@payloadcms/figma 0.0.1-alpha.5 → 0.0.1-alpha.51

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -1,16 +1,15 @@
 import { APIError, generateCookie, parseCookies } from 'payload';
-import { getSafeRedirect } from 'payload/shared';
-import { getProjectToken } from '../../api/figma-api.js';
+import { formatAdminURL, getSafeRedirect } from 'payload/shared';
+import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
 import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
 import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
 const isAbsoluteURL = (url)=>/^[a-z][a-z\d+.-]*:/.test(url);
 export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const { config } = req.payload;
-            const adminPath = getAdminPath(config);
+            const adminRoute = config.routes?.admin || '/admin';
             try {
                 await strategy.ensureMeta();
                 const path = req.pathname;
@@ -37,9 +36,16 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                 }
                 const stateRaw = jsonBody.state;
                 const state = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'));
-                const redirectDestination = state.serverURL || pluginOptions.redirectServerURL || config.serverURL;
-                let failedRedirect = `${redirectDestination}${adminPath}/login`;
-                let redirectToUse = `${redirectDestination}${adminPath}`;
+                const redirectServerURL = state.serverURL || pluginOptions.redirectServerURL || config.serverURL;
+                let failedRedirect = formatAdminURL({
+                    adminRoute,
+                    path: '/login',
+                    serverURL: redirectServerURL
+                });
+                let redirectToUse = formatAdminURL({
+                    adminRoute,
+                    serverURL: redirectServerURL
+                });
                 if (state.redirect) {
                     redirectToUse = state.redirect;
                 }
@@ -126,16 +132,20 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     code,
                     code_verifier: req.payload.decrypt(state.verifier),
                     grant_type: 'authorization_code',
-                    redirect_uri: `${redirectDestination}${config?.routes?.api || '/api'}/${collection.slug}/${endpointSlug}/login`
+                    redirect_uri: formatAdminURL({
+                        apiRoute: config.routes?.api || '/api',
+                        path: `/${collection.slug}/${endpointSlug}/login`,
+                        serverURL: redirectServerURL
+                    })
                 };
+                if (strategy.collectionOptions.clientSecret) {
+                    body.client_secret = strategy.collectionOptions.clientSecret;
+                }
                 debugLogger.info({
                     msg: 'Exchanging code for access token',
                     path,
                     requestBody: body
                 });
-                if (strategy.clientSecret) {
-                    body.client_secret = strategy.clientSecret;
-                }
                 const tokenRes = await fetch(strategy.meta?.token_endpoint, {
                     body: new URLSearchParams(body),
                     headers: {
@@ -149,12 +159,40 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     tokenRes
                 });
                 const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
-                debugLogger.info({
-                    msg: 'tokenResss',
-                    tokenRes
-                });
+                if (error) {
+                    req.payload.logger.error('Error swapping access code with access token:');
+                    req.payload.logger.error({
+                        err: error,
+                        error_description
+                    });
+                    return Response.redirect(failedRedirect);
+                }
+                // Fetch Figma user info for handle and profile image
+                let figmaUserInfo = null;
+                try {
+                    figmaUserInfo = await getUserInfo(access_token);
+                    debugLogger.info({
+                        figmaUserInfo,
+                        msg: 'Fetched Figma user info'
+                    });
+                } catch (err) {
+                    // Non-fatal: user will just not have handle/image
+                    debugLogger.error({
+                        err,
+                        msg: 'Failed to fetch Figma user info'
+                    });
+                }
+                if (!access_token) {
+                    const errMsg = 'No access_token was returned from the identity provider.';
+                    req.payload.logger.error({
+                        msg: errMsg,
+                        path,
+                        tokenRes
+                    });
+                    throw new APIError(errMsg);
+                }
                 // Swap for project token
-                const project_token = await getProjectToken(tokenRes.access_token, 'someproject');
+                const project_token = await getProjectToken(access_token, config.custom.figma.contentSystemId);
                 const refresh_token = access_token;
                 // Store project token as access_token
                 const token = project_token.token;
@@ -172,14 +210,6 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     headers: req.headers,
                     pluginOptions
                 });
-                if (error) {
-                    req.payload.logger.error('Error swapping access code with access token:');
-                    req.payload.logger.error({
-                        err: error,
-                        error_description
-                    });
-                    return Response.redirect(failedRedirect);
-                }
                 // get the payloadRedirect cookie value
                 const cookies = parseCookies(req.headers);
                 const payloadRedirect = 'payloadRedirect' in cookies ? cookies.payloadRedirect : '';
@@ -216,6 +246,21 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     value: token
                 });
                 req.responseHeaders.append('Set-Cookie', tokenCookie);
+                // Store user info in short-lived cookie for defaultVerify to consume
+                if (figmaUserInfo) {
+                    const userInfoValue = Buffer.from(JSON.stringify({
+                        handle: figmaUserInfo.handle,
+                        img_url: figmaUserInfo.img_url
+                    })).toString('base64');
+                    const userInfoCookie = generateCookie({
+                        ...cookieOptions,
+                        name: 'figma-user-info',
+                        expires: new Date(Date.now() + 60_000),
+                        returnCookieAsObject: false,
+                        value: userInfoValue
+                    });
+                    req.responseHeaders.append('Set-Cookie', userInfoCookie);
+                }
                 return Response.redirect(redirectToUse);
             } catch (err) {
                 req.payload.logger.error({

package/dist/oauth/endpoints/getLogoutEndpoint.js

@@ -1,9 +1,9 @@
 import jwt from 'jsonwebtoken';
 import { parseCookies } from 'payload';
+import { formatAdminURL } from 'payload/shared';
 import { clearCookie } from '../utilities/clearCookie.js';
 import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
 export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
@@ -23,12 +23,15 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
             }
             try {
                 await strategy.ensureMeta();
-                const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL;
-                let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`;
+                const redirectServerlURL = pluginOptions.redirectServerURL || config.serverURL;
+                let successfulLogoutRedirectDest = formatAdminURL({
+                    adminRoute: config.routes?.admin || '/admin',
+                    serverURL: redirectServerlURL
+                });
                 if (typeof req.query.redirect === 'string') {
                     successfulLogoutRedirectDest = req.query.redirect;
                 }
-                if (!baseRedirectDestination && !req.query.redirect) {
+                if (!redirectServerlURL && !req.query.redirect) {
                     debugLogger.error({
                         msg: 'No redirect URL provided',
                         path: req.pathname

package/dist/oauth/index.js

@@ -1,3 +1,4 @@
+import { fieldAffectsData } from 'payload/shared';
 import { defaultVerify } from './defaults.js';
 import { getLoginEndpoint } from './endpoints/getLoginEndpoint.js';
 import { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js';
@@ -84,14 +85,45 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 if (collectionOptions.usePayloadJWT) {
                     cookieName = `${config.cookiePrefix || 'payload'}-token`;
                 }
+                // Check if email field exists, if not add it
+                const hasEmailField = existingCollection.fields.some((field)=>'name' in field && field.name === 'email');
+                // Add email field to collection before getting username field
+                // This ensures getUsernameField can find the email field if it's configured as the username
+                const collectionWithEmail = hasEmailField ? existingCollection : {
+                    ...existingCollection,
+                    fields: [
+                        ...existingCollection.fields,
+                        {
+                            name: 'email',
+                            type: 'email',
+                            admin: {
+                                description: 'Managed by Figma',
+                                readOnly: true
+                            },
+                            unique: true
+                        }
+                    ]
+                };
                 const usernameField = getUsernameField({
-                    collection: existingCollection,
+                    collection: collectionWithEmail,
                     collectionOptions
                 });
+                // Make username field readOnly (and add description for email fields)
+                const readOnlyUsernameField = {
+                    ...usernameField,
+                    admin: {
+                        ...usernameField.admin || {},
+                        ...usernameField.name === 'email' ? {
+                            description: 'Managed by Figma'
+                        } : {},
+                        readOnly: true
+                    }
+                };
+                const isUsernameFieldString = typeof adminCollectionOptions.usernameField === 'string';
                 const fields = [
-                    ...existingCollection.fields,
-                    ...typeof adminCollectionOptions.usernameField === 'string' ? [] : [
-                        usernameField
+                    ...collectionWithEmail.fields.map((field)=>fieldAffectsData(field) && field.name === usernameField.name ? readOnlyUsernameField : field),
+                    ...isUsernameFieldString ? [] : [
+                        readOnlyUsernameField
                     ]
                 ];
                 if (disabled) {
@@ -102,7 +134,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 const strategy = new Strategy({
                     clientID: collectionOptions.clientID,
-                    clientSecret: collectionOptions.clientSecret,
                     collection: existingCollection,
                     collectionOptions,
                     cookieName,
@@ -134,6 +165,10 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 return {
                     ...existingCollection,
+                    access: {
+                        ...existingCollection.access || {},
+                        create: ()=>false
+                    },
                     auth: {
                         ...typeof existingCollection.auth === 'object' ? existingCollection.auth : {},
                         disableLocalStrategy,

package/dist/oauth/strategy/index.d.ts

@@ -4,7 +4,6 @@ import * as jose from 'jose';
 import type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js';
 export interface Options {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;
@@ -16,7 +15,6 @@ export interface Options {
 }
 export declare class Strategy {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;

package/dist/oauth/strategy/index.js

@@ -1,14 +1,13 @@
 import * as jose from 'jose';
 import { APIError, parseCookies } from 'payload';
-import { validateProjectToken } from '../../auth/jwt-validator.js';
-import { getEnvironment } from '../../constants.js';
+import { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js';
+import { getInfraEnvironment } from '../../constants.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
 import { mergeHeaders } from '../utilities/mergeHeaders.js';
 import { refreshTokens } from '../utilities/refreshTokens.js';
 export class Strategy {
     clientID;
-    clientSecret;
     collection;
     collectionOptions;
     cookieName;
@@ -28,7 +27,6 @@ export class Strategy {
         this.verify = options.verify;
         this.cookieName = options.cookieName;
         this.clientID = options.clientID;
-        this.clientSecret = options.clientSecret;
         this.identityMetadataURL = options.identityMetadata;
         this.name = options.strategyName;
         this.collection = options.collection;
@@ -63,7 +61,11 @@ export class Strategy {
             }
         }
         if (!oauthToken) {
-            if (refreshToken && canSetHeaders) {
+            // Attempt refresh even when canSetHeaders=false (e.g., during RSC navigation).
+            // This allows authentication to succeed for the current request even when
+            // cookies cannot be updated. The cookie will be refreshed on the next
+            // full page load when canSetHeaders=true.
+            if (refreshToken) {
                 debugLogger.info({
                     msg: 'No access token found, but refresh token exists. Attempting to refresh...',
                     refreshToken
@@ -83,11 +85,20 @@ export class Strategy {
                         msg: 'Token refreshed. Verifying...',
                         verifyResult
                     });
-                    if (verifyResult.responseHeaders) {
-                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    // Only return response headers (to set cookies) when canSetHeaders is true.
+                    // During RSC navigation, canSetHeaders=false because response streaming
+                    // has already started and cookies cannot be modified.
+                    if (canSetHeaders) {
+                        if (verifyResult.responseHeaders) {
+                            mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                        }
+                        return {
+                            responseHeaders: refreshed.headers,
+                            user: verifyResult.user
+                        };
                     }
+                    // Authenticate this request without updating cookies
                     return {
-                        responseHeaders: refreshed.headers,
                         user: verifyResult.user
                     };
                 } else {
@@ -97,11 +108,10 @@ export class Strategy {
                         refreshToken
                     });
                 }
-            } else {
-                return {
-                    user: null
-                };
             }
+            return {
+                user: null
+            };
         }
         let oauthTokenVerifyResult = null;
         // First, try to verify token
@@ -136,7 +146,10 @@ export class Strategy {
                 });
             }
         }
-        if (oauthTokenVerifyResult instanceof Error && oauthTokenVerifyResult.name === 'TokenExpiredError' && refreshToken && !this.collectionOptions.usePayloadJWT && canSetHeaders) {
+        // Handle expired access token with valid refresh token.
+        // Same pattern as above: refresh regardless of canSetHeaders to support RSC navigation,
+        // but only update cookies when canSetHeaders=true.
+        if (oauthTokenVerifyResult instanceof JWTValidationError && oauthTokenVerifyResult.code === 'EXPIRED' && refreshToken && !this.collectionOptions.usePayloadJWT) {
             const refreshed = await refreshTokens({
                 payload,
                 refreshToken,
@@ -157,11 +170,17 @@ export class Strategy {
                     msg: 'Token refreshed. Verifying...',
                     verifyResult
                 });
-                if (verifyResult.responseHeaders) {
-                    mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                if (canSetHeaders) {
+                    if (verifyResult.responseHeaders) {
+                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    }
+                    return {
+                        responseHeaders: refreshed.headers,
+                        user: verifyResult.user
+                    };
                 }
+                // Authenticate this request without updating cookies
                 return {
-                    responseHeaders: refreshed.headers,
                     user: verifyResult.user
                 };
             } else {
@@ -200,6 +219,10 @@ export class Strategy {
             for(let attempt = 1; attempt <= 5; attempt++){
                 try {
                     this.meta = await fetch(this.identityMetadataURL).then((res)=>res.json());
+                    if (this.meta) {
+                        // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration
+                        this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms';
+                    }
                     this.debugLog(`fetchMeta - success on attempt ${attempt}`);
                     if (this.meta?.jwks_uri) {
                         this.jwks = await fetch(this.meta.jwks_uri).then((res)=>res.json());
@@ -259,7 +282,7 @@ export class Strategy {
     }
     async jwtVerify({ payload, token }) {
         try {
-            const verified = await validateProjectToken(token, getEnvironment());
+            const verified = await validateProjectToken(token, getInfraEnvironment());
             if (typeof verified !== 'string') {
                 return verified;
             }

package/dist/oauth/types.d.ts

@@ -30,7 +30,7 @@ export interface CollectionOptions {
      * Set to false to only accept the JWT from cookies
      */
     disableJWTFromHeader?: boolean;
-    disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy'];
+    disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy'];
     /**
      * The logout button will either redirect to the IDP logout screen or
      * automatically log the user out of the IDP depending on provider.
@@ -112,11 +112,6 @@ export interface PluginOptions {
      * @default 'payload-oauth-token'
      */
     cookieName?: string;
-    /**
-     * Debug mode will log additional information to the console.
-     *
-     * NOTE: This will log sensitive information to the console.
-     */
     /**
      * Accepts incoming request and allows for modification of cookie options
      */
@@ -125,6 +120,11 @@ export interface PluginOptions {
         cookieOptions: CookieOptions;
         headers: Headers;
     }) => CookieOptions;
+    /**
+     * Debug mode will log additional information to the console.
+     *
+     * NOTE: This will log sensitive information to the console.
+     */
     debug?: boolean;
     /**
      * Disables the plugin functionality while leaving in types, fields and component modifications.

package/dist/oauth/utilities/isDuplicateKeyError.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */
+export declare function isDuplicateKeyError(error: unknown): boolean;
+//# sourceMappingURL=isDuplicateKeyError.d.ts.map

package/dist/oauth/utilities/isDuplicateKeyError.js

@@ -0,0 +1,14 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */ export function isDuplicateKeyError(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const err = error;
+    const message = typeof err.message === 'string' ? err.message : '';
+    return message.includes('409') || message.toLowerCase().includes('conflict') || message.toLowerCase().includes('already exists');
+}
+
+//# sourceMappingURL=isDuplicateKeyError.js.map

package/dist/oauth/utilities/refreshTokens.js

@@ -1,7 +1,7 @@
 import { generateCookie } from 'payload';
 import { getProjectToken } from '../../api/figma-api.js';
 import { validateProjectToken } from '../../auth/jwt-validator.js';
-import { getEnvironment } from '../../constants.js';
+import { getInfraEnvironment } from '../../constants.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { createDebugLogger } from './createDebugLogger.js';
 import { getCookieExpiration } from './getCookieExpiration.js';
@@ -16,7 +16,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
     // so we will refresh both tokens
     try {
         // Get another project token
-        const { expiresAt, token } = await getProjectToken(refreshToken, 'someproject');
+        const { expiresAt, token } = await getProjectToken(refreshToken, payload.config.custom.figma.contentSystemId);
         debugLogger.info({
             expiresAt,
             msg: 'Received new tokens from Figma API',
@@ -48,7 +48,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
                 value: token
             });
             headers.append('Set-Cookie', tokenCookie);
-            const decodedOauthToken = await validateProjectToken(token, getEnvironment());
+            const decodedOauthToken = await validateProjectToken(token, getInfraEnvironment());
             return {
                 decodedOauthToken,
                 headers,

package/dist/plugin/build-config.d.ts

@@ -10,34 +10,41 @@ import type { Config, SanitizedConfig } from 'payload';
  * @example
  * // Minimal config
  * const config: FigmaConfig = {
+ *   figma: {
+ *     contentSystemId: process.env.FIGMA_CONTENT_API_CONTENT_SYSTEM_ID!
+ *   },
  *   collections: [...]
  * }
  *
  * @example
  * // With custom editor
  * const config: FigmaConfig = {
+ *   figma: {
+ *     contentSystemId: process.env.FIGMA_CONTENT_API_CONTENT_SYSTEM_ID!
+ *   },
  *   collections: [...],
  *   editor: lexicalEditor({ features: [...] })
  * }
+ *
+ * @example
+ * // Disable Content System (use custom db)
+ * const config: FigmaConfig = {
+ *   figma: {
+ *     contentSystemId: process.env.FIGMA_CONTENT_API_CONTENT_SYSTEM_ID!,
+ *     useContentSystem: false
+ *   },
+ *   db: mongooseAdapter({ url: process.env.DATABASE_URI }),
+ *   collections: [...]
+ * }
  */
 export type FigmaConfig = {
     editor?: Config['editor'];
 } & {
     figma: {
-        region: string;
-        tenantId: string;
+        contentSystemId: string;
+        storage?: boolean;
         useContentSystem?: boolean;
     };
-} & Omit<Config, 'editor' | 'secret' | 'db'> & Partial<Pick<Config, 'db'>>;
-/**
- * Figma platform wrapper for Payload's buildConfig.
- * Automatically injects:
- * - Figma database adapter
- * - Secret (platform-provided)
- * - Default lexicalEditor (if no custom editor specified)
- *
- * @param config - Payload configuration (db and secret omitted, editor optional)
- * @returns Promise<SanitizedConfig> - Built Payload configuration
- */
-export declare function buildConfig(config: FigmaConfig): Promise<SanitizedConfig>;
+} & Omit<Config, 'db' | 'editor' | 'secret'> & Partial<Pick<Config, 'db'>>;
+export declare function buildFigmaConfig(config: FigmaConfig): Promise<SanitizedConfig>;
 //# sourceMappingURL=build-config.d.ts.map