@next-buildr/payload 2.0.0 → 3.0.0-rc.0

package/dist/plugin/plugin.test.js

@@ -1,11 +1,12 @@
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createEmptyDocument } from '@next-buildr/core';
+import { createEmptyDocument, createRegistryMeta } from '@next-buildr/core';
 import { sqliteAdapter } from '@payloadcms/db-sqlite';
 import { buildConfig, getPayload } from 'payload';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
 import { buildrPlugin } from './index.js';
+import { resolveOptions } from './options.js';
 import { BUILDR_WRITE } from './write-guard.js';
 const pages = {
     slug: 'pages',
@@ -16,6 +17,84 @@ const layoutOf = (name) => ({
     ...createEmptyDocument(),
     nodes: { root: { id: 'root', type: 'buildr/page', name } },
 });
+describe('captcha options', () => {
+    const secret = 'never-echo-this-secret';
+    const valid = {
+        collections: {},
+        forms: {
+            enabled: true,
+            clientIp: { header: 'trusted-ip' },
+            captcha: { secretKey: secret, hostnames: ['example.com'] },
+        },
+    };
+    it('ignores unknown forms keys as before', () => {
+        expect(resolveOptions({ collections: {}, forms: { legacy: true } }).forms
+            .enabled).toBe(false);
+    });
+    it('keeps verifier implementation out of the public entry', async () => {
+        const entry = await import('./index.js');
+        expect(entry).not.toHaveProperty('createTurnstileVerifier');
+    });
+    it('serialises no captcha secret and preserves the host onInit hook', async () => {
+        const onInit = vi.fn();
+        const config = await buildrPlugin({
+            ...valid,
+            registry: { meta: createRegistryMeta({ components: [] }) },
+        })({ collections: [], onInit });
+        expect(JSON.stringify(config)).not.toContain(secret);
+        const payload = { logger: { error: vi.fn(), warn: vi.fn() } };
+        await config.onInit?.(payload);
+        expect(onInit).toHaveBeenCalledExactlyOnceWith(payload);
+    });
+    it('applies provider, concurrency and trusted hop defaults; accepts a request callback', () => {
+        expect(resolveOptions(valid).forms).toMatchObject({
+            captcha: { provider: 'turnstile', maxInFlight: 16 },
+            clientIp: { hops: 1 },
+        });
+        const callback = () => '192.0.2.1';
+        expect(resolveOptions({ ...valid, forms: { ...valid.forms, clientIp: callback } }).forms.clientIp).toBe(callback);
+    });
+    it.each([
+        { enabled: false },
+        { clientIp: undefined },
+        { captcha: { secretKey: secret } },
+        { captcha: { secretKey: secret, hostnames: [] } },
+        ...[
+            '.',
+            '..',
+            '-',
+            'example.com.',
+            '-example.com',
+            'example-.com',
+            `${'a'.repeat(64)}.com`,
+            'EXAMPLE.COM',
+            'https://example.com',
+            'example.com:443',
+            'example.com/path',
+            'a'.repeat(254),
+            'example.com\n',
+        ].map((hostname) => ({ captcha: { secretKey: secret, hostnames: [hostname] } })),
+        ...[0, 1.5, 1025].map((maxInFlight) => ({ captcha: { ...valid.forms.captcha, maxInFlight } })),
+        { captcha: { ...valid.forms.captcha, secretKey: '' } },
+        { captcha: { ...valid.forms.captcha, provider: 'other' } },
+        { captcha: { ...valid.forms.captcha, verifier: { verify() { } } } },
+        { captcha: { ...valid.forms.captcha, [secret]: true } },
+        ...['X-Forwarded-For', '', 'a b', 'valid\n', 'x'.repeat(65)].map((header) => ({
+            clientIp: { header },
+        })),
+        ...[0, -1, 1.5].map((hops) => ({ clientIp: { header: 'trusted-ip', hops } })),
+    ])('rejects invalid captcha configuration without exposing the secret', (change) => {
+        let message = '';
+        try {
+            resolveOptions({ ...valid, forms: { ...valid.forms, ...change } });
+        }
+        catch (error) {
+            message = error.message;
+        }
+        expect(message).toContain('buildrPlugin: invalid options');
+        expect(message).not.toContain(secret);
+    });
+});
 let dir;
 const configOf = (options, collections = [pages]) => buildConfig({
     secret: 'test-secret',

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@next-buildr/payload",
-  "version": "2.0.0",
+  "version": "3.0.0-rc.0",
   "private": false,
+  "license": "MIT",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -39,16 +40,17 @@
     "access": "public"
   },
   "files": [
-    "dist"
+    "dist",
+    "UPGRADING.md"
   ],
   "dependencies": {
-    "@next-buildr/core": "2.0.0",
+    "@next-buildr/core": "3.0.0-rc.0",
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@next-buildr/editor": "2.0.0",
-    "@next-buildr/mcp": "2.0.0",
-    "@next-buildr/next": "2.0.0",
+    "@next-buildr/editor": "3.0.0-rc.0",
+    "@next-buildr/mcp": "3.0.0-rc.0",
+    "@next-buildr/next": "3.0.0-rc.0",
     "@modelcontextprotocol/sdk": "^1.30.1",
     "@payloadcms/ui": "^3.0.0",
     "next": "^15.0.0 || ^16.0.0",
@@ -78,11 +80,11 @@
     }
   },
   "devDependencies": {
-    "@next-buildr/editor": "2.0.0",
-    "@next-buildr/mcp": "2.0.0",
-    "@next-buildr/next": "2.0.0",
-    "@next-buildr/test-utils": "2.0.0",
-    "@next-buildr/tsconfig": "2.0.0",
+    "@next-buildr/editor": "3.0.0-rc.0",
+    "@next-buildr/mcp": "3.0.0-rc.0",
+    "@next-buildr/next": "3.0.0-rc.0",
+    "@next-buildr/test-utils": "3.0.0-rc.0",
+    "@next-buildr/tsconfig": "3.0.0-rc.0",
     "@modelcontextprotocol/sdk": "^1.30.1",
     "@payloadcms/db-sqlite": "3.90.1",
     "@payloadcms/ui": "3.90.1",