@payloadcms/figma 0.0.1-alpha.7 → 0.0.1-alpha.71

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -1,16 +1,15 @@
-import { APIError, generateCookie, parseCookies } from 'payload';
-import { getSafeRedirect } from 'payload/shared';
-import { getProjectToken } from '../../api/figma-api.js';
-import { createCookieOptions } from '../utilities/createCookieOptions.js';
+import { APIError, parseCookies } from 'payload';
+import { formatAdminURL, getSafeRedirect } from 'payload/shared';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { establishSession } from '../utilities/establishSession.js';
+import { exchangeCodeForAccessToken } from '../utilities/exchangeCodeForAccessToken.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
-import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
-const isAbsoluteURL = (url)=>/^[a-z][a-z\d+.-]*:/.test(url);
+import { buildCsrfCookieClearHeader, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
+import { isAbsoluteURL } from '../utilities/isAbsoluteURL.js';
 export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const { config } = req.payload;
-            const adminPath = getAdminPath(config);
+            const adminRoute = config.routes?.admin || '/admin';
             try {
                 await strategy.ensureMeta();
                 const path = req.pathname;
@@ -37,9 +36,26 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                 }
                 const stateRaw = jsonBody.state;
                 const state = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'));
-                const redirectDestination = state.serverURL || pluginOptions.redirectServerURL || config.serverURL;
-                let failedRedirect = `${redirectDestination}${adminPath}/login`;
-                let redirectToUse = `${redirectDestination}${adminPath}`;
+                // Resolve the post-login redirect base. This MUST match the precedence
+                // used when the OAuth `redirect_uri` is minted at `/meta`
+                // (`getAuthorizeURL`: redirectServerURL → config.serverURL →
+                // state.serverURL). `state.serverURL` is the iframe's untrusted
+                // `window.location.origin` (a `/meta` query param), so it must rank
+                // LAST: trusting it first lets the redirect target diverge from the
+                // server-configured origin — in the Make preview that origin is http
+                // (mixed content) and, more visibly, it isn't in Payload's auto-derived
+                // `config.csrf` allowlist (sanitizeConfig pushes `config.serverURL`),
+                // so the CSRF origin check below 403s the callback.
+                const redirectServerURL = pluginOptions.redirectServerURL || config.serverURL || state.serverURL;
+                let failedRedirect = formatAdminURL({
+                    adminRoute,
+                    path: '/login',
+                    serverURL: redirectServerURL
+                });
+                let redirectToUse = formatAdminURL({
+                    adminRoute,
+                    serverURL: redirectServerURL
+                });
                 if (state.redirect) {
                     redirectToUse = state.redirect;
                 }
@@ -93,6 +109,16 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     req.payload.logger.error('Signature mismatch. Failing login and redirecting.');
                     return Response.redirect(failedRedirect);
                 }
+                // Verify CSRF cookie matches the nonce baked into state at /meta time.
+                // This is the browser-binding required by RFC 6749 §10.12 — without
+                // it, an attacker who mints (code, state) via /meta + consent could
+                // replay them into a victim's browser by URL.
+                const cookies = parseCookies(req.headers);
+                const cookieCsrf = cookies.get(OAUTH_STATE_CSRF_COOKIE_NAME);
+                if (!cookieCsrf || cookieCsrf !== state.csrf) {
+                    req.payload.logger.error('CSRF cookie mismatch. Failing login and redirecting.');
+                    return Response.redirect(failedRedirect);
+                }
                 if (!strategy.meta?.token_endpoint) {
                     debugLogger.error({
                         msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,
@@ -121,57 +147,27 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                const body = {
-                    client_id: strategy.clientID,
-                    code,
-                    code_verifier: req.payload.decrypt(state.verifier),
-                    grant_type: 'authorization_code',
-                    redirect_uri: `${redirectDestination}${config?.routes?.api || '/api'}/${collection.slug}/${endpointSlug}/login`
-                };
+                const redirectUri = formatAdminURL({
+                    apiRoute: config.routes?.api || '/api',
+                    path: `/${collection.slug}/${endpointSlug}/login`,
+                    serverURL: redirectServerURL
+                });
                 debugLogger.info({
                     msg: 'Exchanging code for access token',
-                    path,
-                    requestBody: body
+                    path
+                });
+                const tokenRes = await exchangeCodeForAccessToken({
+                    code,
+                    codeVerifier: req.payload.decrypt(state.verifier),
+                    redirectUri,
+                    strategy
                 });
-                if (strategy.clientSecret) {
-                    body.client_secret = strategy.clientSecret;
-                }
-                const tokenRes = await fetch(strategy.meta?.token_endpoint, {
-                    body: new URLSearchParams(body),
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    },
-                    method: 'POST'
-                }).then((r)=>r.json());
                 debugLogger.info({
                     msg: 'Token Response',
                     path,
                     tokenRes
                 });
                 const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
-                debugLogger.info({
-                    msg: 'tokenResss',
-                    tokenRes
-                });
-                // Swap for project token
-                const project_token = await getProjectToken(tokenRes.access_token, 'someproject');
-                const refresh_token = access_token;
-                // Store project token as access_token
-                const token = project_token.token;
-                const expiresIn = project_token.expiresAt;
-                if (!token) {
-                    const errMsg = `No ${collectionOptions.token || 'access_token'} was returned from the identity provider.`;
-                    req.payload.logger.error({
-                        msg: errMsg,
-                        path
-                    });
-                    throw new APIError(errMsg);
-                }
-                const cookieOptions = createCookieOptions({
-                    collection,
-                    headers: req.headers,
-                    pluginOptions
-                });
                 if (error) {
                     req.payload.logger.error('Error swapping access code with access token:');
                     req.payload.logger.error({
@@ -180,12 +176,22 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                // get the payloadRedirect cookie value
-                const cookies = parseCookies(req.headers);
-                const payloadRedirect = 'payloadRedirect' in cookies ? cookies.payloadRedirect : '';
+                if (!access_token) {
+                    const errMsg = 'No access_token was returned from the identity provider.';
+                    req.payload.logger.error({
+                        msg: errMsg,
+                        path,
+                        tokenRes
+                    });
+                    throw new APIError(errMsg);
+                }
+                const payloadRedirect = cookies.get('payloadRedirect') ?? '';
                 if (!req.responseHeaders) {
                     req.responseHeaders = new Headers();
                 }
+                // Clear the CSRF cookie now that the flow has completed — the nonce
+                // is single-use; leaving it around lets a replay try again.
+                req.responseHeaders.append('Set-Cookie', buildCsrfCookieClearHeader());
                 if (payloadRedirect) {
                     if (isAbsoluteURL(payloadRedirect)) {
                         redirectToUse = payloadRedirect;
@@ -194,28 +200,17 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     }
                     req.responseHeaders.append('Set-Cookie', `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`);
                 }
-                if (refresh_token && !collectionOptions.usePayloadJWT) {
-                    debugLogger.info('Setting refresh token cookie');
-                    const refreshCookie = generateCookie({
-                        returnCookieAsObject: false,
-                        ...cookieOptions,
-                        name: `${strategy.cookieName}-refresh`,
-                        value: refresh_token,
-                        // Default to 1 year if no expiration
-                        expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952)
-                    });
-                    req.responseHeaders.append('Set-Cookie', refreshCookie);
-                }
-                const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(expiresIn) // Project token uses epoch time
-                ;
-                const tokenCookie = generateCookie({
-                    ...cookieOptions,
-                    name: strategy.cookieName,
-                    expires: tokenExpires,
-                    returnCookieAsObject: false,
-                    value: token
+                await establishSession({
+                    accessToken: access_token,
+                    collection,
+                    collectionOptions,
+                    contentSystemId: config.custom.figma.contentSystemId,
+                    debugLogger,
+                    pluginOptions,
+                    refreshTokenExpiresIn: refreshTokenExpires,
+                    req,
+                    strategy
                 });
-                req.responseHeaders.append('Set-Cookie', tokenCookie);
                 return Response.redirect(redirectToUse);
             } catch (err) {
                 req.payload.logger.error({

package/dist/oauth/endpoints/getLogoutEndpoint.js

@@ -1,9 +1,9 @@
 import jwt from 'jsonwebtoken';
 import { parseCookies } from 'payload';
+import { formatAdminURL } from 'payload/shared';
 import { clearCookie } from '../utilities/clearCookie.js';
 import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
 export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
@@ -23,12 +23,15 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
             }
             try {
                 await strategy.ensureMeta();
-                const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL;
-                let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`;
+                const redirectServerlURL = pluginOptions.redirectServerURL || config.serverURL;
+                let successfulLogoutRedirectDest = formatAdminURL({
+                    adminRoute: config.routes?.admin || '/admin',
+                    serverURL: redirectServerlURL
+                });
                 if (typeof req.query.redirect === 'string') {
                     successfulLogoutRedirectDest = req.query.redirect;
                 }
-                if (!baseRedirectDestination && !req.query.redirect) {
+                if (!redirectServerlURL && !req.query.redirect) {
                     debugLogger.error({
                         msg: 'No redirect URL provided',
                         path: req.pathname

package/dist/oauth/endpoints/getMetaEndpoint.js

@@ -1,10 +1,18 @@
-import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+import { parseCookies } from 'payload';
+import { buildCsrfCookieHeader, getAuthorizeURL, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
-            const authorizeURL = await getAuthorizeURL({
+            // Reuse the CSRF nonce from the existing cookie if one is set. Makes
+            // `/meta` idempotent: a second call from the same browser (Strict Mode
+            // re-mount, retry, multi-tab) returns the SAME state.csrf, so the
+            // cookie never has to change after the first call — no last-write-wins
+            // race between the cookie and the iframe's already-captured state.
+            const existingCsrfNonce = parseCookies(req.headers).get(OAUTH_STATE_CSRF_COOKIE_NAME);
+            const { authorizeURL, csrfNonce, params } = await getAuthorizeURL({
                 collection,
                 collectionOptions,
                 endpointSlug,
+                existingCsrfNonce,
                 failedRedirect: req.query.failedRedirect,
                 payload: req.payload,
                 pluginOptions,
@@ -12,8 +20,15 @@ export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, p
                 serverURLOverride: req.query.serverURL,
                 strategy
             });
+            if (!req.responseHeaders) {
+                req.responseHeaders = new Headers();
+            }
+            // Always re-emit Set-Cookie — when reusing, this just refreshes Max-Age
+            // so long-lived tabs don't expire the cookie mid-consent.
+            req.responseHeaders.append('Set-Cookie', buildCsrfCookieHeader(csrfNonce));
             return Response.json({
-                authorizeURL
+                authorizeURL,
+                params
             }, {
                 status: 200
             });

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.js

@@ -1,10 +1,15 @@
-import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+import { parseCookies } from 'payload';
+import { buildCsrfCookieHeader, getAuthorizeURL, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
-            const authorizeURL = await getAuthorizeURL({
+            // Reuse the CSRF nonce from the existing cookie if one is set. See
+            // getMetaEndpoint.ts for the idempotency rationale.
+            const existingCsrfNonce = parseCookies(req.headers).get(OAUTH_STATE_CSRF_COOKIE_NAME);
+            const { authorizeURL, csrfNonce } = await getAuthorizeURL({
                 collection,
                 collectionOptions,
                 endpointSlug,
+                existingCsrfNonce,
                 failedRedirect: req.query.failedRedirect,
                 payload: req.payload,
                 pluginOptions,
@@ -12,6 +17,10 @@ export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endp
                 serverURLOverride: req.query.serverURL,
                 strategy
             });
+            if (!req.responseHeaders) {
+                req.responseHeaders = new Headers();
+            }
+            req.responseHeaders.append('Set-Cookie', buildCsrfCookieHeader(csrfNonce));
             return Response.redirect(authorizeURL);
         },
         method: 'get',

package/dist/oauth/index.js

@@ -1,3 +1,4 @@
+import { fieldAffectsData } from 'payload/shared';
 import { defaultVerify } from './defaults.js';
 import { getLoginEndpoint } from './endpoints/getLoginEndpoint.js';
 import { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js';
@@ -94,7 +95,12 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                         ...existingCollection.fields,
                         {
                             name: 'email',
-                            type: 'email'
+                            type: 'email',
+                            admin: {
+                                description: 'Managed by Figma',
+                                readOnly: true
+                            },
+                            unique: true
                         }
                     ]
                 };
@@ -102,10 +108,22 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                     collection: collectionWithEmail,
                     collectionOptions
                 });
+                // Make username field readOnly (and add description for email fields)
+                const readOnlyUsernameField = {
+                    ...usernameField,
+                    admin: {
+                        ...usernameField.admin || {},
+                        ...usernameField.name === 'email' ? {
+                            description: 'Managed by Figma'
+                        } : {},
+                        readOnly: true
+                    }
+                };
+                const isUsernameFieldString = typeof adminCollectionOptions.usernameField === 'string';
                 const fields = [
-                    ...collectionWithEmail.fields,
-                    ...typeof adminCollectionOptions.usernameField === 'string' ? [] : [
-                        usernameField
+                    ...collectionWithEmail.fields.map((field)=>fieldAffectsData(field) && field.name === usernameField.name ? readOnlyUsernameField : field),
+                    ...isUsernameFieldString ? [] : [
+                        readOnlyUsernameField
                     ]
                 ];
                 if (disabled) {
@@ -116,7 +134,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 const strategy = new Strategy({
                     clientID: collectionOptions.clientID,
-                    clientSecret: collectionOptions.clientSecret,
                     collection: existingCollection,
                     collectionOptions,
                     cookieName,
@@ -127,6 +144,7 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                     verify: collectionOptions.verify ?? defaultVerify({
                         collection: existingCollection,
                         strategyName,
+                        userInfoCookieName: pluginOptions?.userInfoCookieName,
                         usernameField
                     })
                 });
@@ -148,6 +166,10 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 return {
                     ...existingCollection,
+                    access: {
+                        ...existingCollection.access || {},
+                        create: ()=>false
+                    },
                     auth: {
                         ...typeof existingCollection.auth === 'object' ? existingCollection.auth : {},
                         disableLocalStrategy,

package/dist/oauth/strategy/index.d.ts

@@ -4,7 +4,6 @@ import * as jose from 'jose';
 import type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js';
 export interface Options {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;
@@ -16,7 +15,6 @@ export interface Options {
 }
 export declare class Strategy {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;

package/dist/oauth/strategy/index.js

@@ -1,14 +1,13 @@
 import * as jose from 'jose';
 import { APIError, parseCookies } from 'payload';
-import { validateProjectToken } from '../../auth/jwt-validator.js';
-import { getEnvironment } from '../../constants.js';
+import { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js';
+import { getInfraEnvironment } from '../../constants.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
 import { mergeHeaders } from '../utilities/mergeHeaders.js';
 import { refreshTokens } from '../utilities/refreshTokens.js';
 export class Strategy {
     clientID;
-    clientSecret;
     collection;
     collectionOptions;
     cookieName;
@@ -28,7 +27,6 @@ export class Strategy {
         this.verify = options.verify;
         this.cookieName = options.cookieName;
         this.clientID = options.clientID;
-        this.clientSecret = options.clientSecret;
         this.identityMetadataURL = options.identityMetadata;
         this.name = options.strategyName;
         this.collection = options.collection;
@@ -63,7 +61,11 @@ export class Strategy {
             }
         }
         if (!oauthToken) {
-            if (refreshToken && canSetHeaders) {
+            // Attempt refresh even when canSetHeaders=false (e.g., during RSC navigation).
+            // This allows authentication to succeed for the current request even when
+            // cookies cannot be updated. The cookie will be refreshed on the next
+            // full page load when canSetHeaders=true.
+            if (refreshToken) {
                 debugLogger.info({
                     msg: 'No access token found, but refresh token exists. Attempting to refresh...',
                     refreshToken
@@ -83,11 +85,20 @@ export class Strategy {
                         msg: 'Token refreshed. Verifying...',
                         verifyResult
                     });
-                    if (verifyResult.responseHeaders) {
-                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    // Only return response headers (to set cookies) when canSetHeaders is true.
+                    // During RSC navigation, canSetHeaders=false because response streaming
+                    // has already started and cookies cannot be modified.
+                    if (canSetHeaders) {
+                        if (verifyResult.responseHeaders) {
+                            mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                        }
+                        return {
+                            responseHeaders: refreshed.headers,
+                            user: verifyResult.user
+                        };
                     }
+                    // Authenticate this request without updating cookies
                     return {
-                        responseHeaders: refreshed.headers,
                         user: verifyResult.user
                     };
                 } else {
@@ -97,11 +108,10 @@ export class Strategy {
                         refreshToken
                     });
                 }
-            } else {
-                return {
-                    user: null
-                };
             }
+            return {
+                user: null
+            };
         }
         let oauthTokenVerifyResult = null;
         // First, try to verify token
@@ -136,7 +146,10 @@ export class Strategy {
                 });
             }
         }
-        if (oauthTokenVerifyResult instanceof Error && oauthTokenVerifyResult.name === 'TokenExpiredError' && refreshToken && !this.collectionOptions.usePayloadJWT && canSetHeaders) {
+        // Handle expired access token with valid refresh token.
+        // Same pattern as above: refresh regardless of canSetHeaders to support RSC navigation,
+        // but only update cookies when canSetHeaders=true.
+        if (oauthTokenVerifyResult instanceof JWTValidationError && oauthTokenVerifyResult.code === 'EXPIRED' && refreshToken && !this.collectionOptions.usePayloadJWT) {
             const refreshed = await refreshTokens({
                 payload,
                 refreshToken,
@@ -157,11 +170,17 @@ export class Strategy {
                     msg: 'Token refreshed. Verifying...',
                     verifyResult
                 });
-                if (verifyResult.responseHeaders) {
-                    mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                if (canSetHeaders) {
+                    if (verifyResult.responseHeaders) {
+                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    }
+                    return {
+                        responseHeaders: refreshed.headers,
+                        user: verifyResult.user
+                    };
                 }
+                // Authenticate this request without updating cookies
                 return {
-                    responseHeaders: refreshed.headers,
                     user: verifyResult.user
                 };
             } else {
@@ -200,6 +219,10 @@ export class Strategy {
             for(let attempt = 1; attempt <= 5; attempt++){
                 try {
                     this.meta = await fetch(this.identityMetadataURL).then((res)=>res.json());
+                    if (this.meta) {
+                        // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration
+                        this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms';
+                    }
                     this.debugLog(`fetchMeta - success on attempt ${attempt}`);
                     if (this.meta?.jwks_uri) {
                         this.jwks = await fetch(this.meta.jwks_uri).then((res)=>res.json());
@@ -259,7 +282,7 @@ export class Strategy {
     }
     async jwtVerify({ payload, token }) {
         try {
-            const verified = await validateProjectToken(token, getEnvironment());
+            const verified = await validateProjectToken(token, getInfraEnvironment());
             if (typeof verified !== 'string') {
                 return verified;
             }

package/dist/oauth/types.d.ts

@@ -30,7 +30,7 @@ export interface CollectionOptions {
      * Set to false to only accept the JWT from cookies
      */
     disableJWTFromHeader?: boolean;
-    disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy'];
+    disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy'];
     /**
      * The logout button will either redirect to the IDP logout screen or
      * automatically log the user out of the IDP depending on provider.
@@ -112,11 +112,6 @@ export interface PluginOptions {
      * @default 'payload-oauth-token'
      */
     cookieName?: string;
-    /**
-     * Debug mode will log additional information to the console.
-     *
-     * NOTE: This will log sensitive information to the console.
-     */
     /**
      * Accepts incoming request and allows for modification of cookie options
      */
@@ -125,6 +120,11 @@ export interface PluginOptions {
         cookieOptions: CookieOptions;
         headers: Headers;
     }) => CookieOptions;
+    /**
+     * Debug mode will log additional information to the console.
+     *
+     * NOTE: This will log sensitive information to the console.
+     */
     debug?: boolean;
     /**
      * Disables the plugin functionality while leaving in types, fields and component modifications.
@@ -148,6 +148,16 @@ export interface PluginOptions {
      * @default 'oauth'
      */
     strategyName?: string;
+    /**
+     * The name of the short-lived cookie used to carry Figma user profile
+     * info from the login endpoint to `defaultVerify`.
+     *
+     * Override in local dev when running multiple Payload apps on localhost
+     * to avoid cookie collisions (all localhost apps share a cookie jar).
+     *
+     * @default 'figma-user-info'
+     */
+    userInfoCookieName?: string;
 }
 export type CookieOptions = {
     domain?: string;
@@ -159,6 +169,13 @@ export type CookieOptions = {
     secure?: boolean;
 };
 export type StateObj = {
+    /**
+     * Random per-flow nonce. The server sets a matching HttpOnly cookie
+     * (`payload-oauth-state_csrf`) at the time the state is minted; `/sso/login`
+     * compares the value in state to the cookie on callback. This is the
+     * browser-bound CSRF defense required by RFC 6749 §10.12.
+     */
+    csrf: string;
     /**
      * Redirect to use if the login fails
      */

package/dist/oauth/utilities/establishSession.d.ts

@@ -0,0 +1,23 @@
+import type { CollectionConfig, PayloadRequest } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { CollectionOptions, DebugLogger, PluginOptions } from '../types.js';
+interface Args {
+    accessToken: string;
+    collection: CollectionConfig;
+    collectionOptions: CollectionOptions;
+    contentSystemId: string;
+    debugLogger: DebugLogger;
+    pluginOptions: PluginOptions;
+    /** From the IdP token response (`expires_in`); used as a refresh-cookie expiry fallback. */
+    refreshTokenExpiresIn?: number;
+    req: PayloadRequest;
+    strategy: Strategy;
+}
+/**
+ * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
+ * project token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
+ */
+export declare const establishSession: ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy, }: Args) => Promise<void>;
+export {};
+//# sourceMappingURL=establishSession.d.ts.map