@payloadcms/figma 0.0.1-alpha.67 → 0.0.1-alpha.69

package/dist/db-content-api/index.d.ts

@@ -1,4 +1,4 @@
-import type { BaseDatabaseAdapter, DatabaseAdapterObj } from 'payload';
+import type { BaseDatabaseAdapter, CreateArgs, DatabaseAdapterObj } from 'payload';
 import createClient from 'openapi-fetch';
 import type { paths } from './generated/content-api-types.js';
 import { type AuthMode } from './utilities/auth.js';
@@ -7,8 +7,21 @@ type ContentAPIOptions = {
     auth: AuthMode;
     contentSystemId: string;
     environmentName?: string;
+    notifyLocalJobQueue: boolean;
     url: string;
 };
+/**
+ * Heads-up logged locally whenever a job is queued. Queued jobs are executed by Figma's deployed runner, so
+ * if a deployed environment exists its runner can pick up anything in the queue. The developer
+ * needs to know that a job they just created locally may run on their deployed app instead of their machine.
+ */
+export declare const LOCAL_JOB_QUEUE_NOTICE: string;
+/**
+ * Logs {@link LOCAL_JOB_QUEUE_NOTICE} for every job queued locally: if a deployed
+ * environment exists, its runner can pick up anything in the queue. No-op when
+ * `notifyLocalJobQueue` is false (i.e. not a local runtime).
+ */
+export declare function maybeNotifyLocalJobQueue(adapter: ContentAPIAdapter, args: CreateArgs): void;
 export type ContentAPIAdapter = {
     auth: AuthMode;
     clearDatabase: () => Promise<void>;
@@ -16,6 +29,7 @@ export type ContentAPIAdapter = {
     contentSystemId: string;
     environmentName?: string;
     idType: 'uuid';
+    notifyLocalJobQueue: boolean;
     url: string;
 } & BaseDatabaseAdapter;
 export declare const contentAPIAdapter: (opts: ContentAPIOptions) => DatabaseAdapterObj;

package/dist/db-content-api/index.js

@@ -14,6 +14,24 @@ import { addFallbackLocale } from './utilities/locale/index.js';
 import { buildMeta } from './utilities/meta/buildMeta.js';
 import { normalizeLocaleInWhere } from './utilities/meta/normalizeLocaleInWhere.js';
 import { convertPayloadWhereToContentAPI } from './utilities/where.js';
+/**
+ * Heads-up logged locally whenever a job is queued. Queued jobs are executed by Figma's deployed runner, so
+ * if a deployed environment exists its runner can pick up anything in the queue. The developer
+ * needs to know that a job they just created locally may run on their deployed app instead of their machine.
+ */ export const LOCAL_JOB_QUEUE_NOTICE = "A job was queued locally. Queued jobs may be run by Figma's deployed runner, not your local " + 'dev server. If this app has a deployed environment, your deployed app may pick this ' + 'job up and run it against deployed code. If this app has no deployed ' + 'environment, the job will not run automatically. To test job logic against your local ' + 'code, call the function your task runs directly instead of queueing a job. ';
+/**
+ * Logs {@link LOCAL_JOB_QUEUE_NOTICE} for every job queued locally: if a deployed
+ * environment exists, its runner can pick up anything in the queue. No-op when
+ * `notifyLocalJobQueue` is false (i.e. not a local runtime).
+ */ export function maybeNotifyLocalJobQueue(adapter, args) {
+    if (!adapter.notifyLocalJobQueue) {
+        return;
+    }
+    if (args.collection !== 'payload-jobs') {
+        return;
+    }
+    adapter.payload.logger.warn(LOCAL_JOB_QUEUE_NOTICE);
+}
 async function syncCollections() {
     let existingIds;
     try {
@@ -544,6 +562,7 @@ async function create(args) {
     if (!response) {
         throw new Error('No response from create');
     }
+    maybeNotifyLocalJobQueue(this, args);
     return unwrapDocument({
         collectionSlug: args.collection,
         doc: response.result,
@@ -878,6 +897,7 @@ export const contentAPIAdapter = (opts)=>({
                 findVersions: findVersions,
                 idType: 'uuid',
                 init,
+                notifyLocalJobQueue: opts.notifyLocalJobQueue,
                 packageName: '@payloadcms/db-content-api',
                 payload,
                 queryDrafts: queryDrafts,

package/dist/oauth/components/LoginButton/iframeAutoLogin.d.ts

@@ -9,15 +9,30 @@ export interface CmsOAuthCodeMessage {
  * value the iframe sent on its outbound `mint-cms-oauth-code` request.
  */
 export declare const parseCmsOAuthCodeMessage: (data: unknown) => CmsOAuthCodeMessage | null;
+export interface ParentOriginSignals {
+    /**
+     * `ancestorOrigins[0]`: immediate embedder origin. `undefined` where the
+     * browser lacks `Location.ancestorOrigins`.
+     */
+    ancestorOrigin: null | string | undefined;
+    /** `window.location.origin` — this iframe's own origin. */
+    ownOrigin: null | string | undefined;
+    /** `document.referrer`. */
+    referrer: null | string | undefined;
+}
 /**
- * Derive a tight `targetOrigin` for `window.parent.postMessage` from the
- * iframe's `document.referrer`. If the referrer is a Figma origin we return
- * it verbatim; otherwise (stripped by Referrer-Policy, malformed, or hostile)
- * we fall back to '*'. The outbound payload contains the server-signed
- * `state` from /meta — no secrets to leak — so '*' is acceptable; the
- * inbound origin check is the load-bearing security control.
+ * Resolve the exact origin for `window.parent.postMessage`, or `null` if we
+ * can't establish a trusted embedder (caller must then NOT post). We never
+ * target `'*'`: the payload embeds PKCE material in `state`.
+ *
+ *  1. `ancestorOrigin` present (browser-set, unspoofable): trust iff Figma,
+ *     else `null` — no fall-through to weaker signals.
+ *  2. No `ancestorOrigins`: fall back to `referrer`, but only if
+ *     it's a Figma origin and not our own. (Payload's `/admin` -> `/admin/login`
+ *     307 leaves `referrer` as our own origin, never the embedder.)
+ *  3. Otherwise `null`.
  */
-export declare const pickParentTargetOrigin: (referrer: null | string | undefined) => string;
+export declare const resolveParentTargetOrigin: ({ ancestorOrigin, ownOrigin, referrer, }: ParentOriginSignals) => null | string;
 export interface IframeAutoLoginDeps {
     doFetch: typeof fetch;
     /**
@@ -36,7 +51,11 @@ export interface IframeAutoLoginDeps {
      * the host is expected to apply its own timeout.
      */
     onFailed?: () => void;
-    parentReferrer: null | string | undefined;
+    /**
+     * Exact origin for `postMessage`, from `resolveParentTargetOrigin`. `null`
+     * means no trusted embedder: don't post, trigger `onFailed`. Never `'*'`.
+     */
+    parentTargetOrigin: null | string;
     postMessageToParent: (message: unknown, targetOrigin: string) => void;
     win: Pick<Window, 'addEventListener' | 'removeEventListener'>;
 }

package/dist/oauth/components/LoginButton/iframeAutoLogin.js

@@ -24,22 +24,31 @@ import { isFigmaOrigin } from '../../utilities/figmaHostnames.js';
     };
 };
 /**
- * Derive a tight `targetOrigin` for `window.parent.postMessage` from the
- * iframe's `document.referrer`. If the referrer is a Figma origin we return
- * it verbatim; otherwise (stripped by Referrer-Policy, malformed, or hostile)
- * we fall back to '*'. The outbound payload contains the server-signed
- * `state` from /meta — no secrets to leak — so '*' is acceptable; the
- * inbound origin check is the load-bearing security control.
- */ export const pickParentTargetOrigin = (referrer)=>{
-    if (!referrer) {
-        return '*';
+ * Resolve the exact origin for `window.parent.postMessage`, or `null` if we
+ * can't establish a trusted embedder (caller must then NOT post). We never
+ * target `'*'`: the payload embeds PKCE material in `state`.
+ *
+ *  1. `ancestorOrigin` present (browser-set, unspoofable): trust iff Figma,
+ *     else `null` — no fall-through to weaker signals.
+ *  2. No `ancestorOrigins`: fall back to `referrer`, but only if
+ *     it's a Figma origin and not our own. (Payload's `/admin` -> `/admin/login`
+ *     307 leaves `referrer` as our own origin, never the embedder.)
+ *  3. Otherwise `null`.
+ */ export const resolveParentTargetOrigin = ({ ancestorOrigin, ownOrigin, referrer })=>{
+    if (ancestorOrigin != null) {
+        return isFigmaOrigin(ancestorOrigin) ? ancestorOrigin : null;
     }
-    try {
-        const candidate = new URL(referrer).origin;
-        return isFigmaOrigin(candidate) ? candidate : '*';
-    } catch  {
-        return '*';
+    if (referrer) {
+        try {
+            const candidate = new URL(referrer).origin;
+            if (candidate !== ownOrigin && isFigmaOrigin(candidate)) {
+                return candidate;
+            }
+        } catch  {
+        // unparseable referrer — fall through
+        }
     }
+    return null;
 };
 /**
  * Wire up the iframe auto-login flow:
@@ -122,6 +131,14 @@ import { isFigmaOrigin } from '../../utilities/figmaHostnames.js';
             if (abortController.signal.aborted) {
                 return;
             }
+            // No trusted embedder origin: refuse to post (don't broadcast PKCE-bearing
+            // `state` to '*'). See `resolveParentTargetOrigin`.
+            if (deps.parentTargetOrigin === null) {
+                // eslint-disable-next-line no-console -- surface auto-login failures to dev tools
+                console.warn('[payload iframe auto-login] could not determine a trusted parent origin — falling back to manual login');
+                deps.onFailed?.();
+                return;
+            }
             flow = {
                 redirectUri: redirect,
                 state
@@ -134,7 +151,7 @@ import { isFigmaOrigin } from '../../utilities/figmaHostnames.js';
                 redirect_uri: redirect,
                 scope,
                 state
-            }, pickParentTargetOrigin(deps.parentReferrer));
+            }, deps.parentTargetOrigin);
         } catch (err) {
             if (abortController.signal.aborted) {
                 return;

package/dist/oauth/components/LoginButton/index.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useConfig } from '@payloadcms/ui';
 import { useSearchParams } from 'next/navigation.js';
 import React, { useEffect, useState } from 'react';
-import { setupIframeAutoLogin } from './iframeAutoLogin.js';
+import { resolveParentTargetOrigin, setupIframeAutoLogin } from './iframeAutoLogin.js';
 import './index.scss';
 const baseClass = 'oauth-login';
 // Max time we wait for the parent (figma.com) to respond with a code after
@@ -82,6 +82,10 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
             console.warn(`[payload iframe auto-login] parent did not reply with cms-oauth-code within ${AUTO_LOGIN_PARENT_REPLY_TIMEOUT_MS}ms — falling back to manual login`);
             setAutoLoginFailed(true);
         }, AUTO_LOGIN_PARENT_REPLY_TIMEOUT_MS);
+        // ancestorOrigins[0] is the immediate embedder's origin (browser-set,
+        // unspoofable) where supported; undefined on browsers that don't implement
+        // the non-standard Location.ancestorOrigins (older Firefox, pre-148).
+        const ancestorOrigins = window.location.ancestorOrigins;
         const cleanup = setupIframeAutoLogin({
             doFetch: window.fetch.bind(window),
             metaUrl: `${serverURL}${api}/${userSlug}/${endpointSlug}/meta?serverURL=${window.location.origin}`,
@@ -89,7 +93,11 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
                 window.location.href = url;
             },
             onFailed: ()=>setAutoLoginFailed(true),
-            parentReferrer: document.referrer,
+            parentTargetOrigin: resolveParentTargetOrigin({
+                ancestorOrigin: ancestorOrigins?.[0],
+                ownOrigin: window.location.origin,
+                referrer: document.referrer
+            }),
             postMessageToParent: (msg, target)=>window.parent.postMessage(msg, target),
             win: window
         });

package/dist/plugin/build-config.d.ts

@@ -1,4 +1,13 @@
 import type { Config, SanitizedConfig } from 'payload';
+/**
+ * Worker-trusted marker injected by Figma's sites-worker after it validates the
+ * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
+ * `jobs.access.run` below honors this marker so Sinatra (async-job-workflow)
+ * can drive job runs without the bypass secret ever reaching tenant code.
+ *
+ * KEEP_IN_SYNC(cloudflare/wrangler/sites-worker/src/auth.ts): FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER
+ */
+export declare const FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER = "figma-internal-forwarded-has-auth-bypass";
 /**
  * Configuration type for Payload projects on the Figma platform.
  *

package/dist/plugin/build-config.js

@@ -20,6 +20,14 @@ import * as log from '../utils/log.js';
 import { logMissingCliAuth } from './auth-preflight.js';
 import { logMissingContentSystemId } from './bootstrap-preflight.js';
 import { getDevCookieNames } from './dev-cookie-names.js';
+/**
+ * Worker-trusted marker injected by Figma's sites-worker after it validates the
+ * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
+ * `jobs.access.run` below honors this marker so Sinatra (async-job-workflow)
+ * can drive job runs without the bypass secret ever reaching tenant code.
+ *
+ * KEEP_IN_SYNC(cloudflare/wrangler/sites-worker/src/auth.ts): FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER
+ */ export const FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER = 'figma-internal-forwarded-has-auth-bypass';
 /**
  * Fields added to users collection for Figma profile info
  */ const figmaUserFields = [
@@ -205,6 +213,10 @@ export async function buildFigmaConfig(config) {
     }
     const url = process.env.FIGMA_CONTENT_API_URL || envConfig.contentApiUrl;
     const isProduction = process.env.NODE_ENV === 'production';
+    // The deployed Lambda runs all queued jobs; locally there is no runner, so the db adapter logs
+    // a heads-up whenever a job is queued. Deployed environments set DISABLE_LOCAL_JOB_QUEUE_NOTIFICATIONS=true
+    // (injected by the control plane); end-users can also set it locally to silence the notice.
+    const notifyLocalJobQueue = process.env.DISABLE_LOCAL_JOB_QUEUE_NOTIFICATIONS !== 'true';
     const usesTokenStoreAuth = !process.env.FIGMA_CONTENT_API_ACCESS_KEY && process.env.FIGMA_DEV_JWT !== 'true';
     if (usesTokenStoreAuth) {
         logMissingCliAuth(getTokenStore());
@@ -221,6 +233,7 @@ export async function buildFigmaConfig(config) {
             },
             contentSystemId,
             environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
             url
         });
     } else if (process.env.FIGMA_DEV_JWT === 'true') {
@@ -230,6 +243,7 @@ export async function buildFigmaConfig(config) {
             },
             contentSystemId,
             environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
             url
         });
     } else {
@@ -240,9 +254,11 @@ export async function buildFigmaConfig(config) {
             },
             contentSystemId,
             environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
             url
         });
     }
+    const userJobsAccessRun = config.jobs?.access?.run;
     // Build complete config with Figma platform defaults
     const configWithFigmaDefaults = {
         ...config,
@@ -267,6 +283,25 @@ export async function buildFigmaConfig(config) {
             health,
             schema
         ],
+        // Gate /api/payload-jobs/run and /api/payload-jobs/handle-schedules. Honor the
+        // sites-worker trust marker so Figma infra job runs never break, defer to the
+        // tenant's jobs.access.run if they set one, otherwise fall back to Payload's
+        // "logged-in user" default so the admin "Run jobs" UI keeps working.
+        jobs: {
+            ...config.jobs ?? {},
+            access: {
+                ...config.jobs?.access ?? {},
+                run: (args)=>{
+                    if (args.req.headers.get(FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER) === '1') {
+                        return true;
+                    }
+                    if (userJobsAccessRun) {
+                        return userJobsAccessRun(args);
+                    }
+                    return !!args.req.user;
+                }
+            }
+        },
         ...isProduction && !config.logger ? {
             logger: {
                 options: {}

package/dist/storage-content-api/client-uploads/ClientUploadHandler.js

@@ -34,6 +34,7 @@ export const ContentApiClientUploadHandler = createClientUploadHandler({
         return {
             clientUploaded: true,
             filename: uploadFilename,
+            mimeType: file.type,
             prefix
         };
     }

package/dist/storage-content-api/handleUpload.js

@@ -1,16 +1,16 @@
 import fs from 'fs';
 import path from 'path';
+import { parseClientUploadContext } from './utilities/index.js';
 const PART_SIZE = 64 * 1024 * 1024 // 64MB per part
 ;
 const MAX_FILE_SIZE_BEFORE_MULTIPART = 100 * 1024 * 1024 // 100MB
 ;
 export const getHandleUpload = ({ client, collection, prefix = '' })=>{
     return async ({ clientUploadContext, data, file })=>{
-        // Skip if client already uploaded THIS SPECIFIC file
-        // clientUploadContext.filename contains the original filename that was client-uploaded
-        // Resized versions (different filename) should still be uploaded
-        const clientUploadedFilename = clientUploadContext && typeof clientUploadContext === 'object' && 'filename' in clientUploadContext ? clientUploadContext.filename : undefined;
-        const isOriginalClientUploaded = clientUploadContext && typeof clientUploadContext === 'object' && 'clientUploaded' in clientUploadContext && clientUploadContext.clientUploaded && file.filename === clientUploadedFilename;
+        // Skip if the client already uploaded THIS SPECIFIC file. Resized versions
+        // (different filename) should still be uploaded.
+        const context = parseClientUploadContext(clientUploadContext);
+        const isOriginalClientUploaded = context.clientUploaded === true && file.filename === context.filename;
         if (isOriginalClientUploaded) {
             return data;
         }

package/dist/storage-content-api/staticHandler.js

@@ -1,5 +1,7 @@
 import { getFilePrefix } from '@payloadcms/plugin-cloud-storage/utilities';
 import path from 'path';
+import { isImage } from 'payload/shared';
+import { parseClientUploadContext } from './utilities/index.js';
 export const getHandler = ({ client, collection })=>{
     return async (req, { params: { clientUploadContext, filename } })=>{
         try {
@@ -23,6 +25,28 @@ export const getHandler = ({ client, collection })=>{
                     status: 500
                 });
             }
+            // On a client-upload fetch-back, core reads this response body into req.file.data to
+            // size the image; a 302's empty body crashes getImageSize. Return real bytes for
+            // images (and unknown mimetypes, to be safe), but keep the redirect otherwise so we
+            // don't download large non-images server-side.
+            if (clientUploadContext) {
+                const { mimeType } = parseClientUploadContext(clientUploadContext);
+                if (!mimeType || isImage(mimeType)) {
+                    const fileResponse = await fetch(data.url);
+                    if (!fileResponse.ok) {
+                        req.payload.logger.error(`Failed to fetch file for client-upload buffer fetch-back: ${fileResponse.status}`);
+                        return new Response('Internal Server Error', {
+                            status: 500
+                        });
+                    }
+                    const contentType = fileResponse.headers.get('Content-Type') ?? mimeType ?? 'application/octet-stream';
+                    return new Response(await fileResponse.arrayBuffer(), {
+                        headers: {
+                            'Content-Type': contentType
+                        }
+                    });
+                }
+            }
             return Response.redirect(data.url, 302);
         } catch (err) {
             req.payload.logger.error({

package/dist/storage-content-api/utilities/index.d.ts

@@ -1,2 +1,3 @@
 export { getSafeFilename } from './getSafeFilename.js';
+export { type ContentApiClientUploadContext, parseClientUploadContext, } from './parseClientUploadContext.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/storage-content-api/utilities/index.js

@@ -1,3 +1,4 @@
 export { getSafeFilename } from './getSafeFilename.js';
+export { parseClientUploadContext } from './parseClientUploadContext.js';
 
 //# sourceMappingURL=index.js.map

package/dist/storage-content-api/utilities/parseClientUploadContext.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The shape of the `clientUploadContext` produced by this adapter's client upload
+ * handler. The plugin's `StaticHandler`/`HandleUpload` types expose it as `unknown`
+ * (it is deserialized from a JSON form field and is adapter-specific), so it must be
+ * narrowed at runtime before use.
+ */
+export type ContentApiClientUploadContext = {
+    clientUploaded?: boolean;
+    filename?: string;
+    mimeType?: string;
+    prefix?: string;
+};
+/**
+ * Safely narrows an `unknown` clientUploadContext into the adapter's known shape,
+ * keeping only properties that are actually present with the expected type. Returns
+ * an empty object for any non-object input.
+ */
+export declare const parseClientUploadContext: (context: unknown) => ContentApiClientUploadContext;
+//# sourceMappingURL=parseClientUploadContext.d.ts.map

package/dist/storage-content-api/utilities/parseClientUploadContext.js

@@ -0,0 +1,30 @@
+/**
+ * The shape of the `clientUploadContext` produced by this adapter's client upload
+ * handler. The plugin's `StaticHandler`/`HandleUpload` types expose it as `unknown`
+ * (it is deserialized from a JSON form field and is adapter-specific), so it must be
+ * narrowed at runtime before use.
+ */ /**
+ * Safely narrows an `unknown` clientUploadContext into the adapter's known shape,
+ * keeping only properties that are actually present with the expected type. Returns
+ * an empty object for any non-object input.
+ */ export const parseClientUploadContext = (context)=>{
+    if (!context || typeof context !== 'object') {
+        return {};
+    }
+    const result = {};
+    if ('clientUploaded' in context && typeof context.clientUploaded === 'boolean') {
+        result.clientUploaded = context.clientUploaded;
+    }
+    if ('filename' in context && typeof context.filename === 'string') {
+        result.filename = context.filename;
+    }
+    if ('mimeType' in context && typeof context.mimeType === 'string') {
+        result.mimeType = context.mimeType;
+    }
+    if ('prefix' in context && typeof context.prefix === 'string') {
+        result.prefix = context.prefix;
+    }
+    return result;
+};
+
+//# sourceMappingURL=parseClientUploadContext.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.0.1-alpha.67",
+  "version": "0.0.1-alpha.69",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {