@payloadcms/figma 0.0.1-alpha.0 → 0.0.1-alpha.10

package/dist/oauth/defaults.js

@@ -0,0 +1,91 @@
+import { v4 as uuid } from 'uuid';
+import { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js';
+export const defaultScope = [
+    'openid',
+    'profile',
+    'email'
+];
+export const defaultUsernameField = {
+    name: 'preferredUsername',
+    type: 'text',
+    admin: {
+        position: 'sidebar',
+        readOnly: true
+    },
+    unique: true
+};
+export const defaultVerify = ({ collection, strategyName, usernameField })=>async ({ payload, token })=>{
+        let tokenUsername = 'preferred_username';
+        if (usernameField.name !== 'preferredUsername') {
+            tokenUsername = usernameField.name;
+        }
+        if (!token[tokenUsername]) {
+            return {
+                user: null
+            };
+        }
+        let user = null;
+        const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined;
+        try {
+            const results = await payload.find({
+                collection: collection.slug,
+                depth,
+                limit: 1,
+                pagination: false,
+                where: {
+                    [usernameField.name]: {
+                        equals: token[tokenUsername]
+                    }
+                }
+            });
+            if (results.docs.length > 0) {
+                user = results.docs[0];
+                // Update user with new token data
+                if (hasUserTokenPropsChanged(user, token)) {
+                    user = await payload.update({
+                        id: user.id,
+                        collection: collection.slug,
+                        data: {
+                            ...token
+                        },
+                        depth
+                    });
+                }
+            } else {
+                const newUser = {
+                    email: token.preferredUsername || token.email,
+                    [usernameField.name]: token[tokenUsername],
+                    ...token
+                };
+                if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {
+                    newUser.password = uuid();
+                }
+                user = await payload.create({
+                    collection: collection.slug,
+                    data: newUser,
+                    depth
+                });
+            }
+        } catch (err) {
+            payload.logger.error({
+                err,
+                msg: 'Error verifying user from defaultVerify.'
+            });
+            return {
+                user: null
+            };
+        }
+        if (user) {
+            user.collection = collection.slug;
+            user._strategy = strategyName;
+            user.exp = token.exp;
+            return {
+                user
+            };
+        }
+        return {
+            user: null
+        };
+    };
+
+//# sourceMappingURL=defaults.js.map

package/dist/oauth/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/oauth/defaults.ts"],"sourcesContent":["import type { CollectionConfig, EmailField, TextField, User } from 'payload'\n\nimport { v4 as uuid } from 'uuid'\n\nimport type { VerifyFunction } from './types.js'\n\nimport { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js'\n\nexport const defaultScope = ['openid', 'profile', 'email']\n\nexport const defaultUsernameField: TextField = {\n  name: 'preferredUsername',\n  type: 'text',\n  admin: {\n    position: 'sidebar',\n    readOnly: true,\n  },\n  unique: true,\n}\n\nexport const defaultVerify =\n  ({\n    collection,\n    strategyName,\n    usernameField,\n  }: {\n    collection: CollectionConfig\n    strategyName: string\n    usernameField: EmailField | TextField\n  }): VerifyFunction =>\n  async ({ payload, token }) => {\n    let tokenUsername = 'preferred_username'\n\n    if (usernameField.name !== 'preferredUsername') {\n      tokenUsername = usernameField.name\n    }\n\n    if (!token[tokenUsername]) {\n      return {\n        user: null,\n      }\n    }\n\n    let user: null | User = null\n    const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined\n\n    try {\n      const results = await payload.find({\n        collection: collection.slug,\n        depth,\n        limit: 1,\n        pagination: false,\n        where: {\n          [usernameField.name]: { equals: token[tokenUsername] },\n        },\n      })\n\n      if (results.docs.length > 0) {\n        user = results.docs[0] as User\n        // Update user with new token data\n        if (hasUserTokenPropsChanged(user, token)) {\n          user = (await payload.update({\n            id: user.id,\n            collection: collection.slug,\n            data: {\n              ...token,\n            },\n            depth,\n          })) as User\n        }\n      } else {\n        const newUser = {\n          email: token.preferredUsername || token.email,\n          [usernameField.name]: token[tokenUsername],\n          ...token,\n        }\n\n        if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {\n          newUser.password = uuid()\n        }\n\n        user = (await payload.create({\n          collection: collection.slug,\n          data: newUser,\n          depth,\n        })) as User\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying user from defaultVerify.',\n      })\n      return {\n        user: null,\n      }\n    }\n\n    if (user) {\n      user.collection = collection.slug\n      user._strategy = strategyName\n      user.exp = token.exp\n\n      return {\n        user,\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n"],"names":["v4","uuid","hasUserTokenPropsChanged","defaultScope","defaultUsernameField","name","type","admin","position","readOnly","unique","defaultVerify","collection","strategyName","usernameField","payload","token","tokenUsername","user","depth","auth","undefined","results","find","slug","limit","pagination","where","equals","docs","length","update","id","data","newUser","email","preferredUsername","disableLocalStrategy","password","create","err","logger","error","msg","_strategy","exp"],"mappings":"AAEA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAIjC,SAASC,wBAAwB,QAAQ,0CAAyC;AAElF,OAAO,MAAMC,eAAe;IAAC;IAAU;IAAW;CAAQ,CAAA;AAE1D,OAAO,MAAMC,uBAAkC;IAC7CC,MAAM;IACNC,MAAM;IACNC,OAAO;QACLC,UAAU;QACVC,UAAU;IACZ;IACAC,QAAQ;AACV,EAAC;AAED,OAAO,MAAMC,gBACX,CAAC,EACCC,UAAU,EACVC,YAAY,EACZC,aAAa,EAKd,GACD,OAAO,EAAEC,OAAO,EAAEC,KAAK,EAAE;QACvB,IAAIC,gBAAgB;QAEpB,IAAIH,cAAcT,IAAI,KAAK,qBAAqB;YAC9CY,gBAAgBH,cAAcT,IAAI;QACpC;QAEA,IAAI,CAACW,KAAK,CAACC,cAAc,EAAE;YACzB,OAAO;gBACLC,MAAM;YACR;QACF;QAEA,IAAIA,OAAoB;QACxB,MAAMC,QAAQ,OAAOP,WAAWQ,IAAI,KAAK,WAAWR,WAAWQ,IAAI,CAACD,KAAK,GAAGE;QAE5E,IAAI;YACF,MAAMC,UAAU,MAAMP,QAAQQ,IAAI,CAAC;gBACjCX,YAAYA,WAAWY,IAAI;gBAC3BL;gBACAM,OAAO;gBACPC,YAAY;gBACZC,OAAO;oBACL,CAACb,cAAcT,IAAI,CAAC,EAAE;wBAAEuB,QAAQZ,KAAK,CAACC,cAAc;oBAAC;gBACvD;YACF;YAEA,IAAIK,QAAQO,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC3BZ,OAAOI,QAAQO,IAAI,CAAC,EAAE;gBACtB,kCAAkC;gBAClC,IAAI3B,yBAAyBgB,MAAMF,QAAQ;oBACzCE,OAAQ,MAAMH,QAAQgB,MAAM,CAAC;wBAC3BC,IAAId,KAAKc,EAAE;wBACXpB,YAAYA,WAAWY,IAAI;wBAC3BS,MAAM;4BACJ,GAAGjB,KAAK;wBACV;wBACAG;oBACF;gBACF;YACF,OAAO;gBACL,MAAMe,UAAU;oBACdC,OAAOnB,MAAMoB,iBAAiB,IAAIpB,MAAMmB,KAAK;oBAC7C,CAACrB,cAAcT,IAAI,CAAC,EAAEW,KAAK,CAACC,cAAc;oBAC1C,GAAGD,KAAK;gBACV;gBAEA,IAAI,OAAOJ,WAAWQ,IAAI,KAAK,YAAY,CAACR,WAAWQ,IAAI,CAACiB,oBAAoB,EAAE;oBAChFH,QAAQI,QAAQ,GAAGrC;gBACrB;gBAEAiB,OAAQ,MAAMH,QAAQwB,MAAM,CAAC;oBAC3B3B,YAAYA,WAAWY,IAAI;oBAC3BS,MAAMC;oBACNf;gBACF;YACF;QACF,EAAE,OAAOqB,KAAc;YACrBzB,QAAQ0B,MAAM,CAACC,KAAK,CAAC;gBACnBF;gBACAG,KAAK;YACP;YACA,OAAO;gBACLzB,MAAM;YACR;QACF;QAEA,IAAIA,MAAM;YACRA,KAAKN,UAAU,GAAGA,WAAWY,IAAI;YACjCN,KAAK0B,SAAS,GAAG/B;YACjBK,KAAK2B,GAAG,GAAG7B,MAAM6B,GAAG;YAEpB,OAAO;gBACL3B;YACF;QACF;QAEA,OAAO;YACLA,MAAM;QACR;IACF,EAAC"}

package/dist/oauth/endpoints/getLoginEndpoint.d.ts

@@ -0,0 +1,13 @@
+import type { CollectionConfig, Endpoint } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { CollectionOptions, PluginOptions } from '../types.js';
+interface Args {
+    collection: CollectionConfig;
+    collectionOptions: CollectionOptions;
+    endpointSlug: string;
+    pluginOptions: PluginOptions;
+    strategy: Strategy;
+}
+export declare const getLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
+export {};
+//# sourceMappingURL=getLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getLoginEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getLoginEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getLoginEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAMzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAEV,iBAAiB,EACjB,aAAa,EAEd,MAAM,aAAa,CAAA;AAcpB,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAID,eAAO,MAAM,gBAAgB,8EAM1B,IAAI,KAAG,QA+OR,CAAA"}

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -0,0 +1,237 @@
+import { APIError, generateCookie, parseCookies } from 'payload';
+import { getSafeRedirect } from 'payload/shared';
+import { getProjectToken } from '../../api/figma-api.js';
+import { createCookieOptions } from '../utilities/createCookieOptions.js';
+import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { extractOrigin } from '../utilities/extractOrigin.js';
+import { getAdminPath } from '../utilities/getAdminPath.js';
+import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
+const isAbsoluteURL = (url)=>/^[a-z][a-z\d+.-]*:/.test(url);
+export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
+        handler: async (req)=>{
+            const { config } = req.payload;
+            const adminPath = getAdminPath(config);
+            try {
+                await strategy.ensureMeta();
+                const path = req.pathname;
+                const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
+                let jsonBody = {};
+                const contentType = req.headers.get('content-type');
+                // Type narrow PayloadRequst's Partial<Request>
+                if (typeof req.json !== 'function' || typeof req.formData !== 'function') {
+                    debugLogger.info({
+                        msg: 'Request does not have json or formData methods',
+                        path
+                    });
+                    return Response.redirect(`${pluginOptions.redirectServerURL || config.serverURL}/login`);
+                }
+                if (collectionOptions.authorizationURLParams?.response_mode === 'query') {
+                    if (Object.keys(req.query).length > 0) {
+                        jsonBody = req.query;
+                    }
+                } else if (contentType === 'application/json') {
+                    jsonBody = await req.json();
+                } else if (contentType === 'application/x-www-form-urlencoded') {
+                    const formData = await req.formData();
+                    jsonBody = Object.fromEntries(formData.entries());
+                }
+                const stateRaw = jsonBody.state;
+                const state = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'));
+                const redirectDestination = state.serverURL || pluginOptions.redirectServerURL || config.serverURL;
+                let failedRedirect = `${redirectDestination}${adminPath}/login`;
+                let redirectToUse = `${redirectDestination}${adminPath}`;
+                if (state.redirect) {
+                    redirectToUse = state.redirect;
+                }
+                if (state.failedRedirect) {
+                    failedRedirect = state.failedRedirect;
+                }
+                failedRedirect = getSafeRedirect({
+                    allowAbsoluteUrls: true,
+                    redirectTo: failedRedirect
+                });
+                redirectToUse = getSafeRedirect({
+                    allowAbsoluteUrls: true,
+                    redirectTo: redirectToUse
+                });
+                if (!isAbsoluteURL(failedRedirect)) {
+                    return Response.json({
+                        error: 'Invalid failed redirect provided'
+                    }, {
+                        status: 403
+                    });
+                }
+                if (!isAbsoluteURL(redirectToUse)) {
+                    return Response.json({
+                        error: 'Invalid redirect provided'
+                    }, {
+                        status: 403
+                    });
+                }
+                if (Array.isArray(req.payload.config.csrf) && req.payload.config.csrf.length > 0) {
+                    const failedRedirectOrigin = extractOrigin(failedRedirect);
+                    const redirectToUseOrigin = extractOrigin(redirectToUse);
+                    if (failedRedirectOrigin && !req.payload.config.csrf.includes(failedRedirectOrigin)) {
+                        req.payload.logger.error(`Failed redirect origin ${failedRedirectOrigin} is not allowed by CSRF configuration.`);
+                        return Response.json({
+                            error: 'Failed redirect origin is not allowed by CSRF configuration.'
+                        }, {
+                            status: 403
+                        });
+                    }
+                    if (redirectToUseOrigin && !req.payload.config.csrf.includes(redirectToUseOrigin)) {
+                        req.payload.logger.error(`Redirect origin ${redirectToUseOrigin} is not allowed by CSRF configuration.`);
+                        return Response.json({
+                            error: 'Redirect origin is not allowed by CSRF configuration.'
+                        }, {
+                            status: 403
+                        });
+                    }
+                }
+                // Verify signature
+                if (strategy.name !== req.payload.decrypt(state.sig)) {
+                    req.payload.logger.error('Signature mismatch. Failing login and redirecting.');
+                    return Response.redirect(failedRedirect);
+                }
+                if (!strategy.meta?.token_endpoint) {
+                    debugLogger.error({
+                        msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,
+                        path
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                debugLogger.info({
+                    body: jsonBody,
+                    msg: 'Received login response body',
+                    path
+                });
+                if (!jsonBody?.code) {
+                    debugLogger.error({
+                        msg: `No authorization code present in body. Failing login and redirecting.`,
+                        path
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                // Exchange `code` from body for refresh token
+                const { code } = jsonBody;
+                if (typeof code !== 'string') {
+                    debugLogger.error({
+                        msg: `Authorization code present in body is not a string. Failing login and redirecting.`,
+                        path
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                const body = {
+                    client_id: strategy.clientID,
+                    code,
+                    code_verifier: req.payload.decrypt(state.verifier),
+                    grant_type: 'authorization_code',
+                    redirect_uri: `${redirectDestination}${config?.routes?.api || '/api'}/${collection.slug}/${endpointSlug}/login`
+                };
+                debugLogger.info({
+                    msg: 'Exchanging code for access token',
+                    path,
+                    requestBody: body
+                });
+                if (strategy.clientSecret) {
+                    body.client_secret = strategy.clientSecret;
+                }
+                const tokenRes = await fetch(strategy.meta?.token_endpoint, {
+                    body: new URLSearchParams(body),
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded'
+                    },
+                    method: 'POST'
+                }).then((r)=>r.json());
+                debugLogger.info({
+                    msg: 'Token Response',
+                    path,
+                    tokenRes
+                });
+                const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
+                debugLogger.info({
+                    msg: 'tokenResss',
+                    tokenRes
+                });
+                // Swap for project token
+                const project_token = await getProjectToken(tokenRes.access_token, 'someproject');
+                const refresh_token = access_token;
+                // Store project token as access_token
+                const token = project_token.token;
+                const expiresIn = project_token.expiresAt;
+                if (!token) {
+                    const errMsg = `No ${collectionOptions.token || 'access_token'} was returned from the identity provider.`;
+                    req.payload.logger.error({
+                        msg: errMsg,
+                        path
+                    });
+                    throw new APIError(errMsg);
+                }
+                const cookieOptions = createCookieOptions({
+                    collection,
+                    headers: req.headers,
+                    pluginOptions
+                });
+                if (error) {
+                    req.payload.logger.error('Error swapping access code with access token:');
+                    req.payload.logger.error({
+                        err: error,
+                        error_description
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                // get the payloadRedirect cookie value
+                const cookies = parseCookies(req.headers);
+                const payloadRedirect = 'payloadRedirect' in cookies ? cookies.payloadRedirect : '';
+                if (!req.responseHeaders) {
+                    req.responseHeaders = new Headers();
+                }
+                if (payloadRedirect) {
+                    if (isAbsoluteURL(payloadRedirect)) {
+                        redirectToUse = payloadRedirect;
+                    } else {
+                        redirectToUse += payloadRedirect;
+                    }
+                    req.responseHeaders.append('Set-Cookie', `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`);
+                }
+                if (refresh_token && !collectionOptions.usePayloadJWT) {
+                    debugLogger.info('Setting refresh token cookie');
+                    const refreshCookie = generateCookie({
+                        returnCookieAsObject: false,
+                        ...cookieOptions,
+                        name: `${strategy.cookieName}-refresh`,
+                        value: refresh_token,
+                        // Default to 1 year if no expiration
+                        expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952)
+                    });
+                    req.responseHeaders.append('Set-Cookie', refreshCookie);
+                }
+                const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(expiresIn) // Project token uses epoch time
+                ;
+                const tokenCookie = generateCookie({
+                    ...cookieOptions,
+                    name: strategy.cookieName,
+                    expires: tokenExpires,
+                    returnCookieAsObject: false,
+                    value: token
+                });
+                req.responseHeaders.append('Set-Cookie', tokenCookie);
+                return Response.redirect(redirectToUse);
+            } catch (err) {
+                req.payload.logger.error({
+                    err,
+                    msg: 'Error while attempting to login',
+                    path: req.pathname
+                });
+                return Response.json({
+                    error: 'Error while attempting to login'
+                }, {
+                    status: 500
+                });
+            }
+        },
+        method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',
+        path: `/${endpointSlug}/login`
+    });
+
+//# sourceMappingURL=getLoginEndpoint.js.map

package/dist/oauth/endpoints/getLoginEndpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/endpoints/getLoginEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport jwt from 'jsonwebtoken'\nimport { APIError, generateCookie, parseCookies } from 'payload'\nimport { getSafeRedirect } from 'payload/shared'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type {\n  AfterOAuthLoginHookResult,\n  CollectionOptions,\n  PluginOptions,\n  StateObj,\n} from '../types.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js'\nimport { ProjectTokenError } from '../../auth/project-token.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { extractOrigin } from '../utilities/extractOrigin.js'\nimport { getAdminPath } from '../utilities/getAdminPath.js'\nimport { getCookieExpiration } from '../utilities/getCookieExpiration.js'\nimport { getSecondsFromTokenExp } from '../utilities/getSecondsFromTokenExp.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nconst isAbsoluteURL = (url: string) => /^[a-z][a-z\\d+.-]*:/.test(url)\n\nexport const getLoginEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const { config } = req.payload\n    const adminPath = getAdminPath(config)\n    try {\n      await strategy.ensureMeta()\n\n      const path = req.pathname\n      const debugLogger = createDebugLogger(req.payload, pluginOptions.debug)\n\n      let jsonBody: Record<string, unknown> = {}\n\n      const contentType = req.headers.get('content-type')\n\n      // Type narrow PayloadRequst's Partial<Request>\n      if (typeof req.json !== 'function' || typeof req.formData !== 'function') {\n        debugLogger.info({\n          msg: 'Request does not have json or formData methods',\n          path,\n        })\n\n        return Response.redirect(`${pluginOptions.redirectServerURL || config.serverURL}/login`)\n      }\n\n      if (collectionOptions.authorizationURLParams?.response_mode === 'query') {\n        if (Object.keys(req.query).length > 0) {\n          jsonBody = req.query\n        }\n      } else if (contentType === 'application/json') {\n        jsonBody = await req.json()\n      } else if (contentType === 'application/x-www-form-urlencoded') {\n        const formData = await req.formData()\n        jsonBody = Object.fromEntries(formData.entries())\n      }\n\n      const stateRaw = jsonBody.state as string\n      const state: StateObj = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'))\n\n      const redirectDestination =\n        state.serverURL || pluginOptions.redirectServerURL || config.serverURL\n      let failedRedirect = `${redirectDestination}${adminPath}/login`\n      let redirectToUse = `${redirectDestination}${adminPath}`\n\n      if (state.redirect) {\n        redirectToUse = state.redirect\n      }\n\n      if (state.failedRedirect) {\n        failedRedirect = state.failedRedirect\n      }\n\n      failedRedirect = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: failedRedirect })\n      redirectToUse = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: redirectToUse })\n\n      if (!isAbsoluteURL(failedRedirect)) {\n        return Response.json({ error: 'Invalid failed redirect provided' }, { status: 403 })\n      }\n      if (!isAbsoluteURL(redirectToUse)) {\n        return Response.json({ error: 'Invalid redirect provided' }, { status: 403 })\n      }\n\n      if (Array.isArray(req.payload.config.csrf) && req.payload.config.csrf.length > 0) {\n        const failedRedirectOrigin = extractOrigin(failedRedirect)\n        const redirectToUseOrigin = extractOrigin(redirectToUse)\n\n        if (failedRedirectOrigin && !req.payload.config.csrf.includes(failedRedirectOrigin)) {\n          req.payload.logger.error(\n            `Failed redirect origin ${failedRedirectOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Failed redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n\n        if (redirectToUseOrigin && !req.payload.config.csrf.includes(redirectToUseOrigin)) {\n          req.payload.logger.error(\n            `Redirect origin ${redirectToUseOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n      }\n\n      // Verify signature\n      if (strategy.name !== req.payload.decrypt(state.sig)) {\n        req.payload.logger.error('Signature mismatch. Failing login and redirecting.')\n        return Response.redirect(failedRedirect)\n      }\n\n      if (!strategy.meta?.token_endpoint) {\n        debugLogger.error({\n          msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      debugLogger.info({ body: jsonBody, msg: 'Received login response body', path })\n\n      if (!jsonBody?.code) {\n        debugLogger.error({\n          msg: `No authorization code present in body. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      // Exchange `code` from body for refresh token\n      const { code } = jsonBody\n\n      if (typeof code !== 'string') {\n        debugLogger.error({\n          msg: `Authorization code present in body is not a string. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      const body: Record<string, string> = {\n        client_id: strategy.clientID,\n        code,\n        code_verifier: req.payload.decrypt(state.verifier),\n        grant_type: 'authorization_code',\n        redirect_uri: `${redirectDestination}${config?.routes?.api || '/api'}/${\n          collection.slug\n        }/${endpointSlug}/login`,\n      }\n\n      debugLogger.info({\n        msg: 'Exchanging code for access token',\n        path,\n        requestBody: body,\n      })\n\n      if (strategy.clientSecret) {\n        body.client_secret = strategy.clientSecret\n      }\n\n      const tokenRes = await fetch(strategy.meta?.token_endpoint, {\n        body: new URLSearchParams(body),\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        method: 'POST',\n      }).then((r) => r.json())\n\n      debugLogger.info({ msg: 'Token Response', path, tokenRes })\n\n      const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes\n\n      debugLogger.info({ msg: 'tokenResss', tokenRes })\n\n      // Swap for project token\n      const project_token = await getProjectToken(tokenRes.access_token, 'someproject')\n      const refresh_token = access_token\n\n      // Store project token as access_token\n\n      const token = project_token.token\n      const expiresIn = project_token.expiresAt\n\n      if (!token) {\n        const errMsg = `No ${\n          collectionOptions.token || 'access_token'\n        } was returned from the identity provider.`\n        req.payload.logger.error({ msg: errMsg, path })\n        throw new APIError(errMsg)\n      }\n\n      const cookieOptions = createCookieOptions({ collection, headers: req.headers, pluginOptions })\n\n      if (error) {\n        req.payload.logger.error('Error swapping access code with access token:')\n        req.payload.logger.error({ err: error, error_description })\n        return Response.redirect(failedRedirect)\n      }\n\n      // get the payloadRedirect cookie value\n      const cookies = parseCookies(req.headers)\n\n      const payloadRedirect =\n        'payloadRedirect' in cookies ? (cookies.payloadRedirect as string) : ''\n\n      if (!req.responseHeaders) {\n        req.responseHeaders = new Headers()\n      }\n\n      if (payloadRedirect) {\n        if (isAbsoluteURL(payloadRedirect)) {\n          redirectToUse = payloadRedirect\n        } else {\n          redirectToUse += payloadRedirect\n        }\n\n        req.responseHeaders.append(\n          'Set-Cookie',\n          `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`,\n        )\n      }\n\n      if (refresh_token && !collectionOptions.usePayloadJWT) {\n        debugLogger.info('Setting refresh token cookie')\n        const refreshCookie = generateCookie({\n          returnCookieAsObject: false,\n          ...cookieOptions,\n          name: `${strategy.cookieName}-refresh`,\n          value: refresh_token,\n          // Default to 1 year if no expiration\n          expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952),\n        }) as string\n\n        req.responseHeaders.append('Set-Cookie', refreshCookie)\n      }\n\n      const tokenExpires = cookieOptions?.expires\n        ? getCookieExpiration(cookieOptions.expires)\n        : new Date(expiresIn) // Project token uses epoch time\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: tokenExpires,\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      req.responseHeaders.append('Set-Cookie', tokenCookie)\n\n      return Response.redirect(redirectToUse)\n    } catch (err: unknown) {\n      req.payload.logger.error({ err, msg: 'Error while attempting to login', path: req.pathname })\n\n      return Response.json({ error: 'Error while attempting to login' }, { status: 500 })\n    }\n  },\n  method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',\n  path: `/${endpointSlug}/login`,\n})\n"],"names":["APIError","generateCookie","parseCookies","getSafeRedirect","getProjectToken","createCookieOptions","createDebugLogger","extractOrigin","getAdminPath","getCookieExpiration","isAbsoluteURL","url","test","getLoginEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","config","payload","adminPath","ensureMeta","path","pathname","debugLogger","debug","jsonBody","contentType","headers","get","json","formData","info","msg","Response","redirect","redirectServerURL","serverURL","authorizationURLParams","response_mode","Object","keys","query","length","fromEntries","entries","stateRaw","state","JSON","parse","Buffer","from","toString","redirectDestination","failedRedirect","redirectToUse","allowAbsoluteUrls","redirectTo","error","status","Array","isArray","csrf","failedRedirectOrigin","redirectToUseOrigin","includes","logger","name","decrypt","sig","meta","token_endpoint","body","code","client_id","clientID","code_verifier","verifier","grant_type","redirect_uri","routes","api","slug","requestBody","clientSecret","client_secret","tokenRes","fetch","URLSearchParams","method","then","r","access_token","error_description","expires_in","refreshTokenExpires","project_token","refresh_token","token","expiresIn","expiresAt","errMsg","cookieOptions","err","cookies","payloadRedirect","responseHeaders","Headers","append","usePayloadJWT","refreshCookie","returnCookieAsObject","cookieName","value","expires","tokenExpires","Date","tokenCookie"],"mappings":"AAGA,SAASA,QAAQ,EAAEC,cAAc,EAAEC,YAAY,QAAQ,UAAS;AAChE,SAASC,eAAe,QAAQ,iBAAgB;AAUhD,SAASC,eAAe,QAAQ,yBAAwB;AAIxD,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,aAAa,QAAQ,gCAA+B;AAC7D,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,mBAAmB,QAAQ,sCAAqC;AAYzE,MAAMC,gBAAgB,CAACC,MAAgB,qBAAqBC,IAAI,CAACD;AAEjE,OAAO,MAAME,mBAAmB,CAAC,EAC/BC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAM,EAAEC,MAAM,EAAE,GAAGD,IAAIE,OAAO;YAC9B,MAAMC,YAAYf,aAAaa;YAC/B,IAAI;gBACF,MAAMH,SAASM,UAAU;gBAEzB,MAAMC,OAAOL,IAAIM,QAAQ;gBACzB,MAAMC,cAAcrB,kBAAkBc,IAAIE,OAAO,EAAEL,cAAcW,KAAK;gBAEtE,IAAIC,WAAoC,CAAC;gBAEzC,MAAMC,cAAcV,IAAIW,OAAO,CAACC,GAAG,CAAC;gBAEpC,+CAA+C;gBAC/C,IAAI,OAAOZ,IAAIa,IAAI,KAAK,cAAc,OAAOb,IAAIc,QAAQ,KAAK,YAAY;oBACxEP,YAAYQ,IAAI,CAAC;wBACfC,KAAK;wBACLX;oBACF;oBAEA,OAAOY,SAASC,QAAQ,CAAC,GAAGrB,cAAcsB,iBAAiB,IAAIlB,OAAOmB,SAAS,CAAC,MAAM,CAAC;gBACzF;gBAEA,IAAIzB,kBAAkB0B,sBAAsB,EAAEC,kBAAkB,SAAS;oBACvE,IAAIC,OAAOC,IAAI,CAACxB,IAAIyB,KAAK,EAAEC,MAAM,GAAG,GAAG;wBACrCjB,WAAWT,IAAIyB,KAAK;oBACtB;gBACF,OAAO,IAAIf,gBAAgB,oBAAoB;oBAC7CD,WAAW,MAAMT,IAAIa,IAAI;gBAC3B,OAAO,IAAIH,gBAAgB,qCAAqC;oBAC9D,MAAMI,WAAW,MAAMd,IAAIc,QAAQ;oBACnCL,WAAWc,OAAOI,WAAW,CAACb,SAASc,OAAO;gBAChD;gBAEA,MAAMC,WAAWpB,SAASqB,KAAK;gBAC/B,MAAMA,QAAkBC,KAAKC,KAAK,CAACC,OAAOC,IAAI,CAACL,UAAU,UAAUM,QAAQ,CAAC;gBAE5E,MAAMC,sBACJN,MAAMV,SAAS,IAAIvB,cAAcsB,iBAAiB,IAAIlB,OAAOmB,SAAS;gBACxE,IAAIiB,iBAAiB,GAAGD,sBAAsBjC,UAAU,MAAM,CAAC;gBAC/D,IAAImC,gBAAgB,GAAGF,sBAAsBjC,WAAW;gBAExD,IAAI2B,MAAMZ,QAAQ,EAAE;oBAClBoB,gBAAgBR,MAAMZ,QAAQ;gBAChC;gBAEA,IAAIY,MAAMO,cAAc,EAAE;oBACxBA,iBAAiBP,MAAMO,cAAc;gBACvC;gBAEAA,iBAAiBtD,gBAAgB;oBAAEwD,mBAAmB;oBAAMC,YAAYH;gBAAe;gBACvFC,gBAAgBvD,gBAAgB;oBAAEwD,mBAAmB;oBAAMC,YAAYF;gBAAc;gBAErF,IAAI,CAAChD,cAAc+C,iBAAiB;oBAClC,OAAOpB,SAASJ,IAAI,CAAC;wBAAE4B,OAAO;oBAAmC,GAAG;wBAAEC,QAAQ;oBAAI;gBACpF;gBACA,IAAI,CAACpD,cAAcgD,gBAAgB;oBACjC,OAAOrB,SAASJ,IAAI,CAAC;wBAAE4B,OAAO;oBAA4B,GAAG;wBAAEC,QAAQ;oBAAI;gBAC7E;gBAEA,IAAIC,MAAMC,OAAO,CAAC5C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,KAAK7C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,CAACnB,MAAM,GAAG,GAAG;oBAChF,MAAMoB,uBAAuB3D,cAAckD;oBAC3C,MAAMU,sBAAsB5D,cAAcmD;oBAE1C,IAAIQ,wBAAwB,CAAC9C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,CAACG,QAAQ,CAACF,uBAAuB;wBACnF9C,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CACtB,CAAC,uBAAuB,EAAEK,qBAAqB,sCAAsC,CAAC;wBAExF,OAAO7B,SAASJ,IAAI,CAClB;4BAAE4B,OAAO;wBAA+D,GACxE;4BAAEC,QAAQ;wBAAI;oBAElB;oBAEA,IAAIK,uBAAuB,CAAC/C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,CAACG,QAAQ,CAACD,sBAAsB;wBACjF/C,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CACtB,CAAC,gBAAgB,EAAEM,oBAAoB,sCAAsC,CAAC;wBAEhF,OAAO9B,SAASJ,IAAI,CAClB;4BAAE4B,OAAO;wBAAwD,GACjE;4BAAEC,QAAQ;wBAAI;oBAElB;gBACF;gBAEA,mBAAmB;gBACnB,IAAI5C,SAASoD,IAAI,KAAKlD,IAAIE,OAAO,CAACiD,OAAO,CAACrB,MAAMsB,GAAG,GAAG;oBACpDpD,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;oBACzB,OAAOxB,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,IAAI,CAACvC,SAASuD,IAAI,EAAEC,gBAAgB;oBAClC/C,YAAYkC,KAAK,CAAC;wBAChBzB,KAAK,CAAC,mFAAmF,CAAC;wBAC1FX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA9B,YAAYQ,IAAI,CAAC;oBAAEwC,MAAM9C;oBAAUO,KAAK;oBAAgCX;gBAAK;gBAE7E,IAAI,CAACI,UAAU+C,MAAM;oBACnBjD,YAAYkC,KAAK,CAAC;wBAChBzB,KAAK,CAAC,qEAAqE,CAAC;wBAC5EX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,8CAA8C;gBAC9C,MAAM,EAAEmB,IAAI,EAAE,GAAG/C;gBAEjB,IAAI,OAAO+C,SAAS,UAAU;oBAC5BjD,YAAYkC,KAAK,CAAC;wBAChBzB,KAAK,CAAC,kFAAkF,CAAC;wBACzFX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,MAAMkB,OAA+B;oBACnCE,WAAW3D,SAAS4D,QAAQ;oBAC5BF;oBACAG,eAAe3D,IAAIE,OAAO,CAACiD,OAAO,CAACrB,MAAM8B,QAAQ;oBACjDC,YAAY;oBACZC,cAAc,GAAG1B,sBAAsBnC,QAAQ8D,QAAQC,OAAO,OAAO,CAAC,EACpEtE,WAAWuE,IAAI,CAChB,CAAC,EAAErE,aAAa,MAAM,CAAC;gBAC1B;gBAEAW,YAAYQ,IAAI,CAAC;oBACfC,KAAK;oBACLX;oBACA6D,aAAaX;gBACf;gBAEA,IAAIzD,SAASqE,YAAY,EAAE;oBACzBZ,KAAKa,aAAa,GAAGtE,SAASqE,YAAY;gBAC5C;gBAEA,MAAME,WAAW,MAAMC,MAAMxE,SAASuD,IAAI,EAAEC,gBAAgB;oBAC1DC,MAAM,IAAIgB,gBAAgBhB;oBAC1B5C,SAAS;wBACP,gBAAgB;oBAClB;oBACA6D,QAAQ;gBACV,GAAGC,IAAI,CAAC,CAACC,IAAMA,EAAE7D,IAAI;gBAErBN,YAAYQ,IAAI,CAAC;oBAAEC,KAAK;oBAAkBX;oBAAMgE;gBAAS;gBAEzD,MAAM,EAAEM,YAAY,EAAElC,KAAK,EAAEmC,iBAAiB,EAAEC,YAAYC,mBAAmB,EAAE,GAAGT;gBAEpF9D,YAAYQ,IAAI,CAAC;oBAAEC,KAAK;oBAAcqD;gBAAS;gBAE/C,yBAAyB;gBACzB,MAAMU,gBAAgB,MAAM/F,gBAAgBqF,SAASM,YAAY,EAAE;gBACnE,MAAMK,gBAAgBL;gBAEtB,sCAAsC;gBAEtC,MAAMM,QAAQF,cAAcE,KAAK;gBACjC,MAAMC,YAAYH,cAAcI,SAAS;gBAEzC,IAAI,CAACF,OAAO;oBACV,MAAMG,SAAS,CAAC,GAAG,EACjBzF,kBAAkBsF,KAAK,IAAI,eAC5B,yCAAyC,CAAC;oBAC3CjF,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;wBAAEzB,KAAKoE;wBAAQ/E;oBAAK;oBAC7C,MAAM,IAAIzB,SAASwG;gBACrB;gBAEA,MAAMC,gBAAgBpG,oBAAoB;oBAAES;oBAAYiB,SAASX,IAAIW,OAAO;oBAAEd;gBAAc;gBAE5F,IAAI4C,OAAO;oBACTzC,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;oBACzBzC,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;wBAAE6C,KAAK7C;wBAAOmC;oBAAkB;oBACzD,OAAO3D,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,uCAAuC;gBACvC,MAAMkD,UAAUzG,aAAakB,IAAIW,OAAO;gBAExC,MAAM6E,kBACJ,qBAAqBD,UAAWA,QAAQC,eAAe,GAAc;gBAEvE,IAAI,CAACxF,IAAIyF,eAAe,EAAE;oBACxBzF,IAAIyF,eAAe,GAAG,IAAIC;gBAC5B;gBAEA,IAAIF,iBAAiB;oBACnB,IAAIlG,cAAckG,kBAAkB;wBAClClD,gBAAgBkD;oBAClB,OAAO;wBACLlD,iBAAiBkD;oBACnB;oBAEAxF,IAAIyF,eAAe,CAACE,MAAM,CACxB,cACA,CAAC,gBAAgB,EAAErD,cAAc,oBAAoB,CAAC;gBAE1D;gBAEA,IAAI0C,iBAAiB,CAACrF,kBAAkBiG,aAAa,EAAE;oBACrDrF,YAAYQ,IAAI,CAAC;oBACjB,MAAM8E,gBAAgBhH,eAAe;wBACnCiH,sBAAsB;wBACtB,GAAGT,aAAa;wBAChBnC,MAAM,GAAGpD,SAASiG,UAAU,CAAC,QAAQ,CAAC;wBACtCC,OAAOhB;wBACP,qCAAqC;wBACrCiB,SAAS5G,oBAAoBgG,eAAeY,WAAWnB,uBAAuB;oBAChF;oBAEA9E,IAAIyF,eAAe,CAACE,MAAM,CAAC,cAAcE;gBAC3C;gBAEA,MAAMK,eAAeb,eAAeY,UAChC5G,oBAAoBgG,cAAcY,OAAO,IACzC,IAAIE,KAAKjB,WAAW,gCAAgC;;gBACxD,MAAMkB,cAAcvH,eAAe;oBACjC,GAAGwG,aAAa;oBAChBnC,MAAMpD,SAASiG,UAAU;oBACzBE,SAASC;oBACTJ,sBAAsB;oBACtBE,OAAOf;gBACT;gBAEAjF,IAAIyF,eAAe,CAACE,MAAM,CAAC,cAAcS;gBAEzC,OAAOnF,SAASC,QAAQ,CAACoB;YAC3B,EAAE,OAAOgD,KAAc;gBACrBtF,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;oBAAE6C;oBAAKtE,KAAK;oBAAmCX,MAAML,IAAIM,QAAQ;gBAAC;gBAE3F,OAAOW,SAASJ,IAAI,CAAC;oBAAE4B,OAAO;gBAAkC,GAAG;oBAAEC,QAAQ;gBAAI;YACnF;QACF;QACA8B,QAAQ7E,kBAAkB0B,sBAAsB,EAAEC,kBAAkB,UAAU,QAAQ;QACtFjB,MAAM,CAAC,CAAC,EAAET,aAAa,MAAM,CAAC;IAChC,CAAA,EAAE"}

package/dist/oauth/endpoints/getLogoutEndpoint.d.ts

@@ -0,0 +1,12 @@
+import type { CollectionConfig, Endpoint } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { PluginOptions } from '../types.js';
+interface Args {
+    collection: CollectionConfig;
+    endpointSlug: string;
+    pluginOptions: PluginOptions;
+    strategy: Strategy;
+}
+export declare const getLogoutEndpoint: ({ collection, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
+export {};
+//# sourceMappingURL=getLogoutEndpoint.d.ts.map

package/dist/oauth/endpoints/getLogoutEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getLogoutEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getLogoutEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAKzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAOhD,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,eAAO,MAAM,iBAAiB,2DAK3B,IAAI,KAAG,QA4ER,CAAA"}

package/dist/oauth/endpoints/getLogoutEndpoint.js

@@ -0,0 +1,99 @@
+import jwt from 'jsonwebtoken';
+import { parseCookies } from 'payload';
+import { clearCookie } from '../utilities/clearCookie.js';
+import { createCookieOptions } from '../utilities/createCookieOptions.js';
+import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { getAdminPath } from '../utilities/getAdminPath.js';
+export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, strategy })=>({
+        handler: async (req)=>{
+            const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
+            const { config } = req.payload;
+            if (!req) {
+                debugLogger.error({
+                    msg: 'Invalid request to logout endpoint'
+                });
+                return Response.json({
+                    error: 'Invalid request to logout endpoint'
+                }, {
+                    status: 400
+                });
+            }
+            if (!req.responseHeaders) {
+                req.responseHeaders = new Headers();
+            }
+            try {
+                await strategy.ensureMeta();
+                const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL;
+                let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`;
+                if (typeof req.query.redirect === 'string') {
+                    successfulLogoutRedirectDest = req.query.redirect;
+                }
+                if (!baseRedirectDestination && !req.query.redirect) {
+                    debugLogger.error({
+                        msg: 'No redirect URL provided',
+                        path: req.pathname
+                    });
+                    return Response.json({
+                        error: 'No redirect URL provided'
+                    }, {
+                        status: 400
+                    });
+                }
+                const cookieOptions = createCookieOptions({
+                    collection,
+                    headers: req.headers,
+                    pluginOptions
+                });
+                let redirectDestination = successfulLogoutRedirectDest;
+                if (strategy.meta?.end_session_endpoint) {
+                    const cookies = parseCookies(req.headers);
+                    const token = cookies.get(strategy.cookieName);
+                    if (!token) {
+                        debugLogger.error({
+                            msg: 'Unable to parse token from cookie.'
+                        });
+                        return Response.json({
+                            error: 'Unable to parse token from cookie.'
+                        }, {
+                            status: 400
+                        });
+                    }
+                    const decodedToken = jwt.decode(token);
+                    const sid = typeof decodedToken === 'object' && decodedToken ? decodedToken.sid : undefined;
+                    const body = {
+                        client_id: strategy.clientID,
+                        logout_hint: sid,
+                        post_logout_redirect_uri: successfulLogoutRedirectDest
+                    };
+                    const qs = new URLSearchParams(body).toString();
+                    redirectDestination = `${strategy.meta.end_session_endpoint}?${qs}`;
+                }
+                clearCookie({
+                    cookieName: strategy.cookieName,
+                    cookieOptions,
+                    req
+                });
+                clearCookie({
+                    cookieName: `${strategy.cookieName}-refresh`,
+                    cookieOptions,
+                    req
+                });
+                return Response.redirect(redirectDestination);
+            } catch (err) {
+                req.payload.logger.error({
+                    err,
+                    msg: 'Error while attempting to logout',
+                    path: req.pathname
+                });
+                return Response.json({
+                    error: 'Error while attempting to logout'
+                }, {
+                    status: 500
+                });
+            }
+        },
+        method: 'get',
+        path: `/${endpointSlug}/logout`
+    });
+
+//# sourceMappingURL=getLogoutEndpoint.js.map

package/dist/oauth/endpoints/getLogoutEndpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/endpoints/getLogoutEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport jwt from 'jsonwebtoken'\nimport { parseCookies } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { PluginOptions } from '../types.js'\n\nimport { clearCookie } from '../utilities/clearCookie.js'\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getAdminPath } from '../utilities/getAdminPath.js'\n\ninterface Args {\n  collection: CollectionConfig\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nexport const getLogoutEndpoint = ({\n  collection,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const debugLogger = createDebugLogger(req.payload, pluginOptions.debug)\n    const { config } = req.payload\n\n    if (!req) {\n      debugLogger.error({ msg: 'Invalid request to logout endpoint' })\n      return Response.json({ error: 'Invalid request to logout endpoint' }, { status: 400 })\n    }\n\n    if (!req.responseHeaders) {\n      req.responseHeaders = new Headers()\n    }\n\n    try {\n      await strategy.ensureMeta()\n\n      const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL\n\n      let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`\n\n      if (typeof req.query.redirect === 'string') {\n        successfulLogoutRedirectDest = req.query.redirect\n      }\n\n      if (!baseRedirectDestination && !req.query.redirect) {\n        debugLogger.error({ msg: 'No redirect URL provided', path: req.pathname })\n        return Response.json({ error: 'No redirect URL provided' }, { status: 400 })\n      }\n\n      const cookieOptions = createCookieOptions({ collection, headers: req.headers, pluginOptions })\n\n      let redirectDestination = successfulLogoutRedirectDest\n      if (strategy.meta?.end_session_endpoint) {\n        const cookies = parseCookies(req.headers)\n\n        const token = cookies.get(strategy.cookieName)\n        if (!token) {\n          debugLogger.error({ msg: 'Unable to parse token from cookie.' })\n          return Response.json({ error: 'Unable to parse token from cookie.' }, { status: 400 })\n        }\n\n        const decodedToken = jwt.decode(token)\n        const sid = typeof decodedToken === 'object' && decodedToken ? decodedToken.sid : undefined\n\n        const body = {\n          client_id: strategy.clientID,\n          logout_hint: sid,\n          post_logout_redirect_uri: successfulLogoutRedirectDest,\n        }\n\n        const qs = new URLSearchParams(body).toString()\n        redirectDestination = `${strategy.meta.end_session_endpoint}?${qs}`\n      }\n\n      clearCookie({\n        cookieName: strategy.cookieName,\n        cookieOptions,\n        req,\n      })\n\n      clearCookie({\n        cookieName: `${strategy.cookieName}-refresh`,\n        cookieOptions,\n        req,\n      })\n\n      return Response.redirect(redirectDestination)\n    } catch (err: unknown) {\n      req.payload.logger.error({ err, msg: 'Error while attempting to logout', path: req.pathname })\n\n      return Response.json({ error: 'Error while attempting to logout' }, { status: 500 })\n    }\n  },\n  method: 'get',\n  path: `/${endpointSlug}/logout`,\n})\n"],"names":["jwt","parseCookies","clearCookie","createCookieOptions","createDebugLogger","getAdminPath","getLogoutEndpoint","collection","endpointSlug","pluginOptions","strategy","handler","req","debugLogger","payload","debug","config","error","msg","Response","json","status","responseHeaders","Headers","ensureMeta","baseRedirectDestination","redirectServerURL","serverURL","successfulLogoutRedirectDest","query","redirect","path","pathname","cookieOptions","headers","redirectDestination","meta","end_session_endpoint","cookies","token","get","cookieName","decodedToken","decode","sid","undefined","body","client_id","clientID","logout_hint","post_logout_redirect_uri","qs","URLSearchParams","toString","err","logger","method"],"mappings":"AAEA,OAAOA,SAAS,eAAc;AAC9B,SAASC,YAAY,QAAQ,UAAS;AAKtC,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,YAAY,QAAQ,+BAA8B;AAS3D,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,UAAU,EACVC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAMC,cAAcT,kBAAkBQ,IAAIE,OAAO,EAAEL,cAAcM,KAAK;YACtE,MAAM,EAAEC,MAAM,EAAE,GAAGJ,IAAIE,OAAO;YAE9B,IAAI,CAACF,KAAK;gBACRC,YAAYI,KAAK,CAAC;oBAAEC,KAAK;gBAAqC;gBAC9D,OAAOC,SAASC,IAAI,CAAC;oBAAEH,OAAO;gBAAqC,GAAG;oBAAEI,QAAQ;gBAAI;YACtF;YAEA,IAAI,CAACT,IAAIU,eAAe,EAAE;gBACxBV,IAAIU,eAAe,GAAG,IAAIC;YAC5B;YAEA,IAAI;gBACF,MAAMb,SAASc,UAAU;gBAEzB,MAAMC,0BAA0BhB,cAAciB,iBAAiB,IAAIV,OAAOW,SAAS;gBAEnF,IAAIC,+BAA+B,GAAGH,0BAA0BpB,aAAaW,SAAS;gBAEtF,IAAI,OAAOJ,IAAIiB,KAAK,CAACC,QAAQ,KAAK,UAAU;oBAC1CF,+BAA+BhB,IAAIiB,KAAK,CAACC,QAAQ;gBACnD;gBAEA,IAAI,CAACL,2BAA2B,CAACb,IAAIiB,KAAK,CAACC,QAAQ,EAAE;oBACnDjB,YAAYI,KAAK,CAAC;wBAAEC,KAAK;wBAA4Ba,MAAMnB,IAAIoB,QAAQ;oBAAC;oBACxE,OAAOb,SAASC,IAAI,CAAC;wBAAEH,OAAO;oBAA2B,GAAG;wBAAEI,QAAQ;oBAAI;gBAC5E;gBAEA,MAAMY,gBAAgB9B,oBAAoB;oBAAEI;oBAAY2B,SAAStB,IAAIsB,OAAO;oBAAEzB;gBAAc;gBAE5F,IAAI0B,sBAAsBP;gBAC1B,IAAIlB,SAAS0B,IAAI,EAAEC,sBAAsB;oBACvC,MAAMC,UAAUrC,aAAaW,IAAIsB,OAAO;oBAExC,MAAMK,QAAQD,QAAQE,GAAG,CAAC9B,SAAS+B,UAAU;oBAC7C,IAAI,CAACF,OAAO;wBACV1B,YAAYI,KAAK,CAAC;4BAAEC,KAAK;wBAAqC;wBAC9D,OAAOC,SAASC,IAAI,CAAC;4BAAEH,OAAO;wBAAqC,GAAG;4BAAEI,QAAQ;wBAAI;oBACtF;oBAEA,MAAMqB,eAAe1C,IAAI2C,MAAM,CAACJ;oBAChC,MAAMK,MAAM,OAAOF,iBAAiB,YAAYA,eAAeA,aAAaE,GAAG,GAAGC;oBAElF,MAAMC,OAAO;wBACXC,WAAWrC,SAASsC,QAAQ;wBAC5BC,aAAaL;wBACbM,0BAA0BtB;oBAC5B;oBAEA,MAAMuB,KAAK,IAAIC,gBAAgBN,MAAMO,QAAQ;oBAC7ClB,sBAAsB,GAAGzB,SAAS0B,IAAI,CAACC,oBAAoB,CAAC,CAAC,EAAEc,IAAI;gBACrE;gBAEAjD,YAAY;oBACVuC,YAAY/B,SAAS+B,UAAU;oBAC/BR;oBACArB;gBACF;gBAEAV,YAAY;oBACVuC,YAAY,GAAG/B,SAAS+B,UAAU,CAAC,QAAQ,CAAC;oBAC5CR;oBACArB;gBACF;gBAEA,OAAOO,SAASW,QAAQ,CAACK;YAC3B,EAAE,OAAOmB,KAAc;gBACrB1C,IAAIE,OAAO,CAACyC,MAAM,CAACtC,KAAK,CAAC;oBAAEqC;oBAAKpC,KAAK;oBAAoCa,MAAMnB,IAAIoB,QAAQ;gBAAC;gBAE5F,OAAOb,SAASC,IAAI,CAAC;oBAAEH,OAAO;gBAAmC,GAAG;oBAAEI,QAAQ;gBAAI;YACpF;QACF;QACAmC,QAAQ;QACRzB,MAAM,CAAC,CAAC,EAAEvB,aAAa,OAAO,CAAC;IACjC,CAAA,EAAE"}

package/dist/oauth/endpoints/getMetaEndpoint.d.ts

@@ -0,0 +1,13 @@
+import type { CollectionConfig, Endpoint } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { CollectionOptions, PluginOptions } from '../types.js';
+interface Args {
+    collection: CollectionConfig;
+    collectionOptions: CollectionOptions;
+    endpointSlug: string;
+    pluginOptions: PluginOptions;
+    strategy: Strategy;
+}
+export declare const getMetaEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
+export {};
+//# sourceMappingURL=getMetaEndpoint.d.ts.map

package/dist/oauth/endpoints/getMetaEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getMetaEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getMetaEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAInE,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,eAAO,MAAM,eAAe,8EAMzB,IAAI,KAAG,QAkBR,CAAA"}

package/dist/oauth/endpoints/getMetaEndpoint.js

@@ -0,0 +1,25 @@
+import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
+        handler: async (req)=>{
+            const authorizeURL = await getAuthorizeURL({
+                collection,
+                collectionOptions,
+                endpointSlug,
+                failedRedirect: req.query.failedRedirect,
+                payload: req.payload,
+                pluginOptions,
+                redirect: req.query.redirect,
+                serverURLOverride: req.query.serverURL,
+                strategy
+            });
+            return Response.json({
+                authorizeURL
+            }, {
+                status: 200
+            });
+        },
+        method: 'get',
+        path: `/${endpointSlug}/meta`
+    });
+
+//# sourceMappingURL=getMetaEndpoint.js.map

package/dist/oauth/endpoints/getMetaEndpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/endpoints/getMetaEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { CollectionOptions, PluginOptions } from '../types.js'\n\nimport { getAuthorizeURL } from '../utilities/getAuthorizeURL.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nexport const getMetaEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const authorizeURL = await getAuthorizeURL({\n      collection,\n      collectionOptions,\n      endpointSlug,\n      failedRedirect: req.query.failedRedirect,\n      payload: req.payload,\n      pluginOptions,\n      redirect: req.query.redirect as string,\n      serverURLOverride: req.query.serverURL as string,\n      strategy,\n    })\n\n    return Response.json({ authorizeURL }, { status: 200 })\n  },\n  method: 'get',\n  path: `/${endpointSlug}/meta`,\n})\n"],"names":["getAuthorizeURL","getMetaEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","authorizeURL","failedRedirect","query","payload","redirect","serverURLOverride","serverURL","Response","json","status","method","path"],"mappings":"AAKA,SAASA,eAAe,QAAQ,kCAAiC;AAUjE,OAAO,MAAMC,kBAAkB,CAAC,EAC9BC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAMC,eAAe,MAAMT,gBAAgB;gBACzCE;gBACAC;gBACAC;gBACAM,gBAAgBF,IAAIG,KAAK,CAACD,cAAc;gBACxCE,SAASJ,IAAII,OAAO;gBACpBP;gBACAQ,UAAUL,IAAIG,KAAK,CAACE,QAAQ;gBAC5BC,mBAAmBN,IAAIG,KAAK,CAACI,SAAS;gBACtCT;YACF;YAEA,OAAOU,SAASC,IAAI,CAAC;gBAAER;YAAa,GAAG;gBAAES,QAAQ;YAAI;QACvD;QACAC,QAAQ;QACRC,MAAM,CAAC,CAAC,EAAEhB,aAAa,KAAK,CAAC;IAC/B,CAAA,EAAE"}

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.d.ts

@@ -0,0 +1,13 @@
+import type { CollectionConfig, Endpoint } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { CollectionOptions, PluginOptions } from '../types.js';
+interface Args {
+    collection: CollectionConfig;
+    collectionOptions: CollectionOptions;
+    endpointSlug: string;
+    pluginOptions: PluginOptions;
+    strategy: Strategy;
+}
+export declare const getRedirectToLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
+export {};
+//# sourceMappingURL=getRedirectToLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRedirectToLoginEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getRedirectToLoginEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAInE,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,eAAO,MAAM,0BAA0B,8EAMpC,IAAI,KAAG,QAkBR,CAAA"}

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.js

@@ -0,0 +1,21 @@
+import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
+        handler: async (req)=>{
+            const authorizeURL = await getAuthorizeURL({
+                collection,
+                collectionOptions,
+                endpointSlug,
+                failedRedirect: req.query.failedRedirect,
+                payload: req.payload,
+                pluginOptions,
+                redirect: req.query.redirect,
+                serverURLOverride: req.query.serverURL,
+                strategy
+            });
+            return Response.redirect(authorizeURL);
+        },
+        method: 'get',
+        path: `/${endpointSlug}/login`
+    });
+
+//# sourceMappingURL=getRedirectToLoginEndpoint.js.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/endpoints/getRedirectToLoginEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { CollectionOptions, PluginOptions } from '../types.js'\n\nimport { getAuthorizeURL } from '../utilities/getAuthorizeURL.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nexport const getRedirectToLoginEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const authorizeURL = await getAuthorizeURL({\n      collection,\n      collectionOptions,\n      endpointSlug,\n      failedRedirect: req.query.failedRedirect,\n      payload: req.payload,\n      pluginOptions,\n      redirect: req.query.redirect as string,\n      serverURLOverride: req.query.serverURL as string,\n      strategy,\n    })\n\n    return Response.redirect(authorizeURL)\n  },\n  method: 'get',\n  path: `/${endpointSlug}/login`,\n})\n"],"names":["getAuthorizeURL","getRedirectToLoginEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","authorizeURL","failedRedirect","query","payload","redirect","serverURLOverride","serverURL","Response","method","path"],"mappings":"AAKA,SAASA,eAAe,QAAQ,kCAAiC;AAUjE,OAAO,MAAMC,6BAA6B,CAAC,EACzCC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAMC,eAAe,MAAMT,gBAAgB;gBACzCE;gBACAC;gBACAC;gBACAM,gBAAgBF,IAAIG,KAAK,CAACD,cAAc;gBACxCE,SAASJ,IAAII,OAAO;gBACpBP;gBACAQ,UAAUL,IAAIG,KAAK,CAACE,QAAQ;gBAC5BC,mBAAmBN,IAAIG,KAAK,CAACI,SAAS;gBACtCT;YACF;YAEA,OAAOU,SAASH,QAAQ,CAACJ;QAC3B;QACAQ,QAAQ;QACRC,MAAM,CAAC,CAAC,EAAEd,aAAa,MAAM,CAAC;IAChC,CAAA,EAAE"}

package/dist/oauth/exports/client.d.ts

@@ -0,0 +1,3 @@
+export { DefaultLoginButton } from '../components/LoginButton/index.jsx';
+export { LogoutButton } from '../components/LogoutButton/index.jsx';
+//# sourceMappingURL=client.d.ts.map