@payloadcms/figma 0.0.1-alpha.28 → 0.0.1-alpha.29

package/dist/commands/deploy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import * as p from '@clack/prompts'\nimport { spawn } from 'child_process'\nimport path from 'path'\nimport pc from 'picocolors'\n\nimport { createDeployment, performDeployment } from '../api/control-plane.js'\nimport { getValidAccessToken } from '../auth/oauth-flow.js'\nimport { getTokenStore } from '../auth/token-store.js'\nimport { collectStaticAssets, createLambdaZip, getFileSize } from '../utils/asset-collection.js'\nimport { detectBuild, getBuildCommand } from '../utils/build-detection.js'\nimport * as log from '../utils/log.js'\nimport { getPackageManager } from '../utils/package-manager.js'\nimport { isInProjectDirectory } from '../utils/project.js'\nimport { uploadLambdaZip, uploadStaticAssets } from '../utils/s3-upload.js'\nimport { loginCommand } from './login.js'\n\n/**\n * Options for deploy command\n */\nexport interface DeployCommandOptions {\n  /** Enable debug mode */\n  debug?: boolean\n  /** Tenant ID */\n  id?: string\n  /** Skip confirmation prompts */\n  yes?: boolean\n}\n\n/**\n * Format bytes to human-readable string\n */\nfunction formatBytes(bytes: number): string {\n  if (bytes === 0) {\n    return '0 B'\n  }\n  const k = 1024\n  const sizes = ['B', 'KB', 'MB', 'GB']\n  const i = Math.floor(Math.log(bytes) / Math.log(k))\n  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(2))} ${sizes[i]}`\n}\n\n/**\n * Format date to human-readable string in local time\n */\nfunction formatDate(date: Date): string {\n  return date.toLocaleString('en-US', {\n    day: 'numeric',\n    hour: 'numeric',\n    minute: 'numeric',\n    month: 'long',\n    timeZoneName: 'short',\n    year: 'numeric',\n  })\n}\n\n/**\n * Execute the deploy command\n *\n * @param options - Command options\n */\nexport async function deployCommand(options: DeployCommandOptions): Promise<void> {\n  const projectPath = process.cwd()\n  const spinner = p.spinner()\n\n  if (!options.id) {\n    p.log.error(pc.red('✗ Tenant ID is required. Use --id <tenant_id> to specify.'))\n    process.exit(1)\n  }\n\n  const tenantId = options.id\n\n  try {\n    // ===== PRE-FLIGHT CHECKS =====\n\n    // Check if in project directory\n    if (!(await isInProjectDirectory(projectPath))) {\n      p.log.error(pc.red(\"✗ 'deploy' command is not available outside of a Payload project.\"))\n      p.note(\n        'Create a project or connect an existing one to Figma: npx @payloadcms/figma init',\n        'Tip',\n      )\n      process.exit(1)\n    }\n\n    // Check authentication\n    const tokenStore = getTokenStore()\n\n    let accessToken = await getValidAccessToken(tokenStore)\n    if (!accessToken) {\n      p.log.message('Please log in to continue')\n      await loginCommand()\n      accessToken = await getValidAccessToken(tokenStore)\n      if (!accessToken) {\n        p.log.error(pc.red('✗ Authentication failed'))\n        process.exit(1)\n      }\n    }\n\n    // ===== BUILD VALIDATION =====\n\n    spinner.start('Checking for build...')\n    let buildInfo = await detectBuild(projectPath)\n\n    if (!buildInfo) {\n      spinner.stop(pc.yellow('⚠ No build found for this project.'))\n\n      // Try to find build command\n      const buildCmd = await getBuildCommand(projectPath)\n\n      if (!buildCmd) {\n        p.log.error('No build script found in package.json')\n        p.note('Add a build script to package.json: \"build\": \"next build\"', 'Tip')\n        process.exit(1)\n      }\n\n      // Prompt to run build\n      if (!options.yes) {\n        const shouldBuild = await p.confirm({\n          initialValue: true,\n          message: `Build command found in package.json. Run it?`,\n        })\n\n        if (p.isCancel(shouldBuild) || !shouldBuild) {\n          p.log.message('Cancelling deployment...')\n          process.exit(0)\n        }\n      }\n\n      // Run build\n      const packageManager = await getPackageManager(projectPath)\n      const buildCommand = `${packageManager} run build`\n      spinner.stop(`Running ${buildCommand}...\\n`)\n\n      try {\n        // Stream build output to user with formatting\n        const buildProcess = spawn(packageManager, ['run', 'build'], {\n          cwd: projectPath,\n          stdio: ['ignore', 'pipe', 'pipe'],\n        })\n\n        // Indent and dim output\n        buildProcess.stdout?.on('data', (data) => {\n          const lines = data.toString().split('\\n')\n          lines.forEach((line: string) => {\n            if (line.trim()) {\n              // eslint-disable-next-line no-console\n              console.log(pc.dim(`      ${line}`)) // Standard output\n            }\n          })\n        })\n\n        buildProcess.stderr?.on('data', (data) => {\n          const lines = data.toString().split('\\n')\n          lines.forEach((line: string) => {\n            if (line.trim()) {\n              // eslint-disable-next-line no-console\n              console.log(pc.dim(`      ${line}`)) // Standard error\n            }\n          })\n        })\n\n        const exitCode = await new Promise<number>((resolve) => {\n          buildProcess.on('close', resolve)\n        })\n\n        if (exitCode !== 0) {\n          throw new Error(`Build process exited with code ${exitCode}`)\n        }\n\n        p.log.success(pc.green('✓ Build completed'))\n      } catch (error) {\n        p.log.error(pc.red('✗ Build failed'))\n        if (error instanceof Error && options.debug) {\n          log.error(`Build error: ${error.message}`)\n        }\n        process.exit(1)\n      }\n\n      // Re-check for build\n      buildInfo = await detectBuild(projectPath)\n      if (!buildInfo) {\n        p.log.error(pc.red('✗ Build completed but standalone build not found'))\n        p.note('Ensure next.config.js has output: \"standalone\"', 'Check Lambda Configuration')\n        process.exit(1)\n      }\n    } else {\n      spinner.stop(pc.green('✓ Build found'))\n      p.note(\n        [\n          `${pc.cyan('Build ID:')} ${buildInfo.buildId}`,\n          `${pc.cyan('Date:')} ${formatDate(buildInfo.timestamp)}`,\n        ].join('\\n'),\n        'Build Details',\n      )\n    }\n\n    // ===== DEPLOYMENT PREPARATION =====\n\n    // Create Lambda zip\n    spinner.start('Creating deployment package...')\n    try {\n      await createLambdaZip(projectPath)\n      spinner.stop(pc.green('✓ Deployment package created'))\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to create deployment package'))\n      throw error\n    }\n\n    // Collect static assets\n    spinner.start('Collecting static assets...')\n    const staticAssets = await collectStaticAssets(projectPath)\n    const zipPath = path.join(projectPath, 'lambda.zip')\n    const zipSize = await getFileSize(zipPath)\n    spinner.stop(pc.green(`✓ ${staticAssets.length} static assets detected`))\n\n    log.debug(`Lambda zip size: ${formatBytes(zipSize)}`)\n    log.debug(`Static assets: ${staticAssets.length} files`)\n\n    // ===== DEPLOYMENT CONFIRMATION =====\n\n    if (!options.yes) {\n      p.note(\n        [\n          `${pc.cyan('Build ID:')} ${buildInfo.buildId}`,\n          `${pc.cyan('Date:')} ${formatDate(buildInfo.timestamp)}`,\n          `${pc.cyan('Code size:')} ${formatBytes(zipSize)}`,\n          `${pc.cyan('Static assets:')} ${staticAssets.length} files`,\n        ].join('\\n'),\n        'Details',\n      )\n\n      const shouldDeploy = await p.confirm({\n        initialValue: true,\n        message: 'Deploy this build to Figma?',\n      })\n\n      if (p.isCancel(shouldDeploy) || !shouldDeploy) {\n        p.log.message('Cancelling deployment...')\n        process.exit(0)\n      }\n    }\n\n    // ===== DEPLOYMENT EXECUTION =====\n\n    // Step 1: Create deployment\n    spinner.start('Creating deployment...')\n    let deploymentId: string\n    let codeUploadUrl: string\n    let staticAssetUploadUrls: Record<string, string>\n\n    try {\n      const createResponse = await createDeployment(accessToken, tenantId, {\n        staticAssets,\n      })\n\n      deploymentId = createResponse.deploymentId\n      codeUploadUrl = createResponse.codeUploadUrl\n      staticAssetUploadUrls = createResponse.staticAssetUploadUrls\n\n      log.debug(`Deployment ID: ${deploymentId}`)\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to create deployment'))\n      throw error\n    }\n\n    // Step 2: Upload code\n    spinner.message(`Uploading code (${formatBytes(zipSize)})...`)\n    try {\n      await uploadLambdaZip(zipPath, codeUploadUrl)\n      spinner.stop(pc.green(`✓ Code uploaded (${formatBytes(zipSize)})`))\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to upload code'))\n      throw error\n    }\n\n    // Step 3: Upload static assets\n    if (staticAssets.length > 0) {\n      spinner.start('Uploading static assets...')\n\n      try {\n        const uploadResults = await uploadStaticAssets(\n          projectPath,\n          staticAssetUploadUrls,\n          (uploaded, total) => {\n            spinner.message(`Uploading static assets (${uploaded}/${total})...`)\n          },\n        )\n\n        if (uploadResults.assetsFailed > 0) {\n          spinner.stop(\n            pc.yellow(\n              `⚠ ${uploadResults.assetsUploaded}/${staticAssets.length} assets uploaded (${uploadResults.assetsFailed} failed)`,\n            ),\n          )\n          p.log.warning(\n            `${uploadResults.assetsFailed} assets failed to upload. Deployment may be incomplete.`,\n          )\n        } else {\n          spinner.stop(\n            pc.green(\n              `✓ Static assets uploaded (${uploadResults.assetsUploaded} files, ${formatBytes(uploadResults.totalBytesUploaded)})`,\n            ),\n          )\n        }\n      } catch (error) {\n        spinner.stop(pc.red('✗ Failed to upload assets'))\n        throw error\n      }\n    }\n\n    // Step 4: Perform deployment\n    spinner.start('Performing deployment...')\n    try {\n      await performDeployment(accessToken, tenantId, {\n        deploymentId,\n      })\n      spinner.stop(pc.green('✓ Deployment initiated'))\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to perform deployment'))\n      throw error\n    }\n\n    // TODO: Add deployment progress tracking\n    // Future: Poll deployment status and show progress\n    // API endpoint: GET /v1/tenant/{tenant_id}/deploy/{deployment_id}/status\n\n    // Success output\n    p.log.message('This usually takes 2-3 minutes to complete.')\n\n    // TODO: Get tenant details for URL using getTenantDetails\n    // TODO: Display next steps with url to manage their CMS ie. https://staging.figma.com/files/1234/cms/manager/12345678\n  } catch (error) {\n    spinner.stop(pc.red('✗ Failed'))\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    p.log.error(pc.red(`✗ ${message}`))\n    if (options.debug && error instanceof Error && error.stack) {\n      log.error(`Stack trace: ${error.stack}`)\n    }\n    process.exit(1)\n  }\n}\n"],"names":["p","spawn","path","pc","createDeployment","performDeployment","getValidAccessToken","getTokenStore","collectStaticAssets","createLambdaZip","getFileSize","detectBuild","getBuildCommand","log","getPackageManager","isInProjectDirectory","uploadLambdaZip","uploadStaticAssets","loginCommand","formatBytes","bytes","k","sizes","i","Math","floor","parseFloat","pow","toFixed","formatDate","date","toLocaleString","day","hour","minute","month","timeZoneName","year","deployCommand","options","projectPath","process","cwd","spinner","id","error","red","exit","tenantId","note","tokenStore","accessToken","message","start","buildInfo","stop","yellow","buildCmd","yes","shouldBuild","confirm","initialValue","isCancel","packageManager","buildCommand","buildProcess","stdio","stdout","on","data","lines","toString","split","forEach","line","trim","console","dim","stderr","exitCode","Promise","resolve","Error","success","green","debug","cyan","buildId","timestamp","join","staticAssets","zipPath","zipSize","length","shouldDeploy","deploymentId","codeUploadUrl","staticAssetUploadUrls","createResponse","uploadResults","uploaded","total","assetsFailed","assetsUploaded","warning","totalBytesUploaded","stack"],"mappings":"AAAA,YAAYA,OAAO,iBAAgB;AACnC,SAASC,KAAK,QAAQ,gBAAe;AACrC,OAAOC,UAAU,OAAM;AACvB,OAAOC,QAAQ,aAAY;AAE3B,SAASC,gBAAgB,EAAEC,iBAAiB,QAAQ,0BAAyB;AAC7E,SAASC,mBAAmB,QAAQ,wBAAuB;AAC3D,SAASC,aAAa,QAAQ,yBAAwB;AACtD,SAASC,mBAAmB,EAAEC,eAAe,EAAEC,WAAW,QAAQ,+BAA8B;AAChG,SAASC,WAAW,EAAEC,eAAe,QAAQ,8BAA6B;AAC1E,YAAYC,SAAS,kBAAiB;AACtC,SAASC,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,oBAAoB,QAAQ,sBAAqB;AAC1D,SAASC,eAAe,EAAEC,kBAAkB,QAAQ,wBAAuB;AAC3E,SAASC,YAAY,QAAQ,aAAY;AAczC;;CAEC,GACD,SAASC,YAAYC,KAAa;IAChC,IAAIA,UAAU,GAAG;QACf,OAAO;IACT;IACA,MAAMC,IAAI;IACV,MAAMC,QAAQ;QAAC;QAAK;QAAM;QAAM;KAAK;IACrC,MAAMC,IAAIC,KAAKC,KAAK,CAACD,KAAKX,GAAG,CAACO,SAASI,KAAKX,GAAG,CAACQ;IAChD,OAAO,GAAGK,WAAW,AAACN,CAAAA,QAAQI,KAAKG,GAAG,CAACN,GAAGE,EAAC,EAAGK,OAAO,CAAC,IAAI,CAAC,EAAEN,KAAK,CAACC,EAAE,EAAE;AACzE;AAEA;;CAEC,GACD,SAASM,WAAWC,IAAU;IAC5B,OAAOA,KAAKC,cAAc,CAAC,SAAS;QAClCC,KAAK;QACLC,MAAM;QACNC,QAAQ;QACRC,OAAO;QACPC,cAAc;QACdC,MAAM;IACR;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,cAAcC,OAA6B;IAC/D,MAAMC,cAAcC,QAAQC,GAAG;IAC/B,MAAMC,UAAU3C,EAAE2C,OAAO;IAEzB,IAAI,CAACJ,QAAQK,EAAE,EAAE;QACf5C,EAAEa,GAAG,CAACgC,KAAK,CAAC1C,GAAG2C,GAAG,CAAC;QACnBL,QAAQM,IAAI,CAAC;IACf;IAEA,MAAMC,WAAWT,QAAQK,EAAE;IAE3B,IAAI;QACF,gCAAgC;QAEhC,gCAAgC;QAChC,IAAI,CAAE,MAAM7B,qBAAqByB,cAAe;YAC9CxC,EAAEa,GAAG,CAACgC,KAAK,CAAC1C,GAAG2C,GAAG,CAAC;YACnB9C,EAAEiD,IAAI,CACJ,oFACA;YAEFR,QAAQM,IAAI,CAAC;QACf;QAEA,uBAAuB;QACvB,MAAMG,aAAa3C;QAEnB,IAAI4C,cAAc,MAAM7C,oBAAoB4C;QAC5C,IAAI,CAACC,aAAa;YAChBnD,EAAEa,GAAG,CAACuC,OAAO,CAAC;YACd,MAAMlC;YACNiC,cAAc,MAAM7C,oBAAoB4C;YACxC,IAAI,CAACC,aAAa;gBAChBnD,EAAEa,GAAG,CAACgC,KAAK,CAAC1C,GAAG2C,GAAG,CAAC;gBACnBL,QAAQM,IAAI,CAAC;YACf;QACF;QAEA,+BAA+B;QAE/BJ,QAAQU,KAAK,CAAC;QACd,IAAIC,YAAY,MAAM3C,YAAY6B;QAElC,IAAI,CAACc,WAAW;YACdX,QAAQY,IAAI,CAACpD,GAAGqD,MAAM,CAAC;YAEvB,4BAA4B;YAC5B,MAAMC,WAAW,MAAM7C,gBAAgB4B;YAEvC,IAAI,CAACiB,UAAU;gBACbzD,EAAEa,GAAG,CAACgC,KAAK,CAAC;gBACZ7C,EAAEiD,IAAI,CAAC,6DAA6D;gBACpER,QAAQM,IAAI,CAAC;YACf;YAEA,sBAAsB;YACtB,IAAI,CAACR,QAAQmB,GAAG,EAAE;gBAChB,MAAMC,cAAc,MAAM3D,EAAE4D,OAAO,CAAC;oBAClCC,cAAc;oBACdT,SAAS,CAAC,4CAA4C,CAAC;gBACzD;gBAEA,IAAIpD,EAAE8D,QAAQ,CAACH,gBAAgB,CAACA,aAAa;oBAC3C3D,EAAEa,GAAG,CAACuC,OAAO,CAAC;oBACdX,QAAQM,IAAI,CAAC;gBACf;YACF;YAEA,YAAY;YACZ,MAAMgB,iBAAiB,MAAMjD,kBAAkB0B;YAC/C,MAAMwB,eAAe,GAAGD,eAAe,UAAU,CAAC;YAClDpB,QAAQY,IAAI,CAAC,CAAC,QAAQ,EAAES,aAAa,KAAK,CAAC;YAE3C,IAAI;gBACF,8CAA8C;gBAC9C,MAAMC,eAAehE,MAAM8D,gBAAgB;oBAAC;oBAAO;iBAAQ,EAAE;oBAC3DrB,KAAKF;oBACL0B,OAAO;wBAAC;wBAAU;wBAAQ;qBAAO;gBACnC;gBAEA,wBAAwB;gBACxBD,aAAaE,MAAM,EAAEC,GAAG,QAAQ,CAACC;oBAC/B,MAAMC,QAAQD,KAAKE,QAAQ,GAAGC,KAAK,CAAC;oBACpCF,MAAMG,OAAO,CAAC,CAACC;wBACb,IAAIA,KAAKC,IAAI,IAAI;4BACf,sCAAsC;4BACtCC,QAAQ/D,GAAG,CAACV,GAAG0E,GAAG,CAAC,CAAC,MAAM,EAAEH,MAAM,IAAG,kBAAkB;wBACzD;oBACF;gBACF;gBAEAT,aAAaa,MAAM,EAAEV,GAAG,QAAQ,CAACC;oBAC/B,MAAMC,QAAQD,KAAKE,QAAQ,GAAGC,KAAK,CAAC;oBACpCF,MAAMG,OAAO,CAAC,CAACC;wBACb,IAAIA,KAAKC,IAAI,IAAI;4BACf,sCAAsC;4BACtCC,QAAQ/D,GAAG,CAACV,GAAG0E,GAAG,CAAC,CAAC,MAAM,EAAEH,MAAM,IAAG,iBAAiB;wBACxD;oBACF;gBACF;gBAEA,MAAMK,WAAW,MAAM,IAAIC,QAAgB,CAACC;oBAC1ChB,aAAaG,EAAE,CAAC,SAASa;gBAC3B;gBAEA,IAAIF,aAAa,GAAG;oBAClB,MAAM,IAAIG,MAAM,CAAC,+BAA+B,EAAEH,UAAU;gBAC9D;gBAEA/E,EAAEa,GAAG,CAACsE,OAAO,CAAChF,GAAGiF,KAAK,CAAC;YACzB,EAAE,OAAOvC,OAAO;gBACd7C,EAAEa,GAAG,CAACgC,KAAK,CAAC1C,GAAG2C,GAAG,CAAC;gBACnB,IAAID,iBAAiBqC,SAAS3C,QAAQ8C,KAAK,EAAE;oBAC3CxE,IAAIgC,KAAK,CAAC,CAAC,aAAa,EAAEA,MAAMO,OAAO,EAAE;gBAC3C;gBACAX,QAAQM,IAAI,CAAC;YACf;YAEA,qBAAqB;YACrBO,YAAY,MAAM3C,YAAY6B;YAC9B,IAAI,CAACc,WAAW;gBACdtD,EAAEa,GAAG,CAACgC,KAAK,CAAC1C,GAAG2C,GAAG,CAAC;gBACnB9C,EAAEiD,IAAI,CAAC,kDAAkD;gBACzDR,QAAQM,IAAI,CAAC;YACf;QACF,OAAO;YACLJ,QAAQY,IAAI,CAACpD,GAAGiF,KAAK,CAAC;YACtBpF,EAAEiD,IAAI,CACJ;gBACE,GAAG9C,GAAGmF,IAAI,CAAC,aAAa,CAAC,EAAEhC,UAAUiC,OAAO,EAAE;gBAC9C,GAAGpF,GAAGmF,IAAI,CAAC,SAAS,CAAC,EAAEzD,WAAWyB,UAAUkC,SAAS,GAAG;aACzD,CAACC,IAAI,CAAC,OACP;QAEJ;QAEA,qCAAqC;QAErC,oBAAoB;QACpB9C,QAAQU,KAAK,CAAC;QACd,IAAI;YACF,MAAM5C,gBAAgB+B;YACtBG,QAAQY,IAAI,CAACpD,GAAGiF,KAAK,CAAC;QACxB,EAAE,OAAOvC,OAAO;YACdF,QAAQY,IAAI,CAACpD,GAAG2C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,wBAAwB;QACxBF,QAAQU,KAAK,CAAC;QACd,MAAMqC,eAAe,MAAMlF,oBAAoBgC;QAC/C,MAAMmD,UAAUzF,KAAKuF,IAAI,CAACjD,aAAa;QACvC,MAAMoD,UAAU,MAAMlF,YAAYiF;QAClChD,QAAQY,IAAI,CAACpD,GAAGiF,KAAK,CAAC,CAAC,EAAE,EAAEM,aAAaG,MAAM,CAAC,uBAAuB,CAAC;QAEvEhF,IAAIwE,KAAK,CAAC,CAAC,iBAAiB,EAAElE,YAAYyE,UAAU;QACpD/E,IAAIwE,KAAK,CAAC,CAAC,eAAe,EAAEK,aAAaG,MAAM,CAAC,MAAM,CAAC;QAEvD,sCAAsC;QAEtC,IAAI,CAACtD,QAAQmB,GAAG,EAAE;YAChB1D,EAAEiD,IAAI,CACJ;gBACE,GAAG9C,GAAGmF,IAAI,CAAC,aAAa,CAAC,EAAEhC,UAAUiC,OAAO,EAAE;gBAC9C,GAAGpF,GAAGmF,IAAI,CAAC,SAAS,CAAC,EAAEzD,WAAWyB,UAAUkC,SAAS,GAAG;gBACxD,GAAGrF,GAAGmF,IAAI,CAAC,cAAc,CAAC,EAAEnE,YAAYyE,UAAU;gBAClD,GAAGzF,GAAGmF,IAAI,CAAC,kBAAkB,CAAC,EAAEI,aAAaG,MAAM,CAAC,MAAM,CAAC;aAC5D,CAACJ,IAAI,CAAC,OACP;YAGF,MAAMK,eAAe,MAAM9F,EAAE4D,OAAO,CAAC;gBACnCC,cAAc;gBACdT,SAAS;YACX;YAEA,IAAIpD,EAAE8D,QAAQ,CAACgC,iBAAiB,CAACA,cAAc;gBAC7C9F,EAAEa,GAAG,CAACuC,OAAO,CAAC;gBACdX,QAAQM,IAAI,CAAC;YACf;QACF;QAEA,mCAAmC;QAEnC,4BAA4B;QAC5BJ,QAAQU,KAAK,CAAC;QACd,IAAI0C;QACJ,IAAIC;QACJ,IAAIC;QAEJ,IAAI;YACF,MAAMC,iBAAiB,MAAM9F,iBAAiB+C,aAAaH,UAAU;gBACnE0C;YACF;YAEAK,eAAeG,eAAeH,YAAY;YAC1CC,gBAAgBE,eAAeF,aAAa;YAC5CC,wBAAwBC,eAAeD,qBAAqB;YAE5DpF,IAAIwE,KAAK,CAAC,CAAC,eAAe,EAAEU,cAAc;QAC5C,EAAE,OAAOlD,OAAO;YACdF,QAAQY,IAAI,CAACpD,GAAG2C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,sBAAsB;QACtBF,QAAQS,OAAO,CAAC,CAAC,gBAAgB,EAAEjC,YAAYyE,SAAS,IAAI,CAAC;QAC7D,IAAI;YACF,MAAM5E,gBAAgB2E,SAASK;YAC/BrD,QAAQY,IAAI,CAACpD,GAAGiF,KAAK,CAAC,CAAC,iBAAiB,EAAEjE,YAAYyE,SAAS,CAAC,CAAC;QACnE,EAAE,OAAO/C,OAAO;YACdF,QAAQY,IAAI,CAACpD,GAAG2C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,+BAA+B;QAC/B,IAAI6C,aAAaG,MAAM,GAAG,GAAG;YAC3BlD,QAAQU,KAAK,CAAC;YAEd,IAAI;gBACF,MAAM8C,gBAAgB,MAAMlF,mBAC1BuB,aACAyD,uBACA,CAACG,UAAUC;oBACT1D,QAAQS,OAAO,CAAC,CAAC,yBAAyB,EAAEgD,SAAS,CAAC,EAAEC,MAAM,IAAI,CAAC;gBACrE;gBAGF,IAAIF,cAAcG,YAAY,GAAG,GAAG;oBAClC3D,QAAQY,IAAI,CACVpD,GAAGqD,MAAM,CACP,CAAC,EAAE,EAAE2C,cAAcI,cAAc,CAAC,CAAC,EAAEb,aAAaG,MAAM,CAAC,kBAAkB,EAAEM,cAAcG,YAAY,CAAC,QAAQ,CAAC;oBAGrHtG,EAAEa,GAAG,CAAC2F,OAAO,CACX,GAAGL,cAAcG,YAAY,CAAC,uDAAuD,CAAC;gBAE1F,OAAO;oBACL3D,QAAQY,IAAI,CACVpD,GAAGiF,KAAK,CACN,CAAC,0BAA0B,EAAEe,cAAcI,cAAc,CAAC,QAAQ,EAAEpF,YAAYgF,cAAcM,kBAAkB,EAAE,CAAC,CAAC;gBAG1H;YACF,EAAE,OAAO5D,OAAO;gBACdF,QAAQY,IAAI,CAACpD,GAAG2C,GAAG,CAAC;gBACpB,MAAMD;YACR;QACF;QAEA,6BAA6B;QAC7BF,QAAQU,KAAK,CAAC;QACd,IAAI;YACF,MAAMhD,kBAAkB8C,aAAaH,UAAU;gBAC7C+C;YACF;YACApD,QAAQY,IAAI,CAACpD,GAAGiF,KAAK,CAAC;QACxB,EAAE,OAAOvC,OAAO;YACdF,QAAQY,IAAI,CAACpD,GAAG2C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,yCAAyC;QACzC,mDAAmD;QACnD,yEAAyE;QAEzE,iBAAiB;QACjB7C,EAAEa,GAAG,CAACuC,OAAO,CAAC;IAEd,0DAA0D;IAC1D,sHAAsH;IACxH,EAAE,OAAOP,OAAO;QACdF,QAAQY,IAAI,CAACpD,GAAG2C,GAAG,CAAC;QACpB,MAAMM,UAAUP,iBAAiBqC,QAAQrC,MAAMO,OAAO,GAAG;QACzDpD,EAAEa,GAAG,CAACgC,KAAK,CAAC1C,GAAG2C,GAAG,CAAC,CAAC,EAAE,EAAEM,SAAS;QACjC,IAAIb,QAAQ8C,KAAK,IAAIxC,iBAAiBqC,SAASrC,MAAM6D,KAAK,EAAE;YAC1D7F,IAAIgC,KAAK,CAAC,CAAC,aAAa,EAAEA,MAAM6D,KAAK,EAAE;QACzC;QACAjE,QAAQM,IAAI,CAAC;IACf;AACF"}
+{"version":3,"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import * as p from '@clack/prompts'\nimport { spawn } from 'child_process'\nimport path from 'path'\nimport pc from 'picocolors'\n\nimport { createDeployment, performDeployment } from '../api/control-plane.js'\nimport { getValidAccessToken } from '../auth/oauth-flow.js'\nimport { getTokenStore } from '../auth/token-store.js'\nimport { collectStaticAssets, createLambdaZip, getFileSize } from '../utils/asset-collection.js'\nimport { detectBuild, getBuildCommand } from '../utils/build-detection.js'\nimport { getEnvVar } from '../utils/env-management.js'\nimport * as log from '../utils/log.js'\nimport { getPackageManager } from '../utils/package-manager.js'\nimport { isInProjectDirectory } from '../utils/project.js'\nimport { uploadLambdaZip, uploadStaticAssets } from '../utils/s3-upload.js'\nimport { loginCommand } from './login.js'\n\n/**\n * Options for deploy command\n */\nexport interface DeployCommandOptions {\n  /** Enable debug mode */\n  debug?: boolean\n  /** Tenant ID */\n  id?: string\n  /** Skip the build step (use existing build) */\n  skipBuild?: boolean\n  /** Skip confirmation prompts */\n  yes?: boolean\n}\n\n/**\n * Format bytes to human-readable string\n */\nfunction formatBytes(bytes: number): string {\n  if (bytes === 0) {\n    return '0 B'\n  }\n  const k = 1024\n  const sizes = ['B', 'KB', 'MB', 'GB']\n  const i = Math.floor(Math.log(bytes) / Math.log(k))\n  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(2))} ${sizes[i]}`\n}\n\n/**\n * Format date to human-readable string in local time\n */\nfunction formatDate(date: Date): string {\n  return date.toLocaleString('en-US', {\n    day: 'numeric',\n    hour: 'numeric',\n    minute: 'numeric',\n    month: 'long',\n    timeZoneName: 'short',\n    year: 'numeric',\n  })\n}\n\n/**\n * Execute the deploy command\n *\n * @param options - Command options\n */\nexport async function deployCommand(options: DeployCommandOptions): Promise<void> {\n  const projectPath = process.cwd()\n  const spinner = p.spinner()\n\n  let tenantId = options.id\n  if (!tenantId) {\n    tenantId = (await getEnvVar(projectPath, 'FIGMA_TENANT_ID')) ?? undefined\n  }\n  if (!tenantId) {\n    p.log.error(pc.red('✗ Tenant ID not found. Run `@payloadcms/figma init` first.'))\n    process.exit(1)\n  }\n\n  try {\n    // ===== PRE-FLIGHT CHECKS =====\n\n    // Check if in project directory\n    if (!(await isInProjectDirectory(projectPath))) {\n      p.log.error(pc.red(\"✗ 'deploy' command is not available outside of a Payload project.\"))\n      p.note(\n        'Create a project or connect an existing one to Figma: npx @payloadcms/figma init',\n        'Tip',\n      )\n      process.exit(1)\n    }\n\n    // Check authentication\n    const tokenStore = getTokenStore()\n\n    let accessToken = await getValidAccessToken(tokenStore)\n    if (!accessToken) {\n      p.log.message('Please log in to continue')\n      await loginCommand()\n      accessToken = await getValidAccessToken(tokenStore)\n      if (!accessToken) {\n        p.log.error(pc.red('✗ Authentication failed'))\n        process.exit(1)\n      }\n    }\n\n    // ===== BUILD =====\n\n    let buildInfo: Awaited<ReturnType<typeof detectBuild>>\n\n    if (options.skipBuild) {\n      // User asserts build exists - verify it\n      spinner.start('Checking for build...')\n      buildInfo = await detectBuild(projectPath)\n\n      if (!buildInfo) {\n        spinner.stop(pc.red('✗ No build found'))\n        p.log.error('Use deploy without --skip-build to build first.')\n        process.exit(1)\n      }\n\n      spinner.stop(pc.green('✓ Build found'))\n      p.note(\n        [\n          `${pc.cyan('Build ID:')} ${buildInfo.buildId}`,\n          `${pc.cyan('Date:')} ${formatDate(buildInfo.timestamp)}`,\n        ].join('\\n'),\n        'Build Details',\n      )\n    } else {\n      // Always build (no prompt)\n      const buildCmd = await getBuildCommand(projectPath)\n\n      if (!buildCmd) {\n        p.log.error('No build script found in package.json')\n        p.note('Add a build script to package.json: \"build\": \"next build\"', 'Tip')\n        process.exit(1)\n      }\n\n      const packageManager = await getPackageManager(projectPath)\n      const buildCommand = `${packageManager} run build`\n      p.log.step(`Running ${buildCommand}...\\n`)\n\n      try {\n        // Stream build output to user with formatting\n        const buildProcess = spawn(packageManager, ['run', 'build'], {\n          cwd: projectPath,\n          stdio: ['ignore', 'pipe', 'pipe'],\n        })\n\n        // Indent and dim output\n        buildProcess.stdout?.on('data', (data) => {\n          const lines = data.toString().split('\\n')\n          lines.forEach((line: string) => {\n            if (line.trim()) {\n              // eslint-disable-next-line no-console\n              console.log(pc.dim(`      ${line}`))\n            }\n          })\n        })\n\n        buildProcess.stderr?.on('data', (data) => {\n          const lines = data.toString().split('\\n')\n          lines.forEach((line: string) => {\n            if (line.trim()) {\n              // eslint-disable-next-line no-console\n              console.log(pc.dim(`      ${line}`))\n            }\n          })\n        })\n\n        const exitCode = await new Promise<number>((resolve) => {\n          buildProcess.on('close', resolve)\n        })\n\n        if (exitCode !== 0) {\n          throw new Error(`Build process exited with code ${exitCode}`)\n        }\n\n        p.log.success(pc.green('✓ Build completed'))\n      } catch (error) {\n        p.log.error(pc.red('✗ Build failed'))\n        if (error instanceof Error && options.debug) {\n          log.error(`Build error: ${error.message}`)\n        }\n        process.exit(1)\n      }\n\n      // Verify build output\n      buildInfo = await detectBuild(projectPath)\n      if (!buildInfo) {\n        p.log.error(pc.red('✗ Build completed but standalone build not found'))\n        p.note('Ensure next.config.js has output: \"standalone\"', 'Check Lambda Configuration')\n        process.exit(1)\n      }\n    }\n\n    // ===== DEPLOYMENT PREPARATION =====\n\n    // Create Lambda zip\n    spinner.start('Creating deployment package...')\n    try {\n      await createLambdaZip(projectPath)\n      spinner.stop(pc.green('✓ Deployment package created'))\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to create deployment package'))\n      throw error\n    }\n\n    // Collect static assets\n    spinner.start('Collecting static assets...')\n    const staticAssets = await collectStaticAssets(projectPath)\n    const zipPath = path.join(projectPath, 'lambda.zip')\n    const zipSize = await getFileSize(zipPath)\n    spinner.stop(pc.green(`✓ ${staticAssets.length} static assets detected`))\n\n    log.debug(`Lambda zip size: ${formatBytes(zipSize)}`)\n    log.debug(`Static assets: ${staticAssets.length} files`)\n\n    // ===== DEPLOYMENT CONFIRMATION =====\n\n    if (!options.yes) {\n      p.note(\n        [\n          `${pc.cyan('Build ID:')} ${buildInfo.buildId}`,\n          `${pc.cyan('Date:')} ${formatDate(buildInfo.timestamp)}`,\n          `${pc.cyan('Code size:')} ${formatBytes(zipSize)}`,\n          `${pc.cyan('Static assets:')} ${staticAssets.length} files`,\n        ].join('\\n'),\n        'Details',\n      )\n    }\n\n    // ===== DEPLOYMENT EXECUTION =====\n\n    // Step 1: Create deployment\n    spinner.start('Creating deployment...')\n    let deploymentId: string\n    let codeUploadUrl: string\n    let staticAssetUploadUrls: Record<string, string>\n\n    try {\n      const createResponse = await createDeployment(accessToken, tenantId, {\n        staticAssets,\n      })\n\n      deploymentId = createResponse.deploymentId\n      codeUploadUrl = createResponse.codeUploadUrl\n      staticAssetUploadUrls = createResponse.staticAssetUploadUrls\n\n      log.debug(`Deployment ID: ${deploymentId}`)\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to create deployment'))\n      throw error\n    }\n\n    // Step 2: Upload code\n    spinner.message(`Uploading code (${formatBytes(zipSize)})...`)\n    try {\n      await uploadLambdaZip(zipPath, codeUploadUrl)\n      spinner.stop(pc.green(`✓ Code uploaded (${formatBytes(zipSize)})`))\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to upload code'))\n      throw error\n    }\n\n    // Step 3: Upload static assets\n    if (staticAssets.length > 0) {\n      spinner.start('Uploading static assets...')\n\n      try {\n        const uploadResults = await uploadStaticAssets(\n          projectPath,\n          staticAssetUploadUrls,\n          (uploaded, total) => {\n            spinner.message(`Uploading static assets (${uploaded}/${total})...`)\n          },\n        )\n\n        if (uploadResults.assetsFailed > 0) {\n          spinner.stop(\n            pc.yellow(\n              `⚠ ${uploadResults.assetsUploaded}/${staticAssets.length} assets uploaded (${uploadResults.assetsFailed} failed)`,\n            ),\n          )\n          p.log.warning(\n            `${uploadResults.assetsFailed} assets failed to upload. Deployment may be incomplete.`,\n          )\n        } else {\n          spinner.stop(\n            pc.green(\n              `✓ Static assets uploaded (${uploadResults.assetsUploaded} files, ${formatBytes(uploadResults.totalBytesUploaded)})`,\n            ),\n          )\n        }\n      } catch (error) {\n        spinner.stop(pc.red('✗ Failed to upload assets'))\n        throw error\n      }\n    }\n\n    // Step 4: Perform deployment\n    spinner.start('Performing deployment...')\n    let tenantDomains: string[] = []\n    try {\n      const result = await performDeployment(accessToken, tenantId, {\n        deploymentId,\n      })\n      tenantDomains = result.tenantDomains ?? []\n      spinner.stop(pc.green('✓ Deployment initiated'))\n    } catch (error) {\n      spinner.stop(pc.red('✗ Failed to perform deployment'))\n      throw error\n    }\n\n    // TODO: Add deployment progress tracking\n    // Future: Poll deployment status and show progress\n    // API endpoint: GET /v1/tenant/{tenant_id}/deploy/{deployment_id}/status\n\n    // Success output\n    if (tenantDomains.length > 0) {\n      p.log.step(`URL: ${pc.cyan(`https://${tenantDomains[0]}`)}`)\n    }\n    p.log.step('This usually takes 2-3 minutes to complete.')\n  } catch (error) {\n    spinner.stop(pc.red('✗ Failed'))\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    p.log.error(pc.red(`✗ ${message}`))\n    if (options.debug && error instanceof Error && error.stack) {\n      log.error(`Stack trace: ${error.stack}`)\n    }\n    process.exit(1)\n  }\n}\n"],"names":["p","spawn","path","pc","createDeployment","performDeployment","getValidAccessToken","getTokenStore","collectStaticAssets","createLambdaZip","getFileSize","detectBuild","getBuildCommand","getEnvVar","log","getPackageManager","isInProjectDirectory","uploadLambdaZip","uploadStaticAssets","loginCommand","formatBytes","bytes","k","sizes","i","Math","floor","parseFloat","pow","toFixed","formatDate","date","toLocaleString","day","hour","minute","month","timeZoneName","year","deployCommand","options","projectPath","process","cwd","spinner","tenantId","id","undefined","error","red","exit","note","tokenStore","accessToken","message","buildInfo","skipBuild","start","stop","green","cyan","buildId","timestamp","join","buildCmd","packageManager","buildCommand","step","buildProcess","stdio","stdout","on","data","lines","toString","split","forEach","line","trim","console","dim","stderr","exitCode","Promise","resolve","Error","success","debug","staticAssets","zipPath","zipSize","length","yes","deploymentId","codeUploadUrl","staticAssetUploadUrls","createResponse","uploadResults","uploaded","total","assetsFailed","yellow","assetsUploaded","warning","totalBytesUploaded","tenantDomains","result","stack"],"mappings":"AAAA,YAAYA,OAAO,iBAAgB;AACnC,SAASC,KAAK,QAAQ,gBAAe;AACrC,OAAOC,UAAU,OAAM;AACvB,OAAOC,QAAQ,aAAY;AAE3B,SAASC,gBAAgB,EAAEC,iBAAiB,QAAQ,0BAAyB;AAC7E,SAASC,mBAAmB,QAAQ,wBAAuB;AAC3D,SAASC,aAAa,QAAQ,yBAAwB;AACtD,SAASC,mBAAmB,EAAEC,eAAe,EAAEC,WAAW,QAAQ,+BAA8B;AAChG,SAASC,WAAW,EAAEC,eAAe,QAAQ,8BAA6B;AAC1E,SAASC,SAAS,QAAQ,6BAA4B;AACtD,YAAYC,SAAS,kBAAiB;AACtC,SAASC,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,oBAAoB,QAAQ,sBAAqB;AAC1D,SAASC,eAAe,EAAEC,kBAAkB,QAAQ,wBAAuB;AAC3E,SAASC,YAAY,QAAQ,aAAY;AAgBzC;;CAEC,GACD,SAASC,YAAYC,KAAa;IAChC,IAAIA,UAAU,GAAG;QACf,OAAO;IACT;IACA,MAAMC,IAAI;IACV,MAAMC,QAAQ;QAAC;QAAK;QAAM;QAAM;KAAK;IACrC,MAAMC,IAAIC,KAAKC,KAAK,CAACD,KAAKX,GAAG,CAACO,SAASI,KAAKX,GAAG,CAACQ;IAChD,OAAO,GAAGK,WAAW,AAACN,CAAAA,QAAQI,KAAKG,GAAG,CAACN,GAAGE,EAAC,EAAGK,OAAO,CAAC,IAAI,CAAC,EAAEN,KAAK,CAACC,EAAE,EAAE;AACzE;AAEA;;CAEC,GACD,SAASM,WAAWC,IAAU;IAC5B,OAAOA,KAAKC,cAAc,CAAC,SAAS;QAClCC,KAAK;QACLC,MAAM;QACNC,QAAQ;QACRC,OAAO;QACPC,cAAc;QACdC,MAAM;IACR;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeC,cAAcC,OAA6B;IAC/D,MAAMC,cAAcC,QAAQC,GAAG;IAC/B,MAAMC,UAAU5C,EAAE4C,OAAO;IAEzB,IAAIC,WAAWL,QAAQM,EAAE;IACzB,IAAI,CAACD,UAAU;QACbA,WAAW,AAAC,MAAMhC,UAAU4B,aAAa,sBAAuBM;IAClE;IACA,IAAI,CAACF,UAAU;QACb7C,EAAEc,GAAG,CAACkC,KAAK,CAAC7C,GAAG8C,GAAG,CAAC;QACnBP,QAAQQ,IAAI,CAAC;IACf;IAEA,IAAI;QACF,gCAAgC;QAEhC,gCAAgC;QAChC,IAAI,CAAE,MAAMlC,qBAAqByB,cAAe;YAC9CzC,EAAEc,GAAG,CAACkC,KAAK,CAAC7C,GAAG8C,GAAG,CAAC;YACnBjD,EAAEmD,IAAI,CACJ,oFACA;YAEFT,QAAQQ,IAAI,CAAC;QACf;QAEA,uBAAuB;QACvB,MAAME,aAAa7C;QAEnB,IAAI8C,cAAc,MAAM/C,oBAAoB8C;QAC5C,IAAI,CAACC,aAAa;YAChBrD,EAAEc,GAAG,CAACwC,OAAO,CAAC;YACd,MAAMnC;YACNkC,cAAc,MAAM/C,oBAAoB8C;YACxC,IAAI,CAACC,aAAa;gBAChBrD,EAAEc,GAAG,CAACkC,KAAK,CAAC7C,GAAG8C,GAAG,CAAC;gBACnBP,QAAQQ,IAAI,CAAC;YACf;QACF;QAEA,oBAAoB;QAEpB,IAAIK;QAEJ,IAAIf,QAAQgB,SAAS,EAAE;YACrB,wCAAwC;YACxCZ,QAAQa,KAAK,CAAC;YACdF,YAAY,MAAM5C,YAAY8B;YAE9B,IAAI,CAACc,WAAW;gBACdX,QAAQc,IAAI,CAACvD,GAAG8C,GAAG,CAAC;gBACpBjD,EAAEc,GAAG,CAACkC,KAAK,CAAC;gBACZN,QAAQQ,IAAI,CAAC;YACf;YAEAN,QAAQc,IAAI,CAACvD,GAAGwD,KAAK,CAAC;YACtB3D,EAAEmD,IAAI,CACJ;gBACE,GAAGhD,GAAGyD,IAAI,CAAC,aAAa,CAAC,EAAEL,UAAUM,OAAO,EAAE;gBAC9C,GAAG1D,GAAGyD,IAAI,CAAC,SAAS,CAAC,EAAE9B,WAAWyB,UAAUO,SAAS,GAAG;aACzD,CAACC,IAAI,CAAC,OACP;QAEJ,OAAO;YACL,2BAA2B;YAC3B,MAAMC,WAAW,MAAMpD,gBAAgB6B;YAEvC,IAAI,CAACuB,UAAU;gBACbhE,EAAEc,GAAG,CAACkC,KAAK,CAAC;gBACZhD,EAAEmD,IAAI,CAAC,6DAA6D;gBACpET,QAAQQ,IAAI,CAAC;YACf;YAEA,MAAMe,iBAAiB,MAAMlD,kBAAkB0B;YAC/C,MAAMyB,eAAe,GAAGD,eAAe,UAAU,CAAC;YAClDjE,EAAEc,GAAG,CAACqD,IAAI,CAAC,CAAC,QAAQ,EAAED,aAAa,KAAK,CAAC;YAEzC,IAAI;gBACF,8CAA8C;gBAC9C,MAAME,eAAenE,MAAMgE,gBAAgB;oBAAC;oBAAO;iBAAQ,EAAE;oBAC3DtB,KAAKF;oBACL4B,OAAO;wBAAC;wBAAU;wBAAQ;qBAAO;gBACnC;gBAEA,wBAAwB;gBACxBD,aAAaE,MAAM,EAAEC,GAAG,QAAQ,CAACC;oBAC/B,MAAMC,QAAQD,KAAKE,QAAQ,GAAGC,KAAK,CAAC;oBACpCF,MAAMG,OAAO,CAAC,CAACC;wBACb,IAAIA,KAAKC,IAAI,IAAI;4BACf,sCAAsC;4BACtCC,QAAQjE,GAAG,CAACX,GAAG6E,GAAG,CAAC,CAAC,MAAM,EAAEH,MAAM;wBACpC;oBACF;gBACF;gBAEAT,aAAaa,MAAM,EAAEV,GAAG,QAAQ,CAACC;oBAC/B,MAAMC,QAAQD,KAAKE,QAAQ,GAAGC,KAAK,CAAC;oBACpCF,MAAMG,OAAO,CAAC,CAACC;wBACb,IAAIA,KAAKC,IAAI,IAAI;4BACf,sCAAsC;4BACtCC,QAAQjE,GAAG,CAACX,GAAG6E,GAAG,CAAC,CAAC,MAAM,EAAEH,MAAM;wBACpC;oBACF;gBACF;gBAEA,MAAMK,WAAW,MAAM,IAAIC,QAAgB,CAACC;oBAC1ChB,aAAaG,EAAE,CAAC,SAASa;gBAC3B;gBAEA,IAAIF,aAAa,GAAG;oBAClB,MAAM,IAAIG,MAAM,CAAC,+BAA+B,EAAEH,UAAU;gBAC9D;gBAEAlF,EAAEc,GAAG,CAACwE,OAAO,CAACnF,GAAGwD,KAAK,CAAC;YACzB,EAAE,OAAOX,OAAO;gBACdhD,EAAEc,GAAG,CAACkC,KAAK,CAAC7C,GAAG8C,GAAG,CAAC;gBACnB,IAAID,iBAAiBqC,SAAS7C,QAAQ+C,KAAK,EAAE;oBAC3CzE,IAAIkC,KAAK,CAAC,CAAC,aAAa,EAAEA,MAAMM,OAAO,EAAE;gBAC3C;gBACAZ,QAAQQ,IAAI,CAAC;YACf;YAEA,sBAAsB;YACtBK,YAAY,MAAM5C,YAAY8B;YAC9B,IAAI,CAACc,WAAW;gBACdvD,EAAEc,GAAG,CAACkC,KAAK,CAAC7C,GAAG8C,GAAG,CAAC;gBACnBjD,EAAEmD,IAAI,CAAC,kDAAkD;gBACzDT,QAAQQ,IAAI,CAAC;YACf;QACF;QAEA,qCAAqC;QAErC,oBAAoB;QACpBN,QAAQa,KAAK,CAAC;QACd,IAAI;YACF,MAAMhD,gBAAgBgC;YACtBG,QAAQc,IAAI,CAACvD,GAAGwD,KAAK,CAAC;QACxB,EAAE,OAAOX,OAAO;YACdJ,QAAQc,IAAI,CAACvD,GAAG8C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,wBAAwB;QACxBJ,QAAQa,KAAK,CAAC;QACd,MAAM+B,eAAe,MAAMhF,oBAAoBiC;QAC/C,MAAMgD,UAAUvF,KAAK6D,IAAI,CAACtB,aAAa;QACvC,MAAMiD,UAAU,MAAMhF,YAAY+E;QAClC7C,QAAQc,IAAI,CAACvD,GAAGwD,KAAK,CAAC,CAAC,EAAE,EAAE6B,aAAaG,MAAM,CAAC,uBAAuB,CAAC;QAEvE7E,IAAIyE,KAAK,CAAC,CAAC,iBAAiB,EAAEnE,YAAYsE,UAAU;QACpD5E,IAAIyE,KAAK,CAAC,CAAC,eAAe,EAAEC,aAAaG,MAAM,CAAC,MAAM,CAAC;QAEvD,sCAAsC;QAEtC,IAAI,CAACnD,QAAQoD,GAAG,EAAE;YAChB5F,EAAEmD,IAAI,CACJ;gBACE,GAAGhD,GAAGyD,IAAI,CAAC,aAAa,CAAC,EAAEL,UAAUM,OAAO,EAAE;gBAC9C,GAAG1D,GAAGyD,IAAI,CAAC,SAAS,CAAC,EAAE9B,WAAWyB,UAAUO,SAAS,GAAG;gBACxD,GAAG3D,GAAGyD,IAAI,CAAC,cAAc,CAAC,EAAExC,YAAYsE,UAAU;gBAClD,GAAGvF,GAAGyD,IAAI,CAAC,kBAAkB,CAAC,EAAE4B,aAAaG,MAAM,CAAC,MAAM,CAAC;aAC5D,CAAC5B,IAAI,CAAC,OACP;QAEJ;QAEA,mCAAmC;QAEnC,4BAA4B;QAC5BnB,QAAQa,KAAK,CAAC;QACd,IAAIoC;QACJ,IAAIC;QACJ,IAAIC;QAEJ,IAAI;YACF,MAAMC,iBAAiB,MAAM5F,iBAAiBiD,aAAaR,UAAU;gBACnE2C;YACF;YAEAK,eAAeG,eAAeH,YAAY;YAC1CC,gBAAgBE,eAAeF,aAAa;YAC5CC,wBAAwBC,eAAeD,qBAAqB;YAE5DjF,IAAIyE,KAAK,CAAC,CAAC,eAAe,EAAEM,cAAc;QAC5C,EAAE,OAAO7C,OAAO;YACdJ,QAAQc,IAAI,CAACvD,GAAG8C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,sBAAsB;QACtBJ,QAAQU,OAAO,CAAC,CAAC,gBAAgB,EAAElC,YAAYsE,SAAS,IAAI,CAAC;QAC7D,IAAI;YACF,MAAMzE,gBAAgBwE,SAASK;YAC/BlD,QAAQc,IAAI,CAACvD,GAAGwD,KAAK,CAAC,CAAC,iBAAiB,EAAEvC,YAAYsE,SAAS,CAAC,CAAC;QACnE,EAAE,OAAO1C,OAAO;YACdJ,QAAQc,IAAI,CAACvD,GAAG8C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,+BAA+B;QAC/B,IAAIwC,aAAaG,MAAM,GAAG,GAAG;YAC3B/C,QAAQa,KAAK,CAAC;YAEd,IAAI;gBACF,MAAMwC,gBAAgB,MAAM/E,mBAC1BuB,aACAsD,uBACA,CAACG,UAAUC;oBACTvD,QAAQU,OAAO,CAAC,CAAC,yBAAyB,EAAE4C,SAAS,CAAC,EAAEC,MAAM,IAAI,CAAC;gBACrE;gBAGF,IAAIF,cAAcG,YAAY,GAAG,GAAG;oBAClCxD,QAAQc,IAAI,CACVvD,GAAGkG,MAAM,CACP,CAAC,EAAE,EAAEJ,cAAcK,cAAc,CAAC,CAAC,EAAEd,aAAaG,MAAM,CAAC,kBAAkB,EAAEM,cAAcG,YAAY,CAAC,QAAQ,CAAC;oBAGrHpG,EAAEc,GAAG,CAACyF,OAAO,CACX,GAAGN,cAAcG,YAAY,CAAC,uDAAuD,CAAC;gBAE1F,OAAO;oBACLxD,QAAQc,IAAI,CACVvD,GAAGwD,KAAK,CACN,CAAC,0BAA0B,EAAEsC,cAAcK,cAAc,CAAC,QAAQ,EAAElF,YAAY6E,cAAcO,kBAAkB,EAAE,CAAC,CAAC;gBAG1H;YACF,EAAE,OAAOxD,OAAO;gBACdJ,QAAQc,IAAI,CAACvD,GAAG8C,GAAG,CAAC;gBACpB,MAAMD;YACR;QACF;QAEA,6BAA6B;QAC7BJ,QAAQa,KAAK,CAAC;QACd,IAAIgD,gBAA0B,EAAE;QAChC,IAAI;YACF,MAAMC,SAAS,MAAMrG,kBAAkBgD,aAAaR,UAAU;gBAC5DgD;YACF;YACAY,gBAAgBC,OAAOD,aAAa,IAAI,EAAE;YAC1C7D,QAAQc,IAAI,CAACvD,GAAGwD,KAAK,CAAC;QACxB,EAAE,OAAOX,OAAO;YACdJ,QAAQc,IAAI,CAACvD,GAAG8C,GAAG,CAAC;YACpB,MAAMD;QACR;QAEA,yCAAyC;QACzC,mDAAmD;QACnD,yEAAyE;QAEzE,iBAAiB;QACjB,IAAIyD,cAAcd,MAAM,GAAG,GAAG;YAC5B3F,EAAEc,GAAG,CAACqD,IAAI,CAAC,CAAC,KAAK,EAAEhE,GAAGyD,IAAI,CAAC,CAAC,QAAQ,EAAE6C,aAAa,CAAC,EAAE,EAAE,GAAG;QAC7D;QACAzG,EAAEc,GAAG,CAACqD,IAAI,CAAC;IACb,EAAE,OAAOnB,OAAO;QACdJ,QAAQc,IAAI,CAACvD,GAAG8C,GAAG,CAAC;QACpB,MAAMK,UAAUN,iBAAiBqC,QAAQrC,MAAMM,OAAO,GAAG;QACzDtD,EAAEc,GAAG,CAACkC,KAAK,CAAC7C,GAAG8C,GAAG,CAAC,CAAC,EAAE,EAAEK,SAAS;QACjC,IAAId,QAAQ+C,KAAK,IAAIvC,iBAAiBqC,SAASrC,MAAM2D,KAAK,EAAE;YAC1D7F,IAAIkC,KAAK,CAAC,CAAC,aAAa,EAAEA,MAAM2D,KAAK,EAAE;QACzC;QACAjE,QAAQQ,IAAI,CAAC;IACf;AACF"}

package/dist/config/oauth.d.ts

@@ -1,4 +1,9 @@
 import type { OAuthConfig } from '../auth/types.js';
+/**
+ * Default port for OAuth callback server
+ * Using a high port (34462) to avoid conflicts with common dev servers (3000, 8080, etc.)
+ */
+export declare const DEFAULT_CALLBACK_PORT = 34462;
 export declare const URLS: Record<'prod' | 'staging', Pick<OAuthConfig, 'authorizationUrl' | 'refreshUrl' | 'tokenUrl'>>;
 /**
  * Figma OAuth2 configuration for public CLI client

package/dist/config/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/config/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAInD,eAAO,MAAM,IAAI,EAAE,MAAM,CACvB,MAAM,GAAG,SAAS,EAClB,IAAI,CAAC,WAAW,EAAE,kBAAkB,GAAG,YAAY,GAAG,UAAU,CAAC,CAkBlE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,EAAE,WAe1B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAA"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/config/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAInD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAQ,CAAA;AAE1C,eAAO,MAAM,IAAI,EAAE,MAAM,CACvB,MAAM,GAAG,SAAS,EAClB,IAAI,CAAC,WAAW,EAAE,kBAAkB,GAAG,YAAY,GAAG,UAAU,CAAC,CAkBlE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,EAAE,WAgB1B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAA"}

package/dist/config/oauth.js

@@ -1,4 +1,8 @@
 import { FIGMA_CLIENT_IDS } from '../constants.js';
+/**
+ * Default port for OAuth callback server
+ * Using a high port (34462) to avoid conflicts with common dev servers (3000, 8080, etc.)
+ */ export const DEFAULT_CALLBACK_PORT = 34462;
 export const URLS = {
     prod: {
         authorizationUrl: 'https://www.figma.com/oauth',
@@ -27,7 +31,7 @@ export const URLS = {
     clientId: process.env.FIGMA_CLIENT_ID || FIGMA_CLIENT_IDS.staging,
     // No client secret - this is a public OAuth client using PKCE
     // Public clients cannot securely store secrets in CLI environments
-    redirectUri: process.env.FIGMA_REDIRECT_URI || 'http://localhost:3000/callback',
+    redirectUri: process.env.FIGMA_REDIRECT_URI || `http://localhost:${DEFAULT_CALLBACK_PORT}/callback`,
     // Only current_user:read scope is needed for basic user info
     scopes: [
         'current_user:read'

package/dist/config/oauth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/config/oauth.ts"],"sourcesContent":["import type { OAuthConfig } from '../auth/types.js'\n\nimport { FIGMA_CLIENT_IDS } from '../constants.js'\n\nexport const URLS: Record<\n  'prod' | 'staging',\n  Pick<OAuthConfig, 'authorizationUrl' | 'refreshUrl' | 'tokenUrl'>\n> = {\n  prod: {\n    authorizationUrl: 'https://www.figma.com/oauth',\n    refreshUrl: 'https://api.figma.com/v1/oauth/refresh',\n    tokenUrl: 'https://api.figma.com/v1/oauth/token',\n  },\n  staging: {\n    authorizationUrl: process.env.FIGMA_AUTH_URL\n      ? `${process.env.FIGMA_AUTH_URL}/oauth` // TODO: Might need to add /cms here based on recent changes\n      : 'https://staging.figma.com/oauth',\n    refreshUrl: process.env.FIGMA_API_URL\n      ? `${process.env.FIGMA_API_URL}/v1/oauth/refresh`\n      : 'https://api.staging.figma.com/v1/oauth/refresh',\n    tokenUrl: process.env.FIGMA_API_URL\n      ? `${process.env.FIGMA_API_URL}/v1/oauth/token`\n      : 'https://api.staging.figma.com/v1/oauth/token',\n  },\n}\n\n/**\n * Figma OAuth2 configuration for public CLI client\n *\n * This is a PUBLIC OAuth client using PKCE (Proof Key for Code Exchange).\n * No client secret is used because CLIs cannot securely store secrets.\n * PKCE provides security through the code_verifier/code_challenge mechanism.\n *\n * For production use, register a public OAuth app with Figma.\n * To register an OAuth app, visit: https://www.figma.com/developers/api#oauth2\n */\nexport const OAUTH_CONFIG: OAuthConfig = {\n  // OAuth client ID (public client)\n  // Uses staging client ID by default since we use staging endpoints\n  clientId: process.env.FIGMA_CLIENT_ID || FIGMA_CLIENT_IDS.staging,\n\n  // No client secret - this is a public OAuth client using PKCE\n  // Public clients cannot securely store secrets in CLI environments\n\n  redirectUri: process.env.FIGMA_REDIRECT_URI || 'http://localhost:3000/callback',\n\n  // Only current_user:read scope is needed for basic user info\n  scopes: ['current_user:read'],\n\n  // TODO: Dynamically choose between prod and staging based on environment\n  ...URLS.staging,\n}\n\n/**\n * Buffer time (in seconds) before token expiration to consider token as expired\n * This helps avoid using tokens that are about to expire\n */\nexport const TOKEN_EXPIRY_BUFFER_SECONDS = 300 // 5 minutes\n"],"names":["FIGMA_CLIENT_IDS","URLS","prod","authorizationUrl","refreshUrl","tokenUrl","staging","process","env","FIGMA_AUTH_URL","FIGMA_API_URL","OAUTH_CONFIG","clientId","FIGMA_CLIENT_ID","redirectUri","FIGMA_REDIRECT_URI","scopes","TOKEN_EXPIRY_BUFFER_SECONDS"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,kBAAiB;AAElD,OAAO,MAAMC,OAGT;IACFC,MAAM;QACJC,kBAAkB;QAClBC,YAAY;QACZC,UAAU;IACZ;IACAC,SAAS;QACPH,kBAAkBI,QAAQC,GAAG,CAACC,cAAc,GACxC,GAAGF,QAAQC,GAAG,CAACC,cAAc,CAAC,MAAM,CAAC,CAAC,4DAA4D;WAClG;QACJL,YAAYG,QAAQC,GAAG,CAACE,aAAa,GACjC,GAAGH,QAAQC,GAAG,CAACE,aAAa,CAAC,iBAAiB,CAAC,GAC/C;QACJL,UAAUE,QAAQC,GAAG,CAACE,aAAa,GAC/B,GAAGH,QAAQC,GAAG,CAACE,aAAa,CAAC,eAAe,CAAC,GAC7C;IACN;AACF,EAAC;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,eAA4B;IACvC,kCAAkC;IAClC,mEAAmE;IACnEC,UAAUL,QAAQC,GAAG,CAACK,eAAe,IAAIb,iBAAiBM,OAAO;IAEjE,8DAA8D;IAC9D,mEAAmE;IAEnEQ,aAAaP,QAAQC,GAAG,CAACO,kBAAkB,IAAI;IAE/C,6DAA6D;IAC7DC,QAAQ;QAAC;KAAoB;IAE7B,yEAAyE;IACzE,GAAGf,KAAKK,OAAO;AACjB,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMW,8BAA8B,IAAI,YAAY;CAAb"}
+{"version":3,"sources":["../../src/config/oauth.ts"],"sourcesContent":["import type { OAuthConfig } from '../auth/types.js'\n\nimport { FIGMA_CLIENT_IDS } from '../constants.js'\n\n/**\n * Default port for OAuth callback server\n * Using a high port (34462) to avoid conflicts with common dev servers (3000, 8080, etc.)\n */\nexport const DEFAULT_CALLBACK_PORT = 34462\n\nexport const URLS: Record<\n  'prod' | 'staging',\n  Pick<OAuthConfig, 'authorizationUrl' | 'refreshUrl' | 'tokenUrl'>\n> = {\n  prod: {\n    authorizationUrl: 'https://www.figma.com/oauth',\n    refreshUrl: 'https://api.figma.com/v1/oauth/refresh',\n    tokenUrl: 'https://api.figma.com/v1/oauth/token',\n  },\n  staging: {\n    authorizationUrl: process.env.FIGMA_AUTH_URL\n      ? `${process.env.FIGMA_AUTH_URL}/oauth` // TODO: Might need to add /cms here based on recent changes\n      : 'https://staging.figma.com/oauth',\n    refreshUrl: process.env.FIGMA_API_URL\n      ? `${process.env.FIGMA_API_URL}/v1/oauth/refresh`\n      : 'https://api.staging.figma.com/v1/oauth/refresh',\n    tokenUrl: process.env.FIGMA_API_URL\n      ? `${process.env.FIGMA_API_URL}/v1/oauth/token`\n      : 'https://api.staging.figma.com/v1/oauth/token',\n  },\n}\n\n/**\n * Figma OAuth2 configuration for public CLI client\n *\n * This is a PUBLIC OAuth client using PKCE (Proof Key for Code Exchange).\n * No client secret is used because CLIs cannot securely store secrets.\n * PKCE provides security through the code_verifier/code_challenge mechanism.\n *\n * For production use, register a public OAuth app with Figma.\n * To register an OAuth app, visit: https://www.figma.com/developers/api#oauth2\n */\nexport const OAUTH_CONFIG: OAuthConfig = {\n  // OAuth client ID (public client)\n  // Uses staging client ID by default since we use staging endpoints\n  clientId: process.env.FIGMA_CLIENT_ID || FIGMA_CLIENT_IDS.staging,\n\n  // No client secret - this is a public OAuth client using PKCE\n  // Public clients cannot securely store secrets in CLI environments\n\n  redirectUri:\n    process.env.FIGMA_REDIRECT_URI || `http://localhost:${DEFAULT_CALLBACK_PORT}/callback`,\n\n  // Only current_user:read scope is needed for basic user info\n  scopes: ['current_user:read'],\n\n  // TODO: Dynamically choose between prod and staging based on environment\n  ...URLS.staging,\n}\n\n/**\n * Buffer time (in seconds) before token expiration to consider token as expired\n * This helps avoid using tokens that are about to expire\n */\nexport const TOKEN_EXPIRY_BUFFER_SECONDS = 300 // 5 minutes\n"],"names":["FIGMA_CLIENT_IDS","DEFAULT_CALLBACK_PORT","URLS","prod","authorizationUrl","refreshUrl","tokenUrl","staging","process","env","FIGMA_AUTH_URL","FIGMA_API_URL","OAUTH_CONFIG","clientId","FIGMA_CLIENT_ID","redirectUri","FIGMA_REDIRECT_URI","scopes","TOKEN_EXPIRY_BUFFER_SECONDS"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,kBAAiB;AAElD;;;CAGC,GACD,OAAO,MAAMC,wBAAwB,MAAK;AAE1C,OAAO,MAAMC,OAGT;IACFC,MAAM;QACJC,kBAAkB;QAClBC,YAAY;QACZC,UAAU;IACZ;IACAC,SAAS;QACPH,kBAAkBI,QAAQC,GAAG,CAACC,cAAc,GACxC,GAAGF,QAAQC,GAAG,CAACC,cAAc,CAAC,MAAM,CAAC,CAAC,4DAA4D;WAClG;QACJL,YAAYG,QAAQC,GAAG,CAACE,aAAa,GACjC,GAAGH,QAAQC,GAAG,CAACE,aAAa,CAAC,iBAAiB,CAAC,GAC/C;QACJL,UAAUE,QAAQC,GAAG,CAACE,aAAa,GAC/B,GAAGH,QAAQC,GAAG,CAACE,aAAa,CAAC,eAAe,CAAC,GAC7C;IACN;AACF,EAAC;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,eAA4B;IACvC,kCAAkC;IAClC,mEAAmE;IACnEC,UAAUL,QAAQC,GAAG,CAACK,eAAe,IAAId,iBAAiBO,OAAO;IAEjE,8DAA8D;IAC9D,mEAAmE;IAEnEQ,aACEP,QAAQC,GAAG,CAACO,kBAAkB,IAAI,CAAC,iBAAiB,EAAEf,sBAAsB,SAAS,CAAC;IAExF,6DAA6D;IAC7DgB,QAAQ;QAAC;KAAoB;IAE7B,yEAAyE;IACzE,GAAGf,KAAKK,OAAO;AACjB,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMW,8BAA8B,IAAI,YAAY;CAAb"}

package/dist/oauth/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/oauth/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAQ,MAAM,SAAS,CAAA;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAIhD,eAAO,MAAM,YAAY,UAAiC,CAAA;AAE1D,eAAO,MAAM,oBAAoB,EAAE,SAQlC,CAAA;AAED,eAAO,MAAM,aAAa,iDAKrB;IACD,UAAU,EAAE,gBAAgB,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,UAAU,GAAG,SAAS,CAAA;CACtC,KAAG,cAiFH,CAAA"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/oauth/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAQ,MAAM,SAAS,CAAA;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAKhD,eAAO,MAAM,YAAY,UAAiC,CAAA;AAE1D,eAAO,MAAM,oBAAoB,EAAE,SAQlC,CAAA;AAED,eAAO,MAAM,aAAa,iDAKrB;IACD,UAAU,EAAE,gBAAgB,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,UAAU,GAAG,SAAS,CAAA;CACtC,KAAG,cAuGH,CAAA"}

package/dist/oauth/defaults.js

@@ -1,5 +1,6 @@
 import { v4 as uuid } from 'uuid';
 import { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js';
+import { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js';
 export const defaultScope = [
     'openid',
     'profile',
@@ -60,11 +61,34 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
                 if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {
                     newUser.password = uuid();
                 }
-                user = await payload.create({
-                    collection: collection.slug,
-                    data: newUser,
-                    depth
-                });
+                try {
+                    user = await payload.create({
+                        collection: collection.slug,
+                        data: newUser,
+                        depth,
+                        overrideAccess: true
+                    });
+                } catch (createErr) {
+                    // Race condition: if unique constraint violation, user was created by concurrent request
+                    if (isDuplicateKeyError(createErr)) {
+                        const retryResults = await payload.find({
+                            collection: collection.slug,
+                            depth,
+                            limit: 1,
+                            pagination: false,
+                            where: {
+                                [usernameField.name]: {
+                                    equals: token[tokenUsername]
+                                }
+                            }
+                        });
+                        if (retryResults.docs.length > 0) {
+                            user = retryResults.docs[0];
+                        }
+                    } else {
+                        throw createErr;
+                    }
+                }
             }
         } catch (err) {
             payload.logger.error({

package/dist/oauth/defaults.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth/defaults.ts"],"sourcesContent":["import type { CollectionConfig, EmailField, TextField, User } from 'payload'\n\nimport { v4 as uuid } from 'uuid'\n\nimport type { VerifyFunction } from './types.js'\n\nimport { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js'\n\nexport const defaultScope = ['openid', 'profile', 'email']\n\nexport const defaultUsernameField: TextField = {\n  name: 'preferredUsername',\n  type: 'text',\n  admin: {\n    position: 'sidebar',\n    readOnly: true,\n  },\n  unique: true,\n}\n\nexport const defaultVerify =\n  ({\n    collection,\n    strategyName,\n    usernameField,\n  }: {\n    collection: CollectionConfig\n    strategyName: string\n    usernameField: EmailField | TextField\n  }): VerifyFunction =>\n  async ({ payload, token }) => {\n    let tokenUsername = 'preferred_username'\n\n    if (usernameField.name !== 'preferredUsername') {\n      tokenUsername = usernameField.name\n    }\n\n    if (!token[tokenUsername]) {\n      return {\n        user: null,\n      }\n    }\n\n    let user: null | User = null\n    const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined\n\n    try {\n      const results = await payload.find({\n        collection: collection.slug,\n        depth,\n        limit: 1,\n        pagination: false,\n        where: {\n          [usernameField.name]: { equals: token[tokenUsername] },\n        },\n      })\n\n      if (results.docs.length > 0) {\n        user = results.docs[0] as User\n        // Update user with new token data\n        if (hasUserTokenPropsChanged(user, token)) {\n          user = (await payload.update({\n            id: user.id,\n            collection: collection.slug,\n            data: {\n              ...token,\n            },\n            depth,\n          })) as User\n        }\n      } else {\n        const newUser = {\n          email: token.preferredUsername || token.email,\n          [usernameField.name]: token[tokenUsername],\n          ...token,\n        }\n\n        if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {\n          newUser.password = uuid()\n        }\n\n        user = (await payload.create({\n          collection: collection.slug,\n          data: newUser,\n          depth,\n        })) as User\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying user from defaultVerify.',\n      })\n      return {\n        user: null,\n      }\n    }\n\n    if (user) {\n      user.collection = collection.slug\n      user._strategy = strategyName\n      user.exp = token.exp\n\n      return {\n        user,\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n"],"names":["v4","uuid","hasUserTokenPropsChanged","defaultScope","defaultUsernameField","name","type","admin","position","readOnly","unique","defaultVerify","collection","strategyName","usernameField","payload","token","tokenUsername","user","depth","auth","undefined","results","find","slug","limit","pagination","where","equals","docs","length","update","id","data","newUser","email","preferredUsername","disableLocalStrategy","password","create","err","logger","error","msg","_strategy","exp"],"mappings":"AAEA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAIjC,SAASC,wBAAwB,QAAQ,0CAAyC;AAElF,OAAO,MAAMC,eAAe;IAAC;IAAU;IAAW;CAAQ,CAAA;AAE1D,OAAO,MAAMC,uBAAkC;IAC7CC,MAAM;IACNC,MAAM;IACNC,OAAO;QACLC,UAAU;QACVC,UAAU;IACZ;IACAC,QAAQ;AACV,EAAC;AAED,OAAO,MAAMC,gBACX,CAAC,EACCC,UAAU,EACVC,YAAY,EACZC,aAAa,EAKd,GACD,OAAO,EAAEC,OAAO,EAAEC,KAAK,EAAE;QACvB,IAAIC,gBAAgB;QAEpB,IAAIH,cAAcT,IAAI,KAAK,qBAAqB;YAC9CY,gBAAgBH,cAAcT,IAAI;QACpC;QAEA,IAAI,CAACW,KAAK,CAACC,cAAc,EAAE;YACzB,OAAO;gBACLC,MAAM;YACR;QACF;QAEA,IAAIA,OAAoB;QACxB,MAAMC,QAAQ,OAAOP,WAAWQ,IAAI,KAAK,WAAWR,WAAWQ,IAAI,CAACD,KAAK,GAAGE;QAE5E,IAAI;YACF,MAAMC,UAAU,MAAMP,QAAQQ,IAAI,CAAC;gBACjCX,YAAYA,WAAWY,IAAI;gBAC3BL;gBACAM,OAAO;gBACPC,YAAY;gBACZC,OAAO;oBACL,CAACb,cAAcT,IAAI,CAAC,EAAE;wBAAEuB,QAAQZ,KAAK,CAACC,cAAc;oBAAC;gBACvD;YACF;YAEA,IAAIK,QAAQO,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC3BZ,OAAOI,QAAQO,IAAI,CAAC,EAAE;gBACtB,kCAAkC;gBAClC,IAAI3B,yBAAyBgB,MAAMF,QAAQ;oBACzCE,OAAQ,MAAMH,QAAQgB,MAAM,CAAC;wBAC3BC,IAAId,KAAKc,EAAE;wBACXpB,YAAYA,WAAWY,IAAI;wBAC3BS,MAAM;4BACJ,GAAGjB,KAAK;wBACV;wBACAG;oBACF;gBACF;YACF,OAAO;gBACL,MAAMe,UAAU;oBACdC,OAAOnB,MAAMoB,iBAAiB,IAAIpB,MAAMmB,KAAK;oBAC7C,CAACrB,cAAcT,IAAI,CAAC,EAAEW,KAAK,CAACC,cAAc;oBAC1C,GAAGD,KAAK;gBACV;gBAEA,IAAI,OAAOJ,WAAWQ,IAAI,KAAK,YAAY,CAACR,WAAWQ,IAAI,CAACiB,oBAAoB,EAAE;oBAChFH,QAAQI,QAAQ,GAAGrC;gBACrB;gBAEAiB,OAAQ,MAAMH,QAAQwB,MAAM,CAAC;oBAC3B3B,YAAYA,WAAWY,IAAI;oBAC3BS,MAAMC;oBACNf;gBACF;YACF;QACF,EAAE,OAAOqB,KAAc;YACrBzB,QAAQ0B,MAAM,CAACC,KAAK,CAAC;gBACnBF;gBACAG,KAAK;YACP;YACA,OAAO;gBACLzB,MAAM;YACR;QACF;QAEA,IAAIA,MAAM;YACRA,KAAKN,UAAU,GAAGA,WAAWY,IAAI;YACjCN,KAAK0B,SAAS,GAAG/B;YACjBK,KAAK2B,GAAG,GAAG7B,MAAM6B,GAAG;YAEpB,OAAO;gBACL3B;YACF;QACF;QAEA,OAAO;YACLA,MAAM;QACR;IACF,EAAC"}
+{"version":3,"sources":["../../src/oauth/defaults.ts"],"sourcesContent":["import type { CollectionConfig, EmailField, TextField, User } from 'payload'\n\nimport { v4 as uuid } from 'uuid'\n\nimport type { VerifyFunction } from './types.js'\n\nimport { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js'\nimport { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js'\n\nexport const defaultScope = ['openid', 'profile', 'email']\n\nexport const defaultUsernameField: TextField = {\n  name: 'preferredUsername',\n  type: 'text',\n  admin: {\n    position: 'sidebar',\n    readOnly: true,\n  },\n  unique: true,\n}\n\nexport const defaultVerify =\n  ({\n    collection,\n    strategyName,\n    usernameField,\n  }: {\n    collection: CollectionConfig\n    strategyName: string\n    usernameField: EmailField | TextField\n  }): VerifyFunction =>\n  async ({ payload, token }) => {\n    let tokenUsername = 'preferred_username'\n\n    if (usernameField.name !== 'preferredUsername') {\n      tokenUsername = usernameField.name\n    }\n\n    if (!token[tokenUsername]) {\n      return {\n        user: null,\n      }\n    }\n\n    let user: null | User = null\n    const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined\n\n    try {\n      const results = await payload.find({\n        collection: collection.slug,\n        depth,\n        limit: 1,\n        pagination: false,\n        where: {\n          [usernameField.name]: { equals: token[tokenUsername] },\n        },\n      })\n\n      if (results.docs.length > 0) {\n        user = results.docs[0] as User\n        // Update user with new token data\n        if (hasUserTokenPropsChanged(user, token)) {\n          user = (await payload.update({\n            id: user.id,\n            collection: collection.slug,\n            data: {\n              ...token,\n            },\n            depth,\n          })) as User\n        }\n      } else {\n        const newUser = {\n          email: token.preferredUsername || token.email,\n          [usernameField.name]: token[tokenUsername],\n          ...token,\n        }\n\n        if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {\n          newUser.password = uuid()\n        }\n\n        try {\n          user = (await payload.create({\n            collection: collection.slug,\n            data: newUser,\n            depth,\n            overrideAccess: true,\n          })) as User\n        } catch (createErr: unknown) {\n          // Race condition: if unique constraint violation, user was created by concurrent request\n          if (isDuplicateKeyError(createErr)) {\n            const retryResults = await payload.find({\n              collection: collection.slug,\n              depth,\n              limit: 1,\n              pagination: false,\n              where: {\n                [usernameField.name]: { equals: token[tokenUsername] },\n              },\n            })\n\n            if (retryResults.docs.length > 0) {\n              user = retryResults.docs[0] as User\n            }\n          } else {\n            throw createErr\n          }\n        }\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying user from defaultVerify.',\n      })\n      return {\n        user: null,\n      }\n    }\n\n    if (user) {\n      user.collection = collection.slug\n      user._strategy = strategyName\n      user.exp = token.exp\n\n      return {\n        user,\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n"],"names":["v4","uuid","hasUserTokenPropsChanged","isDuplicateKeyError","defaultScope","defaultUsernameField","name","type","admin","position","readOnly","unique","defaultVerify","collection","strategyName","usernameField","payload","token","tokenUsername","user","depth","auth","undefined","results","find","slug","limit","pagination","where","equals","docs","length","update","id","data","newUser","email","preferredUsername","disableLocalStrategy","password","create","overrideAccess","createErr","retryResults","err","logger","error","msg","_strategy","exp"],"mappings":"AAEA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAIjC,SAASC,wBAAwB,QAAQ,0CAAyC;AAClF,SAASC,mBAAmB,QAAQ,qCAAoC;AAExE,OAAO,MAAMC,eAAe;IAAC;IAAU;IAAW;CAAQ,CAAA;AAE1D,OAAO,MAAMC,uBAAkC;IAC7CC,MAAM;IACNC,MAAM;IACNC,OAAO;QACLC,UAAU;QACVC,UAAU;IACZ;IACAC,QAAQ;AACV,EAAC;AAED,OAAO,MAAMC,gBACX,CAAC,EACCC,UAAU,EACVC,YAAY,EACZC,aAAa,EAKd,GACD,OAAO,EAAEC,OAAO,EAAEC,KAAK,EAAE;QACvB,IAAIC,gBAAgB;QAEpB,IAAIH,cAAcT,IAAI,KAAK,qBAAqB;YAC9CY,gBAAgBH,cAAcT,IAAI;QACpC;QAEA,IAAI,CAACW,KAAK,CAACC,cAAc,EAAE;YACzB,OAAO;gBACLC,MAAM;YACR;QACF;QAEA,IAAIA,OAAoB;QACxB,MAAMC,QAAQ,OAAOP,WAAWQ,IAAI,KAAK,WAAWR,WAAWQ,IAAI,CAACD,KAAK,GAAGE;QAE5E,IAAI;YACF,MAAMC,UAAU,MAAMP,QAAQQ,IAAI,CAAC;gBACjCX,YAAYA,WAAWY,IAAI;gBAC3BL;gBACAM,OAAO;gBACPC,YAAY;gBACZC,OAAO;oBACL,CAACb,cAAcT,IAAI,CAAC,EAAE;wBAAEuB,QAAQZ,KAAK,CAACC,cAAc;oBAAC;gBACvD;YACF;YAEA,IAAIK,QAAQO,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC3BZ,OAAOI,QAAQO,IAAI,CAAC,EAAE;gBACtB,kCAAkC;gBAClC,IAAI5B,yBAAyBiB,MAAMF,QAAQ;oBACzCE,OAAQ,MAAMH,QAAQgB,MAAM,CAAC;wBAC3BC,IAAId,KAAKc,EAAE;wBACXpB,YAAYA,WAAWY,IAAI;wBAC3BS,MAAM;4BACJ,GAAGjB,KAAK;wBACV;wBACAG;oBACF;gBACF;YACF,OAAO;gBACL,MAAMe,UAAU;oBACdC,OAAOnB,MAAMoB,iBAAiB,IAAIpB,MAAMmB,KAAK;oBAC7C,CAACrB,cAAcT,IAAI,CAAC,EAAEW,KAAK,CAACC,cAAc;oBAC1C,GAAGD,KAAK;gBACV;gBAEA,IAAI,OAAOJ,WAAWQ,IAAI,KAAK,YAAY,CAACR,WAAWQ,IAAI,CAACiB,oBAAoB,EAAE;oBAChFH,QAAQI,QAAQ,GAAGtC;gBACrB;gBAEA,IAAI;oBACFkB,OAAQ,MAAMH,QAAQwB,MAAM,CAAC;wBAC3B3B,YAAYA,WAAWY,IAAI;wBAC3BS,MAAMC;wBACNf;wBACAqB,gBAAgB;oBAClB;gBACF,EAAE,OAAOC,WAAoB;oBAC3B,yFAAyF;oBACzF,IAAIvC,oBAAoBuC,YAAY;wBAClC,MAAMC,eAAe,MAAM3B,QAAQQ,IAAI,CAAC;4BACtCX,YAAYA,WAAWY,IAAI;4BAC3BL;4BACAM,OAAO;4BACPC,YAAY;4BACZC,OAAO;gCACL,CAACb,cAAcT,IAAI,CAAC,EAAE;oCAAEuB,QAAQZ,KAAK,CAACC,cAAc;gCAAC;4BACvD;wBACF;wBAEA,IAAIyB,aAAab,IAAI,CAACC,MAAM,GAAG,GAAG;4BAChCZ,OAAOwB,aAAab,IAAI,CAAC,EAAE;wBAC7B;oBACF,OAAO;wBACL,MAAMY;oBACR;gBACF;YACF;QACF,EAAE,OAAOE,KAAc;YACrB5B,QAAQ6B,MAAM,CAACC,KAAK,CAAC;gBACnBF;gBACAG,KAAK;YACP;YACA,OAAO;gBACL5B,MAAM;YACR;QACF;QAEA,IAAIA,MAAM;YACRA,KAAKN,UAAU,GAAGA,WAAWY,IAAI;YACjCN,KAAK6B,SAAS,GAAGlC;YACjBK,KAAK8B,GAAG,GAAGhC,MAAMgC,GAAG;YAEpB,OAAO;gBACL9B;YACF;QACF;QAEA,OAAO;YACLA,MAAM;QACR;IACF,EAAC"}

package/dist/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoD,MAAM,EAAE,MAAM,SAAS,CAAA;AAIvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAc/C,eAAO,MAAM,YAAY,kBACP,aAAa,KAAG,MAuQ/B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoD,MAAM,EAAE,MAAM,SAAS,CAAA;AAIvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAc/C,eAAO,MAAM,YAAY,kBACP,aAAa,KAAG,MAiR/B,CAAA"}

package/dist/oauth/index.js

@@ -95,7 +95,12 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                         ...existingCollection.fields,
                         {
                             name: 'email',
-                            type: 'email'
+                            type: 'email',
+                            admin: {
+                                description: 'Managed by Figma',
+                                readOnly: true
+                            },
+                            unique: true
                         }
                     ]
                 };
@@ -103,11 +108,14 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                     collection: collectionWithEmail,
                     collectionOptions
                 });
-                // Make username field readOnly
+                // Make username field readOnly (and add description for email fields)
                 const readOnlyUsernameField = {
                     ...usernameField,
                     admin: {
                         ...usernameField.admin || {},
+                        ...usernameField.name === 'email' ? {
+                            description: 'Managed by Figma'
+                        } : {},
                         readOnly: true
                     }
                 };
@@ -158,6 +166,10 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 return {
                     ...existingCollection,
+                    access: {
+                        ...existingCollection.access || {},
+                        create: ()=>false
+                    },
                     auth: {
                         ...typeof existingCollection.auth === 'object' ? existingCollection.auth : {},
                         disableLocalStrategy,

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth/index.ts"],"sourcesContent":["import type { AuthStrategy, CollectionConfig, IncomingAuthType, Plugin } from 'payload'\n\nimport { fieldAffectsData } from 'payload/shared'\n\nimport type { PluginOptions } from './types.js'\n\nimport { defaultVerify } from './defaults.js'\nimport { getLoginEndpoint } from './endpoints/getLoginEndpoint.js'\nimport { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js'\nimport { getMetaEndpoint } from './endpoints/getMetaEndpoint.js'\nimport { getRedirectToLoginEndpoint } from './endpoints/getRedirectToLoginEndpoint.js'\nimport { getAfterLogout } from './hooks/afterLogout.js'\nimport { getMeHook } from './hooks/me.js'\nimport { getRefreshHook } from './hooks/refresh.js'\nimport { Strategy } from './strategy/index.js'\nimport { getAdminCollectionSlug } from './utilities/getAdminCollectionSlug.js'\nimport { getUsernameField } from './utilities/getUsernameField.js'\n\nexport const oAuth2Plugin =\n  (pluginOptions: PluginOptions): Plugin =>\n  (config) => {\n    const { collections: allCollectionOptions, debug, disabled } = pluginOptions\n\n    const strategyName = pluginOptions?.strategyName || 'oauth'\n    // Defaults to sso, but can be overridden to accommodate multiple strategies on one collection\n    const endpointSlug = pluginOptions?.strategyName || 'sso'\n\n    const adminCollectionSlug = getAdminCollectionSlug(config)\n    const adminCollectionOptions = allCollectionOptions.find(\n      ({ slug }) => slug === adminCollectionSlug,\n    )\n\n    if (!adminCollectionOptions) {\n      throw new Error(\n        `Can't find collection options for the admin collection ${adminCollectionSlug}.`,\n      )\n    }\n\n    let LoginButton = null\n\n    if (adminCollectionOptions.LoginButton === false) {\n      LoginButton = null\n    } else if (typeof adminCollectionOptions.LoginButton === 'string') {\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: adminCollectionOptions.LoginButton,\n      }\n    } else if (typeof adminCollectionOptions.LoginButton === 'object') {\n      LoginButton = {\n        ...adminCollectionOptions.LoginButton,\n        clientProps: {\n          ...adminCollectionOptions.LoginButton.clientProps,\n          disabled,\n          endpointSlug,\n        },\n      }\n    } else {\n      // Default to the provided LoginButton component path\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: '@payloadcms/figma/client#DefaultLoginButton',\n      }\n    }\n\n    return {\n      ...config,\n      admin: {\n        ...(config.admin || {}),\n        components: {\n          ...(typeof config.admin === 'object' && typeof config.admin.components === 'object'\n            ? config.admin.components\n            : {}),\n          ...(adminCollectionOptions.endOAuthSessionOnLogout\n            ? {\n                logout: {\n                  Button: {\n                    clientProps: {\n                      disabled,\n                      endpointSlug,\n                    },\n                    path: '@payloadcms/figma/client#LogoutButton',\n                  },\n                },\n              }\n            : {}),\n          beforeLogin: [\n            ...(typeof config.admin === 'object' &&\n            typeof config.admin.components === 'object' &&\n            Array.isArray(config.admin.components.beforeLogin)\n              ? config.admin.components.beforeLogin\n              : []),\n            ...(LoginButton ? [LoginButton] : []),\n          ],\n        },\n      },\n      collections: (config.collections || []).map((existingCollection) => {\n        const collectionOptions = allCollectionOptions.find(\n          ({ slug }) => slug === existingCollection.slug,\n        )\n\n        if (!collectionOptions) {\n          return existingCollection\n        }\n\n        let cookieName = pluginOptions?.cookieName || `payload-${strategyName}-token`\n        // If the usePayloadJWT option is enabled, use the default cookie name from Payload\n        if (collectionOptions.usePayloadJWT) {\n          cookieName = `${config.cookiePrefix || 'payload'}-token`\n        }\n\n        // Check if email field exists, if not add it\n        const hasEmailField = existingCollection.fields.some(\n          (field) => 'name' in field && field.name === 'email',\n        )\n\n        // Add email field to collection before getting username field\n        // This ensures getUsernameField can find the email field if it's configured as the username\n        const collectionWithEmail: CollectionConfig = hasEmailField\n          ? existingCollection\n          : {\n              ...existingCollection,\n              fields: [\n                ...existingCollection.fields,\n                {\n                  name: 'email',\n                  type: 'email',\n                },\n              ],\n            }\n\n        const usernameField = getUsernameField({\n          collection: collectionWithEmail,\n          collectionOptions,\n        })\n\n        // Make username field readOnly\n        const readOnlyUsernameField = {\n          ...usernameField,\n          admin: {\n            ...(usernameField.admin || {}),\n            readOnly: true,\n          },\n        } as typeof usernameField\n\n        const isUsernameFieldString = typeof adminCollectionOptions.usernameField === 'string'\n\n        const fields = [\n          ...collectionWithEmail.fields.map((field) =>\n            fieldAffectsData(field) && field.name === usernameField.name\n              ? readOnlyUsernameField\n              : field,\n          ),\n          ...(isUsernameFieldString ? [] : [readOnlyUsernameField]),\n        ]\n\n        if (disabled) {\n          return {\n            ...existingCollection,\n            fields,\n          }\n        }\n\n        const strategy = new Strategy({\n          clientID: collectionOptions.clientID,\n          clientSecret: collectionOptions.clientSecret,\n          collection: existingCollection,\n          collectionOptions,\n          cookieName,\n          debug,\n          identityMetadata: collectionOptions.identityMetadata,\n          pluginOptions,\n          strategyName,\n          verify:\n            collectionOptions.verify ??\n            defaultVerify({\n              collection: existingCollection,\n              strategyName,\n              usernameField,\n            }),\n        })\n\n        const authStrategy: AuthStrategy = {\n          name: `${existingCollection.slug}-${strategyName}`,\n          // Bind 'this' to ensure the authenticate function has the correct context\n          authenticate: strategy.authenticate.bind(strategy),\n        }\n\n        let disableLocalStrategy: IncomingAuthType['disableLocalStrategy']\n\n        if (collectionOptions.disableLocalStrategy === false) {\n          // When the plugin collection option has disableLocalStrategy option set to false, do not disable the local strategy\n          disableLocalStrategy = undefined\n        } else if (collectionOptions.disableLocalStrategy) {\n          // use the configured disableLocalStrategy which can include `enableFields`, etc.\n          disableLocalStrategy = collectionOptions.disableLocalStrategy\n        } else {\n          // by default disableLocalStrategy\n          disableLocalStrategy = true\n        }\n\n        return {\n          ...existingCollection,\n          auth: {\n            ...(typeof existingCollection.auth === 'object' ? existingCollection.auth : {}),\n            disableLocalStrategy,\n            strategies: [\n              ...(typeof existingCollection.auth === 'object' &&\n              Array.isArray(existingCollection.auth.strategies)\n                ? existingCollection.auth.strategies\n                : []),\n              authStrategy,\n            ],\n          },\n          endpoints: [\n            ...(existingCollection.endpoints || []),\n            getLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getMetaEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getLogoutEndpoint({\n              collection: existingCollection,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getRedirectToLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n          ],\n          fields,\n          hooks: {\n            ...(existingCollection.hooks || {}),\n            afterLogout: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.afterLogout)\n                ? existingCollection.hooks.afterLogout\n                : []),\n              getAfterLogout({\n                collection: existingCollection,\n                cookieName,\n                pluginOptions,\n              }),\n            ],\n            me: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.me)\n                ? existingCollection.hooks.me\n                : []),\n              // Do not inject the me hook if the usePayloadJWT option is enabled\n              ...(!collectionOptions.usePayloadJWT ? [getMeHook({ cookieName })] : []),\n            ],\n            refresh: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.refresh)\n                ? existingCollection.hooks.refresh\n                : []),\n              getRefreshHook({ pluginOptions, strategy }),\n            ],\n          },\n        }\n      }),\n    }\n  }\n"],"names":["fieldAffectsData","defaultVerify","getLoginEndpoint","getLogoutEndpoint","getMetaEndpoint","getRedirectToLoginEndpoint","getAfterLogout","getMeHook","getRefreshHook","Strategy","getAdminCollectionSlug","getUsernameField","oAuth2Plugin","pluginOptions","config","collections","allCollectionOptions","debug","disabled","strategyName","endpointSlug","adminCollectionSlug","adminCollectionOptions","find","slug","Error","LoginButton","clientProps","path","admin","components","endOAuthSessionOnLogout","logout","Button","beforeLogin","Array","isArray","map","existingCollection","collectionOptions","cookieName","usePayloadJWT","cookiePrefix","hasEmailField","fields","some","field","name","collectionWithEmail","type","usernameField","collection","readOnlyUsernameField","readOnly","isUsernameFieldString","strategy","clientID","clientSecret","identityMetadata","verify","authStrategy","authenticate","bind","disableLocalStrategy","undefined","auth","strategies","endpoints","hooks","afterLogout","me","refresh"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,iBAAgB;AAIjD,SAASC,aAAa,QAAQ,gBAAe;AAC7C,SAASC,gBAAgB,QAAQ,kCAAiC;AAClE,SAASC,iBAAiB,QAAQ,mCAAkC;AACpE,SAASC,eAAe,QAAQ,iCAAgC;AAChE,SAASC,0BAA0B,QAAQ,4CAA2C;AACtF,SAASC,cAAc,QAAQ,yBAAwB;AACvD,SAASC,SAAS,QAAQ,gBAAe;AACzC,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,QAAQ,QAAQ,sBAAqB;AAC9C,SAASC,sBAAsB,QAAQ,wCAAuC;AAC9E,SAASC,gBAAgB,QAAQ,kCAAiC;AAElE,OAAO,MAAMC,eACX,CAACC,gBACD,CAACC;QACC,MAAM,EAAEC,aAAaC,oBAAoB,EAAEC,KAAK,EAAEC,QAAQ,EAAE,GAAGL;QAE/D,MAAMM,eAAeN,eAAeM,gBAAgB;QACpD,8FAA8F;QAC9F,MAAMC,eAAeP,eAAeM,gBAAgB;QAEpD,MAAME,sBAAsBX,uBAAuBI;QACnD,MAAMQ,yBAAyBN,qBAAqBO,IAAI,CACtD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASH;QAGzB,IAAI,CAACC,wBAAwB;YAC3B,MAAM,IAAIG,MACR,CAAC,uDAAuD,EAAEJ,oBAAoB,CAAC,CAAC;QAEpF;QAEA,IAAIK,cAAc;QAElB,IAAIJ,uBAAuBI,WAAW,KAAK,OAAO;YAChDA,cAAc;QAChB,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAMN,uBAAuBI,WAAW;YAC1C;QACF,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZ,GAAGJ,uBAAuBI,WAAW;gBACrCC,aAAa;oBACX,GAAGL,uBAAuBI,WAAW,CAACC,WAAW;oBACjDT;oBACAE;gBACF;YACF;QACF,OAAO;YACL,qDAAqD;YACrDM,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAM;YACR;QACF;QAEA,OAAO;YACL,GAAGd,MAAM;YACTe,OAAO;gBACL,GAAIf,OAAOe,KAAK,IAAI,CAAC,CAAC;gBACtBC,YAAY;oBACV,GAAI,OAAOhB,OAAOe,KAAK,KAAK,YAAY,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,WACvEhB,OAAOe,KAAK,CAACC,UAAU,GACvB,CAAC,CAAC;oBACN,GAAIR,uBAAuBS,uBAAuB,GAC9C;wBACEC,QAAQ;4BACNC,QAAQ;gCACNN,aAAa;oCACXT;oCACAE;gCACF;gCACAQ,MAAM;4BACR;wBACF;oBACF,IACA,CAAC,CAAC;oBACNM,aAAa;2BACP,OAAOpB,OAAOe,KAAK,KAAK,YAC5B,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,YACnCK,MAAMC,OAAO,CAACtB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,IAC7CpB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,GACnC,EAAE;2BACFR,cAAc;4BAACA;yBAAY,GAAG,EAAE;qBACrC;gBACH;YACF;YACAX,aAAa,AAACD,CAAAA,OAAOC,WAAW,IAAI,EAAE,AAAD,EAAGsB,GAAG,CAAC,CAACC;gBAC3C,MAAMC,oBAAoBvB,qBAAqBO,IAAI,CACjD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASc,mBAAmBd,IAAI;gBAGhD,IAAI,CAACe,mBAAmB;oBACtB,OAAOD;gBACT;gBAEA,IAAIE,aAAa3B,eAAe2B,cAAc,CAAC,QAAQ,EAAErB,aAAa,MAAM,CAAC;gBAC7E,mFAAmF;gBACnF,IAAIoB,kBAAkBE,aAAa,EAAE;oBACnCD,aAAa,GAAG1B,OAAO4B,YAAY,IAAI,UAAU,MAAM,CAAC;gBAC1D;gBAEA,6CAA6C;gBAC7C,MAAMC,gBAAgBL,mBAAmBM,MAAM,CAACC,IAAI,CAClD,CAACC,QAAU,UAAUA,SAASA,MAAMC,IAAI,KAAK;gBAG/C,8DAA8D;gBAC9D,4FAA4F;gBAC5F,MAAMC,sBAAwCL,gBAC1CL,qBACA;oBACE,GAAGA,kBAAkB;oBACrBM,QAAQ;2BACHN,mBAAmBM,MAAM;wBAC5B;4BACEG,MAAM;4BACNE,MAAM;wBACR;qBACD;gBACH;gBAEJ,MAAMC,gBAAgBvC,iBAAiB;oBACrCwC,YAAYH;oBACZT;gBACF;gBAEA,+BAA+B;gBAC/B,MAAMa,wBAAwB;oBAC5B,GAAGF,aAAa;oBAChBrB,OAAO;wBACL,GAAIqB,cAAcrB,KAAK,IAAI,CAAC,CAAC;wBAC7BwB,UAAU;oBACZ;gBACF;gBAEA,MAAMC,wBAAwB,OAAOhC,uBAAuB4B,aAAa,KAAK;gBAE9E,MAAMN,SAAS;uBACVI,oBAAoBJ,MAAM,CAACP,GAAG,CAAC,CAACS,QACjC9C,iBAAiB8C,UAAUA,MAAMC,IAAI,KAAKG,cAAcH,IAAI,GACxDK,wBACAN;uBAEFQ,wBAAwB,EAAE,GAAG;wBAACF;qBAAsB;iBACzD;gBAED,IAAIlC,UAAU;oBACZ,OAAO;wBACL,GAAGoB,kBAAkB;wBACrBM;oBACF;gBACF;gBAEA,MAAMW,WAAW,IAAI9C,SAAS;oBAC5B+C,UAAUjB,kBAAkBiB,QAAQ;oBACpCC,cAAclB,kBAAkBkB,YAAY;oBAC5CN,YAAYb;oBACZC;oBACAC;oBACAvB;oBACAyC,kBAAkBnB,kBAAkBmB,gBAAgB;oBACpD7C;oBACAM;oBACAwC,QACEpB,kBAAkBoB,MAAM,IACxB1D,cAAc;wBACZkD,YAAYb;wBACZnB;wBACA+B;oBACF;gBACJ;gBAEA,MAAMU,eAA6B;oBACjCb,MAAM,GAAGT,mBAAmBd,IAAI,CAAC,CAAC,EAAEL,cAAc;oBAClD,0EAA0E;oBAC1E0C,cAAcN,SAASM,YAAY,CAACC,IAAI,CAACP;gBAC3C;gBAEA,IAAIQ;gBAEJ,IAAIxB,kBAAkBwB,oBAAoB,KAAK,OAAO;oBACpD,oHAAoH;oBACpHA,uBAAuBC;gBACzB,OAAO,IAAIzB,kBAAkBwB,oBAAoB,EAAE;oBACjD,iFAAiF;oBACjFA,uBAAuBxB,kBAAkBwB,oBAAoB;gBAC/D,OAAO;oBACL,kCAAkC;oBAClCA,uBAAuB;gBACzB;gBAEA,OAAO;oBACL,GAAGzB,kBAAkB;oBACrB2B,MAAM;wBACJ,GAAI,OAAO3B,mBAAmB2B,IAAI,KAAK,WAAW3B,mBAAmB2B,IAAI,GAAG,CAAC,CAAC;wBAC9EF;wBACAG,YAAY;+BACN,OAAO5B,mBAAmB2B,IAAI,KAAK,YACvC9B,MAAMC,OAAO,CAACE,mBAAmB2B,IAAI,CAACC,UAAU,IAC5C5B,mBAAmB2B,IAAI,CAACC,UAAU,GAClC,EAAE;4BACNN;yBACD;oBACH;oBACAO,WAAW;2BACL7B,mBAAmB6B,SAAS,IAAI,EAAE;wBACtCjE,iBAAiB;4BACfiD,YAAYb;4BACZC;4BACAnB;4BACAP;4BACA0C;wBACF;wBACAnD,gBAAgB;4BACd+C,YAAYb;4BACZC;4BACAnB;4BACAP;4BACA0C;wBACF;wBACApD,kBAAkB;4BAChBgD,YAAYb;4BACZlB;4BACAP;4BACA0C;wBACF;wBACAlD,2BAA2B;4BACzB8C,YAAYb;4BACZC;4BACAnB;4BACAP;4BACA0C;wBACF;qBACD;oBACDX;oBACAwB,OAAO;wBACL,GAAI9B,mBAAmB8B,KAAK,IAAI,CAAC,CAAC;wBAClCC,aAAa;+BACP,OAAO/B,mBAAmB8B,KAAK,KAAK,YACxCjC,MAAMC,OAAO,CAACE,mBAAmB8B,KAAK,CAACC,WAAW,IAC9C/B,mBAAmB8B,KAAK,CAACC,WAAW,GACpC,EAAE;4BACN/D,eAAe;gCACb6C,YAAYb;gCACZE;gCACA3B;4BACF;yBACD;wBACDyD,IAAI;+BACE,OAAOhC,mBAAmB8B,KAAK,KAAK,YACxCjC,MAAMC,OAAO,CAACE,mBAAmB8B,KAAK,CAACE,EAAE,IACrChC,mBAAmB8B,KAAK,CAACE,EAAE,GAC3B,EAAE;4BACN,mEAAmE;+BAC/D,CAAC/B,kBAAkBE,aAAa,GAAG;gCAAClC,UAAU;oCAAEiC;gCAAW;6BAAG,GAAG,EAAE;yBACxE;wBACD+B,SAAS;+BACH,OAAOjC,mBAAmB8B,KAAK,KAAK,YACxCjC,MAAMC,OAAO,CAACE,mBAAmB8B,KAAK,CAACG,OAAO,IAC1CjC,mBAAmB8B,KAAK,CAACG,OAAO,GAChC,EAAE;4BACN/D,eAAe;gCAAEK;gCAAe0C;4BAAS;yBAC1C;oBACH;gBACF;YACF;QACF;IACF,EAAC"}
+{"version":3,"sources":["../../src/oauth/index.ts"],"sourcesContent":["import type { AuthStrategy, CollectionConfig, IncomingAuthType, Plugin } from 'payload'\n\nimport { fieldAffectsData } from 'payload/shared'\n\nimport type { PluginOptions } from './types.js'\n\nimport { defaultVerify } from './defaults.js'\nimport { getLoginEndpoint } from './endpoints/getLoginEndpoint.js'\nimport { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js'\nimport { getMetaEndpoint } from './endpoints/getMetaEndpoint.js'\nimport { getRedirectToLoginEndpoint } from './endpoints/getRedirectToLoginEndpoint.js'\nimport { getAfterLogout } from './hooks/afterLogout.js'\nimport { getMeHook } from './hooks/me.js'\nimport { getRefreshHook } from './hooks/refresh.js'\nimport { Strategy } from './strategy/index.js'\nimport { getAdminCollectionSlug } from './utilities/getAdminCollectionSlug.js'\nimport { getUsernameField } from './utilities/getUsernameField.js'\n\nexport const oAuth2Plugin =\n  (pluginOptions: PluginOptions): Plugin =>\n  (config) => {\n    const { collections: allCollectionOptions, debug, disabled } = pluginOptions\n\n    const strategyName = pluginOptions?.strategyName || 'oauth'\n    // Defaults to sso, but can be overridden to accommodate multiple strategies on one collection\n    const endpointSlug = pluginOptions?.strategyName || 'sso'\n\n    const adminCollectionSlug = getAdminCollectionSlug(config)\n    const adminCollectionOptions = allCollectionOptions.find(\n      ({ slug }) => slug === adminCollectionSlug,\n    )\n\n    if (!adminCollectionOptions) {\n      throw new Error(\n        `Can't find collection options for the admin collection ${adminCollectionSlug}.`,\n      )\n    }\n\n    let LoginButton = null\n\n    if (adminCollectionOptions.LoginButton === false) {\n      LoginButton = null\n    } else if (typeof adminCollectionOptions.LoginButton === 'string') {\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: adminCollectionOptions.LoginButton,\n      }\n    } else if (typeof adminCollectionOptions.LoginButton === 'object') {\n      LoginButton = {\n        ...adminCollectionOptions.LoginButton,\n        clientProps: {\n          ...adminCollectionOptions.LoginButton.clientProps,\n          disabled,\n          endpointSlug,\n        },\n      }\n    } else {\n      // Default to the provided LoginButton component path\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: '@payloadcms/figma/client#DefaultLoginButton',\n      }\n    }\n\n    return {\n      ...config,\n      admin: {\n        ...(config.admin || {}),\n        components: {\n          ...(typeof config.admin === 'object' && typeof config.admin.components === 'object'\n            ? config.admin.components\n            : {}),\n          ...(adminCollectionOptions.endOAuthSessionOnLogout\n            ? {\n                logout: {\n                  Button: {\n                    clientProps: {\n                      disabled,\n                      endpointSlug,\n                    },\n                    path: '@payloadcms/figma/client#LogoutButton',\n                  },\n                },\n              }\n            : {}),\n          beforeLogin: [\n            ...(typeof config.admin === 'object' &&\n            typeof config.admin.components === 'object' &&\n            Array.isArray(config.admin.components.beforeLogin)\n              ? config.admin.components.beforeLogin\n              : []),\n            ...(LoginButton ? [LoginButton] : []),\n          ],\n        },\n      },\n      collections: (config.collections || []).map((existingCollection) => {\n        const collectionOptions = allCollectionOptions.find(\n          ({ slug }) => slug === existingCollection.slug,\n        )\n\n        if (!collectionOptions) {\n          return existingCollection\n        }\n\n        let cookieName = pluginOptions?.cookieName || `payload-${strategyName}-token`\n        // If the usePayloadJWT option is enabled, use the default cookie name from Payload\n        if (collectionOptions.usePayloadJWT) {\n          cookieName = `${config.cookiePrefix || 'payload'}-token`\n        }\n\n        // Check if email field exists, if not add it\n        const hasEmailField = existingCollection.fields.some(\n          (field) => 'name' in field && field.name === 'email',\n        )\n\n        // Add email field to collection before getting username field\n        // This ensures getUsernameField can find the email field if it's configured as the username\n        const collectionWithEmail: CollectionConfig = hasEmailField\n          ? existingCollection\n          : {\n              ...existingCollection,\n              fields: [\n                ...existingCollection.fields,\n                {\n                  name: 'email',\n                  type: 'email',\n                  admin: {\n                    description: 'Managed by Figma',\n                    readOnly: true,\n                  },\n                  unique: true,\n                },\n              ],\n            }\n\n        const usernameField = getUsernameField({\n          collection: collectionWithEmail,\n          collectionOptions,\n        })\n\n        // Make username field readOnly (and add description for email fields)\n        const readOnlyUsernameField = {\n          ...usernameField,\n          admin: {\n            ...(usernameField.admin || {}),\n            ...(usernameField.name === 'email' ? { description: 'Managed by Figma' } : {}),\n            readOnly: true,\n          },\n        } as typeof usernameField\n\n        const isUsernameFieldString = typeof adminCollectionOptions.usernameField === 'string'\n\n        const fields = [\n          ...collectionWithEmail.fields.map((field) =>\n            fieldAffectsData(field) && field.name === usernameField.name\n              ? readOnlyUsernameField\n              : field,\n          ),\n          ...(isUsernameFieldString ? [] : [readOnlyUsernameField]),\n        ]\n\n        if (disabled) {\n          return {\n            ...existingCollection,\n            fields,\n          }\n        }\n\n        const strategy = new Strategy({\n          clientID: collectionOptions.clientID,\n          clientSecret: collectionOptions.clientSecret,\n          collection: existingCollection,\n          collectionOptions,\n          cookieName,\n          debug,\n          identityMetadata: collectionOptions.identityMetadata,\n          pluginOptions,\n          strategyName,\n          verify:\n            collectionOptions.verify ??\n            defaultVerify({\n              collection: existingCollection,\n              strategyName,\n              usernameField,\n            }),\n        })\n\n        const authStrategy: AuthStrategy = {\n          name: `${existingCollection.slug}-${strategyName}`,\n          // Bind 'this' to ensure the authenticate function has the correct context\n          authenticate: strategy.authenticate.bind(strategy),\n        }\n\n        let disableLocalStrategy: IncomingAuthType['disableLocalStrategy']\n\n        if (collectionOptions.disableLocalStrategy === false) {\n          // When the plugin collection option has disableLocalStrategy option set to false, do not disable the local strategy\n          disableLocalStrategy = undefined\n        } else if (collectionOptions.disableLocalStrategy) {\n          // use the configured disableLocalStrategy which can include `enableFields`, etc.\n          disableLocalStrategy = collectionOptions.disableLocalStrategy\n        } else {\n          // by default disableLocalStrategy\n          disableLocalStrategy = true\n        }\n\n        return {\n          ...existingCollection,\n          access: {\n            ...(existingCollection.access || {}),\n            create: () => false,\n          },\n          auth: {\n            ...(typeof existingCollection.auth === 'object' ? existingCollection.auth : {}),\n            disableLocalStrategy,\n            strategies: [\n              ...(typeof existingCollection.auth === 'object' &&\n              Array.isArray(existingCollection.auth.strategies)\n                ? existingCollection.auth.strategies\n                : []),\n              authStrategy,\n            ],\n          },\n          endpoints: [\n            ...(existingCollection.endpoints || []),\n            getLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getMetaEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getLogoutEndpoint({\n              collection: existingCollection,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getRedirectToLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n          ],\n          fields,\n          hooks: {\n            ...(existingCollection.hooks || {}),\n            afterLogout: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.afterLogout)\n                ? existingCollection.hooks.afterLogout\n                : []),\n              getAfterLogout({\n                collection: existingCollection,\n                cookieName,\n                pluginOptions,\n              }),\n            ],\n            me: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.me)\n                ? existingCollection.hooks.me\n                : []),\n              // Do not inject the me hook if the usePayloadJWT option is enabled\n              ...(!collectionOptions.usePayloadJWT ? [getMeHook({ cookieName })] : []),\n            ],\n            refresh: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.refresh)\n                ? existingCollection.hooks.refresh\n                : []),\n              getRefreshHook({ pluginOptions, strategy }),\n            ],\n          },\n        }\n      }),\n    }\n  }\n"],"names":["fieldAffectsData","defaultVerify","getLoginEndpoint","getLogoutEndpoint","getMetaEndpoint","getRedirectToLoginEndpoint","getAfterLogout","getMeHook","getRefreshHook","Strategy","getAdminCollectionSlug","getUsernameField","oAuth2Plugin","pluginOptions","config","collections","allCollectionOptions","debug","disabled","strategyName","endpointSlug","adminCollectionSlug","adminCollectionOptions","find","slug","Error","LoginButton","clientProps","path","admin","components","endOAuthSessionOnLogout","logout","Button","beforeLogin","Array","isArray","map","existingCollection","collectionOptions","cookieName","usePayloadJWT","cookiePrefix","hasEmailField","fields","some","field","name","collectionWithEmail","type","description","readOnly","unique","usernameField","collection","readOnlyUsernameField","isUsernameFieldString","strategy","clientID","clientSecret","identityMetadata","verify","authStrategy","authenticate","bind","disableLocalStrategy","undefined","access","create","auth","strategies","endpoints","hooks","afterLogout","me","refresh"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,iBAAgB;AAIjD,SAASC,aAAa,QAAQ,gBAAe;AAC7C,SAASC,gBAAgB,QAAQ,kCAAiC;AAClE,SAASC,iBAAiB,QAAQ,mCAAkC;AACpE,SAASC,eAAe,QAAQ,iCAAgC;AAChE,SAASC,0BAA0B,QAAQ,4CAA2C;AACtF,SAASC,cAAc,QAAQ,yBAAwB;AACvD,SAASC,SAAS,QAAQ,gBAAe;AACzC,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,QAAQ,QAAQ,sBAAqB;AAC9C,SAASC,sBAAsB,QAAQ,wCAAuC;AAC9E,SAASC,gBAAgB,QAAQ,kCAAiC;AAElE,OAAO,MAAMC,eACX,CAACC,gBACD,CAACC;QACC,MAAM,EAAEC,aAAaC,oBAAoB,EAAEC,KAAK,EAAEC,QAAQ,EAAE,GAAGL;QAE/D,MAAMM,eAAeN,eAAeM,gBAAgB;QACpD,8FAA8F;QAC9F,MAAMC,eAAeP,eAAeM,gBAAgB;QAEpD,MAAME,sBAAsBX,uBAAuBI;QACnD,MAAMQ,yBAAyBN,qBAAqBO,IAAI,CACtD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASH;QAGzB,IAAI,CAACC,wBAAwB;YAC3B,MAAM,IAAIG,MACR,CAAC,uDAAuD,EAAEJ,oBAAoB,CAAC,CAAC;QAEpF;QAEA,IAAIK,cAAc;QAElB,IAAIJ,uBAAuBI,WAAW,KAAK,OAAO;YAChDA,cAAc;QAChB,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAMN,uBAAuBI,WAAW;YAC1C;QACF,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZ,GAAGJ,uBAAuBI,WAAW;gBACrCC,aAAa;oBACX,GAAGL,uBAAuBI,WAAW,CAACC,WAAW;oBACjDT;oBACAE;gBACF;YACF;QACF,OAAO;YACL,qDAAqD;YACrDM,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAM;YACR;QACF;QAEA,OAAO;YACL,GAAGd,MAAM;YACTe,OAAO;gBACL,GAAIf,OAAOe,KAAK,IAAI,CAAC,CAAC;gBACtBC,YAAY;oBACV,GAAI,OAAOhB,OAAOe,KAAK,KAAK,YAAY,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,WACvEhB,OAAOe,KAAK,CAACC,UAAU,GACvB,CAAC,CAAC;oBACN,GAAIR,uBAAuBS,uBAAuB,GAC9C;wBACEC,QAAQ;4BACNC,QAAQ;gCACNN,aAAa;oCACXT;oCACAE;gCACF;gCACAQ,MAAM;4BACR;wBACF;oBACF,IACA,CAAC,CAAC;oBACNM,aAAa;2BACP,OAAOpB,OAAOe,KAAK,KAAK,YAC5B,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,YACnCK,MAAMC,OAAO,CAACtB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,IAC7CpB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,GACnC,EAAE;2BACFR,cAAc;4BAACA;yBAAY,GAAG,EAAE;qBACrC;gBACH;YACF;YACAX,aAAa,AAACD,CAAAA,OAAOC,WAAW,IAAI,EAAE,AAAD,EAAGsB,GAAG,CAAC,CAACC;gBAC3C,MAAMC,oBAAoBvB,qBAAqBO,IAAI,CACjD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASc,mBAAmBd,IAAI;gBAGhD,IAAI,CAACe,mBAAmB;oBACtB,OAAOD;gBACT;gBAEA,IAAIE,aAAa3B,eAAe2B,cAAc,CAAC,QAAQ,EAAErB,aAAa,MAAM,CAAC;gBAC7E,mFAAmF;gBACnF,IAAIoB,kBAAkBE,aAAa,EAAE;oBACnCD,aAAa,GAAG1B,OAAO4B,YAAY,IAAI,UAAU,MAAM,CAAC;gBAC1D;gBAEA,6CAA6C;gBAC7C,MAAMC,gBAAgBL,mBAAmBM,MAAM,CAACC,IAAI,CAClD,CAACC,QAAU,UAAUA,SAASA,MAAMC,IAAI,KAAK;gBAG/C,8DAA8D;gBAC9D,4FAA4F;gBAC5F,MAAMC,sBAAwCL,gBAC1CL,qBACA;oBACE,GAAGA,kBAAkB;oBACrBM,QAAQ;2BACHN,mBAAmBM,MAAM;wBAC5B;4BACEG,MAAM;4BACNE,MAAM;4BACNpB,OAAO;gCACLqB,aAAa;gCACbC,UAAU;4BACZ;4BACAC,QAAQ;wBACV;qBACD;gBACH;gBAEJ,MAAMC,gBAAgB1C,iBAAiB;oBACrC2C,YAAYN;oBACZT;gBACF;gBAEA,sEAAsE;gBACtE,MAAMgB,wBAAwB;oBAC5B,GAAGF,aAAa;oBAChBxB,OAAO;wBACL,GAAIwB,cAAcxB,KAAK,IAAI,CAAC,CAAC;wBAC7B,GAAIwB,cAAcN,IAAI,KAAK,UAAU;4BAAEG,aAAa;wBAAmB,IAAI,CAAC,CAAC;wBAC7EC,UAAU;oBACZ;gBACF;gBAEA,MAAMK,wBAAwB,OAAOlC,uBAAuB+B,aAAa,KAAK;gBAE9E,MAAMT,SAAS;uBACVI,oBAAoBJ,MAAM,CAACP,GAAG,CAAC,CAACS,QACjC9C,iBAAiB8C,UAAUA,MAAMC,IAAI,KAAKM,cAAcN,IAAI,GACxDQ,wBACAT;uBAEFU,wBAAwB,EAAE,GAAG;wBAACD;qBAAsB;iBACzD;gBAED,IAAIrC,UAAU;oBACZ,OAAO;wBACL,GAAGoB,kBAAkB;wBACrBM;oBACF;gBACF;gBAEA,MAAMa,WAAW,IAAIhD,SAAS;oBAC5BiD,UAAUnB,kBAAkBmB,QAAQ;oBACpCC,cAAcpB,kBAAkBoB,YAAY;oBAC5CL,YAAYhB;oBACZC;oBACAC;oBACAvB;oBACA2C,kBAAkBrB,kBAAkBqB,gBAAgB;oBACpD/C;oBACAM;oBACA0C,QACEtB,kBAAkBsB,MAAM,IACxB5D,cAAc;wBACZqD,YAAYhB;wBACZnB;wBACAkC;oBACF;gBACJ;gBAEA,MAAMS,eAA6B;oBACjCf,MAAM,GAAGT,mBAAmBd,IAAI,CAAC,CAAC,EAAEL,cAAc;oBAClD,0EAA0E;oBAC1E4C,cAAcN,SAASM,YAAY,CAACC,IAAI,CAACP;gBAC3C;gBAEA,IAAIQ;gBAEJ,IAAI1B,kBAAkB0B,oBAAoB,KAAK,OAAO;oBACpD,oHAAoH;oBACpHA,uBAAuBC;gBACzB,OAAO,IAAI3B,kBAAkB0B,oBAAoB,EAAE;oBACjD,iFAAiF;oBACjFA,uBAAuB1B,kBAAkB0B,oBAAoB;gBAC/D,OAAO;oBACL,kCAAkC;oBAClCA,uBAAuB;gBACzB;gBAEA,OAAO;oBACL,GAAG3B,kBAAkB;oBACrB6B,QAAQ;wBACN,GAAI7B,mBAAmB6B,MAAM,IAAI,CAAC,CAAC;wBACnCC,QAAQ,IAAM;oBAChB;oBACAC,MAAM;wBACJ,GAAI,OAAO/B,mBAAmB+B,IAAI,KAAK,WAAW/B,mBAAmB+B,IAAI,GAAG,CAAC,CAAC;wBAC9EJ;wBACAK,YAAY;+BACN,OAAOhC,mBAAmB+B,IAAI,KAAK,YACvClC,MAAMC,OAAO,CAACE,mBAAmB+B,IAAI,CAACC,UAAU,IAC5ChC,mBAAmB+B,IAAI,CAACC,UAAU,GAClC,EAAE;4BACNR;yBACD;oBACH;oBACAS,WAAW;2BACLjC,mBAAmBiC,SAAS,IAAI,EAAE;wBACtCrE,iBAAiB;4BACfoD,YAAYhB;4BACZC;4BACAnB;4BACAP;4BACA4C;wBACF;wBACArD,gBAAgB;4BACdkD,YAAYhB;4BACZC;4BACAnB;4BACAP;4BACA4C;wBACF;wBACAtD,kBAAkB;4BAChBmD,YAAYhB;4BACZlB;4BACAP;4BACA4C;wBACF;wBACApD,2BAA2B;4BACzBiD,YAAYhB;4BACZC;4BACAnB;4BACAP;4BACA4C;wBACF;qBACD;oBACDb;oBACA4B,OAAO;wBACL,GAAIlC,mBAAmBkC,KAAK,IAAI,CAAC,CAAC;wBAClCC,aAAa;+BACP,OAAOnC,mBAAmBkC,KAAK,KAAK,YACxCrC,MAAMC,OAAO,CAACE,mBAAmBkC,KAAK,CAACC,WAAW,IAC9CnC,mBAAmBkC,KAAK,CAACC,WAAW,GACpC,EAAE;4BACNnE,eAAe;gCACbgD,YAAYhB;gCACZE;gCACA3B;4BACF;yBACD;wBACD6D,IAAI;+BACE,OAAOpC,mBAAmBkC,KAAK,KAAK,YACxCrC,MAAMC,OAAO,CAACE,mBAAmBkC,KAAK,CAACE,EAAE,IACrCpC,mBAAmBkC,KAAK,CAACE,EAAE,GAC3B,EAAE;4BACN,mEAAmE;+BAC/D,CAACnC,kBAAkBE,aAAa,GAAG;gCAAClC,UAAU;oCAAEiC;gCAAW;6BAAG,GAAG,EAAE;yBACxE;wBACDmC,SAAS;+BACH,OAAOrC,mBAAmBkC,KAAK,KAAK,YACxCrC,MAAMC,OAAO,CAACE,mBAAmBkC,KAAK,CAACG,OAAO,IAC1CrC,mBAAmBkC,KAAK,CAACG,OAAO,GAChC,EAAE;4BACNnE,eAAe;gCAAEK;gCAAe4C;4BAAS;yBAC1C;oBACH;gBACF;YACF;QACF;IACF,EAAC"}

package/dist/oauth/strategy/index.js

@@ -1,6 +1,6 @@
 import * as jose from 'jose';
 import { APIError, parseCookies } from 'payload';
-import { validateProjectToken } from '../../auth/jwt-validator.js';
+import { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js';
 import { getEnvironment } from '../../constants.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
@@ -136,7 +136,7 @@ export class Strategy {
                 });
             }
         }
-        if (oauthTokenVerifyResult instanceof Error && oauthTokenVerifyResult.name === 'TokenExpiredError' && refreshToken && !this.collectionOptions.usePayloadJWT && canSetHeaders) {
+        if (oauthTokenVerifyResult instanceof JWTValidationError && oauthTokenVerifyResult.code === 'EXPIRED' && refreshToken && !this.collectionOptions.usePayloadJWT && canSetHeaders) {
             const refreshed = await refreshTokens({
                 payload,
                 refreshToken,

package/dist/oauth/strategy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof Error &&\n      oauthTokenVerifyResult.name === 'TokenExpiredError' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n\n          if (this.meta) {\n            // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration\n            this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms'\n          }\n\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","authorization_endpoint","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUrC,aAAakC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCE,SAClCF,uBAAuBjC,IAAI,KAAK,uBAChCmB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACgD,aAAa,IACrC1B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI0C,KAAKC,GAAG,KAAK,IAAI,CAAC3C,mBAAmB,CAAC4C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAAChD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC6C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC5C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI6C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAAChD,IAAI,GAAG,MAAMiD,MAAM,IAAI,CAACnD,mBAAmB,EAAEoD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBAExE,IAAI,IAAI,CAACpD,IAAI,EAAE;wBACb,oGAAoG;wBACpG,IAAI,CAACA,IAAI,CAACqD,sBAAsB,GAAG,IAAI,CAACrD,IAAI,EAAEqD,yBAAyB;oBACzE;oBAEA,IAAI,CAACxD,QAAQ,CAAC,CAAC,+BAA+B,EAAEmD,SAAS;oBAEzD,IAAI,IAAI,CAAChD,IAAI,EAAEsD,UAAU;wBACvB,IAAI,CAACvD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACjD,IAAI,CAACsD,QAAQ,EAAEJ,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACnD,mBAAmB,GAAG,IAAI0C;oBAC/B,IAAI,CAAC9C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACsD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBT,YAAYS;oBACZ,IAAI,CAAC3D,QAAQ,CAAC,CAAC,2BAA2B,EAAEmD,QAAQ,IAAI,EAAGQ,OAAiBC,SAAS;oBAErF,IAAIT,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIU,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACd,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIlE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACgB,mBAAmB,CAAC,eAAe,EACjF,AAACiD,WAAqBU,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACvD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG6D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACpE,IAAI,IAAIqE,MAAMC,OAAO,CAAC,IAAI,CAACtE,IAAI,CAACoE,IAAI,IAAI,IAAI,CAACpE,IAAI,CAACoE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAI1B,MAAM;QAClB;QAEA,IAAI,CAAC2B,KAAK;YACR,MAAM,IAAI3B,MAAM;QAClB;QAEA,IAAI,CAAC4B,MAAM;YACT,MAAM,IAAI5B,MAAM;QAClB;QAEA,KAAK,MAAMiC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM5F,KAAK6F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAIpC,MAAM;YAClB;YAEA+B,SAAS,MAAMzF,KAAK+F,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAIhC,MAAM;QAClB;QAEA,IAAI,CAAC+B,QAAQ;YACX,MAAM,IAAI/B,MAAM;QAClB;QAEA,OAAO+B;IACT;IAEA,MAAMhC,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM4C,WAAW,MAAM7F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO4F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB5D,QAAQ6D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACArD,KAAK;YACP;YAEA,IAAIqD,eAAevC,OAAO;gBACxB,OAAOuC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof JWTValidationError &&\n      oauthTokenVerifyResult.code === 'EXPIRED' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n\n          if (this.meta) {\n            // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration\n            this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms'\n          }\n\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","JWTValidationError","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","code","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","authorization_endpoint","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAASC,kBAAkB,EAAEC,oBAAoB,QAAQ,8BAA6B;AACtF,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUtC,aAAamC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCtD,sBAClCsD,uBAAuBK,IAAI,KAAK,aAChCnB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACiD,aAAa,IACrC3B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI2C,KAAKC,GAAG,KAAK,IAAI,CAAC5C,mBAAmB,CAAC6C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAACjD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC8C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC7C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI8C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAACjD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACpD,mBAAmB,EAAEqD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBAExE,IAAI,IAAI,CAACrD,IAAI,EAAE;wBACb,oGAAoG;wBACpG,IAAI,CAACA,IAAI,CAACsD,sBAAsB,GAAG,IAAI,CAACtD,IAAI,EAAEsD,yBAAyB;oBACzE;oBAEA,IAAI,CAACzD,QAAQ,CAAC,CAAC,+BAA+B,EAAEoD,SAAS;oBAEzD,IAAI,IAAI,CAACjD,IAAI,EAAEuD,UAAU;wBACvB,IAAI,CAACxD,IAAI,GAAG,MAAMmD,MAAM,IAAI,CAAClD,IAAI,CAACuD,QAAQ,EAAEJ,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACpD,mBAAmB,GAAG,IAAI2C;oBAC/B,IAAI,CAAC/C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACuD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBT,YAAYS;oBACZ,IAAI,CAAC5D,QAAQ,CAAC,CAAC,2BAA2B,EAAEoD,QAAQ,IAAI,EAAGQ,OAAiBC,SAAS;oBAErF,IAAIT,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIU,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACd,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIpE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACiB,mBAAmB,CAAC,eAAe,EACjF,AAACkD,WAAqBU,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACxD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG8D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACrE,IAAI,IAAIsE,MAAMC,OAAO,CAAC,IAAI,CAACvE,IAAI,CAACqE,IAAI,IAAI,IAAI,CAACrE,IAAI,CAACqE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAI3B,MAAM;QAClB;QAEA,IAAI,CAAC4B,KAAK;YACR,MAAM,IAAI5B,MAAM;QAClB;QAEA,IAAI,CAAC6B,MAAM;YACT,MAAM,IAAI7B,MAAM;QAClB;QAEA,KAAK,MAAMkC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM9F,KAAK+F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAIrC,MAAM;YAClB;YAEAgC,SAAS,MAAM3F,KAAKiG,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAIjC,MAAM;QAClB;QAEA,IAAI,CAACgC,QAAQ;YACX,MAAM,IAAIhC,MAAM;QAClB;QAEA,OAAOgC;IACT;IAEA,MAAMjC,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM6C,WAAW,MAAM9F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO6F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB7D,QAAQ8D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACAtD,KAAK;YACP;YAEA,IAAIsD,eAAexC,OAAO;gBACxB,OAAOwC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}

package/dist/oauth/types.d.ts

@@ -112,11 +112,6 @@ export interface PluginOptions {
      * @default 'payload-oauth-token'
      */
     cookieName?: string;
-    /**
-     * Debug mode will log additional information to the console.
-     *
-     * NOTE: This will log sensitive information to the console.
-     */
     /**
      * Accepts incoming request and allows for modification of cookie options
      */
@@ -125,6 +120,11 @@ export interface PluginOptions {
         cookieOptions: CookieOptions;
         headers: Headers;
     }) => CookieOptions;
+    /**
+     * Debug mode will log additional information to the console.
+     *
+     * NOTE: This will log sensitive information to the console.
+     */
     debug?: boolean;
     /**
      * Disables the plugin functionality while leaving in types, fields and component modifications.

package/dist/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACvE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IAEH;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACvE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}

package/dist/oauth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAwNrD,WAGC"}
+{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAuNrD,WAGC"}

package/dist/oauth/utilities/isDuplicateKeyError.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */
+export declare function isDuplicateKeyError(error: unknown): boolean;
+//# sourceMappingURL=isDuplicateKeyError.d.ts.map

package/dist/oauth/utilities/isDuplicateKeyError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isDuplicateKeyError.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/isDuplicateKeyError.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAa3D"}

package/dist/oauth/utilities/isDuplicateKeyError.js

@@ -0,0 +1,14 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */ export function isDuplicateKeyError(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const err = error;
+    const message = typeof err.message === 'string' ? err.message : '';
+    return message.includes('409') || message.toLowerCase().includes('conflict') || message.toLowerCase().includes('already exists');
+}
+
+//# sourceMappingURL=isDuplicateKeyError.js.map

package/dist/oauth/utilities/isDuplicateKeyError.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth/utilities/isDuplicateKeyError.ts"],"sourcesContent":["/**\n * Check if an error is a duplicate key/unique constraint violation from Content API.\n *\n * Content API returns HTTP 409 with \"conflict\" or \"already exists\" in the message.\n */\nexport function isDuplicateKeyError(error: unknown): boolean {\n  if (!error || typeof error !== 'object') {\n    return false\n  }\n\n  const err = error as { message?: unknown }\n  const message = typeof err.message === 'string' ? err.message : ''\n\n  return (\n    message.includes('409') ||\n    message.toLowerCase().includes('conflict') ||\n    message.toLowerCase().includes('already exists')\n  )\n}\n"],"names":["isDuplicateKeyError","error","err","message","includes","toLowerCase"],"mappings":"AAAA;;;;CAIC,GACD,OAAO,SAASA,oBAAoBC,KAAc;IAChD,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;QACvC,OAAO;IACT;IAEA,MAAMC,MAAMD;IACZ,MAAME,UAAU,OAAOD,IAAIC,OAAO,KAAK,WAAWD,IAAIC,OAAO,GAAG;IAEhE,OACEA,QAAQC,QAAQ,CAAC,UACjBD,QAAQE,WAAW,GAAGD,QAAQ,CAAC,eAC/BD,QAAQE,WAAW,GAAGD,QAAQ,CAAC;AAEnC"}