@payloadcms/figma 0.0.1-alpha.7 → 0.0.1-alpha.70

package/dist/plugin/build-config.js

@@ -1,26 +1,319 @@
+import { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage';
+import { initClientUploads } from '@payloadcms/plugin-cloud-storage/utilities';
 import { lexicalEditor } from '@payloadcms/richtext-lexical';
 import { buildConfig as payloadBuildConfig } from 'payload';
+import { getBootstrapInfo } from '../api/control-plane.js';
+import { getValidCredential } from '../auth/oauth-flow.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { getEnvConfig } from '../constants.js';
+import { contentAPIAdapter } from '../db-content-api/index.js';
+import { scheduleExtractPlugin } from '../deploy/schedule-extract-plugin.js';
+import { health } from '../endpoints/health.js';
+import { schema } from '../endpoints/schema.js';
 import { oAuth2Plugin } from '../oauth/index.js';
-import { figmaContentSystem } from './adapter.js';
+import { createStorageClient } from '../storage-content-api/client.js';
+import { getGenerateSignedURLHandler } from '../storage-content-api/client-uploads/generateSignedURL.js';
+import { contentApiStorageAdapter } from '../storage-content-api/index.js';
+import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
+import { getEnvVarSync } from '../utils/env-management.js';
+import * as log from '../utils/log.js';
+import { logMissingCliAuth } from './auth-preflight.js';
+import { logMissingContentSystemId } from './bootstrap-preflight.js';
+import { getDevCookieNames } from './dev-cookie-names.js';
 /**
- * Figma platform wrapper for Payload's buildConfig.
- * Automatically injects:
- * - Figma database adapter
- * - Secret (platform-provided)
- * - Default lexicalEditor (if no custom editor specified)
+ * Worker-trusted marker injected by Figma's sites-worker after it validates the
+ * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
+ * `jobs.access.run` below honors this marker so Sinatra (async-job-workflow)
+ * can drive job runs without the bypass secret ever reaching tenant code.
  *
- * @param config - Payload configuration (db and secret omitted, editor optional)
- * @returns Promise<SanitizedConfig> - Built Payload configuration
- */ export async function buildConfig(config) {
+ * KEEP_IN_SYNC(cloudflare/wrangler/sites-worker/src/auth.ts): FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER
+ */ export const FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER = 'figma-internal-forwarded-has-auth-bypass';
+/**
+ * Fields added to users collection for Figma profile info
+ */ const figmaUserFields = [
+    {
+        name: 'figmaHandle',
+        type: 'text',
+        admin: {
+            readOnly: true
+        },
+        label: 'Name'
+    },
+    {
+        name: 'figmaImageUrl',
+        type: 'text',
+        admin: {
+            components: {
+                Cell: '@payloadcms/figma/client#FigmaAvatarCell'
+            },
+            disableBulkEdit: true,
+            hidden: true,
+            readOnly: true
+        },
+        label: 'Profile Picture'
+    }
+];
+function missingOAuthCredential(name) {
+    log.warning(`${name} could not be resolved. OAuth login will not work until this is configured. ` + 'Run `npx @payloadcms/figma init` to set up your project.');
+    return '';
+}
+/**
+ * Fetch bootstrap data from the API and cache all environments locally.
+ * Returns the requested environment's data, or a typed failure reason.
+ */ async function resolveAndCacheBootstrap(store, projectId, environmentName) {
+    let credential;
+    try {
+        credential = await getValidCredential(store);
+    } catch (error) {
+        return {
+            ok: false,
+            reason: {
+                kind: 'network',
+                message: messageOf(error)
+            }
+        };
+    }
+    if (!credential) {
+        return {
+            ok: false,
+            reason: {
+                kind: 'unauthenticated'
+            }
+        };
+    }
+    try {
+        const bootstrapInfo = await getBootstrapInfo(credential, projectId);
+        cacheAllEnvironments(store, projectId, bootstrapInfo);
+    } catch (error) {
+        return {
+            ok: false,
+            reason: {
+                kind: 'network',
+                message: messageOf(error)
+            }
+        };
+    }
+    const data = store.getBootstrapData(projectId, environmentName);
+    if (!data) {
+        return {
+            ok: false,
+            reason: {
+                environmentName,
+                kind: 'environment-not-found',
+                projectId
+            }
+        };
+    }
+    return {
+        data,
+        ok: true
+    };
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : 'Unknown error';
+}
+/**
+ * Creates storage configuration for upload collections
+ */ function createStorageConfig(url, contentSystemId) {
+    const storageConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
+        baseUrl: url,
+        contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
+    } : process.env.FIGMA_DEV_JWT === 'true' ? {
+        auth: {
+            mode: 'devJwt'
+        },
+        baseUrl: url,
+        contentSystemId
+    } : {
+        auth: {
+            mode: 'tokenStore',
+            tokenStore: getTokenStore()
+        },
+        baseUrl: url,
+        contentSystemId
+    };
+    const adapter = contentApiStorageAdapter(storageConfig);
+    const storageClient = createStorageClient(storageConfig);
+    return {
+        adapter,
+        storageClient
+    };
+}
+/**
+ * Plugin that applies cloud storage configuration to all upload-enabled collections.
+ * Runs at the end of the plugin chain so it sees collections added by user plugins too.
+ */ function createStoragePlugin(url, contentSystemId) {
+    return (incomingConfig)=>{
+        const uploadCollections = (incomingConfig.collections || []).filter((c)=>c.upload);
+        if (uploadCollections.length === 0) {
+            return incomingConfig;
+        }
+        const { adapter, storageClient } = createStorageConfig(url, contentSystemId);
+        const collectionsMap = uploadCollections.reduce((acc, c)=>{
+            acc[c.slug] = {
+                adapter,
+                disableLocalStorage: true
+            };
+            return acc;
+        }, {});
+        initClientUploads({
+            clientHandler: '@payloadcms/figma/client#ContentApiClientUploadHandler',
+            collections: collectionsMap,
+            config: incomingConfig,
+            enabled: true,
+            serverHandler: getGenerateSignedURLHandler({
+                client: storageClient
+            }),
+            serverHandlerPath: '/content-api-storage-signed-url'
+        });
+        const storagePlugin = cloudStoragePlugin({
+            collections: collectionsMap
+        });
+        return storagePlugin(incomingConfig);
+    };
+}
+export async function buildFigmaConfig(config) {
+    const envConfig = getEnvConfig();
+    // Resolve contentSystemId: config first, env var, then local store fallback (dev)
+    let { contentSystemId } = config.figma;
+    contentSystemId ??= process.env.FIGMA_CONTENT_API_CONTENT_SYSTEM_ID;
+    let bootstrapData = null;
+    let bootstrapReason = null;
+    // Local dev: resolve from project ID + bootstrap cache
+    // Use getEnvVarSync fallback because Next.js evaluates config before dotenv populates process.env
+    if (!contentSystemId) {
+        const projectId = process.env.FIGMA_PROJECT_ID ?? getEnvVarSync(process.cwd(), 'FIGMA_PROJECT_ID');
+        const environmentName = process.env.FIGMA_ENVIRONMENT_NAME ?? getEnvVarSync(process.cwd(), 'FIGMA_ENVIRONMENT_NAME');
+        if (!projectId || !environmentName) {
+            bootstrapReason = {
+                kind: 'no-config'
+            };
+        } else {
+            const store = getTokenStore();
+            bootstrapData = store.getBootstrapData(projectId, environmentName);
+            // Runtime fallback: fetch from API if not cached (e.g. environment switch without re-init)
+            if (!bootstrapData) {
+                const resolution = await resolveAndCacheBootstrap(store, projectId, environmentName);
+                if (resolution.ok) {
+                    bootstrapData = resolution.data;
+                } else {
+                    bootstrapReason = resolution.reason;
+                }
+            }
+            if (bootstrapData) {
+                contentSystemId = bootstrapData.contentSystemId;
+            }
+        }
+    }
+    if (!contentSystemId) {
+        logMissingContentSystemId(bootstrapReason ?? {
+            kind: 'no-config'
+        });
+        throw new Error('Content System ID could not be resolved. ' + 'Run `npx @payloadcms/figma init` to set up your project.');
+    }
+    const url = process.env.FIGMA_CONTENT_API_URL || envConfig.contentApiUrl;
+    const isProduction = process.env.NODE_ENV === 'production';
+    // The deployed Lambda runs all queued jobs; locally there is no runner, so the db adapter logs
+    // a heads-up whenever a job is queued. Deployed environments set DISABLE_LOCAL_JOB_QUEUE_NOTIFICATIONS=true
+    // (injected by the control plane); end-users can also set it locally to silence the notice.
+    const notifyLocalJobQueue = process.env.DISABLE_LOCAL_JOB_QUEUE_NOTIFICATIONS !== 'true';
+    const usesTokenStoreAuth = !process.env.FIGMA_CONTENT_API_ACCESS_KEY && process.env.FIGMA_DEV_JWT !== 'true';
+    if (usesTokenStoreAuth) {
+        logMissingCliAuth(getTokenStore());
+    }
+    // Determine database adapter based on environment
+    let db;
+    if (config.figma.useContentSystem === false) {
+        db = config.db;
+    } else if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
+        db = contentAPIAdapter({
+            auth: {
+                apiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY,
+                mode: 'apiKey'
+            },
+            contentSystemId,
+            environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
+            url
+        });
+    } else if (process.env.FIGMA_DEV_JWT === 'true') {
+        db = contentAPIAdapter({
+            auth: {
+                mode: 'devJwt'
+            },
+            contentSystemId,
+            environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
+            url
+        });
+    } else {
+        db = contentAPIAdapter({
+            auth: {
+                mode: 'tokenStore',
+                tokenStore: getTokenStore()
+            },
+            contentSystemId,
+            environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
+            url
+        });
+    }
+    const userJobsAccessRun = config.jobs?.access?.run;
     // Build complete config with Figma platform defaults
     const configWithFigmaDefaults = {
         ...config,
-        db: config.figma.useContentSystem ? figmaContentSystem() : config.db,
+        admin: {
+            // Auto-refresh tokens before expiry to prevent unexpected logouts.
+            autoRefresh: true,
+            avatar: {
+                Component: '@payloadcms/figma/client#FigmaAvatar'
+            },
+            ...config.admin
+        },
+        custom: {
+            figma: {
+                ...config.figma,
+                contentSystemId
+            }
+        },
+        db,
         editor: config.editor ?? lexicalEditor(),
+        endpoints: [
+            ...config.endpoints ?? [],
+            health,
+            schema
+        ],
+        // Gate /api/payload-jobs/run and /api/payload-jobs/handle-schedules. Honor the
+        // sites-worker trust marker so Figma infra job runs never break, defer to the
+        // tenant's jobs.access.run if they set one, otherwise fall back to Payload's
+        // "logged-in user" default so the admin "Run jobs" UI keeps working.
+        jobs: {
+            ...config.jobs ?? {},
+            access: {
+                ...config.jobs?.access ?? {},
+                run: (args)=>{
+                    if (args.req.headers.get(FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER) === '1') {
+                        return true;
+                    }
+                    if (userJobsAccessRun) {
+                        return userJobsAccessRun(args);
+                    }
+                    return !!args.req.user;
+                }
+            }
+        },
+        ...isProduction && !config.logger ? {
+            logger: {
+                options: {}
+            }
+        } : {},
         secret: 'MY_SECRET',
         // Add oauth to plugins if not already present
         plugins: [
             ...config.plugins ?? [],
+            ...config.figma.storage !== false ? [
+                createStoragePlugin(url, contentSystemId)
+            ] : [],
             oAuth2Plugin({
                 collections: [
                     {
@@ -30,9 +323,9 @@ import { figmaContentSystem } from './adapter.js';
                             response_mode: 'query',
                             response_type: 'code'
                         },
-                        clientID: process.env.FIGMA_OAUTH_CLIENT_ID,
-                        clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,
-                        identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',
+                        clientID: process.env.FIGMA_OAUTH_CLIENT_ID ?? bootstrapData?.oauthClientId ?? missingOAuthCredential('FIGMA_OAUTH_CLIENT_ID'),
+                        clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET ?? bootstrapData?.oauthClientSecret,
+                        identityMetadata: envConfig.identityMetadata,
                         scope: [
                             'current_user:read'
                         ],
@@ -40,12 +333,29 @@ import { figmaContentSystem } from './adapter.js';
                         usernameField: 'email'
                     }
                 ],
-                debug: true,
-                disabled: false,
-                redirectServerURL: 'http://localhost:3000'
-            })
+                ...isProduction ? {} : getDevCookieNames(contentSystemId),
+                debug: !!process.env.DEBUG,
+                disabled: false
+            }),
+            scheduleExtractPlugin()
         ]
     };
+    // Inject figma fields into users collection
+    const collections = configWithFigmaDefaults.collections?.map((col)=>{
+        if (col.slug === 'users') {
+            return {
+                ...col,
+                fields: [
+                    ...col.fields || [],
+                    ...figmaUserFields
+                ]
+            };
+        }
+        return col;
+    });
+    if (collections) {
+        configWithFigmaDefaults.collections = collections;
+    }
     // Delegate to Payload's buildConfig
     return await payloadBuildConfig(configWithFigmaDefaults);
 }

package/dist/plugin/dev-cookie-names.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Namespace OAuth cookies per-app in local dev so multiple Payload apps
+ * running on localhost (shared cookie jar across ports) don't clobber each
+ * other's sessions on logout. Uses projectId so the cookie stays stable when
+ * switching environments in the same checkout; falls back to contentSystemId
+ * when projectId isn't in `.env`.
+ *
+ * In production, cookies are isolated by unique hostnames and this is unused.
+ */
+export declare function getDevCookieNames(contentSystemId: string): {
+    cookieName: string;
+    userInfoCookieName: string;
+};
+//# sourceMappingURL=dev-cookie-names.d.ts.map

package/dist/plugin/dev-cookie-names.js

@@ -0,0 +1,19 @@
+import { getEnvVarSync } from '../utils/env-management.js';
+/**
+ * Namespace OAuth cookies per-app in local dev so multiple Payload apps
+ * running on localhost (shared cookie jar across ports) don't clobber each
+ * other's sessions on logout. Uses projectId so the cookie stays stable when
+ * switching environments in the same checkout; falls back to contentSystemId
+ * when projectId isn't in `.env`.
+ *
+ * In production, cookies are isolated by unique hostnames and this is unused.
+ */ export function getDevCookieNames(contentSystemId) {
+    const projectId = process.env.FIGMA_PROJECT_ID ?? getEnvVarSync(process.cwd(), 'FIGMA_PROJECT_ID') ?? contentSystemId;
+    const suffix = projectId.slice(0, 8);
+    return {
+        cookieName: `figma-${suffix}-oauth-token`,
+        userInfoCookieName: `figma-${suffix}-user-info`
+    };
+}
+
+//# sourceMappingURL=dev-cookie-names.js.map

package/dist/storage-content-api/api-types.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Upload API types extracted from Content API OpenAPI spec.
+ * These are kept separate to avoid breaking changes when the main spec is regenerated.
+ */
+export type UploadPaths = {
+    '/api/v0/uploads/{collectionId}/{filename}': {
+        delete: {
+            parameters: {
+                path: {
+                    collectionId: string;
+                    filename: string;
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            success: true;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/download/sign': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        expiresIn: number;
+                        filename: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            url: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/multipart/abort': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        filename: string;
+                        uploadId: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            success: true;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/multipart/complete': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        filename: string;
+                        parts: Array<{
+                            ETag: string;
+                            PartNumber: number;
+                        }>;
+                        uploadId: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            success: true;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/multipart/initiate': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        contentType: string;
+                        filename: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            uploadId: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/multipart/parts': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        expiresIn: number;
+                        filename: string;
+                        partNumbers: number[];
+                        uploadId: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            parts: Array<{
+                                partNumber: number;
+                                url: string;
+                            }>;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/sign': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        contentType?: string;
+                        expiresIn: number;
+                        filename: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            url: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=api-types.d.ts.map

package/dist/storage-content-api/api-types.js

@@ -0,0 +1,6 @@
+/**
+ * Upload API types extracted from Content API OpenAPI spec.
+ * These are kept separate to avoid breaking changes when the main spec is regenerated.
+ */ export { };
+
+//# sourceMappingURL=api-types.js.map

package/dist/storage-content-api/client-uploads/ClientUploadHandler.d.ts

@@ -0,0 +1,9 @@
+export declare const ContentApiClientUploadHandler: ({ children, collectionSlug, enabled, extra, prefix, serverHandlerPath, }: {
+    children: import("react").ReactNode;
+    collectionSlug: import("payload").UploadCollectionSlug;
+    enabled?: boolean;
+    extra: Record<string, unknown>;
+    prefix?: string;
+    serverHandlerPath: `/${string}`;
+}) => import("react").JSX.Element;
+//# sourceMappingURL=ClientUploadHandler.d.ts.map

package/dist/storage-content-api/client-uploads/ClientUploadHandler.js

@@ -0,0 +1,43 @@
+'use client';
+import { createClientUploadHandler } from '@payloadcms/plugin-cloud-storage/client';
+export const ContentApiClientUploadHandler = createClientUploadHandler({
+    handler: async ({ apiRoute, collectionSlug, file, prefix, serverHandlerPath, serverURL })=>{
+        // Build endpoint URL: serverURL + apiRoute + serverHandlerPath
+        const endpointRoute = `${serverURL}${apiRoute}${serverHandlerPath}`;
+        const response = await fetch(endpointRoute, {
+            body: JSON.stringify({
+                collectionSlug,
+                filename: file.name,
+                mimeType: file.type
+            }),
+            credentials: 'include',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            method: 'POST'
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to get presigned URL: ${response.status} ${response.statusText}`);
+        }
+        const { filename: safeFilename, url } = await response.json();
+        const uploadFilename = safeFilename || file.name;
+        const uploadResponse = await fetch(url, {
+            body: file,
+            headers: {
+                'Content-Type': file.type
+            },
+            method: 'PUT'
+        });
+        if (!uploadResponse.ok) {
+            throw new Error(`Failed to upload to S3: ${uploadResponse.status} ${uploadResponse.statusText}`);
+        }
+        return {
+            clientUploaded: true,
+            filename: uploadFilename,
+            mimeType: file.type,
+            prefix
+        };
+    }
+});
+
+//# sourceMappingURL=ClientUploadHandler.js.map

package/dist/storage-content-api/client-uploads/generateSignedURL.d.ts

@@ -0,0 +1,13 @@
+import type { PayloadHandler } from 'payload';
+import type { StorageClient } from '../client.js';
+type ClientUploadsAccess = (args: {
+    collectionSlug: string;
+    req: Parameters<PayloadHandler>[0];
+}) => boolean | Promise<boolean>;
+type Args = {
+    access?: ClientUploadsAccess;
+    client: StorageClient;
+};
+export declare const getGenerateSignedURLHandler: ({ access, client, }: Args) => PayloadHandler;
+export {};
+//# sourceMappingURL=generateSignedURL.d.ts.map