@payloadcms/figma 0.0.1-alpha.6 → 0.0.1-alpha.61

package/dist/oauth/endpoints/getLoginEndpoint.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/endpoints/getLoginEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport jwt from 'jsonwebtoken'\nimport { APIError, generateCookie, parseCookies } from 'payload'\nimport { getSafeRedirect } from 'payload/shared'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type {\n  AfterOAuthLoginHookResult,\n  CollectionOptions,\n  PluginOptions,\n  StateObj,\n} from '../types.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js'\nimport { ProjectTokenError } from '../../auth/project-token.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { extractOrigin } from '../utilities/extractOrigin.js'\nimport { getAdminPath } from '../utilities/getAdminPath.js'\nimport { getCookieExpiration } from '../utilities/getCookieExpiration.js'\nimport { getSecondsFromTokenExp } from '../utilities/getSecondsFromTokenExp.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nconst isAbsoluteURL = (url: string) => /^[a-z][a-z\\d+.-]*:/.test(url)\n\nexport const getLoginEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const { config } = req.payload\n    const adminPath = getAdminPath(config)\n    try {\n      await strategy.ensureMeta()\n\n      const path = req.pathname\n      const debugLogger = createDebugLogger(req.payload, pluginOptions.debug)\n\n      let jsonBody: Record<string, unknown> = {}\n\n      const contentType = req.headers.get('content-type')\n\n      // Type narrow PayloadRequst's Partial<Request>\n      if (typeof req.json !== 'function' || typeof req.formData !== 'function') {\n        debugLogger.info({\n          msg: 'Request does not have json or formData methods',\n          path,\n        })\n\n        return Response.redirect(`${pluginOptions.redirectServerURL || config.serverURL}/login`)\n      }\n\n      if (collectionOptions.authorizationURLParams?.response_mode === 'query') {\n        if (Object.keys(req.query).length > 0) {\n          jsonBody = req.query\n        }\n      } else if (contentType === 'application/json') {\n        jsonBody = await req.json()\n      } else if (contentType === 'application/x-www-form-urlencoded') {\n        const formData = await req.formData()\n        jsonBody = Object.fromEntries(formData.entries())\n      }\n\n      const stateRaw = jsonBody.state as string\n      const state: StateObj = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'))\n\n      const redirectDestination =\n        state.serverURL || pluginOptions.redirectServerURL || config.serverURL\n      let failedRedirect = `${redirectDestination}${adminPath}/login`\n      let redirectToUse = `${redirectDestination}${adminPath}`\n\n      if (state.redirect) {\n        redirectToUse = state.redirect\n      }\n\n      if (state.failedRedirect) {\n        failedRedirect = state.failedRedirect\n      }\n\n      failedRedirect = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: failedRedirect })\n      redirectToUse = getSafeRedirect({ allowAbsoluteUrls: true, redirectTo: redirectToUse })\n\n      if (!isAbsoluteURL(failedRedirect)) {\n        return Response.json({ error: 'Invalid failed redirect provided' }, { status: 403 })\n      }\n      if (!isAbsoluteURL(redirectToUse)) {\n        return Response.json({ error: 'Invalid redirect provided' }, { status: 403 })\n      }\n\n      if (Array.isArray(req.payload.config.csrf) && req.payload.config.csrf.length > 0) {\n        const failedRedirectOrigin = extractOrigin(failedRedirect)\n        const redirectToUseOrigin = extractOrigin(redirectToUse)\n\n        if (failedRedirectOrigin && !req.payload.config.csrf.includes(failedRedirectOrigin)) {\n          req.payload.logger.error(\n            `Failed redirect origin ${failedRedirectOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Failed redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n\n        if (redirectToUseOrigin && !req.payload.config.csrf.includes(redirectToUseOrigin)) {\n          req.payload.logger.error(\n            `Redirect origin ${redirectToUseOrigin} is not allowed by CSRF configuration.`,\n          )\n          return Response.json(\n            { error: 'Redirect origin is not allowed by CSRF configuration.' },\n            { status: 403 },\n          )\n        }\n      }\n\n      // Verify signature\n      if (strategy.name !== req.payload.decrypt(state.sig)) {\n        req.payload.logger.error('Signature mismatch. Failing login and redirecting.')\n        return Response.redirect(failedRedirect)\n      }\n\n      if (!strategy.meta?.token_endpoint) {\n        debugLogger.error({\n          msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      debugLogger.info({ body: jsonBody, msg: 'Received login response body', path })\n\n      if (!jsonBody?.code) {\n        debugLogger.error({\n          msg: `No authorization code present in body. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      // Exchange `code` from body for refresh token\n      const { code } = jsonBody\n\n      if (typeof code !== 'string') {\n        debugLogger.error({\n          msg: `Authorization code present in body is not a string. Failing login and redirecting.`,\n          path,\n        })\n        return Response.redirect(failedRedirect)\n      }\n\n      const body: Record<string, string> = {\n        client_id: strategy.clientID,\n        code,\n        code_verifier: req.payload.decrypt(state.verifier),\n        grant_type: 'authorization_code',\n        redirect_uri: `${redirectDestination}${config?.routes?.api || '/api'}/${\n          collection.slug\n        }/${endpointSlug}/login`,\n      }\n\n      debugLogger.info({\n        msg: 'Exchanging code for access token',\n        path,\n        requestBody: body,\n      })\n\n      if (strategy.clientSecret) {\n        body.client_secret = strategy.clientSecret\n      }\n\n      const tokenRes = await fetch(strategy.meta?.token_endpoint, {\n        body: new URLSearchParams(body),\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        method: 'POST',\n      }).then((r) => r.json())\n\n      debugLogger.info({ msg: 'Token Response', path, tokenRes })\n\n      const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes\n\n      debugLogger.info({ msg: 'tokenResss', tokenRes })\n\n      // Swap for project token\n      const project_token = await getProjectToken(tokenRes.access_token, 'someproject')\n      const refresh_token = access_token\n\n      // Store project token as access_token\n\n      const token = project_token.token\n      const expiresIn = project_token.expiresAt\n\n      if (!token) {\n        const errMsg = `No ${\n          collectionOptions.token || 'access_token'\n        } was returned from the identity provider.`\n        req.payload.logger.error({ msg: errMsg, path })\n        throw new APIError(errMsg)\n      }\n\n      const cookieOptions = createCookieOptions({ collection, headers: req.headers, pluginOptions })\n\n      if (error) {\n        req.payload.logger.error('Error swapping access code with access token:')\n        req.payload.logger.error({ err: error, error_description })\n        return Response.redirect(failedRedirect)\n      }\n\n      // get the payloadRedirect cookie value\n      const cookies = parseCookies(req.headers)\n\n      const payloadRedirect =\n        'payloadRedirect' in cookies ? (cookies.payloadRedirect as string) : ''\n\n      if (!req.responseHeaders) {\n        req.responseHeaders = new Headers()\n      }\n\n      if (payloadRedirect) {\n        if (isAbsoluteURL(payloadRedirect)) {\n          redirectToUse = payloadRedirect\n        } else {\n          redirectToUse += payloadRedirect\n        }\n\n        req.responseHeaders.append(\n          'Set-Cookie',\n          `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`,\n        )\n      }\n\n      if (refresh_token && !collectionOptions.usePayloadJWT) {\n        debugLogger.info('Setting refresh token cookie')\n        const refreshCookie = generateCookie({\n          returnCookieAsObject: false,\n          ...cookieOptions,\n          name: `${strategy.cookieName}-refresh`,\n          value: refresh_token,\n          // Default to 1 year if no expiration\n          expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952),\n        }) as string\n\n        req.responseHeaders.append('Set-Cookie', refreshCookie)\n      }\n\n      const tokenExpires = cookieOptions?.expires\n        ? getCookieExpiration(cookieOptions.expires)\n        : new Date(expiresIn) // Project token uses epoch time\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: tokenExpires,\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      req.responseHeaders.append('Set-Cookie', tokenCookie)\n\n      return Response.redirect(redirectToUse)\n    } catch (err: unknown) {\n      req.payload.logger.error({ err, msg: 'Error while attempting to login', path: req.pathname })\n\n      return Response.json({ error: 'Error while attempting to login' }, { status: 500 })\n    }\n  },\n  method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',\n  path: `/${endpointSlug}/login`,\n})\n"],"names":["APIError","generateCookie","parseCookies","getSafeRedirect","getProjectToken","createCookieOptions","createDebugLogger","extractOrigin","getAdminPath","getCookieExpiration","isAbsoluteURL","url","test","getLoginEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","config","payload","adminPath","ensureMeta","path","pathname","debugLogger","debug","jsonBody","contentType","headers","get","json","formData","info","msg","Response","redirect","redirectServerURL","serverURL","authorizationURLParams","response_mode","Object","keys","query","length","fromEntries","entries","stateRaw","state","JSON","parse","Buffer","from","toString","redirectDestination","failedRedirect","redirectToUse","allowAbsoluteUrls","redirectTo","error","status","Array","isArray","csrf","failedRedirectOrigin","redirectToUseOrigin","includes","logger","name","decrypt","sig","meta","token_endpoint","body","code","client_id","clientID","code_verifier","verifier","grant_type","redirect_uri","routes","api","slug","requestBody","clientSecret","client_secret","tokenRes","fetch","URLSearchParams","method","then","r","access_token","error_description","expires_in","refreshTokenExpires","project_token","refresh_token","token","expiresIn","expiresAt","errMsg","cookieOptions","err","cookies","payloadRedirect","responseHeaders","Headers","append","usePayloadJWT","refreshCookie","returnCookieAsObject","cookieName","value","expires","tokenExpires","Date","tokenCookie"],"mappings":"AAGA,SAASA,QAAQ,EAAEC,cAAc,EAAEC,YAAY,QAAQ,UAAS;AAChE,SAASC,eAAe,QAAQ,iBAAgB;AAUhD,SAASC,eAAe,QAAQ,yBAAwB;AAIxD,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,aAAa,QAAQ,gCAA+B;AAC7D,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,mBAAmB,QAAQ,sCAAqC;AAYzE,MAAMC,gBAAgB,CAACC,MAAgB,qBAAqBC,IAAI,CAACD;AAEjE,OAAO,MAAME,mBAAmB,CAAC,EAC/BC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAM,EAAEC,MAAM,EAAE,GAAGD,IAAIE,OAAO;YAC9B,MAAMC,YAAYf,aAAaa;YAC/B,IAAI;gBACF,MAAMH,SAASM,UAAU;gBAEzB,MAAMC,OAAOL,IAAIM,QAAQ;gBACzB,MAAMC,cAAcrB,kBAAkBc,IAAIE,OAAO,EAAEL,cAAcW,KAAK;gBAEtE,IAAIC,WAAoC,CAAC;gBAEzC,MAAMC,cAAcV,IAAIW,OAAO,CAACC,GAAG,CAAC;gBAEpC,+CAA+C;gBAC/C,IAAI,OAAOZ,IAAIa,IAAI,KAAK,cAAc,OAAOb,IAAIc,QAAQ,KAAK,YAAY;oBACxEP,YAAYQ,IAAI,CAAC;wBACfC,KAAK;wBACLX;oBACF;oBAEA,OAAOY,SAASC,QAAQ,CAAC,GAAGrB,cAAcsB,iBAAiB,IAAIlB,OAAOmB,SAAS,CAAC,MAAM,CAAC;gBACzF;gBAEA,IAAIzB,kBAAkB0B,sBAAsB,EAAEC,kBAAkB,SAAS;oBACvE,IAAIC,OAAOC,IAAI,CAACxB,IAAIyB,KAAK,EAAEC,MAAM,GAAG,GAAG;wBACrCjB,WAAWT,IAAIyB,KAAK;oBACtB;gBACF,OAAO,IAAIf,gBAAgB,oBAAoB;oBAC7CD,WAAW,MAAMT,IAAIa,IAAI;gBAC3B,OAAO,IAAIH,gBAAgB,qCAAqC;oBAC9D,MAAMI,WAAW,MAAMd,IAAIc,QAAQ;oBACnCL,WAAWc,OAAOI,WAAW,CAACb,SAASc,OAAO;gBAChD;gBAEA,MAAMC,WAAWpB,SAASqB,KAAK;gBAC/B,MAAMA,QAAkBC,KAAKC,KAAK,CAACC,OAAOC,IAAI,CAACL,UAAU,UAAUM,QAAQ,CAAC;gBAE5E,MAAMC,sBACJN,MAAMV,SAAS,IAAIvB,cAAcsB,iBAAiB,IAAIlB,OAAOmB,SAAS;gBACxE,IAAIiB,iBAAiB,GAAGD,sBAAsBjC,UAAU,MAAM,CAAC;gBAC/D,IAAImC,gBAAgB,GAAGF,sBAAsBjC,WAAW;gBAExD,IAAI2B,MAAMZ,QAAQ,EAAE;oBAClBoB,gBAAgBR,MAAMZ,QAAQ;gBAChC;gBAEA,IAAIY,MAAMO,cAAc,EAAE;oBACxBA,iBAAiBP,MAAMO,cAAc;gBACvC;gBAEAA,iBAAiBtD,gBAAgB;oBAAEwD,mBAAmB;oBAAMC,YAAYH;gBAAe;gBACvFC,gBAAgBvD,gBAAgB;oBAAEwD,mBAAmB;oBAAMC,YAAYF;gBAAc;gBAErF,IAAI,CAAChD,cAAc+C,iBAAiB;oBAClC,OAAOpB,SAASJ,IAAI,CAAC;wBAAE4B,OAAO;oBAAmC,GAAG;wBAAEC,QAAQ;oBAAI;gBACpF;gBACA,IAAI,CAACpD,cAAcgD,gBAAgB;oBACjC,OAAOrB,SAASJ,IAAI,CAAC;wBAAE4B,OAAO;oBAA4B,GAAG;wBAAEC,QAAQ;oBAAI;gBAC7E;gBAEA,IAAIC,MAAMC,OAAO,CAAC5C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,KAAK7C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,CAACnB,MAAM,GAAG,GAAG;oBAChF,MAAMoB,uBAAuB3D,cAAckD;oBAC3C,MAAMU,sBAAsB5D,cAAcmD;oBAE1C,IAAIQ,wBAAwB,CAAC9C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,CAACG,QAAQ,CAACF,uBAAuB;wBACnF9C,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CACtB,CAAC,uBAAuB,EAAEK,qBAAqB,sCAAsC,CAAC;wBAExF,OAAO7B,SAASJ,IAAI,CAClB;4BAAE4B,OAAO;wBAA+D,GACxE;4BAAEC,QAAQ;wBAAI;oBAElB;oBAEA,IAAIK,uBAAuB,CAAC/C,IAAIE,OAAO,CAACD,MAAM,CAAC4C,IAAI,CAACG,QAAQ,CAACD,sBAAsB;wBACjF/C,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CACtB,CAAC,gBAAgB,EAAEM,oBAAoB,sCAAsC,CAAC;wBAEhF,OAAO9B,SAASJ,IAAI,CAClB;4BAAE4B,OAAO;wBAAwD,GACjE;4BAAEC,QAAQ;wBAAI;oBAElB;gBACF;gBAEA,mBAAmB;gBACnB,IAAI5C,SAASoD,IAAI,KAAKlD,IAAIE,OAAO,CAACiD,OAAO,CAACrB,MAAMsB,GAAG,GAAG;oBACpDpD,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;oBACzB,OAAOxB,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,IAAI,CAACvC,SAASuD,IAAI,EAAEC,gBAAgB;oBAClC/C,YAAYkC,KAAK,CAAC;wBAChBzB,KAAK,CAAC,mFAAmF,CAAC;wBAC1FX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA9B,YAAYQ,IAAI,CAAC;oBAAEwC,MAAM9C;oBAAUO,KAAK;oBAAgCX;gBAAK;gBAE7E,IAAI,CAACI,UAAU+C,MAAM;oBACnBjD,YAAYkC,KAAK,CAAC;wBAChBzB,KAAK,CAAC,qEAAqE,CAAC;wBAC5EX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,8CAA8C;gBAC9C,MAAM,EAAEmB,IAAI,EAAE,GAAG/C;gBAEjB,IAAI,OAAO+C,SAAS,UAAU;oBAC5BjD,YAAYkC,KAAK,CAAC;wBAChBzB,KAAK,CAAC,kFAAkF,CAAC;wBACzFX;oBACF;oBACA,OAAOY,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,MAAMkB,OAA+B;oBACnCE,WAAW3D,SAAS4D,QAAQ;oBAC5BF;oBACAG,eAAe3D,IAAIE,OAAO,CAACiD,OAAO,CAACrB,MAAM8B,QAAQ;oBACjDC,YAAY;oBACZC,cAAc,GAAG1B,sBAAsBnC,QAAQ8D,QAAQC,OAAO,OAAO,CAAC,EACpEtE,WAAWuE,IAAI,CAChB,CAAC,EAAErE,aAAa,MAAM,CAAC;gBAC1B;gBAEAW,YAAYQ,IAAI,CAAC;oBACfC,KAAK;oBACLX;oBACA6D,aAAaX;gBACf;gBAEA,IAAIzD,SAASqE,YAAY,EAAE;oBACzBZ,KAAKa,aAAa,GAAGtE,SAASqE,YAAY;gBAC5C;gBAEA,MAAME,WAAW,MAAMC,MAAMxE,SAASuD,IAAI,EAAEC,gBAAgB;oBAC1DC,MAAM,IAAIgB,gBAAgBhB;oBAC1B5C,SAAS;wBACP,gBAAgB;oBAClB;oBACA6D,QAAQ;gBACV,GAAGC,IAAI,CAAC,CAACC,IAAMA,EAAE7D,IAAI;gBAErBN,YAAYQ,IAAI,CAAC;oBAAEC,KAAK;oBAAkBX;oBAAMgE;gBAAS;gBAEzD,MAAM,EAAEM,YAAY,EAAElC,KAAK,EAAEmC,iBAAiB,EAAEC,YAAYC,mBAAmB,EAAE,GAAGT;gBAEpF9D,YAAYQ,IAAI,CAAC;oBAAEC,KAAK;oBAAcqD;gBAAS;gBAE/C,yBAAyB;gBACzB,MAAMU,gBAAgB,MAAM/F,gBAAgBqF,SAASM,YAAY,EAAE;gBACnE,MAAMK,gBAAgBL;gBAEtB,sCAAsC;gBAEtC,MAAMM,QAAQF,cAAcE,KAAK;gBACjC,MAAMC,YAAYH,cAAcI,SAAS;gBAEzC,IAAI,CAACF,OAAO;oBACV,MAAMG,SAAS,CAAC,GAAG,EACjBzF,kBAAkBsF,KAAK,IAAI,eAC5B,yCAAyC,CAAC;oBAC3CjF,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;wBAAEzB,KAAKoE;wBAAQ/E;oBAAK;oBAC7C,MAAM,IAAIzB,SAASwG;gBACrB;gBAEA,MAAMC,gBAAgBpG,oBAAoB;oBAAES;oBAAYiB,SAASX,IAAIW,OAAO;oBAAEd;gBAAc;gBAE5F,IAAI4C,OAAO;oBACTzC,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;oBACzBzC,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;wBAAE6C,KAAK7C;wBAAOmC;oBAAkB;oBACzD,OAAO3D,SAASC,QAAQ,CAACmB;gBAC3B;gBAEA,uCAAuC;gBACvC,MAAMkD,UAAUzG,aAAakB,IAAIW,OAAO;gBAExC,MAAM6E,kBACJ,qBAAqBD,UAAWA,QAAQC,eAAe,GAAc;gBAEvE,IAAI,CAACxF,IAAIyF,eAAe,EAAE;oBACxBzF,IAAIyF,eAAe,GAAG,IAAIC;gBAC5B;gBAEA,IAAIF,iBAAiB;oBACnB,IAAIlG,cAAckG,kBAAkB;wBAClClD,gBAAgBkD;oBAClB,OAAO;wBACLlD,iBAAiBkD;oBACnB;oBAEAxF,IAAIyF,eAAe,CAACE,MAAM,CACxB,cACA,CAAC,gBAAgB,EAAErD,cAAc,oBAAoB,CAAC;gBAE1D;gBAEA,IAAI0C,iBAAiB,CAACrF,kBAAkBiG,aAAa,EAAE;oBACrDrF,YAAYQ,IAAI,CAAC;oBACjB,MAAM8E,gBAAgBhH,eAAe;wBACnCiH,sBAAsB;wBACtB,GAAGT,aAAa;wBAChBnC,MAAM,GAAGpD,SAASiG,UAAU,CAAC,QAAQ,CAAC;wBACtCC,OAAOhB;wBACP,qCAAqC;wBACrCiB,SAAS5G,oBAAoBgG,eAAeY,WAAWnB,uBAAuB;oBAChF;oBAEA9E,IAAIyF,eAAe,CAACE,MAAM,CAAC,cAAcE;gBAC3C;gBAEA,MAAMK,eAAeb,eAAeY,UAChC5G,oBAAoBgG,cAAcY,OAAO,IACzC,IAAIE,KAAKjB,WAAW,gCAAgC;;gBACxD,MAAMkB,cAAcvH,eAAe;oBACjC,GAAGwG,aAAa;oBAChBnC,MAAMpD,SAASiG,UAAU;oBACzBE,SAASC;oBACTJ,sBAAsB;oBACtBE,OAAOf;gBACT;gBAEAjF,IAAIyF,eAAe,CAACE,MAAM,CAAC,cAAcS;gBAEzC,OAAOnF,SAASC,QAAQ,CAACoB;YAC3B,EAAE,OAAOgD,KAAc;gBACrBtF,IAAIE,OAAO,CAAC+C,MAAM,CAACR,KAAK,CAAC;oBAAE6C;oBAAKtE,KAAK;oBAAmCX,MAAML,IAAIM,QAAQ;gBAAC;gBAE3F,OAAOW,SAASJ,IAAI,CAAC;oBAAE4B,OAAO;gBAAkC,GAAG;oBAAEC,QAAQ;gBAAI;YACnF;QACF;QACA8B,QAAQ7E,kBAAkB0B,sBAAsB,EAAEC,kBAAkB,UAAU,QAAQ;QACtFjB,MAAM,CAAC,CAAC,EAAET,aAAa,MAAM,CAAC;IAChC,CAAA,EAAE"}

package/dist/oauth/endpoints/getLogoutEndpoint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getLogoutEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getLogoutEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAKzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAOhD,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,eAAO,MAAM,iBAAiB,2DAK3B,IAAI,KAAG,QA4ER,CAAA"}

package/dist/oauth/endpoints/getLogoutEndpoint.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/endpoints/getLogoutEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport jwt from 'jsonwebtoken'\nimport { parseCookies } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { PluginOptions } from '../types.js'\n\nimport { clearCookie } from '../utilities/clearCookie.js'\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getAdminPath } from '../utilities/getAdminPath.js'\n\ninterface Args {\n  collection: CollectionConfig\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nexport const getLogoutEndpoint = ({\n  collection,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const debugLogger = createDebugLogger(req.payload, pluginOptions.debug)\n    const { config } = req.payload\n\n    if (!req) {\n      debugLogger.error({ msg: 'Invalid request to logout endpoint' })\n      return Response.json({ error: 'Invalid request to logout endpoint' }, { status: 400 })\n    }\n\n    if (!req.responseHeaders) {\n      req.responseHeaders = new Headers()\n    }\n\n    try {\n      await strategy.ensureMeta()\n\n      const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL\n\n      let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`\n\n      if (typeof req.query.redirect === 'string') {\n        successfulLogoutRedirectDest = req.query.redirect\n      }\n\n      if (!baseRedirectDestination && !req.query.redirect) {\n        debugLogger.error({ msg: 'No redirect URL provided', path: req.pathname })\n        return Response.json({ error: 'No redirect URL provided' }, { status: 400 })\n      }\n\n      const cookieOptions = createCookieOptions({ collection, headers: req.headers, pluginOptions })\n\n      let redirectDestination = successfulLogoutRedirectDest\n      if (strategy.meta?.end_session_endpoint) {\n        const cookies = parseCookies(req.headers)\n\n        const token = cookies.get(strategy.cookieName)\n        if (!token) {\n          debugLogger.error({ msg: 'Unable to parse token from cookie.' })\n          return Response.json({ error: 'Unable to parse token from cookie.' }, { status: 400 })\n        }\n\n        const decodedToken = jwt.decode(token)\n        const sid = typeof decodedToken === 'object' && decodedToken ? decodedToken.sid : undefined\n\n        const body = {\n          client_id: strategy.clientID,\n          logout_hint: sid,\n          post_logout_redirect_uri: successfulLogoutRedirectDest,\n        }\n\n        const qs = new URLSearchParams(body).toString()\n        redirectDestination = `${strategy.meta.end_session_endpoint}?${qs}`\n      }\n\n      clearCookie({\n        cookieName: strategy.cookieName,\n        cookieOptions,\n        req,\n      })\n\n      clearCookie({\n        cookieName: `${strategy.cookieName}-refresh`,\n        cookieOptions,\n        req,\n      })\n\n      return Response.redirect(redirectDestination)\n    } catch (err: unknown) {\n      req.payload.logger.error({ err, msg: 'Error while attempting to logout', path: req.pathname })\n\n      return Response.json({ error: 'Error while attempting to logout' }, { status: 500 })\n    }\n  },\n  method: 'get',\n  path: `/${endpointSlug}/logout`,\n})\n"],"names":["jwt","parseCookies","clearCookie","createCookieOptions","createDebugLogger","getAdminPath","getLogoutEndpoint","collection","endpointSlug","pluginOptions","strategy","handler","req","debugLogger","payload","debug","config","error","msg","Response","json","status","responseHeaders","Headers","ensureMeta","baseRedirectDestination","redirectServerURL","serverURL","successfulLogoutRedirectDest","query","redirect","path","pathname","cookieOptions","headers","redirectDestination","meta","end_session_endpoint","cookies","token","get","cookieName","decodedToken","decode","sid","undefined","body","client_id","clientID","logout_hint","post_logout_redirect_uri","qs","URLSearchParams","toString","err","logger","method"],"mappings":"AAEA,OAAOA,SAAS,eAAc;AAC9B,SAASC,YAAY,QAAQ,UAAS;AAKtC,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,YAAY,QAAQ,+BAA8B;AAS3D,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,UAAU,EACVC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAMC,cAAcT,kBAAkBQ,IAAIE,OAAO,EAAEL,cAAcM,KAAK;YACtE,MAAM,EAAEC,MAAM,EAAE,GAAGJ,IAAIE,OAAO;YAE9B,IAAI,CAACF,KAAK;gBACRC,YAAYI,KAAK,CAAC;oBAAEC,KAAK;gBAAqC;gBAC9D,OAAOC,SAASC,IAAI,CAAC;oBAAEH,OAAO;gBAAqC,GAAG;oBAAEI,QAAQ;gBAAI;YACtF;YAEA,IAAI,CAACT,IAAIU,eAAe,EAAE;gBACxBV,IAAIU,eAAe,GAAG,IAAIC;YAC5B;YAEA,IAAI;gBACF,MAAMb,SAASc,UAAU;gBAEzB,MAAMC,0BAA0BhB,cAAciB,iBAAiB,IAAIV,OAAOW,SAAS;gBAEnF,IAAIC,+BAA+B,GAAGH,0BAA0BpB,aAAaW,SAAS;gBAEtF,IAAI,OAAOJ,IAAIiB,KAAK,CAACC,QAAQ,KAAK,UAAU;oBAC1CF,+BAA+BhB,IAAIiB,KAAK,CAACC,QAAQ;gBACnD;gBAEA,IAAI,CAACL,2BAA2B,CAACb,IAAIiB,KAAK,CAACC,QAAQ,EAAE;oBACnDjB,YAAYI,KAAK,CAAC;wBAAEC,KAAK;wBAA4Ba,MAAMnB,IAAIoB,QAAQ;oBAAC;oBACxE,OAAOb,SAASC,IAAI,CAAC;wBAAEH,OAAO;oBAA2B,GAAG;wBAAEI,QAAQ;oBAAI;gBAC5E;gBAEA,MAAMY,gBAAgB9B,oBAAoB;oBAAEI;oBAAY2B,SAAStB,IAAIsB,OAAO;oBAAEzB;gBAAc;gBAE5F,IAAI0B,sBAAsBP;gBAC1B,IAAIlB,SAAS0B,IAAI,EAAEC,sBAAsB;oBACvC,MAAMC,UAAUrC,aAAaW,IAAIsB,OAAO;oBAExC,MAAMK,QAAQD,QAAQE,GAAG,CAAC9B,SAAS+B,UAAU;oBAC7C,IAAI,CAACF,OAAO;wBACV1B,YAAYI,KAAK,CAAC;4BAAEC,KAAK;wBAAqC;wBAC9D,OAAOC,SAASC,IAAI,CAAC;4BAAEH,OAAO;wBAAqC,GAAG;4BAAEI,QAAQ;wBAAI;oBACtF;oBAEA,MAAMqB,eAAe1C,IAAI2C,MAAM,CAACJ;oBAChC,MAAMK,MAAM,OAAOF,iBAAiB,YAAYA,eAAeA,aAAaE,GAAG,GAAGC;oBAElF,MAAMC,OAAO;wBACXC,WAAWrC,SAASsC,QAAQ;wBAC5BC,aAAaL;wBACbM,0BAA0BtB;oBAC5B;oBAEA,MAAMuB,KAAK,IAAIC,gBAAgBN,MAAMO,QAAQ;oBAC7ClB,sBAAsB,GAAGzB,SAAS0B,IAAI,CAACC,oBAAoB,CAAC,CAAC,EAAEc,IAAI;gBACrE;gBAEAjD,YAAY;oBACVuC,YAAY/B,SAAS+B,UAAU;oBAC/BR;oBACArB;gBACF;gBAEAV,YAAY;oBACVuC,YAAY,GAAG/B,SAAS+B,UAAU,CAAC,QAAQ,CAAC;oBAC5CR;oBACArB;gBACF;gBAEA,OAAOO,SAASW,QAAQ,CAACK;YAC3B,EAAE,OAAOmB,KAAc;gBACrB1C,IAAIE,OAAO,CAACyC,MAAM,CAACtC,KAAK,CAAC;oBAAEqC;oBAAKpC,KAAK;oBAAoCa,MAAMnB,IAAIoB,QAAQ;gBAAC;gBAE5F,OAAOb,SAASC,IAAI,CAAC;oBAAEH,OAAO;gBAAmC,GAAG;oBAAEI,QAAQ;gBAAI;YACpF;QACF;QACAmC,QAAQ;QACRzB,MAAM,CAAC,CAAC,EAAEvB,aAAa,OAAO,CAAC;IACjC,CAAA,EAAE"}

package/dist/oauth/endpoints/getMetaEndpoint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getMetaEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getMetaEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAInE,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,eAAO,MAAM,eAAe,8EAMzB,IAAI,KAAG,QAkBR,CAAA"}

package/dist/oauth/endpoints/getMetaEndpoint.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/endpoints/getMetaEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { CollectionOptions, PluginOptions } from '../types.js'\n\nimport { getAuthorizeURL } from '../utilities/getAuthorizeURL.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nexport const getMetaEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const authorizeURL = await getAuthorizeURL({\n      collection,\n      collectionOptions,\n      endpointSlug,\n      failedRedirect: req.query.failedRedirect,\n      payload: req.payload,\n      pluginOptions,\n      redirect: req.query.redirect as string,\n      serverURLOverride: req.query.serverURL as string,\n      strategy,\n    })\n\n    return Response.json({ authorizeURL }, { status: 200 })\n  },\n  method: 'get',\n  path: `/${endpointSlug}/meta`,\n})\n"],"names":["getAuthorizeURL","getMetaEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","authorizeURL","failedRedirect","query","payload","redirect","serverURLOverride","serverURL","Response","json","status","method","path"],"mappings":"AAKA,SAASA,eAAe,QAAQ,kCAAiC;AAUjE,OAAO,MAAMC,kBAAkB,CAAC,EAC9BC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAMC,eAAe,MAAMT,gBAAgB;gBACzCE;gBACAC;gBACAC;gBACAM,gBAAgBF,IAAIG,KAAK,CAACD,cAAc;gBACxCE,SAASJ,IAAII,OAAO;gBACpBP;gBACAQ,UAAUL,IAAIG,KAAK,CAACE,QAAQ;gBAC5BC,mBAAmBN,IAAIG,KAAK,CAACI,SAAS;gBACtCT;YACF;YAEA,OAAOU,SAASC,IAAI,CAAC;gBAAER;YAAa,GAAG;gBAAES,QAAQ;YAAI;QACvD;QACAC,QAAQ;QACRC,MAAM,CAAC,CAAC,EAAEhB,aAAa,KAAK,CAAC;IAC/B,CAAA,EAAE"}

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getRedirectToLoginEndpoint.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/getRedirectToLoginEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAInE,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,eAAO,MAAM,0BAA0B,8EAMpC,IAAI,KAAG,QAkBR,CAAA"}

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/endpoints/getRedirectToLoginEndpoint.ts"],"sourcesContent":["import type { CollectionConfig, Endpoint } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { CollectionOptions, PluginOptions } from '../types.js'\n\nimport { getAuthorizeURL } from '../utilities/getAuthorizeURL.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  pluginOptions: PluginOptions\n  strategy: Strategy\n}\n\nexport const getRedirectToLoginEndpoint = ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  pluginOptions,\n  strategy,\n}: Args): Endpoint => ({\n  handler: async (req) => {\n    const authorizeURL = await getAuthorizeURL({\n      collection,\n      collectionOptions,\n      endpointSlug,\n      failedRedirect: req.query.failedRedirect,\n      payload: req.payload,\n      pluginOptions,\n      redirect: req.query.redirect as string,\n      serverURLOverride: req.query.serverURL as string,\n      strategy,\n    })\n\n    return Response.redirect(authorizeURL)\n  },\n  method: 'get',\n  path: `/${endpointSlug}/login`,\n})\n"],"names":["getAuthorizeURL","getRedirectToLoginEndpoint","collection","collectionOptions","endpointSlug","pluginOptions","strategy","handler","req","authorizeURL","failedRedirect","query","payload","redirect","serverURLOverride","serverURL","Response","method","path"],"mappings":"AAKA,SAASA,eAAe,QAAQ,kCAAiC;AAUjE,OAAO,MAAMC,6BAA6B,CAAC,EACzCC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,aAAa,EACbC,QAAQ,EACH,GAAgB,CAAA;QACrBC,SAAS,OAAOC;YACd,MAAMC,eAAe,MAAMT,gBAAgB;gBACzCE;gBACAC;gBACAC;gBACAM,gBAAgBF,IAAIG,KAAK,CAACD,cAAc;gBACxCE,SAASJ,IAAII,OAAO;gBACpBP;gBACAQ,UAAUL,IAAIG,KAAK,CAACE,QAAQ;gBAC5BC,mBAAmBN,IAAIG,KAAK,CAACI,SAAS;gBACtCT;YACF;YAEA,OAAOU,SAASH,QAAQ,CAACJ;QAC3B;QACAQ,QAAQ;QACRC,MAAM,CAAC,CAAC,EAAEd,aAAa,MAAM,CAAC;IAChC,CAAA,EAAE"}

package/dist/oauth/exports/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/oauth/exports/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA"}

package/dist/oauth/exports/client.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/exports/client.ts"],"sourcesContent":["export { DefaultLoginButton } from '../components/LoginButton/index.jsx'\nexport { LogoutButton } from '../components/LogoutButton/index.jsx'\n"],"names":["DefaultLoginButton","LogoutButton"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,sCAAqC;AACxE,SAASC,YAAY,QAAQ,uCAAsC"}

package/dist/oauth/hooks/afterLogout.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"afterLogout.d.ts","sourceRoot":"","sources":["../../../src/oauth/hooks/afterLogout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAKhD,eAAO,MAAM,cAAc,+CAKtB;IACD,UAAU,EAAE,gBAAgB,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,aAAa,CAAA;CAC7B,KAAG,yBAuBH,CAAA"}

package/dist/oauth/hooks/afterLogout.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/hooks/afterLogout.ts"],"sourcesContent":["import type { CollectionAfterLogoutHook, CollectionConfig } from 'payload'\n\nimport type { PluginOptions } from '../types.js'\n\nimport { clearCookie } from '../utilities/clearCookie.js'\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\n\nexport const getAfterLogout =\n  ({\n    collection,\n    cookieName,\n    pluginOptions,\n  }: {\n    collection: CollectionConfig\n    cookieName: string\n    pluginOptions: PluginOptions\n  }): CollectionAfterLogoutHook =>\n  ({ req }) => {\n    if (!req) {\n      return\n    }\n\n    if (!req.responseHeaders) {\n      req.responseHeaders = new Headers()\n    }\n\n    const cookieOptions = createCookieOptions({ collection, headers: req.headers, pluginOptions })\n\n    clearCookie({\n      cookieName,\n      cookieOptions,\n      req,\n    })\n\n    clearCookie({\n      cookieName: `${cookieName}-refresh`,\n      cookieOptions,\n      req,\n    })\n  }\n"],"names":["clearCookie","createCookieOptions","getAfterLogout","collection","cookieName","pluginOptions","req","responseHeaders","Headers","cookieOptions","headers"],"mappings":"AAIA,SAASA,WAAW,QAAQ,8BAA6B;AACzD,SAASC,mBAAmB,QAAQ,sCAAqC;AAEzE,OAAO,MAAMC,iBACX,CAAC,EACCC,UAAU,EACVC,UAAU,EACVC,aAAa,EAKd,GACD,CAAC,EAAEC,GAAG,EAAE;QACN,IAAI,CAACA,KAAK;YACR;QACF;QAEA,IAAI,CAACA,IAAIC,eAAe,EAAE;YACxBD,IAAIC,eAAe,GAAG,IAAIC;QAC5B;QAEA,MAAMC,gBAAgBR,oBAAoB;YAAEE;YAAYO,SAASJ,IAAII,OAAO;YAAEL;QAAc;QAE5FL,YAAY;YACVI;YACAK;YACAH;QACF;QAEAN,YAAY;YACVI,YAAY,GAAGA,WAAW,QAAQ,CAAC;YACnCK;YACAH;QACF;IACF,EAAC"}

package/dist/oauth/hooks/me.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/oauth/hooks/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAgB,MAAM,SAAS,CAAA;AAK7D,eAAO,MAAM,SAAS,mBACH;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,KAAG,gBAgDzC,CAAA"}

package/dist/oauth/hooks/me.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/hooks/me.ts"],"sourcesContent":["import { type CollectionMeHook, parseCookies } from 'payload'\n\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\n\nexport const getMeHook =\n  ({ cookieName }: { cookieName: string }): CollectionMeHook =>\n  // eslint-disable-next-line @typescript-eslint/require-await\n  async ({ args, user }) => {\n    const debugLogger = createDebugLogger(args.req.payload, false)\n\n    const cookies = parseCookies(args.req.headers)\n    const refreshToken = cookies.get(`${cookieName}-refresh`)\n    let token = cookies.get(cookieName)\n\n    let exp: number | undefined\n\n    if (refreshToken) {\n      exp = getTokenExp({ debugLogger, token: refreshToken })\n      if (exp) {\n        return {\n          exp,\n          user,\n        }\n      }\n    }\n\n    if (!token) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = args.req.headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        token = jwtFromHeader.replace('Bearer ', '')\n        exp = getTokenExp({ debugLogger, token })\n        if (exp) {\n          return {\n            exp,\n            user,\n          }\n        }\n      }\n    }\n\n    if (token) {\n      exp = getTokenExp({ debugLogger, token })\n\n      if (exp) {\n        return {\n          exp,\n          user,\n        }\n      }\n    }\n\n    return undefined\n  }\n"],"names":["parseCookies","createDebugLogger","getTokenExp","getMeHook","cookieName","args","user","debugLogger","req","payload","cookies","headers","refreshToken","get","token","exp","jwtFromHeader","startsWith","replace","undefined"],"mappings":"AAAA,SAAgCA,YAAY,QAAQ,UAAS;AAE7D,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AAEzD,OAAO,MAAMC,YACX,CAAC,EAAEC,UAAU,EAA0B,GACvC,4DAA4D;IAC5D,OAAO,EAAEC,IAAI,EAAEC,IAAI,EAAE;QACnB,MAAMC,cAAcN,kBAAkBI,KAAKG,GAAG,CAACC,OAAO,EAAE;QAExD,MAAMC,UAAUV,aAAaK,KAAKG,GAAG,CAACG,OAAO;QAC7C,MAAMC,eAAeF,QAAQG,GAAG,CAAC,GAAGT,WAAW,QAAQ,CAAC;QACxD,IAAIU,QAAQJ,QAAQG,GAAG,CAACT;QAExB,IAAIW;QAEJ,IAAIH,cAAc;YAChBG,MAAMb,YAAY;gBAAEK;gBAAaO,OAAOF;YAAa;YACrD,IAAIG,KAAK;gBACP,OAAO;oBACLA;oBACAT;gBACF;YACF;QACF;QAEA,IAAI,CAACQ,OAAO;YACV,uCAAuC;YACvC,MAAME,gBAAgBX,KAAKG,GAAG,CAACG,OAAO,CAACE,GAAG,CAAC;YAC3C,IAAI,OAAOG,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5EH,QAAQE,cAAcE,OAAO,CAAC,WAAW;gBACzCH,MAAMb,YAAY;oBAAEK;oBAAaO;gBAAM;gBACvC,IAAIC,KAAK;oBACP,OAAO;wBACLA;wBACAT;oBACF;gBACF;YACF;QACF;QAEA,IAAIQ,OAAO;YACTC,MAAMb,YAAY;gBAAEK;gBAAaO;YAAM;YAEvC,IAAIC,KAAK;gBACP,OAAO;oBACLA;oBACAT;gBACF;YACF;QACF;QAEA,OAAOa;IACT,EAAC"}

package/dist/oauth/hooks/refresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/oauth/hooks/refresh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,qBAAqB,EAAgC,MAAM,SAAS,CAAA;AAElF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAShD,eAAO,MAAM,cAAc,iCAItB;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB,KAAG,qBAiGH,CAAA"}

package/dist/oauth/hooks/refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/hooks/refresh.ts"],"sourcesContent":["import jwt from 'jsonwebtoken'\nimport { type CollectionRefreshHook, generateCookie, parseCookies } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { PluginOptions } from '../types.js'\n\nimport { createCookieOptions } from '../utilities/createCookieOptions.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getCookieExpiration } from '../utilities/getCookieExpiration.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport const getRefreshHook =\n  ({\n    pluginOptions,\n    strategy,\n  }: {\n    pluginOptions: PluginOptions\n    strategy: Strategy\n  }): CollectionRefreshHook =>\n  async ({ args, user }) => {\n    if (!args.req.responseHeaders) {\n      args.req.responseHeaders = new Headers()\n    }\n\n    const debugLogger = createDebugLogger(args.req.payload, strategy.debug)\n\n    const cookies = parseCookies(args.req.headers)\n\n    if (strategy.collectionOptions.usePayloadJWT) {\n      const token = cookies.get(strategy.cookieName)\n\n      if (!token) {\n        args.req.payload.logger.error(`No token found under cookie: ${strategy.cookieName}`)\n        return undefined\n      }\n\n      const decoded = jwt.verify(token, args.req.payload.secret)\n\n      strategy.debugLog('usePayloadJWT: true - Refreshing token', {\n        decoded,\n        [strategy.cookieName]: token,\n      })\n\n      if (decoded && typeof decoded === 'object') {\n        const auth = typeof strategy.collection.auth === 'object' ? strategy.collection.auth : {}\n        const { tokenExpiration: authTokenExp } = auth\n        const tokenExpiration = authTokenExp || 7200\n\n        delete decoded.exp\n        delete decoded.iat\n\n        const refreshedToken = jwt.sign(decoded, args.req.payload.secret, {\n          expiresIn: tokenExpiration,\n        })\n\n        const cookieOptions = createCookieOptions({\n          collection: strategy.collection,\n          headers: args.req.headers,\n          pluginOptions,\n        })\n\n        const refreshCookie = generateCookie({\n          returnCookieAsObject: false,\n          ...cookieOptions,\n          name: `${strategy.cookieName}-refresh`,\n          expires: getCookieExpiration(\n            cookieOptions?.expires ?? getTokenExp({ debugLogger, token }) ?? 31_556_952,\n          ),\n          value: refreshedToken,\n        }) as string\n\n        args.req.responseHeaders.append('Set-Cookie', refreshCookie)\n\n        const newDecoded = jwt.decode(refreshedToken)\n\n        strategy.debugLog('usePayloadJWT: true - Received new refresh token', {\n          newDecoded,\n          refreshedToken,\n        })\n\n        if (typeof newDecoded === 'object' && newDecoded) {\n          return {\n            exp: Number(newDecoded.exp),\n            refreshedToken,\n            strategy: strategy.name,\n            user,\n          }\n        }\n      }\n    } else {\n      const refreshToken = cookies.get(`${strategy.cookieName}-refresh`)\n\n      if (!refreshToken) {\n        return undefined\n      }\n\n      const result = await refreshTokens({ payload: args.req.payload, refreshToken, strategy })\n\n      if (!result) {\n        return undefined\n      }\n\n      mergeHeaders(result.headers, args.req.responseHeaders)\n\n      if (result.decodedOauthToken.exp) {\n        return {\n          exp: result.decodedOauthToken.exp,\n          refreshedToken: result.token,\n          strategy: strategy.name,\n          user,\n        }\n      }\n    }\n\n    return undefined\n  }\n"],"names":["jwt","generateCookie","parseCookies","createCookieOptions","createDebugLogger","getCookieExpiration","getTokenExp","mergeHeaders","refreshTokens","getRefreshHook","pluginOptions","strategy","args","user","req","responseHeaders","Headers","debugLogger","payload","debug","cookies","headers","collectionOptions","usePayloadJWT","token","get","cookieName","logger","error","undefined","decoded","verify","secret","debugLog","auth","collection","tokenExpiration","authTokenExp","exp","iat","refreshedToken","sign","expiresIn","cookieOptions","refreshCookie","returnCookieAsObject","name","expires","value","append","newDecoded","decode","Number","refreshToken","result","decodedOauthToken"],"mappings":"AAAA,OAAOA,SAAS,eAAc;AAC9B,SAAqCC,cAAc,EAAEC,YAAY,QAAQ,UAAS;AAKlF,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,mBAAmB,QAAQ,sCAAqC;AACzE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAE7D,OAAO,MAAMC,iBACX,CAAC,EACCC,aAAa,EACbC,QAAQ,EAIT,GACD,OAAO,EAAEC,IAAI,EAAEC,IAAI,EAAE;QACnB,IAAI,CAACD,KAAKE,GAAG,CAACC,eAAe,EAAE;YAC7BH,KAAKE,GAAG,CAACC,eAAe,GAAG,IAAIC;QACjC;QAEA,MAAMC,cAAcb,kBAAkBQ,KAAKE,GAAG,CAACI,OAAO,EAAEP,SAASQ,KAAK;QAEtE,MAAMC,UAAUlB,aAAaU,KAAKE,GAAG,CAACO,OAAO;QAE7C,IAAIV,SAASW,iBAAiB,CAACC,aAAa,EAAE;YAC5C,MAAMC,QAAQJ,QAAQK,GAAG,CAACd,SAASe,UAAU;YAE7C,IAAI,CAACF,OAAO;gBACVZ,KAAKE,GAAG,CAACI,OAAO,CAACS,MAAM,CAACC,KAAK,CAAC,CAAC,6BAA6B,EAAEjB,SAASe,UAAU,EAAE;gBACnF,OAAOG;YACT;YAEA,MAAMC,UAAU9B,IAAI+B,MAAM,CAACP,OAAOZ,KAAKE,GAAG,CAACI,OAAO,CAACc,MAAM;YAEzDrB,SAASsB,QAAQ,CAAC,0CAA0C;gBAC1DH;gBACA,CAACnB,SAASe,UAAU,CAAC,EAAEF;YACzB;YAEA,IAAIM,WAAW,OAAOA,YAAY,UAAU;gBAC1C,MAAMI,OAAO,OAAOvB,SAASwB,UAAU,CAACD,IAAI,KAAK,WAAWvB,SAASwB,UAAU,CAACD,IAAI,GAAG,CAAC;gBACxF,MAAM,EAAEE,iBAAiBC,YAAY,EAAE,GAAGH;gBAC1C,MAAME,kBAAkBC,gBAAgB;gBAExC,OAAOP,QAAQQ,GAAG;gBAClB,OAAOR,QAAQS,GAAG;gBAElB,MAAMC,iBAAiBxC,IAAIyC,IAAI,CAACX,SAASlB,KAAKE,GAAG,CAACI,OAAO,CAACc,MAAM,EAAE;oBAChEU,WAAWN;gBACb;gBAEA,MAAMO,gBAAgBxC,oBAAoB;oBACxCgC,YAAYxB,SAASwB,UAAU;oBAC/Bd,SAAST,KAAKE,GAAG,CAACO,OAAO;oBACzBX;gBACF;gBAEA,MAAMkC,gBAAgB3C,eAAe;oBACnC4C,sBAAsB;oBACtB,GAAGF,aAAa;oBAChBG,MAAM,GAAGnC,SAASe,UAAU,CAAC,QAAQ,CAAC;oBACtCqB,SAAS1C,oBACPsC,eAAeI,WAAWzC,YAAY;wBAAEW;wBAAaO;oBAAM,MAAM;oBAEnEwB,OAAOR;gBACT;gBAEA5B,KAAKE,GAAG,CAACC,eAAe,CAACkC,MAAM,CAAC,cAAcL;gBAE9C,MAAMM,aAAalD,IAAImD,MAAM,CAACX;gBAE9B7B,SAASsB,QAAQ,CAAC,oDAAoD;oBACpEiB;oBACAV;gBACF;gBAEA,IAAI,OAAOU,eAAe,YAAYA,YAAY;oBAChD,OAAO;wBACLZ,KAAKc,OAAOF,WAAWZ,GAAG;wBAC1BE;wBACA7B,UAAUA,SAASmC,IAAI;wBACvBjC;oBACF;gBACF;YACF;QACF,OAAO;YACL,MAAMwC,eAAejC,QAAQK,GAAG,CAAC,GAAGd,SAASe,UAAU,CAAC,QAAQ,CAAC;YAEjE,IAAI,CAAC2B,cAAc;gBACjB,OAAOxB;YACT;YAEA,MAAMyB,SAAS,MAAM9C,cAAc;gBAAEU,SAASN,KAAKE,GAAG,CAACI,OAAO;gBAAEmC;gBAAc1C;YAAS;YAEvF,IAAI,CAAC2C,QAAQ;gBACX,OAAOzB;YACT;YAEAtB,aAAa+C,OAAOjC,OAAO,EAAET,KAAKE,GAAG,CAACC,eAAe;YAErD,IAAIuC,OAAOC,iBAAiB,CAACjB,GAAG,EAAE;gBAChC,OAAO;oBACLA,KAAKgB,OAAOC,iBAAiB,CAACjB,GAAG;oBACjCE,gBAAgBc,OAAO9B,KAAK;oBAC5Bb,UAAUA,SAASmC,IAAI;oBACvBjC;gBACF;YACF;QACF;QAEA,OAAOgB;IACT,EAAC"}

package/dist/oauth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkC,MAAM,EAAE,MAAM,SAAS,CAAA;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAc/C,eAAO,MAAM,YAAY,kBACP,aAAa,KAAG,MAiP/B,CAAA"}

package/dist/oauth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/oauth/index.ts"],"sourcesContent":["import type { AuthStrategy, IncomingAuthType, Plugin } from 'payload'\n\nimport type { PluginOptions } from './types.js'\n\nimport { defaultVerify } from './defaults.js'\nimport { getLoginEndpoint } from './endpoints/getLoginEndpoint.js'\nimport { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js'\nimport { getMetaEndpoint } from './endpoints/getMetaEndpoint.js'\nimport { getRedirectToLoginEndpoint } from './endpoints/getRedirectToLoginEndpoint.js'\nimport { getAfterLogout } from './hooks/afterLogout.js'\nimport { getMeHook } from './hooks/me.js'\nimport { getRefreshHook } from './hooks/refresh.js'\nimport { Strategy } from './strategy/index.js'\nimport { getAdminCollectionSlug } from './utilities/getAdminCollectionSlug.js'\nimport { getUsernameField } from './utilities/getUsernameField.js'\n\nexport const oAuth2Plugin =\n  (pluginOptions: PluginOptions): Plugin =>\n  (config) => {\n    const { collections: allCollectionOptions, debug, disabled } = pluginOptions\n\n    const strategyName = pluginOptions?.strategyName || 'oauth'\n    // Defaults to sso, but can be overridden to accommodate multiple strategies on one collection\n    const endpointSlug = pluginOptions?.strategyName || 'sso'\n\n    const adminCollectionSlug = getAdminCollectionSlug(config)\n    const adminCollectionOptions = allCollectionOptions.find(\n      ({ slug }) => slug === adminCollectionSlug,\n    )\n\n    if (!adminCollectionOptions) {\n      throw new Error(\n        `Can't find collection options for the admin collection ${adminCollectionSlug}.`,\n      )\n    }\n\n    let LoginButton = null\n\n    if (adminCollectionOptions.LoginButton === false) {\n      LoginButton = null\n    } else if (typeof adminCollectionOptions.LoginButton === 'string') {\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: adminCollectionOptions.LoginButton,\n      }\n    } else if (typeof adminCollectionOptions.LoginButton === 'object') {\n      LoginButton = {\n        ...adminCollectionOptions.LoginButton,\n        clientProps: {\n          ...adminCollectionOptions.LoginButton.clientProps,\n          disabled,\n          endpointSlug,\n        },\n      }\n    } else {\n      // Default to the provided LoginButton component path\n      LoginButton = {\n        clientProps: {\n          disabled,\n          endpointSlug,\n        },\n        path: '@payloadcms/figma/client#DefaultLoginButton',\n      }\n    }\n\n    return {\n      ...config,\n      admin: {\n        ...(config.admin || {}),\n        components: {\n          ...(typeof config.admin === 'object' && typeof config.admin.components === 'object'\n            ? config.admin.components\n            : {}),\n          ...(adminCollectionOptions.endOAuthSessionOnLogout\n            ? {\n                logout: {\n                  Button: {\n                    clientProps: {\n                      disabled,\n                      endpointSlug,\n                    },\n                    path: '@payloadcms/figma/client#LogoutButton',\n                  },\n                },\n              }\n            : {}),\n          beforeLogin: [\n            ...(typeof config.admin === 'object' &&\n            typeof config.admin.components === 'object' &&\n            Array.isArray(config.admin.components.beforeLogin)\n              ? config.admin.components.beforeLogin\n              : []),\n            ...(LoginButton ? [LoginButton] : []),\n          ],\n        },\n      },\n      collections: (config.collections || []).map((existingCollection) => {\n        const collectionOptions = allCollectionOptions.find(\n          ({ slug }) => slug === existingCollection.slug,\n        )\n\n        if (!collectionOptions) {\n          return existingCollection\n        }\n\n        let cookieName = pluginOptions?.cookieName || `payload-${strategyName}-token`\n        // If the usePayloadJWT option is enabled, use the default cookie name from Payload\n        if (collectionOptions.usePayloadJWT) {\n          cookieName = `${config.cookiePrefix || 'payload'}-token`\n        }\n\n        const usernameField = getUsernameField({\n          collection: existingCollection,\n          collectionOptions,\n        })\n\n        // Check if email field exists, if not add it\n        const hasEmailField = existingCollection.fields.some(\n          (field) => 'name' in field && field.name === 'email',\n        )\n\n        const fields = [\n          ...existingCollection.fields,\n          ...(typeof adminCollectionOptions.usernameField === 'string' ? [] : [usernameField]),\n          ...(!hasEmailField\n            ? [\n                {\n                  name: 'email',\n                  type: 'email' as const,\n                },\n              ]\n            : []),\n        ]\n\n        if (disabled) {\n          return {\n            ...existingCollection,\n            fields,\n          }\n        }\n\n        const strategy = new Strategy({\n          clientID: collectionOptions.clientID,\n          clientSecret: collectionOptions.clientSecret,\n          collection: existingCollection,\n          collectionOptions,\n          cookieName,\n          debug,\n          identityMetadata: collectionOptions.identityMetadata,\n          pluginOptions,\n          strategyName,\n          verify:\n            collectionOptions.verify ??\n            defaultVerify({\n              collection: existingCollection,\n              strategyName,\n              usernameField,\n            }),\n        })\n\n        const authStrategy: AuthStrategy = {\n          name: `${existingCollection.slug}-${strategyName}`,\n          // Bind 'this' to ensure the authenticate function has the correct context\n          authenticate: strategy.authenticate.bind(strategy),\n        }\n\n        let disableLocalStrategy: IncomingAuthType['disableLocalStrategy']\n\n        if (collectionOptions.disableLocalStrategy === false) {\n          // When the plugin collection option has disableLocalStrategy option set to false, do not disable the local strategy\n          disableLocalStrategy = undefined\n        } else if (collectionOptions.disableLocalStrategy) {\n          // use the configured disableLocalStrategy which can include `enableFields`, etc.\n          disableLocalStrategy = collectionOptions.disableLocalStrategy\n        } else {\n          // by default disableLocalStrategy\n          disableLocalStrategy = true\n        }\n\n        return {\n          ...existingCollection,\n          auth: {\n            ...(typeof existingCollection.auth === 'object' ? existingCollection.auth : {}),\n            disableLocalStrategy,\n            strategies: [\n              ...(typeof existingCollection.auth === 'object' &&\n              Array.isArray(existingCollection.auth.strategies)\n                ? existingCollection.auth.strategies\n                : []),\n              authStrategy,\n            ],\n          },\n          endpoints: [\n            ...(existingCollection.endpoints || []),\n            getLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getMetaEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getLogoutEndpoint({\n              collection: existingCollection,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n            getRedirectToLoginEndpoint({\n              collection: existingCollection,\n              collectionOptions,\n              endpointSlug,\n              pluginOptions,\n              strategy,\n            }),\n          ],\n          fields,\n          hooks: {\n            ...(existingCollection.hooks || {}),\n            afterLogout: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.afterLogout)\n                ? existingCollection.hooks.afterLogout\n                : []),\n              getAfterLogout({\n                collection: existingCollection,\n                cookieName,\n                pluginOptions,\n              }),\n            ],\n            me: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.me)\n                ? existingCollection.hooks.me\n                : []),\n              // Do not inject the me hook if the usePayloadJWT option is enabled\n              ...(!collectionOptions.usePayloadJWT ? [getMeHook({ cookieName })] : []),\n            ],\n            refresh: [\n              ...(typeof existingCollection.hooks === 'object' &&\n              Array.isArray(existingCollection.hooks.refresh)\n                ? existingCollection.hooks.refresh\n                : []),\n              getRefreshHook({ pluginOptions, strategy }),\n            ],\n          },\n        }\n      }),\n    }\n  }\n"],"names":["defaultVerify","getLoginEndpoint","getLogoutEndpoint","getMetaEndpoint","getRedirectToLoginEndpoint","getAfterLogout","getMeHook","getRefreshHook","Strategy","getAdminCollectionSlug","getUsernameField","oAuth2Plugin","pluginOptions","config","collections","allCollectionOptions","debug","disabled","strategyName","endpointSlug","adminCollectionSlug","adminCollectionOptions","find","slug","Error","LoginButton","clientProps","path","admin","components","endOAuthSessionOnLogout","logout","Button","beforeLogin","Array","isArray","map","existingCollection","collectionOptions","cookieName","usePayloadJWT","cookiePrefix","usernameField","collection","hasEmailField","fields","some","field","name","type","strategy","clientID","clientSecret","identityMetadata","verify","authStrategy","authenticate","bind","disableLocalStrategy","undefined","auth","strategies","endpoints","hooks","afterLogout","me","refresh"],"mappings":"AAIA,SAASA,aAAa,QAAQ,gBAAe;AAC7C,SAASC,gBAAgB,QAAQ,kCAAiC;AAClE,SAASC,iBAAiB,QAAQ,mCAAkC;AACpE,SAASC,eAAe,QAAQ,iCAAgC;AAChE,SAASC,0BAA0B,QAAQ,4CAA2C;AACtF,SAASC,cAAc,QAAQ,yBAAwB;AACvD,SAASC,SAAS,QAAQ,gBAAe;AACzC,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,QAAQ,QAAQ,sBAAqB;AAC9C,SAASC,sBAAsB,QAAQ,wCAAuC;AAC9E,SAASC,gBAAgB,QAAQ,kCAAiC;AAElE,OAAO,MAAMC,eACX,CAACC,gBACD,CAACC;QACC,MAAM,EAAEC,aAAaC,oBAAoB,EAAEC,KAAK,EAAEC,QAAQ,EAAE,GAAGL;QAE/D,MAAMM,eAAeN,eAAeM,gBAAgB;QACpD,8FAA8F;QAC9F,MAAMC,eAAeP,eAAeM,gBAAgB;QAEpD,MAAME,sBAAsBX,uBAAuBI;QACnD,MAAMQ,yBAAyBN,qBAAqBO,IAAI,CACtD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASH;QAGzB,IAAI,CAACC,wBAAwB;YAC3B,MAAM,IAAIG,MACR,CAAC,uDAAuD,EAAEJ,oBAAoB,CAAC,CAAC;QAEpF;QAEA,IAAIK,cAAc;QAElB,IAAIJ,uBAAuBI,WAAW,KAAK,OAAO;YAChDA,cAAc;QAChB,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAMN,uBAAuBI,WAAW;YAC1C;QACF,OAAO,IAAI,OAAOJ,uBAAuBI,WAAW,KAAK,UAAU;YACjEA,cAAc;gBACZ,GAAGJ,uBAAuBI,WAAW;gBACrCC,aAAa;oBACX,GAAGL,uBAAuBI,WAAW,CAACC,WAAW;oBACjDT;oBACAE;gBACF;YACF;QACF,OAAO;YACL,qDAAqD;YACrDM,cAAc;gBACZC,aAAa;oBACXT;oBACAE;gBACF;gBACAQ,MAAM;YACR;QACF;QAEA,OAAO;YACL,GAAGd,MAAM;YACTe,OAAO;gBACL,GAAIf,OAAOe,KAAK,IAAI,CAAC,CAAC;gBACtBC,YAAY;oBACV,GAAI,OAAOhB,OAAOe,KAAK,KAAK,YAAY,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,WACvEhB,OAAOe,KAAK,CAACC,UAAU,GACvB,CAAC,CAAC;oBACN,GAAIR,uBAAuBS,uBAAuB,GAC9C;wBACEC,QAAQ;4BACNC,QAAQ;gCACNN,aAAa;oCACXT;oCACAE;gCACF;gCACAQ,MAAM;4BACR;wBACF;oBACF,IACA,CAAC,CAAC;oBACNM,aAAa;2BACP,OAAOpB,OAAOe,KAAK,KAAK,YAC5B,OAAOf,OAAOe,KAAK,CAACC,UAAU,KAAK,YACnCK,MAAMC,OAAO,CAACtB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,IAC7CpB,OAAOe,KAAK,CAACC,UAAU,CAACI,WAAW,GACnC,EAAE;2BACFR,cAAc;4BAACA;yBAAY,GAAG,EAAE;qBACrC;gBACH;YACF;YACAX,aAAa,AAACD,CAAAA,OAAOC,WAAW,IAAI,EAAE,AAAD,EAAGsB,GAAG,CAAC,CAACC;gBAC3C,MAAMC,oBAAoBvB,qBAAqBO,IAAI,CACjD,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASc,mBAAmBd,IAAI;gBAGhD,IAAI,CAACe,mBAAmB;oBACtB,OAAOD;gBACT;gBAEA,IAAIE,aAAa3B,eAAe2B,cAAc,CAAC,QAAQ,EAAErB,aAAa,MAAM,CAAC;gBAC7E,mFAAmF;gBACnF,IAAIoB,kBAAkBE,aAAa,EAAE;oBACnCD,aAAa,GAAG1B,OAAO4B,YAAY,IAAI,UAAU,MAAM,CAAC;gBAC1D;gBAEA,MAAMC,gBAAgBhC,iBAAiB;oBACrCiC,YAAYN;oBACZC;gBACF;gBAEA,6CAA6C;gBAC7C,MAAMM,gBAAgBP,mBAAmBQ,MAAM,CAACC,IAAI,CAClD,CAACC,QAAU,UAAUA,SAASA,MAAMC,IAAI,KAAK;gBAG/C,MAAMH,SAAS;uBACVR,mBAAmBQ,MAAM;uBACxB,OAAOxB,uBAAuBqB,aAAa,KAAK,WAAW,EAAE,GAAG;wBAACA;qBAAc;uBAC/E,CAACE,gBACD;wBACE;4BACEI,MAAM;4BACNC,MAAM;wBACR;qBACD,GACD,EAAE;iBACP;gBAED,IAAIhC,UAAU;oBACZ,OAAO;wBACL,GAAGoB,kBAAkB;wBACrBQ;oBACF;gBACF;gBAEA,MAAMK,WAAW,IAAI1C,SAAS;oBAC5B2C,UAAUb,kBAAkBa,QAAQ;oBACpCC,cAAcd,kBAAkBc,YAAY;oBAC5CT,YAAYN;oBACZC;oBACAC;oBACAvB;oBACAqC,kBAAkBf,kBAAkBe,gBAAgB;oBACpDzC;oBACAM;oBACAoC,QACEhB,kBAAkBgB,MAAM,IACxBtD,cAAc;wBACZ2C,YAAYN;wBACZnB;wBACAwB;oBACF;gBACJ;gBAEA,MAAMa,eAA6B;oBACjCP,MAAM,GAAGX,mBAAmBd,IAAI,CAAC,CAAC,EAAEL,cAAc;oBAClD,0EAA0E;oBAC1EsC,cAAcN,SAASM,YAAY,CAACC,IAAI,CAACP;gBAC3C;gBAEA,IAAIQ;gBAEJ,IAAIpB,kBAAkBoB,oBAAoB,KAAK,OAAO;oBACpD,oHAAoH;oBACpHA,uBAAuBC;gBACzB,OAAO,IAAIrB,kBAAkBoB,oBAAoB,EAAE;oBACjD,iFAAiF;oBACjFA,uBAAuBpB,kBAAkBoB,oBAAoB;gBAC/D,OAAO;oBACL,kCAAkC;oBAClCA,uBAAuB;gBACzB;gBAEA,OAAO;oBACL,GAAGrB,kBAAkB;oBACrBuB,MAAM;wBACJ,GAAI,OAAOvB,mBAAmBuB,IAAI,KAAK,WAAWvB,mBAAmBuB,IAAI,GAAG,CAAC,CAAC;wBAC9EF;wBACAG,YAAY;+BACN,OAAOxB,mBAAmBuB,IAAI,KAAK,YACvC1B,MAAMC,OAAO,CAACE,mBAAmBuB,IAAI,CAACC,UAAU,IAC5CxB,mBAAmBuB,IAAI,CAACC,UAAU,GAClC,EAAE;4BACNN;yBACD;oBACH;oBACAO,WAAW;2BACLzB,mBAAmByB,SAAS,IAAI,EAAE;wBACtC7D,iBAAiB;4BACf0C,YAAYN;4BACZC;4BACAnB;4BACAP;4BACAsC;wBACF;wBACA/C,gBAAgB;4BACdwC,YAAYN;4BACZC;4BACAnB;4BACAP;4BACAsC;wBACF;wBACAhD,kBAAkB;4BAChByC,YAAYN;4BACZlB;4BACAP;4BACAsC;wBACF;wBACA9C,2BAA2B;4BACzBuC,YAAYN;4BACZC;4BACAnB;4BACAP;4BACAsC;wBACF;qBACD;oBACDL;oBACAkB,OAAO;wBACL,GAAI1B,mBAAmB0B,KAAK,IAAI,CAAC,CAAC;wBAClCC,aAAa;+BACP,OAAO3B,mBAAmB0B,KAAK,KAAK,YACxC7B,MAAMC,OAAO,CAACE,mBAAmB0B,KAAK,CAACC,WAAW,IAC9C3B,mBAAmB0B,KAAK,CAACC,WAAW,GACpC,EAAE;4BACN3D,eAAe;gCACbsC,YAAYN;gCACZE;gCACA3B;4BACF;yBACD;wBACDqD,IAAI;+BACE,OAAO5B,mBAAmB0B,KAAK,KAAK,YACxC7B,MAAMC,OAAO,CAACE,mBAAmB0B,KAAK,CAACE,EAAE,IACrC5B,mBAAmB0B,KAAK,CAACE,EAAE,GAC3B,EAAE;4BACN,mEAAmE;+BAC/D,CAAC3B,kBAAkBE,aAAa,GAAG;gCAAClC,UAAU;oCAAEiC;gCAAW;6BAAG,GAAG,EAAE;yBACxE;wBACD2B,SAAS;+BACH,OAAO7B,mBAAmB0B,KAAK,KAAK,YACxC7B,MAAMC,OAAO,CAACE,mBAAmB0B,KAAK,CAACG,OAAO,IAC1C7B,mBAAmB0B,KAAK,CAACG,OAAO,GAChC,EAAE;4BACN3D,eAAe;gCAAEK;gCAAesC;4BAAS;yBAC1C;oBACH;gBACF;YACF;QACF;IACF,EAAC"}

package/dist/oauth/strategy/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/strategy/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AAEnC,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,OAAO,EACR,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAUnF,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,cAAc,CAAA;CACvB;AAED,qBAAa,QAAQ;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,EAAE,MAAM,CAAA;IAElB,KAAK,EAAE,OAAO,CAAA;IAGd,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,CAAA;IAElC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;KACjB,CAAA;IACD,IAAI,CAAC,EAAE;QACL,sBAAsB,EAAE,MAAM,CAAA;QAC9B,oBAAoB,EAAE,MAAM,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,iBAAiB,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,mBAAmB,CAAC,EAAE,IAAI,CAAA;IAE1B,WAAW,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,aAAa,CAAA;IAC5B,MAAM,EAAE,cAAc,CAAA;gBAEV,OAAO,EAAE,OAAO;IAiBtB,YAAY,CAAC,EACjB,aAAa,EACb,OAAO,EACP,OAAO,GACR,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyJnD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAe3B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAkD1B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C1D,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;CAmB3F;AAED,KAAK,aAAa,GAAG;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA"}

package/dist/oauth/strategy/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/strategy/index.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\n/* eslint-disable @typescript-eslint/restrict-template-expressions */\nimport type {\n  AuthStrategyFunctionArgs,\n  AuthStrategyResult,\n  CollectionConfig,\n  Payload,\n} from 'payload'\n\nimport * as jose from 'jose'\nimport { APIError, parseCookies } from 'payload'\n\nimport type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js'\n\nimport { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js'\nimport { ProjectTokenError } from '../../auth/project-token.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createDebugLogger } from '../utilities/createDebugLogger.js'\nimport { getTokenExp } from '../utilities/getTokenExp.js'\nimport { mergeHeaders } from '../utilities/mergeHeaders.js'\nimport { refreshTokens } from '../utilities/refreshTokens.js'\n\nexport interface Options {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n  debug?: boolean\n  identityMetadata: string\n  pluginOptions: PluginOptions\n  strategyName: string\n  verify: VerifyFunction\n}\n\nexport class Strategy {\n  clientID: string\n  clientSecret?: string\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  cookieName: string\n\n  debug: boolean\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  debugLog: (...args: any[]) => void\n\n  identityMetadataURL: string\n  jwks?: {\n    keys: jose.JWK[]\n  }\n  meta?: {\n    authorization_endpoint: string\n    end_session_endpoint: string\n    jwks_uri: string\n    token_endpoint: string\n    userinfo_endpoint: string\n  }\n  metaLastFetchedTime?: Date\n\n  metaPromise?: Promise<void>\n  metaPromiseResolve?: () => void\n  name: string\n  pluginOptions: PluginOptions\n  verify: VerifyFunction\n\n  constructor(options: Options) {\n    this.verify = options.verify\n    this.cookieName = options.cookieName\n    this.clientID = options.clientID\n    this.clientSecret = options.clientSecret\n    this.identityMetadataURL = options.identityMetadata\n    this.name = options.strategyName\n    this.collection = options.collection\n    this.collectionOptions = options.collectionOptions\n    this.pluginOptions = options.pluginOptions\n    this.debug = options.debug || false\n    // eslint-disable-next-line no-console, @typescript-eslint/no-explicit-any\n    this.debugLog = options.debug ? (...args: any[]) => console.log(...args) : () => null\n    // Prevent wokiness with `this`\n    this.ensureMeta = this.ensureMeta.bind(this)\n  }\n\n  async authenticate({\n    canSetHeaders,\n    headers,\n    payload,\n  }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> {\n    const debugLogger = createDebugLogger(payload, this.debug)\n    await this.ensureMeta()\n\n    const cookies = parseCookies(headers)\n\n    let oauthToken = cookies.get(this.cookieName)\n    const refreshToken = cookies.get(`${this.cookieName}-refresh`)\n\n    debugLogger.info({\n      msg: 'Retrieved tokens from cookies',\n      oauthToken,\n      refreshToken,\n    })\n\n    if (!this.collectionOptions.disableJWTFromHeader) {\n      // Parse Authorization header if exists\n      const jwtFromHeader = headers.get('authorization')\n      if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {\n        debugLogger.info({\n          jwtFromHeader,\n          msg: 'Found bearer token in authorization header',\n        })\n        oauthToken = jwtFromHeader.replace('Bearer ', '')\n      }\n    }\n\n    if (!oauthToken) {\n      if (refreshToken && canSetHeaders) {\n        debugLogger.info({\n          msg: 'No access token found, but refresh token exists. Attempting to refresh...',\n          refreshToken,\n        })\n        const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n        if (refreshed) {\n          const verifyResult = await this.verify({\n            headers,\n            payload,\n            token: refreshed.decodedOauthToken,\n          })\n\n          debugLogger.info({\n            msg: 'Token refreshed. Verifying...',\n            verifyResult,\n          })\n\n          if (verifyResult.responseHeaders) {\n            mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n          }\n\n          return {\n            responseHeaders: refreshed.headers,\n            user: verifyResult.user,\n          }\n        } else {\n          debugLogger.info({\n            msg: 'Token refresh failed',\n            refreshed,\n            refreshToken,\n          })\n        }\n      } else {\n        return {\n          user: null,\n        }\n      }\n    }\n\n    let oauthTokenVerifyResult: Error | jwt.JwtPayload | null = null\n\n    // First, try to verify token\n    if (oauthToken) {\n      oauthTokenVerifyResult = await this.jwtVerify({ payload, token: oauthToken })\n\n      // If verify comes back null, there is no user\n      if (oauthTokenVerifyResult === null) {\n        return {\n          user: null,\n        }\n      }\n\n      // If verify comes back truthy, use it\n      // but first set exp from refresh token\n      // because access exp is likely very short lived\n      if (\n        typeof oauthTokenVerifyResult === 'object' &&\n        !(oauthTokenVerifyResult instanceof Error)\n      ) {\n        if (refreshToken) {\n          const refreshTokenExp = getTokenExp({ debugLogger, token: refreshToken })\n\n          if (refreshTokenExp) {\n            oauthTokenVerifyResult.exp = refreshTokenExp\n          }\n        }\n\n        return this.verify({\n          headers,\n          payload,\n          token: oauthTokenVerifyResult,\n        })\n      }\n    }\n\n    if (\n      oauthTokenVerifyResult instanceof Error &&\n      oauthTokenVerifyResult.name === 'TokenExpiredError' &&\n      refreshToken &&\n      !this.collectionOptions.usePayloadJWT &&\n      canSetHeaders\n    ) {\n      const refreshed = await refreshTokens({ payload, refreshToken, strategy: this })\n\n      debugLogger.info({\n        msg: 'Token expired. Refreshing...',\n        refreshed,\n        refreshToken,\n      })\n\n      if (refreshed) {\n        const verifyResult = await this.verify({\n          headers,\n          payload,\n          token: refreshed.decodedOauthToken,\n        })\n\n        debugLogger.info({\n          msg: 'Token refreshed. Verifying...',\n          verifyResult,\n        })\n\n        if (verifyResult.responseHeaders) {\n          mergeHeaders(verifyResult.responseHeaders, refreshed.headers)\n        }\n\n        return {\n          responseHeaders: refreshed.headers,\n          user: verifyResult.user,\n        }\n      } else {\n        debugLogger.info({\n          msg: 'Token refresh failed',\n          refreshed,\n          refreshToken,\n        })\n      }\n    }\n\n    return {\n      user: null,\n    }\n  }\n\n  async ensureMeta(): Promise<void> {\n    if (this.metaPromise) {\n      this.debugLog('strategy - metaPromise exists. Waiting for it to resolve...')\n      await this.metaPromise\n    }\n\n    // If no meta or this.metaLastFetchedTime is more than 24 hours old, fetch meta\n    if (!this.metaLastFetchedTime || Date.now() - this.metaLastFetchedTime.getTime() > 86_400_000) {\n      this.debugLog(\n        `Meta is stale. Fetching... Last fetched: ${this.metaLastFetchedTime || 'never'}`,\n      )\n      await this.fetchMeta()\n    }\n  }\n\n  async fetchMeta(): Promise<void> {\n    // If already in-flight, return the existing promise\n    if (this.metaPromise) {\n      this.debugLog('fetchMeta - returning existing metaPromise')\n      return this.metaPromise\n    }\n\n    this.debugLog('fetchMeta - creating new metaPromise...')\n\n    // Build the shared promise\n    this.metaPromise = (async () => {\n      let lastError: unknown\n\n      for (let attempt = 1; attempt <= 5; attempt++) {\n        try {\n          this.meta = await fetch(this.identityMetadataURL).then((res) => res.json())\n          this.debugLog(`fetchMeta - success on attempt ${attempt}`)\n\n          if (this.meta?.jwks_uri) {\n            this.jwks = await fetch(this.meta.jwks_uri).then((res) => res.json())\n          }\n\n          this.metaLastFetchedTime = new Date()\n          this.debugLog(`fetchMeta - finished at ${this.metaLastFetchedTime.toISOString()}`)\n          return\n        } catch (error: unknown) {\n          lastError = error\n          this.debugLog(`fetchMeta - FAILED attempt ${attempt}/5: ${(error as Error)?.message}`)\n\n          if (attempt < 5) {\n            // Exponential backoff (up to 1s)\n            await new Promise((resolve) => setTimeout(resolve, Math.min(attempt * 200, 1000)))\n          }\n        }\n      }\n\n      throw new APIError(\n        `Failed to fetch identity metadata from \"${this.identityMetadataURL}\". Last error: ${\n          (lastError as Error)?.message ?? 'unknown'\n        }`,\n      )\n    })()\n\n    try {\n      await this.metaPromise\n    } finally {\n      this.metaPromise = undefined\n    }\n  }\n\n  async generateOidcPEM(kid: string, alg: string): Promise<string> {\n    const keys = this && this.jwks && Array.isArray(this.jwks.keys) ? this.jwks.keys : null\n\n    let pubKey: null | string = null\n    let foundKey = false\n\n    if (!kid) {\n      throw new Error('kid is missing')\n    }\n\n    if (!alg) {\n      throw new Error('alg is missing')\n    }\n\n    if (!keys) {\n      throw new Error('keys is missing')\n    }\n\n    for (const key of keys) {\n      if (!('kid' in key) || key.kid !== kid) {\n        continue\n      }\n\n      const cryptoKey = await jose.importJWK(key, alg)\n      if (!(cryptoKey instanceof CryptoKey)) {\n        throw new Error('importJWK did not return a CryptoKey')\n      }\n\n      pubKey = await jose.exportSPKI(cryptoKey)\n      foundKey = true\n\n      break\n    }\n\n    if (!foundKey) {\n      throw new Error('a key with the specific kid cannot be found')\n    }\n\n    if (!pubKey) {\n      throw new Error('generating public key pem failed')\n    }\n\n    return pubKey\n  }\n\n  async jwtVerify({ payload, token }: JwtVerifyArgs): Promise<Error | jwt.JwtPayload | null> {\n    try {\n      const verified = await validateProjectToken(token, getEnvironment())\n      if (typeof verified !== 'string') {\n        return verified\n      }\n    } catch (err: unknown) {\n      payload.logger.error({\n        err,\n        msg: 'Error verifying jwt token',\n      })\n\n      if (err instanceof Error) {\n        return err\n      }\n      return null\n    }\n    return null\n  }\n}\n\ntype JwtVerifyArgs = {\n  payload: Payload\n  token: string\n}\n"],"names":["jose","APIError","parseCookies","validateProjectToken","getEnvironment","createDebugLogger","getTokenExp","mergeHeaders","refreshTokens","Strategy","clientID","clientSecret","collection","collectionOptions","cookieName","debug","debugLog","identityMetadataURL","jwks","meta","metaLastFetchedTime","metaPromise","metaPromiseResolve","name","pluginOptions","verify","options","identityMetadata","strategyName","args","console","log","ensureMeta","bind","authenticate","canSetHeaders","headers","payload","debugLogger","cookies","oauthToken","get","refreshToken","info","msg","disableJWTFromHeader","jwtFromHeader","startsWith","replace","refreshed","strategy","verifyResult","token","decodedOauthToken","responseHeaders","user","oauthTokenVerifyResult","jwtVerify","Error","refreshTokenExp","exp","usePayloadJWT","Date","now","getTime","fetchMeta","lastError","attempt","fetch","then","res","json","jwks_uri","toISOString","error","message","Promise","resolve","setTimeout","Math","min","undefined","generateOidcPEM","kid","alg","keys","Array","isArray","pubKey","foundKey","key","cryptoKey","importJWK","CryptoKey","exportSPKI","verified","err","logger"],"mappings":"AASA,YAAYA,UAAU,OAAM;AAC5B,SAASC,QAAQ,EAAEC,YAAY,QAAQ,UAAS;AAIhD,SAA6BC,oBAAoB,QAAQ,8BAA6B;AAEtF,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,aAAa,QAAQ,gCAA+B;AAe7D,OAAO,MAAMC;IACXC,SAAgB;IAChBC,aAAqB;IACrBC,WAA4B;IAC5BC,kBAAoC;IACpCC,WAAkB;IAElBC,MAAc;IAEd,8DAA8D;IAC9DC,SAAkC;IAElCC,oBAA2B;IAC3BC,KAEC;IACDC,KAMC;IACDC,oBAA0B;IAE1BC,YAA2B;IAC3BC,mBAA+B;IAC/BC,KAAY;IACZC,cAA4B;IAC5BC,OAAsB;IAEtB,YAAYC,OAAgB,CAAE;QAC5B,IAAI,CAACD,MAAM,GAAGC,QAAQD,MAAM;QAC5B,IAAI,CAACX,UAAU,GAAGY,QAAQZ,UAAU;QACpC,IAAI,CAACJ,QAAQ,GAAGgB,QAAQhB,QAAQ;QAChC,IAAI,CAACC,YAAY,GAAGe,QAAQf,YAAY;QACxC,IAAI,CAACM,mBAAmB,GAAGS,QAAQC,gBAAgB;QACnD,IAAI,CAACJ,IAAI,GAAGG,QAAQE,YAAY;QAChC,IAAI,CAAChB,UAAU,GAAGc,QAAQd,UAAU;QACpC,IAAI,CAACC,iBAAiB,GAAGa,QAAQb,iBAAiB;QAClD,IAAI,CAACW,aAAa,GAAGE,QAAQF,aAAa;QAC1C,IAAI,CAACT,KAAK,GAAGW,QAAQX,KAAK,IAAI;QAC9B,0EAA0E;QAC1E,IAAI,CAACC,QAAQ,GAAGU,QAAQX,KAAK,GAAG,CAAC,GAAGc,OAAgBC,QAAQC,GAAG,IAAIF,QAAQ,IAAM;QACjF,+BAA+B;QAC/B,IAAI,CAACG,UAAU,GAAG,IAAI,CAACA,UAAU,CAACC,IAAI,CAAC,IAAI;IAC7C;IAEA,MAAMC,aAAa,EACjBC,aAAa,EACbC,OAAO,EACPC,OAAO,EACkB,EAA+B;QACxD,MAAMC,cAAcjC,kBAAkBgC,SAAS,IAAI,CAACtB,KAAK;QACzD,MAAM,IAAI,CAACiB,UAAU;QAErB,MAAMO,UAAUrC,aAAakC;QAE7B,IAAII,aAAaD,QAAQE,GAAG,CAAC,IAAI,CAAC3B,UAAU;QAC5C,MAAM4B,eAAeH,QAAQE,GAAG,CAAC,GAAG,IAAI,CAAC3B,UAAU,CAAC,QAAQ,CAAC;QAE7DwB,YAAYK,IAAI,CAAC;YACfC,KAAK;YACLJ;YACAE;QACF;QAEA,IAAI,CAAC,IAAI,CAAC7B,iBAAiB,CAACgC,oBAAoB,EAAE;YAChD,uCAAuC;YACvC,MAAMC,gBAAgBV,QAAQK,GAAG,CAAC;YAClC,IAAI,OAAOK,kBAAkB,YAAYA,cAAcC,UAAU,CAAC,YAAY;gBAC5ET,YAAYK,IAAI,CAAC;oBACfG;oBACAF,KAAK;gBACP;gBACAJ,aAAaM,cAAcE,OAAO,CAAC,WAAW;YAChD;QACF;QAEA,IAAI,CAACR,YAAY;YACf,IAAIE,gBAAgBP,eAAe;gBACjCG,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLF;gBACF;gBACA,MAAMO,YAAY,MAAMzC,cAAc;oBAAE6B;oBAASK;oBAAcQ,UAAU,IAAI;gBAAC;gBAC9E,IAAID,WAAW;oBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;wBACrCW;wBACAC;wBACAe,OAAOH,UAAUI,iBAAiB;oBACpC;oBAEAf,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLO;oBACF;oBAEA,IAAIA,aAAaG,eAAe,EAAE;wBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;oBAC9D;oBAEA,OAAO;wBACLkB,iBAAiBL,UAAUb,OAAO;wBAClCmB,MAAMJ,aAAaI,IAAI;oBACzB;gBACF,OAAO;oBACLjB,YAAYK,IAAI,CAAC;wBACfC,KAAK;wBACLK;wBACAP;oBACF;gBACF;YACF,OAAO;gBACL,OAAO;oBACLa,MAAM;gBACR;YACF;QACF;QAEA,IAAIC,yBAAwD;QAE5D,6BAA6B;QAC7B,IAAIhB,YAAY;YACdgB,yBAAyB,MAAM,IAAI,CAACC,SAAS,CAAC;gBAAEpB;gBAASe,OAAOZ;YAAW;YAE3E,8CAA8C;YAC9C,IAAIgB,2BAA2B,MAAM;gBACnC,OAAO;oBACLD,MAAM;gBACR;YACF;YAEA,sCAAsC;YACtC,uCAAuC;YACvC,gDAAgD;YAChD,IACE,OAAOC,2BAA2B,YAClC,CAAEA,CAAAA,kCAAkCE,KAAI,GACxC;gBACA,IAAIhB,cAAc;oBAChB,MAAMiB,kBAAkBrD,YAAY;wBAAEgC;wBAAac,OAAOV;oBAAa;oBAEvE,IAAIiB,iBAAiB;wBACnBH,uBAAuBI,GAAG,GAAGD;oBAC/B;gBACF;gBAEA,OAAO,IAAI,CAAClC,MAAM,CAAC;oBACjBW;oBACAC;oBACAe,OAAOI;gBACT;YACF;QACF;QAEA,IACEA,kCAAkCE,SAClCF,uBAAuBjC,IAAI,KAAK,uBAChCmB,gBACA,CAAC,IAAI,CAAC7B,iBAAiB,CAACgD,aAAa,IACrC1B,eACA;YACA,MAAMc,YAAY,MAAMzC,cAAc;gBAAE6B;gBAASK;gBAAcQ,UAAU,IAAI;YAAC;YAE9EZ,YAAYK,IAAI,CAAC;gBACfC,KAAK;gBACLK;gBACAP;YACF;YAEA,IAAIO,WAAW;gBACb,MAAME,eAAe,MAAM,IAAI,CAAC1B,MAAM,CAAC;oBACrCW;oBACAC;oBACAe,OAAOH,UAAUI,iBAAiB;gBACpC;gBAEAf,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLO;gBACF;gBAEA,IAAIA,aAAaG,eAAe,EAAE;oBAChC/C,aAAa4C,aAAaG,eAAe,EAAEL,UAAUb,OAAO;gBAC9D;gBAEA,OAAO;oBACLkB,iBAAiBL,UAAUb,OAAO;oBAClCmB,MAAMJ,aAAaI,IAAI;gBACzB;YACF,OAAO;gBACLjB,YAAYK,IAAI,CAAC;oBACfC,KAAK;oBACLK;oBACAP;gBACF;YACF;QACF;QAEA,OAAO;YACLa,MAAM;QACR;IACF;IAEA,MAAMvB,aAA4B;QAChC,IAAI,IAAI,CAACX,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,MAAM,IAAI,CAACK,WAAW;QACxB;QAEA,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAACD,mBAAmB,IAAI0C,KAAKC,GAAG,KAAK,IAAI,CAAC3C,mBAAmB,CAAC4C,OAAO,KAAK,YAAY;YAC7F,IAAI,CAAChD,QAAQ,CACX,CAAC,yCAAyC,EAAE,IAAI,CAACI,mBAAmB,IAAI,SAAS;YAEnF,MAAM,IAAI,CAAC6C,SAAS;QACtB;IACF;IAEA,MAAMA,YAA2B;QAC/B,oDAAoD;QACpD,IAAI,IAAI,CAAC5C,WAAW,EAAE;YACpB,IAAI,CAACL,QAAQ,CAAC;YACd,OAAO,IAAI,CAACK,WAAW;QACzB;QAEA,IAAI,CAACL,QAAQ,CAAC;QAEd,2BAA2B;QAC3B,IAAI,CAACK,WAAW,GAAG,AAAC,CAAA;YAClB,IAAI6C;YAEJ,IAAK,IAAIC,UAAU,GAAGA,WAAW,GAAGA,UAAW;gBAC7C,IAAI;oBACF,IAAI,CAAChD,IAAI,GAAG,MAAMiD,MAAM,IAAI,CAACnD,mBAAmB,EAAEoD,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACxE,IAAI,CAACvD,QAAQ,CAAC,CAAC,+BAA+B,EAAEmD,SAAS;oBAEzD,IAAI,IAAI,CAAChD,IAAI,EAAEqD,UAAU;wBACvB,IAAI,CAACtD,IAAI,GAAG,MAAMkD,MAAM,IAAI,CAACjD,IAAI,CAACqD,QAAQ,EAAEH,IAAI,CAAC,CAACC,MAAQA,IAAIC,IAAI;oBACpE;oBAEA,IAAI,CAACnD,mBAAmB,GAAG,IAAI0C;oBAC/B,IAAI,CAAC9C,QAAQ,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAACI,mBAAmB,CAACqD,WAAW,IAAI;oBACjF;gBACF,EAAE,OAAOC,OAAgB;oBACvBR,YAAYQ;oBACZ,IAAI,CAAC1D,QAAQ,CAAC,CAAC,2BAA2B,EAAEmD,QAAQ,IAAI,EAAGO,OAAiBC,SAAS;oBAErF,IAAIR,UAAU,GAAG;wBACf,iCAAiC;wBACjC,MAAM,IAAIS,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,GAAG,CAACb,UAAU,KAAK;oBAC7E;gBACF;YACF;YAEA,MAAM,IAAIlE,SACR,CAAC,wCAAwC,EAAE,IAAI,CAACgB,mBAAmB,CAAC,eAAe,EACjF,AAACiD,WAAqBS,WAAW,WACjC;QAEN,CAAA;QAEA,IAAI;YACF,MAAM,IAAI,CAACtD,WAAW;QACxB,SAAU;YACR,IAAI,CAACA,WAAW,GAAG4D;QACrB;IACF;IAEA,MAAMC,gBAAgBC,GAAW,EAAEC,GAAW,EAAmB;QAC/D,MAAMC,OAAO,IAAI,IAAI,IAAI,CAACnE,IAAI,IAAIoE,MAAMC,OAAO,CAAC,IAAI,CAACrE,IAAI,CAACmE,IAAI,IAAI,IAAI,CAACnE,IAAI,CAACmE,IAAI,GAAG;QAEnF,IAAIG,SAAwB;QAC5B,IAAIC,WAAW;QAEf,IAAI,CAACN,KAAK;YACR,MAAM,IAAIzB,MAAM;QAClB;QAEA,IAAI,CAAC0B,KAAK;YACR,MAAM,IAAI1B,MAAM;QAClB;QAEA,IAAI,CAAC2B,MAAM;YACT,MAAM,IAAI3B,MAAM;QAClB;QAEA,KAAK,MAAMgC,OAAOL,KAAM;YACtB,IAAI,CAAE,CAAA,SAASK,GAAE,KAAMA,IAAIP,GAAG,KAAKA,KAAK;gBACtC;YACF;YAEA,MAAMQ,YAAY,MAAM3F,KAAK4F,SAAS,CAACF,KAAKN;YAC5C,IAAI,CAAEO,CAAAA,qBAAqBE,SAAQ,GAAI;gBACrC,MAAM,IAAInC,MAAM;YAClB;YAEA8B,SAAS,MAAMxF,KAAK8F,UAAU,CAACH;YAC/BF,WAAW;YAEX;QACF;QAEA,IAAI,CAACA,UAAU;YACb,MAAM,IAAI/B,MAAM;QAClB;QAEA,IAAI,CAAC8B,QAAQ;YACX,MAAM,IAAI9B,MAAM;QAClB;QAEA,OAAO8B;IACT;IAEA,MAAM/B,UAAU,EAAEpB,OAAO,EAAEe,KAAK,EAAiB,EAA0C;QACzF,IAAI;YACF,MAAM2C,WAAW,MAAM5F,qBAAqBiD,OAAOhD;YACnD,IAAI,OAAO2F,aAAa,UAAU;gBAChC,OAAOA;YACT;QACF,EAAE,OAAOC,KAAc;YACrB3D,QAAQ4D,MAAM,CAACvB,KAAK,CAAC;gBACnBsB;gBACApD,KAAK;YACP;YAEA,IAAIoD,eAAetC,OAAO;gBACxB,OAAOsC;YACT;YACA,OAAO;QACT;QACA,OAAO;IACT;AACF"}

package/dist/oauth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;AAEnE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,GAAG,CAAC,UAAU,CAAA;CACtB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAA;AAER,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpE,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IAEH;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;IACzE;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACnC,CAAA;IACD;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAEnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IAEH;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,gBAAgB,CAAA;QAC5B,aAAa,EAAE,aAAa,CAAA;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,aAAa,CAAA;IAEnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;CACZ,CAAA"}

package/dist/oauth/types.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/oauth/types.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type jwt from 'jsonwebtoken'\nimport type {\n  AuthStrategyResult,\n  CollectionConfig,\n  CustomComponent,\n  EmailField,\n  IncomingAuthType,\n  Payload,\n  PayloadRequest,\n  TextField,\n} from 'payload'\n\nexport type Done = (error: any, user?: any, info?: unknown) => void\n\nexport type VerifyFunction = (args: {\n  headers: Headers\n  payload: Payload\n  token: jwt.JwtPayload\n}) => Promise<AuthStrategyResult>\n\nexport type AfterOAuthLoginHookResult = {\n  redirect?: string\n} | void\n\nexport type AfterOAuthLoginHook = (args: {\n  access_token?: string\n  id_token?: string\n  refresh_token?: string\n  req: PayloadRequest\n}) => AfterOAuthLoginHookResult | Promise<AfterOAuthLoginHookResult>\n\nexport interface CollectionOptions {\n  authorizationURLParams?: Record<string, string>\n\n  clientID: string\n  clientSecret?: string\n\n  /**\n   * Whether to disable the local strategy for this collection.\n   *\n   * @default true\n   */\n\n  /**\n   * By default, accept a JWT from the authorization header\n   *\n   * Set to false to only accept the JWT from cookies\n   */\n  disableJWTFromHeader?: boolean\n\n  disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy']\n  /**\n   * The logout button will either redirect to the IDP logout screen or\n   * automatically log the user out of the IDP depending on provider.\n   *\n   * @default false\n   */\n  endOAuthSessionOnLogout?: boolean\n  hooks?: {\n    afterLogin?: AfterOAuthLoginHook[]\n  }\n  /**\n   * The OpenID metadata endpoint for the identity provider.\n   *\n   * @example http://localhost:8080/realms/master/.well-known/openid-configuration\n   * @example https://myapp.auth0.com/.well-known/openid-configuration\n   */\n  identityMetadata: string\n  /**\n   * Custom React component to use as the login button on the login page.\n   */\n  LoginButton?: CustomComponent | false\n  /**\n   * The OAuth2.0 scope to request from the identity provider.\n   *\n   * @default ['openid', 'profile', 'email']\n   */\n  scope?: string[]\n  /**\n   * The Payload collection slug to apply the OAuth2.0 strategy to.\n   */\n  slug: string\n  /**\n   * Property to use as the token to decode from the OAuth2.0 response.\n   *\n   * This is passed to the default or custom `verify` function.\n   *\n   * @default 'access_token'\n   */\n  token?: 'access_token' | 'id_token'\n\n  /**\n   * Have Payload maintain the JWT cookie.\n   *\n   * This is for when the IDP does not support silently refreshing tokens in the background.\n   */\n  usePayloadJWT?: boolean\n\n  /**\n   * The Payload field to use as the username field for the user\n   * When a text is used, the plugin will find the collection field with the name provided\n   * Alternatively define the entire field to use\n   * @default\n   *\n   * ```ts\n   * {\n   *   type: 'text',\n   *   name: 'preferredUsername',\n   *   unique: true,\n   *   admin: {\n   *     position: 'sidebar',\n   *     readOnly: true,\n   *   },\n   * }\n   * ```\n   */\n  usernameField?: EmailField | string | TextField\n\n  /**\n   * Custom verify function that receives the token and performs any logic.\n   * By default, the defaultVerify function is used.\n   */\n  verify?: VerifyFunction\n}\n\nexport interface PluginOptions {\n  /**\n   * The collections to apply the OAuth2.0 strategy to.\n   */\n  collections: CollectionOptions[]\n  /**\n   * The name of the cookie to use for storing the user's token.\n   *\n   * @default 'payload-oauth-token'\n   */\n  cookieName?: string\n  /**\n   * Debug mode will log additional information to the console.\n   *\n   * NOTE: This will log sensitive information to the console.\n   */\n\n  /**\n   * Accepts incoming request and allows for modification of cookie options\n   */\n  createCookieOptions?: (args: {\n    collection: CollectionConfig\n    cookieOptions: CookieOptions\n    headers: Headers\n  }) => CookieOptions\n\n  debug?: boolean\n  /**\n   * Disables the plugin functionality while leaving in types, fields and component modifications.\n   * @default false\n   */\n  disabled?: boolean\n  /**\n   * OAuth2.0 requires a URL to redirect the user to.\n   * If you do not have a `config.serverURL` defined in your Payload config, you must define this string to be set as where the identity provider should redirect users once logged in.\n   */\n  redirectServerURL?: string\n  /**\n   * Override the strategy name used for this plugin.\n   *\n   * This should only be overridden to accomodate multiple plugin\n   * invocations against a single user collection.\n   *\n   * If you have a custom basePath defined in your Next config,\n   * this value should not contain that path.\n   *\n   * @default 'oauth'\n   */\n  strategyName?: string\n}\n\nexport type CookieOptions = {\n  domain?: string\n  expires?: Date | number\n  httpOnly?: boolean\n  maxAge?: number\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n}\n\nexport type StateObj = {\n  /**\n   * Redirect to use if the login fails\n   */\n  failedRedirect?: string\n  /**\n   * Redirect to use after the login is successful\n   */\n  redirect?: string\n  /**\n   * The URL that will be used for Payload to redirect to\n   */\n  serverURL?: string\n  /**\n   * Encrypted signature to be verified\n   */\n  sig: string\n  /**\n   * Code verifier used for PKCE\n   */\n  verifier: string\n}\n\nexport type LogFn = {\n  (msg: string, ...args: any[]): void\n  (obj: unknown, msg?: string, ...args: any[]): void\n  <T extends object>(obj: T, msg?: string, ...args: any[]): void\n}\n\nexport type DebugLogger = {\n  error: LogFn\n  info: LogFn\n}\n"],"names":[],"mappings":"AAAA,qDAAqD,GAwNrD,WAGC"}

package/dist/oauth/utilities/clearCookie.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clearCookie.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/clearCookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAI7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,WAAW,SAAU;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,aAAa,CAAA;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAClC,GAAG,EAAE,cAAc,CAAA;CACpB,SAmBA,CAAA"}

package/dist/oauth/utilities/clearCookie.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/clearCookie.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { generateCookie } from 'payload'\n\nimport type { CookieOptions } from '../types.js'\n\nimport { getCookieExpiration } from './getCookieExpiration.js'\n\nexport const clearCookie = (args: {\n  cookieName: string\n  cookieOptions: CookieOptions\n  overrides?: Partial<CookieOptions>\n  req: PayloadRequest\n}) => {\n  const options = {\n    ...args.cookieOptions,\n    ...(args.overrides || {}),\n  }\n\n  const clearedCookie = generateCookie({\n    ...options,\n    name: args.cookieName,\n    expires: getCookieExpiration(options?.expires) ?? new Date(),\n    returnCookieAsObject: false,\n    value: '',\n  }) as string\n\n  if (!args.req.responseHeaders) {\n    args.req.responseHeaders = new Headers()\n  }\n\n  args.req.responseHeaders.append('Set-Cookie', clearedCookie)\n}\n"],"names":["generateCookie","getCookieExpiration","clearCookie","args","options","cookieOptions","overrides","clearedCookie","name","cookieName","expires","Date","returnCookieAsObject","value","req","responseHeaders","Headers","append"],"mappings":"AAEA,SAASA,cAAc,QAAQ,UAAS;AAIxC,SAASC,mBAAmB,QAAQ,2BAA0B;AAE9D,OAAO,MAAMC,cAAc,CAACC;IAM1B,MAAMC,UAAU;QACd,GAAGD,KAAKE,aAAa;QACrB,GAAIF,KAAKG,SAAS,IAAI,CAAC,CAAC;IAC1B;IAEA,MAAMC,gBAAgBP,eAAe;QACnC,GAAGI,OAAO;QACVI,MAAML,KAAKM,UAAU;QACrBC,SAAST,oBAAoBG,SAASM,YAAY,IAAIC;QACtDC,sBAAsB;QACtBC,OAAO;IACT;IAEA,IAAI,CAACV,KAAKW,GAAG,CAACC,eAAe,EAAE;QAC7BZ,KAAKW,GAAG,CAACC,eAAe,GAAG,IAAIC;IACjC;IAEAb,KAAKW,GAAG,CAACC,eAAe,CAACE,MAAM,CAAC,cAAcV;AAChD,EAAC"}

package/dist/oauth/utilities/createCookieOptions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createCookieOptions.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,SAAS,CAAA;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE/D,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;CAC7B;AAED,eAAO,MAAM,mBAAmB,4CAI7B,IAAI,KAAG,aA8CT,CAAA"}

package/dist/oauth/utilities/createCookieOptions.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/createCookieOptions.ts"],"sourcesContent":["import type { CollectionConfig, PayloadRequest } from 'payload'\n\nimport type { CookieOptions, PluginOptions } from '../types.js'\n\ninterface Args {\n  collection: CollectionConfig\n  headers: Headers\n  pluginOptions: PluginOptions\n}\n\nexport const createCookieOptions = ({\n  collection,\n  headers,\n  pluginOptions,\n}: Args): CookieOptions => {\n  let cookieOptions: CookieOptions = {\n    domain: undefined,\n    httpOnly: true,\n    path: '/',\n    sameSite: undefined,\n    secure: false,\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    const { domain, sameSite, secure } = collection.auth.cookies\n    if (typeof secure === 'boolean') {\n      cookieOptions.secure = secure\n    }\n    if (typeof sameSite === 'string') {\n      cookieOptions.sameSite = sameSite as 'Lax'\n    }\n    if (typeof domain === 'string') {\n      cookieOptions.domain = domain\n    }\n  }\n\n  if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {\n    if (collection.auth.cookies.secure) {\n      cookieOptions.secure = true\n    }\n    if (collection.auth.cookies.sameSite) {\n      cookieOptions.sameSite =\n        typeof collection.auth.cookies.sameSite === 'string'\n          ? collection.auth.cookies.sameSite\n          : 'Lax'\n    }\n    if (collection.auth.cookies.domain) {\n      cookieOptions.domain = collection.auth.cookies.domain\n    }\n  }\n\n  if (typeof pluginOptions.createCookieOptions === 'function') {\n    cookieOptions = pluginOptions.createCookieOptions({\n      collection,\n      cookieOptions,\n      headers,\n    })\n  }\n\n  return cookieOptions\n}\n"],"names":["createCookieOptions","collection","headers","pluginOptions","cookieOptions","domain","undefined","httpOnly","path","sameSite","secure","auth","cookies"],"mappings":"AAUA,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,UAAU,EACVC,OAAO,EACPC,aAAa,EACR;IACL,IAAIC,gBAA+B;QACjCC,QAAQC;QACRC,UAAU;QACVC,MAAM;QACNC,UAAUH;QACVI,QAAQ;IACV;IAEA,IAAI,OAAOT,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,MAAM,EAAEP,MAAM,EAAEI,QAAQ,EAAEC,MAAM,EAAE,GAAGT,WAAWU,IAAI,CAACC,OAAO;QAC5D,IAAI,OAAOF,WAAW,WAAW;YAC/BN,cAAcM,MAAM,GAAGA;QACzB;QACA,IAAI,OAAOD,aAAa,UAAU;YAChCL,cAAcK,QAAQ,GAAGA;QAC3B;QACA,IAAI,OAAOJ,WAAW,UAAU;YAC9BD,cAAcC,MAAM,GAAGA;QACzB;IACF;IAEA,IAAI,OAAOJ,WAAWU,IAAI,KAAK,YAAY,OAAOV,WAAWU,IAAI,CAACC,OAAO,KAAK,UAAU;QACtF,IAAIX,WAAWU,IAAI,CAACC,OAAO,CAACF,MAAM,EAAE;YAClCN,cAAcM,MAAM,GAAG;QACzB;QACA,IAAIT,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,EAAE;YACpCL,cAAcK,QAAQ,GACpB,OAAOR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,KAAK,WACxCR,WAAWU,IAAI,CAACC,OAAO,CAACH,QAAQ,GAChC;QACR;QACA,IAAIR,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM,EAAE;YAClCD,cAAcC,MAAM,GAAGJ,WAAWU,IAAI,CAACC,OAAO,CAACP,MAAM;QACvD;IACF;IAEA,IAAI,OAAOF,cAAcH,mBAAmB,KAAK,YAAY;QAC3DI,gBAAgBD,cAAcH,mBAAmB,CAAC;YAChDC;YACAG;YACAF;QACF;IACF;IAEA,OAAOE;AACT,EAAC"}

package/dist/oauth/utilities/createDebugLogger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createDebugLogger.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/createDebugLogger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,eAAO,MAAM,iBAAiB,YAAa,OAAO,cAAc,OAAO,KAAG,WAazE,CAAA"}

package/dist/oauth/utilities/createDebugLogger.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/createDebugLogger.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport type { DebugLogger } from '../types.js'\n\nexport const createDebugLogger = (payload: Payload, condition?: boolean): DebugLogger => {\n  return {\n    error: (args: unknown) => {\n      if (condition) {\n        payload.logger.error(args)\n      }\n    },\n    info: (args: unknown) => {\n      if (condition) {\n        payload.logger.info(args)\n      }\n    },\n  }\n}\n"],"names":["createDebugLogger","payload","condition","error","args","logger","info"],"mappings":"AAIA,OAAO,MAAMA,oBAAoB,CAACC,SAAkBC;IAClD,OAAO;QACLC,OAAO,CAACC;YACN,IAAIF,WAAW;gBACbD,QAAQI,MAAM,CAACF,KAAK,CAACC;YACvB;QACF;QACAE,MAAM,CAACF;YACL,IAAIF,WAAW;gBACbD,QAAQI,MAAM,CAACC,IAAI,CAACF;YACtB;QACF;IACF;AACF,EAAC"}

package/dist/oauth/utilities/extractOrigin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"extractOrigin.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/extractOrigin.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,QAAS,MAAM,KAAG,IAAI,GAAG,MAOlD,CAAA"}

package/dist/oauth/utilities/extractOrigin.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/extractOrigin.ts"],"sourcesContent":["export const extractOrigin = (url: string): null | string => {\n  try {\n    const parsed = new URL(url)\n    return parsed.origin // includes protocol, hostname, and port if present\n  } catch {\n    return null // invalid URL\n  }\n}\n"],"names":["extractOrigin","url","parsed","URL","origin"],"mappings":"AAAA,OAAO,MAAMA,gBAAgB,CAACC;IAC5B,IAAI;QACF,MAAMC,SAAS,IAAIC,IAAIF;QACvB,OAAOC,OAAOE,MAAM,CAAC,mDAAmD;;IAC1E,EAAE,OAAM;QACN,OAAO,KAAK,cAAc;;IAC5B;AACF,EAAC"}

package/dist/oauth/utilities/getAdminCollectionSlug.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getAdminCollectionSlug.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/getAdminCollectionSlug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAErC,eAAO,MAAM,sBAAsB,WAAY,MAAM,KAAG,MAmBvD,CAAA"}

package/dist/oauth/utilities/getAdminCollectionSlug.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/getAdminCollectionSlug.ts"],"sourcesContent":["import type { Config } from 'payload'\n\nexport const getAdminCollectionSlug = (config: Config): string => {\n  // if config specifies admin user collection, find and use it\n  if (config.admin?.user) {\n    const matchedAdminCollection = config.collections?.find(\n      (collection) => config.admin?.user === collection.slug,\n    )\n    if (matchedAdminCollection) {\n      return matchedAdminCollection.slug\n    }\n  }\n\n  // if config does not specify admin user collection, find first collection with auth\n  const firstCollectionWithAuth = config.collections?.find(({ auth }) => Boolean(auth))\n  if (firstCollectionWithAuth) {\n    return firstCollectionWithAuth.slug\n  }\n\n  // Otherwise, assume that it'll be the built-in auth\n  return 'users'\n}\n"],"names":["getAdminCollectionSlug","config","admin","user","matchedAdminCollection","collections","find","collection","slug","firstCollectionWithAuth","auth","Boolean"],"mappings":"AAEA,OAAO,MAAMA,yBAAyB,CAACC;IACrC,6DAA6D;IAC7D,IAAIA,OAAOC,KAAK,EAAEC,MAAM;QACtB,MAAMC,yBAAyBH,OAAOI,WAAW,EAAEC,KACjD,CAACC,aAAeN,OAAOC,KAAK,EAAEC,SAASI,WAAWC,IAAI;QAExD,IAAIJ,wBAAwB;YAC1B,OAAOA,uBAAuBI,IAAI;QACpC;IACF;IAEA,oFAAoF;IACpF,MAAMC,0BAA0BR,OAAOI,WAAW,EAAEC,KAAK,CAAC,EAAEI,IAAI,EAAE,GAAKC,QAAQD;IAC/E,IAAID,yBAAyB;QAC3B,OAAOA,wBAAwBD,IAAI;IACrC;IAEA,oDAAoD;IACpD,OAAO;AACT,EAAC"}

package/dist/oauth/utilities/getAdminPath.d.ts

@@ -1,8 +0,0 @@
-import type { ClientConfig, SanitizedConfig } from 'payload';
-/**
- * This is the path to the admin panel WITHOUT domain.
- *
- * This respects the `basePath` property in the Next config.
- */
-export declare const getAdminPath: (config: ClientConfig | SanitizedConfig) => string;
-//# sourceMappingURL=getAdminPath.d.ts.map

package/dist/oauth/utilities/getAdminPath.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getAdminPath.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/getAdminPath.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE5D;;;;GAIG;AACH,eAAO,MAAM,YAAY,WAAY,YAAY,GAAG,eAAe,WAElE,CAAA"}

package/dist/oauth/utilities/getAdminPath.js

@@ -1,9 +0,0 @@
-/**
- * This is the path to the admin panel WITHOUT domain.
- *
- * This respects the `basePath` property in the Next config.
- */ export const getAdminPath = (config)=>{
-    return `${process.env.NEXT_BASE_PATH ?? ''}${config.routes?.admin || '/admin'}`;
-};
-
-//# sourceMappingURL=getAdminPath.js.map

package/dist/oauth/utilities/getAdminPath.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/getAdminPath.ts"],"sourcesContent":["import type { ClientConfig, SanitizedConfig } from 'payload'\n\n/**\n * This is the path to the admin panel WITHOUT domain.\n *\n * This respects the `basePath` property in the Next config.\n */\nexport const getAdminPath = (config: ClientConfig | SanitizedConfig) => {\n  return `${process.env.NEXT_BASE_PATH ?? ''}${config.routes?.admin || '/admin'}`\n}\n"],"names":["getAdminPath","config","process","env","NEXT_BASE_PATH","routes","admin"],"mappings":"AAEA;;;;CAIC,GACD,OAAO,MAAMA,eAAe,CAACC;IAC3B,OAAO,GAAGC,QAAQC,GAAG,CAACC,cAAc,IAAI,KAAKH,OAAOI,MAAM,EAAEC,SAAS,UAAU;AACjF,EAAC"}

package/dist/oauth/utilities/getAuthorizeURL.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getAuthorizeURL.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/getAuthorizeURL.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAMxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAY,MAAM,aAAa,CAAA;AAI7E,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,eAAO,MAAM,eAAe,oIAUzB,IAAI,KAAG,OAAO,CAAC,MAAM,CAoDvB,CAAA"}

package/dist/oauth/utilities/getAuthorizeURL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/getAuthorizeURL.ts"],"sourcesContent":["import type { CollectionConfig, Payload } from 'payload'\n\nimport crypto from 'crypto'\nimport * as QueryString from 'qs-esm'\nimport { v4 as uuid } from 'uuid'\n\nimport type { Strategy } from '../strategy/index.js'\nimport type { CollectionOptions, PluginOptions, StateObj } from '../types.js'\n\nimport { defaultScope } from '../defaults.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n  endpointSlug: string\n  failedRedirect?: unknown\n  payload: Payload\n  pluginOptions: PluginOptions\n  redirect?: unknown\n  serverURLOverride?: unknown\n  strategy: Strategy\n}\n\nexport const getAuthorizeURL = async ({\n  collection,\n  collectionOptions,\n  endpointSlug,\n  failedRedirect,\n  payload,\n  pluginOptions,\n  redirect,\n  serverURLOverride,\n  strategy,\n}: Args): Promise<string> => {\n  const { redirectServerURL } = pluginOptions\n\n  await strategy.ensureMeta()\n\n  // Generate a random code verifier\n  const codeVerifier = crypto.randomBytes(32).toString('base64url')\n\n  // Create a code challenge by hashing the code verifier\n  const code_challenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url')\n\n  const state: StateObj = {\n    sig: payload.encrypt(strategy.name),\n    verifier: payload.encrypt(codeVerifier),\n  }\n\n  if (typeof serverURLOverride === 'string') {\n    state.serverURL = serverURLOverride\n  }\n\n  if (typeof redirect === 'string') {\n    state.redirect = redirect\n  }\n\n  if (typeof failedRedirect === 'string') {\n    state.failedRedirect = failedRedirect\n  }\n\n  const baseRedirectURL = redirectServerURL || payload.config.serverURL || state.serverURL\n\n  const loginRedirectURL = encodeURI(\n    `${baseRedirectURL}${payload.config.routes?.api || '/api'}/${collection.slug}/${endpointSlug}/login`,\n  )\n\n  const params = {\n    client_id: collectionOptions.clientID,\n    code_challenge,\n    code_challenge_method: 'S256',\n    nonce: uuid(),\n    redirect_uri: loginRedirectURL,\n    response_mode: 'form_post',\n    response_type: 'id_token%20token%20code',\n    scope: (collectionOptions.scope ?? defaultScope).join('+'),\n    state: Buffer.from(JSON.stringify(state)).toString('base64'),\n    ...(collectionOptions.authorizationURLParams || {}),\n  }\n\n  const authorizeURL = `${strategy.meta?.authorization_endpoint}?${QueryString.stringify(params, {\n    encode: false,\n  })}`\n\n  return authorizeURL\n}\n"],"names":["crypto","QueryString","v4","uuid","defaultScope","getAuthorizeURL","collection","collectionOptions","endpointSlug","failedRedirect","payload","pluginOptions","redirect","serverURLOverride","strategy","redirectServerURL","ensureMeta","codeVerifier","randomBytes","toString","code_challenge","createHash","update","digest","state","sig","encrypt","name","verifier","serverURL","baseRedirectURL","config","loginRedirectURL","encodeURI","routes","api","slug","params","client_id","clientID","code_challenge_method","nonce","redirect_uri","response_mode","response_type","scope","join","Buffer","from","JSON","stringify","authorizationURLParams","authorizeURL","meta","authorization_endpoint","encode"],"mappings":"AAEA,OAAOA,YAAY,SAAQ;AAC3B,YAAYC,iBAAiB,SAAQ;AACrC,SAASC,MAAMC,IAAI,QAAQ,OAAM;AAKjC,SAASC,YAAY,QAAQ,iBAAgB;AAc7C,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,UAAU,EACVC,iBAAiB,EACjBC,YAAY,EACZC,cAAc,EACdC,OAAO,EACPC,aAAa,EACbC,QAAQ,EACRC,iBAAiB,EACjBC,QAAQ,EACH;IACL,MAAM,EAAEC,iBAAiB,EAAE,GAAGJ;IAE9B,MAAMG,SAASE,UAAU;IAEzB,kCAAkC;IAClC,MAAMC,eAAejB,OAAOkB,WAAW,CAAC,IAAIC,QAAQ,CAAC;IAErD,uDAAuD;IACvD,MAAMC,iBAAiBpB,OAAOqB,UAAU,CAAC,UAAUC,MAAM,CAACL,cAAcM,MAAM,CAAC;IAE/E,MAAMC,QAAkB;QACtBC,KAAKf,QAAQgB,OAAO,CAACZ,SAASa,IAAI;QAClCC,UAAUlB,QAAQgB,OAAO,CAACT;IAC5B;IAEA,IAAI,OAAOJ,sBAAsB,UAAU;QACzCW,MAAMK,SAAS,GAAGhB;IACpB;IAEA,IAAI,OAAOD,aAAa,UAAU;QAChCY,MAAMZ,QAAQ,GAAGA;IACnB;IAEA,IAAI,OAAOH,mBAAmB,UAAU;QACtCe,MAAMf,cAAc,GAAGA;IACzB;IAEA,MAAMqB,kBAAkBf,qBAAqBL,QAAQqB,MAAM,CAACF,SAAS,IAAIL,MAAMK,SAAS;IAExF,MAAMG,mBAAmBC,UACvB,GAAGH,kBAAkBpB,QAAQqB,MAAM,CAACG,MAAM,EAAEC,OAAO,OAAO,CAAC,EAAE7B,WAAW8B,IAAI,CAAC,CAAC,EAAE5B,aAAa,MAAM,CAAC;IAGtG,MAAM6B,SAAS;QACbC,WAAW/B,kBAAkBgC,QAAQ;QACrCnB;QACAoB,uBAAuB;QACvBC,OAAOtC;QACPuC,cAAcV;QACdW,eAAe;QACfC,eAAe;QACfC,OAAO,AAACtC,CAAAA,kBAAkBsC,KAAK,IAAIzC,YAAW,EAAG0C,IAAI,CAAC;QACtDtB,OAAOuB,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAAC1B,QAAQL,QAAQ,CAAC;QACnD,GAAIZ,kBAAkB4C,sBAAsB,IAAI,CAAC,CAAC;IACpD;IAEA,MAAMC,eAAe,GAAGtC,SAASuC,IAAI,EAAEC,uBAAuB,CAAC,EAAErD,YAAYiD,SAAS,CAACb,QAAQ;QAC7FkB,QAAQ;IACV,IAAI;IAEJ,OAAOH;AACT,EAAC"}

package/dist/oauth/utilities/getCookieExpiration.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getCookieExpiration.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/getCookieExpiration.ts"],"names":[],"mappings":"AAAA,KAAK,aAAa,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;AAEvD,eAAO,MAAM,mBAAmB,aAAc,aAAa,KAAG,IAS7D,CAAA"}

package/dist/oauth/utilities/getCookieExpiration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/getCookieExpiration.ts"],"sourcesContent":["type CookieExpires = Date | number | string | undefined\n\nexport const getCookieExpiration = (expires?: CookieExpires): Date => {\n  if (expires instanceof Date) {\n    return expires\n  }\n\n  const seconds = typeof expires === 'number' ? expires : 7200\n  const currentTime = new Date()\n  currentTime.setSeconds(currentTime.getSeconds() + seconds)\n  return currentTime\n}\n"],"names":["getCookieExpiration","expires","Date","seconds","currentTime","setSeconds","getSeconds"],"mappings":"AAEA,OAAO,MAAMA,sBAAsB,CAACC;IAClC,IAAIA,mBAAmBC,MAAM;QAC3B,OAAOD;IACT;IAEA,MAAME,UAAU,OAAOF,YAAY,WAAWA,UAAU;IACxD,MAAMG,cAAc,IAAIF;IACxBE,YAAYC,UAAU,CAACD,YAAYE,UAAU,KAAKH;IAClD,OAAOC;AACT,EAAC"}

package/dist/oauth/utilities/getSecondsFromTokenExp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getSecondsFromTokenExp.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/getSecondsFromTokenExp.ts"],"names":[],"mappings":"AAAA,wBAAgB,sBAAsB,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAG1E"}

package/dist/oauth/utilities/getSecondsFromTokenExp.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/getSecondsFromTokenExp.ts"],"sourcesContent":["export function getSecondsFromTokenExp(futureUnixTimestamp: number): number {\n  const now = Math.floor(Date.now() / 1000) // current time in seconds\n  return futureUnixTimestamp - now\n}\n"],"names":["getSecondsFromTokenExp","futureUnixTimestamp","now","Math","floor","Date"],"mappings":"AAAA,OAAO,SAASA,uBAAuBC,mBAA2B;IAChE,MAAMC,MAAMC,KAAKC,KAAK,CAACC,KAAKH,GAAG,KAAK,MAAM,0BAA0B;;IACpE,OAAOD,sBAAsBC;AAC/B"}

package/dist/oauth/utilities/getTokenExp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getTokenExp.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/getTokenExp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,eAAO,MAAM,WAAW,4BAGrB;IACD,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;CACd,KAAG,MAAM,GAAG,SAwBZ,CAAA"}

package/dist/oauth/utilities/getTokenExp.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/getTokenExp.ts"],"sourcesContent":["import jwt from 'jsonwebtoken'\n\nimport type { DebugLogger } from '../types.js'\n\nexport const getTokenExp = ({\n  debugLogger,\n  token,\n}: {\n  debugLogger: DebugLogger\n  token: string\n}): number | undefined => {\n  if (!token) {\n    return undefined\n  }\n\n  try {\n    const decoded = jwt.decode(token)\n\n    if (\n      decoded &&\n      typeof decoded === 'object' &&\n      'exp' in decoded &&\n      typeof decoded.exp === 'number'\n    ) {\n      return decoded.exp\n    }\n  } catch (err: unknown) {\n    debugLogger.error({\n      err,\n      msg: 'Error decoding token in getTokenExp',\n    })\n  }\n\n  return undefined\n}\n"],"names":["jwt","getTokenExp","debugLogger","token","undefined","decoded","decode","exp","err","error","msg"],"mappings":"AAAA,OAAOA,SAAS,eAAc;AAI9B,OAAO,MAAMC,cAAc,CAAC,EAC1BC,WAAW,EACXC,KAAK,EAIN;IACC,IAAI,CAACA,OAAO;QACV,OAAOC;IACT;IAEA,IAAI;QACF,MAAMC,UAAUL,IAAIM,MAAM,CAACH;QAE3B,IACEE,WACA,OAAOA,YAAY,YACnB,SAASA,WACT,OAAOA,QAAQE,GAAG,KAAK,UACvB;YACA,OAAOF,QAAQE,GAAG;QACpB;IACF,EAAE,OAAOC,KAAc;QACrBN,YAAYO,KAAK,CAAC;YAChBD;YACAE,KAAK;QACP;IACF;IAEA,OAAON;AACT,EAAC"}

package/dist/oauth/utilities/getUsernameField.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getUsernameField.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/getUsernameField.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAItE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAIpD,UAAU,IAAI;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,iBAAiB,EAAE,iBAAiB,CAAA;CACrC;AACD,eAAO,MAAM,gBAAgB,uCAG1B,IAAI,KAAG,UAAU,GAAG,SA0BtB,CAAA"}

package/dist/oauth/utilities/getUsernameField.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/getUsernameField.ts"],"sourcesContent":["import type { CollectionConfig, EmailField, TextField } from 'payload'\n\nimport { flattenTopLevelFields } from 'payload'\n\nimport type { CollectionOptions } from '../types.js'\n\nimport { defaultUsernameField } from '../defaults.js'\n\ninterface Args {\n  collection: CollectionConfig\n  collectionOptions: CollectionOptions\n}\nexport const getUsernameField = ({\n  collection,\n  collectionOptions,\n}: Args): EmailField | TextField => {\n  if (!collectionOptions.usernameField) {\n    return defaultUsernameField\n  }\n\n  if (typeof collectionOptions.usernameField === 'string') {\n    const matchedField = flattenTopLevelFields(collection.fields).find(\n      (field) => field.name === collectionOptions.usernameField,\n    )\n\n    if (!matchedField) {\n      throw new Error(\n        `Username field \"${collectionOptions.usernameField}\" not found in collection \"${collection.slug}\"`,\n      )\n    }\n\n    if (matchedField.type !== 'text' && matchedField.type !== 'email') {\n      throw new Error(\n        `Username field \"${collectionOptions.usernameField}\" must be of type \"text\" or \"email\"`,\n      )\n    }\n\n    return matchedField\n  }\n\n  return collectionOptions.usernameField\n}\n"],"names":["flattenTopLevelFields","defaultUsernameField","getUsernameField","collection","collectionOptions","usernameField","matchedField","fields","find","field","name","Error","slug","type"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,UAAS;AAI/C,SAASC,oBAAoB,QAAQ,iBAAgB;AAMrD,OAAO,MAAMC,mBAAmB,CAAC,EAC/BC,UAAU,EACVC,iBAAiB,EACZ;IACL,IAAI,CAACA,kBAAkBC,aAAa,EAAE;QACpC,OAAOJ;IACT;IAEA,IAAI,OAAOG,kBAAkBC,aAAa,KAAK,UAAU;QACvD,MAAMC,eAAeN,sBAAsBG,WAAWI,MAAM,EAAEC,IAAI,CAChE,CAACC,QAAUA,MAAMC,IAAI,KAAKN,kBAAkBC,aAAa;QAG3D,IAAI,CAACC,cAAc;YACjB,MAAM,IAAIK,MACR,CAAC,gBAAgB,EAAEP,kBAAkBC,aAAa,CAAC,2BAA2B,EAAEF,WAAWS,IAAI,CAAC,CAAC,CAAC;QAEtG;QAEA,IAAIN,aAAaO,IAAI,KAAK,UAAUP,aAAaO,IAAI,KAAK,SAAS;YACjE,MAAM,IAAIF,MACR,CAAC,gBAAgB,EAAEP,kBAAkBC,aAAa,CAAC,mCAAmC,CAAC;QAE3F;QAEA,OAAOC;IACT;IAEA,OAAOF,kBAAkBC,aAAa;AACxC,EAAC"}

package/dist/oauth/utilities/hasUserTokenPropsChanged.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hasUserTokenPropsChanged.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/hasUserTokenPropsChanged.ts"],"names":[],"mappings":"AAAA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEnC;;;GAGG;AACH,eAAO,MAAM,wBAAwB,SAAU,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,OAerF,CAAA"}

package/dist/oauth/utilities/hasUserTokenPropsChanged.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/hasUserTokenPropsChanged.ts"],"sourcesContent":["type User = Record<string, unknown>\n\n/**\n * Iterate over the user's properties and compare them to the token's properties.\n * If a property has changed, return true.\n */\nexport const hasUserTokenPropsChanged = (user: User, token: Record<string, unknown>): boolean => {\n  // For each property in token:\n  // - if so, are the values different?\n  // - if so, return true\n\n  // Iterate over the user's properties\n  for (const key in user) {\n    if (user[key] && token[key]) {\n      if (compareValues(user[key], token[key])) {\n        return true\n      }\n    }\n  }\n\n  return false\n}\n\nfunction compareValues(userVal: unknown, tokenVal: unknown): boolean {\n  if (Array.isArray(userVal) && Array.isArray(tokenVal)) {\n    return (\n      userVal.some((val) => !tokenVal.includes(val)) ||\n      tokenVal.some((val) => !userVal.includes(val))\n    )\n  }\n  return userVal !== tokenVal\n}\n"],"names":["hasUserTokenPropsChanged","user","token","key","compareValues","userVal","tokenVal","Array","isArray","some","val","includes"],"mappings":"AAEA;;;CAGC,GACD,OAAO,MAAMA,2BAA2B,CAACC,MAAYC;IACnD,8BAA8B;IAC9B,qCAAqC;IACrC,uBAAuB;IAEvB,qCAAqC;IACrC,IAAK,MAAMC,OAAOF,KAAM;QACtB,IAAIA,IAAI,CAACE,IAAI,IAAID,KAAK,CAACC,IAAI,EAAE;YAC3B,IAAIC,cAAcH,IAAI,CAACE,IAAI,EAAED,KAAK,CAACC,IAAI,GAAG;gBACxC,OAAO;YACT;QACF;IACF;IAEA,OAAO;AACT,EAAC;AAED,SAASC,cAAcC,OAAgB,EAAEC,QAAiB;IACxD,IAAIC,MAAMC,OAAO,CAACH,YAAYE,MAAMC,OAAO,CAACF,WAAW;QACrD,OACED,QAAQI,IAAI,CAAC,CAACC,MAAQ,CAACJ,SAASK,QAAQ,CAACD,SACzCJ,SAASG,IAAI,CAAC,CAACC,MAAQ,CAACL,QAAQM,QAAQ,CAACD;IAE7C;IACA,OAAOL,YAAYC;AACrB"}

package/dist/oauth/utilities/mergeHeaders.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mergeHeaders.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/mergeHeaders.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,GAAG,IAAI,CA8BtF"}

package/dist/oauth/utilities/mergeHeaders.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/mergeHeaders.ts"],"sourcesContent":["const headersToJoin = ['set-cookie', 'warning', 'www-authenticate', 'proxy-authenticate', 'vary']\n\nexport function mergeHeaders(sourceHeaders: Headers, destinationHeaders: Headers): void {\n  // Create a map to store combined headers\n  const combinedHeaders = new Headers()\n\n  // Add existing destination headers to the combined map\n  destinationHeaders.forEach((value, key) => {\n    combinedHeaders.set(key, value)\n  })\n\n  // Add source headers to the combined map, joining specific headers\n  sourceHeaders.forEach((value, key) => {\n    const lowerKey = key.toLowerCase()\n    if (headersToJoin.includes(lowerKey)) {\n      if (combinedHeaders.has(key)) {\n        combinedHeaders.set(key, `${combinedHeaders.get(key)}, ${value}`)\n      } else {\n        combinedHeaders.set(key, value)\n      }\n    } else {\n      combinedHeaders.set(key, value)\n    }\n  })\n\n  // Clear the destination headers and set the combined headers\n  destinationHeaders.forEach((_, key) => {\n    destinationHeaders.delete(key)\n  })\n  combinedHeaders.forEach((value, key) => {\n    destinationHeaders.append(key, value)\n  })\n}\n"],"names":["headersToJoin","mergeHeaders","sourceHeaders","destinationHeaders","combinedHeaders","Headers","forEach","value","key","set","lowerKey","toLowerCase","includes","has","get","_","delete","append"],"mappings":"AAAA,MAAMA,gBAAgB;IAAC;IAAc;IAAW;IAAoB;IAAsB;CAAO;AAEjG,OAAO,SAASC,aAAaC,aAAsB,EAAEC,kBAA2B;IAC9E,yCAAyC;IACzC,MAAMC,kBAAkB,IAAIC;IAE5B,uDAAuD;IACvDF,mBAAmBG,OAAO,CAAC,CAACC,OAAOC;QACjCJ,gBAAgBK,GAAG,CAACD,KAAKD;IAC3B;IAEA,mEAAmE;IACnEL,cAAcI,OAAO,CAAC,CAACC,OAAOC;QAC5B,MAAME,WAAWF,IAAIG,WAAW;QAChC,IAAIX,cAAcY,QAAQ,CAACF,WAAW;YACpC,IAAIN,gBAAgBS,GAAG,CAACL,MAAM;gBAC5BJ,gBAAgBK,GAAG,CAACD,KAAK,GAAGJ,gBAAgBU,GAAG,CAACN,KAAK,EAAE,EAAED,OAAO;YAClE,OAAO;gBACLH,gBAAgBK,GAAG,CAACD,KAAKD;YAC3B;QACF,OAAO;YACLH,gBAAgBK,GAAG,CAACD,KAAKD;QAC3B;IACF;IAEA,6DAA6D;IAC7DJ,mBAAmBG,OAAO,CAAC,CAACS,GAAGP;QAC7BL,mBAAmBa,MAAM,CAACR;IAC5B;IACAJ,gBAAgBE,OAAO,CAAC,CAACC,OAAOC;QAC9BL,mBAAmBc,MAAM,CAACT,KAAKD;IACjC;AACF"}

package/dist/oauth/utilities/refreshTokens.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refreshTokens.d.ts","sourceRoot":"","sources":["../../../src/oauth/utilities/refreshTokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAItC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAUpD,UAAU,IAAI;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,KAAK,MAAM,GACP;IACE,iBAAiB,EAAE,GAAG,CAAC,UAAU,CAAA;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd,GACD,KAAK,CAAA;AAET,eAAO,MAAM,aAAa,wCAA+C,IAAI,KAAG,OAAO,CAAC,MAAM,CAmE7F,CAAA"}

package/dist/oauth/utilities/refreshTokens.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/oauth/utilities/refreshTokens.ts"],"sourcesContent":["import type jwt from 'jsonwebtoken'\nimport type { Payload } from 'payload'\n\nimport { generateCookie } from 'payload'\n\nimport type { Strategy } from '../strategy/index.js'\n\nimport { getProjectToken } from '../../api/figma-api.js'\nimport { validateProjectToken } from '../../auth/jwt-validator.js'\nimport { getEnvironment } from '../../constants.js'\nimport { createCookieOptions } from './createCookieOptions.js'\nimport { createDebugLogger } from './createDebugLogger.js'\nimport { getCookieExpiration } from './getCookieExpiration.js'\nimport { getTokenExp } from './getTokenExp.js'\n\ninterface Args {\n  payload: Payload\n  refreshToken: string\n  strategy: Strategy\n}\n\ntype Result =\n  | {\n      decodedOauthToken: jwt.JwtPayload\n      headers: Headers\n      token: string\n    }\n  | false\n\nexport const refreshTokens = async ({ payload, refreshToken, strategy }: Args): Promise<Result> => {\n  const debugLogger = createDebugLogger(payload, strategy.debug)\n\n  debugLogger.info({\n    msg: 'Refreshing tokens',\n  })\n\n  const headers = new Headers()\n\n  // At this point, access token is expired\n  // but refresh token is still valid\n  // so we will refresh both tokens\n\n  try {\n    // Get another project token\n    const { expiresAt, token } = await getProjectToken(refreshToken, 'someproject')\n\n    debugLogger.info({\n      expiresAt,\n      msg: 'Received new tokens from Figma API',\n      token,\n    })\n\n    // On error, no user\n    if (!token) {\n      debugLogger.error({\n        msg: 'Error refreshing tokens',\n      })\n      return false\n    }\n\n    if (token) {\n      debugLogger.info({\n        msg: 'Successfully refreshed project token',\n        token,\n      })\n\n      const expires_in = new Date(expiresAt)\n\n      const cookieOptions = createCookieOptions({\n        collection: strategy.collection,\n        headers,\n        pluginOptions: strategy.pluginOptions,\n      })\n\n      const tokenCookie = generateCookie({\n        ...cookieOptions,\n        name: strategy.cookieName,\n        expires: getCookieExpiration(expires_in),\n        returnCookieAsObject: false,\n        value: token,\n      }) as string\n\n      headers.append('Set-Cookie', tokenCookie)\n\n      const decodedOauthToken = await validateProjectToken(token, getEnvironment())\n\n      return { decodedOauthToken, headers, token }\n    }\n  } catch (error) {\n    debugLogger.error({\n      err: error,\n      msg: 'Error refreshing tokens',\n    })\n  }\n\n  return false\n}\n"],"names":["generateCookie","getProjectToken","validateProjectToken","getEnvironment","createCookieOptions","createDebugLogger","getCookieExpiration","refreshTokens","payload","refreshToken","strategy","debugLogger","debug","info","msg","headers","Headers","expiresAt","token","error","expires_in","Date","cookieOptions","collection","pluginOptions","tokenCookie","name","cookieName","expires","returnCookieAsObject","value","append","decodedOauthToken","err"],"mappings":"AAGA,SAASA,cAAc,QAAQ,UAAS;AAIxC,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,oBAAoB,QAAQ,8BAA6B;AAClE,SAASC,cAAc,QAAQ,qBAAoB;AACnD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,iBAAiB,QAAQ,yBAAwB;AAC1D,SAASC,mBAAmB,QAAQ,2BAA0B;AAiB9D,OAAO,MAAMC,gBAAgB,OAAO,EAAEC,OAAO,EAAEC,YAAY,EAAEC,QAAQ,EAAQ;IAC3E,MAAMC,cAAcN,kBAAkBG,SAASE,SAASE,KAAK;IAE7DD,YAAYE,IAAI,CAAC;QACfC,KAAK;IACP;IAEA,MAAMC,UAAU,IAAIC;IAEpB,yCAAyC;IACzC,mCAAmC;IACnC,iCAAiC;IAEjC,IAAI;QACF,4BAA4B;QAC5B,MAAM,EAAEC,SAAS,EAAEC,KAAK,EAAE,GAAG,MAAMjB,gBAAgBQ,cAAc;QAEjEE,YAAYE,IAAI,CAAC;YACfI;YACAH,KAAK;YACLI;QACF;QAEA,oBAAoB;QACpB,IAAI,CAACA,OAAO;YACVP,YAAYQ,KAAK,CAAC;gBAChBL,KAAK;YACP;YACA,OAAO;QACT;QAEA,IAAII,OAAO;YACTP,YAAYE,IAAI,CAAC;gBACfC,KAAK;gBACLI;YACF;YAEA,MAAME,aAAa,IAAIC,KAAKJ;YAE5B,MAAMK,gBAAgBlB,oBAAoB;gBACxCmB,YAAYb,SAASa,UAAU;gBAC/BR;gBACAS,eAAed,SAASc,aAAa;YACvC;YAEA,MAAMC,cAAczB,eAAe;gBACjC,GAAGsB,aAAa;gBAChBI,MAAMhB,SAASiB,UAAU;gBACzBC,SAAStB,oBAAoBc;gBAC7BS,sBAAsB;gBACtBC,OAAOZ;YACT;YAEAH,QAAQgB,MAAM,CAAC,cAAcN;YAE7B,MAAMO,oBAAoB,MAAM9B,qBAAqBgB,OAAOf;YAE5D,OAAO;gBAAE6B;gBAAmBjB;gBAASG;YAAM;QAC7C;IACF,EAAE,OAAOC,OAAO;QACdR,YAAYQ,KAAK,CAAC;YAChBc,KAAKd;YACLL,KAAK;QACP;IACF;IAEA,OAAO;AACT,EAAC"}

package/dist/plugin/adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/plugin/adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAIjD,MAAM,WAAW,yBAAyB;CAEzC;AAED,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAiJ9F"}

package/dist/plugin/adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/plugin/adapter.ts"],"sourcesContent":["/* eslint-disable */\n\nimport type { DatabaseAdapterObj } from 'payload'\n\nimport { createDatabaseAdapter } from 'payload'\n\nexport interface FigmaContentSystemOptions {\n  // Add Figma-specific configuration options here\n}\n\nexport function figmaContentSystem(options: FigmaContentSystemOptions = {}): DatabaseAdapterObj {\n  function adapter({ payload }: { payload: any }) {\n    return createDatabaseAdapter({\n      name: 'figma-content-system',\n      defaultIDType: 'text' as const,\n      packageName: '@payloadcms/plugin-figma',\n      payload,\n\n      // Connection lifecycle\n      connect: async () => {\n        throw new Error('figmaContentSystem.connect() not implemented')\n      },\n      destroy: async () => {\n        throw new Error('figmaContentSystem.destroy() not implemented')\n      },\n      init: async () => {\n        throw new Error('figmaContentSystem.init() not implemented')\n      },\n\n      // Transactions\n      beginTransaction: async () => {\n        throw new Error('figmaContentSystem.beginTransaction() not implemented')\n      },\n      commitTransaction: async () => {\n        throw new Error('figmaContentSystem.commitTransaction() not implemented')\n      },\n      rollbackTransaction: async () => {\n        throw new Error('figmaContentSystem.rollbackTransaction() not implemented')\n      },\n\n      // Collection operations\n      count: async () => {\n        throw new Error('figmaContentSystem.count() not implemented')\n      },\n      create: async () => {\n        throw new Error('figmaContentSystem.create() not implemented')\n      },\n      deleteMany: async () => {\n        throw new Error('figmaContentSystem.deleteMany() not implemented')\n      },\n      deleteOne: async () => {\n        throw new Error('figmaContentSystem.deleteOne() not implemented')\n      },\n      find: async () => {\n        throw new Error('figmaContentSystem.find() not implemented')\n      },\n      findDistinct: async () => {\n        throw new Error('figmaContentSystem.findDistinct() not implemented')\n      },\n      findOne: async () => {\n        throw new Error('figmaContentSystem.findOne() not implemented')\n      },\n      updateMany: async () => {\n        throw new Error('figmaContentSystem.updateMany() not implemented')\n      },\n      updateOne: async () => {\n        throw new Error('figmaContentSystem.updateOne() not implemented')\n      },\n      upsert: async () => {\n        throw new Error('figmaContentSystem.upsert() not implemented')\n      },\n\n      // Global operations\n      createGlobal: async () => {\n        throw new Error('figmaContentSystem.createGlobal() not implemented')\n      },\n      findGlobal: async () => {\n        throw new Error('figmaContentSystem.findGlobal() not implemented')\n      },\n      updateGlobal: async () => {\n        throw new Error('figmaContentSystem.updateGlobal() not implemented')\n      },\n\n      // Version operations\n      countVersions: async () => {\n        throw new Error('figmaContentSystem.countVersions() not implemented')\n      },\n      createVersion: async () => {\n        throw new Error('figmaContentSystem.createVersion() not implemented')\n      },\n      deleteVersions: async () => {\n        throw new Error('figmaContentSystem.deleteVersions() not implemented')\n      },\n      findVersions: async () => {\n        throw new Error('figmaContentSystem.findVersions() not implemented')\n      },\n      updateVersion: async () => {\n        throw new Error('figmaContentSystem.updateVersion() not implemented')\n      },\n\n      // Global version operations\n      countGlobalVersions: async () => {\n        throw new Error('figmaContentSystem.countGlobalVersions() not implemented')\n      },\n      createGlobalVersion: async () => {\n        throw new Error('figmaContentSystem.createGlobalVersion() not implemented')\n      },\n      findGlobalVersions: async () => {\n        throw new Error('figmaContentSystem.findGlobalVersions() not implemented')\n      },\n      updateGlobalVersion: async () => {\n        throw new Error('figmaContentSystem.updateGlobalVersion() not implemented')\n      },\n\n      // Draft operations\n      queryDrafts: async () => {\n        throw new Error('figmaContentSystem.queryDrafts() not implemented')\n      },\n\n      // Job operations\n      updateJobs: async () => {\n        throw new Error('figmaContentSystem.updateJobs() not implemented')\n      },\n\n      // Migration operations\n      createMigration: async () => {\n        throw new Error('figmaContentSystem.createMigration() not implemented')\n      },\n      migrate: async () => {\n        throw new Error('figmaContentSystem.migrate() not implemented')\n      },\n      migrateDown: async () => {\n        throw new Error('figmaContentSystem.migrateDown() not implemented')\n      },\n      migrateFresh: async () => {\n        throw new Error('figmaContentSystem.migrateFresh() not implemented')\n      },\n      migrateRefresh: async () => {\n        throw new Error('figmaContentSystem.migrateRefresh() not implemented')\n      },\n      migrateReset: async () => {\n        throw new Error('figmaContentSystem.migrateReset() not implemented')\n      },\n      migrateStatus: async () => {\n        throw new Error('figmaContentSystem.migrateStatus() not implemented')\n      },\n      migrationDir: './migrations',\n    })\n  }\n\n  return {\n    name: 'figma-content-system',\n    defaultIDType: 'text' as const,\n    init: adapter,\n  }\n}\n"],"names":["createDatabaseAdapter","figmaContentSystem","options","adapter","payload","name","defaultIDType","packageName","connect","Error","destroy","init","beginTransaction","commitTransaction","rollbackTransaction","count","create","deleteMany","deleteOne","find","findDistinct","findOne","updateMany","updateOne","upsert","createGlobal","findGlobal","updateGlobal","countVersions","createVersion","deleteVersions","findVersions","updateVersion","countGlobalVersions","createGlobalVersion","findGlobalVersions","updateGlobalVersion","queryDrafts","updateJobs","createMigration","migrate","migrateDown","migrateFresh","migrateRefresh","migrateReset","migrateStatus","migrationDir"],"mappings":"AAAA,kBAAkB,GAIlB,SAASA,qBAAqB,QAAQ,UAAS;AAM/C,OAAO,SAASC,mBAAmBC,UAAqC,CAAC,CAAC;IACxE,SAASC,QAAQ,EAAEC,OAAO,EAAoB;QAC5C,OAAOJ,sBAAsB;YAC3BK,MAAM;YACNC,eAAe;YACfC,aAAa;YACbH;YAEA,uBAAuB;YACvBI,SAAS;gBACP,MAAM,IAAIC,MAAM;YAClB;YACAC,SAAS;gBACP,MAAM,IAAID,MAAM;YAClB;YACAE,MAAM;gBACJ,MAAM,IAAIF,MAAM;YAClB;YAEA,eAAe;YACfG,kBAAkB;gBAChB,MAAM,IAAIH,MAAM;YAClB;YACAI,mBAAmB;gBACjB,MAAM,IAAIJ,MAAM;YAClB;YACAK,qBAAqB;gBACnB,MAAM,IAAIL,MAAM;YAClB;YAEA,wBAAwB;YACxBM,OAAO;gBACL,MAAM,IAAIN,MAAM;YAClB;YACAO,QAAQ;gBACN,MAAM,IAAIP,MAAM;YAClB;YACAQ,YAAY;gBACV,MAAM,IAAIR,MAAM;YAClB;YACAS,WAAW;gBACT,MAAM,IAAIT,MAAM;YAClB;YACAU,MAAM;gBACJ,MAAM,IAAIV,MAAM;YAClB;YACAW,cAAc;gBACZ,MAAM,IAAIX,MAAM;YAClB;YACAY,SAAS;gBACP,MAAM,IAAIZ,MAAM;YAClB;YACAa,YAAY;gBACV,MAAM,IAAIb,MAAM;YAClB;YACAc,WAAW;gBACT,MAAM,IAAId,MAAM;YAClB;YACAe,QAAQ;gBACN,MAAM,IAAIf,MAAM;YAClB;YAEA,oBAAoB;YACpBgB,cAAc;gBACZ,MAAM,IAAIhB,MAAM;YAClB;YACAiB,YAAY;gBACV,MAAM,IAAIjB,MAAM;YAClB;YACAkB,cAAc;gBACZ,MAAM,IAAIlB,MAAM;YAClB;YAEA,qBAAqB;YACrBmB,eAAe;gBACb,MAAM,IAAInB,MAAM;YAClB;YACAoB,eAAe;gBACb,MAAM,IAAIpB,MAAM;YAClB;YACAqB,gBAAgB;gBACd,MAAM,IAAIrB,MAAM;YAClB;YACAsB,cAAc;gBACZ,MAAM,IAAItB,MAAM;YAClB;YACAuB,eAAe;gBACb,MAAM,IAAIvB,MAAM;YAClB;YAEA,4BAA4B;YAC5BwB,qBAAqB;gBACnB,MAAM,IAAIxB,MAAM;YAClB;YACAyB,qBAAqB;gBACnB,MAAM,IAAIzB,MAAM;YAClB;YACA0B,oBAAoB;gBAClB,MAAM,IAAI1B,MAAM;YAClB;YACA2B,qBAAqB;gBACnB,MAAM,IAAI3B,MAAM;YAClB;YAEA,mBAAmB;YACnB4B,aAAa;gBACX,MAAM,IAAI5B,MAAM;YAClB;YAEA,iBAAiB;YACjB6B,YAAY;gBACV,MAAM,IAAI7B,MAAM;YAClB;YAEA,uBAAuB;YACvB8B,iBAAiB;gBACf,MAAM,IAAI9B,MAAM;YAClB;YACA+B,SAAS;gBACP,MAAM,IAAI/B,MAAM;YAClB;YACAgC,aAAa;gBACX,MAAM,IAAIhC,MAAM;YAClB;YACAiC,cAAc;gBACZ,MAAM,IAAIjC,MAAM;YAClB;YACAkC,gBAAgB;gBACd,MAAM,IAAIlC,MAAM;YAClB;YACAmC,cAAc;gBACZ,MAAM,IAAInC,MAAM;YAClB;YACAoC,eAAe;gBACb,MAAM,IAAIpC,MAAM;YAClB;YACAqC,cAAc;QAChB;IACF;IAEA,OAAO;QACLzC,MAAM;QACNC,eAAe;QACfK,MAAMR;IACR;AACF"}

package/dist/plugin/build-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../../src/plugin/build-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAQtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC1B,GAAG;IACF,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAC3B,CAAA;CACF,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAoC/E"}

package/dist/plugin/build-config.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/plugin/build-config.ts"],"sourcesContent":["import type { Config, SanitizedConfig } from 'payload'\n\nimport { lexicalEditor } from '@payloadcms/richtext-lexical'\nimport { buildConfig as payloadBuildConfig } from 'payload'\n\nimport { oAuth2Plugin } from '../oauth/index.js'\nimport { figmaContentSystem } from './adapter.js'\n\n/**\n * Configuration type for Payload projects on the Figma platform.\n *\n * Differences from standard Payload Config:\n * - `db`: Omitted (auto-injected by Figma platform)\n * - `secret`: Omitted (auto-injected by Figma platform)\n * - `editor`: Optional (defaults to lexicalEditor() if not provided)\n *\n * @example\n * // Minimal config\n * const config: FigmaConfig = {\n *   collections: [...]\n * }\n *\n * @example\n * // With custom editor\n * const config: FigmaConfig = {\n *   collections: [...],\n *   editor: lexicalEditor({ features: [...] })\n * }\n */\nexport type FigmaConfig = {\n  editor?: Config['editor']\n} & {\n  figma: {\n    region: string\n    tenantId: string\n    useContentSystem?: boolean\n  }\n} & Omit<Config, 'editor' | 'secret' | 'db'> &\n  Partial<Pick<Config, 'db'>>\n\n/**\n * Figma platform wrapper for Payload's buildConfig.\n * Automatically injects:\n * - Figma database adapter\n * - Secret (platform-provided)\n * - Default lexicalEditor (if no custom editor specified)\n *\n * @param config - Payload configuration (db and secret omitted, editor optional)\n * @returns Promise<SanitizedConfig> - Built Payload configuration\n */\nexport async function buildConfig(config: FigmaConfig): Promise<SanitizedConfig> {\n  // Build complete config with Figma platform defaults\n  const configWithFigmaDefaults: Config = {\n    ...config,\n    db: config.figma.useContentSystem ? figmaContentSystem() : config.db!,\n    editor: config.editor ?? lexicalEditor(),\n    secret: 'MY_SECRET',\n    // Add oauth to plugins if not already present\n    plugins: [\n      ...(config.plugins ?? []),\n      oAuth2Plugin({\n        collections: [\n          {\n            slug: 'users',\n            // Use adapter because Figma app doesn't support OIDC scopes\n            authorizationURLParams: {\n              response_mode: 'query',\n              response_type: 'code',\n            },\n            clientID: process.env.FIGMA_OAUTH_CLIENT_ID!,\n            clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,\n            identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',\n            scope: ['current_user:read'],\n            token: 'id_token', // Adapter creates JWT id_token from Figma user info\n            usernameField: 'email',\n          },\n        ],\n        debug: true,\n        disabled: false,\n        redirectServerURL: 'http://localhost:3000',\n      }),\n    ],\n  }\n\n  // Delegate to Payload's buildConfig\n  return await payloadBuildConfig(configWithFigmaDefaults)\n}\n"],"names":["lexicalEditor","buildConfig","payloadBuildConfig","oAuth2Plugin","figmaContentSystem","config","configWithFigmaDefaults","db","figma","useContentSystem","editor","secret","plugins","collections","slug","authorizationURLParams","response_mode","response_type","clientID","process","env","FIGMA_OAUTH_CLIENT_ID","clientSecret","FIGMA_OAUTH_CLIENT_SECRET","identityMetadata","scope","token","usernameField","debug","disabled","redirectServerURL"],"mappings":"AAEA,SAASA,aAAa,QAAQ,+BAA8B;AAC5D,SAASC,eAAeC,kBAAkB,QAAQ,UAAS;AAE3D,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,kBAAkB,QAAQ,eAAc;AAkCjD;;;;;;;;;CASC,GACD,OAAO,eAAeH,YAAYI,MAAmB;IACnD,qDAAqD;IACrD,MAAMC,0BAAkC;QACtC,GAAGD,MAAM;QACTE,IAAIF,OAAOG,KAAK,CAACC,gBAAgB,GAAGL,uBAAuBC,OAAOE,EAAE;QACpEG,QAAQL,OAAOK,MAAM,IAAIV;QACzBW,QAAQ;QACR,8CAA8C;QAC9CC,SAAS;eACHP,OAAOO,OAAO,IAAI,EAAE;YACxBT,aAAa;gBACXU,aAAa;oBACX;wBACEC,MAAM;wBACN,4DAA4D;wBAC5DC,wBAAwB;4BACtBC,eAAe;4BACfC,eAAe;wBACjB;wBACAC,UAAUC,QAAQC,GAAG,CAACC,qBAAqB;wBAC3CC,cAAcH,QAAQC,GAAG,CAACG,yBAAyB;wBACnDC,kBAAkB;wBAClBC,OAAO;4BAAC;yBAAoB;wBAC5BC,OAAO;wBACPC,eAAe;oBACjB;iBACD;gBACDC,OAAO;gBACPC,UAAU;gBACVC,mBAAmB;YACrB;SACD;IACH;IAEA,oCAAoC;IACpC,OAAO,MAAM5B,mBAAmBI;AAClC"}

package/dist/types/config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,yCAAyC;IACzC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,WAAW,CAAA;IACxC,oBAAoB;IACpB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAA;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,iDAAiD;IACjD,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAA;IACxC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB"}

package/dist/types/config.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/types/config.ts"],"sourcesContent":["/**\n * Figma CMS Configuration Types\n */\n\n/**\n * Tenant instance from Control Plane API\n */\nexport interface Tenant {\n  /** Creation timestamp */\n  createdAt?: string\n  /** Domain name (e.g., my-cms.figmacms.com) */\n  domain: string\n  /** Unique tenant ID */\n  id: string\n  /** Parent ID */\n  parentId: string\n  /** Parent type (team, org, workspace) */\n  parentType: 'org' | 'team' | 'workspace'\n  /** Tenant status */\n  status: 'active' | 'inactive' | 'provisioning'\n}\n\n/**\n * Project information from detection\n */\nexport interface ProjectInfo {\n  /** Whether Payload is installed */\n  hasPayload: boolean\n  /** Package manager detected (npm, pnpm, yarn) */\n  packageManager?: 'npm' | 'pnpm' | 'yarn'\n  /** Project root path */\n  path: string\n  /** Payload version if installed */\n  payloadVersion?: string\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC,GAgBD;;CAEC,GACD,WASC"}

package/dist/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,KAAK,CAAA;AAE1B,MAAM,WAAW,IAAK,SAAQ,GAAG,CAAC,IAAI;IACpC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,SAAS,EAAE,kBAAkB,CAAA;IAC7B,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,kBAAkB,CAAA;IAC9B,OAAO,EAAE,kBAAkB,CAAA;IAI3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAEtC,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,cAAc,CAAA;AAE1D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,IAAI,EAAE,SAAS,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,QAAQ;IAC9C,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,UAAU,QAAQ;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAA;AAE5D,MAAM,MAAM,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,iBAAiB,CAAA;AAExF,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAA;AAE5C,MAAM,MAAM,cAAc,GAAG;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,EAAE,OAAO,CAAA;IACjB,sBAAsB,EAAE,OAAO,CAAA;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,WAAW,EAAE,IAAI,GAAG,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAA;AAEjD,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,WAAW,GAAG,mBAAmB,CAAA"}

package/dist/types.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type arg from 'arg'\n\nexport interface Args extends arg.Spec {\n  '--debug': BooleanConstructor\n  '--force': BooleanConstructor\n  '--help': BooleanConstructor\n  '--list': BooleanConstructor\n  '--logout': BooleanConstructor\n  '--yes': BooleanConstructor\n\n  // Aliases\n\n  '-f': string\n  '-h': string\n  '-y': string\n}\n\nexport type CliArgs = arg.Result<Args>\n\nexport type ProjectTemplate = GitTemplate | PluginTemplate\n\nexport type ProjectExample = {\n  name: string\n  url: string\n}\n\n/**\n * Template that is cloned verbatim from a git repo\n * Performs .env manipulation based upon input\n */\nexport interface GitTemplate extends Template {\n  type: 'starter'\n  url: string\n}\n\n/**\n * Type specifically for the plugin template\n * No .env manipulation is done\n */\nexport interface PluginTemplate extends Template {\n  type: 'plugin'\n  url: string\n}\n\ninterface Template {\n  description?: string\n  name: string\n  type: ProjectTemplate['type']\n}\n\nexport type PackageManager = 'bun' | 'npm' | 'pnpm' | 'yarn'\n\nexport type DbType = 'd1-sqlite' | 'mongodb' | 'postgres' | 'sqlite' | 'vercel-postgres'\n\nexport type DbDetails = {\n  dbUri?: string\n  type: DbType\n}\n\nexport type EditorType = 'lexical' | 'slate'\n\nexport type NextAppDetails = {\n  hasTopLevelLayout: boolean\n  isPayloadInstalled?: boolean\n  isSrcDir: boolean\n  isSupportedNextVersion: boolean\n  nextAppDir?: string\n  nextConfigPath?: string\n  nextConfigType?: NextConfigType\n  nextVersion: null | string\n}\n\nexport type NextConfigType = 'cjs' | 'esm' | 'ts'\n\nexport type StorageAdapterType = 'localDisk' | 'r2Storage' | 'vercelBlobStorage'\n"],"names":[],"mappings":"AA0EA,WAAgF"}

package/dist/utils/asset-collection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"asset-collection.d.ts","sourceRoot":"","sources":["../../src/utils/asset-collection.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGnE;AAgDD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAchF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBxE"}

package/dist/utils/asset-collection.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utils/asset-collection.ts"],"sourcesContent":["import { exec } from 'child_process'\nimport fs from 'fs/promises'\nimport path from 'path'\nimport { promisify } from 'util'\n\nimport * as log from './log.js'\n\nconst execAsync = promisify(exec)\n\n// Maximum file size for static assets (S3 limitation)\nconst MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB\n\n/**\n * Get file size in bytes\n *\n * @param filePath - Absolute path to file\n * @returns File size in bytes\n */\nexport async function getFileSize(filePath: string): Promise<number> {\n  const stats = await fs.stat(filePath)\n  return stats.size\n}\n\n/**\n * Recursively collect files from a directory\n *\n * Excludes files larger than 50MB (S3 limitation).\n * Warns user when files are excluded due to size.\n *\n * @param dir - Directory to scan\n * @param baseDir - Base directory for relative paths\n * @returns Array of relative file paths\n */\nasync function collectFiles(dir: string, baseDir: string): Promise<string[]> {\n  const files: string[] = []\n\n  try {\n    const entries = await fs.readdir(dir, { withFileTypes: true })\n\n    for (const entry of entries) {\n      const fullPath = path.join(dir, entry.name)\n\n      if (entry.isDirectory()) {\n        // Recursively collect from subdirectories\n        const subFiles = await collectFiles(fullPath, baseDir)\n        files.push(...subFiles)\n      } else if (entry.isFile()) {\n        // Check file size before adding\n        const stats = await fs.stat(fullPath)\n        if (stats.size <= MAX_ASSET_SIZE) {\n          // Add relative path from base directory\n          const relativePath = path.relative(baseDir, fullPath)\n          files.push(relativePath)\n        } else {\n          // Warn user about skipped files\n          const sizeMB = (stats.size / (1024 * 1024)).toFixed(2)\n          const relativePath = path.relative(baseDir, fullPath)\n          log.warning(`Skipping large asset: ${relativePath} (${sizeMB}MB exceeds 50MB limit)`)\n        }\n      }\n    }\n  } catch {\n    // Directory doesn't exist or not accessible\n    return []\n  }\n\n  return files\n}\n\n/**\n * Collect all static asset paths from .next/static\n *\n * Returns paths relative to project root, formatted for S3:\n * - `.next/static/chunks/main.js` → `_next/static/chunks/main.js`\n *\n * @param projectPath - Path to project root\n * @returns Array of static asset paths (using _next prefix)\n */\nexport async function collectStaticAssets(projectPath: string): Promise<string[]> {\n  const staticDir = path.join(projectPath, '.next', 'static')\n\n  try {\n    await fs.stat(staticDir)\n  } catch {\n    // No static directory\n    return []\n  }\n\n  const files = await collectFiles(staticDir, projectPath)\n\n  // Convert .next/static to _next/static (Next.js convention)\n  return files.map((file) => file.replace(/^\\.next\\//, '_next/'))\n}\n\n/**\n * Create Lambda deployment zip using build_for_lambda.sh\n *\n * This script:\n * - Copies static files to standalone build\n * - Creates lambda.zip from .next/standalone/\n * - Places zip at project root\n *\n * @param projectPath - Path to project root\n * @throws Error if script missing or execution fails\n */\nexport async function createLambdaZip(projectPath: string): Promise<void> {\n  const scriptPath = path.join(projectPath, 'build_for_lambda.sh')\n\n  // Check if script exists\n  try {\n    await fs.stat(scriptPath)\n  } catch {\n    throw new Error('build_for_lambda.sh not found. Run init command to set up project.')\n  }\n\n  // Execute script\n  try {\n    await execAsync('./build_for_lambda.sh', { cwd: projectPath })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    throw new Error(`Failed to create Lambda zip: ${message}`)\n  }\n\n  // Verify zip was created\n  const zipPath = path.join(projectPath, 'lambda.zip')\n  try {\n    await fs.stat(zipPath)\n  } catch {\n    throw new Error('lambda.zip was not created by build_for_lambda.sh')\n  }\n}\n"],"names":["exec","fs","path","promisify","log","execAsync","MAX_ASSET_SIZE","getFileSize","filePath","stats","stat","size","collectFiles","dir","baseDir","files","entries","readdir","withFileTypes","entry","fullPath","join","name","isDirectory","subFiles","push","isFile","relativePath","relative","sizeMB","toFixed","warning","collectStaticAssets","projectPath","staticDir","map","file","replace","createLambdaZip","scriptPath","Error","cwd","error","message","zipPath"],"mappings":"AAAA,SAASA,IAAI,QAAQ,gBAAe;AACpC,OAAOC,QAAQ,cAAa;AAC5B,OAAOC,UAAU,OAAM;AACvB,SAASC,SAAS,QAAQ,OAAM;AAEhC,YAAYC,SAAS,WAAU;AAE/B,MAAMC,YAAYF,UAAUH;AAE5B,sDAAsD;AACtD,MAAMM,iBAAiB,KAAK,OAAO,KAAK,OAAO;;AAE/C;;;;;CAKC,GACD,OAAO,eAAeC,YAAYC,QAAgB;IAChD,MAAMC,QAAQ,MAAMR,GAAGS,IAAI,CAACF;IAC5B,OAAOC,MAAME,IAAI;AACnB;AAEA;;;;;;;;;CASC,GACD,eAAeC,aAAaC,GAAW,EAAEC,OAAe;IACtD,MAAMC,QAAkB,EAAE;IAE1B,IAAI;QACF,MAAMC,UAAU,MAAMf,GAAGgB,OAAO,CAACJ,KAAK;YAAEK,eAAe;QAAK;QAE5D,KAAK,MAAMC,SAASH,QAAS;YAC3B,MAAMI,WAAWlB,KAAKmB,IAAI,CAACR,KAAKM,MAAMG,IAAI;YAE1C,IAAIH,MAAMI,WAAW,IAAI;gBACvB,0CAA0C;gBAC1C,MAAMC,WAAW,MAAMZ,aAAaQ,UAAUN;gBAC9CC,MAAMU,IAAI,IAAID;YAChB,OAAO,IAAIL,MAAMO,MAAM,IAAI;gBACzB,gCAAgC;gBAChC,MAAMjB,QAAQ,MAAMR,GAAGS,IAAI,CAACU;gBAC5B,IAAIX,MAAME,IAAI,IAAIL,gBAAgB;oBAChC,wCAAwC;oBACxC,MAAMqB,eAAezB,KAAK0B,QAAQ,CAACd,SAASM;oBAC5CL,MAAMU,IAAI,CAACE;gBACb,OAAO;oBACL,gCAAgC;oBAChC,MAAME,SAAS,AAACpB,CAAAA,MAAME,IAAI,GAAI,CAAA,OAAO,IAAG,CAAC,EAAGmB,OAAO,CAAC;oBACpD,MAAMH,eAAezB,KAAK0B,QAAQ,CAACd,SAASM;oBAC5ChB,IAAI2B,OAAO,CAAC,CAAC,sBAAsB,EAAEJ,aAAa,EAAE,EAAEE,OAAO,sBAAsB,CAAC;gBACtF;YACF;QACF;IACF,EAAE,OAAM;QACN,4CAA4C;QAC5C,OAAO,EAAE;IACX;IAEA,OAAOd;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeiB,oBAAoBC,WAAmB;IAC3D,MAAMC,YAAYhC,KAAKmB,IAAI,CAACY,aAAa,SAAS;IAElD,IAAI;QACF,MAAMhC,GAAGS,IAAI,CAACwB;IAChB,EAAE,OAAM;QACN,sBAAsB;QACtB,OAAO,EAAE;IACX;IAEA,MAAMnB,QAAQ,MAAMH,aAAasB,WAAWD;IAE5C,4DAA4D;IAC5D,OAAOlB,MAAMoB,GAAG,CAAC,CAACC,OAASA,KAAKC,OAAO,CAAC,aAAa;AACvD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,gBAAgBL,WAAmB;IACvD,MAAMM,aAAarC,KAAKmB,IAAI,CAACY,aAAa;IAE1C,yBAAyB;IACzB,IAAI;QACF,MAAMhC,GAAGS,IAAI,CAAC6B;IAChB,EAAE,OAAM;QACN,MAAM,IAAIC,MAAM;IAClB;IAEA,iBAAiB;IACjB,IAAI;QACF,MAAMnC,UAAU,yBAAyB;YAAEoC,KAAKR;QAAY;IAC9D,EAAE,OAAOS,OAAO;QACd,MAAMC,UAAUD,iBAAiBF,QAAQE,MAAMC,OAAO,GAAG;QACzD,MAAM,IAAIH,MAAM,CAAC,6BAA6B,EAAEG,SAAS;IAC3D;IAEA,yBAAyB;IACzB,MAAMC,UAAU1C,KAAKmB,IAAI,CAACY,aAAa;IACvC,IAAI;QACF,MAAMhC,GAAGS,IAAI,CAACkC;IAChB,EAAE,OAAM;QACN,MAAM,IAAIJ,MAAM;IAClB;AACF"}