@payloadcms/figma 0.0.1-alpha.67 → 0.0.1-alpha.68

package/dist/plugin/build-config.d.ts

@@ -1,4 +1,13 @@
 import type { Config, SanitizedConfig } from 'payload';
+/**
+ * Worker-trusted marker injected by Figma's sites-worker after it validates the
+ * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
+ * `jobs.access.run` below honors this marker so Sinatra (async-job-workflow)
+ * can drive job runs without the bypass secret ever reaching tenant code.
+ *
+ * KEEP_IN_SYNC(cloudflare/wrangler/sites-worker/src/auth.ts): FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER
+ */
+export declare const FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER = "figma-internal-forwarded-has-auth-bypass";
 /**
  * Configuration type for Payload projects on the Figma platform.
  *

package/dist/plugin/build-config.js

@@ -20,6 +20,14 @@ import * as log from '../utils/log.js';
 import { logMissingCliAuth } from './auth-preflight.js';
 import { logMissingContentSystemId } from './bootstrap-preflight.js';
 import { getDevCookieNames } from './dev-cookie-names.js';
+/**
+ * Worker-trusted marker injected by Figma's sites-worker after it validates the
+ * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
+ * `jobs.access.run` below honors this marker so Sinatra (async-job-workflow)
+ * can drive job runs without the bypass secret ever reaching tenant code.
+ *
+ * KEEP_IN_SYNC(cloudflare/wrangler/sites-worker/src/auth.ts): FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER
+ */ export const FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER = 'figma-internal-forwarded-has-auth-bypass';
 /**
  * Fields added to users collection for Figma profile info
  */ const figmaUserFields = [
@@ -243,6 +251,7 @@ export async function buildFigmaConfig(config) {
             url
         });
     }
+    const userJobsAccessRun = config.jobs?.access?.run;
     // Build complete config with Figma platform defaults
     const configWithFigmaDefaults = {
         ...config,
@@ -267,6 +276,25 @@ export async function buildFigmaConfig(config) {
             health,
             schema
         ],
+        // Gate /api/payload-jobs/run and /api/payload-jobs/handle-schedules. Honor the
+        // sites-worker trust marker so Figma infra job runs never break, defer to the
+        // tenant's jobs.access.run if they set one, otherwise fall back to Payload's
+        // "logged-in user" default so the admin "Run jobs" UI keeps working.
+        jobs: {
+            ...config.jobs ?? {},
+            access: {
+                ...config.jobs?.access ?? {},
+                run: (args)=>{
+                    if (args.req.headers.get(FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER) === '1') {
+                        return true;
+                    }
+                    if (userJobsAccessRun) {
+                        return userJobsAccessRun(args);
+                    }
+                    return !!args.req.user;
+                }
+            }
+        },
         ...isProduction && !config.logger ? {
             logger: {
                 options: {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.0.1-alpha.67",
+  "version": "0.0.1-alpha.68",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {