@payloadcms/figma 0.0.1-alpha.0 → 0.0.1-alpha.10

package/dist/oauth/strategy/index.js

@@ -0,0 +1,280 @@
+import * as jose from 'jose';
+import { APIError, parseCookies } from 'payload';
+import { validateProjectToken } from '../../auth/jwt-validator.js';
+import { getEnvironment } from '../../constants.js';
+import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { getTokenExp } from '../utilities/getTokenExp.js';
+import { mergeHeaders } from '../utilities/mergeHeaders.js';
+import { refreshTokens } from '../utilities/refreshTokens.js';
+export class Strategy {
+    clientID;
+    clientSecret;
+    collection;
+    collectionOptions;
+    cookieName;
+    debug;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    debugLog;
+    identityMetadataURL;
+    jwks;
+    meta;
+    metaLastFetchedTime;
+    metaPromise;
+    metaPromiseResolve;
+    name;
+    pluginOptions;
+    verify;
+    constructor(options){
+        this.verify = options.verify;
+        this.cookieName = options.cookieName;
+        this.clientID = options.clientID;
+        this.clientSecret = options.clientSecret;
+        this.identityMetadataURL = options.identityMetadata;
+        this.name = options.strategyName;
+        this.collection = options.collection;
+        this.collectionOptions = options.collectionOptions;
+        this.pluginOptions = options.pluginOptions;
+        this.debug = options.debug || false;
+        // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any
+        this.debugLog = options.debug ? (...args)=>console.log(...args) : ()=>null;
+        // Prevent wokiness with `this`
+        this.ensureMeta = this.ensureMeta.bind(this);
+    }
+    async authenticate({ canSetHeaders, headers, payload }) {
+        const debugLogger = createDebugLogger(payload, this.debug);
+        await this.ensureMeta();
+        const cookies = parseCookies(headers);
+        let oauthToken = cookies.get(this.cookieName);
+        const refreshToken = cookies.get(`${this.cookieName}-refresh`);
+        debugLogger.info({
+            msg: 'Retrieved tokens from cookies',
+            oauthToken,
+            refreshToken
+        });
+        if (!this.collectionOptions.disableJWTFromHeader) {
+            // Parse Authorization header if exists
+            const jwtFromHeader = headers.get('authorization');
+            if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {
+                debugLogger.info({
+                    jwtFromHeader,
+                    msg: 'Found bearer token in authorization header'
+                });
+                oauthToken = jwtFromHeader.replace('Bearer ', '');
+            }
+        }
+        if (!oauthToken) {
+            if (refreshToken && canSetHeaders) {
+                debugLogger.info({
+                    msg: 'No access token found, but refresh token exists. Attempting to refresh...',
+                    refreshToken
+                });
+                const refreshed = await refreshTokens({
+                    payload,
+                    refreshToken,
+                    strategy: this
+                });
+                if (refreshed) {
+                    const verifyResult = await this.verify({
+                        headers,
+                        payload,
+                        token: refreshed.decodedOauthToken
+                    });
+                    debugLogger.info({
+                        msg: 'Token refreshed. Verifying...',
+                        verifyResult
+                    });
+                    if (verifyResult.responseHeaders) {
+                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    }
+                    return {
+                        responseHeaders: refreshed.headers,
+                        user: verifyResult.user
+                    };
+                } else {
+                    debugLogger.info({
+                        msg: 'Token refresh failed',
+                        refreshed,
+                        refreshToken
+                    });
+                }
+            } else {
+                return {
+                    user: null
+                };
+            }
+        }
+        let oauthTokenVerifyResult = null;
+        // First, try to verify token
+        if (oauthToken) {
+            oauthTokenVerifyResult = await this.jwtVerify({
+                payload,
+                token: oauthToken
+            });
+            // If verify comes back null, there is no user
+            if (oauthTokenVerifyResult === null) {
+                return {
+                    user: null
+                };
+            }
+            // If verify comes back truthy, use it
+            // but first set exp from refresh token
+            // because access exp is likely very short lived
+            if (typeof oauthTokenVerifyResult === 'object' && !(oauthTokenVerifyResult instanceof Error)) {
+                if (refreshToken) {
+                    const refreshTokenExp = getTokenExp({
+                        debugLogger,
+                        token: refreshToken
+                    });
+                    if (refreshTokenExp) {
+                        oauthTokenVerifyResult.exp = refreshTokenExp;
+                    }
+                }
+                return this.verify({
+                    headers,
+                    payload,
+                    token: oauthTokenVerifyResult
+                });
+            }
+        }
+        if (oauthTokenVerifyResult instanceof Error && oauthTokenVerifyResult.name === 'TokenExpiredError' && refreshToken && !this.collectionOptions.usePayloadJWT && canSetHeaders) {
+            const refreshed = await refreshTokens({
+                payload,
+                refreshToken,
+                strategy: this
+            });
+            debugLogger.info({
+                msg: 'Token expired. Refreshing...',
+                refreshed,
+                refreshToken
+            });
+            if (refreshed) {
+                const verifyResult = await this.verify({
+                    headers,
+                    payload,
+                    token: refreshed.decodedOauthToken
+                });
+                debugLogger.info({
+                    msg: 'Token refreshed. Verifying...',
+                    verifyResult
+                });
+                if (verifyResult.responseHeaders) {
+                    mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                }
+                return {
+                    responseHeaders: refreshed.headers,
+                    user: verifyResult.user
+                };
+            } else {
+                debugLogger.info({
+                    msg: 'Token refresh failed',
+                    refreshed,
+                    refreshToken
+                });
+            }
+        }
+        return {
+            user: null
+        };
+    }
+    async ensureMeta() {
+        if (this.metaPromise) {
+            this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...');
+            await this.metaPromise;
+        }
+        // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta
+        if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {
+            this.debugLog(`Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`);
+            await this.fetchMeta();
+        }
+    }
+    async fetchMeta() {
+        // If already in-flight, return the existing promise
+        if (this.metaPromise) {
+            this.debugLog('fetchMeta - returning existing metaPromise');
+            return this.metaPromise;
+        }
+        this.debugLog('fetchMeta - creating new metaPromise...');
+        // Build the shared promise
+        this.metaPromise = (async ()=>{
+            let lastError;
+            for(let attempt = 1; attempt <= 5; attempt++){
+                try {
+                    this.meta = await fetch(this.identityMetadataURL).then((res)=>res.json());
+                    this.debugLog(`fetchMeta - success on attempt ${attempt}`);
+                    if (this.meta?.jwks_uri) {
+                        this.jwks = await fetch(this.meta.jwks_uri).then((res)=>res.json());
+                    }
+                    this.metaLastFetchedTime = new Date();
+                    this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`);
+                    return;
+                } catch (error) {
+                    lastError = error;
+                    this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${error?.message}`);
+                    if (attempt < 5) {
+                        // Exponential backoff (up to 1s)
+                        await new Promise((resolve)=>setTimeout(resolve, Math.min(attempt * 200, 1000)));
+                    }
+                }
+            }
+            throw new APIError(`Failed to fetch identity metadata from "${this.identityMetadataURL}". Last error: ${lastError?.message ?? 'unknown'}`);
+        })();
+        try {
+            await this.metaPromise;
+        } finally{
+            this.metaPromise = undefined;
+        }
+    }
+    async generateOidcPEM(kid, alg) {
+        const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null;
+        let pubKey = null;
+        let foundKey = false;
+        if (!kid) {
+            throw new Error('kid is missing');
+        }
+        if (!alg) {
+            throw new Error('alg is missing');
+        }
+        if (!keys) {
+            throw new Error('keys is missing');
+        }
+        for (const key of keys){
+            if (!('kid' in key) || key.kid !== kid) {
+                continue;
+            }
+            const cryptoKey = await jose.importJWK(key, alg);
+            if (!(cryptoKey instanceof CryptoKey)) {
+                throw new Error('importJWK did not return a CryptoKey');
+            }
+            pubKey = await jose.exportSPKI(cryptoKey);
+            foundKey = true;
+            break;
+        }
+        if (!foundKey) {
+            throw new Error('a key with the specific kid cannot be found');
+        }
+        if (!pubKey) {
+            throw new Error('generating public key pem failed');
+        }
+        return pubKey;
+    }
+    async jwtVerify({ payload, token }) {
+        try {
+            const verified = await validateProjectToken(token, getEnvironment());
+            if (typeof verified !== 'string') {
+                return verified;
+            }
+        } catch (err) {
+            payload.logger.error({
+                err,
+                msg: 'Error verifying jwt token'
+            });
+            if (err instanceof Error) {
+                return err;
+            }
+            return null;
+        }
+        return null;
+    }
+}
+
+//# sourceMappingURL=index.js.map

package/dist/oauth/strategy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js'\nimport { ProjectTokenError } from '../../auth/project-token.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof Error &&\n      oauthTokenVerifyResult.name === 'TokenExpiredError' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAA6BC,oBAAoB,QAAQ,8BAA6B;AAEtF,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUrC,aAAakC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCE,SAClCF,uBAAuBjC,IAAI,KAAK,uBAChCmB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACgD,aAAa,IACrC1B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI0C,KAAKC,GAAG,KAAK,IAAI,CAAC3C,mBAAmB,CAAC4C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAAChD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC6C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC5C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI6C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAAChD,IAAI,GAAG,MAAMiD,MAAM,IAAI,CAACnD,mBAAmB,EAAEoD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACxE,IAAI,CAACvD,QAAQ,CAAC,CAAC,+BAA+B,EAAEmD,SAAS;oBAEzD,IAAI,IAAI,CAAChD,IAAI,EAAEqD,UAAU;wBACvB,IAAI,CAACtD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACjD,IAAI,CAACqD,QAAQ,EAAEH,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACnD,mBAAmB,GAAG,IAAI0C;oBAC/B,IAAI,CAAC9C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACqD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBR,YAAYQ;oBACZ,IAAI,CAAC1D,QAAQ,CAAC,CAAC,2BAA2B,EAAEmD,QAAQ,IAAI,EAAGO,OAAiBC,SAAS;oBAErF,IAAIR,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIS,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACb,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIlE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACgB,mBAAmB,CAAC,eAAe,EACjF,AAACiD,WAAqBS,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACtD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG4D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACnE,IAAI,IAAIoE,MAAMC,OAAO,CAAC,IAAI,CAACrE,IAAI,CAACmE,IAAI,IAAI,IAAI,CAACnE,IAAI,CAACmE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAIzB,MAAM;QAClB;QAEA,IAAI,CAAC0B,KAAK;YACR,MAAM,IAAI1B,MAAM;QAClB;QAEA,IAAI,CAAC2B,MAAM;YACT,MAAM,IAAI3B,MAAM;QAClB;QAEA,KAAK,MAAMgC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM3F,KAAK4F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAInC,MAAM;YAClB;YAEA8B,SAAS,MAAMxF,KAAK8F,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAI/B,MAAM;QAClB;QAEA,IAAI,CAAC8B,QAAQ;YACX,MAAM,IAAI9B,MAAM;QAClB;QAEA,OAAO8B;IACT;IAEA,MAAM/B,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM2C,WAAW,MAAM5F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO2F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB3D,QAAQ4D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACApD,KAAK;YACP;YAEA,IAAIoD,eAAetC,OAAO;gBACxB,OAAOsC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}

package/dist/oauth/types.d.ts

@@ -0,0 +1,192 @@
+import type jwt from 'jsonwebtoken';
+import type { AuthStrategyResult, CollectionConfig, CustomComponent, EmailField, IncomingAuthType, Payload, PayloadRequest, TextField } from 'payload';
+export type Done = (error: any, user?: any, info?: unknown) => void;
+export type VerifyFunction = (args: {
+    headers: Headers;
+    payload: Payload;
+    token: jwt.JwtPayload;
+}) => Promise<AuthStrategyResult>;
+export type AfterOAuthLoginHookResult = {
+    redirect?: string;
+} | void;
+export type AfterOAuthLoginHook = (args: {
+    access_token?: string;
+    id_token?: string;
+    refresh_token?: string;
+    req: PayloadRequest;
+}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>;
+export interface CollectionOptions {
+    authorizationURLParams?: Record<string, string>;
+    clientID: string;
+    clientSecret?: string;
+    /**
+     * Whether to disable the local strategy for this collection.
+     *
+     * @default true
+     */
+    /**
+     * By default, accept a JWT from the authorization header
+     *
+     * Set to false to only accept the JWT from cookies
+     */
+    disableJWTFromHeader?: boolean;
+    disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy'];
+    /**
+     * The logout button will either redirect to the IDP logout screen or
+     * automatically log the user out of the IDP depending on provider.
+     *
+     * @default false
+     */
+    endOAuthSessionOnLogout?: boolean;
+    hooks?: {
+        afterLogin?: AfterOAuthLoginHook[];
+    };
+    /**
+     * The OpenID metadata endpoint for the identity provider.
+     *
+     * @example http://localhost:8080/realms/master/.well-known/openid-configuration
+     * @example https://myapp.auth0.com/.well-known/openid-configuration
+     */
+    identityMetadata: string;
+    /**
+     * Custom React component to use as the login button on the login page.
+     */
+    LoginButton?: CustomComponent | false;
+    /**
+     * The OAuth2.0 scope to request from the identity provider.
+     *
+     * @default ['openid', 'profile', 'email']
+     */
+    scope?: string[];
+    /**
+     * The Payload collection slug to apply the OAuth2.0 strategy to.
+     */
+    slug: string;
+    /**
+     * Property to use as the token to decode from the OAuth2.0 response.
+     *
+     * This is passed to the default or custom `verify` function.
+     *
+     * @default 'access_token'
+     */
+    token?: 'access_token' | 'id_token';
+    /**
+     * Have Payload maintain the JWT cookie.
+     *
+     * This is for when the IDP does not support silently refreshing tokens in the background.
+     */
+    usePayloadJWT?: boolean;
+    /**
+     * The Payload field to use as the username field for the user
+     * When a text is used, the plugin will find the collection field with the name provided
+     * Alternatively define the entire field to use
+     * @default
+     *
+     * ```ts
+     * {
+     *   type: 'text',
+     *   name: 'preferredUsername',
+     *   unique: true,
+     *   admin: {
+     *     position: 'sidebar',
+     *     readOnly: true,
+     *   },
+     * }
+     * ```
+     */
+    usernameField?: EmailField | string | TextField;
+    /**
+     * Custom verify function that receives the token and performs any logic.
+     * By default, the defaultVerify function is used.
+     */
+    verify?: VerifyFunction;
+}
+export interface PluginOptions {
+    /**
+     * The collections to apply the OAuth2.0 strategy to.
+     */
+    collections: CollectionOptions[];
+    /**
+     * The name of the cookie to use for storing the user's token.
+     *
+     * @default 'payload-oauth-token'
+     */
+    cookieName?: string;
+    /**
+     * Debug mode will log additional information to the console.
+     *
+     * NOTE: This will log sensitive information to the console.
+     */
+    /**
+     * Accepts incoming request and allows for modification of cookie options
+     */
+    createCookieOptions?: (args: {
+        collection: CollectionConfig;
+        cookieOptions: CookieOptions;
+        headers: Headers;
+    }) => CookieOptions;
+    debug?: boolean;
+    /**
+     * Disables the plugin functionality while leaving in types, fields and component modifications.
+     * @default false
+     */
+    disabled?: boolean;
+    /**
+     * OAuth2.0 requires a URL to redirect the user to.
+     * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.
+     */
+    redirectServerURL?: string;
+    /**
+     * Override the strategy name used for this plugin.
+     *
+     * This should only be overridden to accomodate multiple plugin
+     * invocations against a single user collection.
+     *
+     * If you have a custom basePath defined in your Next config,
+     * this value should not contain that path.
+     *
+     * @default 'oauth'
+     */
+    strategyName?: string;
+}
+export type CookieOptions = {
+    domain?: string;
+    expires?: Date | number;
+    httpOnly?: boolean;
+    maxAge?: number;
+    path?: string;
+    sameSite?: 'Lax' | 'None' | 'Strict';
+    secure?: boolean;
+};
+export type StateObj = {
+    /**
+     * Redirect to use if the login fails
+     */
+    failedRedirect?: string;
+    /**
+     * Redirect to use after the login is successful
+     */
+    redirect?: string;
+    /**
+     * The URL that will be used for Payload to redirect to
+     */
+    serverURL?: string;
+    /**
+     * Encrypted signature to be verified
+     */
+    sig: string;
+    /**
+     * Code verifier used for PKCE
+     */
+    verifier: string;
+};
+export type LogFn = {
+    (msg: string, ...args: any[]): void;
+    (obj: unknown, msg?: string, ...args: any[]): void;
+    <T extends object>(obj: T, msg?: string, ...args: any[]): void;
+};
+export type DebugLogger = {
+    error: LogFn;
+    info: LogFn;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACzE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IAEH;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}

package/dist/oauth/types.js

@@ -0,0 +1,3 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */ export { };
+
+//# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAwNrD,WAGC"}

package/dist/oauth/utilities/clearCookie.d.ts

@@ -0,0 +1,9 @@
+import type { PayloadRequest } from 'payload';
+import type { CookieOptions } from '../types.js';
+export declare const clearCookie: (args: {
+    cookieName: string;
+    cookieOptions: CookieOptions;
+    overrides?: Partial<CookieOptions>;
+    req: PayloadRequest;
+}) => void;
+//# sourceMappingURL=clearCookie.d.ts.map

package/dist/oauth/utilities/clearCookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clearCookie.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/clearCookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAI7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,WAAW,SAAU;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,aAAa,CAAA;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAClC,GAAG,EAAE,cAAc,CAAA;CACpB,SAmBA,CAAA"}

package/dist/oauth/utilities/clearCookie.js

@@ -0,0 +1,21 @@
+import { generateCookie } from 'payload';
+import { getCookieExpiration } from './getCookieExpiration.js';
+export const clearCookie = (args)=>{
+    const options = {
+        ...args.cookieOptions,
+        ...args.overrides || {}
+    };
+    const clearedCookie = generateCookie({
+        ...options,
+        name: args.cookieName,
+        expires: getCookieExpiration(options?.expires) ?? new Date(),
+        returnCookieAsObject: false,
+        value: ''
+    });
+    if (!args.req.responseHeaders) {
+        args.req.responseHeaders = new Headers();
+    }
+    args.req.responseHeaders.append('Set-Cookie', clearedCookie);
+};
+
+//# sourceMappingURL=clearCookie.js.map

package/dist/oauth/utilities/clearCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/utilities/clearCookie.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { generateCookie } from 'payload'\n\nimport type { CookieOptions } from '../types.js'\n\nimport { getCookieExpiration } from './getCookieExpiration.js'\n\nexport const clearCookie = (args: {\n  cookieName: string\n  cookieOptions: CookieOptions\n  overrides?: Partial<CookieOptions>\n  req: PayloadRequest\n}) => {\n  const options = {\n    ...args.cookieOptions,\n    ...(args.overrides || {}),\n  }\n\n  const clearedCookie = generateCookie({\n    ...options,\n    name: args.cookieName,\n    expires: getCookieExpiration(options?.expires) ?? new Date(),\n    returnCookieAsObject: false,\n    value: '',\n  }) as string\n\n  if (!args.req.responseHeaders) {\n    args.req.responseHeaders = new Headers()\n  }\n\n  args.req.responseHeaders.append('Set-Cookie', clearedCookie)\n}\n"],"names":["generateCookie","getCookieExpiration","clearCookie","args","options","cookieOptions","overrides","clearedCookie","name","cookieName","expires","Date","returnCookieAsObject","value","req","responseHeaders","Headers","append"],"mappings":"AAEA,SAASA,cAAc,QAAQ,UAAS;AAIxC,SAASC,mBAAmB,QAAQ,2BAA0B;AAE9D,OAAO,MAAMC,cAAc,CAACC;IAM1B,MAAMC,UAAU;QACd,GAAGD,KAAKE,aAAa;QACrB,GAAIF,KAAKG,SAAS,IAAI,CAAC,CAAC;IAC1B;IAEA,MAAMC,gBAAgBP,eAAe;QACnC,GAAGI,OAAO;QACVI,MAAML,KAAKM,UAAU;QACrBC,SAAST,oBAAoBG,SAASM,YAAY,IAAIC;QACtDC,sBAAsB;QACtBC,OAAO;IACT;IAEA,IAAI,CAACV,KAAKW,GAAG,CAACC,eAAe,EAAE;QAC7BZ,KAAKW,GAAG,CAACC,eAAe,GAAG,IAAIC;IACjC;IAEAb,KAAKW,GAAG,CAACC,eAAe,CAACE,MAAM,CAAC,cAAcV;AAChD,EAAC"}

package/dist/oauth/utilities/createCookieOptions.d.ts

@@ -0,0 +1,10 @@
+import type { CollectionConfig } from 'payload';
+import type { CookieOptions, PluginOptions } from '../types.js';
+interface Args {
+    collection: CollectionConfig;
+    headers: Headers;
+    pluginOptions: PluginOptions;
+}
+export declare const createCookieOptions: ({ collection, headers, pluginOptions, }: Args) => CookieOptions;
+export {};
+//# sourceMappingURL=createCookieOptions.d.ts.map

package/dist/oauth/utilities/createCookieOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCookieOptions.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,SAAS,CAAA;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE/D,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;CAC7B;AAED,eAAO,MAAM,mBAAmB,4CAI7B,IAAI,KAAG,aA8CT,CAAA"}

package/dist/oauth/utilities/createCookieOptions.js

@@ -0,0 +1,42 @@
+export const createCookieOptions = ({ collection, headers, pluginOptions })=>{
+    let cookieOptions = {
+        domain: undefined,
+        httpOnly: true,
+        path: '/',
+        sameSite: undefined,
+        secure: false
+    };
+    if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {
+        const { domain, sameSite, secure } = collection.auth.cookies;
+        if (typeof secure === 'boolean') {
+            cookieOptions.secure = secure;
+        }
+        if (typeof sameSite === 'string') {
+            cookieOptions.sameSite = sameSite;
+        }
+        if (typeof domain === 'string') {
+            cookieOptions.domain = domain;
+        }
+    }
+    if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {
+        if (collection.auth.cookies.secure) {
+            cookieOptions.secure = true;
+        }
+        if (collection.auth.cookies.sameSite) {
+            cookieOptions.sameSite = typeof collection.auth.cookies.sameSite === 'string' ? collection.auth.cookies.sameSite : 'Lax';
+        }
+        if (collection.auth.cookies.domain) {
+            cookieOptions.domain = collection.auth.cookies.domain;
+        }
+    }
+    if (typeof pluginOptions.createCookieOptions === 'function') {
+        cookieOptions = pluginOptions.createCookieOptions({
+            collection,
+            cookieOptions,
+            headers
+        });
+    }
+    return cookieOptions;
+};
+
+//# sourceMappingURL=createCookieOptions.js.map

package/dist/oauth/utilities/createCookieOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"sourcesContent":["import type { CollectionConfig, PayloadRequest } from 'payload'\n\nimport type { CookieOptions, PluginOptions } from '../types.js'\n\ninterface Args {\n  collection: CollectionConfig\n  headers: Headers\n  pluginOptions: PluginOptions\n}\n\nexport const createCookieOptions = ({\n  collection,\n  headers,\n  pluginOptions,\n}: Args): CookieOptions => {\n  let cookieOptions: CookieOptions = {\n    domain: undefined,\n    httpOnly: true,\n    path: '/',\n    sameSite: undefined,\n    secure: false,\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    const { domain, sameSite, secure } = collection.auth.cookies\n    if (typeof secure === 'boolean') {\n      cookieOptions.secure = secure\n    }\n    if (typeof sameSite === 'string') {\n      cookieOptions.sameSite = sameSite as 'Lax'\n    }\n    if (typeof domain === 'string') {\n      cookieOptions.domain = domain\n    }\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    if (collection.auth.cookies.secure) {\n      cookieOptions.secure = true\n    }\n    if (collection.auth.cookies.sameSite) {\n      cookieOptions.sameSite =\n        typeof collection.auth.cookies.sameSite === 'string'\n          ? collection.auth.cookies.sameSite\n          : 'Lax'\n    }\n    if (collection.auth.cookies.domain) {\n      cookieOptions.domain = collection.auth.cookies.domain\n    }\n  }\n\n  if (typeof pluginOptions.createCookieOptions === 'function') {\n    cookieOptions = pluginOptions.createCookieOptions({\n      collection,\n      cookieOptions,\n      headers,\n    })\n  }\n\n  return cookieOptions\n}\n"],"names":["createCookieOptions","collection","headers","pluginOptions","cookieOptions","domain","undefined","httpOnly","path","sameSite","secure","auth","cookies"],"mappings":"AAUA,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,UAAU,EACVC,OAAO,EACPC,aAAa,EACR;IACL,IAAIC,gBAA+B;QACjCC,QAAQC;QACRC,UAAU;QACVC,MAAM;QACNC,UAAUH;QACVI,QAAQ;IACV;IAEA,IAAI,OAAOT,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,MAAM,EAAEP,MAAM,EAAEI,QAAQ,EAAEC,MAAM,EAAE,GAAGT,WAAWU,IAAI,CAACC,OAAO;QAC5D,IAAI,OAAOF,WAAW,WAAW;YAC/BN,cAAcM,MAAM,GAAGA;QACzB;QACA,IAAI,OAAOD,aAAa,UAAU;YAChCL,cAAcK,QAAQ,GAAGA;QAC3B;QACA,IAAI,OAAOJ,WAAW,UAAU;YAC9BD,cAAcC,MAAM,GAAGA;QACzB;IACF;IAEA,IAAI,OAAOJ,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,IAAIX,WAAWU,IAAI,CAACC,OAAO,CAACF,MAAM,EAAE;YAClCN,cAAcM,MAAM,GAAG;QACzB;QACA,IAAIT,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,EAAE;YACpCL,cAAcK,QAAQ,GACpB,OAAOR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,KAAK,WACxCR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,GAChC;QACR;QACA,IAAIR,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM,EAAE;YAClCD,cAAcC,MAAM,GAAGJ,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM;QACvD;IACF;IAEA,IAAI,OAAOF,cAAcH,mBAAmB,KAAK,YAAY;QAC3DI,gBAAgBD,cAAcH,mBAAmB,CAAC;YAChDC;YACAG;YACAF;QACF;IACF;IAEA,OAAOE;AACT,EAAC"}

package/dist/oauth/utilities/createDebugLogger.d.ts

@@ -0,0 +1,4 @@
+import type { Payload } from 'payload';
+import type { DebugLogger } from '../types.js';
+export declare const createDebugLogger: (payload: Payload, condition?: boolean) => DebugLogger;
+//# sourceMappingURL=createDebugLogger.d.ts.map

package/dist/oauth/utilities/createDebugLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createDebugLogger.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/createDebugLogger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,eAAO,MAAM,iBAAiB,YAAa,OAAO,cAAc,OAAO,KAAG,WAazE,CAAA"}