovery = await this.getOidcDiscovery(provider);
     const nonce = randomBytes2(16).toString("hex");
@@ -1951,6 +1978,17 @@ var AdminAuthController = class {
   defaultCallbackPath(providerId, origin = "") {
     return `${origin}/api/admin/auth/${providerId}/callback`;
   }
+  buildCustomProviderStartUrl(startUrl, origin) {
+    const value = startUrl.trim();
+    if (!value || /^(undefined|null)(\/|$)/i.test(value)) return null;
+    try {
+      const url = new URL(value, origin);
+      if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+      return url;
+    } catch {
+      return null;
+    }
+  }
   async signState(payload) {
     return new SignJWT2(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.5.41",
+  "version": "2.5.43",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",