@payloadcms/figma 0.0.1-alpha.2 → 0.0.1-alpha.21

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth/index.ts"],"sourcesContent":["import type { AuthStrategy, IncomingAuthType, Plugin } from 'payload'\n\nimport type { PluginOptions } from './types.js'\n\nimport { defaultVerify } from './defaults.js'\nimport { getLoginEndpoint } from './endpoints/getLoginEndpoint.js'\nimport { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js'\nimport { getMetaEndpoint } from './endpoints/getMetaEndpoint.js'\nimport { getRedirectToLoginEndpoint } from './endpoints/getRedirectToLoginEndpoint.js'\nimport { getAfterLogout } from './hooks/afterLogout.js'\nimport { getMeHook } from './hooks/me.js'\nimport { getRefreshHook } from './hooks/refresh.js'\nimport { Strategy } from './strategy/index.js'\nimport { getAdminCollectionSlug } from './utilities/getAdminCollectionSlug.js'\nimport { getUsernameField } from './utilities/getUsernameField.js'\n\nexport const oAuth2Plugin =\n  (pluginOptions: PluginOptions): Plugin =>\n  (config) => {\n    const { collections: allCollectionOptions, debug, disabled } = pluginOptions\n\n    const strategyName = pluginOptions?.strategyName || 'oauth'\n    // Defaults to sso, but can be overridden to accommodate multiple strategies on one collection\n    const endpointSlug = pluginOptions?.strategyName || 'sso'\n\n    const adminCollectionSlug = getAdminCollectionSlug(config)\n    const adminCollectionOptions = allCollectionOptions.find(\n      ({ slug }) => slug === adminCollectionSlug,\n    )\n\n    if (!adminCollectionOptions) {\n      throw new Error(\n        `Can't find collection options for the admin collection ${adminCollectionSlug}.`,\n      )\n    }\n\n    let LoginButton = null\n\n    if (adminCollectionOptions.LoginButton === false) {\n      LoginButton = null\n    } else if (typeof adminCollectionOptions.LoginButton === 'string') {\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: adminCollectionOptions.LoginButton,\n      }\n    } else if (typeof adminCollectionOptions.LoginButton === 'object') {\n      LoginButton = {\n        ...adminCollectionOptions.LoginButton,\n        clientProps: {\n          ...adminCollectionOptions.LoginButton.clientProps,\n          disabled,\n          endpointSlug,\n        },\n      }\n    } else {\n      // Default to the provided LoginButton component path\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: '@payloadcms/plugin-oauth2/client#DefaultLoginButton',\n      }\n    }\n\n    return {\n      ...config,\n      admin: {\n        ...(config.admin || {}),\n        components: {\n          ...(typeof config.admin === 'object' && typeof config.admin.components === 'object'\n            ? config.admin.components\n            : {}),\n          ...(adminCollectionOptions.endOAuthSessionOnLogout\n            ? {\n                logout: {\n                  Button: {\n                    clientProps: {\n                      disabled,\n                      endpointSlug,\n                    },\n                    path: '@payloadcms/plugin-oauth2/client#LogoutButton',\n                  },\n                },\n              }\n            : {}),\n          beforeLogin: [\n            ...(typeof config.admin === 'object' &&\n            typeof config.admin.components === 'object' &&\n            Array.isArray(config.admin.components.beforeLogin)\n              ? config.admin.components.beforeLogin\n              : []),\n            ...(LoginButton ? [LoginButton] : []),\n          ],\n        },\n      },\n      collections: (config.collections || []).map((existingCollection) => {\n        const collectionOptions = allCollectionOptions.find(\n          ({ slug }) => slug === existingCollection.slug,\n        )\n\n        if (!collectionOptions) {\n          return existingCollection\n        }\n\n        let cookieName = pluginOptions?.cookieName || `payload-${strategyName}-token`\n        // If the usePayloadJWT option is enabled, use the default cookie name from Payload\n        if (collectionOptions.usePayloadJWT) {\n          cookieName = `${config.cookiePrefix || 'payload'}-token`\n        }\n\n        const usernameField = getUsernameField({\n          collection: existingCollection,\n          collectionOptions,\n        })\n\n        const fields = [\n          ...existingCollection.fields,\n          ...(typeof adminCollectionOptions.usernameField === 'string' ? [] : [usernameField]),\n        ]\n\n        if (disabled) {\n          return {\n            ...existingCollection,\n            fields,\n          }\n        }\n\n        const strategy = new Strategy({\n          clientID: collectionOptions.clientID,\n          clientSecret: collectionOptions.clientSecret,\n          collection: existingCollection,\n          collectionOptions,\n          cookieName,\n          debug,\n          identityMetadata: collectionOptions.identityMetadata,\n          pluginOptions,\n          strategyName,\n          verify:\n            collectionOptions.verify ??\n            defaultVerify({\n              collection: existingCollection,\n              strategyName,\n              usernameField,\n            }),\n        })\n\n        const authStrategy: AuthStrategy = {\n          name: `${existingCollection.slug}-${strategyName}`,\n          // Bind 'this' to ensure the authenticate function has the correct context\n          authenticate: strategy.authenticate.bind(strategy),\n        }\n\n        let disableLocalStrategy: IncomingAuthType['disableLocalStrategy']\n\n        if (collectionOptions.disableLocalStrategy === false) {\n          // When the plugin collection option has disableLocalStrategy option set to false, do not disable the local strategy\n          disableLocalStrategy = undefined\n        } else if (collectionOptions.disableLocalStrategy) {\n          // use the configured disableLocalStrategy which can include `enableFields`, etc.\n          disableLocalStrategy = collectionOptions.disableLocalStrategy\n        } else {\n          // by default disableLocalStrategy\n          disableLocalStrategy = true\n        }\n\n        return {\n          ...existingCollection,\n          auth: {\n            ...(typeof existingCollection.auth === 'object' ? existingCollection.auth : {}),\n            disableLocalStrategy,\n            strategies: [\n              ...(typeof existingCollection.auth === 'object' &&\n              Array.isArray(existingCollection.auth.strategies)\n                ? existingCollection.auth.strategies\n                : []),\n              authStrategy,\n            ],\n          },\n          endpoints: [\n            ...(existingCollection.endpoints || []),\n            getLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getMetaEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getLogoutEndpoint({\n              collection: existingCollection,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getRedirectToLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n          ],\n          fields,\n          hooks: {\n            ...(existingCollection.hooks || {}),\n            afterLogout: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.afterLogout)\n                ? existingCollection.hooks.afterLogout\n                : []),\n              getAfterLogout({\n                collection: existingCollection,\n                cookieName,\n                pluginOptions,\n              }),\n            ],\n            me: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.me)\n                ? existingCollection.hooks.me\n                : []),\n              // Do not inject the me hook if the usePayloadJWT option is enabled\n              ...(!collectionOptions.usePayloadJWT ? [getMeHook({ cookieName })] : []),\n            ],\n            refresh: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.refresh)\n                ? existingCollection.hooks.refresh\n                : []),\n              getRefreshHook({ pluginOptions, strategy }),\n            ],\n          },\n        }\n      }),\n    }\n  }\n"],"names":["defaultVerify","getLoginEndpoint","getLogoutEndpoint","getMetaEndpoint","getRedirectToLoginEndpoint","getAfterLogout","getMeHook","getRefreshHook","Strategy","getAdminCollectionSlug","getUsernameField","oAuth2Plugin","pluginOptions","config","collections","allCollectionOptions","debug","disabled","strategyName","endpointSlug","adminCollectionSlug","adminCollectionOptions","find","slug","Error","LoginButton","clientProps","path","admin","components","endOAuthSessionOnLogout","logout","Button","beforeLogin","Array","isArray","map","existingCollection","collectionOptions","cookieName","usePayloadJWT","cookiePrefix","usernameField","collection","fields","strategy","clientID","clientSecret","identityMetadata","verify","authStrategy","name","authenticate","bind","disableLocalStrategy","undefined","auth","strategies","endpoints","hooks","afterLogout","me","refresh"],"mappings":"AAIA,SAASA,aAAa,QAAQ,gBAAe;AAC7C,SAASC,gBAAgB,QAAQ,kCAAiC;AAClE,SAASC,iBAAiB,QAAQ,mCAAkC;AACpE,SAASC,eAAe,QAAQ,iCAAgC;AAChE,SAASC,0BAA0B,QAAQ,4CAA2C;AACtF,SAASC,cAAc,QAAQ,yBAAwB;AACvD,SAASC,SAAS,QAAQ,gBAAe;AACzC,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,QAAQ,QAAQ,sBAAqB;AAC9C,SAASC,sBAAsB,QAAQ,wCAAuC;AAC9E,SAASC,gBAAgB,QAAQ,kCAAiC;AAElE,OAAO,MAAMC,eACX,CAACC,gBACD,CAACC;QACC,MAAM,EAAEC,aAAaC,oBAAoB,EAAEC,KAAK,EAAEC,QAAQ,EAAE,GAAGL;QAE/D,MAAMM,eAAeN,eAAeM,gBAAgB;QACpD,8FAA8F;QAC9F,MAAMC,eAAeP,eAAeM,gBAAgB;QAEpD,MAAME,sBAAsBX,uBAAuBI;QACnD,MAAMQ,yBAAyBN,qBAAqBO,IAAI,CACtD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASH;QAGzB,IAAI,CAACC,wBAAwB;YAC3B,MAAM,IAAIG,MACR,CAAC,uDAAuD,EAAEJ,oBAAoB,CAAC,CAAC;QAEpF;QAEA,IAAIK,cAAc;QAElB,IAAIJ,uBAAuBI,WAAW,KAAK,OAAO;YAChDA,cAAc;QAChB,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAMN,uBAAuBI,WAAW;YAC1C;QACF,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZ,GAAGJ,uBAAuBI,WAAW;gBACrCC,aAAa;oBACX,GAAGL,uBAAuBI,WAAW,CAACC,WAAW;oBACjDT;oBACAE;gBACF;YACF;QACF,OAAO;YACL,qDAAqD;YACrDM,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAM;YACR;QACF;QAEA,OAAO;YACL,GAAGd,MAAM;YACTe,OAAO;gBACL,GAAIf,OAAOe,KAAK,IAAI,CAAC,CAAC;gBACtBC,YAAY;oBACV,GAAI,OAAOhB,OAAOe,KAAK,KAAK,YAAY,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,WACvEhB,OAAOe,KAAK,CAACC,UAAU,GACvB,CAAC,CAAC;oBACN,GAAIR,uBAAuBS,uBAAuB,GAC9C;wBACEC,QAAQ;4BACNC,QAAQ;gCACNN,aAAa;oCACXT;oCACAE;gCACF;gCACAQ,MAAM;4BACR;wBACF;oBACF,IACA,CAAC,CAAC;oBACNM,aAAa;2BACP,OAAOpB,OAAOe,KAAK,KAAK,YAC5B,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,YACnCK,MAAMC,OAAO,CAACtB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,IAC7CpB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,GACnC,EAAE;2BACFR,cAAc;4BAACA;yBAAY,GAAG,EAAE;qBACrC;gBACH;YACF;YACAX,aAAa,AAACD,CAAAA,OAAOC,WAAW,IAAI,EAAE,AAAD,EAAGsB,GAAG,CAAC,CAACC;gBAC3C,MAAMC,oBAAoBvB,qBAAqBO,IAAI,CACjD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASc,mBAAmBd,IAAI;gBAGhD,IAAI,CAACe,mBAAmB;oBACtB,OAAOD;gBACT;gBAEA,IAAIE,aAAa3B,eAAe2B,cAAc,CAAC,QAAQ,EAAErB,aAAa,MAAM,CAAC;gBAC7E,mFAAmF;gBACnF,IAAIoB,kBAAkBE,aAAa,EAAE;oBACnCD,aAAa,GAAG1B,OAAO4B,YAAY,IAAI,UAAU,MAAM,CAAC;gBAC1D;gBAEA,MAAMC,gBAAgBhC,iBAAiB;oBACrCiC,YAAYN;oBACZC;gBACF;gBAEA,MAAMM,SAAS;uBACVP,mBAAmBO,MAAM;uBACxB,OAAOvB,uBAAuBqB,aAAa,KAAK,WAAW,EAAE,GAAG;wBAACA;qBAAc;iBACpF;gBAED,IAAIzB,UAAU;oBACZ,OAAO;wBACL,GAAGoB,kBAAkB;wBACrBO;oBACF;gBACF;gBAEA,MAAMC,WAAW,IAAIrC,SAAS;oBAC5BsC,UAAUR,kBAAkBQ,QAAQ;oBACpCC,cAAcT,kBAAkBS,YAAY;oBAC5CJ,YAAYN;oBACZC;oBACAC;oBACAvB;oBACAgC,kBAAkBV,kBAAkBU,gBAAgB;oBACpDpC;oBACAM;oBACA+B,QACEX,kBAAkBW,MAAM,IACxBjD,cAAc;wBACZ2C,YAAYN;wBACZnB;wBACAwB;oBACF;gBACJ;gBAEA,MAAMQ,eAA6B;oBACjCC,MAAM,GAAGd,mBAAmBd,IAAI,CAAC,CAAC,EAAEL,cAAc;oBAClD,0EAA0E;oBAC1EkC,cAAcP,SAASO,YAAY,CAACC,IAAI,CAACR;gBAC3C;gBAEA,IAAIS;gBAEJ,IAAIhB,kBAAkBgB,oBAAoB,KAAK,OAAO;oBACpD,oHAAoH;oBACpHA,uBAAuBC;gBACzB,OAAO,IAAIjB,kBAAkBgB,oBAAoB,EAAE;oBACjD,iFAAiF;oBACjFA,uBAAuBhB,kBAAkBgB,oBAAoB;gBAC/D,OAAO;oBACL,kCAAkC;oBAClCA,uBAAuB;gBACzB;gBAEA,OAAO;oBACL,GAAGjB,kBAAkB;oBACrBmB,MAAM;wBACJ,GAAI,OAAOnB,mBAAmBmB,IAAI,KAAK,WAAWnB,mBAAmBmB,IAAI,GAAG,CAAC,CAAC;wBAC9EF;wBACAG,YAAY;+BACN,OAAOpB,mBAAmBmB,IAAI,KAAK,YACvCtB,MAAMC,OAAO,CAACE,mBAAmBmB,IAAI,CAACC,UAAU,IAC5CpB,mBAAmBmB,IAAI,CAACC,UAAU,GAClC,EAAE;4BACNP;yBACD;oBACH;oBACAQ,WAAW;2BACLrB,mBAAmBqB,SAAS,IAAI,EAAE;wBACtCzD,iBAAiB;4BACf0C,YAAYN;4BACZC;4BACAnB;4BACAP;4BACAiC;wBACF;wBACA1C,gBAAgB;4BACdwC,YAAYN;4BACZC;4BACAnB;4BACAP;4BACAiC;wBACF;wBACA3C,kBAAkB;4BAChByC,YAAYN;4BACZlB;4BACAP;4BACAiC;wBACF;wBACAzC,2BAA2B;4BACzBuC,YAAYN;4BACZC;4BACAnB;4BACAP;4BACAiC;wBACF;qBACD;oBACDD;oBACAe,OAAO;wBACL,GAAItB,mBAAmBsB,KAAK,IAAI,CAAC,CAAC;wBAClCC,aAAa;+BACP,OAAOvB,mBAAmBsB,KAAK,KAAK,YACxCzB,MAAMC,OAAO,CAACE,mBAAmBsB,KAAK,CAACC,WAAW,IAC9CvB,mBAAmBsB,KAAK,CAACC,WAAW,GACpC,EAAE;4BACNvD,eAAe;gCACbsC,YAAYN;gCACZE;gCACA3B;4BACF;yBACD;wBACDiD,IAAI;+BACE,OAAOxB,mBAAmBsB,KAAK,KAAK,YACxCzB,MAAMC,OAAO,CAACE,mBAAmBsB,KAAK,CAACE,EAAE,IACrCxB,mBAAmBsB,KAAK,CAACE,EAAE,GAC3B,EAAE;4BACN,mEAAmE;+BAC/D,CAACvB,kBAAkBE,aAAa,GAAG;gCAAClC,UAAU;oCAAEiC;gCAAW;6BAAG,GAAG,EAAE;yBACxE;wBACDuB,SAAS;+BACH,OAAOzB,mBAAmBsB,KAAK,KAAK,YACxCzB,MAAMC,OAAO,CAACE,mBAAmBsB,KAAK,CAACG,OAAO,IAC1CzB,mBAAmBsB,KAAK,CAACG,OAAO,GAChC,EAAE;4BACNvD,eAAe;gCAAEK;gCAAeiC;4BAAS;yBAC1C;oBACH;gBACF;YACF;QACF;IACF,EAAC"}
+{"version":3,"sources":["../../src/oauth/index.ts"],"sourcesContent":["import type { AuthStrategy, CollectionConfig, IncomingAuthType, Plugin } from 'payload'\n\nimport { fieldAffectsData } from 'payload/shared'\n\nimport type { PluginOptions } from './types.js'\n\nimport { defaultVerify } from './defaults.js'\nimport { getLoginEndpoint } from './endpoints/getLoginEndpoint.js'\nimport { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js'\nimport { getMetaEndpoint } from './endpoints/getMetaEndpoint.js'\nimport { getRedirectToLoginEndpoint } from './endpoints/getRedirectToLoginEndpoint.js'\nimport { getAfterLogout } from './hooks/afterLogout.js'\nimport { getMeHook } from './hooks/me.js'\nimport { getRefreshHook } from './hooks/refresh.js'\nimport { Strategy } from './strategy/index.js'\nimport { getAdminCollectionSlug } from './utilities/getAdminCollectionSlug.js'\nimport { getUsernameField } from './utilities/getUsernameField.js'\n\nexport const oAuth2Plugin =\n  (pluginOptions: PluginOptions): Plugin =>\n  (config) => {\n    const { collections: allCollectionOptions, debug, disabled } = pluginOptions\n\n    const strategyName = pluginOptions?.strategyName || 'oauth'\n    // Defaults to sso, but can be overridden to accommodate multiple strategies on one collection\n    const endpointSlug = pluginOptions?.strategyName || 'sso'\n\n    const adminCollectionSlug = getAdminCollectionSlug(config)\n    const adminCollectionOptions = allCollectionOptions.find(\n      ({ slug }) => slug === adminCollectionSlug,\n    )\n\n    if (!adminCollectionOptions) {\n      throw new Error(\n        `Can't find collection options for the admin collection ${adminCollectionSlug}.`,\n      )\n    }\n\n    let LoginButton = null\n\n    if (adminCollectionOptions.LoginButton === false) {\n      LoginButton = null\n    } else if (typeof adminCollectionOptions.LoginButton === 'string') {\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: adminCollectionOptions.LoginButton,\n      }\n    } else if (typeof adminCollectionOptions.LoginButton === 'object') {\n      LoginButton = {\n        ...adminCollectionOptions.LoginButton,\n        clientProps: {\n          ...adminCollectionOptions.LoginButton.clientProps,\n          disabled,\n          endpointSlug,\n        },\n      }\n    } else {\n      // Default to the provided LoginButton component path\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: '@payloadcms/figma/client#DefaultLoginButton',\n      }\n    }\n\n    return {\n      ...config,\n      admin: {\n        ...(config.admin || {}),\n        components: {\n          ...(typeof config.admin === 'object' && typeof config.admin.components === 'object'\n            ? config.admin.components\n            : {}),\n          ...(adminCollectionOptions.endOAuthSessionOnLogout\n            ? {\n                logout: {\n                  Button: {\n                    clientProps: {\n                      disabled,\n                      endpointSlug,\n                    },\n                    path: '@payloadcms/figma/client#LogoutButton',\n                  },\n                },\n              }\n            : {}),\n          beforeLogin: [\n            ...(typeof config.admin === 'object' &&\n            typeof config.admin.components === 'object' &&\n            Array.isArray(config.admin.components.beforeLogin)\n              ? config.admin.components.beforeLogin\n              : []),\n            ...(LoginButton ? [LoginButton] : []),\n          ],\n        },\n      },\n      collections: (config.collections || []).map((existingCollection) => {\n        const collectionOptions = allCollectionOptions.find(\n          ({ slug }) => slug === existingCollection.slug,\n        )\n\n        if (!collectionOptions) {\n          return existingCollection\n        }\n\n        let cookieName = pluginOptions?.cookieName || `payload-${strategyName}-token`\n        // If the usePayloadJWT option is enabled, use the default cookie name from Payload\n        if (collectionOptions.usePayloadJWT) {\n          cookieName = `${config.cookiePrefix || 'payload'}-token`\n        }\n\n        // Check if email field exists, if not add it\n        const hasEmailField = existingCollection.fields.some(\n          (field) => 'name' in field && field.name === 'email',\n        )\n\n        // Add email field to collection before getting username field\n        // This ensures getUsernameField can find the email field if it's configured as the username\n        const collectionWithEmail: CollectionConfig = hasEmailField\n          ? existingCollection\n          : {\n              ...existingCollection,\n              fields: [\n                ...existingCollection.fields,\n                {\n                  name: 'email',\n                  type: 'email',\n                },\n              ],\n            }\n\n        const usernameField = getUsernameField({\n          collection: collectionWithEmail,\n          collectionOptions,\n        })\n\n        // Make username field readOnly\n        const readOnlyUsernameField = {\n          ...usernameField,\n          admin: {\n            ...(usernameField.admin || {}),\n            readOnly: true,\n          },\n        } as typeof usernameField\n\n        const isUsernameFieldString = typeof adminCollectionOptions.usernameField === 'string'\n\n        const fields = [\n          ...collectionWithEmail.fields.map((field) =>\n            fieldAffectsData(field) && field.name === usernameField.name\n              ? readOnlyUsernameField\n              : field,\n          ),\n          ...(isUsernameFieldString ? [] : [readOnlyUsernameField]),\n        ]\n\n        if (disabled) {\n          return {\n            ...existingCollection,\n            fields,\n          }\n        }\n\n        const strategy = new Strategy({\n          clientID: collectionOptions.clientID,\n          clientSecret: collectionOptions.clientSecret,\n          collection: existingCollection,\n          collectionOptions,\n          cookieName,\n          debug,\n          identityMetadata: collectionOptions.identityMetadata,\n          pluginOptions,\n          strategyName,\n          verify:\n            collectionOptions.verify ??\n            defaultVerify({\n              collection: existingCollection,\n              strategyName,\n              usernameField,\n            }),\n        })\n\n        const authStrategy: AuthStrategy = {\n          name: `${existingCollection.slug}-${strategyName}`,\n          // Bind 'this' to ensure the authenticate function has the correct context\n          authenticate: strategy.authenticate.bind(strategy),\n        }\n\n        let disableLocalStrategy: IncomingAuthType['disableLocalStrategy']\n\n        if (collectionOptions.disableLocalStrategy === false) {\n          // When the plugin collection option has disableLocalStrategy option set to false, do not disable the local strategy\n          disableLocalStrategy = undefined\n        } else if (collectionOptions.disableLocalStrategy) {\n          // use the configured disableLocalStrategy which can include `enableFields`, etc.\n          disableLocalStrategy = collectionOptions.disableLocalStrategy\n        } else {\n          // by default disableLocalStrategy\n          disableLocalStrategy = true\n        }\n\n        return {\n          ...existingCollection,\n          auth: {\n            ...(typeof existingCollection.auth === 'object' ? existingCollection.auth : {}),\n            disableLocalStrategy,\n            strategies: [\n              ...(typeof existingCollection.auth === 'object' &&\n              Array.isArray(existingCollection.auth.strategies)\n                ? existingCollection.auth.strategies\n                : []),\n              authStrategy,\n            ],\n          },\n          endpoints: [\n            ...(existingCollection.endpoints || []),\n            getLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getMetaEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getLogoutEndpoint({\n              collection: existingCollection,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getRedirectToLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n          ],\n          fields,\n          hooks: {\n            ...(existingCollection.hooks || {}),\n            afterLogout: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.afterLogout)\n                ? existingCollection.hooks.afterLogout\n                : []),\n              getAfterLogout({\n                collection: existingCollection,\n                cookieName,\n                pluginOptions,\n              }),\n            ],\n            me: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.me)\n                ? existingCollection.hooks.me\n                : []),\n              // Do not inject the me hook if the usePayloadJWT option is enabled\n              ...(!collectionOptions.usePayloadJWT ? [getMeHook({ cookieName })] : []),\n            ],\n            refresh: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.refresh)\n                ? existingCollection.hooks.refresh\n                : []),\n              getRefreshHook({ pluginOptions, strategy }),\n            ],\n          },\n        }\n      }),\n    }\n  }\n"],"names":["fieldAffectsData","defaultVerify","getLoginEndpoint","getLogoutEndpoint","getMetaEndpoint","getRedirectToLoginEndpoint","getAfterLogout","getMeHook","getRefreshHook","Strategy","getAdminCollectionSlug","getUsernameField","oAuth2Plugin","pluginOptions","config","collections","allCollectionOptions","debug","disabled","strategyName","endpointSlug","adminCollectionSlug","adminCollectionOptions","find","slug","Error","LoginButton","clientProps","path","admin","components","endOAuthSessionOnLogout","logout","Button","beforeLogin","Array","isArray","map","existingCollection","collectionOptions","cookieName","usePayloadJWT","cookiePrefix","hasEmailField","fields","some","field","name","collectionWithEmail","type","usernameField","collection","readOnlyUsernameField","readOnly","isUsernameFieldString","strategy","clientID","clientSecret","identityMetadata","verify","authStrategy","authenticate","bind","disableLocalStrategy","undefined","auth","strategies","endpoints","hooks","afterLogout","me","refresh"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,iBAAgB;AAIjD,SAASC,aAAa,QAAQ,gBAAe;AAC7C,SAASC,gBAAgB,QAAQ,kCAAiC;AAClE,SAASC,iBAAiB,QAAQ,mCAAkC;AACpE,SAASC,eAAe,QAAQ,iCAAgC;AAChE,SAASC,0BAA0B,QAAQ,4CAA2C;AACtF,SAASC,cAAc,QAAQ,yBAAwB;AACvD,SAASC,SAAS,QAAQ,gBAAe;AACzC,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,QAAQ,QAAQ,sBAAqB;AAC9C,SAASC,sBAAsB,QAAQ,wCAAuC;AAC9E,SAASC,gBAAgB,QAAQ,kCAAiC;AAElE,OAAO,MAAMC,eACX,CAACC,gBACD,CAACC;QACC,MAAM,EAAEC,aAAaC,oBAAoB,EAAEC,KAAK,EAAEC,QAAQ,EAAE,GAAGL;QAE/D,MAAMM,eAAeN,eAAeM,gBAAgB;QACpD,8FAA8F;QAC9F,MAAMC,eAAeP,eAAeM,gBAAgB;QAEpD,MAAME,sBAAsBX,uBAAuBI;QACnD,MAAMQ,yBAAyBN,qBAAqBO,IAAI,CACtD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASH;QAGzB,IAAI,CAACC,wBAAwB;YAC3B,MAAM,IAAIG,MACR,CAAC,uDAAuD,EAAEJ,oBAAoB,CAAC,CAAC;QAEpF;QAEA,IAAIK,cAAc;QAElB,IAAIJ,uBAAuBI,WAAW,KAAK,OAAO;YAChDA,cAAc;QAChB,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAMN,uBAAuBI,WAAW;YAC1C;QACF,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZ,GAAGJ,uBAAuBI,WAAW;gBACrCC,aAAa;oBACX,GAAGL,uBAAuBI,WAAW,CAACC,WAAW;oBACjDT;oBACAE;gBACF;YACF;QACF,OAAO;YACL,qDAAqD;YACrDM,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAM;YACR;QACF;QAEA,OAAO;YACL,GAAGd,MAAM;YACTe,OAAO;gBACL,GAAIf,OAAOe,KAAK,IAAI,CAAC,CAAC;gBACtBC,YAAY;oBACV,GAAI,OAAOhB,OAAOe,KAAK,KAAK,YAAY,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,WACvEhB,OAAOe,KAAK,CAACC,UAAU,GACvB,CAAC,CAAC;oBACN,GAAIR,uBAAuBS,uBAAuB,GAC9C;wBACEC,QAAQ;4BACNC,QAAQ;gCACNN,aAAa;oCACXT;oCACAE;gCACF;gCACAQ,MAAM;4BACR;wBACF;oBACF,IACA,CAAC,CAAC;oBACNM,aAAa;2BACP,OAAOpB,OAAOe,KAAK,KAAK,YAC5B,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,YACnCK,MAAMC,OAAO,CAACtB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,IAC7CpB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,GACnC,EAAE;2BACFR,cAAc;4BAACA;yBAAY,GAAG,EAAE;qBACrC;gBACH;YACF;YACAX,aAAa,AAACD,CAAAA,OAAOC,WAAW,IAAI,EAAE,AAAD,EAAGsB,GAAG,CAAC,CAACC;gBAC3C,MAAMC,oBAAoBvB,qBAAqBO,IAAI,CACjD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASc,mBAAmBd,IAAI;gBAGhD,IAAI,CAACe,mBAAmB;oBACtB,OAAOD;gBACT;gBAEA,IAAIE,aAAa3B,eAAe2B,cAAc,CAAC,QAAQ,EAAErB,aAAa,MAAM,CAAC;gBAC7E,mFAAmF;gBACnF,IAAIoB,kBAAkBE,aAAa,EAAE;oBACnCD,aAAa,GAAG1B,OAAO4B,YAAY,IAAI,UAAU,MAAM,CAAC;gBAC1D;gBAEA,6CAA6C;gBAC7C,MAAMC,gBAAgBL,mBAAmBM,MAAM,CAACC,IAAI,CAClD,CAACC,QAAU,UAAUA,SAASA,MAAMC,IAAI,KAAK;gBAG/C,8DAA8D;gBAC9D,4FAA4F;gBAC5F,MAAMC,sBAAwCL,gBAC1CL,qBACA;oBACE,GAAGA,kBAAkB;oBACrBM,QAAQ;2BACHN,mBAAmBM,MAAM;wBAC5B;4BACEG,MAAM;4BACNE,MAAM;wBACR;qBACD;gBACH;gBAEJ,MAAMC,gBAAgBvC,iBAAiB;oBACrCwC,YAAYH;oBACZT;gBACF;gBAEA,+BAA+B;gBAC/B,MAAMa,wBAAwB;oBAC5B,GAAGF,aAAa;oBAChBrB,OAAO;wBACL,GAAIqB,cAAcrB,KAAK,IAAI,CAAC,CAAC;wBAC7BwB,UAAU;oBACZ;gBACF;gBAEA,MAAMC,wBAAwB,OAAOhC,uBAAuB4B,aAAa,KAAK;gBAE9E,MAAMN,SAAS;uBACVI,oBAAoBJ,MAAM,CAACP,GAAG,CAAC,CAACS,QACjC9C,iBAAiB8C,UAAUA,MAAMC,IAAI,KAAKG,cAAcH,IAAI,GACxDK,wBACAN;uBAEFQ,wBAAwB,EAAE,GAAG;wBAACF;qBAAsB;iBACzD;gBAED,IAAIlC,UAAU;oBACZ,OAAO;wBACL,GAAGoB,kBAAkB;wBACrBM;oBACF;gBACF;gBAEA,MAAMW,WAAW,IAAI9C,SAAS;oBAC5B+C,UAAUjB,kBAAkBiB,QAAQ;oBACpCC,cAAclB,kBAAkBkB,YAAY;oBAC5CN,YAAYb;oBACZC;oBACAC;oBACAvB;oBACAyC,kBAAkBnB,kBAAkBmB,gBAAgB;oBACpD7C;oBACAM;oBACAwC,QACEpB,kBAAkBoB,MAAM,IACxB1D,cAAc;wBACZkD,YAAYb;wBACZnB;wBACA+B;oBACF;gBACJ;gBAEA,MAAMU,eAA6B;oBACjCb,MAAM,GAAGT,mBAAmBd,IAAI,CAAC,CAAC,EAAEL,cAAc;oBAClD,0EAA0E;oBAC1E0C,cAAcN,SAASM,YAAY,CAACC,IAAI,CAACP;gBAC3C;gBAEA,IAAIQ;gBAEJ,IAAIxB,kBAAkBwB,oBAAoB,KAAK,OAAO;oBACpD,oHAAoH;oBACpHA,uBAAuBC;gBACzB,OAAO,IAAIzB,kBAAkBwB,oBAAoB,EAAE;oBACjD,iFAAiF;oBACjFA,uBAAuBxB,kBAAkBwB,oBAAoB;gBAC/D,OAAO;oBACL,kCAAkC;oBAClCA,uBAAuB;gBACzB;gBAEA,OAAO;oBACL,GAAGzB,kBAAkB;oBACrB2B,MAAM;wBACJ,GAAI,OAAO3B,mBAAmB2B,IAAI,KAAK,WAAW3B,mBAAmB2B,IAAI,GAAG,CAAC,CAAC;wBAC9EF;wBACAG,YAAY;+BACN,OAAO5B,mBAAmB2B,IAAI,KAAK,YACvC9B,MAAMC,OAAO,CAACE,mBAAmB2B,IAAI,CAACC,UAAU,IAC5C5B,mBAAmB2B,IAAI,CAACC,UAAU,GAClC,EAAE;4BACNN;yBACD;oBACH;oBACAO,WAAW;2BACL7B,mBAAmB6B,SAAS,IAAI,EAAE;wBACtCjE,iBAAiB;4BACfiD,YAAYb;4BACZC;4BACAnB;4BACAP;4BACA0C;wBACF;wBACAnD,gBAAgB;4BACd+C,YAAYb;4BACZC;4BACAnB;4BACAP;4BACA0C;wBACF;wBACApD,kBAAkB;4BAChBgD,YAAYb;4BACZlB;4BACAP;4BACA0C;wBACF;wBACAlD,2BAA2B;4BACzB8C,YAAYb;4BACZC;4BACAnB;4BACAP;4BACA0C;wBACF;qBACD;oBACDX;oBACAwB,OAAO;wBACL,GAAI9B,mBAAmB8B,KAAK,IAAI,CAAC,CAAC;wBAClCC,aAAa;+BACP,OAAO/B,mBAAmB8B,KAAK,KAAK,YACxCjC,MAAMC,OAAO,CAACE,mBAAmB8B,KAAK,CAACC,WAAW,IAC9C/B,mBAAmB8B,KAAK,CAACC,WAAW,GACpC,EAAE;4BACN/D,eAAe;gCACb6C,YAAYb;gCACZE;gCACA3B;4BACF;yBACD;wBACDyD,IAAI;+BACE,OAAOhC,mBAAmB8B,KAAK,KAAK,YACxCjC,MAAMC,OAAO,CAACE,mBAAmB8B,KAAK,CAACE,EAAE,IACrChC,mBAAmB8B,KAAK,CAACE,EAAE,GAC3B,EAAE;4BACN,mEAAmE;+BAC/D,CAAC/B,kBAAkBE,aAAa,GAAG;gCAAClC,UAAU;oCAAEiC;gCAAW;6BAAG,GAAG,EAAE;yBACxE;wBACD+B,SAAS;+BACH,OAAOjC,mBAAmB8B,KAAK,KAAK,YACxCjC,MAAMC,OAAO,CAACE,mBAAmB8B,KAAK,CAACG,OAAO,IAC1CjC,mBAAmB8B,KAAK,CAACG,OAAO,GAChC,EAAE;4BACN/D,eAAe;gCAAEK;gCAAe0C;4BAAS;yBAC1C;oBACH;gBACF;YACF;QACF;IACF,EAAC"}

package/dist/oauth/strategy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/strategy/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AAEnC,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,OAAO,EACR,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAUnF,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,cAAc,CAAA;CACvB;AAED,qBAAa,QAAQ;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,EAAE,MAAM,CAAA;IAElB,KAAK,EAAE,OAAO,CAAA;IAGd,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,CAAA;IAElC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;KACjB,CAAA;IACD,IAAI,CAAC,EAAE;QACL,sBAAsB,EAAE,MAAM,CAAA;QAC9B,oBAAoB,EAAE,MAAM,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,iBAAiB,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,mBAAmB,CAAC,EAAE,IAAI,CAAA;IAE1B,WAAW,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,aAAa,CAAA;IAC5B,MAAM,EAAE,cAAc,CAAA;gBAEV,OAAO,EAAE,OAAO;IAiBtB,YAAY,CAAC,EACjB,aAAa,EACb,OAAO,EACP,OAAO,GACR,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyJnD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAe3B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAkD1B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C1D,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;CAmB3F;AAED,KAAK,aAAa,GAAG;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/strategy/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AAEnC,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,OAAO,EACR,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AASnF,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,cAAc,CAAA;CACvB;AAED,qBAAa,QAAQ;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,EAAE,MAAM,CAAA;IAElB,KAAK,EAAE,OAAO,CAAA;IAGd,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,CAAA;IAElC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;KACjB,CAAA;IACD,IAAI,CAAC,EAAE;QACL,sBAAsB,EAAE,MAAM,CAAA;QAC9B,oBAAoB,EAAE,MAAM,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,iBAAiB,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,mBAAmB,CAAC,EAAE,IAAI,CAAA;IAE1B,WAAW,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,aAAa,CAAA;IAC5B,MAAM,EAAE,cAAc,CAAA;gBAEV,OAAO,EAAE,OAAO;IAiBtB,YAAY,CAAC,EACjB,aAAa,EACb,OAAO,EACP,OAAO,GACR,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyJnD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAe3B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAkD1B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C1D,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;CAmB3F;AAED,KAAK,aAAa,GAAG;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA"}

package/dist/oauth/strategy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js'\nimport { ProjectTokenError } from '../../auth/project-token.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof Error &&\n      oauthTokenVerifyResult.name === 'TokenExpiredError' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAA6BC,oBAAoB,QAAQ,8BAA6B;AAEtF,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUrC,aAAakC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCE,SAClCF,uBAAuBjC,IAAI,KAAK,uBAChCmB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACgD,aAAa,IACrC1B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI0C,KAAKC,GAAG,KAAK,IAAI,CAAC3C,mBAAmB,CAAC4C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAAChD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC6C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC5C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI6C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAAChD,IAAI,GAAG,MAAMiD,MAAM,IAAI,CAACnD,mBAAmB,EAAEoD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACxE,IAAI,CAACvD,QAAQ,CAAC,CAAC,+BAA+B,EAAEmD,SAAS;oBAEzD,IAAI,IAAI,CAAChD,IAAI,EAAEqD,UAAU;wBACvB,IAAI,CAACtD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACjD,IAAI,CAACqD,QAAQ,EAAEH,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACnD,mBAAmB,GAAG,IAAI0C;oBAC/B,IAAI,CAAC9C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACqD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBR,YAAYQ;oBACZ,IAAI,CAAC1D,QAAQ,CAAC,CAAC,2BAA2B,EAAEmD,QAAQ,IAAI,EAAGO,OAAiBC,SAAS;oBAErF,IAAIR,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIS,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACb,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIlE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACgB,mBAAmB,CAAC,eAAe,EACjF,AAACiD,WAAqBS,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACtD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG4D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACnE,IAAI,IAAIoE,MAAMC,OAAO,CAAC,IAAI,CAACrE,IAAI,CAACmE,IAAI,IAAI,IAAI,CAACnE,IAAI,CAACmE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAIzB,MAAM;QAClB;QAEA,IAAI,CAAC0B,KAAK;YACR,MAAM,IAAI1B,MAAM;QAClB;QAEA,IAAI,CAAC2B,MAAM;YACT,MAAM,IAAI3B,MAAM;QAClB;QAEA,KAAK,MAAMgC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM3F,KAAK4F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAInC,MAAM;YAClB;YAEA8B,SAAS,MAAMxF,KAAK8F,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAI/B,MAAM;QAClB;QAEA,IAAI,CAAC8B,QAAQ;YACX,MAAM,IAAI9B,MAAM;QAClB;QAEA,OAAO8B;IACT;IAEA,MAAM/B,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM2C,WAAW,MAAM5F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO2F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB3D,QAAQ4D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACApD,KAAK;YACP;YAEA,IAAIoD,eAAetC,OAAO;gBACxB,OAAOsC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof Error &&\n      oauthTokenVerifyResult.name === 'TokenExpiredError' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUrC,aAAakC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCE,SAClCF,uBAAuBjC,IAAI,KAAK,uBAChCmB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACgD,aAAa,IACrC1B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI0C,KAAKC,GAAG,KAAK,IAAI,CAAC3C,mBAAmB,CAAC4C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAAChD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC6C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC5C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI6C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAAChD,IAAI,GAAG,MAAMiD,MAAM,IAAI,CAACnD,mBAAmB,EAAEoD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACxE,IAAI,CAACvD,QAAQ,CAAC,CAAC,+BAA+B,EAAEmD,SAAS;oBAEzD,IAAI,IAAI,CAAChD,IAAI,EAAEqD,UAAU;wBACvB,IAAI,CAACtD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACjD,IAAI,CAACqD,QAAQ,EAAEH,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACnD,mBAAmB,GAAG,IAAI0C;oBAC/B,IAAI,CAAC9C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACqD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBR,YAAYQ;oBACZ,IAAI,CAAC1D,QAAQ,CAAC,CAAC,2BAA2B,EAAEmD,QAAQ,IAAI,EAAGO,OAAiBC,SAAS;oBAErF,IAAIR,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIS,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACb,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIlE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACgB,mBAAmB,CAAC,eAAe,EACjF,AAACiD,WAAqBS,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACtD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG4D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACnE,IAAI,IAAIoE,MAAMC,OAAO,CAAC,IAAI,CAACrE,IAAI,CAACmE,IAAI,IAAI,IAAI,CAACnE,IAAI,CAACmE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAIzB,MAAM;QAClB;QAEA,IAAI,CAAC0B,KAAK;YACR,MAAM,IAAI1B,MAAM;QAClB;QAEA,IAAI,CAAC2B,MAAM;YACT,MAAM,IAAI3B,MAAM;QAClB;QAEA,KAAK,MAAMgC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM3F,KAAK4F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAInC,MAAM;YAClB;YAEA8B,SAAS,MAAMxF,KAAK8F,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAI/B,MAAM;QAClB;QAEA,IAAI,CAAC8B,QAAQ;YACX,MAAM,IAAI9B,MAAM;QAClB;QAEA,OAAO8B;IACT;IAEA,MAAM/B,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM2C,WAAW,MAAM5F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO2F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB3D,QAAQ4D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACApD,KAAK;YACP;YAEA,IAAIoD,eAAetC,OAAO;gBACxB,OAAOsC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}

package/dist/oauth/types.d.ts

@@ -30,7 +30,7 @@ export interface CollectionOptions {
      * Set to false to only accept the JWT from cookies
      */
     disableJWTFromHeader?: boolean;
-    disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy'];
+    disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy'];
     /**
      * The logout button will either redirect to the IDP logout screen or
      * automatically log the user out of the IDP depending on provider.

package/dist/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACzE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IAEH;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACvE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IAEH;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}

package/dist/oauth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAwNrD,WAGC"}
+{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAwNrD,WAGC"}

package/dist/oauth/utilities/createCookieOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createCookieOptions.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,SAAS,CAAA;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE/D,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;CAC7B;AAED,eAAO,MAAM,mBAAmB,4CAI7B,IAAI,KAAG,aA8CT,CAAA"}
+{"version":3,"file":"createCookieOptions.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE/D,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;CAC7B;AAED,eAAO,MAAM,mBAAmB,4CAI7B,IAAI,KAAG,aA8CT,CAAA"}

package/dist/oauth/utilities/createCookieOptions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"sourcesContent":["import type { CollectionConfig, PayloadRequest } from 'payload'\n\nimport type { CookieOptions, PluginOptions } from '../types.js'\n\ninterface Args {\n  collection: CollectionConfig\n  headers: Headers\n  pluginOptions: PluginOptions\n}\n\nexport const createCookieOptions = ({\n  collection,\n  headers,\n  pluginOptions,\n}: Args): CookieOptions => {\n  let cookieOptions: CookieOptions = {\n    domain: undefined,\n    httpOnly: true,\n    path: '/',\n    sameSite: undefined,\n    secure: false,\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    const { domain, sameSite, secure } = collection.auth.cookies\n    if (typeof secure === 'boolean') {\n      cookieOptions.secure = secure\n    }\n    if (typeof sameSite === 'string') {\n      cookieOptions.sameSite = sameSite as 'Lax'\n    }\n    if (typeof domain === 'string') {\n      cookieOptions.domain = domain\n    }\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    if (collection.auth.cookies.secure) {\n      cookieOptions.secure = true\n    }\n    if (collection.auth.cookies.sameSite) {\n      cookieOptions.sameSite =\n        typeof collection.auth.cookies.sameSite === 'string'\n          ? collection.auth.cookies.sameSite\n          : 'Lax'\n    }\n    if (collection.auth.cookies.domain) {\n      cookieOptions.domain = collection.auth.cookies.domain\n    }\n  }\n\n  if (typeof pluginOptions.createCookieOptions === 'function') {\n    cookieOptions = pluginOptions.createCookieOptions({\n      collection,\n      cookieOptions,\n      headers,\n    })\n  }\n\n  return cookieOptions\n}\n"],"names":["createCookieOptions","collection","headers","pluginOptions","cookieOptions","domain","undefined","httpOnly","path","sameSite","secure","auth","cookies"],"mappings":"AAUA,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,UAAU,EACVC,OAAO,EACPC,aAAa,EACR;IACL,IAAIC,gBAA+B;QACjCC,QAAQC;QACRC,UAAU;QACVC,MAAM;QACNC,UAAUH;QACVI,QAAQ;IACV;IAEA,IAAI,OAAOT,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,MAAM,EAAEP,MAAM,EAAEI,QAAQ,EAAEC,MAAM,EAAE,GAAGT,WAAWU,IAAI,CAACC,OAAO;QAC5D,IAAI,OAAOF,WAAW,WAAW;YAC/BN,cAAcM,MAAM,GAAGA;QACzB;QACA,IAAI,OAAOD,aAAa,UAAU;YAChCL,cAAcK,QAAQ,GAAGA;QAC3B;QACA,IAAI,OAAOJ,WAAW,UAAU;YAC9BD,cAAcC,MAAM,GAAGA;QACzB;IACF;IAEA,IAAI,OAAOJ,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,IAAIX,WAAWU,IAAI,CAACC,OAAO,CAACF,MAAM,EAAE;YAClCN,cAAcM,MAAM,GAAG;QACzB;QACA,IAAIT,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,EAAE;YACpCL,cAAcK,QAAQ,GACpB,OAAOR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,KAAK,WACxCR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,GAChC;QACR;QACA,IAAIR,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM,EAAE;YAClCD,cAAcC,MAAM,GAAGJ,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM;QACvD;IACF;IAEA,IAAI,OAAOF,cAAcH,mBAAmB,KAAK,YAAY;QAC3DI,gBAAgBD,cAAcH,mBAAmB,CAAC;YAChDC;YACAG;YACAF;QACF;IACF;IAEA,OAAOE;AACT,EAAC"}
+{"version":3,"sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport type { CookieOptions, PluginOptions } from '../types.js'\n\ninterface Args {\n  collection: CollectionConfig\n  headers: Headers\n  pluginOptions: PluginOptions\n}\n\nexport const createCookieOptions = ({\n  collection,\n  headers,\n  pluginOptions,\n}: Args): CookieOptions => {\n  let cookieOptions: CookieOptions = {\n    domain: undefined,\n    httpOnly: true,\n    path: '/',\n    sameSite: undefined,\n    secure: false,\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    const { domain, sameSite, secure } = collection.auth.cookies\n    if (typeof secure === 'boolean') {\n      cookieOptions.secure = secure\n    }\n    if (typeof sameSite === 'string') {\n      cookieOptions.sameSite = sameSite as 'Lax'\n    }\n    if (typeof domain === 'string') {\n      cookieOptions.domain = domain\n    }\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    if (collection.auth.cookies.secure) {\n      cookieOptions.secure = true\n    }\n    if (collection.auth.cookies.sameSite) {\n      cookieOptions.sameSite =\n        typeof collection.auth.cookies.sameSite === 'string'\n          ? collection.auth.cookies.sameSite\n          : 'Lax'\n    }\n    if (collection.auth.cookies.domain) {\n      cookieOptions.domain = collection.auth.cookies.domain\n    }\n  }\n\n  if (typeof pluginOptions.createCookieOptions === 'function') {\n    cookieOptions = pluginOptions.createCookieOptions({\n      collection,\n      cookieOptions,\n      headers,\n    })\n  }\n\n  return cookieOptions\n}\n"],"names":["createCookieOptions","collection","headers","pluginOptions","cookieOptions","domain","undefined","httpOnly","path","sameSite","secure","auth","cookies"],"mappings":"AAUA,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,UAAU,EACVC,OAAO,EACPC,aAAa,EACR;IACL,IAAIC,gBAA+B;QACjCC,QAAQC;QACRC,UAAU;QACVC,MAAM;QACNC,UAAUH;QACVI,QAAQ;IACV;IAEA,IAAI,OAAOT,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,MAAM,EAAEP,MAAM,EAAEI,QAAQ,EAAEC,MAAM,EAAE,GAAGT,WAAWU,IAAI,CAACC,OAAO;QAC5D,IAAI,OAAOF,WAAW,WAAW;YAC/BN,cAAcM,MAAM,GAAGA;QACzB;QACA,IAAI,OAAOD,aAAa,UAAU;YAChCL,cAAcK,QAAQ,GAAGA;QAC3B;QACA,IAAI,OAAOJ,WAAW,UAAU;YAC9BD,cAAcC,MAAM,GAAGA;QACzB;IACF;IAEA,IAAI,OAAOJ,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,IAAIX,WAAWU,IAAI,CAACC,OAAO,CAACF,MAAM,EAAE;YAClCN,cAAcM,MAAM,GAAG;QACzB;QACA,IAAIT,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,EAAE;YACpCL,cAAcK,QAAQ,GACpB,OAAOR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,KAAK,WACxCR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,GAChC;QACR;QACA,IAAIR,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM,EAAE;YAClCD,cAAcC,MAAM,GAAGJ,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM;QACvD;IACF;IAEA,IAAI,OAAOF,cAAcH,mBAAmB,KAAK,YAAY;QAC3DI,gBAAgBD,cAAcH,mBAAmB,CAAC;YAChDC;YACAG;YACAF;QACF;IACF;IAEA,OAAOE;AACT,EAAC"}

package/dist/oauth/utilities/refreshTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshTokens.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/refreshTokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAItC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAUpD,UAAU,IAAI;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,KAAK,MAAM,GACP;IACE,iBAAiB,EAAE,GAAG,CAAC,UAAU,CAAA;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd,GACD,KAAK,CAAA;AAET,eAAO,MAAM,aAAa,wCAA+C,IAAI,KAAG,OAAO,CAAC,MAAM,CAmE7F,CAAA"}
+{"version":3,"file":"refreshTokens.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/refreshTokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAItC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AASpD,UAAU,IAAI;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,KAAK,MAAM,GACP;IACE,iBAAiB,EAAE,GAAG,CAAC,UAAU,CAAA;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd,GACD,KAAK,CAAA;AAET,eAAO,MAAM,aAAa,wCAA+C,IAAI,KAAG,OAAO,CAAC,MAAM,CAsE7F,CAAA"}

package/dist/oauth/utilities/refreshTokens.js

@@ -16,7 +16,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
     // so we will refresh both tokens
     try {
         // Get another project token
-        const { expiresAt, token } = await getProjectToken(refreshToken, 'someproject');
+        const { expiresAt, token } = await getProjectToken(refreshToken, payload.config.custom.figma.tenantId);
         debugLogger.info({
             expiresAt,
             msg: 'Received new tokens from Figma API',

package/dist/oauth/utilities/refreshTokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/utilities/refreshTokens.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\nimport type { Payload } from 'payload'\n\nimport { generateCookie } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createCookieOptions } from './createCookieOptions.js'\nimport { createDebugLogger } from './createDebugLogger.js'\nimport { getCookieExpiration } from './getCookieExpiration.js'\nimport { getTokenExp } from './getTokenExp.js'\n\ninterface Args {\n  payload: Payload\n  refreshToken: string\n  strategy: Strategy\n}\n\ntype Result =\n  | {\n      decodedOauthToken: jwt.JwtPayload\n      headers: Headers\n      token: string\n    }\n  | false\n\nexport const refreshTokens = async ({ payload, refreshToken, strategy }: Args): Promise<Result> => {\n  const debugLogger = createDebugLogger(payload, strategy.debug)\n\n  debugLogger.info({\n    msg: 'Refreshing tokens',\n  })\n\n  const headers = new Headers()\n\n  // At this point, access token is expired\n  // but refresh token is still valid\n  // so we will refresh both tokens\n\n  try {\n    // Get another project token\n    const { expiresAt, token } = await getProjectToken(refreshToken, 'someproject')\n\n    debugLogger.info({\n      expiresAt,\n      msg: 'Received new tokens from Figma API',\n      token,\n    })\n\n    // On error, no user\n    if (!token) {\n      debugLogger.error({\n        msg: 'Error refreshing tokens',\n      })\n      return false\n    }\n\n    if (token) {\n      debugLogger.info({\n        msg: 'Successfully refreshed project token',\n        token,\n      })\n\n      const expires_in = new Date(expiresAt)\n\n      const cookieOptions = createCookieOptions({\n        collection: strategy.collection,\n        headers,\n        pluginOptions: strategy.pluginOptions,\n      })\n\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: getCookieExpiration(expires_in),\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      headers.append('Set-Cookie', tokenCookie)\n\n      const decodedOauthToken = await validateProjectToken(token, getEnvironment())\n\n      return { decodedOauthToken, headers, token }\n    }\n  } catch (error) {\n    debugLogger.error({\n      err: error,\n      msg: 'Error refreshing tokens',\n    })\n  }\n\n  return false\n}\n"],"names":["generateCookie","getProjectToken","validateProjectToken","getEnvironment","createCookieOptions","createDebugLogger","getCookieExpiration","refreshTokens","payload","refreshToken","strategy","debugLogger","debug","info","msg","headers","Headers","expiresAt","token","error","expires_in","Date","cookieOptions","collection","pluginOptions","tokenCookie","name","cookieName","expires","returnCookieAsObject","value","append","decodedOauthToken","err"],"mappings":"AAGA,SAASA,cAAc,QAAQ,UAAS;AAIxC,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,iBAAiB,QAAQ,yBAAwB;AAC1D,SAASC,mBAAmB,QAAQ,2BAA0B;AAiB9D,OAAO,MAAMC,gBAAgB,OAAO,EAAEC,OAAO,EAAEC,YAAY,EAAEC,QAAQ,EAAQ;IAC3E,MAAMC,cAAcN,kBAAkBG,SAASE,SAASE,KAAK;IAE7DD,YAAYE,IAAI,CAAC;QACfC,KAAK;IACP;IAEA,MAAMC,UAAU,IAAIC;IAEpB,yCAAyC;IACzC,mCAAmC;IACnC,iCAAiC;IAEjC,IAAI;QACF,4BAA4B;QAC5B,MAAM,EAAEC,SAAS,EAAEC,KAAK,EAAE,GAAG,MAAMjB,gBAAgBQ,cAAc;QAEjEE,YAAYE,IAAI,CAAC;YACfI;YACAH,KAAK;YACLI;QACF;QAEA,oBAAoB;QACpB,IAAI,CAACA,OAAO;YACVP,YAAYQ,KAAK,CAAC;gBAChBL,KAAK;YACP;YACA,OAAO;QACT;QAEA,IAAII,OAAO;YACTP,YAAYE,IAAI,CAAC;gBACfC,KAAK;gBACLI;YACF;YAEA,MAAME,aAAa,IAAIC,KAAKJ;YAE5B,MAAMK,gBAAgBlB,oBAAoB;gBACxCmB,YAAYb,SAASa,UAAU;gBAC/BR;gBACAS,eAAed,SAASc,aAAa;YACvC;YAEA,MAAMC,cAAczB,eAAe;gBACjC,GAAGsB,aAAa;gBAChBI,MAAMhB,SAASiB,UAAU;gBACzBC,SAAStB,oBAAoBc;gBAC7BS,sBAAsB;gBACtBC,OAAOZ;YACT;YAEAH,QAAQgB,MAAM,CAAC,cAAcN;YAE7B,MAAMO,oBAAoB,MAAM9B,qBAAqBgB,OAAOf;YAE5D,OAAO;gBAAE6B;gBAAmBjB;gBAASG;YAAM;QAC7C;IACF,EAAE,OAAOC,OAAO;QACdR,YAAYQ,KAAK,CAAC;YAChBc,KAAKd;YACLL,KAAK;QACP;IACF;IAEA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../../src/oauth/utilities/refreshTokens.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\nimport type { Payload } from 'payload'\n\nimport { generateCookie } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createCookieOptions } from './createCookieOptions.js'\nimport { createDebugLogger } from './createDebugLogger.js'\nimport { getCookieExpiration } from './getCookieExpiration.js'\n\ninterface Args {\n  payload: Payload\n  refreshToken: string\n  strategy: Strategy\n}\n\ntype Result =\n  | {\n      decodedOauthToken: jwt.JwtPayload\n      headers: Headers\n      token: string\n    }\n  | false\n\nexport const refreshTokens = async ({ payload, refreshToken, strategy }: Args): Promise<Result> => {\n  const debugLogger = createDebugLogger(payload, strategy.debug)\n\n  debugLogger.info({\n    msg: 'Refreshing tokens',\n  })\n\n  const headers = new Headers()\n\n  // At this point, access token is expired\n  // but refresh token is still valid\n  // so we will refresh both tokens\n\n  try {\n    // Get another project token\n    const { expiresAt, token } = await getProjectToken(\n      refreshToken,\n      payload.config.custom.figma.tenantId,\n    )\n\n    debugLogger.info({\n      expiresAt,\n      msg: 'Received new tokens from Figma API',\n      token,\n    })\n\n    // On error, no user\n    if (!token) {\n      debugLogger.error({\n        msg: 'Error refreshing tokens',\n      })\n      return false\n    }\n\n    if (token) {\n      debugLogger.info({\n        msg: 'Successfully refreshed project token',\n        token,\n      })\n\n      const expires_in = new Date(expiresAt)\n\n      const cookieOptions = createCookieOptions({\n        collection: strategy.collection,\n        headers,\n        pluginOptions: strategy.pluginOptions,\n      })\n\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: getCookieExpiration(expires_in),\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      headers.append('Set-Cookie', tokenCookie)\n\n      const decodedOauthToken = await validateProjectToken(token, getEnvironment())\n\n      return { decodedOauthToken, headers, token }\n    }\n  } catch (error) {\n    debugLogger.error({\n      err: error,\n      msg: 'Error refreshing tokens',\n    })\n  }\n\n  return false\n}\n"],"names":["generateCookie","getProjectToken","validateProjectToken","getEnvironment","createCookieOptions","createDebugLogger","getCookieExpiration","refreshTokens","payload","refreshToken","strategy","debugLogger","debug","info","msg","headers","Headers","expiresAt","token","config","custom","figma","tenantId","error","expires_in","Date","cookieOptions","collection","pluginOptions","tokenCookie","name","cookieName","expires","returnCookieAsObject","value","append","decodedOauthToken","err"],"mappings":"AAGA,SAASA,cAAc,QAAQ,UAAS;AAIxC,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,iBAAiB,QAAQ,yBAAwB;AAC1D,SAASC,mBAAmB,QAAQ,2BAA0B;AAgB9D,OAAO,MAAMC,gBAAgB,OAAO,EAAEC,OAAO,EAAEC,YAAY,EAAEC,QAAQ,EAAQ;IAC3E,MAAMC,cAAcN,kBAAkBG,SAASE,SAASE,KAAK;IAE7DD,YAAYE,IAAI,CAAC;QACfC,KAAK;IACP;IAEA,MAAMC,UAAU,IAAIC;IAEpB,yCAAyC;IACzC,mCAAmC;IACnC,iCAAiC;IAEjC,IAAI;QACF,4BAA4B;QAC5B,MAAM,EAAEC,SAAS,EAAEC,KAAK,EAAE,GAAG,MAAMjB,gBACjCQ,cACAD,QAAQW,MAAM,CAACC,MAAM,CAACC,KAAK,CAACC,QAAQ;QAGtCX,YAAYE,IAAI,CAAC;YACfI;YACAH,KAAK;YACLI;QACF;QAEA,oBAAoB;QACpB,IAAI,CAACA,OAAO;YACVP,YAAYY,KAAK,CAAC;gBAChBT,KAAK;YACP;YACA,OAAO;QACT;QAEA,IAAII,OAAO;YACTP,YAAYE,IAAI,CAAC;gBACfC,KAAK;gBACLI;YACF;YAEA,MAAMM,aAAa,IAAIC,KAAKR;YAE5B,MAAMS,gBAAgBtB,oBAAoB;gBACxCuB,YAAYjB,SAASiB,UAAU;gBAC/BZ;gBACAa,eAAelB,SAASkB,aAAa;YACvC;YAEA,MAAMC,cAAc7B,eAAe;gBACjC,GAAG0B,aAAa;gBAChBI,MAAMpB,SAASqB,UAAU;gBACzBC,SAAS1B,oBAAoBkB;gBAC7BS,sBAAsB;gBACtBC,OAAOhB;YACT;YAEAH,QAAQoB,MAAM,CAAC,cAAcN;YAE7B,MAAMO,oBAAoB,MAAMlC,qBAAqBgB,OAAOf;YAE5D,OAAO;gBAAEiC;gBAAmBrB;gBAASG;YAAM;QAC7C;IACF,EAAE,OAAOK,OAAO;QACdZ,YAAYY,KAAK,CAAC;YAChBc,KAAKd;YACLT,KAAK;QACP;IACF;IAEA,OAAO;AACT,EAAC"}

package/dist/plugin/build-config.d.ts

@@ -10,25 +10,41 @@ import type { Config, SanitizedConfig } from 'payload';
  * @example
  * // Minimal config
  * const config: FigmaConfig = {
+ *   figma: {
+ *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!
+ *   },
  *   collections: [...]
  * }
  *
  * @example
  * // With custom editor
  * const config: FigmaConfig = {
+ *   figma: {
+ *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!
+ *   },
  *   collections: [...],
  *   editor: lexicalEditor({ features: [...] })
  * }
+ *
+ * @example
+ * // Disable Content System (use custom db)
+ * const config: FigmaConfig = {
+ *   figma: {
+ *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!,
+ *     useContentSystem: false
+ *   },
+ *   db: mongooseAdapter({ url: process.env.DATABASE_URI }),
+ *   collections: [...]
+ * }
  */
 export type FigmaConfig = {
     editor?: Config['editor'];
 } & {
     figma: {
-        region: string;
-        tenantId: string;
+        contentSystemId: string;
         useContentSystem?: boolean;
     };
-} & Omit<Config, 'editor' | 'secret'>;
+} & Omit<Config, 'db' | 'editor' | 'secret'> & Partial<Pick<Config, 'db'>>;
 /**
  * Figma platform wrapper for Payload's buildConfig.
  * Automatically injects:
@@ -39,7 +55,5 @@ export type FigmaConfig = {
  * @param config - Payload configuration (db and secret omitted, editor optional)
  * @returns Promise<SanitizedConfig> - Built Payload configuration
  */
-export declare function buildConfig(config: FigmaConfig, options?: {
-    useContentSystem: boolean;
-}): Promise<SanitizedConfig>;
+export declare function buildConfig(config: FigmaConfig): Promise<SanitizedConfig>;
 //# sourceMappingURL=build-config.d.ts.map

package/dist/plugin/build-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../../src/plugin/build-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAQtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC1B,GAAG;IACF,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAC3B,CAAA;CACF,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAA;AAErC;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE;IAAE,gBAAgB,EAAE,OAAO,CAAA;CAA+B,GAClE,OAAO,CAAC,eAAe,CAAC,CAwC1B"}
+{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../../src/plugin/build-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAWtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC1B,GAAG;IACF,KAAK,EAAE;QACL,eAAe,EAAE,MAAM,CAAA;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAC3B,CAAA;CACF,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAsE/E"}

package/dist/plugin/build-config.js

@@ -1,7 +1,10 @@
 import { lexicalEditor } from '@payloadcms/richtext-lexical';
 import { buildConfig as payloadBuildConfig } from 'payload';
+import { getValidProjectToken } from '../auth/project-token.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { contentAPIAdapter } from '../db-adapter.js';
+import { health } from '../endpoints/health.js';
 import { oAuth2Plugin } from '../oauth/index.js';
-import { figmaContentSystem } from './adapter.js';
 /**
  * Figma platform wrapper for Payload's buildConfig.
  * Automatically injects:
@@ -11,18 +14,38 @@ import { figmaContentSystem } from './adapter.js';
  *
  * @param config - Payload configuration (db and secret omitted, editor optional)
  * @returns Promise<SanitizedConfig> - Built Payload configuration
- */ export async function buildConfig(config, options = {
-    useContentSystem: true
-}) {
+ */ export async function buildConfig(config) {
+    // Validate required environment variable
+    if (!config.figma.contentSystemId) {
+        throw new Error('FIGMA_CONTENT_SYSTEM_ID is required. ' + 'Ensure your .env file contains: FIGMA_CONTENT_SYSTEM_ID=your-content-system-id');
+    }
+    const contentSystemId = config.figma.contentSystemId;
+    let projectToken = '';
+    if (!process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
+        const tokenStore = getTokenStore();
+        const retrievedToken = await getValidProjectToken(tokenStore, contentSystemId);
+        if (retrievedToken) {
+            projectToken = retrievedToken;
+        }
+    }
     // Build complete config with Figma platform defaults
     const configWithFigmaDefaults = {
         ...config,
-        ...options.useContentSystem ? {
-            db: figmaContentSystem()
-        } : {
-            db: config.db
+        custom: {
+            figma: config.figma || {}
         },
+        // TODO: - cms-tenants-001-staging needs to be dynamic in the future
+        db: config.figma.useContentSystem !== false ? contentAPIAdapter({
+            contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY,
+            contentApiUrl: process.env.FIGMA_CONTENT_API_URL || 'https://us-east-1.cms-tenants-001-staging.figmacontentstaging.com',
+            contentSystemId: config.figma.contentSystemId,
+            projectToken
+        }) : config.db,
         editor: config.editor ?? lexicalEditor(),
+        endpoints: [
+            ...config.endpoints ?? [],
+            health
+        ],
         secret: 'MY_SECRET',
         // Add oauth to plugins if not already present
         plugins: [
@@ -46,15 +69,11 @@ import { figmaContentSystem } from './adapter.js';
                         usernameField: 'email'
                     }
                 ],
-                debug: true,
-                disabled: false,
-                redirectServerURL: 'http://localhost:3000'
+                debug: !!process.env.DEBUG,
+                disabled: false
             })
         ]
     };
-    if (options.useContentSystem) {
-        configWithFigmaDefaults.db = figmaContentSystem();
-    }
     // Delegate to Payload's buildConfig
     return await payloadBuildConfig(configWithFigmaDefaults);
 }

package/dist/plugin/build-config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/plugin/build-config.ts"],"sourcesContent":["import type { Config, SanitizedConfig } from 'payload'\n\nimport { lexicalEditor } from '@payloadcms/richtext-lexical'\nimport { buildConfig as payloadBuildConfig } from 'payload'\n\nimport { oAuth2Plugin } from '../oauth/index.js'\nimport { figmaContentSystem } from './adapter.js'\n\n/**\n * Configuration type for Payload projects on the Figma platform.\n *\n * Differences from standard Payload Config:\n * - `db`: Omitted (auto-injected by Figma platform)\n * - `secret`: Omitted (auto-injected by Figma platform)\n * - `editor`: Optional (defaults to lexicalEditor() if not provided)\n *\n * @example\n * // Minimal config\n * const config: FigmaConfig = {\n *   collections: [...]\n * }\n *\n * @example\n * // With custom editor\n * const config: FigmaConfig = {\n *   collections: [...],\n *   editor: lexicalEditor({ features: [...] })\n * }\n */\nexport type FigmaConfig = {\n  editor?: Config['editor']\n} & {\n  figma: {\n    region: string\n    tenantId: string\n    useContentSystem?: boolean\n  }\n} & Omit<Config, 'editor' | 'secret'>\n\n/**\n * Figma platform wrapper for Payload's buildConfig.\n * Automatically injects:\n * - Figma database adapter\n * - Secret (platform-provided)\n * - Default lexicalEditor (if no custom editor specified)\n *\n * @param config - Payload configuration (db and secret omitted, editor optional)\n * @returns Promise<SanitizedConfig> - Built Payload configuration\n */\nexport async function buildConfig(\n  config: FigmaConfig,\n  options: { useContentSystem: boolean } = { useContentSystem: true },\n): Promise<SanitizedConfig> {\n  // Build complete config with Figma platform defaults\n  const configWithFigmaDefaults: Config = {\n    ...config,\n    ...(options.useContentSystem ? { db: figmaContentSystem() } : { db: config.db }),\n    editor: config.editor ?? lexicalEditor(),\n    secret: 'MY_SECRET',\n    // Add oauth to plugins if not already present\n    plugins: [\n      ...(config.plugins ?? []),\n      oAuth2Plugin({\n        collections: [\n          {\n            slug: 'users',\n            // Use adapter because Figma app doesn't support OIDC scopes\n            authorizationURLParams: {\n              response_mode: 'query',\n              response_type: 'code',\n            },\n            clientID: process.env.FIGMA_OAUTH_CLIENT_ID!,\n            clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,\n            identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',\n            scope: ['current_user:read'],\n            token: 'id_token', // Adapter creates JWT id_token from Figma user info\n            usernameField: 'email',\n          },\n        ],\n        debug: true,\n        disabled: false,\n        redirectServerURL: 'http://localhost:3000',\n      }),\n    ],\n  }\n\n  if (options.useContentSystem) {\n    configWithFigmaDefaults.db = figmaContentSystem()\n  }\n\n  // Delegate to Payload's buildConfig\n  return await payloadBuildConfig(configWithFigmaDefaults)\n}\n"],"names":["lexicalEditor","buildConfig","payloadBuildConfig","oAuth2Plugin","figmaContentSystem","config","options","useContentSystem","configWithFigmaDefaults","db","editor","secret","plugins","collections","slug","authorizationURLParams","response_mode","response_type","clientID","process","env","FIGMA_OAUTH_CLIENT_ID","clientSecret","FIGMA_OAUTH_CLIENT_SECRET","identityMetadata","scope","token","usernameField","debug","disabled","redirectServerURL"],"mappings":"AAEA,SAASA,aAAa,QAAQ,+BAA8B;AAC5D,SAASC,eAAeC,kBAAkB,QAAQ,UAAS;AAE3D,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,kBAAkB,QAAQ,eAAc;AAiCjD;;;;;;;;;CASC,GACD,OAAO,eAAeH,YACpBI,MAAmB,EACnBC,UAAyC;IAAEC,kBAAkB;AAAK,CAAC;IAEnE,qDAAqD;IACrD,MAAMC,0BAAkC;QACtC,GAAGH,MAAM;QACT,GAAIC,QAAQC,gBAAgB,GAAG;YAAEE,IAAIL;QAAqB,IAAI;YAAEK,IAAIJ,OAAOI,EAAE;QAAC,CAAC;QAC/EC,QAAQL,OAAOK,MAAM,IAAIV;QACzBW,QAAQ;QACR,8CAA8C;QAC9CC,SAAS;eACHP,OAAOO,OAAO,IAAI,EAAE;YACxBT,aAAa;gBACXU,aAAa;oBACX;wBACEC,MAAM;wBACN,4DAA4D;wBAC5DC,wBAAwB;4BACtBC,eAAe;4BACfC,eAAe;wBACjB;wBACAC,UAAUC,QAAQC,GAAG,CAACC,qBAAqB;wBAC3CC,cAAcH,QAAQC,GAAG,CAACG,yBAAyB;wBACnDC,kBAAkB;wBAClBC,OAAO;4BAAC;yBAAoB;wBAC5BC,OAAO;wBACPC,eAAe;oBACjB;iBACD;gBACDC,OAAO;gBACPC,UAAU;gBACVC,mBAAmB;YACrB;SACD;IACH;IAEA,IAAIxB,QAAQC,gBAAgB,EAAE;QAC5BC,wBAAwBC,EAAE,GAAGL;IAC/B;IAEA,oCAAoC;IACpC,OAAO,MAAMF,mBAAmBM;AAClC"}
+{"version":3,"sources":["../../src/plugin/build-config.ts"],"sourcesContent":["import type { Config, SanitizedConfig } from 'payload'\n\nimport { lexicalEditor } from '@payloadcms/richtext-lexical'\nimport { buildConfig as payloadBuildConfig } from 'payload'\n\nimport { getValidProjectToken } from '../auth/project-token.js'\nimport { getTokenStore } from '../auth/token-store.js'\nimport { contentAPIAdapter } from '../db-adapter.js'\nimport { health } from '../endpoints/health.js'\nimport { oAuth2Plugin } from '../oauth/index.js'\n\n/**\n * Configuration type for Payload projects on the Figma platform.\n *\n * Differences from standard Payload Config:\n * - `db`: Omitted (auto-injected by Figma platform)\n * - `secret`: Omitted (auto-injected by Figma platform)\n * - `editor`: Optional (defaults to lexicalEditor() if not provided)\n *\n * @example\n * // Minimal config\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!\n *   },\n *   collections: [...]\n * }\n *\n * @example\n * // With custom editor\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!\n *   },\n *   collections: [...],\n *   editor: lexicalEditor({ features: [...] })\n * }\n *\n * @example\n * // Disable Content System (use custom db)\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!,\n *     useContentSystem: false\n *   },\n *   db: mongooseAdapter({ url: process.env.DATABASE_URI }),\n *   collections: [...]\n * }\n */\nexport type FigmaConfig = {\n  editor?: Config['editor']\n} & {\n  figma: {\n    contentSystemId: string\n    useContentSystem?: boolean\n  }\n} & Omit<Config, 'db' | 'editor' | 'secret'> &\n  Partial<Pick<Config, 'db'>>\n\n/**\n * Figma platform wrapper for Payload's buildConfig.\n * Automatically injects:\n * - Figma database adapter\n * - Secret (platform-provided)\n * - Default lexicalEditor (if no custom editor specified)\n *\n * @param config - Payload configuration (db and secret omitted, editor optional)\n * @returns Promise<SanitizedConfig> - Built Payload configuration\n */\nexport async function buildConfig(config: FigmaConfig): Promise<SanitizedConfig> {\n  // Validate required environment variable\n  if (!config.figma.contentSystemId) {\n    throw new Error(\n      'FIGMA_CONTENT_SYSTEM_ID is required. ' +\n        'Ensure your .env file contains: FIGMA_CONTENT_SYSTEM_ID=your-content-system-id',\n    )\n  }\n\n  const contentSystemId = config.figma.contentSystemId\n\n  let projectToken = ''\n\n  if (!process.env.FIGMA_CONTENT_API_ACCESS_KEY) {\n    const tokenStore = getTokenStore()\n    const retrievedToken = await getValidProjectToken(tokenStore, contentSystemId)\n    if (retrievedToken) {\n      projectToken = retrievedToken\n    }\n  }\n\n  // Build complete config with Figma platform defaults\n  const configWithFigmaDefaults: Config = {\n    ...config,\n    custom: {\n      figma: config.figma || {},\n    },\n    // TODO: - cms-tenants-001-staging needs to be dynamic in the future\n    db:\n      config.figma.useContentSystem !== false\n        ? contentAPIAdapter({\n            contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY!,\n            contentApiUrl:\n              process.env.FIGMA_CONTENT_API_URL ||\n              'https://us-east-1.cms-tenants-001-staging.figmacontentstaging.com',\n            contentSystemId: config.figma.contentSystemId,\n            projectToken,\n          })\n        : config.db!,\n    editor: config.editor ?? lexicalEditor(),\n    endpoints: [...(config.endpoints ?? []), health],\n    secret: 'MY_SECRET',\n    // Add oauth to plugins if not already present\n    plugins: [\n      ...(config.plugins ?? []),\n      oAuth2Plugin({\n        collections: [\n          {\n            slug: 'users',\n            // Use adapter because Figma app doesn't support OIDC scopes\n            authorizationURLParams: {\n              response_mode: 'query',\n              response_type: 'code',\n            },\n            clientID: process.env.FIGMA_OAUTH_CLIENT_ID!,\n            clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,\n            identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',\n            scope: ['current_user:read'],\n            token: 'id_token', // Adapter creates JWT id_token from Figma user info\n            usernameField: 'email',\n          },\n        ],\n        debug: !!process.env.DEBUG,\n        disabled: false,\n      }),\n    ],\n  }\n\n  // Delegate to Payload's buildConfig\n  return await payloadBuildConfig(configWithFigmaDefaults)\n}\n"],"names":["lexicalEditor","buildConfig","payloadBuildConfig","getValidProjectToken","getTokenStore","contentAPIAdapter","health","oAuth2Plugin","config","figma","contentSystemId","Error","projectToken","process","env","FIGMA_CONTENT_API_ACCESS_KEY","tokenStore","retrievedToken","configWithFigmaDefaults","custom","db","useContentSystem","contentApiKey","contentApiUrl","FIGMA_CONTENT_API_URL","editor","endpoints","secret","plugins","collections","slug","authorizationURLParams","response_mode","response_type","clientID","FIGMA_OAUTH_CLIENT_ID","clientSecret","FIGMA_OAUTH_CLIENT_SECRET","identityMetadata","scope","token","usernameField","debug","DEBUG","disabled"],"mappings":"AAEA,SAASA,aAAa,QAAQ,+BAA8B;AAC5D,SAASC,eAAeC,kBAAkB,QAAQ,UAAS;AAE3D,SAASC,oBAAoB,QAAQ,2BAA0B;AAC/D,SAASC,aAAa,QAAQ,yBAAwB;AACtD,SAASC,iBAAiB,QAAQ,mBAAkB;AACpD,SAASC,MAAM,QAAQ,yBAAwB;AAC/C,SAASC,YAAY,QAAQ,oBAAmB;AAkDhD;;;;;;;;;CASC,GACD,OAAO,eAAeN,YAAYO,MAAmB;IACnD,yCAAyC;IACzC,IAAI,CAACA,OAAOC,KAAK,CAACC,eAAe,EAAE;QACjC,MAAM,IAAIC,MACR,0CACE;IAEN;IAEA,MAAMD,kBAAkBF,OAAOC,KAAK,CAACC,eAAe;IAEpD,IAAIE,eAAe;IAEnB,IAAI,CAACC,QAAQC,GAAG,CAACC,4BAA4B,EAAE;QAC7C,MAAMC,aAAaZ;QACnB,MAAMa,iBAAiB,MAAMd,qBAAqBa,YAAYN;QAC9D,IAAIO,gBAAgB;YAClBL,eAAeK;QACjB;IACF;IAEA,qDAAqD;IACrD,MAAMC,0BAAkC;QACtC,GAAGV,MAAM;QACTW,QAAQ;YACNV,OAAOD,OAAOC,KAAK,IAAI,CAAC;QAC1B;QACA,oEAAoE;QACpEW,IACEZ,OAAOC,KAAK,CAACY,gBAAgB,KAAK,QAC9BhB,kBAAkB;YAChBiB,eAAeT,QAAQC,GAAG,CAACC,4BAA4B;YACvDQ,eACEV,QAAQC,GAAG,CAACU,qBAAqB,IACjC;YACFd,iBAAiBF,OAAOC,KAAK,CAACC,eAAe;YAC7CE;QACF,KACAJ,OAAOY,EAAE;QACfK,QAAQjB,OAAOiB,MAAM,IAAIzB;QACzB0B,WAAW;eAAKlB,OAAOkB,SAAS,IAAI,EAAE;YAAGpB;SAAO;QAChDqB,QAAQ;QACR,8CAA8C;QAC9CC,SAAS;eACHpB,OAAOoB,OAAO,IAAI,EAAE;YACxBrB,aAAa;gBACXsB,aAAa;oBACX;wBACEC,MAAM;wBACN,4DAA4D;wBAC5DC,wBAAwB;4BACtBC,eAAe;4BACfC,eAAe;wBACjB;wBACAC,UAAUrB,QAAQC,GAAG,CAACqB,qBAAqB;wBAC3CC,cAAcvB,QAAQC,GAAG,CAACuB,yBAAyB;wBACnDC,kBAAkB;wBAClBC,OAAO;4BAAC;yBAAoB;wBAC5BC,OAAO;wBACPC,eAAe;oBACjB;iBACD;gBACDC,OAAO,CAAC,CAAC7B,QAAQC,GAAG,CAAC6B,KAAK;gBAC1BC,UAAU;YACZ;SACD;IACH;IAEA,oCAAoC;IACpC,OAAO,MAAM1C,mBAAmBgB;AAClC"}

package/dist/utils/env-management.d.ts

@@ -1,16 +1,9 @@
 /**
- * Generate a cryptographically secure secret for PAYLOAD_SECRET
- *
- * @returns 24-character hexadecimal string
- */
-export declare function generateSecret(): string;
-/**
- * Manage environment files for a new project
- *
- * Creates .env from .env.example (if exists) and populates PAYLOAD_SECRET
+ * Add or update an environment variable in .env file
  *
  * @param projectPath - Path to project directory
- * @returns The generated payload secret
+ * @param key - Environment variable name
+ * @param value - Environment variable value
  */
-export declare function manageEnvFiles(projectPath: string): Promise<string>;
+export declare function addOrUpdateEnvVar(projectPath: string, key: string, value: string): Promise<void>;
 //# sourceMappingURL=env-management.d.ts.map

package/dist/utils/env-management.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-management.d.ts","sourceRoot":"","sources":["../../src/utils/env-management.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAoDD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CzE"}
+{"version":3,"file":"env-management.d.ts","sourceRoot":"","sources":["../../src/utils/env-management.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAmEf"}