@payloadcms/figma 0.0.1-alpha.44 → 0.0.1-alpha.46

package/dist/oauth/defaults.js

@@ -1,6 +1,19 @@
+import { parseCookies } from 'payload';
 import { v4 as uuid } from 'uuid';
 import { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js';
 import { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js';
+function getFigmaUserInfo(headers) {
+    try {
+        const cookies = parseCookies(headers);
+        const encoded = cookies.get('figma-user-info');
+        if (!encoded) {
+            return null;
+        }
+        return JSON.parse(Buffer.from(encoded, 'base64').toString('utf-8'));
+    } catch  {
+        return null;
+    }
+}
 export const defaultScope = [
     'openid',
     'profile',
@@ -15,7 +28,7 @@ export const defaultUsernameField = {
     },
     unique: true
 };
-export const defaultVerify = ({ collection, strategyName, usernameField })=>async ({ payload, token })=>{
+export const defaultVerify = ({ collection, strategyName, usernameField })=>async ({ headers, payload, token })=>{
         let tokenUsername = 'preferred_username';
         if (usernameField.name !== 'preferredUsername') {
             tokenUsername = usernameField.name;
@@ -25,6 +38,13 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
                 user: null
             };
         }
+        const figmaUserInfo = getFigmaUserInfo(headers);
+        let responseHeaders;
+        // Clear the cookie after reading
+        if (figmaUserInfo) {
+            responseHeaders = new Headers();
+            responseHeaders.append('Set-Cookie', 'figma-user-info=; Max-Age=0; Path=/;');
+        }
         let user = null;
         const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined;
         try {
@@ -41,13 +61,19 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
             });
             if (results.docs.length > 0) {
                 user = results.docs[0];
-                // Update user with new token data
-                if (hasUserTokenPropsChanged(user, token)) {
+                // Check if update needed (token changed OR figma info missing/changed)
+                const userWithFigma = user;
+                const needsFigmaUpdate = figmaUserInfo && (userWithFigma.figmaHandle !== figmaUserInfo.handle || userWithFigma.figmaImageUrl !== figmaUserInfo.img_url);
+                if (hasUserTokenPropsChanged(user, token) || needsFigmaUpdate) {
                     user = await payload.update({
                         id: user.id,
                         collection: collection.slug,
                         data: {
-                            ...token
+                            ...token,
+                            ...figmaUserInfo && {
+                                figmaHandle: figmaUserInfo.handle,
+                                figmaImageUrl: figmaUserInfo.img_url
+                            }
                         },
                         depth
                     });
@@ -56,7 +82,11 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
                 const newUser = {
                     email: token.preferredUsername || token.email,
                     [usernameField.name]: token[tokenUsername],
-                    ...token
+                    ...token,
+                    ...figmaUserInfo && {
+                        figmaHandle: figmaUserInfo.handle,
+                        figmaImageUrl: figmaUserInfo.img_url
+                    }
                 };
                 if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {
                     newUser.password = uuid();
@@ -96,6 +126,7 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
                 msg: 'Error verifying user from defaultVerify.'
             });
             return {
+                responseHeaders,
                 user: null
             };
         }
@@ -104,10 +135,12 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
             user._strategy = strategyName;
             user.exp = token.exp;
             return {
+                responseHeaders,
                 user
             };
         }
         return {
+            responseHeaders,
             user: null
         };
     };

package/dist/oauth/defaults.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth/defaults.ts"],"sourcesContent":["import type { CollectionConfig, EmailField, TextField, User } from 'payload'\n\nimport { v4 as uuid } from 'uuid'\n\nimport type { VerifyFunction } from './types.js'\n\nimport { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js'\nimport { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js'\n\nexport const defaultScope = ['openid', 'profile', 'email']\n\nexport const defaultUsernameField: TextField = {\n  name: 'preferredUsername',\n  type: 'text',\n  admin: {\n    position: 'sidebar',\n    readOnly: true,\n  },\n  unique: true,\n}\n\nexport const defaultVerify =\n  ({\n    collection,\n    strategyName,\n    usernameField,\n  }: {\n    collection: CollectionConfig\n    strategyName: string\n    usernameField: EmailField | TextField\n  }): VerifyFunction =>\n  async ({ payload, token }) => {\n    let tokenUsername = 'preferred_username'\n\n    if (usernameField.name !== 'preferredUsername') {\n      tokenUsername = usernameField.name\n    }\n\n    if (!token[tokenUsername]) {\n      return {\n        user: null,\n      }\n    }\n\n    let user: null | User = null\n    const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined\n\n    try {\n      const results = await payload.find({\n        collection: collection.slug,\n        depth,\n        limit: 1,\n        pagination: false,\n        where: {\n          [usernameField.name]: { equals: token[tokenUsername] },\n        },\n      })\n\n      if (results.docs.length > 0) {\n        user = results.docs[0] as User\n        // Update user with new token data\n        if (hasUserTokenPropsChanged(user, token)) {\n          user = (await payload.update({\n            id: user.id,\n            collection: collection.slug,\n            data: {\n              ...token,\n            },\n            depth,\n          })) as User\n        }\n      } else {\n        const newUser = {\n          email: token.preferredUsername || token.email,\n          [usernameField.name]: token[tokenUsername],\n          ...token,\n        }\n\n        if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {\n          newUser.password = uuid()\n        }\n\n        try {\n          user = (await payload.create({\n            collection: collection.slug,\n            data: newUser,\n            depth,\n            overrideAccess: true,\n          })) as User\n        } catch (createErr: unknown) {\n          // Race condition: if unique constraint violation, user was created by concurrent request\n          if (isDuplicateKeyError(createErr)) {\n            const retryResults = await payload.find({\n              collection: collection.slug,\n              depth,\n              limit: 1,\n              pagination: false,\n              where: {\n                [usernameField.name]: { equals: token[tokenUsername] },\n              },\n            })\n\n            if (retryResults.docs.length > 0) {\n              user = retryResults.docs[0] as User\n            }\n          } else {\n            throw createErr\n          }\n        }\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying user from defaultVerify.',\n      })\n      return {\n        user: null,\n      }\n    }\n\n    if (user) {\n      user.collection = collection.slug\n      user._strategy = strategyName\n      user.exp = token.exp\n\n      return {\n        user,\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n"],"names":["v4","uuid","hasUserTokenPropsChanged","isDuplicateKeyError","defaultScope","defaultUsernameField","name","type","admin","position","readOnly","unique","defaultVerify","collection","strategyName","usernameField","payload","token","tokenUsername","user","depth","auth","undefined","results","find","slug","limit","pagination","where","equals","docs","length","update","id","data","newUser","email","preferredUsername","disableLocalStrategy","password","create","overrideAccess","createErr","retryResults","err","logger","error","msg","_strategy","exp"],"mappings":"AAEA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAIjC,SAASC,wBAAwB,QAAQ,0CAAyC;AAClF,SAASC,mBAAmB,QAAQ,qCAAoC;AAExE,OAAO,MAAMC,eAAe;IAAC;IAAU;IAAW;CAAQ,CAAA;AAE1D,OAAO,MAAMC,uBAAkC;IAC7CC,MAAM;IACNC,MAAM;IACNC,OAAO;QACLC,UAAU;QACVC,UAAU;IACZ;IACAC,QAAQ;AACV,EAAC;AAED,OAAO,MAAMC,gBACX,CAAC,EACCC,UAAU,EACVC,YAAY,EACZC,aAAa,EAKd,GACD,OAAO,EAAEC,OAAO,EAAEC,KAAK,EAAE;QACvB,IAAIC,gBAAgB;QAEpB,IAAIH,cAAcT,IAAI,KAAK,qBAAqB;YAC9CY,gBAAgBH,cAAcT,IAAI;QACpC;QAEA,IAAI,CAACW,KAAK,CAACC,cAAc,EAAE;YACzB,OAAO;gBACLC,MAAM;YACR;QACF;QAEA,IAAIA,OAAoB;QACxB,MAAMC,QAAQ,OAAOP,WAAWQ,IAAI,KAAK,WAAWR,WAAWQ,IAAI,CAACD,KAAK,GAAGE;QAE5E,IAAI;YACF,MAAMC,UAAU,MAAMP,QAAQQ,IAAI,CAAC;gBACjCX,YAAYA,WAAWY,IAAI;gBAC3BL;gBACAM,OAAO;gBACPC,YAAY;gBACZC,OAAO;oBACL,CAACb,cAAcT,IAAI,CAAC,EAAE;wBAAEuB,QAAQZ,KAAK,CAACC,cAAc;oBAAC;gBACvD;YACF;YAEA,IAAIK,QAAQO,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC3BZ,OAAOI,QAAQO,IAAI,CAAC,EAAE;gBACtB,kCAAkC;gBAClC,IAAI5B,yBAAyBiB,MAAMF,QAAQ;oBACzCE,OAAQ,MAAMH,QAAQgB,MAAM,CAAC;wBAC3BC,IAAId,KAAKc,EAAE;wBACXpB,YAAYA,WAAWY,IAAI;wBAC3BS,MAAM;4BACJ,GAAGjB,KAAK;wBACV;wBACAG;oBACF;gBACF;YACF,OAAO;gBACL,MAAMe,UAAU;oBACdC,OAAOnB,MAAMoB,iBAAiB,IAAIpB,MAAMmB,KAAK;oBAC7C,CAACrB,cAAcT,IAAI,CAAC,EAAEW,KAAK,CAACC,cAAc;oBAC1C,GAAGD,KAAK;gBACV;gBAEA,IAAI,OAAOJ,WAAWQ,IAAI,KAAK,YAAY,CAACR,WAAWQ,IAAI,CAACiB,oBAAoB,EAAE;oBAChFH,QAAQI,QAAQ,GAAGtC;gBACrB;gBAEA,IAAI;oBACFkB,OAAQ,MAAMH,QAAQwB,MAAM,CAAC;wBAC3B3B,YAAYA,WAAWY,IAAI;wBAC3BS,MAAMC;wBACNf;wBACAqB,gBAAgB;oBAClB;gBACF,EAAE,OAAOC,WAAoB;oBAC3B,yFAAyF;oBACzF,IAAIvC,oBAAoBuC,YAAY;wBAClC,MAAMC,eAAe,MAAM3B,QAAQQ,IAAI,CAAC;4BACtCX,YAAYA,WAAWY,IAAI;4BAC3BL;4BACAM,OAAO;4BACPC,YAAY;4BACZC,OAAO;gCACL,CAACb,cAAcT,IAAI,CAAC,EAAE;oCAAEuB,QAAQZ,KAAK,CAACC,cAAc;gCAAC;4BACvD;wBACF;wBAEA,IAAIyB,aAAab,IAAI,CAACC,MAAM,GAAG,GAAG;4BAChCZ,OAAOwB,aAAab,IAAI,CAAC,EAAE;wBAC7B;oBACF,OAAO;wBACL,MAAMY;oBACR;gBACF;YACF;QACF,EAAE,OAAOE,KAAc;YACrB5B,QAAQ6B,MAAM,CAACC,KAAK,CAAC;gBACnBF;gBACAG,KAAK;YACP;YACA,OAAO;gBACL5B,MAAM;YACR;QACF;QAEA,IAAIA,MAAM;YACRA,KAAKN,UAAU,GAAGA,WAAWY,IAAI;YACjCN,KAAK6B,SAAS,GAAGlC;YACjBK,KAAK8B,GAAG,GAAGhC,MAAMgC,GAAG;YAEpB,OAAO;gBACL9B;YACF;QACF;QAEA,OAAO;YACLA,MAAM;QACR;IACF,EAAC"}
+{"version":3,"sources":["../../src/oauth/defaults.ts"],"sourcesContent":["import type { CollectionConfig, EmailField, TextField, TypedUser } from 'payload'\n\nimport { parseCookies } from 'payload'\nimport { v4 as uuid } from 'uuid'\n\nimport type { VerifyFunction } from './types.js'\n\nimport { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js'\nimport { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js'\n\ntype FigmaUserInfoCookie = {\n  handle: string\n  img_url: string\n}\n\ntype UserWithFigmaFields = {\n  figmaHandle?: string\n  figmaImageUrl?: string\n} & TypedUser\n\nfunction getFigmaUserInfo(headers: Headers): FigmaUserInfoCookie | null {\n  try {\n    const cookies = parseCookies(headers)\n    const encoded = cookies.get('figma-user-info')\n    if (!encoded) {\n      return null\n    }\n    return JSON.parse(Buffer.from(encoded, 'base64').toString('utf-8'))\n  } catch {\n    return null\n  }\n}\n\nexport const defaultScope = ['openid', 'profile', 'email']\n\nexport const defaultUsernameField: TextField = {\n  name: 'preferredUsername',\n  type: 'text',\n  admin: {\n    position: 'sidebar',\n    readOnly: true,\n  },\n  unique: true,\n}\n\nexport const defaultVerify =\n  ({\n    collection,\n    strategyName,\n    usernameField,\n  }: {\n    collection: CollectionConfig\n    strategyName: string\n    usernameField: EmailField | TextField\n  }): VerifyFunction =>\n  async ({ headers, payload, token }) => {\n    let tokenUsername = 'preferred_username'\n\n    if (usernameField.name !== 'preferredUsername') {\n      tokenUsername = usernameField.name\n    }\n\n    if (!token[tokenUsername]) {\n      return {\n        user: null,\n      }\n    }\n\n    const figmaUserInfo = getFigmaUserInfo(headers)\n    let responseHeaders: Headers | undefined\n\n    // Clear the cookie after reading\n    if (figmaUserInfo) {\n      responseHeaders = new Headers()\n      responseHeaders.append('Set-Cookie', 'figma-user-info=; Max-Age=0; Path=/;')\n    }\n\n    let user: null | TypedUser | UserWithFigmaFields = null\n    const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined\n\n    try {\n      const results = await payload.find({\n        collection: collection.slug,\n        depth,\n        limit: 1,\n        pagination: false,\n        where: {\n          [usernameField.name]: { equals: token[tokenUsername] },\n        },\n      })\n\n      if (results.docs.length > 0) {\n        user = results.docs[0] as UserWithFigmaFields\n\n        // Check if update needed (token changed OR figma info missing/changed)\n        const userWithFigma = user\n        const needsFigmaUpdate =\n          figmaUserInfo &&\n          (userWithFigma.figmaHandle !== figmaUserInfo.handle ||\n            userWithFigma.figmaImageUrl !== figmaUserInfo.img_url)\n\n        if (hasUserTokenPropsChanged(user, token) || needsFigmaUpdate) {\n          user = (await payload.update({\n            id: user.id,\n            collection: collection.slug,\n            data: {\n              ...token,\n              ...(figmaUserInfo && {\n                figmaHandle: figmaUserInfo.handle,\n                figmaImageUrl: figmaUserInfo.img_url,\n              }),\n            },\n            depth,\n          })) as TypedUser\n        }\n      } else {\n        const newUser: Record<string, unknown> = {\n          email: token.preferredUsername || token.email,\n          [usernameField.name]: token[tokenUsername],\n          ...token,\n          ...(figmaUserInfo && {\n            figmaHandle: figmaUserInfo.handle,\n            figmaImageUrl: figmaUserInfo.img_url,\n          }),\n        }\n\n        if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {\n          newUser.password = uuid()\n        }\n\n        try {\n          user = (await payload.create({\n            collection: collection.slug,\n            data: newUser,\n            depth,\n            overrideAccess: true,\n          })) as TypedUser\n        } catch (createErr: unknown) {\n          // Race condition: if unique constraint violation, user was created by concurrent request\n          if (isDuplicateKeyError(createErr)) {\n            const retryResults = await payload.find({\n              collection: collection.slug,\n              depth,\n              limit: 1,\n              pagination: false,\n              where: {\n                [usernameField.name]: { equals: token[tokenUsername] },\n              },\n            })\n\n            if (retryResults.docs.length > 0) {\n              user = retryResults.docs[0] as TypedUser\n            }\n          } else {\n            throw createErr\n          }\n        }\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying user from defaultVerify.',\n      })\n      return {\n        responseHeaders,\n        user: null,\n      }\n    }\n\n    if (user) {\n      user.collection = collection.slug\n      user._strategy = strategyName\n      user.exp = token.exp\n\n      return {\n        responseHeaders,\n        user,\n      }\n    }\n\n    return {\n      responseHeaders,\n      user: null,\n    }\n  }\n"],"names":["parseCookies","v4","uuid","hasUserTokenPropsChanged","isDuplicateKeyError","getFigmaUserInfo","headers","cookies","encoded","get","JSON","parse","Buffer","from","toString","defaultScope","defaultUsernameField","name","type","admin","position","readOnly","unique","defaultVerify","collection","strategyName","usernameField","payload","token","tokenUsername","user","figmaUserInfo","responseHeaders","Headers","append","depth","auth","undefined","results","find","slug","limit","pagination","where","equals","docs","length","userWithFigma","needsFigmaUpdate","figmaHandle","handle","figmaImageUrl","img_url","update","id","data","newUser","email","preferredUsername","disableLocalStrategy","password","create","overrideAccess","createErr","retryResults","err","logger","error","msg","_strategy","exp"],"mappings":"AAEA,SAASA,YAAY,QAAQ,UAAS;AACtC,SAASC,MAAMC,IAAI,QAAQ,OAAM;AAIjC,SAASC,wBAAwB,QAAQ,0CAAyC;AAClF,SAASC,mBAAmB,QAAQ,qCAAoC;AAYxE,SAASC,iBAAiBC,OAAgB;IACxC,IAAI;QACF,MAAMC,UAAUP,aAAaM;QAC7B,MAAME,UAAUD,QAAQE,GAAG,CAAC;QAC5B,IAAI,CAACD,SAAS;YACZ,OAAO;QACT;QACA,OAAOE,KAAKC,KAAK,CAACC,OAAOC,IAAI,CAACL,SAAS,UAAUM,QAAQ,CAAC;IAC5D,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,OAAO,MAAMC,eAAe;IAAC;IAAU;IAAW;CAAQ,CAAA;AAE1D,OAAO,MAAMC,uBAAkC;IAC7CC,MAAM;IACNC,MAAM;IACNC,OAAO;QACLC,UAAU;QACVC,UAAU;IACZ;IACAC,QAAQ;AACV,EAAC;AAED,OAAO,MAAMC,gBACX,CAAC,EACCC,UAAU,EACVC,YAAY,EACZC,aAAa,EAKd,GACD,OAAO,EAAEpB,OAAO,EAAEqB,OAAO,EAAEC,KAAK,EAAE;QAChC,IAAIC,gBAAgB;QAEpB,IAAIH,cAAcT,IAAI,KAAK,qBAAqB;YAC9CY,gBAAgBH,cAAcT,IAAI;QACpC;QAEA,IAAI,CAACW,KAAK,CAACC,cAAc,EAAE;YACzB,OAAO;gBACLC,MAAM;YACR;QACF;QAEA,MAAMC,gBAAgB1B,iBAAiBC;QACvC,IAAI0B;QAEJ,iCAAiC;QACjC,IAAID,eAAe;YACjBC,kBAAkB,IAAIC;YACtBD,gBAAgBE,MAAM,CAAC,cAAc;QACvC;QAEA,IAAIJ,OAA+C;QACnD,MAAMK,QAAQ,OAAOX,WAAWY,IAAI,KAAK,WAAWZ,WAAWY,IAAI,CAACD,KAAK,GAAGE;QAE5E,IAAI;YACF,MAAMC,UAAU,MAAMX,QAAQY,IAAI,CAAC;gBACjCf,YAAYA,WAAWgB,IAAI;gBAC3BL;gBACAM,OAAO;gBACPC,YAAY;gBACZC,OAAO;oBACL,CAACjB,cAAcT,IAAI,CAAC,EAAE;wBAAE2B,QAAQhB,KAAK,CAACC,cAAc;oBAAC;gBACvD;YACF;YAEA,IAAIS,QAAQO,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC3BhB,OAAOQ,QAAQO,IAAI,CAAC,EAAE;gBAEtB,uEAAuE;gBACvE,MAAME,gBAAgBjB;gBACtB,MAAMkB,mBACJjB,iBACCgB,CAAAA,cAAcE,WAAW,KAAKlB,cAAcmB,MAAM,IACjDH,cAAcI,aAAa,KAAKpB,cAAcqB,OAAO,AAAD;gBAExD,IAAIjD,yBAAyB2B,MAAMF,UAAUoB,kBAAkB;oBAC7DlB,OAAQ,MAAMH,QAAQ0B,MAAM,CAAC;wBAC3BC,IAAIxB,KAAKwB,EAAE;wBACX9B,YAAYA,WAAWgB,IAAI;wBAC3Be,MAAM;4BACJ,GAAG3B,KAAK;4BACR,GAAIG,iBAAiB;gCACnBkB,aAAalB,cAAcmB,MAAM;gCACjCC,eAAepB,cAAcqB,OAAO;4BACtC,CAAC;wBACH;wBACAjB;oBACF;gBACF;YACF,OAAO;gBACL,MAAMqB,UAAmC;oBACvCC,OAAO7B,MAAM8B,iBAAiB,IAAI9B,MAAM6B,KAAK;oBAC7C,CAAC/B,cAAcT,IAAI,CAAC,EAAEW,KAAK,CAACC,cAAc;oBAC1C,GAAGD,KAAK;oBACR,GAAIG,iBAAiB;wBACnBkB,aAAalB,cAAcmB,MAAM;wBACjCC,eAAepB,cAAcqB,OAAO;oBACtC,CAAC;gBACH;gBAEA,IAAI,OAAO5B,WAAWY,IAAI,KAAK,YAAY,CAACZ,WAAWY,IAAI,CAACuB,oBAAoB,EAAE;oBAChFH,QAAQI,QAAQ,GAAG1D;gBACrB;gBAEA,IAAI;oBACF4B,OAAQ,MAAMH,QAAQkC,MAAM,CAAC;wBAC3BrC,YAAYA,WAAWgB,IAAI;wBAC3Be,MAAMC;wBACNrB;wBACA2B,gBAAgB;oBAClB;gBACF,EAAE,OAAOC,WAAoB;oBAC3B,yFAAyF;oBACzF,IAAI3D,oBAAoB2D,YAAY;wBAClC,MAAMC,eAAe,MAAMrC,QAAQY,IAAI,CAAC;4BACtCf,YAAYA,WAAWgB,IAAI;4BAC3BL;4BACAM,OAAO;4BACPC,YAAY;4BACZC,OAAO;gCACL,CAACjB,cAAcT,IAAI,CAAC,EAAE;oCAAE2B,QAAQhB,KAAK,CAACC,cAAc;gCAAC;4BACvD;wBACF;wBAEA,IAAImC,aAAanB,IAAI,CAACC,MAAM,GAAG,GAAG;4BAChChB,OAAOkC,aAAanB,IAAI,CAAC,EAAE;wBAC7B;oBACF,OAAO;wBACL,MAAMkB;oBACR;gBACF;YACF;QACF,EAAE,OAAOE,KAAc;YACrBtC,QAAQuC,MAAM,CAACC,KAAK,CAAC;gBACnBF;gBACAG,KAAK;YACP;YACA,OAAO;gBACLpC;gBACAF,MAAM;YACR;QACF;QAEA,IAAIA,MAAM;YACRA,KAAKN,UAAU,GAAGA,WAAWgB,IAAI;YACjCV,KAAKuC,SAAS,GAAG5C;YACjBK,KAAKwC,GAAG,GAAG1C,MAAM0C,GAAG;YAEpB,OAAO;gBACLtC;gBACAF;YACF;QACF;QAEA,OAAO;YACLE;YACAF,MAAM;QACR;IACF,EAAC"}

package/dist/oauth/endpoints/getLoginEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getLoginEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getLoginEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAKzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAY,MAAM,aAAa,CAAA;AAQ7E,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAID,eAAO,MAAM,gBAAgB,8EAM1B,IAAI,KAAG,QA4PR,CAAA"}
+{"version":3,"file":"getLoginEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getLoginEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAMzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAY,MAAM,aAAa,CAAA;AAQ7E,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAID,eAAO,MAAM,gBAAgB,8EAM1B,IAAI,KAAG,QAyRR,CAAA"}

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -1,6 +1,6 @@
 import { APIError, generateCookie, parseCookies } from 'payload';
 import { formatAdminURL, getSafeRedirect } from 'payload/shared';
-import { getProjectToken } from '../../api/figma-api.js';
+import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
 import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
@@ -159,12 +159,40 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     tokenRes
                 });
                 const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
-                debugLogger.info({
-                    msg: 'tokenResss',
-                    tokenRes
-                });
+                if (error) {
+                    req.payload.logger.error('Error swapping access code with access token:');
+                    req.payload.logger.error({
+                        err: error,
+                        error_description
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                // Fetch Figma user info for handle and profile image
+                let figmaUserInfo = null;
+                try {
+                    figmaUserInfo = await getUserInfo(access_token);
+                    debugLogger.info({
+                        figmaUserInfo,
+                        msg: 'Fetched Figma user info'
+                    });
+                } catch (err) {
+                    // Non-fatal: user will just not have handle/image
+                    debugLogger.error({
+                        err,
+                        msg: 'Failed to fetch Figma user info'
+                    });
+                }
+                if (!access_token) {
+                    const errMsg = 'No access_token was returned from the identity provider.';
+                    req.payload.logger.error({
+                        msg: errMsg,
+                        path,
+                        tokenRes
+                    });
+                    throw new APIError(errMsg);
+                }
                 // Swap for project token
-                const project_token = await getProjectToken(tokenRes.access_token, config.custom.figma.contentSystemId);
+                const project_token = await getProjectToken(access_token, config.custom.figma.contentSystemId);
                 const refresh_token = access_token;
                 // Store project token as access_token
                 const token = project_token.token;
@@ -182,14 +210,6 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     headers: req.headers,
                     pluginOptions
                 });
-                if (error) {
-                    req.payload.logger.error('Error swapping access code with access token:');
-                    req.payload.logger.error({
-                        err: error,
-                        error_description
-                    });
-                    return Response.redirect(failedRedirect);
-                }
                 // get the payloadRedirect cookie value
                 const cookies = parseCookies(req.headers);
                 const payloadRedirect = 'payloadRedirect' in cookies ? cookies.payloadRedirect : '';
@@ -226,6 +246,21 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     value: token
                 });
                 req.responseHeaders.append('Set-Cookie', tokenCookie);
+                // Store user info in short-lived cookie for defaultVerify to consume
+                if (figmaUserInfo) {
+                    const userInfoValue = Buffer.from(JSON.stringify({
+                        handle: figmaUserInfo.handle,
+                        img_url: figmaUserInfo.img_url
+                    })).toString('base64');
+                    const userInfoCookie = generateCookie({
+                        ...cookieOptions,
+                        name: 'figma-user-info',
+                        expires: new Date(Date.now() + 60_000),
+                        returnCookieAsObject: false,
+                        value: userInfoValue
+                    });
+                    req.responseHeaders.append('Set-Cookie', userInfoCookie);
+                }
                 return Response.redirect(redirectToUse);
             } catch (err) {
                 req.payload.logger.error({

package/dist/oauth/endpoints/getLoginEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/endpoints/getLoginEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport { APIError, generateCookie, parseCookies } from 'payload'\nimport { formatAdminURL, getSafeRedirect } from 'payload/shared'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { CollectionOptions, PluginOptions, StateObj } from '../types.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { extractOrigin } from '../utilities/extractOrigin.js'\nimport { getCookieExpiration } from '../utilities/getCookieExpiration.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nconst isAbsoluteURL = (url: string) => /^[a-z][a-z\\d+.-]*:/.test(url)\n\nexport const getLoginEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const { config } = req.payload\n    const adminRoute = config.routes?.admin || '/admin'\n\n    try {\n      await strategy.ensureMeta()\n\n      const path = req.pathname\n      const debugLogger = createDebugLogger(req.payload, pluginOptions.debug)\n\n      let jsonBody: Record<string, unknown> = {}\n\n      const contentType = req.headers.get('content-type')\n\n      // Type narrow PayloadRequst's Partial<Request>\n      if (typeof req.json !== 'function' || typeof req.formData !== 'function') {\n        debugLogger.info({\n          msg: 'Request does not have json or formData methods',\n          path,\n        })\n\n        return Response.redirect(`${pluginOptions.redirectServerURL || config.serverURL}/login`)\n      }\n\n      if (collectionOptions.authorizationURLParams?.response_mode === 'query') {\n        if (Object.keys(req.query).length > 0) {\n          jsonBody = req.query\n        }\n      } else if (contentType === 'application/json') {\n        jsonBody = await req.json()\n      } else if (contentType === 'application/x-www-form-urlencoded') {\n        const formData = await req.formData()\n        jsonBody = Object.fromEntries(formData.entries())\n      }\n\n      const stateRaw = jsonBody.state as string\n      const state: StateObj = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'))\n\n      const redirectServerURL =\n        state.serverURL || pluginOptions.redirectServerURL || config.serverURL\n      let failedRedirect = formatAdminURL({\n        adminRoute,\n        path: '/login',\n        serverURL: redirectServerURL,\n      })\n      let redirectToUse = formatAdminURL({\n        adminRoute,\n        serverURL: redirectServerURL,\n      })\n\n      if (state.redirect) {\n        redirectToUse = state.redirect\n      }\n\n      if (state.failedRedirect) {\n        failedRedirect = state.failedRedirect\n      }\n\n      failedRedirect = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: failedRedirect })\n      redirectToUse = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: redirectToUse })\n\n      if (!isAbsoluteURL(failedRedirect)) {\n        return Response.json({ error: 'Invalid failed redirect provided' }, { status: 403 })\n      }\n      if (!isAbsoluteURL(redirectToUse)) {\n        return Response.json({ error: 'Invalid redirect provided' }, { status: 403 })\n      }\n\n      if (Array.isArray(req.payload.config.csrf) && req.payload.config.csrf.length > 0) {\n        const failedRedirectOrigin = extractOrigin(failedRedirect)\n        const redirectToUseOrigin = extractOrigin(redirectToUse)\n\n        if (failedRedirectOrigin && !req.payload.config.csrf.includes(failedRedirectOrigin)) {\n          req.payload.logger.error(\n            `Failed redirect origin ${failedRedirectOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Failed redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n\n        if (redirectToUseOrigin && !req.payload.config.csrf.includes(redirectToUseOrigin)) {\n          req.payload.logger.error(\n            `Redirect origin ${redirectToUseOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n      }\n\n      // Verify signature\n      if (strategy.name !== req.payload.decrypt(state.sig)) {\n        req.payload.logger.error('Signature mismatch. Failing login and redirecting.')\n        return Response.redirect(failedRedirect)\n      }\n\n      if (!strategy.meta?.token_endpoint) {\n        debugLogger.error({\n          msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      debugLogger.info({ body: jsonBody, msg: 'Received login response body', path })\n\n      if (!jsonBody?.code) {\n        debugLogger.error({\n          msg: `No authorization code present in body. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      // Exchange `code` from body for refresh token\n      const { code } = jsonBody\n\n      if (typeof code !== 'string') {\n        debugLogger.error({\n          msg: `Authorization code present in body is not a string. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      const body: Record<string, string> = {\n        client_id: strategy.clientID,\n        code,\n        code_verifier: req.payload.decrypt(state.verifier),\n        grant_type: 'authorization_code',\n        redirect_uri: formatAdminURL({\n          apiRoute: config.routes?.api || '/api',\n          path: `/${collection.slug}/${endpointSlug}/login`,\n          serverURL: redirectServerURL,\n        }),\n      }\n\n      if (strategy.collectionOptions.clientSecret) {\n        body.client_secret = strategy.collectionOptions.clientSecret\n      }\n\n      debugLogger.info({\n        msg: 'Exchanging code for access token',\n        path,\n        requestBody: body,\n      })\n\n      const tokenRes = await fetch(strategy.meta?.token_endpoint, {\n        body: new URLSearchParams(body),\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        method: 'POST',\n      }).then((r) => r.json())\n\n      debugLogger.info({ msg: 'Token Response', path, tokenRes })\n\n      const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes\n\n      debugLogger.info({ msg: 'tokenResss', tokenRes })\n\n      // Swap for project token\n      const project_token = await getProjectToken(\n        tokenRes.access_token,\n        config.custom.figma.contentSystemId,\n      )\n      const refresh_token = access_token\n\n      // Store project token as access_token\n\n      const token = project_token.token\n      const expiresIn = project_token.expiresAt\n\n      if (!token) {\n        const errMsg = `No ${\n          collectionOptions.token || 'access_token'\n        } was returned from the identity provider.`\n        req.payload.logger.error({ msg: errMsg, path })\n        throw new APIError(errMsg)\n      }\n\n      const cookieOptions = createCookieOptions({ collection, headers: req.headers, pluginOptions })\n\n      if (error) {\n        req.payload.logger.error('Error swapping access code with access token:')\n        req.payload.logger.error({ err: error, error_description })\n        return Response.redirect(failedRedirect)\n      }\n\n      // get the payloadRedirect cookie value\n      const cookies = parseCookies(req.headers)\n\n      const payloadRedirect =\n        'payloadRedirect' in cookies ? (cookies.payloadRedirect as string) : ''\n\n      if (!req.responseHeaders) {\n        req.responseHeaders = new Headers()\n      }\n\n      if (payloadRedirect) {\n        if (isAbsoluteURL(payloadRedirect)) {\n          redirectToUse = payloadRedirect\n        } else {\n          redirectToUse += payloadRedirect\n        }\n\n        req.responseHeaders.append(\n          'Set-Cookie',\n          `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`,\n        )\n      }\n\n      if (refresh_token && !collectionOptions.usePayloadJWT) {\n        debugLogger.info('Setting refresh token cookie')\n        const refreshCookie = generateCookie({\n          returnCookieAsObject: false,\n          ...cookieOptions,\n          name: `${strategy.cookieName}-refresh`,\n          value: refresh_token,\n          // Default to 1 year if no expiration\n          expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952),\n        }) as string\n\n        req.responseHeaders.append('Set-Cookie', refreshCookie)\n      }\n\n      const tokenExpires = cookieOptions?.expires\n        ? getCookieExpiration(cookieOptions.expires)\n        : new Date(expiresIn) // Project token uses epoch time\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: tokenExpires,\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      req.responseHeaders.append('Set-Cookie', tokenCookie)\n\n      return Response.redirect(redirectToUse)\n    } catch (err: unknown) {\n      req.payload.logger.error({ err, msg: 'Error while attempting to login', path: req.pathname })\n\n      return Response.json({ error: 'Error while attempting to login' }, { status: 500 })\n    }\n  },\n  method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',\n  path: `/${endpointSlug}/login`,\n})\n"],"names":["APIError","generateCookie","parseCookies","formatAdminURL","getSafeRedirect","getProjectToken","createCookieOptions","createDebugLogger","extractOrigin","getCookieExpiration","isAbsoluteURL","url","test","getLoginEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","config","payload","adminRoute","routes","admin","ensureMeta","path","pathname","debugLogger","debug","jsonBody","contentType","headers","get","json","formData","info","msg","Response","redirect","redirectServerURL","serverURL","authorizationURLParams","response_mode","Object","keys","query","length","fromEntries","entries","stateRaw","state","JSON","parse","Buffer","from","toString","failedRedirect","redirectToUse","allowAbsoluteUrls","redirectTo","error","status","Array","isArray","csrf","failedRedirectOrigin","redirectToUseOrigin","includes","logger","name","decrypt","sig","meta","token_endpoint","body","code","client_id","clientID","code_verifier","verifier","grant_type","redirect_uri","apiRoute","api","slug","clientSecret","client_secret","requestBody","tokenRes","fetch","URLSearchParams","method","then","r","access_token","error_description","expires_in","refreshTokenExpires","project_token","custom","figma","contentSystemId","refresh_token","token","expiresIn","expiresAt","errMsg","cookieOptions","err","cookies","payloadRedirect","responseHeaders","Headers","append","usePayloadJWT","refreshCookie","returnCookieAsObject","cookieName","value","expires","tokenExpires","Date","tokenCookie"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,cAAc,EAAEC,YAAY,QAAQ,UAAS;AAChE,SAASC,cAAc,EAAEC,eAAe,QAAQ,iBAAgB;AAKhE,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,aAAa,QAAQ,gCAA+B;AAC7D,SAASC,mBAAmB,QAAQ,sCAAqC;AAUzE,MAAMC,gBAAgB,CAACC,MAAgB,qBAAqBC,IAAI,CAACD;AAEjE,OAAO,MAAME,mBAAmB,CAAC,EAC/BC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAM,EAAEC,MAAM,EAAE,GAAGD,IAAIE,OAAO;YAC9B,MAAMC,aAAaF,OAAOG,MAAM,EAAEC,SAAS;YAE3C,IAAI;gBACF,MAAMP,SAASQ,UAAU;gBAEzB,MAAMC,OAAOP,IAAIQ,QAAQ;gBACzB,MAAMC,cAActB,kBAAkBa,IAAIE,OAAO,EAAEL,cAAca,KAAK;gBAEtE,IAAIC,WAAoC,CAAC;gBAEzC,MAAMC,cAAcZ,IAAIa,OAAO,CAACC,GAAG,CAAC;gBAEpC,+CAA+C;gBAC/C,IAAI,OAAOd,IAAIe,IAAI,KAAK,cAAc,OAAOf,IAAIgB,QAAQ,KAAK,YAAY;oBACxEP,YAAYQ,IAAI,CAAC;wBACfC,KAAK;wBACLX;oBACF;oBAEA,OAAOY,SAASC,QAAQ,CAAC,GAAGvB,cAAcwB,iBAAiB,IAAIpB,OAAOqB,SAAS,CAAC,MAAM,CAAC;gBACzF;gBAEA,IAAI3B,kBAAkB4B,sBAAsB,EAAEC,kBAAkB,SAAS;oBACvE,IAAIC,OAAOC,IAAI,CAAC1B,IAAI2B,KAAK,EAAEC,MAAM,GAAG,GAAG;wBACrCjB,WAAWX,IAAI2B,KAAK;oBACtB;gBACF,OAAO,IAAIf,gBAAgB,oBAAoB;oBAC7CD,WAAW,MAAMX,IAAIe,IAAI;gBAC3B,OAAO,IAAIH,gBAAgB,qCAAqC;oBAC9D,MAAMI,WAAW,MAAMhB,IAAIgB,QAAQ;oBACnCL,WAAWc,OAAOI,WAAW,CAACb,SAASc,OAAO;gBAChD;gBAEA,MAAMC,WAAWpB,SAASqB,KAAK;gBAC/B,MAAMA,QAAkBC,KAAKC,KAAK,CAACC,OAAOC,IAAI,CAACL,UAAU,UAAUM,QAAQ,CAAC;gBAE5E,MAAMhB,oBACJW,MAAMV,SAAS,IAAIzB,cAAcwB,iBAAiB,IAAIpB,OAAOqB,SAAS;gBACxE,IAAIgB,iBAAiBvD,eAAe;oBAClCoB;oBACAI,MAAM;oBACNe,WAAWD;gBACb;gBACA,IAAIkB,gBAAgBxD,eAAe;oBACjCoB;oBACAmB,WAAWD;gBACb;gBAEA,IAAIW,MAAMZ,QAAQ,EAAE;oBAClBmB,gBAAgBP,MAAMZ,QAAQ;gBAChC;gBAEA,IAAIY,MAAMM,cAAc,EAAE;oBACxBA,iBAAiBN,MAAMM,cAAc;gBACvC;gBAEAA,iBAAiBtD,gBAAgB;oBAAEwD,mBAAmB;oBAAMC,YAAYH;gBAAe;gBACvFC,gBAAgBvD,gBAAgB;oBAAEwD,mBAAmB;oBAAMC,YAAYF;gBAAc;gBAErF,IAAI,CAACjD,cAAcgD,iBAAiB;oBAClC,OAAOnB,SAASJ,IAAI,CAAC;wBAAE2B,OAAO;oBAAmC,GAAG;wBAAEC,QAAQ;oBAAI;gBACpF;gBACA,IAAI,CAACrD,cAAciD,gBAAgB;oBACjC,OAAOpB,SAASJ,IAAI,CAAC;wBAAE2B,OAAO;oBAA4B,GAAG;wBAAEC,QAAQ;oBAAI;gBAC7E;gBAEA,IAAIC,MAAMC,OAAO,CAAC7C,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,KAAK9C,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,CAAClB,MAAM,GAAG,GAAG;oBAChF,MAAMmB,uBAAuB3D,cAAckD;oBAC3C,MAAMU,sBAAsB5D,cAAcmD;oBAE1C,IAAIQ,wBAAwB,CAAC/C,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,CAACG,QAAQ,CAACF,uBAAuB;wBACnF/C,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CACtB,CAAC,uBAAuB,EAAEK,qBAAqB,sCAAsC,CAAC;wBAExF,OAAO5B,SAASJ,IAAI,CAClB;4BAAE2B,OAAO;wBAA+D,GACxE;4BAAEC,QAAQ;wBAAI;oBAElB;oBAEA,IAAIK,uBAAuB,CAAChD,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,CAACG,QAAQ,CAACD,sBAAsB;wBACjFhD,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CACtB,CAAC,gBAAgB,EAAEM,oBAAoB,sCAAsC,CAAC;wBAEhF,OAAO7B,SAASJ,IAAI,CAClB;4BAAE2B,OAAO;wBAAwD,GACjE;4BAAEC,QAAQ;wBAAI;oBAElB;gBACF;gBAEA,mBAAmB;gBACnB,IAAI7C,SAASqD,IAAI,KAAKnD,IAAIE,OAAO,CAACkD,OAAO,CAACpB,MAAMqB,GAAG,GAAG;oBACpDrD,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;oBACzB,OAAOvB,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,IAAI,CAACxC,SAASwD,IAAI,EAAEC,gBAAgB;oBAClC9C,YAAYiC,KAAK,CAAC;wBAChBxB,KAAK,CAAC,mFAAmF,CAAC;wBAC1FX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA7B,YAAYQ,IAAI,CAAC;oBAAEuC,MAAM7C;oBAAUO,KAAK;oBAAgCX;gBAAK;gBAE7E,IAAI,CAACI,UAAU8C,MAAM;oBACnBhD,YAAYiC,KAAK,CAAC;wBAChBxB,KAAK,CAAC,qEAAqE,CAAC;wBAC5EX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,8CAA8C;gBAC9C,MAAM,EAAEmB,IAAI,EAAE,GAAG9C;gBAEjB,IAAI,OAAO8C,SAAS,UAAU;oBAC5BhD,YAAYiC,KAAK,CAAC;wBAChBxB,KAAK,CAAC,kFAAkF,CAAC;wBACzFX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,MAAMkB,OAA+B;oBACnCE,WAAW5D,SAAS6D,QAAQ;oBAC5BF;oBACAG,eAAe5D,IAAIE,OAAO,CAACkD,OAAO,CAACpB,MAAM6B,QAAQ;oBACjDC,YAAY;oBACZC,cAAchF,eAAe;wBAC3BiF,UAAU/D,OAAOG,MAAM,EAAE6D,OAAO;wBAChC1D,MAAM,CAAC,CAAC,EAAEb,WAAWwE,IAAI,CAAC,CAAC,EAAEtE,aAAa,MAAM,CAAC;wBACjD0B,WAAWD;oBACb;gBACF;gBAEA,IAAIvB,SAASH,iBAAiB,CAACwE,YAAY,EAAE;oBAC3CX,KAAKY,aAAa,GAAGtE,SAASH,iBAAiB,CAACwE,YAAY;gBAC9D;gBAEA1D,YAAYQ,IAAI,CAAC;oBACfC,KAAK;oBACLX;oBACA8D,aAAab;gBACf;gBAEA,MAAMc,WAAW,MAAMC,MAAMzE,SAASwD,IAAI,EAAEC,gBAAgB;oBAC1DC,MAAM,IAAIgB,gBAAgBhB;oBAC1B3C,SAAS;wBACP,gBAAgB;oBAClB;oBACA4D,QAAQ;gBACV,GAAGC,IAAI,CAAC,CAACC,IAAMA,EAAE5D,IAAI;gBAErBN,YAAYQ,IAAI,CAAC;oBAAEC,KAAK;oBAAkBX;oBAAM+D;gBAAS;gBAEzD,MAAM,EAAEM,YAAY,EAAElC,KAAK,EAAEmC,iBAAiB,EAAEC,YAAYC,mBAAmB,EAAE,GAAGT;gBAEpF7D,YAAYQ,IAAI,CAAC;oBAAEC,KAAK;oBAAcoD;gBAAS;gBAE/C,yBAAyB;gBACzB,MAAMU,gBAAgB,MAAM/F,gBAC1BqF,SAASM,YAAY,EACrB3E,OAAOgF,MAAM,CAACC,KAAK,CAACC,eAAe;gBAErC,MAAMC,gBAAgBR;gBAEtB,sCAAsC;gBAEtC,MAAMS,QAAQL,cAAcK,KAAK;gBACjC,MAAMC,YAAYN,cAAcO,SAAS;gBAEzC,IAAI,CAACF,OAAO;oBACV,MAAMG,SAAS,CAAC,GAAG,EACjB7F,kBAAkB0F,KAAK,IAAI,eAC5B,yCAAyC,CAAC;oBAC3CrF,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;wBAAExB,KAAKsE;wBAAQjF;oBAAK;oBAC7C,MAAM,IAAI3B,SAAS4G;gBACrB;gBAEA,MAAMC,gBAAgBvG,oBAAoB;oBAAEQ;oBAAYmB,SAASb,IAAIa,OAAO;oBAAEhB;gBAAc;gBAE5F,IAAI6C,OAAO;oBACT1C,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;oBACzB1C,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;wBAAEgD,KAAKhD;wBAAOmC;oBAAkB;oBACzD,OAAO1D,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,uCAAuC;gBACvC,MAAMqD,UAAU7G,aAAakB,IAAIa,OAAO;gBAExC,MAAM+E,kBACJ,qBAAqBD,UAAWA,QAAQC,eAAe,GAAc;gBAEvE,IAAI,CAAC5F,IAAI6F,eAAe,EAAE;oBACxB7F,IAAI6F,eAAe,GAAG,IAAIC;gBAC5B;gBAEA,IAAIF,iBAAiB;oBACnB,IAAItG,cAAcsG,kBAAkB;wBAClCrD,gBAAgBqD;oBAClB,OAAO;wBACLrD,iBAAiBqD;oBACnB;oBAEA5F,IAAI6F,eAAe,CAACE,MAAM,CACxB,cACA,CAAC,gBAAgB,EAAExD,cAAc,oBAAoB,CAAC;gBAE1D;gBAEA,IAAI6C,iBAAiB,CAACzF,kBAAkBqG,aAAa,EAAE;oBACrDvF,YAAYQ,IAAI,CAAC;oBACjB,MAAMgF,gBAAgBpH,eAAe;wBACnCqH,sBAAsB;wBACtB,GAAGT,aAAa;wBAChBtC,MAAM,GAAGrD,SAASqG,UAAU,CAAC,QAAQ,CAAC;wBACtCC,OAAOhB;wBACP,qCAAqC;wBACrCiB,SAAShH,oBAAoBoG,eAAeY,WAAWtB,uBAAuB;oBAChF;oBAEA/E,IAAI6F,eAAe,CAACE,MAAM,CAAC,cAAcE;gBAC3C;gBAEA,MAAMK,eAAeb,eAAeY,UAChChH,oBAAoBoG,cAAcY,OAAO,IACzC,IAAIE,KAAKjB,WAAW,gCAAgC;;gBACxD,MAAMkB,cAAc3H,eAAe;oBACjC,GAAG4G,aAAa;oBAChBtC,MAAMrD,SAASqG,UAAU;oBACzBE,SAASC;oBACTJ,sBAAsB;oBACtBE,OAAOf;gBACT;gBAEArF,IAAI6F,eAAe,CAACE,MAAM,CAAC,cAAcS;gBAEzC,OAAOrF,SAASC,QAAQ,CAACmB;YAC3B,EAAE,OAAOmD,KAAc;gBACrB1F,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;oBAAEgD;oBAAKxE,KAAK;oBAAmCX,MAAMP,IAAIQ,QAAQ;gBAAC;gBAE3F,OAAOW,SAASJ,IAAI,CAAC;oBAAE2B,OAAO;gBAAkC,GAAG;oBAAEC,QAAQ;gBAAI;YACnF;QACF;QACA8B,QAAQ9E,kBAAkB4B,sBAAsB,EAAEC,kBAAkB,UAAU,QAAQ;QACtFjB,MAAM,CAAC,CAAC,EAAEX,aAAa,MAAM,CAAC;IAChC,CAAA,EAAE"}
+{"version":3,"sources":["../../../src/oauth/endpoints/getLoginEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport { APIError, generateCookie, parseCookies } from 'payload'\nimport { formatAdminURL, getSafeRedirect } from 'payload/shared'\n\nimport type { FigmaUserInfo } from '../../api/figma-api.js'\nimport type { Strategy } from '../strategy/index.js'\nimport type { CollectionOptions, PluginOptions, StateObj } from '../types.js'\n\nimport { getProjectToken, getUserInfo } from '../../api/figma-api.js'\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { extractOrigin } from '../utilities/extractOrigin.js'\nimport { getCookieExpiration } from '../utilities/getCookieExpiration.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nconst isAbsoluteURL = (url: string) => /^[a-z][a-z\\d+.-]*:/.test(url)\n\nexport const getLoginEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const { config } = req.payload\n    const adminRoute = config.routes?.admin || '/admin'\n\n    try {\n      await strategy.ensureMeta()\n\n      const path = req.pathname\n      const debugLogger = createDebugLogger(req.payload, pluginOptions.debug)\n\n      let jsonBody: Record<string, unknown> = {}\n\n      const contentType = req.headers.get('content-type')\n\n      // Type narrow PayloadRequst's Partial<Request>\n      if (typeof req.json !== 'function' || typeof req.formData !== 'function') {\n        debugLogger.info({\n          msg: 'Request does not have json or formData methods',\n          path,\n        })\n\n        return Response.redirect(`${pluginOptions.redirectServerURL || config.serverURL}/login`)\n      }\n\n      if (collectionOptions.authorizationURLParams?.response_mode === 'query') {\n        if (Object.keys(req.query).length > 0) {\n          jsonBody = req.query\n        }\n      } else if (contentType === 'application/json') {\n        jsonBody = await req.json()\n      } else if (contentType === 'application/x-www-form-urlencoded') {\n        const formData = await req.formData()\n        jsonBody = Object.fromEntries(formData.entries())\n      }\n\n      const stateRaw = jsonBody.state as string\n      const state: StateObj = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'))\n\n      const redirectServerURL =\n        state.serverURL || pluginOptions.redirectServerURL || config.serverURL\n      let failedRedirect = formatAdminURL({\n        adminRoute,\n        path: '/login',\n        serverURL: redirectServerURL,\n      })\n      let redirectToUse = formatAdminURL({\n        adminRoute,\n        serverURL: redirectServerURL,\n      })\n\n      if (state.redirect) {\n        redirectToUse = state.redirect\n      }\n\n      if (state.failedRedirect) {\n        failedRedirect = state.failedRedirect\n      }\n\n      failedRedirect = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: failedRedirect })\n      redirectToUse = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: redirectToUse })\n\n      if (!isAbsoluteURL(failedRedirect)) {\n        return Response.json({ error: 'Invalid failed redirect provided' }, { status: 403 })\n      }\n      if (!isAbsoluteURL(redirectToUse)) {\n        return Response.json({ error: 'Invalid redirect provided' }, { status: 403 })\n      }\n\n      if (Array.isArray(req.payload.config.csrf) && req.payload.config.csrf.length > 0) {\n        const failedRedirectOrigin = extractOrigin(failedRedirect)\n        const redirectToUseOrigin = extractOrigin(redirectToUse)\n\n        if (failedRedirectOrigin && !req.payload.config.csrf.includes(failedRedirectOrigin)) {\n          req.payload.logger.error(\n            `Failed redirect origin ${failedRedirectOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Failed redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n\n        if (redirectToUseOrigin && !req.payload.config.csrf.includes(redirectToUseOrigin)) {\n          req.payload.logger.error(\n            `Redirect origin ${redirectToUseOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n      }\n\n      // Verify signature\n      if (strategy.name !== req.payload.decrypt(state.sig)) {\n        req.payload.logger.error('Signature mismatch. Failing login and redirecting.')\n        return Response.redirect(failedRedirect)\n      }\n\n      if (!strategy.meta?.token_endpoint) {\n        debugLogger.error({\n          msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      debugLogger.info({ body: jsonBody, msg: 'Received login response body', path })\n\n      if (!jsonBody?.code) {\n        debugLogger.error({\n          msg: `No authorization code present in body. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      // Exchange `code` from body for refresh token\n      const { code } = jsonBody\n\n      if (typeof code !== 'string') {\n        debugLogger.error({\n          msg: `Authorization code present in body is not a string. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      const body: Record<string, string> = {\n        client_id: strategy.clientID,\n        code,\n        code_verifier: req.payload.decrypt(state.verifier),\n        grant_type: 'authorization_code',\n        redirect_uri: formatAdminURL({\n          apiRoute: config.routes?.api || '/api',\n          path: `/${collection.slug}/${endpointSlug}/login`,\n          serverURL: redirectServerURL,\n        }),\n      }\n\n      if (strategy.collectionOptions.clientSecret) {\n        body.client_secret = strategy.collectionOptions.clientSecret\n      }\n\n      debugLogger.info({\n        msg: 'Exchanging code for access token',\n        path,\n        requestBody: body,\n      })\n\n      const tokenRes = await fetch(strategy.meta?.token_endpoint, {\n        body: new URLSearchParams(body),\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        method: 'POST',\n      }).then((r) => r.json())\n\n      debugLogger.info({ msg: 'Token Response', path, tokenRes })\n\n      const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes\n\n      if (error) {\n        req.payload.logger.error('Error swapping access code with access token:')\n        req.payload.logger.error({ err: error, error_description })\n        return Response.redirect(failedRedirect)\n      }\n\n      // Fetch Figma user info for handle and profile image\n      let figmaUserInfo: FigmaUserInfo | null = null\n      try {\n        figmaUserInfo = await getUserInfo(access_token)\n        debugLogger.info({ figmaUserInfo, msg: 'Fetched Figma user info' })\n      } catch (err) {\n        // Non-fatal: user will just not have handle/image\n        debugLogger.error({ err, msg: 'Failed to fetch Figma user info' })\n      }\n\n      if (!access_token) {\n        const errMsg = 'No access_token was returned from the identity provider.'\n        req.payload.logger.error({ msg: errMsg, path, tokenRes })\n        throw new APIError(errMsg)\n      }\n\n      // Swap for project token\n      const project_token = await getProjectToken(access_token, config.custom.figma.contentSystemId)\n      const refresh_token = access_token\n\n      // Store project token as access_token\n\n      const token = project_token.token\n      const expiresIn = project_token.expiresAt\n\n      if (!token) {\n        const errMsg = `No ${\n          collectionOptions.token || 'access_token'\n        } was returned from the identity provider.`\n        req.payload.logger.error({ msg: errMsg, path })\n        throw new APIError(errMsg)\n      }\n\n      const cookieOptions = createCookieOptions({ collection, headers: req.headers, pluginOptions })\n\n      // get the payloadRedirect cookie value\n      const cookies = parseCookies(req.headers)\n\n      const payloadRedirect =\n        'payloadRedirect' in cookies ? (cookies.payloadRedirect as string) : ''\n\n      if (!req.responseHeaders) {\n        req.responseHeaders = new Headers()\n      }\n\n      if (payloadRedirect) {\n        if (isAbsoluteURL(payloadRedirect)) {\n          redirectToUse = payloadRedirect\n        } else {\n          redirectToUse += payloadRedirect\n        }\n\n        req.responseHeaders.append(\n          'Set-Cookie',\n          `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`,\n        )\n      }\n\n      if (refresh_token && !collectionOptions.usePayloadJWT) {\n        debugLogger.info('Setting refresh token cookie')\n        const refreshCookie = generateCookie({\n          returnCookieAsObject: false,\n          ...cookieOptions,\n          name: `${strategy.cookieName}-refresh`,\n          value: refresh_token,\n          // Default to 1 year if no expiration\n          expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952),\n        }) as string\n\n        req.responseHeaders.append('Set-Cookie', refreshCookie)\n      }\n\n      const tokenExpires = cookieOptions?.expires\n        ? getCookieExpiration(cookieOptions.expires)\n        : new Date(expiresIn) // Project token uses epoch time\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: tokenExpires,\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      req.responseHeaders.append('Set-Cookie', tokenCookie)\n\n      // Store user info in short-lived cookie for defaultVerify to consume\n      if (figmaUserInfo) {\n        const userInfoValue = Buffer.from(\n          JSON.stringify({\n            handle: figmaUserInfo.handle,\n            img_url: figmaUserInfo.img_url,\n          }),\n        ).toString('base64')\n        const userInfoCookie = generateCookie({\n          ...cookieOptions,\n          name: 'figma-user-info',\n          expires: new Date(Date.now() + 60_000), // 60 seconds\n          returnCookieAsObject: false,\n          value: userInfoValue,\n        }) as string\n        req.responseHeaders.append('Set-Cookie', userInfoCookie)\n      }\n\n      return Response.redirect(redirectToUse)\n    } catch (err: unknown) {\n      req.payload.logger.error({ err, msg: 'Error while attempting to login', path: req.pathname })\n\n      return Response.json({ error: 'Error while attempting to login' }, { status: 500 })\n    }\n  },\n  method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',\n  path: `/${endpointSlug}/login`,\n})\n"],"names":["APIError","generateCookie","parseCookies","formatAdminURL","getSafeRedirect","getProjectToken","getUserInfo","createCookieOptions","createDebugLogger","extractOrigin","getCookieExpiration","isAbsoluteURL","url","test","getLoginEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","config","payload","adminRoute","routes","admin","ensureMeta","path","pathname","debugLogger","debug","jsonBody","contentType","headers","get","json","formData","info","msg","Response","redirect","redirectServerURL","serverURL","authorizationURLParams","response_mode","Object","keys","query","length","fromEntries","entries","stateRaw","state","JSON","parse","Buffer","from","toString","failedRedirect","redirectToUse","allowAbsoluteUrls","redirectTo","error","status","Array","isArray","csrf","failedRedirectOrigin","redirectToUseOrigin","includes","logger","name","decrypt","sig","meta","token_endpoint","body","code","client_id","clientID","code_verifier","verifier","grant_type","redirect_uri","apiRoute","api","slug","clientSecret","client_secret","requestBody","tokenRes","fetch","URLSearchParams","method","then","r","access_token","error_description","expires_in","refreshTokenExpires","err","figmaUserInfo","errMsg","project_token","custom","figma","contentSystemId","refresh_token","token","expiresIn","expiresAt","cookieOptions","cookies","payloadRedirect","responseHeaders","Headers","append","usePayloadJWT","refreshCookie","returnCookieAsObject","cookieName","value","expires","tokenExpires","Date","tokenCookie","userInfoValue","stringify","handle","img_url","userInfoCookie","now"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,cAAc,EAAEC,YAAY,QAAQ,UAAS;AAChE,SAASC,cAAc,EAAEC,eAAe,QAAQ,iBAAgB;AAMhE,SAASC,eAAe,EAAEC,WAAW,QAAQ,yBAAwB;AACrE,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,aAAa,QAAQ,gCAA+B;AAC7D,SAASC,mBAAmB,QAAQ,sCAAqC;AAUzE,MAAMC,gBAAgB,CAACC,MAAgB,qBAAqBC,IAAI,CAACD;AAEjE,OAAO,MAAME,mBAAmB,CAAC,EAC/BC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAM,EAAEC,MAAM,EAAE,GAAGD,IAAIE,OAAO;YAC9B,MAAMC,aAAaF,OAAOG,MAAM,EAAEC,SAAS;YAE3C,IAAI;gBACF,MAAMP,SAASQ,UAAU;gBAEzB,MAAMC,OAAOP,IAAIQ,QAAQ;gBACzB,MAAMC,cAActB,kBAAkBa,IAAIE,OAAO,EAAEL,cAAca,KAAK;gBAEtE,IAAIC,WAAoC,CAAC;gBAEzC,MAAMC,cAAcZ,IAAIa,OAAO,CAACC,GAAG,CAAC;gBAEpC,+CAA+C;gBAC/C,IAAI,OAAOd,IAAIe,IAAI,KAAK,cAAc,OAAOf,IAAIgB,QAAQ,KAAK,YAAY;oBACxEP,YAAYQ,IAAI,CAAC;wBACfC,KAAK;wBACLX;oBACF;oBAEA,OAAOY,SAASC,QAAQ,CAAC,GAAGvB,cAAcwB,iBAAiB,IAAIpB,OAAOqB,SAAS,CAAC,MAAM,CAAC;gBACzF;gBAEA,IAAI3B,kBAAkB4B,sBAAsB,EAAEC,kBAAkB,SAAS;oBACvE,IAAIC,OAAOC,IAAI,CAAC1B,IAAI2B,KAAK,EAAEC,MAAM,GAAG,GAAG;wBACrCjB,WAAWX,IAAI2B,KAAK;oBACtB;gBACF,OAAO,IAAIf,gBAAgB,oBAAoB;oBAC7CD,WAAW,MAAMX,IAAIe,IAAI;gBAC3B,OAAO,IAAIH,gBAAgB,qCAAqC;oBAC9D,MAAMI,WAAW,MAAMhB,IAAIgB,QAAQ;oBACnCL,WAAWc,OAAOI,WAAW,CAACb,SAASc,OAAO;gBAChD;gBAEA,MAAMC,WAAWpB,SAASqB,KAAK;gBAC/B,MAAMA,QAAkBC,KAAKC,KAAK,CAACC,OAAOC,IAAI,CAACL,UAAU,UAAUM,QAAQ,CAAC;gBAE5E,MAAMhB,oBACJW,MAAMV,SAAS,IAAIzB,cAAcwB,iBAAiB,IAAIpB,OAAOqB,SAAS;gBACxE,IAAIgB,iBAAiBxD,eAAe;oBAClCqB;oBACAI,MAAM;oBACNe,WAAWD;gBACb;gBACA,IAAIkB,gBAAgBzD,eAAe;oBACjCqB;oBACAmB,WAAWD;gBACb;gBAEA,IAAIW,MAAMZ,QAAQ,EAAE;oBAClBmB,gBAAgBP,MAAMZ,QAAQ;gBAChC;gBAEA,IAAIY,MAAMM,cAAc,EAAE;oBACxBA,iBAAiBN,MAAMM,cAAc;gBACvC;gBAEAA,iBAAiBvD,gBAAgB;oBAAEyD,mBAAmB;oBAAMC,YAAYH;gBAAe;gBACvFC,gBAAgBxD,gBAAgB;oBAAEyD,mBAAmB;oBAAMC,YAAYF;gBAAc;gBAErF,IAAI,CAACjD,cAAcgD,iBAAiB;oBAClC,OAAOnB,SAASJ,IAAI,CAAC;wBAAE2B,OAAO;oBAAmC,GAAG;wBAAEC,QAAQ;oBAAI;gBACpF;gBACA,IAAI,CAACrD,cAAciD,gBAAgB;oBACjC,OAAOpB,SAASJ,IAAI,CAAC;wBAAE2B,OAAO;oBAA4B,GAAG;wBAAEC,QAAQ;oBAAI;gBAC7E;gBAEA,IAAIC,MAAMC,OAAO,CAAC7C,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,KAAK9C,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,CAAClB,MAAM,GAAG,GAAG;oBAChF,MAAMmB,uBAAuB3D,cAAckD;oBAC3C,MAAMU,sBAAsB5D,cAAcmD;oBAE1C,IAAIQ,wBAAwB,CAAC/C,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,CAACG,QAAQ,CAACF,uBAAuB;wBACnF/C,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CACtB,CAAC,uBAAuB,EAAEK,qBAAqB,sCAAsC,CAAC;wBAExF,OAAO5B,SAASJ,IAAI,CAClB;4BAAE2B,OAAO;wBAA+D,GACxE;4BAAEC,QAAQ;wBAAI;oBAElB;oBAEA,IAAIK,uBAAuB,CAAChD,IAAIE,OAAO,CAACD,MAAM,CAAC6C,IAAI,CAACG,QAAQ,CAACD,sBAAsB;wBACjFhD,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CACtB,CAAC,gBAAgB,EAAEM,oBAAoB,sCAAsC,CAAC;wBAEhF,OAAO7B,SAASJ,IAAI,CAClB;4BAAE2B,OAAO;wBAAwD,GACjE;4BAAEC,QAAQ;wBAAI;oBAElB;gBACF;gBAEA,mBAAmB;gBACnB,IAAI7C,SAASqD,IAAI,KAAKnD,IAAIE,OAAO,CAACkD,OAAO,CAACpB,MAAMqB,GAAG,GAAG;oBACpDrD,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;oBACzB,OAAOvB,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,IAAI,CAACxC,SAASwD,IAAI,EAAEC,gBAAgB;oBAClC9C,YAAYiC,KAAK,CAAC;wBAChBxB,KAAK,CAAC,mFAAmF,CAAC;wBAC1FX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA7B,YAAYQ,IAAI,CAAC;oBAAEuC,MAAM7C;oBAAUO,KAAK;oBAAgCX;gBAAK;gBAE7E,IAAI,CAACI,UAAU8C,MAAM;oBACnBhD,YAAYiC,KAAK,CAAC;wBAChBxB,KAAK,CAAC,qEAAqE,CAAC;wBAC5EX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,8CAA8C;gBAC9C,MAAM,EAAEmB,IAAI,EAAE,GAAG9C;gBAEjB,IAAI,OAAO8C,SAAS,UAAU;oBAC5BhD,YAAYiC,KAAK,CAAC;wBAChBxB,KAAK,CAAC,kFAAkF,CAAC;wBACzFX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,MAAMkB,OAA+B;oBACnCE,WAAW5D,SAAS6D,QAAQ;oBAC5BF;oBACAG,eAAe5D,IAAIE,OAAO,CAACkD,OAAO,CAACpB,MAAM6B,QAAQ;oBACjDC,YAAY;oBACZC,cAAcjF,eAAe;wBAC3BkF,UAAU/D,OAAOG,MAAM,EAAE6D,OAAO;wBAChC1D,MAAM,CAAC,CAAC,EAAEb,WAAWwE,IAAI,CAAC,CAAC,EAAEtE,aAAa,MAAM,CAAC;wBACjD0B,WAAWD;oBACb;gBACF;gBAEA,IAAIvB,SAASH,iBAAiB,CAACwE,YAAY,EAAE;oBAC3CX,KAAKY,aAAa,GAAGtE,SAASH,iBAAiB,CAACwE,YAAY;gBAC9D;gBAEA1D,YAAYQ,IAAI,CAAC;oBACfC,KAAK;oBACLX;oBACA8D,aAAab;gBACf;gBAEA,MAAMc,WAAW,MAAMC,MAAMzE,SAASwD,IAAI,EAAEC,gBAAgB;oBAC1DC,MAAM,IAAIgB,gBAAgBhB;oBAC1B3C,SAAS;wBACP,gBAAgB;oBAClB;oBACA4D,QAAQ;gBACV,GAAGC,IAAI,CAAC,CAACC,IAAMA,EAAE5D,IAAI;gBAErBN,YAAYQ,IAAI,CAAC;oBAAEC,KAAK;oBAAkBX;oBAAM+D;gBAAS;gBAEzD,MAAM,EAAEM,YAAY,EAAElC,KAAK,EAAEmC,iBAAiB,EAAEC,YAAYC,mBAAmB,EAAE,GAAGT;gBAEpF,IAAI5B,OAAO;oBACT1C,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;oBACzB1C,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;wBAAEsC,KAAKtC;wBAAOmC;oBAAkB;oBACzD,OAAO1D,SAASC,QAAQ,CAACkB;gBAC3B;gBAEA,qDAAqD;gBACrD,IAAI2C,gBAAsC;gBAC1C,IAAI;oBACFA,gBAAgB,MAAMhG,YAAY2F;oBAClCnE,YAAYQ,IAAI,CAAC;wBAAEgE;wBAAe/D,KAAK;oBAA0B;gBACnE,EAAE,OAAO8D,KAAK;oBACZ,kDAAkD;oBAClDvE,YAAYiC,KAAK,CAAC;wBAAEsC;wBAAK9D,KAAK;oBAAkC;gBAClE;gBAEA,IAAI,CAAC0D,cAAc;oBACjB,MAAMM,SAAS;oBACflF,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;wBAAExB,KAAKgE;wBAAQ3E;wBAAM+D;oBAAS;oBACvD,MAAM,IAAI3F,SAASuG;gBACrB;gBAEA,yBAAyB;gBACzB,MAAMC,gBAAgB,MAAMnG,gBAAgB4F,cAAc3E,OAAOmF,MAAM,CAACC,KAAK,CAACC,eAAe;gBAC7F,MAAMC,gBAAgBX;gBAEtB,sCAAsC;gBAEtC,MAAMY,QAAQL,cAAcK,KAAK;gBACjC,MAAMC,YAAYN,cAAcO,SAAS;gBAEzC,IAAI,CAACF,OAAO;oBACV,MAAMN,SAAS,CAAC,GAAG,EACjBvF,kBAAkB6F,KAAK,IAAI,eAC5B,yCAAyC,CAAC;oBAC3CxF,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;wBAAExB,KAAKgE;wBAAQ3E;oBAAK;oBAC7C,MAAM,IAAI5B,SAASuG;gBACrB;gBAEA,MAAMS,gBAAgBzG,oBAAoB;oBAAEQ;oBAAYmB,SAASb,IAAIa,OAAO;oBAAEhB;gBAAc;gBAE5F,uCAAuC;gBACvC,MAAM+F,UAAU/G,aAAamB,IAAIa,OAAO;gBAExC,MAAMgF,kBACJ,qBAAqBD,UAAWA,QAAQC,eAAe,GAAc;gBAEvE,IAAI,CAAC7F,IAAI8F,eAAe,EAAE;oBACxB9F,IAAI8F,eAAe,GAAG,IAAIC;gBAC5B;gBAEA,IAAIF,iBAAiB;oBACnB,IAAIvG,cAAcuG,kBAAkB;wBAClCtD,gBAAgBsD;oBAClB,OAAO;wBACLtD,iBAAiBsD;oBACnB;oBAEA7F,IAAI8F,eAAe,CAACE,MAAM,CACxB,cACA,CAAC,gBAAgB,EAAEzD,cAAc,oBAAoB,CAAC;gBAE1D;gBAEA,IAAIgD,iBAAiB,CAAC5F,kBAAkBsG,aAAa,EAAE;oBACrDxF,YAAYQ,IAAI,CAAC;oBACjB,MAAMiF,gBAAgBtH,eAAe;wBACnCuH,sBAAsB;wBACtB,GAAGR,aAAa;wBAChBxC,MAAM,GAAGrD,SAASsG,UAAU,CAAC,QAAQ,CAAC;wBACtCC,OAAOd;wBACP,qCAAqC;wBACrCe,SAASjH,oBAAoBsG,eAAeW,WAAWvB,uBAAuB;oBAChF;oBAEA/E,IAAI8F,eAAe,CAACE,MAAM,CAAC,cAAcE;gBAC3C;gBAEA,MAAMK,eAAeZ,eAAeW,UAChCjH,oBAAoBsG,cAAcW,OAAO,IACzC,IAAIE,KAAKf,WAAW,gCAAgC;;gBACxD,MAAMgB,cAAc7H,eAAe;oBACjC,GAAG+G,aAAa;oBAChBxC,MAAMrD,SAASsG,UAAU;oBACzBE,SAASC;oBACTJ,sBAAsB;oBACtBE,OAAOb;gBACT;gBAEAxF,IAAI8F,eAAe,CAACE,MAAM,CAAC,cAAcS;gBAEzC,qEAAqE;gBACrE,IAAIxB,eAAe;oBACjB,MAAMyB,gBAAgBvE,OAAOC,IAAI,CAC/BH,KAAK0E,SAAS,CAAC;wBACbC,QAAQ3B,cAAc2B,MAAM;wBAC5BC,SAAS5B,cAAc4B,OAAO;oBAChC,IACAxE,QAAQ,CAAC;oBACX,MAAMyE,iBAAiBlI,eAAe;wBACpC,GAAG+G,aAAa;wBAChBxC,MAAM;wBACNmD,SAAS,IAAIE,KAAKA,KAAKO,GAAG,KAAK;wBAC/BZ,sBAAsB;wBACtBE,OAAOK;oBACT;oBACA1G,IAAI8F,eAAe,CAACE,MAAM,CAAC,cAAcc;gBAC3C;gBAEA,OAAO3F,SAASC,QAAQ,CAACmB;YAC3B,EAAE,OAAOyC,KAAc;gBACrBhF,IAAIE,OAAO,CAACgD,MAAM,CAACR,KAAK,CAAC;oBAAEsC;oBAAK9D,KAAK;oBAAmCX,MAAMP,IAAIQ,QAAQ;gBAAC;gBAE3F,OAAOW,SAASJ,IAAI,CAAC;oBAAE2B,OAAO;gBAAkC,GAAG;oBAAEC,QAAQ;gBAAI;YACnF;QACF;QACA8B,QAAQ9E,kBAAkB4B,sBAAsB,EAAEC,kBAAkB,UAAU,QAAQ;QACtFjB,MAAM,CAAC,CAAC,EAAEX,aAAa,MAAM,CAAC;IAChC,CAAA,EAAE"}

package/dist/plugin/build-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../../src/plugin/build-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAkBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC1B,GAAG;IACF,KAAK,EAAE;QACL,eAAe,EAAE,MAAM,CAAA;QACvB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAC3B,CAAA;CACF,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CA8HpF"}
+{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../../src/plugin/build-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAS,eAAe,EAAE,MAAM,SAAS,CAAA;AAkB7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC1B,GAAG;IACF,KAAK,EAAE;QACL,eAAe,EAAE,MAAM,CAAA;QACvB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAC3B,CAAA;CACF,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AA6B7B;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CA8IpF"}

package/dist/plugin/build-config.js

@@ -10,6 +10,31 @@ import { oAuth2Plugin } from '../oauth/index.js';
 import { createStorageClient } from '../storage-content-api/client.js';
 import { getGenerateSignedURLHandler } from '../storage-content-api/client-uploads/generateSignedURL.js';
 import { contentApiStorageAdapter } from '../storage-content-api/index.js';
+/**
+ * Fields added to users collection for Figma profile info
+ */ const figmaUserFields = [
+    {
+        name: 'figmaHandle',
+        type: 'text',
+        admin: {
+            readOnly: true
+        },
+        label: 'Name'
+    },
+    {
+        name: 'figmaImageUrl',
+        type: 'text',
+        admin: {
+            components: {
+                Cell: '@payloadcms/figma/client#FigmaAvatarCell'
+            },
+            disableBulkEdit: true,
+            hidden: true,
+            readOnly: true
+        },
+        label: 'Profile Picture'
+    }
+];
 /**
  * Figma platform wrapper for Payload's buildConfig.
  * Automatically injects:
@@ -107,9 +132,10 @@ import { contentApiStorageAdapter } from '../storage-content-api/index.js';
         ...config,
         admin: {
             // Auto-refresh tokens before expiry to prevent unexpected logouts.
-            // The project token (access token) expires in ~15 minutes, so the client
-            // will automatically refresh at ~14 minutes to keep the session alive.
             autoRefresh: true,
+            avatar: {
+                Component: '@payloadcms/figma/client#FigmaAvatar'
+            },
             ...config.admin
         },
         custom: {
@@ -152,6 +178,22 @@ import { contentApiStorageAdapter } from '../storage-content-api/index.js';
             })
         ]
     };
+    // Inject figma fields into users collection
+    const collections = configWithFigmaDefaults.collections?.map((col)=>{
+        if (col.slug === 'users') {
+            return {
+                ...col,
+                fields: [
+                    ...col.fields || [],
+                    ...figmaUserFields
+                ]
+            };
+        }
+        return col;
+    });
+    if (collections) {
+        configWithFigmaDefaults.collections = collections;
+    }
     // Delegate to Payload's buildConfig
     return await payloadBuildConfig(configWithFigmaDefaults);
 }

package/dist/plugin/build-config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/plugin/build-config.ts"],"sourcesContent":["import type { Config, SanitizedConfig } from 'payload'\n\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\nimport { initClientUploads } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { lexicalEditor } from '@payloadcms/richtext-lexical'\nimport { buildConfig as payloadBuildConfig } from 'payload'\n\nimport type { StorageClientConfig } from '../storage-content-api/index.js'\n\nimport { getTokenStore } from '../auth/token-store.js'\nimport { ENV_CONFIG, getEnvironment } from '../constants.js'\nimport { contentAPIAdapter } from '../db-content-api/index.js'\nimport { health } from '../endpoints/health.js'\nimport { oAuth2Plugin } from '../oauth/index.js'\nimport { createStorageClient } from '../storage-content-api/client.js'\nimport { getGenerateSignedURLHandler } from '../storage-content-api/client-uploads/generateSignedURL.js'\nimport { contentApiStorageAdapter } from '../storage-content-api/index.js'\n\n/**\n * Configuration type for Payload projects on the Figma platform.\n *\n * Differences from standard Payload Config:\n * - `db`: Omitted (auto-injected by Figma platform)\n * - `secret`: Omitted (auto-injected by Figma platform)\n * - `editor`: Optional (defaults to lexicalEditor() if not provided)\n *\n * @example\n * // Minimal config\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!\n *   },\n *   collections: [...]\n * }\n *\n * @example\n * // With custom editor\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!\n *   },\n *   collections: [...],\n *   editor: lexicalEditor({ features: [...] })\n * }\n *\n * @example\n * // Disable Content System (use custom db)\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!,\n *     useContentSystem: false\n *   },\n *   db: mongooseAdapter({ url: process.env.DATABASE_URI }),\n *   collections: [...]\n * }\n */\nexport type FigmaConfig = {\n  editor?: Config['editor']\n} & {\n  figma: {\n    contentSystemId: string\n    storage?: boolean\n    useContentSystem?: boolean\n  }\n} & Omit<Config, 'db' | 'editor' | 'secret'> &\n  Partial<Pick<Config, 'db'>>\n\n/**\n * Figma platform wrapper for Payload's buildConfig.\n * Automatically injects:\n * - Figma database adapter\n * - Secret (platform-provided)\n * - Default lexicalEditor (if no custom editor specified)\n *\n * @param config - Payload configuration (db and secret omitted, editor optional)\n * @returns Promise<SanitizedConfig> - Built Payload configuration\n */\nexport async function buildFigmaConfig(config: FigmaConfig): Promise<SanitizedConfig> {\n  // Validate required environment variable\n  if (!config.figma.contentSystemId) {\n    throw new Error(\n      'FIGMA_CONTENT_SYSTEM_ID is required. ' +\n        'Ensure your .env file contains: FIGMA_CONTENT_SYSTEM_ID=your-content-system-id',\n    )\n  }\n\n  const env = getEnvironment()\n  const url = process.env.FIGMA_CONTENT_API_URL || ENV_CONFIG[env].contentApiUrl\n  const { contentSystemId } = config.figma\n\n  // Determine database adapter based on environment\n  let db: Config['db']\n\n  if (config.figma.useContentSystem === false) {\n    db = config.db!\n  } else if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {\n    db = contentAPIAdapter({\n      auth: { apiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY, mode: 'apiKey' },\n      contentSystemId,\n      url,\n    })\n  } else if (process.env.FIGMA_DEV_JWT === 'true') {\n    db = contentAPIAdapter({\n      auth: { mode: 'devJwt' },\n      contentSystemId,\n      url,\n    })\n  } else {\n    db = contentAPIAdapter({\n      auth: { mode: 'tokenStore', tokenStore: getTokenStore(getEnvironment()) },\n      contentSystemId,\n      url,\n    })\n  }\n\n  // Build storage plugin if there are upload collections and storage is not disabled\n  const uploadCollections = (config.collections || []).filter((c) => c.upload)\n  let storagePlugin: ReturnType<typeof cloudStoragePlugin> | undefined\n\n  if (uploadCollections.length > 0 && config.figma.storage !== false) {\n    const storageConfig: StorageClientConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY\n      ? { baseUrl: url, contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY }\n      : process.env.FIGMA_DEV_JWT === 'true'\n        ? {\n            auth: { mode: 'devJwt' },\n            baseUrl: url,\n            contentSystemId,\n          }\n        : {\n            auth: { mode: 'tokenStore', tokenStore: getTokenStore(getEnvironment()) },\n            baseUrl: url,\n            contentSystemId,\n          }\n\n    const adapter = contentApiStorageAdapter(storageConfig)\n    const storageClient = createStorageClient(storageConfig)\n\n    const collectionsMap = uploadCollections.reduce(\n      (acc, c) => {\n        acc[c.slug] = { adapter, disableLocalStorage: true }\n        return acc\n      },\n      {} as Record<string, { adapter: typeof adapter; disableLocalStorage: boolean }>,\n    )\n\n    initClientUploads({\n      clientHandler: '@payloadcms/figma/client#ContentApiClientUploadHandler',\n      collections: collectionsMap,\n      config: config as unknown as Config,\n      enabled: true,\n      serverHandler: getGenerateSignedURLHandler({ client: storageClient }),\n      serverHandlerPath: '/content-api-storage-signed-url',\n    })\n\n    storagePlugin = cloudStoragePlugin({ collections: collectionsMap })\n  }\n\n  // Build complete config with Figma platform defaults\n  const configWithFigmaDefaults: Config = {\n    ...config,\n    admin: {\n      // Auto-refresh tokens before expiry to prevent unexpected logouts.\n      // The project token (access token) expires in ~15 minutes, so the client\n      // will automatically refresh at ~14 minutes to keep the session alive.\n      autoRefresh: true,\n      ...config.admin,\n    },\n    custom: {\n      figma: config.figma || {},\n    },\n    db,\n    editor: config.editor ?? lexicalEditor(),\n    endpoints: [...(config.endpoints ?? []), health],\n    secret: 'MY_SECRET',\n    // Add oauth to plugins if not already present\n    plugins: [\n      ...(config.plugins ?? []),\n      ...(storagePlugin ? [storagePlugin] : []),\n      oAuth2Plugin({\n        collections: [\n          {\n            slug: 'users',\n            // Use adapter because Figma app doesn't support OIDC scopes\n            authorizationURLParams: {\n              response_mode: 'query',\n              response_type: 'code',\n            },\n            clientID: process.env.FIGMA_OAUTH_CLIENT_ID!,\n            clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,\n            identityMetadata: ENV_CONFIG[env].identityMetadata,\n            scope: ['current_user:read'],\n            token: 'id_token', // Adapter creates JWT id_token from Figma user info\n            usernameField: 'email',\n          },\n        ],\n        debug: !!process.env.DEBUG,\n        disabled: false,\n      }),\n    ],\n  }\n\n  // Delegate to Payload's buildConfig\n  return await payloadBuildConfig(configWithFigmaDefaults)\n}\n"],"names":["cloudStoragePlugin","initClientUploads","lexicalEditor","buildConfig","payloadBuildConfig","getTokenStore","ENV_CONFIG","getEnvironment","contentAPIAdapter","health","oAuth2Plugin","createStorageClient","getGenerateSignedURLHandler","contentApiStorageAdapter","buildFigmaConfig","config","figma","contentSystemId","Error","env","url","process","FIGMA_CONTENT_API_URL","contentApiUrl","db","useContentSystem","FIGMA_CONTENT_API_ACCESS_KEY","auth","apiKey","mode","FIGMA_DEV_JWT","tokenStore","uploadCollections","collections","filter","c","upload","storagePlugin","length","storage","storageConfig","baseUrl","contentApiKey","adapter","storageClient","collectionsMap","reduce","acc","slug","disableLocalStorage","clientHandler","enabled","serverHandler","client","serverHandlerPath","configWithFigmaDefaults","admin","autoRefresh","custom","editor","endpoints","secret","plugins","authorizationURLParams","response_mode","response_type","clientID","FIGMA_OAUTH_CLIENT_ID","clientSecret","FIGMA_OAUTH_CLIENT_SECRET","identityMetadata","scope","token","usernameField","debug","DEBUG","disabled"],"mappings":"AAEA,SAASA,kBAAkB,QAAQ,mCAAkC;AACrE,SAASC,iBAAiB,QAAQ,6CAA4C;AAC9E,SAASC,aAAa,QAAQ,+BAA8B;AAC5D,SAASC,eAAeC,kBAAkB,QAAQ,UAAS;AAI3D,SAASC,aAAa,QAAQ,yBAAwB;AACtD,SAASC,UAAU,EAAEC,cAAc,QAAQ,kBAAiB;AAC5D,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,MAAM,QAAQ,yBAAwB;AAC/C,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,mBAAmB,QAAQ,mCAAkC;AACtE,SAASC,2BAA2B,QAAQ,6DAA4D;AACxG,SAASC,wBAAwB,QAAQ,kCAAiC;AAmD1E;;;;;;;;;CASC,GACD,OAAO,eAAeC,iBAAiBC,MAAmB;IACxD,yCAAyC;IACzC,IAAI,CAACA,OAAOC,KAAK,CAACC,eAAe,EAAE;QACjC,MAAM,IAAIC,MACR,0CACE;IAEN;IAEA,MAAMC,MAAMZ;IACZ,MAAMa,MAAMC,QAAQF,GAAG,CAACG,qBAAqB,IAAIhB,UAAU,CAACa,IAAI,CAACI,aAAa;IAC9E,MAAM,EAAEN,eAAe,EAAE,GAAGF,OAAOC,KAAK;IAExC,kDAAkD;IAClD,IAAIQ;IAEJ,IAAIT,OAAOC,KAAK,CAACS,gBAAgB,KAAK,OAAO;QAC3CD,KAAKT,OAAOS,EAAE;IAChB,OAAO,IAAIH,QAAQF,GAAG,CAACO,4BAA4B,EAAE;QACnDF,KAAKhB,kBAAkB;YACrBmB,MAAM;gBAAEC,QAAQP,QAAQF,GAAG,CAACO,4BAA4B;gBAAEG,MAAM;YAAS;YACzEZ;YACAG;QACF;IACF,OAAO,IAAIC,QAAQF,GAAG,CAACW,aAAa,KAAK,QAAQ;QAC/CN,KAAKhB,kBAAkB;YACrBmB,MAAM;gBAAEE,MAAM;YAAS;YACvBZ;YACAG;QACF;IACF,OAAO;QACLI,KAAKhB,kBAAkB;YACrBmB,MAAM;gBAAEE,MAAM;gBAAcE,YAAY1B,cAAcE;YAAkB;YACxEU;YACAG;QACF;IACF;IAEA,mFAAmF;IACnF,MAAMY,oBAAoB,AAACjB,CAAAA,OAAOkB,WAAW,IAAI,EAAE,AAAD,EAAGC,MAAM,CAAC,CAACC,IAAMA,EAAEC,MAAM;IAC3E,IAAIC;IAEJ,IAAIL,kBAAkBM,MAAM,GAAG,KAAKvB,OAAOC,KAAK,CAACuB,OAAO,KAAK,OAAO;QAClE,MAAMC,gBAAqCnB,QAAQF,GAAG,CAACO,4BAA4B,GAC/E;YAAEe,SAASrB;YAAKsB,eAAerB,QAAQF,GAAG,CAACO,4BAA4B;QAAC,IACxEL,QAAQF,GAAG,CAACW,aAAa,KAAK,SAC5B;YACEH,MAAM;gBAAEE,MAAM;YAAS;YACvBY,SAASrB;YACTH;QACF,IACA;YACEU,MAAM;gBAAEE,MAAM;gBAAcE,YAAY1B,cAAcE;YAAkB;YACxEkC,SAASrB;YACTH;QACF;QAEN,MAAM0B,UAAU9B,yBAAyB2B;QACzC,MAAMI,gBAAgBjC,oBAAoB6B;QAE1C,MAAMK,iBAAiBb,kBAAkBc,MAAM,CAC7C,CAACC,KAAKZ;YACJY,GAAG,CAACZ,EAAEa,IAAI,CAAC,GAAG;gBAAEL;gBAASM,qBAAqB;YAAK;YACnD,OAAOF;QACT,GACA,CAAC;QAGH9C,kBAAkB;YAChBiD,eAAe;YACfjB,aAAaY;YACb9B,QAAQA;YACRoC,SAAS;YACTC,eAAexC,4BAA4B;gBAAEyC,QAAQT;YAAc;YACnEU,mBAAmB;QACrB;QAEAjB,gBAAgBrC,mBAAmB;YAAEiC,aAAaY;QAAe;IACnE;IAEA,qDAAqD;IACrD,MAAMU,0BAAkC;QACtC,GAAGxC,MAAM;QACTyC,OAAO;YACL,mEAAmE;YACnE,yEAAyE;YACzE,uEAAuE;YACvEC,aAAa;YACb,GAAG1C,OAAOyC,KAAK;QACjB;QACAE,QAAQ;YACN1C,OAAOD,OAAOC,KAAK,IAAI,CAAC;QAC1B;QACAQ;QACAmC,QAAQ5C,OAAO4C,MAAM,IAAIzD;QACzB0D,WAAW;eAAK7C,OAAO6C,SAAS,IAAI,EAAE;YAAGnD;SAAO;QAChDoD,QAAQ;QACR,8CAA8C;QAC9CC,SAAS;eACH/C,OAAO+C,OAAO,IAAI,EAAE;eACpBzB,gBAAgB;gBAACA;aAAc,GAAG,EAAE;YACxC3B,aAAa;gBACXuB,aAAa;oBACX;wBACEe,MAAM;wBACN,4DAA4D;wBAC5De,wBAAwB;4BACtBC,eAAe;4BACfC,eAAe;wBACjB;wBACAC,UAAU7C,QAAQF,GAAG,CAACgD,qBAAqB;wBAC3CC,cAAc/C,QAAQF,GAAG,CAACkD,yBAAyB;wBACnDC,kBAAkBhE,UAAU,CAACa,IAAI,CAACmD,gBAAgB;wBAClDC,OAAO;4BAAC;yBAAoB;wBAC5BC,OAAO;wBACPC,eAAe;oBACjB;iBACD;gBACDC,OAAO,CAAC,CAACrD,QAAQF,GAAG,CAACwD,KAAK;gBAC1BC,UAAU;YACZ;SACD;IACH;IAEA,oCAAoC;IACpC,OAAO,MAAMxE,mBAAmBmD;AAClC"}
+{"version":3,"sources":["../../src/plugin/build-config.ts"],"sourcesContent":["import type { Config, Field, SanitizedConfig } from 'payload'\n\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\nimport { initClientUploads } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { lexicalEditor } from '@payloadcms/richtext-lexical'\nimport { buildConfig as payloadBuildConfig } from 'payload'\n\nimport type { StorageClientConfig } from '../storage-content-api/index.js'\n\nimport { getTokenStore } from '../auth/token-store.js'\nimport { ENV_CONFIG, getEnvironment } from '../constants.js'\nimport { contentAPIAdapter } from '../db-content-api/index.js'\nimport { health } from '../endpoints/health.js'\nimport { oAuth2Plugin } from '../oauth/index.js'\nimport { createStorageClient } from '../storage-content-api/client.js'\nimport { getGenerateSignedURLHandler } from '../storage-content-api/client-uploads/generateSignedURL.js'\nimport { contentApiStorageAdapter } from '../storage-content-api/index.js'\n\n/**\n * Configuration type for Payload projects on the Figma platform.\n *\n * Differences from standard Payload Config:\n * - `db`: Omitted (auto-injected by Figma platform)\n * - `secret`: Omitted (auto-injected by Figma platform)\n * - `editor`: Optional (defaults to lexicalEditor() if not provided)\n *\n * @example\n * // Minimal config\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!\n *   },\n *   collections: [...]\n * }\n *\n * @example\n * // With custom editor\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!\n *   },\n *   collections: [...],\n *   editor: lexicalEditor({ features: [...] })\n * }\n *\n * @example\n * // Disable Content System (use custom db)\n * const config: FigmaConfig = {\n *   figma: {\n *     contentSystemId: process.env.FIGMA_CONTENT_SYSTEM_ID!,\n *     useContentSystem: false\n *   },\n *   db: mongooseAdapter({ url: process.env.DATABASE_URI }),\n *   collections: [...]\n * }\n */\nexport type FigmaConfig = {\n  editor?: Config['editor']\n} & {\n  figma: {\n    contentSystemId: string\n    storage?: boolean\n    useContentSystem?: boolean\n  }\n} & Omit<Config, 'db' | 'editor' | 'secret'> &\n  Partial<Pick<Config, 'db'>>\n\n/**\n * Fields added to users collection for Figma profile info\n */\nconst figmaUserFields: Field[] = [\n  {\n    name: 'figmaHandle',\n    type: 'text',\n    admin: {\n      readOnly: true,\n    },\n    label: 'Name',\n  },\n  {\n    name: 'figmaImageUrl',\n    type: 'text',\n    admin: {\n      components: {\n        Cell: '@payloadcms/figma/client#FigmaAvatarCell',\n      },\n      disableBulkEdit: true,\n      hidden: true,\n      readOnly: true,\n    },\n    label: 'Profile Picture',\n  },\n]\n\n/**\n * Figma platform wrapper for Payload's buildConfig.\n * Automatically injects:\n * - Figma database adapter\n * - Secret (platform-provided)\n * - Default lexicalEditor (if no custom editor specified)\n *\n * @param config - Payload configuration (db and secret omitted, editor optional)\n * @returns Promise<SanitizedConfig> - Built Payload configuration\n */\nexport async function buildFigmaConfig(config: FigmaConfig): Promise<SanitizedConfig> {\n  // Validate required environment variable\n  if (!config.figma.contentSystemId) {\n    throw new Error(\n      'FIGMA_CONTENT_SYSTEM_ID is required. ' +\n        'Ensure your .env file contains: FIGMA_CONTENT_SYSTEM_ID=your-content-system-id',\n    )\n  }\n\n  const env = getEnvironment()\n  const url = process.env.FIGMA_CONTENT_API_URL || ENV_CONFIG[env].contentApiUrl\n  const { contentSystemId } = config.figma\n\n  // Determine database adapter based on environment\n  let db: Config['db']\n\n  if (config.figma.useContentSystem === false) {\n    db = config.db!\n  } else if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {\n    db = contentAPIAdapter({\n      auth: { apiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY, mode: 'apiKey' },\n      contentSystemId,\n      url,\n    })\n  } else if (process.env.FIGMA_DEV_JWT === 'true') {\n    db = contentAPIAdapter({\n      auth: { mode: 'devJwt' },\n      contentSystemId,\n      url,\n    })\n  } else {\n    db = contentAPIAdapter({\n      auth: { mode: 'tokenStore', tokenStore: getTokenStore(getEnvironment()) },\n      contentSystemId,\n      url,\n    })\n  }\n\n  // Build storage plugin if there are upload collections and storage is not disabled\n  const uploadCollections = (config.collections || []).filter((c) => c.upload)\n  let storagePlugin: ReturnType<typeof cloudStoragePlugin> | undefined\n\n  if (uploadCollections.length > 0 && config.figma.storage !== false) {\n    const storageConfig: StorageClientConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY\n      ? { baseUrl: url, contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY }\n      : process.env.FIGMA_DEV_JWT === 'true'\n        ? {\n            auth: { mode: 'devJwt' },\n            baseUrl: url,\n            contentSystemId,\n          }\n        : {\n            auth: { mode: 'tokenStore', tokenStore: getTokenStore(getEnvironment()) },\n            baseUrl: url,\n            contentSystemId,\n          }\n\n    const adapter = contentApiStorageAdapter(storageConfig)\n    const storageClient = createStorageClient(storageConfig)\n\n    const collectionsMap = uploadCollections.reduce(\n      (acc, c) => {\n        acc[c.slug] = { adapter, disableLocalStorage: true }\n        return acc\n      },\n      {} as Record<string, { adapter: typeof adapter; disableLocalStorage: boolean }>,\n    )\n\n    initClientUploads({\n      clientHandler: '@payloadcms/figma/client#ContentApiClientUploadHandler',\n      collections: collectionsMap,\n      config: config as unknown as Config,\n      enabled: true,\n      serverHandler: getGenerateSignedURLHandler({ client: storageClient }),\n      serverHandlerPath: '/content-api-storage-signed-url',\n    })\n\n    storagePlugin = cloudStoragePlugin({ collections: collectionsMap })\n  }\n\n  // Build complete config with Figma platform defaults\n  const configWithFigmaDefaults: Config = {\n    ...config,\n    admin: {\n      // Auto-refresh tokens before expiry to prevent unexpected logouts.\n      autoRefresh: true,\n      avatar: {\n        Component: '@payloadcms/figma/client#FigmaAvatar',\n      },\n      ...config.admin,\n    },\n    custom: {\n      figma: config.figma || {},\n    },\n    db,\n    editor: config.editor ?? lexicalEditor(),\n    endpoints: [...(config.endpoints ?? []), health],\n    secret: 'MY_SECRET',\n    // Add oauth to plugins if not already present\n    plugins: [\n      ...(config.plugins ?? []),\n      ...(storagePlugin ? [storagePlugin] : []),\n      oAuth2Plugin({\n        collections: [\n          {\n            slug: 'users',\n            // Use adapter because Figma app doesn't support OIDC scopes\n            authorizationURLParams: {\n              response_mode: 'query',\n              response_type: 'code',\n            },\n            clientID: process.env.FIGMA_OAUTH_CLIENT_ID!,\n            clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,\n            identityMetadata: ENV_CONFIG[env].identityMetadata,\n            scope: ['current_user:read'],\n            token: 'id_token', // Adapter creates JWT id_token from Figma user info\n            usernameField: 'email',\n          },\n        ],\n        debug: !!process.env.DEBUG,\n        disabled: false,\n      }),\n    ],\n  }\n\n  // Inject figma fields into users collection\n  const collections = configWithFigmaDefaults.collections?.map((col) => {\n    if (col.slug === 'users') {\n      return {\n        ...col,\n        fields: [...(col.fields || []), ...figmaUserFields],\n      }\n    }\n    return col\n  })\n\n  if (collections) {\n    configWithFigmaDefaults.collections = collections\n  }\n\n  // Delegate to Payload's buildConfig\n  return await payloadBuildConfig(configWithFigmaDefaults)\n}\n"],"names":["cloudStoragePlugin","initClientUploads","lexicalEditor","buildConfig","payloadBuildConfig","getTokenStore","ENV_CONFIG","getEnvironment","contentAPIAdapter","health","oAuth2Plugin","createStorageClient","getGenerateSignedURLHandler","contentApiStorageAdapter","figmaUserFields","name","type","admin","readOnly","label","components","Cell","disableBulkEdit","hidden","buildFigmaConfig","config","figma","contentSystemId","Error","env","url","process","FIGMA_CONTENT_API_URL","contentApiUrl","db","useContentSystem","FIGMA_CONTENT_API_ACCESS_KEY","auth","apiKey","mode","FIGMA_DEV_JWT","tokenStore","uploadCollections","collections","filter","c","upload","storagePlugin","length","storage","storageConfig","baseUrl","contentApiKey","adapter","storageClient","collectionsMap","reduce","acc","slug","disableLocalStorage","clientHandler","enabled","serverHandler","client","serverHandlerPath","configWithFigmaDefaults","autoRefresh","avatar","Component","custom","editor","endpoints","secret","plugins","authorizationURLParams","response_mode","response_type","clientID","FIGMA_OAUTH_CLIENT_ID","clientSecret","FIGMA_OAUTH_CLIENT_SECRET","identityMetadata","scope","token","usernameField","debug","DEBUG","disabled","map","col","fields"],"mappings":"AAEA,SAASA,kBAAkB,QAAQ,mCAAkC;AACrE,SAASC,iBAAiB,QAAQ,6CAA4C;AAC9E,SAASC,aAAa,QAAQ,+BAA8B;AAC5D,SAASC,eAAeC,kBAAkB,QAAQ,UAAS;AAI3D,SAASC,aAAa,QAAQ,yBAAwB;AACtD,SAASC,UAAU,EAAEC,cAAc,QAAQ,kBAAiB;AAC5D,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,MAAM,QAAQ,yBAAwB;AAC/C,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,mBAAmB,QAAQ,mCAAkC;AACtE,SAASC,2BAA2B,QAAQ,6DAA4D;AACxG,SAASC,wBAAwB,QAAQ,kCAAiC;AAmD1E;;CAEC,GACD,MAAMC,kBAA2B;IAC/B;QACEC,MAAM;QACNC,MAAM;QACNC,OAAO;YACLC,UAAU;QACZ;QACAC,OAAO;IACT;IACA;QACEJ,MAAM;QACNC,MAAM;QACNC,OAAO;YACLG,YAAY;gBACVC,MAAM;YACR;YACAC,iBAAiB;YACjBC,QAAQ;YACRL,UAAU;QACZ;QACAC,OAAO;IACT;CACD;AAED;;;;;;;;;CASC,GACD,OAAO,eAAeK,iBAAiBC,MAAmB;IACxD,yCAAyC;IACzC,IAAI,CAACA,OAAOC,KAAK,CAACC,eAAe,EAAE;QACjC,MAAM,IAAIC,MACR,0CACE;IAEN;IAEA,MAAMC,MAAMtB;IACZ,MAAMuB,MAAMC,QAAQF,GAAG,CAACG,qBAAqB,IAAI1B,UAAU,CAACuB,IAAI,CAACI,aAAa;IAC9E,MAAM,EAAEN,eAAe,EAAE,GAAGF,OAAOC,KAAK;IAExC,kDAAkD;IAClD,IAAIQ;IAEJ,IAAIT,OAAOC,KAAK,CAACS,gBAAgB,KAAK,OAAO;QAC3CD,KAAKT,OAAOS,EAAE;IAChB,OAAO,IAAIH,QAAQF,GAAG,CAACO,4BAA4B,EAAE;QACnDF,KAAK1B,kBAAkB;YACrB6B,MAAM;gBAAEC,QAAQP,QAAQF,GAAG,CAACO,4BAA4B;gBAAEG,MAAM;YAAS;YACzEZ;YACAG;QACF;IACF,OAAO,IAAIC,QAAQF,GAAG,CAACW,aAAa,KAAK,QAAQ;QAC/CN,KAAK1B,kBAAkB;YACrB6B,MAAM;gBAAEE,MAAM;YAAS;YACvBZ;YACAG;QACF;IACF,OAAO;QACLI,KAAK1B,kBAAkB;YACrB6B,MAAM;gBAAEE,MAAM;gBAAcE,YAAYpC,cAAcE;YAAkB;YACxEoB;YACAG;QACF;IACF;IAEA,mFAAmF;IACnF,MAAMY,oBAAoB,AAACjB,CAAAA,OAAOkB,WAAW,IAAI,EAAE,AAAD,EAAGC,MAAM,CAAC,CAACC,IAAMA,EAAEC,MAAM;IAC3E,IAAIC;IAEJ,IAAIL,kBAAkBM,MAAM,GAAG,KAAKvB,OAAOC,KAAK,CAACuB,OAAO,KAAK,OAAO;QAClE,MAAMC,gBAAqCnB,QAAQF,GAAG,CAACO,4BAA4B,GAC/E;YAAEe,SAASrB;YAAKsB,eAAerB,QAAQF,GAAG,CAACO,4BAA4B;QAAC,IACxEL,QAAQF,GAAG,CAACW,aAAa,KAAK,SAC5B;YACEH,MAAM;gBAAEE,MAAM;YAAS;YACvBY,SAASrB;YACTH;QACF,IACA;YACEU,MAAM;gBAAEE,MAAM;gBAAcE,YAAYpC,cAAcE;YAAkB;YACxE4C,SAASrB;YACTH;QACF;QAEN,MAAM0B,UAAUxC,yBAAyBqC;QACzC,MAAMI,gBAAgB3C,oBAAoBuC;QAE1C,MAAMK,iBAAiBb,kBAAkBc,MAAM,CAC7C,CAACC,KAAKZ;YACJY,GAAG,CAACZ,EAAEa,IAAI,CAAC,GAAG;gBAAEL;gBAASM,qBAAqB;YAAK;YACnD,OAAOF;QACT,GACA,CAAC;QAGHxD,kBAAkB;YAChB2D,eAAe;YACfjB,aAAaY;YACb9B,QAAQA;YACRoC,SAAS;YACTC,eAAelD,4BAA4B;gBAAEmD,QAAQT;YAAc;YACnEU,mBAAmB;QACrB;QAEAjB,gBAAgB/C,mBAAmB;YAAE2C,aAAaY;QAAe;IACnE;IAEA,qDAAqD;IACrD,MAAMU,0BAAkC;QACtC,GAAGxC,MAAM;QACTR,OAAO;YACL,mEAAmE;YACnEiD,aAAa;YACbC,QAAQ;gBACNC,WAAW;YACb;YACA,GAAG3C,OAAOR,KAAK;QACjB;QACAoD,QAAQ;YACN3C,OAAOD,OAAOC,KAAK,IAAI,CAAC;QAC1B;QACAQ;QACAoC,QAAQ7C,OAAO6C,MAAM,IAAIpE;QACzBqE,WAAW;eAAK9C,OAAO8C,SAAS,IAAI,EAAE;YAAG9D;SAAO;QAChD+D,QAAQ;QACR,8CAA8C;QAC9CC,SAAS;eACHhD,OAAOgD,OAAO,IAAI,EAAE;eACpB1B,gBAAgB;gBAACA;aAAc,GAAG,EAAE;YACxCrC,aAAa;gBACXiC,aAAa;oBACX;wBACEe,MAAM;wBACN,4DAA4D;wBAC5DgB,wBAAwB;4BACtBC,eAAe;4BACfC,eAAe;wBACjB;wBACAC,UAAU9C,QAAQF,GAAG,CAACiD,qBAAqB;wBAC3CC,cAAchD,QAAQF,GAAG,CAACmD,yBAAyB;wBACnDC,kBAAkB3E,UAAU,CAACuB,IAAI,CAACoD,gBAAgB;wBAClDC,OAAO;4BAAC;yBAAoB;wBAC5BC,OAAO;wBACPC,eAAe;oBACjB;iBACD;gBACDC,OAAO,CAAC,CAACtD,QAAQF,GAAG,CAACyD,KAAK;gBAC1BC,UAAU;YACZ;SACD;IACH;IAEA,4CAA4C;IAC5C,MAAM5C,cAAcsB,wBAAwBtB,WAAW,EAAE6C,IAAI,CAACC;QAC5D,IAAIA,IAAI/B,IAAI,KAAK,SAAS;YACxB,OAAO;gBACL,GAAG+B,GAAG;gBACNC,QAAQ;uBAAKD,IAAIC,MAAM,IAAI,EAAE;uBAAM5E;iBAAgB;YACrD;QACF;QACA,OAAO2E;IACT;IAEA,IAAI9C,aAAa;QACfsB,wBAAwBtB,WAAW,GAAGA;IACxC;IAEA,oCAAoC;IACpC,OAAO,MAAMvC,mBAAmB6D;AAClC"}

package/dist/templates/README.md

@@ -4,7 +4,7 @@ A Payload project configured for running on Figma infrastructure.
 
 ## Getting Started
 
-pnpm dev
+{{RUN_COMMAND}} dev
 
 Open http://localhost:3000/admin to access the admin panel.
 

package/dist/types/config.d.ts

@@ -1,6 +1,7 @@
 /**
  * Figma CMS Configuration Types
  */
+import type { PackageManager } from '../utils/package-manager.js';
 /**
  * Tenant instance from Control Plane API
  */
@@ -25,7 +26,7 @@ export interface ProjectInfo {
     /** Whether Payload is installed */
     hasPayload: boolean;
     /** Package manager detected (npm, pnpm, yarn) */
-    packageManager?: 'npm' | 'pnpm' | 'yarn';
+    packageManager?: PackageManager;
     /** Project root path */
     path: string;
     /** Payload version if installed */

package/dist/types/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,yCAAyC;IACzC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,WAAW,CAAA;IACxC,oBAAoB;IACpB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAA;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,iDAAiD;IACjD,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAA;IACxC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAEjE;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,yCAAyC;IACzC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,WAAW,CAAA;IACxC,oBAAoB;IACpB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAA;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,iDAAiD;IACjD,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB"}

package/dist/types/config.js

@@ -1,8 +1,6 @@
 /**
  * Figma CMS Configuration Types
  */ /**
- * Tenant instance from Control Plane API
- */ /**
  * Project information from detection
  */ export { };
 

package/dist/types/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/types/config.ts"],"sourcesContent":["/**\n * Figma CMS Configuration Types\n */\n\n/**\n * Tenant instance from Control Plane API\n */\nexport interface Tenant {\n  /** Creation timestamp */\n  createdAt?: string\n  /** Domain name (e.g., my-cms.figmacms.com) */\n  domain: string\n  /** Unique tenant ID */\n  id: string\n  /** Parent ID */\n  parentId: string\n  /** Parent type (team, org, workspace) */\n  parentType: 'org' | 'team' | 'workspace'\n  /** Tenant status */\n  status: 'active' | 'inactive' | 'provisioning'\n}\n\n/**\n * Project information from detection\n */\nexport interface ProjectInfo {\n  /** Whether Payload is installed */\n  hasPayload: boolean\n  /** Package manager detected (npm, pnpm, yarn) */\n  packageManager?: 'npm' | 'pnpm' | 'yarn'\n  /** Project root path */\n  path: string\n  /** Payload version if installed */\n  payloadVersion?: string\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC,GAgBD;;CAEC,GACD,WASC"}
+{"version":3,"sources":["../../src/types/config.ts"],"sourcesContent":["/**\n * Figma CMS Configuration Types\n */\n\nimport type { PackageManager } from '../utils/package-manager.js'\n\n/**\n * Tenant instance from Control Plane API\n */\nexport interface Tenant {\n  /** Creation timestamp */\n  createdAt?: string\n  /** Domain name (e.g., my-cms.figmacms.com) */\n  domain: string\n  /** Unique tenant ID */\n  id: string\n  /** Parent ID */\n  parentId: string\n  /** Parent type (team, org, workspace) */\n  parentType: 'org' | 'team' | 'workspace'\n  /** Tenant status */\n  status: 'active' | 'inactive' | 'provisioning'\n}\n\n/**\n * Project information from detection\n */\nexport interface ProjectInfo {\n  /** Whether Payload is installed */\n  hasPayload: boolean\n  /** Package manager detected (npm, pnpm, yarn) */\n  packageManager?: PackageManager\n  /** Project root path */\n  path: string\n  /** Payload version if installed */\n  payloadVersion?: string\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAsBD;;CAEC,GACD,WASC"}

package/dist/types.d.ts

@@ -38,7 +38,6 @@ interface Template {
     name: string;
     type: ProjectTemplate['type'];
 }
-export type PackageManager = 'bun' | 'npm' | 'pnpm' | 'yarn';
 export type DbType = 'd1-sqlite' | 'mongodb' | 'postgres' | 'sqlite' | 'vercel-postgres';
 export type DbDetails = {
     dbUri?: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,KAAK,CAAA;AAE1B,MAAM,WAAW,IAAK,SAAQ,GAAG,CAAC,IAAI;IACpC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,OAAO,EAAE,iBAAiB,CAAA;IAC1B,SAAS,EAAE,kBAAkB,CAAA;IAC7B,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,kBAAkB,CAAA;IAC9B,OAAO,EAAE,kBAAkB,CAAA;IAI3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAEtC,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,cAAc,CAAA;AAE1D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,IAAI,EAAE,SAAS,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,QAAQ;IAC9C,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,UAAU,QAAQ;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAA;AAE5D,MAAM,MAAM,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,iBAAiB,CAAA;AAExF,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAA;AAE5C,MAAM,MAAM,cAAc,GAAG;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,EAAE,OAAO,CAAA;IACjB,sBAAsB,EAAE,OAAO,CAAA;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,WAAW,EAAE,IAAI,GAAG,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAA;AAEjD,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,WAAW,GAAG,mBAAmB,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,KAAK,CAAA;AAE1B,MAAM,WAAW,IAAK,SAAQ,GAAG,CAAC,IAAI;IACpC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,OAAO,EAAE,iBAAiB,CAAA;IAC1B,SAAS,EAAE,kBAAkB,CAAA;IAC7B,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,kBAAkB,CAAA;IAC9B,OAAO,EAAE,kBAAkB,CAAA;IAI3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAEtC,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,cAAc,CAAA;AAE1D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,IAAI,EAAE,SAAS,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,QAAQ;IAC9C,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,UAAU,QAAQ;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;CAC9B;AAED,MAAM,MAAM,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,iBAAiB,CAAA;AAExF,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAA;AAE5C,MAAM,MAAM,cAAc,GAAG;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,EAAE,OAAO,CAAA;IACjB,sBAAsB,EAAE,OAAO,CAAA;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,WAAW,EAAE,IAAI,GAAG,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAA;AAEjD,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,WAAW,GAAG,mBAAmB,CAAA"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type arg from 'arg'\n\nexport interface Args extends arg.Spec {\n  '--debug': BooleanConstructor\n  '--env': StringConstructor\n  '--force': BooleanConstructor\n  '--help': BooleanConstructor\n  '--list': BooleanConstructor\n  '--logout': BooleanConstructor\n  '--yes': BooleanConstructor\n\n  // Aliases\n\n  '-f': string\n  '-h': string\n  '-y': string\n}\n\nexport type CliArgs = arg.Result<Args>\n\nexport type ProjectTemplate = GitTemplate | PluginTemplate\n\nexport type ProjectExample = {\n  name: string\n  url: string\n}\n\n/**\n * Template that is cloned verbatim from a git repo\n * Performs .env manipulation based upon input\n */\nexport interface GitTemplate extends Template {\n  type: 'starter'\n  url: string\n}\n\n/**\n * Type specifically for the plugin template\n * No .env manipulation is done\n */\nexport interface PluginTemplate extends Template {\n  type: 'plugin'\n  url: string\n}\n\ninterface Template {\n  description?: string\n  name: string\n  type: ProjectTemplate['type']\n}\n\nexport type PackageManager = 'bun' | 'npm' | 'pnpm' | 'yarn'\n\nexport type DbType = 'd1-sqlite' | 'mongodb' | 'postgres' | 'sqlite' | 'vercel-postgres'\n\nexport type DbDetails = {\n  dbUri?: string\n  type: DbType\n}\n\nexport type EditorType = 'lexical' | 'slate'\n\nexport type NextAppDetails = {\n  hasTopLevelLayout: boolean\n  isPayloadInstalled?: boolean\n  isSrcDir: boolean\n  isSupportedNextVersion: boolean\n  nextAppDir?: string\n  nextConfigPath?: string\n  nextConfigType?: NextConfigType\n  nextVersion: null | string\n}\n\nexport type NextConfigType = 'cjs' | 'esm' | 'ts'\n\nexport type StorageAdapterType = 'localDisk' | 'r2Storage' | 'vercelBlobStorage'\n"],"names":[],"mappings":"AA2EA,WAAgF"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type arg from 'arg'\n\nexport interface Args extends arg.Spec {\n  '--debug': BooleanConstructor\n  '--env': StringConstructor\n  '--force': BooleanConstructor\n  '--help': BooleanConstructor\n  '--list': BooleanConstructor\n  '--logout': BooleanConstructor\n  '--yes': BooleanConstructor\n\n  // Aliases\n\n  '-f': string\n  '-h': string\n  '-y': string\n}\n\nexport type CliArgs = arg.Result<Args>\n\nexport type ProjectTemplate = GitTemplate | PluginTemplate\n\nexport type ProjectExample = {\n  name: string\n  url: string\n}\n\n/**\n * Template that is cloned verbatim from a git repo\n * Performs .env manipulation based upon input\n */\nexport interface GitTemplate extends Template {\n  type: 'starter'\n  url: string\n}\n\n/**\n * Type specifically for the plugin template\n * No .env manipulation is done\n */\nexport interface PluginTemplate extends Template {\n  type: 'plugin'\n  url: string\n}\n\ninterface Template {\n  description?: string\n  name: string\n  type: ProjectTemplate['type']\n}\n\nexport type DbType = 'd1-sqlite' | 'mongodb' | 'postgres' | 'sqlite' | 'vercel-postgres'\n\nexport type DbDetails = {\n  dbUri?: string\n  type: DbType\n}\n\nexport type EditorType = 'lexical' | 'slate'\n\nexport type NextAppDetails = {\n  hasTopLevelLayout: boolean\n  isPayloadInstalled?: boolean\n  isSrcDir: boolean\n  isSupportedNextVersion: boolean\n  nextAppDir?: string\n  nextConfigPath?: string\n  nextConfigType?: NextConfigType\n  nextVersion: null | string\n}\n\nexport type NextConfigType = 'cjs' | 'esm' | 'ts'\n\nexport type StorageAdapterType = 'localDisk' | 'r2Storage' | 'vercelBlobStorage'\n"],"names":[],"mappings":"AAyEA,WAAgF"}

package/dist/utils/lambda-config.d.ts

@@ -3,7 +3,7 @@ import type { PackageManager } from './package-manager.js';
  * Apply Lambda-specific modifications to a Payload project
  *
  * @param projectPath - Path to project directory
- * @param packageManager - Package manager to use in scripts (defaults to 'pnpm')
+ * @param packageManager - Package manager to use in scripts (defaults to 'npm')
  */
 export declare function applyLambdaModifications(projectPath: string, packageManager?: PackageManager): Promise<void>;
 //# sourceMappingURL=lambda-config.d.ts.map

package/dist/utils/lambda-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lambda-config.d.ts","sourceRoot":"","sources":["../../src/utils/lambda-config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAS1D;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,cAAuB,GACtC,OAAO,CAAC,IAAI,CAAC,CA2Bf"}
+{"version":3,"file":"lambda-config.d.ts","sourceRoot":"","sources":["../../src/utils/lambda-config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAS1D;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,cAAsB,GACrC,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/utils/lambda-config.js

@@ -11,8 +11,8 @@ NODE_ENV=production exec node server.js
  * Apply Lambda-specific modifications to a Payload project
  *
  * @param projectPath - Path to project directory
- * @param packageManager - Package manager to use in scripts (defaults to 'pnpm')
- */ export async function applyLambdaModifications(projectPath, packageManager = 'pnpm') {
+ * @param packageManager - Package manager to use in scripts (defaults to 'npm')
+ */ export async function applyLambdaModifications(projectPath, packageManager = 'npm') {
     // 1. Create run.sh
     const runShPath = path.join(projectPath, 'run.sh');
     await fs.writeFile(runShPath, RUN_SH_CONTENT, 'utf-8');