@payloadcms/figma 0.0.1-alpha.27 → 0.0.1-alpha.29

package/dist/oauth/strategy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof Error &&\n      oauthTokenVerifyResult.name === 'TokenExpiredError' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n\n          if (this.meta) {\n            // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration\n            this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms'\n          }\n\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","authorization_endpoint","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUrC,aAAakC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCE,SAClCF,uBAAuBjC,IAAI,KAAK,uBAChCmB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACgD,aAAa,IACrC1B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI0C,KAAKC,GAAG,KAAK,IAAI,CAAC3C,mBAAmB,CAAC4C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAAChD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC6C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC5C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI6C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAAChD,IAAI,GAAG,MAAMiD,MAAM,IAAI,CAACnD,mBAAmB,EAAEoD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBAExE,IAAI,IAAI,CAACpD,IAAI,EAAE;wBACb,oGAAoG;wBACpG,IAAI,CAACA,IAAI,CAACqD,sBAAsB,GAAG,IAAI,CAACrD,IAAI,EAAEqD,yBAAyB;oBACzE;oBAEA,IAAI,CAACxD,QAAQ,CAAC,CAAC,+BAA+B,EAAEmD,SAAS;oBAEzD,IAAI,IAAI,CAAChD,IAAI,EAAEsD,UAAU;wBACvB,IAAI,CAACvD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACjD,IAAI,CAACsD,QAAQ,EAAEJ,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACnD,mBAAmB,GAAG,IAAI0C;oBAC/B,IAAI,CAAC9C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACsD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBT,YAAYS;oBACZ,IAAI,CAAC3D,QAAQ,CAAC,CAAC,2BAA2B,EAAEmD,QAAQ,IAAI,EAAGQ,OAAiBC,SAAS;oBAErF,IAAIT,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIU,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACd,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIlE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACgB,mBAAmB,CAAC,eAAe,EACjF,AAACiD,WAAqBU,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACvD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG6D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACpE,IAAI,IAAIqE,MAAMC,OAAO,CAAC,IAAI,CAACtE,IAAI,CAACoE,IAAI,IAAI,IAAI,CAACpE,IAAI,CAACoE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAI1B,MAAM;QAClB;QAEA,IAAI,CAAC2B,KAAK;YACR,MAAM,IAAI3B,MAAM;QAClB;QAEA,IAAI,CAAC4B,MAAM;YACT,MAAM,IAAI5B,MAAM;QAClB;QAEA,KAAK,MAAMiC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM5F,KAAK6F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAIpC,MAAM;YAClB;YAEA+B,SAAS,MAAMzF,KAAK+F,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAIhC,MAAM;QAClB;QAEA,IAAI,CAAC+B,QAAQ;YACX,MAAM,IAAI/B,MAAM;QAClB;QAEA,OAAO+B;IACT;IAEA,MAAMhC,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM4C,WAAW,MAAM7F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO4F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB5D,QAAQ6D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACArD,KAAK;YACP;YAEA,IAAIqD,eAAevC,OAAO;gBACxB,OAAOuC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof JWTValidationError &&\n      oauthTokenVerifyResult.code === 'EXPIRED' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n\n          if (this.meta) {\n            // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration\n            this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms'\n          }\n\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","JWTValidationError","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","code","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","authorization_endpoint","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAASC,kBAAkB,EAAEC,oBAAoB,QAAQ,8BAA6B;AACtF,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUtC,aAAamC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCtD,sBAClCsD,uBAAuBK,IAAI,KAAK,aAChCnB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACiD,aAAa,IACrC3B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI2C,KAAKC,GAAG,KAAK,IAAI,CAAC5C,mBAAmB,CAAC6C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAACjD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC8C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC7C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI8C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAACjD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACpD,mBAAmB,EAAEqD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBAExE,IAAI,IAAI,CAACrD,IAAI,EAAE;wBACb,oGAAoG;wBACpG,IAAI,CAACA,IAAI,CAACsD,sBAAsB,GAAG,IAAI,CAACtD,IAAI,EAAEsD,yBAAyB;oBACzE;oBAEA,IAAI,CAACzD,QAAQ,CAAC,CAAC,+BAA+B,EAAEoD,SAAS;oBAEzD,IAAI,IAAI,CAACjD,IAAI,EAAEuD,UAAU;wBACvB,IAAI,CAACxD,IAAI,GAAG,MAAMmD,MAAM,IAAI,CAAClD,IAAI,CAACuD,QAAQ,EAAEJ,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACpD,mBAAmB,GAAG,IAAI2C;oBAC/B,IAAI,CAAC/C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACuD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBT,YAAYS;oBACZ,IAAI,CAAC5D,QAAQ,CAAC,CAAC,2BAA2B,EAAEoD,QAAQ,IAAI,EAAGQ,OAAiBC,SAAS;oBAErF,IAAIT,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIU,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACd,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIpE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACiB,mBAAmB,CAAC,eAAe,EACjF,AAACkD,WAAqBU,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACxD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG8D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACrE,IAAI,IAAIsE,MAAMC,OAAO,CAAC,IAAI,CAACvE,IAAI,CAACqE,IAAI,IAAI,IAAI,CAACrE,IAAI,CAACqE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAI3B,MAAM;QAClB;QAEA,IAAI,CAAC4B,KAAK;YACR,MAAM,IAAI5B,MAAM;QAClB;QAEA,IAAI,CAAC6B,MAAM;YACT,MAAM,IAAI7B,MAAM;QAClB;QAEA,KAAK,MAAMkC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM9F,KAAK+F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAIrC,MAAM;YAClB;YAEAgC,SAAS,MAAM3F,KAAKiG,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAIjC,MAAM;QAClB;QAEA,IAAI,CAACgC,QAAQ;YACX,MAAM,IAAIhC,MAAM;QAClB;QAEA,OAAOgC;IACT;IAEA,MAAMjC,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM6C,WAAW,MAAM9F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO6F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB7D,QAAQ8D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACAtD,KAAK;YACP;YAEA,IAAIsD,eAAexC,OAAO;gBACxB,OAAOwC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}

package/dist/oauth/types.d.ts

@@ -112,11 +112,6 @@ export interface PluginOptions {
      * @default 'payload-oauth-token'
      */
     cookieName?: string;
-    /**
-     * Debug mode will log additional information to the console.
-     *
-     * NOTE: This will log sensitive information to the console.
-     */
     /**
      * Accepts incoming request and allows for modification of cookie options
      */
@@ -125,6 +120,11 @@ export interface PluginOptions {
         cookieOptions: CookieOptions;
         headers: Headers;
     }) => CookieOptions;
+    /**
+     * Debug mode will log additional information to the console.
+     *
+     * NOTE: This will log sensitive information to the console.
+     */
     debug?: boolean;
     /**
      * Disables the plugin functionality while leaving in types, fields and component modifications.

package/dist/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACvE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IAEH;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACvE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}

package/dist/oauth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAwNrD,WAGC"}
+{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAuNrD,WAGC"}

package/dist/oauth/utilities/isDuplicateKeyError.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */
+export declare function isDuplicateKeyError(error: unknown): boolean;
+//# sourceMappingURL=isDuplicateKeyError.d.ts.map

package/dist/oauth/utilities/isDuplicateKeyError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isDuplicateKeyError.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/isDuplicateKeyError.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAa3D"}

package/dist/oauth/utilities/isDuplicateKeyError.js

@@ -0,0 +1,14 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */ export function isDuplicateKeyError(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const err = error;
+    const message = typeof err.message === 'string' ? err.message : '';
+    return message.includes('409') || message.toLowerCase().includes('conflict') || message.toLowerCase().includes('already exists');
+}
+
+//# sourceMappingURL=isDuplicateKeyError.js.map

package/dist/oauth/utilities/isDuplicateKeyError.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/utilities/isDuplicateKeyError.ts"],"sourcesContent":["/**\n * Check if an error is a duplicate key/unique constraint violation from Content API.\n *\n * Content API returns HTTP 409 with \"conflict\" or \"already exists\" in the message.\n */\nexport function isDuplicateKeyError(error: unknown): boolean {\n  if (!error || typeof error !== 'object') {\n    return false\n  }\n\n  const err = error as { message?: unknown }\n  const message = typeof err.message === 'string' ? err.message : ''\n\n  return (\n    message.includes('409') ||\n    message.toLowerCase().includes('conflict') ||\n    message.toLowerCase().includes('already exists')\n  )\n}\n"],"names":["isDuplicateKeyError","error","err","message","includes","toLowerCase"],"mappings":"AAAA;;;;CAIC,GACD,OAAO,SAASA,oBAAoBC,KAAc;IAChD,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;QACvC,OAAO;IACT;IAEA,MAAMC,MAAMD;IACZ,MAAME,UAAU,OAAOD,IAAIC,OAAO,KAAK,WAAWD,IAAIC,OAAO,GAAG;IAEhE,OACEA,QAAQC,QAAQ,CAAC,UACjBD,QAAQE,WAAW,GAAGD,QAAQ,CAAC,eAC/BD,QAAQE,WAAW,GAAGD,QAAQ,CAAC;AAEnC"}

package/dist/oauth/utilities/refreshTokens.js

@@ -16,7 +16,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
     // so we will refresh both tokens
     try {
         // Get another project token
-        const { expiresAt, token } = await getProjectToken(refreshToken, payload.config.custom.figma.tenantId);
+        const { expiresAt, token } = await getProjectToken(refreshToken, payload.config.custom.figma.contentSystemId);
         debugLogger.info({
             expiresAt,
             msg: 'Received new tokens from Figma API',

package/dist/oauth/utilities/refreshTokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/utilities/refreshTokens.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\nimport type { Payload } from 'payload'\n\nimport { generateCookie } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createCookieOptions } from './createCookieOptions.js'\nimport { createDebugLogger } from './createDebugLogger.js'\nimport { getCookieExpiration } from './getCookieExpiration.js'\n\ninterface Args {\n  payload: Payload\n  refreshToken: string\n  strategy: Strategy\n}\n\ntype Result =\n  | {\n      decodedOauthToken: jwt.JwtPayload\n      headers: Headers\n      token: string\n    }\n  | false\n\nexport const refreshTokens = async ({ payload, refreshToken, strategy }: Args): Promise<Result> => {\n  const debugLogger = createDebugLogger(payload, strategy.debug)\n\n  debugLogger.info({\n    msg: 'Refreshing tokens',\n  })\n\n  const headers = new Headers()\n\n  // At this point, access token is expired\n  // but refresh token is still valid\n  // so we will refresh both tokens\n\n  try {\n    // Get another project token\n    const { expiresAt, token } = await getProjectToken(\n      refreshToken,\n      payload.config.custom.figma.tenantId,\n    )\n\n    debugLogger.info({\n      expiresAt,\n      msg: 'Received new tokens from Figma API',\n      token,\n    })\n\n    // On error, no user\n    if (!token) {\n      debugLogger.error({\n        msg: 'Error refreshing tokens',\n      })\n      return false\n    }\n\n    if (token) {\n      debugLogger.info({\n        msg: 'Successfully refreshed project token',\n        token,\n      })\n\n      const expires_in = new Date(expiresAt)\n\n      const cookieOptions = createCookieOptions({\n        collection: strategy.collection,\n        headers,\n        pluginOptions: strategy.pluginOptions,\n      })\n\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: getCookieExpiration(expires_in),\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      headers.append('Set-Cookie', tokenCookie)\n\n      const decodedOauthToken = await validateProjectToken(token, getEnvironment())\n\n      return { decodedOauthToken, headers, token }\n    }\n  } catch (error) {\n    debugLogger.error({\n      err: error,\n      msg: 'Error refreshing tokens',\n    })\n  }\n\n  return false\n}\n"],"names":["generateCookie","getProjectToken","validateProjectToken","getEnvironment","createCookieOptions","createDebugLogger","getCookieExpiration","refreshTokens","payload","refreshToken","strategy","debugLogger","debug","info","msg","headers","Headers","expiresAt","token","config","custom","figma","tenantId","error","expires_in","Date","cookieOptions","collection","pluginOptions","tokenCookie","name","cookieName","expires","returnCookieAsObject","value","append","decodedOauthToken","err"],"mappings":"AAGA,SAASA,cAAc,QAAQ,UAAS;AAIxC,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,iBAAiB,QAAQ,yBAAwB;AAC1D,SAASC,mBAAmB,QAAQ,2BAA0B;AAgB9D,OAAO,MAAMC,gBAAgB,OAAO,EAAEC,OAAO,EAAEC,YAAY,EAAEC,QAAQ,EAAQ;IAC3E,MAAMC,cAAcN,kBAAkBG,SAASE,SAASE,KAAK;IAE7DD,YAAYE,IAAI,CAAC;QACfC,KAAK;IACP;IAEA,MAAMC,UAAU,IAAIC;IAEpB,yCAAyC;IACzC,mCAAmC;IACnC,iCAAiC;IAEjC,IAAI;QACF,4BAA4B;QAC5B,MAAM,EAAEC,SAAS,EAAEC,KAAK,EAAE,GAAG,MAAMjB,gBACjCQ,cACAD,QAAQW,MAAM,CAACC,MAAM,CAACC,KAAK,CAACC,QAAQ;QAGtCX,YAAYE,IAAI,CAAC;YACfI;YACAH,KAAK;YACLI;QACF;QAEA,oBAAoB;QACpB,IAAI,CAACA,OAAO;YACVP,YAAYY,KAAK,CAAC;gBAChBT,KAAK;YACP;YACA,OAAO;QACT;QAEA,IAAII,OAAO;YACTP,YAAYE,IAAI,CAAC;gBACfC,KAAK;gBACLI;YACF;YAEA,MAAMM,aAAa,IAAIC,KAAKR;YAE5B,MAAMS,gBAAgBtB,oBAAoB;gBACxCuB,YAAYjB,SAASiB,UAAU;gBAC/BZ;gBACAa,eAAelB,SAASkB,aAAa;YACvC;YAEA,MAAMC,cAAc7B,eAAe;gBACjC,GAAG0B,aAAa;gBAChBI,MAAMpB,SAASqB,UAAU;gBACzBC,SAAS1B,oBAAoBkB;gBAC7BS,sBAAsB;gBACtBC,OAAOhB;YACT;YAEAH,QAAQoB,MAAM,CAAC,cAAcN;YAE7B,MAAMO,oBAAoB,MAAMlC,qBAAqBgB,OAAOf;YAE5D,OAAO;gBAAEiC;gBAAmBrB;gBAASG;YAAM;QAC7C;IACF,EAAE,OAAOK,OAAO;QACdZ,YAAYY,KAAK,CAAC;YAChBc,KAAKd;YACLT,KAAK;QACP;IACF;IAEA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../../src/oauth/utilities/refreshTokens.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\nimport type { Payload } from 'payload'\n\nimport { generateCookie } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createCookieOptions } from './createCookieOptions.js'\nimport { createDebugLogger } from './createDebugLogger.js'\nimport { getCookieExpiration } from './getCookieExpiration.js'\n\ninterface Args {\n  payload: Payload\n  refreshToken: string\n  strategy: Strategy\n}\n\ntype Result =\n  | {\n      decodedOauthToken: jwt.JwtPayload\n      headers: Headers\n      token: string\n    }\n  | false\n\nexport const refreshTokens = async ({ payload, refreshToken, strategy }: Args): Promise<Result> => {\n  const debugLogger = createDebugLogger(payload, strategy.debug)\n\n  debugLogger.info({\n    msg: 'Refreshing tokens',\n  })\n\n  const headers = new Headers()\n\n  // At this point, access token is expired\n  // but refresh token is still valid\n  // so we will refresh both tokens\n\n  try {\n    // Get another project token\n    const { expiresAt, token } = await getProjectToken(\n      refreshToken,\n      payload.config.custom.figma.contentSystemId,\n    )\n\n    debugLogger.info({\n      expiresAt,\n      msg: 'Received new tokens from Figma API',\n      token,\n    })\n\n    // On error, no user\n    if (!token) {\n      debugLogger.error({\n        msg: 'Error refreshing tokens',\n      })\n      return false\n    }\n\n    if (token) {\n      debugLogger.info({\n        msg: 'Successfully refreshed project token',\n        token,\n      })\n\n      const expires_in = new Date(expiresAt)\n\n      const cookieOptions = createCookieOptions({\n        collection: strategy.collection,\n        headers,\n        pluginOptions: strategy.pluginOptions,\n      })\n\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: getCookieExpiration(expires_in),\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      headers.append('Set-Cookie', tokenCookie)\n\n      const decodedOauthToken = await validateProjectToken(token, getEnvironment())\n\n      return { decodedOauthToken, headers, token }\n    }\n  } catch (error) {\n    debugLogger.error({\n      err: error,\n      msg: 'Error refreshing tokens',\n    })\n  }\n\n  return false\n}\n"],"names":["generateCookie","getProjectToken","validateProjectToken","getEnvironment","createCookieOptions","createDebugLogger","getCookieExpiration","refreshTokens","payload","refreshToken","strategy","debugLogger","debug","info","msg","headers","Headers","expiresAt","token","config","custom","figma","contentSystemId","error","expires_in","Date","cookieOptions","collection","pluginOptions","tokenCookie","name","cookieName","expires","returnCookieAsObject","value","append","decodedOauthToken","err"],"mappings":"AAGA,SAASA,cAAc,QAAQ,UAAS;AAIxC,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,iBAAiB,QAAQ,yBAAwB;AAC1D,SAASC,mBAAmB,QAAQ,2BAA0B;AAgB9D,OAAO,MAAMC,gBAAgB,OAAO,EAAEC,OAAO,EAAEC,YAAY,EAAEC,QAAQ,EAAQ;IAC3E,MAAMC,cAAcN,kBAAkBG,SAASE,SAASE,KAAK;IAE7DD,YAAYE,IAAI,CAAC;QACfC,KAAK;IACP;IAEA,MAAMC,UAAU,IAAIC;IAEpB,yCAAyC;IACzC,mCAAmC;IACnC,iCAAiC;IAEjC,IAAI;QACF,4BAA4B;QAC5B,MAAM,EAAEC,SAAS,EAAEC,KAAK,EAAE,GAAG,MAAMjB,gBACjCQ,cACAD,QAAQW,MAAM,CAACC,MAAM,CAACC,KAAK,CAACC,eAAe;QAG7CX,YAAYE,IAAI,CAAC;YACfI;YACAH,KAAK;YACLI;QACF;QAEA,oBAAoB;QACpB,IAAI,CAACA,OAAO;YACVP,YAAYY,KAAK,CAAC;gBAChBT,KAAK;YACP;YACA,OAAO;QACT;QAEA,IAAII,OAAO;YACTP,YAAYE,IAAI,CAAC;gBACfC,KAAK;gBACLI;YACF;YAEA,MAAMM,aAAa,IAAIC,KAAKR;YAE5B,MAAMS,gBAAgBtB,oBAAoB;gBACxCuB,YAAYjB,SAASiB,UAAU;gBAC/BZ;gBACAa,eAAelB,SAASkB,aAAa;YACvC;YAEA,MAAMC,cAAc7B,eAAe;gBACjC,GAAG0B,aAAa;gBAChBI,MAAMpB,SAASqB,UAAU;gBACzBC,SAAS1B,oBAAoBkB;gBAC7BS,sBAAsB;gBACtBC,OAAOhB;YACT;YAEAH,QAAQoB,MAAM,CAAC,cAAcN;YAE7B,MAAMO,oBAAoB,MAAMlC,qBAAqBgB,OAAOf;YAE5D,OAAO;gBAAEiC;gBAAmBrB;gBAASG;YAAM;QAC7C;IACF,EAAE,OAAOK,OAAO;QACdZ,YAAYY,KAAK,CAAC;YAChBc,KAAKd;YACLT,KAAK;QACP;IACF;IAEA,OAAO;AACT,EAAC"}

package/dist/templates/README.md

@@ -0,0 +1,19 @@
+# {{PROJECT_NAME}}
+
+A Payload project configured for running on Figma infrastructure.
+
+## Getting Started
+
+pnpm dev
+
+Open http://localhost:3000/admin to access the admin panel.
+
+## Deployment
+
+npx @payloadcms/figma deploy
+
+Deploys to Figma infrastructure.
+
+## Resources
+
+- [Payload Docs](https://payloadcms.com/docs)

package/dist/utils/env-management.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Get an environment variable value from .env file
+ *
+ * @param projectPath - Path to project directory
+ * @param key - Environment variable name to retrieve
+ * @returns The value if found, null otherwise
+ */
+export declare function getEnvVar(projectPath: string, key: string): Promise<null | string>;
 /**
  * Add or update an environment variable in .env file
  *

package/dist/utils/env-management.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-management.d.ts","sourceRoot":"","sources":["../../src/utils/env-management.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAmEf"}
+{"version":3,"file":"env-management.d.ts","sourceRoot":"","sources":["../../src/utils/env-management.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CA+BxF;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAmEf"}

package/dist/utils/env-management.js

@@ -1,5 +1,37 @@
 import fs from 'fs/promises';
 import path from 'path';
+/**
+ * Get an environment variable value from .env file
+ *
+ * @param projectPath - Path to project directory
+ * @param key - Environment variable name to retrieve
+ * @returns The value if found, null otherwise
+ */ export async function getEnvVar(projectPath, key) {
+    const envPath = path.join(projectPath, '.env');
+    try {
+        const contents = await fs.readFile(envPath, 'utf-8');
+        const lines = contents.split('\n');
+        for (const line of lines){
+            // Skip empty lines and comments
+            if (!line.trim() || line.trim().startsWith('#')) {
+                continue;
+            }
+            // Skip lines without =
+            if (!line.includes('=')) {
+                continue;
+            }
+            const equalsIndex = line.indexOf('=');
+            const lineKey = line.substring(0, equalsIndex).trim();
+            if (lineKey === key) {
+                return line.substring(equalsIndex + 1);
+            }
+        }
+        return null;
+    } catch  {
+        // File doesn't exist or can't be read
+        return null;
+    }
+}
 /**
  * Add or update an environment variable in .env file
  *

package/dist/utils/env-management.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/env-management.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport path from 'path'\n\n/**\n * Add or update an environment variable in .env file\n *\n * @param projectPath - Path to project directory\n * @param key - Environment variable name\n * @param value - Environment variable value\n */\nexport async function addOrUpdateEnvVar(\n  projectPath: string,\n  key: string,\n  value: string,\n): Promise<void> {\n  const envPath = path.join(projectPath, '.env')\n\n  try {\n    let contents = ''\n    let envExists = false\n\n    // Try to read existing .env file\n    try {\n      contents = await fs.readFile(envPath, 'utf-8')\n      envExists = true\n    } catch {\n      // .env doesn't exist, will create it\n    }\n\n    const lines = contents.split('\\n')\n    const seenKeys = new Set<string>()\n    const processedLines: string[] = []\n    let keyUpdated = false\n\n    for (const line of lines) {\n      // Skip empty lines at start if file didn't exist\n      if (!envExists && !line.trim()) {\n        continue\n      }\n\n      // Preserve empty lines and comments\n      if (!line.trim() || line.trim().startsWith('#')) {\n        processedLines.push(line)\n        continue\n      }\n\n      // Skip lines without =\n      if (!line.includes('=')) {\n        processedLines.push(line)\n        continue\n      }\n\n      const [lineKey] = line.split('=')\n      const trimmedKey = lineKey.trim()\n\n      // Skip duplicate keys (keep first occurrence)\n      if (seenKeys.has(trimmedKey)) {\n        continue\n      }\n      seenKeys.add(trimmedKey)\n\n      // Update or keep the line\n      if (trimmedKey === key) {\n        processedLines.push(`${key}=${value}`)\n        keyUpdated = true\n      } else {\n        processedLines.push(line)\n      }\n    }\n\n    // Add key if not present\n    if (!keyUpdated) {\n      processedLines.push(`${key}=${value}`)\n    }\n\n    await fs.writeFile(envPath, processedLines.join('\\n'), 'utf-8')\n  } catch (error) {\n    throw new Error(\n      `Failed to update .env file: ${error instanceof Error ? error.message : 'Unknown error'}`,\n    )\n  }\n}\n"],"names":["fs","path","addOrUpdateEnvVar","projectPath","key","value","envPath","join","contents","envExists","readFile","lines","split","seenKeys","Set","processedLines","keyUpdated","line","trim","startsWith","push","includes","lineKey","trimmedKey","has","add","writeFile","error","Error","message"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,UAAU,OAAM;AAEvB;;;;;;CAMC,GACD,OAAO,eAAeC,kBACpBC,WAAmB,EACnBC,GAAW,EACXC,KAAa;IAEb,MAAMC,UAAUL,KAAKM,IAAI,CAACJ,aAAa;IAEvC,IAAI;QACF,IAAIK,WAAW;QACf,IAAIC,YAAY;QAEhB,iCAAiC;QACjC,IAAI;YACFD,WAAW,MAAMR,GAAGU,QAAQ,CAACJ,SAAS;YACtCG,YAAY;QACd,EAAE,OAAM;QACN,qCAAqC;QACvC;QAEA,MAAME,QAAQH,SAASI,KAAK,CAAC;QAC7B,MAAMC,WAAW,IAAIC;QACrB,MAAMC,iBAA2B,EAAE;QACnC,IAAIC,aAAa;QAEjB,KAAK,MAAMC,QAAQN,MAAO;YACxB,iDAAiD;YACjD,IAAI,CAACF,aAAa,CAACQ,KAAKC,IAAI,IAAI;gBAC9B;YACF;YAEA,oCAAoC;YACpC,IAAI,CAACD,KAAKC,IAAI,MAAMD,KAAKC,IAAI,GAAGC,UAAU,CAAC,MAAM;gBAC/CJ,eAAeK,IAAI,CAACH;gBACpB;YACF;YAEA,uBAAuB;YACvB,IAAI,CAACA,KAAKI,QAAQ,CAAC,MAAM;gBACvBN,eAAeK,IAAI,CAACH;gBACpB;YACF;YAEA,MAAM,CAACK,QAAQ,GAAGL,KAAKL,KAAK,CAAC;YAC7B,MAAMW,aAAaD,QAAQJ,IAAI;YAE/B,8CAA8C;YAC9C,IAAIL,SAASW,GAAG,CAACD,aAAa;gBAC5B;YACF;YACAV,SAASY,GAAG,CAACF;YAEb,0BAA0B;YAC1B,IAAIA,eAAenB,KAAK;gBACtBW,eAAeK,IAAI,CAAC,GAAGhB,IAAI,CAAC,EAAEC,OAAO;gBACrCW,aAAa;YACf,OAAO;gBACLD,eAAeK,IAAI,CAACH;YACtB;QACF;QAEA,yBAAyB;QACzB,IAAI,CAACD,YAAY;YACfD,eAAeK,IAAI,CAAC,GAAGhB,IAAI,CAAC,EAAEC,OAAO;QACvC;QAEA,MAAML,GAAG0B,SAAS,CAACpB,SAASS,eAAeR,IAAI,CAAC,OAAO;IACzD,EAAE,OAAOoB,OAAO;QACd,MAAM,IAAIC,MACR,CAAC,4BAA4B,EAAED,iBAAiBC,QAAQD,MAAME,OAAO,GAAG,iBAAiB;IAE7F;AACF"}
+{"version":3,"sources":["../../src/utils/env-management.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport path from 'path'\n\n/**\n * Get an environment variable value from .env file\n *\n * @param projectPath - Path to project directory\n * @param key - Environment variable name to retrieve\n * @returns The value if found, null otherwise\n */\nexport async function getEnvVar(projectPath: string, key: string): Promise<null | string> {\n  const envPath = path.join(projectPath, '.env')\n\n  try {\n    const contents = await fs.readFile(envPath, 'utf-8')\n    const lines = contents.split('\\n')\n\n    for (const line of lines) {\n      // Skip empty lines and comments\n      if (!line.trim() || line.trim().startsWith('#')) {\n        continue\n      }\n\n      // Skip lines without =\n      if (!line.includes('=')) {\n        continue\n      }\n\n      const equalsIndex = line.indexOf('=')\n      const lineKey = line.substring(0, equalsIndex).trim()\n\n      if (lineKey === key) {\n        return line.substring(equalsIndex + 1)\n      }\n    }\n\n    return null\n  } catch {\n    // File doesn't exist or can't be read\n    return null\n  }\n}\n\n/**\n * Add or update an environment variable in .env file\n *\n * @param projectPath - Path to project directory\n * @param key - Environment variable name\n * @param value - Environment variable value\n */\nexport async function addOrUpdateEnvVar(\n  projectPath: string,\n  key: string,\n  value: string,\n): Promise<void> {\n  const envPath = path.join(projectPath, '.env')\n\n  try {\n    let contents = ''\n    let envExists = false\n\n    // Try to read existing .env file\n    try {\n      contents = await fs.readFile(envPath, 'utf-8')\n      envExists = true\n    } catch {\n      // .env doesn't exist, will create it\n    }\n\n    const lines = contents.split('\\n')\n    const seenKeys = new Set<string>()\n    const processedLines: string[] = []\n    let keyUpdated = false\n\n    for (const line of lines) {\n      // Skip empty lines at start if file didn't exist\n      if (!envExists && !line.trim()) {\n        continue\n      }\n\n      // Preserve empty lines and comments\n      if (!line.trim() || line.trim().startsWith('#')) {\n        processedLines.push(line)\n        continue\n      }\n\n      // Skip lines without =\n      if (!line.includes('=')) {\n        processedLines.push(line)\n        continue\n      }\n\n      const [lineKey] = line.split('=')\n      const trimmedKey = lineKey.trim()\n\n      // Skip duplicate keys (keep first occurrence)\n      if (seenKeys.has(trimmedKey)) {\n        continue\n      }\n      seenKeys.add(trimmedKey)\n\n      // Update or keep the line\n      if (trimmedKey === key) {\n        processedLines.push(`${key}=${value}`)\n        keyUpdated = true\n      } else {\n        processedLines.push(line)\n      }\n    }\n\n    // Add key if not present\n    if (!keyUpdated) {\n      processedLines.push(`${key}=${value}`)\n    }\n\n    await fs.writeFile(envPath, processedLines.join('\\n'), 'utf-8')\n  } catch (error) {\n    throw new Error(\n      `Failed to update .env file: ${error instanceof Error ? error.message : 'Unknown error'}`,\n    )\n  }\n}\n"],"names":["fs","path","getEnvVar","projectPath","key","envPath","join","contents","readFile","lines","split","line","trim","startsWith","includes","equalsIndex","indexOf","lineKey","substring","addOrUpdateEnvVar","value","envExists","seenKeys","Set","processedLines","keyUpdated","push","trimmedKey","has","add","writeFile","error","Error","message"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,UAAU,OAAM;AAEvB;;;;;;CAMC,GACD,OAAO,eAAeC,UAAUC,WAAmB,EAAEC,GAAW;IAC9D,MAAMC,UAAUJ,KAAKK,IAAI,CAACH,aAAa;IAEvC,IAAI;QACF,MAAMI,WAAW,MAAMP,GAAGQ,QAAQ,CAACH,SAAS;QAC5C,MAAMI,QAAQF,SAASG,KAAK,CAAC;QAE7B,KAAK,MAAMC,QAAQF,MAAO;YACxB,gCAAgC;YAChC,IAAI,CAACE,KAAKC,IAAI,MAAMD,KAAKC,IAAI,GAAGC,UAAU,CAAC,MAAM;gBAC/C;YACF;YAEA,uBAAuB;YACvB,IAAI,CAACF,KAAKG,QAAQ,CAAC,MAAM;gBACvB;YACF;YAEA,MAAMC,cAAcJ,KAAKK,OAAO,CAAC;YACjC,MAAMC,UAAUN,KAAKO,SAAS,CAAC,GAAGH,aAAaH,IAAI;YAEnD,IAAIK,YAAYb,KAAK;gBACnB,OAAOO,KAAKO,SAAS,CAACH,cAAc;YACtC;QACF;QAEA,OAAO;IACT,EAAE,OAAM;QACN,sCAAsC;QACtC,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,OAAO,eAAeI,kBACpBhB,WAAmB,EACnBC,GAAW,EACXgB,KAAa;IAEb,MAAMf,UAAUJ,KAAKK,IAAI,CAACH,aAAa;IAEvC,IAAI;QACF,IAAII,WAAW;QACf,IAAIc,YAAY;QAEhB,iCAAiC;QACjC,IAAI;YACFd,WAAW,MAAMP,GAAGQ,QAAQ,CAACH,SAAS;YACtCgB,YAAY;QACd,EAAE,OAAM;QACN,qCAAqC;QACvC;QAEA,MAAMZ,QAAQF,SAASG,KAAK,CAAC;QAC7B,MAAMY,WAAW,IAAIC;QACrB,MAAMC,iBAA2B,EAAE;QACnC,IAAIC,aAAa;QAEjB,KAAK,MAAMd,QAAQF,MAAO;YACxB,iDAAiD;YACjD,IAAI,CAACY,aAAa,CAACV,KAAKC,IAAI,IAAI;gBAC9B;YACF;YAEA,oCAAoC;YACpC,IAAI,CAACD,KAAKC,IAAI,MAAMD,KAAKC,IAAI,GAAGC,UAAU,CAAC,MAAM;gBAC/CW,eAAeE,IAAI,CAACf;gBACpB;YACF;YAEA,uBAAuB;YACvB,IAAI,CAACA,KAAKG,QAAQ,CAAC,MAAM;gBACvBU,eAAeE,IAAI,CAACf;gBACpB;YACF;YAEA,MAAM,CAACM,QAAQ,GAAGN,KAAKD,KAAK,CAAC;YAC7B,MAAMiB,aAAaV,QAAQL,IAAI;YAE/B,8CAA8C;YAC9C,IAAIU,SAASM,GAAG,CAACD,aAAa;gBAC5B;YACF;YACAL,SAASO,GAAG,CAACF;YAEb,0BAA0B;YAC1B,IAAIA,eAAevB,KAAK;gBACtBoB,eAAeE,IAAI,CAAC,GAAGtB,IAAI,CAAC,EAAEgB,OAAO;gBACrCK,aAAa;YACf,OAAO;gBACLD,eAAeE,IAAI,CAACf;YACtB;QACF;QAEA,yBAAyB;QACzB,IAAI,CAACc,YAAY;YACfD,eAAeE,IAAI,CAAC,GAAGtB,IAAI,CAAC,EAAEgB,OAAO;QACvC;QAEA,MAAMpB,GAAG8B,SAAS,CAACzB,SAASmB,eAAelB,IAAI,CAAC,OAAO;IACzD,EAAE,OAAOyB,OAAO;QACd,MAAM,IAAIC,MACR,CAAC,4BAA4B,EAAED,iBAAiBC,QAAQD,MAAME,OAAO,GAAG,iBAAiB;IAE7F;AACF"}

package/dist/utils/formatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/utils/formatter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,YAAY,CAAC,CAmCvB"}
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/utils/formatter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,YAAY,CAAC,CAiCvB"}

package/dist/utils/formatter.js

@@ -6,13 +6,7 @@ import path from 'path';
  */ export async function formatFile(filePath, packageManager) {
     return new Promise((resolve)=>{
         try {
-            const args = [
-                'exec',
-                'prettier',
-                '--write',
-                filePath
-            ];
-            const child = spawn(packageManager, args, {
+            const child = spawn(`${packageManager} exec prettier --write "${filePath}"`, {
                 cwd: path.dirname(filePath),
                 shell: true,
                 stdio: 'pipe'

package/dist/utils/formatter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/formatter.ts"],"sourcesContent":["import { spawn } from 'child_process'\nimport path from 'path'\n\nimport type { PackageManager } from './package-manager.js'\n\nexport type FormatResult = {\n  success: boolean\n  warning?: string\n}\n\n/**\n * Format file with Prettier\n * Returns warning if formatting fails but does not throw\n */\nexport async function formatFile(\n  filePath: string,\n  packageManager: PackageManager,\n): Promise<FormatResult> {\n  return new Promise((resolve) => {\n    try {\n      const args = ['exec', 'prettier', '--write', filePath]\n\n      const child = spawn(packageManager, args, {\n        cwd: path.dirname(filePath),\n        shell: true,\n        stdio: 'pipe',\n      })\n\n      child.on('close', (code) => {\n        if (code === 0) {\n          resolve({ success: true })\n        } else {\n          resolve({\n            success: false,\n            warning: 'Could not format file with Prettier',\n          })\n        }\n      })\n\n      child.on('error', () => {\n        resolve({\n          success: false,\n          warning: 'Could not format file with Prettier',\n        })\n      })\n    } catch {\n      resolve({\n        success: false,\n        warning: 'Could not format file with Prettier',\n      })\n    }\n  })\n}\n"],"names":["spawn","path","formatFile","filePath","packageManager","Promise","resolve","args","child","cwd","dirname","shell","stdio","on","code","success","warning"],"mappings":"AAAA,SAASA,KAAK,QAAQ,gBAAe;AACrC,OAAOC,UAAU,OAAM;AASvB;;;CAGC,GACD,OAAO,eAAeC,WACpBC,QAAgB,EAChBC,cAA8B;IAE9B,OAAO,IAAIC,QAAQ,CAACC;QAClB,IAAI;YACF,MAAMC,OAAO;gBAAC;gBAAQ;gBAAY;gBAAWJ;aAAS;YAEtD,MAAMK,QAAQR,MAAMI,gBAAgBG,MAAM;gBACxCE,KAAKR,KAAKS,OAAO,CAACP;gBAClBQ,OAAO;gBACPC,OAAO;YACT;YAEAJ,MAAMK,EAAE,CAAC,SAAS,CAACC;gBACjB,IAAIA,SAAS,GAAG;oBACdR,QAAQ;wBAAES,SAAS;oBAAK;gBAC1B,OAAO;oBACLT,QAAQ;wBACNS,SAAS;wBACTC,SAAS;oBACX;gBACF;YACF;YAEAR,MAAMK,EAAE,CAAC,SAAS;gBAChBP,QAAQ;oBACNS,SAAS;oBACTC,SAAS;gBACX;YACF;QACF,EAAE,OAAM;YACNV,QAAQ;gBACNS,SAAS;gBACTC,SAAS;YACX;QACF;IACF;AACF"}
+{"version":3,"sources":["../../src/utils/formatter.ts"],"sourcesContent":["import { spawn } from 'child_process'\nimport path from 'path'\n\nimport type { PackageManager } from './package-manager.js'\n\nexport type FormatResult = {\n  success: boolean\n  warning?: string\n}\n\n/**\n * Format file with Prettier\n * Returns warning if formatting fails but does not throw\n */\nexport async function formatFile(\n  filePath: string,\n  packageManager: PackageManager,\n): Promise<FormatResult> {\n  return new Promise((resolve) => {\n    try {\n      const child = spawn(`${packageManager} exec prettier --write \"${filePath}\"`, {\n        cwd: path.dirname(filePath),\n        shell: true,\n        stdio: 'pipe',\n      })\n\n      child.on('close', (code) => {\n        if (code === 0) {\n          resolve({ success: true })\n        } else {\n          resolve({\n            success: false,\n            warning: 'Could not format file with Prettier',\n          })\n        }\n      })\n\n      child.on('error', () => {\n        resolve({\n          success: false,\n          warning: 'Could not format file with Prettier',\n        })\n      })\n    } catch {\n      resolve({\n        success: false,\n        warning: 'Could not format file with Prettier',\n      })\n    }\n  })\n}\n"],"names":["spawn","path","formatFile","filePath","packageManager","Promise","resolve","child","cwd","dirname","shell","stdio","on","code","success","warning"],"mappings":"AAAA,SAASA,KAAK,QAAQ,gBAAe;AACrC,OAAOC,UAAU,OAAM;AASvB;;;CAGC,GACD,OAAO,eAAeC,WACpBC,QAAgB,EAChBC,cAA8B;IAE9B,OAAO,IAAIC,QAAQ,CAACC;QAClB,IAAI;YACF,MAAMC,QAAQP,MAAM,GAAGI,eAAe,wBAAwB,EAAED,SAAS,CAAC,CAAC,EAAE;gBAC3EK,KAAKP,KAAKQ,OAAO,CAACN;gBAClBO,OAAO;gBACPC,OAAO;YACT;YAEAJ,MAAMK,EAAE,CAAC,SAAS,CAACC;gBACjB,IAAIA,SAAS,GAAG;oBACdP,QAAQ;wBAAEQ,SAAS;oBAAK;gBAC1B,OAAO;oBACLR,QAAQ;wBACNQ,SAAS;wBACTC,SAAS;oBACX;gBACF;YACF;YAEAR,MAAMK,EAAE,CAAC,SAAS;gBAChBN,QAAQ;oBACNQ,SAAS;oBACTC,SAAS;gBACX;YACF;QACF,EAAE,OAAM;YACNT,QAAQ;gBACNQ,SAAS;gBACTC,SAAS;YACX;QACF;IACF;AACF"}

package/dist/utils/messages.js

@@ -31,12 +31,12 @@ export function helpMessage() {
 
       ${pc.cyan('@payloadcms/figma init --id <content-system-id>')}   Initialize project with Content System ID
       ${pc.cyan('@payloadcms/figma init --force')}                    Force reconfiguration of existing project
-      ${pc.cyan('@payloadcms/figma init --skip-auth')}                Skip authentication (testing only)
 
   ${pc.bold('DEPLOY COMMAND')}
 
-      ${pc.cyan('@payloadcms/figma deploy --id <tenant-id>')}         Deploy your project to Figma
+      ${pc.cyan('@payloadcms/figma deploy')}             Deploy your project to Figma
       ${pc.dim('--yes, -y')}                             Skip confirmation prompts
+      ${pc.dim('--skip-build')}                          Skip building and use existing build
 
   ${pc.bold('DOCUMENTATION')}
 

package/dist/utils/messages.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/messages.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport path from 'path'\nimport pc from 'picocolors'\nimport terminalLink from 'terminal-link'\n\nimport type { PackageManager } from '../types.js'\n\nconst header = (message: string): string => pc.bold(message)\n\nexport function helpMessage(): void {\n  console.log(`\n  ${pc.bold('USAGE')}\n\n      ${pc.dim('@payloadcms/figma <command> [options]')}\n\n  ${pc.bold('COMMANDS')}\n\n      ${pc.cyan('login')}            Authenticate with Figma OAuth2\n      ${pc.cyan('logout')}           Clear all stored tokens\n      ${pc.cyan('list-tokens')}      Show stored token information\n      ${pc.cyan('init')}             Initialize a Figma CMS project\n      ${pc.cyan('deploy')}           Deploy your project to Figma\n\n  ${pc.bold('OPTIONS')}\n\n      ${pc.dim('-h, --help          Show help')}\n      ${pc.dim('--debug             Enable debug logging')}\n\n  ${pc.bold('AUTHENTICATION')}\n\n      ${pc.cyan('@payloadcms/figma login')}                Authenticate with Figma\n      ${pc.cyan('@payloadcms/figma logout')}               Clear all tokens (with confirmation)\n      ${pc.cyan('@payloadcms/figma list-tokens')}          Display stored OAuth and project tokens\n\n  ${pc.bold('INIT COMMAND')}\n\n      ${pc.cyan('@payloadcms/figma init --id <content-system-id>')}   Initialize project with Content System ID\n      ${pc.cyan('@payloadcms/figma init --force')}                    Force reconfiguration of existing project\n      ${pc.cyan('@payloadcms/figma init --skip-auth')}                Skip authentication (testing only)\n\n  ${pc.bold('DEPLOY COMMAND')}\n\n      ${pc.cyan('@payloadcms/figma deploy --id <tenant-id>')}         Deploy your project to Figma\n      ${pc.dim('--yes, -y')}                             Skip confirmation prompts\n\n  ${pc.bold('DOCUMENTATION')}\n\n      ${createTerminalLink('Getting Started', 'https://payloadcms.com/docs/getting-started/what-is-payload')}\n      ${createTerminalLink('Figma CMS Docs', 'https://www.figma.com/developers/api')}\n`)\n}\n\n// Create terminalLink with fallback for unsupported terminals\nfunction createTerminalLink(text: string, url: string) {\n  return terminalLink(text, url, {\n    fallback: (text, url) => `${text}: ${url}`,\n  })\n}\n\nexport function successMessage(projectDir: string, packageManager: PackageManager): string {\n  const relativePath = path.relative(process.cwd(), projectDir)\n  return `\n${header('Launch Application:')}\n\n  - cd ./${relativePath}\n  - ${packageManager === 'npm' ? 'npm run' : packageManager} dev or follow directions in README.md\n\n${header('Documentation:')}\n\n  - ${createTerminalLink(\n    'Getting Started',\n    'https://payloadcms.com/docs/getting-started/what-is-payload',\n  )}\n  - ${createTerminalLink('Configuration', 'https://payloadcms.com/docs/configuration/overview')}\n\n`\n}\n\nexport function successfulNextInit(): string {\n  return `- ${createTerminalLink(\n    'Getting Started',\n    'https://payloadcms.com/docs/getting-started/what-is-payload',\n  )}\n- ${createTerminalLink('Configuration', 'https://payloadcms.com/docs/configuration/overview')}\n`\n}\n\nexport function moveMessage(args: { nextAppDir: string; projectDir: string }): string {\n  const relativeAppDir = path.relative(process.cwd(), args.nextAppDir)\n  return `\n${header('Next Steps:')}\n\nPayload does not support a top-level layout.tsx file in the app directory.\n\n${pc.bold('To continue:')}\n\n- Create a new directory in ./${relativeAppDir} such as ./${relativeAppDir}/${pc.bold('(app)')}\n- Move all files from ./${relativeAppDir} into that directory\n\nIt is recommended to do this from your IDE if your app has existing file references.\n\nOnce moved, rerun the @payloadcms/figma command again.\n`\n}\n\nexport function feedbackOutro(): string {\n  return `${pc.bgCyan(pc.black(' Have feedback? '))} Visit us on ${createTerminalLink('GitHub', 'https://github.com/payloadcms/payload')}.`\n}\n"],"names":["path","pc","terminalLink","header","message","bold","helpMessage","console","log","dim","cyan","createTerminalLink","text","url","fallback","successMessage","projectDir","packageManager","relativePath","relative","process","cwd","successfulNextInit","moveMessage","args","relativeAppDir","nextAppDir","feedbackOutro","bgCyan","black"],"mappings":"AAAA,6BAA6B,GAC7B,OAAOA,UAAU,OAAM;AACvB,OAAOC,QAAQ,aAAY;AAC3B,OAAOC,kBAAkB,gBAAe;AAIxC,MAAMC,SAAS,CAACC,UAA4BH,GAAGI,IAAI,CAACD;AAEpD,OAAO,SAASE;IACdC,QAAQC,GAAG,CAAC,CAAC;EACb,EAAEP,GAAGI,IAAI,CAAC,SAAS;;MAEf,EAAEJ,GAAGQ,GAAG,CAAC,yCAAyC;;EAEtD,EAAER,GAAGI,IAAI,CAAC,YAAY;;MAElB,EAAEJ,GAAGS,IAAI,CAAC,SAAS;MACnB,EAAET,GAAGS,IAAI,CAAC,UAAU;MACpB,EAAET,GAAGS,IAAI,CAAC,eAAe;MACzB,EAAET,GAAGS,IAAI,CAAC,QAAQ;MAClB,EAAET,GAAGS,IAAI,CAAC,UAAU;;EAExB,EAAET,GAAGI,IAAI,CAAC,WAAW;;MAEjB,EAAEJ,GAAGQ,GAAG,CAAC,iCAAiC;MAC1C,EAAER,GAAGQ,GAAG,CAAC,4CAA4C;;EAEzD,EAAER,GAAGI,IAAI,CAAC,kBAAkB;;MAExB,EAAEJ,GAAGS,IAAI,CAAC,2BAA2B;MACrC,EAAET,GAAGS,IAAI,CAAC,4BAA4B;MACtC,EAAET,GAAGS,IAAI,CAAC,iCAAiC;;EAE/C,EAAET,GAAGI,IAAI,CAAC,gBAAgB;;MAEtB,EAAEJ,GAAGS,IAAI,CAAC,mDAAmD;MAC7D,EAAET,GAAGS,IAAI,CAAC,kCAAkC;MAC5C,EAAET,GAAGS,IAAI,CAAC,sCAAsC;;EAEpD,EAAET,GAAGI,IAAI,CAAC,kBAAkB;;MAExB,EAAEJ,GAAGS,IAAI,CAAC,6CAA6C;MACvD,EAAET,GAAGQ,GAAG,CAAC,aAAa;;EAE1B,EAAER,GAAGI,IAAI,CAAC,iBAAiB;;MAEvB,EAAEM,mBAAmB,mBAAmB,+DAA+D;MACvG,EAAEA,mBAAmB,kBAAkB,wCAAwC;AACrF,CAAC;AACD;AAEA,8DAA8D;AAC9D,SAASA,mBAAmBC,IAAY,EAAEC,GAAW;IACnD,OAAOX,aAAaU,MAAMC,KAAK;QAC7BC,UAAU,CAACF,MAAMC,MAAQ,GAAGD,KAAK,EAAE,EAAEC,KAAK;IAC5C;AACF;AAEA,OAAO,SAASE,eAAeC,UAAkB,EAAEC,cAA8B;IAC/E,MAAMC,eAAelB,KAAKmB,QAAQ,CAACC,QAAQC,GAAG,IAAIL;IAClD,OAAO,CAAC;AACV,EAAEb,OAAO,uBAAuB;;SAEvB,EAAEe,aAAa;IACpB,EAAED,mBAAmB,QAAQ,YAAYA,eAAe;;AAE5D,EAAEd,OAAO,kBAAkB;;IAEvB,EAAEQ,mBACF,mBACA,+DACA;IACA,EAAEA,mBAAmB,iBAAiB,sDAAsD;;AAEhG,CAAC;AACD;AAEA,OAAO,SAASW;IACd,OAAO,CAAC,EAAE,EAAEX,mBACV,mBACA,+DACA;EACF,EAAEA,mBAAmB,iBAAiB,sDAAsD;AAC9F,CAAC;AACD;AAEA,OAAO,SAASY,YAAYC,IAAgD;IAC1E,MAAMC,iBAAiBzB,KAAKmB,QAAQ,CAACC,QAAQC,GAAG,IAAIG,KAAKE,UAAU;IACnE,OAAO,CAAC;AACV,EAAEvB,OAAO,eAAe;;;;AAIxB,EAAEF,GAAGI,IAAI,CAAC,gBAAgB;;8BAEI,EAAEoB,eAAe,WAAW,EAAEA,eAAe,CAAC,EAAExB,GAAGI,IAAI,CAAC,SAAS;wBACvE,EAAEoB,eAAe;;;;;AAKzC,CAAC;AACD;AAEA,OAAO,SAASE;IACd,OAAO,GAAG1B,GAAG2B,MAAM,CAAC3B,GAAG4B,KAAK,CAAC,qBAAqB,aAAa,EAAElB,mBAAmB,UAAU,yCAAyC,CAAC,CAAC;AAC3I"}
+{"version":3,"sources":["../../src/utils/messages.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport path from 'path'\nimport pc from 'picocolors'\nimport terminalLink from 'terminal-link'\n\nimport type { PackageManager } from '../types.js'\n\nconst header = (message: string): string => pc.bold(message)\n\nexport function helpMessage(): void {\n  console.log(`\n  ${pc.bold('USAGE')}\n\n      ${pc.dim('@payloadcms/figma <command> [options]')}\n\n  ${pc.bold('COMMANDS')}\n\n      ${pc.cyan('login')}            Authenticate with Figma OAuth2\n      ${pc.cyan('logout')}           Clear all stored tokens\n      ${pc.cyan('list-tokens')}      Show stored token information\n      ${pc.cyan('init')}             Initialize a Figma CMS project\n      ${pc.cyan('deploy')}           Deploy your project to Figma\n\n  ${pc.bold('OPTIONS')}\n\n      ${pc.dim('-h, --help          Show help')}\n      ${pc.dim('--debug             Enable debug logging')}\n\n  ${pc.bold('AUTHENTICATION')}\n\n      ${pc.cyan('@payloadcms/figma login')}                Authenticate with Figma\n      ${pc.cyan('@payloadcms/figma logout')}               Clear all tokens (with confirmation)\n      ${pc.cyan('@payloadcms/figma list-tokens')}          Display stored OAuth and project tokens\n\n  ${pc.bold('INIT COMMAND')}\n\n      ${pc.cyan('@payloadcms/figma init --id <content-system-id>')}   Initialize project with Content System ID\n      ${pc.cyan('@payloadcms/figma init --force')}                    Force reconfiguration of existing project\n\n  ${pc.bold('DEPLOY COMMAND')}\n\n      ${pc.cyan('@payloadcms/figma deploy')}             Deploy your project to Figma\n      ${pc.dim('--yes, -y')}                             Skip confirmation prompts\n      ${pc.dim('--skip-build')}                          Skip building and use existing build\n\n  ${pc.bold('DOCUMENTATION')}\n\n      ${createTerminalLink('Getting Started', 'https://payloadcms.com/docs/getting-started/what-is-payload')}\n      ${createTerminalLink('Figma CMS Docs', 'https://www.figma.com/developers/api')}\n`)\n}\n\n// Create terminalLink with fallback for unsupported terminals\nfunction createTerminalLink(text: string, url: string) {\n  return terminalLink(text, url, {\n    fallback: (text, url) => `${text}: ${url}`,\n  })\n}\n\nexport function successMessage(projectDir: string, packageManager: PackageManager): string {\n  const relativePath = path.relative(process.cwd(), projectDir)\n  return `\n${header('Launch Application:')}\n\n  - cd ./${relativePath}\n  - ${packageManager === 'npm' ? 'npm run' : packageManager} dev or follow directions in README.md\n\n${header('Documentation:')}\n\n  - ${createTerminalLink(\n    'Getting Started',\n    'https://payloadcms.com/docs/getting-started/what-is-payload',\n  )}\n  - ${createTerminalLink('Configuration', 'https://payloadcms.com/docs/configuration/overview')}\n\n`\n}\n\nexport function successfulNextInit(): string {\n  return `- ${createTerminalLink(\n    'Getting Started',\n    'https://payloadcms.com/docs/getting-started/what-is-payload',\n  )}\n- ${createTerminalLink('Configuration', 'https://payloadcms.com/docs/configuration/overview')}\n`\n}\n\nexport function moveMessage(args: { nextAppDir: string; projectDir: string }): string {\n  const relativeAppDir = path.relative(process.cwd(), args.nextAppDir)\n  return `\n${header('Next Steps:')}\n\nPayload does not support a top-level layout.tsx file in the app directory.\n\n${pc.bold('To continue:')}\n\n- Create a new directory in ./${relativeAppDir} such as ./${relativeAppDir}/${pc.bold('(app)')}\n- Move all files from ./${relativeAppDir} into that directory\n\nIt is recommended to do this from your IDE if your app has existing file references.\n\nOnce moved, rerun the @payloadcms/figma command again.\n`\n}\n\nexport function feedbackOutro(): string {\n  return `${pc.bgCyan(pc.black(' Have feedback? '))} Visit us on ${createTerminalLink('GitHub', 'https://github.com/payloadcms/payload')}.`\n}\n"],"names":["path","pc","terminalLink","header","message","bold","helpMessage","console","log","dim","cyan","createTerminalLink","text","url","fallback","successMessage","projectDir","packageManager","relativePath","relative","process","cwd","successfulNextInit","moveMessage","args","relativeAppDir","nextAppDir","feedbackOutro","bgCyan","black"],"mappings":"AAAA,6BAA6B,GAC7B,OAAOA,UAAU,OAAM;AACvB,OAAOC,QAAQ,aAAY;AAC3B,OAAOC,kBAAkB,gBAAe;AAIxC,MAAMC,SAAS,CAACC,UAA4BH,GAAGI,IAAI,CAACD;AAEpD,OAAO,SAASE;IACdC,QAAQC,GAAG,CAAC,CAAC;EACb,EAAEP,GAAGI,IAAI,CAAC,SAAS;;MAEf,EAAEJ,GAAGQ,GAAG,CAAC,yCAAyC;;EAEtD,EAAER,GAAGI,IAAI,CAAC,YAAY;;MAElB,EAAEJ,GAAGS,IAAI,CAAC,SAAS;MACnB,EAAET,GAAGS,IAAI,CAAC,UAAU;MACpB,EAAET,GAAGS,IAAI,CAAC,eAAe;MACzB,EAAET,GAAGS,IAAI,CAAC,QAAQ;MAClB,EAAET,GAAGS,IAAI,CAAC,UAAU;;EAExB,EAAET,GAAGI,IAAI,CAAC,WAAW;;MAEjB,EAAEJ,GAAGQ,GAAG,CAAC,iCAAiC;MAC1C,EAAER,GAAGQ,GAAG,CAAC,4CAA4C;;EAEzD,EAAER,GAAGI,IAAI,CAAC,kBAAkB;;MAExB,EAAEJ,GAAGS,IAAI,CAAC,2BAA2B;MACrC,EAAET,GAAGS,IAAI,CAAC,4BAA4B;MACtC,EAAET,GAAGS,IAAI,CAAC,iCAAiC;;EAE/C,EAAET,GAAGI,IAAI,CAAC,gBAAgB;;MAEtB,EAAEJ,GAAGS,IAAI,CAAC,mDAAmD;MAC7D,EAAET,GAAGS,IAAI,CAAC,kCAAkC;;EAEhD,EAAET,GAAGI,IAAI,CAAC,kBAAkB;;MAExB,EAAEJ,GAAGS,IAAI,CAAC,4BAA4B;MACtC,EAAET,GAAGQ,GAAG,CAAC,aAAa;MACtB,EAAER,GAAGQ,GAAG,CAAC,gBAAgB;;EAE7B,EAAER,GAAGI,IAAI,CAAC,iBAAiB;;MAEvB,EAAEM,mBAAmB,mBAAmB,+DAA+D;MACvG,EAAEA,mBAAmB,kBAAkB,wCAAwC;AACrF,CAAC;AACD;AAEA,8DAA8D;AAC9D,SAASA,mBAAmBC,IAAY,EAAEC,GAAW;IACnD,OAAOX,aAAaU,MAAMC,KAAK;QAC7BC,UAAU,CAACF,MAAMC,MAAQ,GAAGD,KAAK,EAAE,EAAEC,KAAK;IAC5C;AACF;AAEA,OAAO,SAASE,eAAeC,UAAkB,EAAEC,cAA8B;IAC/E,MAAMC,eAAelB,KAAKmB,QAAQ,CAACC,QAAQC,GAAG,IAAIL;IAClD,OAAO,CAAC;AACV,EAAEb,OAAO,uBAAuB;;SAEvB,EAAEe,aAAa;IACpB,EAAED,mBAAmB,QAAQ,YAAYA,eAAe;;AAE5D,EAAEd,OAAO,kBAAkB;;IAEvB,EAAEQ,mBACF,mBACA,+DACA;IACA,EAAEA,mBAAmB,iBAAiB,sDAAsD;;AAEhG,CAAC;AACD;AAEA,OAAO,SAASW;IACd,OAAO,CAAC,EAAE,EAAEX,mBACV,mBACA,+DACA;EACF,EAAEA,mBAAmB,iBAAiB,sDAAsD;AAC9F,CAAC;AACD;AAEA,OAAO,SAASY,YAAYC,IAAgD;IAC1E,MAAMC,iBAAiBzB,KAAKmB,QAAQ,CAACC,QAAQC,GAAG,IAAIG,KAAKE,UAAU;IACnE,OAAO,CAAC;AACV,EAAEvB,OAAO,eAAe;;;;AAIxB,EAAEF,GAAGI,IAAI,CAAC,gBAAgB;;8BAEI,EAAEoB,eAAe,WAAW,EAAEA,eAAe,CAAC,EAAExB,GAAGI,IAAI,CAAC,SAAS;wBACvE,EAAEoB,eAAe;;;;;AAKzC,CAAC;AACD;AAEA,OAAO,SAASE;IACd,OAAO,GAAG1B,GAAG2B,MAAM,CAAC3B,GAAG4B,KAAK,CAAC,qBAAqB,aAAa,EAAElB,mBAAmB,UAAU,yCAAyC,CAAC,CAAC;AAC3I"}

package/dist/utils/payload-config-ast.d.ts

@@ -29,6 +29,11 @@ export type DetectionResult = {
     needsImportChange: boolean;
     /** Whether a `secret` property exists in the config */
     secretProperty?: boolean;
+    /** Sharp configuration if present */
+    sharpProperty?: {
+        /** NPM package sharp is imported from (always 'sharp') */
+        importSource: string;
+    };
 };
 /**
  * Detect what changes are needed in the payload config file

package/dist/utils/payload-config-ast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-config-ast.d.ts","sourceRoot":"","sources":["../../src/utils/payload-config-ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAM1C;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE;QACX,gFAAgF;QAChF,OAAO,EAAE,MAAM,CAAA;QACf,gFAAgF;QAChF,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,sCAAsC;IACtC,cAAc,CAAC,EAAE;QACf,qFAAqF;QACrF,YAAY,EAAE,MAAM,CAAA;QACpB,oEAAoE;QACpE,SAAS,EAAE,OAAO,CAAA;KACnB,CAAA;IACD,wDAAwD;IACxD,iBAAiB,EAAE,OAAO,CAAA;IAC1B,sGAAsG;IACtG,QAAQ,EAAE,OAAO,CAAA;IACjB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,uFAAuF;IACvF,sBAAsB,EAAE,OAAO,CAAA;IAC/B,mFAAmF;IACnF,iBAAiB,EAAE,OAAO,CAAA;IAC1B,uDAAuD;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAG,eAAe,CAqJ7E;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAA;AA0CD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,eAAe,GACzB,qBAAqB,CAwKvB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,mBAAmB,GAC1B,qBAAqB,CAqDvB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,mBAAmB,GAAG,IAAI,CA4ElF"}
+{"version":3,"file":"payload-config-ast.d.ts","sourceRoot":"","sources":["../../src/utils/payload-config-ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAM1C;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,gDAAgD;IAChD,UAAU,CAAC,EAAE;QACX,gFAAgF;QAChF,OAAO,EAAE,MAAM,CAAA;QACf,gFAAgF;QAChF,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,sCAAsC;IACtC,cAAc,CAAC,EAAE;QACf,qFAAqF;QACrF,YAAY,EAAE,MAAM,CAAA;QACpB,oEAAoE;QACpE,SAAS,EAAE,OAAO,CAAA;KACnB,CAAA;IACD,wDAAwD;IACxD,iBAAiB,EAAE,OAAO,CAAA;IAC1B,sGAAsG;IACtG,QAAQ,EAAE,OAAO,CAAA;IACjB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,uFAAuF;IACvF,sBAAsB,EAAE,OAAO,CAAA;IAC/B,mFAAmF;IACnF,iBAAiB,EAAE,OAAO,CAAA;IAC1B,uDAAuD;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,qCAAqC;IACrC,aAAa,CAAC,EAAE;QACd,0DAA0D;QAC1D,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF,CAAA;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAG,eAAe,CAoK7E;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAA;AA0CD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,eAAe,GACzB,qBAAqB,CA4LvB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,mBAAmB,GAC1B,qBAAqB,CAqDvB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,mBAAmB,GAAG,IAAI,CA4ElF"}

package/dist/utils/payload-config-ast.js

@@ -112,6 +112,15 @@ import * as log from './log.js';
             }
         }
     }
+    // Check for sharp property
+    const sharpProperty = configArg.getProperty('sharp');
+    if (sharpProperty) {
+        // Find the import source for sharp
+        const sharpImport = imports.find((imp)=>imp.getModuleSpecifierValue() === 'sharp' || imp.getNamedImports().some((ni)=>ni.getName() === 'sharp'));
+        result.sharpProperty = {
+            importSource: sharpImport?.getModuleSpecifierValue() || 'sharp'
+        };
+    }
     // Check for figma property
     const figmaProperty = configArg.getProperty('figma');
     if (figmaProperty) {
@@ -243,7 +252,16 @@ import * as log from './log.js';
             modified = true;
         }
     }
-    // 4. Update buildConfig import
+    // 4. Remove sharp property
+    if (detection.sharpProperty) {
+        const sharpProperty = configArg.getProperty('sharp');
+        if (sharpProperty) {
+            sharpProperty.remove();
+            changes.push('Removed sharp property');
+            modified = true;
+        }
+    }
+    // 5. Update buildConfig import
     if (detection.needsImportChange) {
         if (payloadImport) {
             if (detection.hasOtherPayloadImports) {
@@ -285,7 +303,7 @@ import * as log from './log.js';
             modified = true;
         }
     }
-    // 5. Remove orphaned imports
+    // 6. Remove orphaned imports
     // Re-fetch imports after each removal to avoid stale references
     if (detection.dbProperty) {
         const currentImports = sourceFile.getImportDeclarations();
@@ -305,6 +323,15 @@ import * as log from './log.js';
             modified = true;
         }
     }
+    if (detection.sharpProperty) {
+        const currentImports = sourceFile.getImportDeclarations();
+        const sharpImport = currentImports.find((imp)=>imp.getModuleSpecifierValue() === 'sharp');
+        if (sharpImport) {
+            sharpImport.remove();
+            changes.push('Removed sharp import');
+            modified = true;
+        }
+    }
     return {
         changes,
         modified