@payloadcms/figma 0.0.1-alpha.73 → 0.0.1-alpha.75

package/dist/endpoints/health.js

@@ -7,5 +7,3 @@ export const health = {
     method: 'get',
     path: '/health'
 };
-
-//# sourceMappingURL=health.js.map

package/dist/endpoints/schema.d.ts

@@ -1,3 +1,2 @@
 import type { Endpoint } from 'payload';
 export declare const schema: Endpoint;
-//# sourceMappingURL=schema.d.ts.map

package/dist/endpoints/schema.js

@@ -25,5 +25,3 @@ export const schema = {
     method: 'get',
     path: '/figma/schema'
 };
-
-//# sourceMappingURL=schema.js.map

package/dist/exports/client.d.ts

@@ -3,4 +3,3 @@ export { FigmaAvatarCell } from '../oauth/components/FigmaAvatarCell/index.js';
 export { DefaultLoginButton } from '../oauth/components/LoginButton/index.js';
 export { LogoutButton } from '../oauth/components/LogoutButton/index.js';
 export { ContentApiClientUploadHandler } from '../storage-content-api/client-uploads/ClientUploadHandler.js';
-//# sourceMappingURL=client.d.ts.map

package/dist/exports/client.js

@@ -3,5 +3,3 @@ export { FigmaAvatarCell } from '../oauth/components/FigmaAvatarCell/index.js';
 export { DefaultLoginButton } from '../oauth/components/LoginButton/index.js';
 export { LogoutButton } from '../oauth/components/LogoutButton/index.js';
 export { ContentApiClientUploadHandler } from '../storage-content-api/client-uploads/ClientUploadHandler.js';
-
-//# sourceMappingURL=client.js.map

package/dist/index.d.ts

@@ -3,4 +3,3 @@ export { figmaContentSystem } from './plugin/adapter.js';
 export type { FigmaContentSystemOptions } from './plugin/adapter.js';
 export { buildFigmaConfig } from './plugin/build-config.js';
 export type { FigmaConfig } from './plugin/build-config.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -4,5 +4,3 @@ export { contentAPIAdapter } from './db-content-api/index.js';
 export { figmaContentSystem } from './plugin/adapter.js';
 // Export buildConfig wrapper and its config type
 export { buildFigmaConfig } from './plugin/build-config.js';
-
-//# sourceMappingURL=index.js.map

package/dist/lib/download-skill.d.ts

@@ -10,4 +10,3 @@ export declare function downloadSkill(args: {
     debug?: boolean;
     projectDir: string;
 }): Promise<DownloadSkillResult>;
-//# sourceMappingURL=download-skill.d.ts.map

package/dist/lib/download-skill.js

@@ -75,5 +75,3 @@ async function pathExists(p) {
         return false;
     }
 }
-
-//# sourceMappingURL=download-skill.js.map

package/dist/oauth/components/FigmaAvatar/index.d.ts

@@ -1,4 +1,3 @@
 import type React from 'react';
 import './index.scss';
 export declare const FigmaAvatar: React.FC;
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/components/FigmaAvatar/index.js

@@ -23,5 +23,3 @@ export const FigmaAvatar = ()=>{
         width: 25
     });
 };
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/components/FigmaAvatarCell/index.d.ts

@@ -2,4 +2,3 @@ import type { DefaultCellComponentProps } from 'payload';
 import type React from 'react';
 import './index.scss';
 export declare const FigmaAvatarCell: React.FC<DefaultCellComponentProps>;
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/components/FigmaAvatarCell/index.js

@@ -21,5 +21,3 @@ export const FigmaAvatarCell = ({ cellData })=>{
         width: 20
     });
 };
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/components/FigmaAvatarPlaceholder/index.d.ts

@@ -6,4 +6,3 @@ type FigmaAvatarPlaceholderProps = {
 export declare const FigmaAvatarPlaceholder: React.FC<FigmaAvatarPlaceholderProps>;
 export declare function isValidImageUrl(url: string): boolean;
 export {};
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/components/FigmaAvatarPlaceholder/index.js

@@ -33,5 +33,3 @@ export function isValidImageUrl(url) {
         return false;
     }
 }
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/components/LoginButton/iframeAutoLogin.d.ts

@@ -79,4 +79,3 @@ export interface IframeAutoLoginDeps {
  * fetch — designed to be returned directly from a React useEffect.
  */
 export declare const setupIframeAutoLogin: (deps: IframeAutoLoginDeps) => (() => void);
-//# sourceMappingURL=iframeAutoLogin.d.ts.map

package/dist/oauth/components/LoginButton/iframeAutoLogin.js

@@ -166,5 +166,3 @@ import { isFigmaOrigin } from '../../utilities/figmaHostnames.js';
         abortController.abort();
     };
 };
-
-//# sourceMappingURL=iframeAutoLogin.js.map

package/dist/oauth/components/LoginButton/index.d.ts

@@ -6,4 +6,3 @@ type DefaultLoginButtonProps = {
 };
 export declare const DefaultLoginButton: React.FC<DefaultLoginButtonProps>;
 export {};
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/components/LoginButton/index.js

@@ -1,8 +1,8 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useConfig } from '@payloadcms/ui';
-import { useSearchParams } from 'next/navigation.js';
+import { useConfig, useSearchParams } from '@payloadcms/ui';
 import React, { useEffect, useState } from 'react';
+import { getSearchParam } from '../../utils/getSearchParam.js';
 import { resolveParentTargetOrigin, setupIframeAutoLogin } from './iframeAutoLogin.js';
 import './index.scss';
 const baseClass = 'oauth-login';
@@ -55,7 +55,7 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
     const [isInIframe, setIsInIframe] = useState(null);
     const [autoLoginFailed, setAutoLoginFailed] = useState(false);
     const searchParams = useSearchParams();
-    const payloadRedirect = searchParams.get('redirect');
+    const payloadRedirect = getSearchParam(searchParams, 'redirect');
     useEffect(()=>{
         try {
             setIsInIframe(window.self !== window.top);
@@ -188,5 +188,3 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
         })
     });
 };
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/components/LogoutButton/index.d.ts

@@ -4,4 +4,3 @@ export declare const LogoutButton: React.FC<{
     disabled?: boolean;
     endpointSlug: string;
 }>;
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/components/LogoutButton/index.js

@@ -76,5 +76,3 @@ export const LogoutButton = ({ disabled, endpointSlug })=>{
         })
     });
 };
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/defaults.d.ts

@@ -9,4 +9,3 @@ export declare const defaultVerify: ({ collection, strategyName, userInfoCookieN
     userInfoCookieName?: string;
     usernameField: EmailField | TextField;
 }) => VerifyFunction;
-//# sourceMappingURL=defaults.d.ts.map

package/dist/oauth/defaults.js

@@ -138,6 +138,14 @@ export const defaultVerify = ({ collection, strategyName, userInfoCookieName = D
             user.collection = collection.slug;
             user._strategy = strategyName;
             user.exp = token.exp;
+            // userGroups/makePermission are virtual (never persisted). Surface the live
+            // JWT claims on the authenticated user for this request so access control
+            // and self-reads see current values. Claims are snake_case on the wire; the
+            // collection fields are camelCase. The field afterRead hooks
+            // (see build-config.ts) read these back off req.user.
+            const userWithFigmaClaims = user;
+            userWithFigmaClaims.userGroups = Array.isArray(token.user_groups) ? token.user_groups : undefined;
+            userWithFigmaClaims.makePermission = token.make_permission === 'edit' || token.make_permission === 'view' ? token.make_permission : undefined;
             return {
                 responseHeaders,
                 user
@@ -148,5 +156,3 @@ export const defaultVerify = ({ collection, strategyName, userInfoCookieName = D
             user: null
         };
     };
-
-//# sourceMappingURL=defaults.js.map

package/dist/oauth/endpoints/getLoginEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -163,9 +163,8 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     strategy
                 });
                 debugLogger.info({
-                    msg: 'Token Response',
-                    path,
-                    tokenRes
+                    msg: 'Received token response',
+                    path
                 });
                 const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
                 if (error) {
@@ -180,8 +179,7 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     const errMsg = 'No access_token was returned from the identity provider.';
                     req.payload.logger.error({
                         msg: errMsg,
-                        path,
-                        tokenRes
+                        path
                     });
                     throw new APIError(errMsg);
                 }
@@ -206,8 +204,8 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     accessToken: access_token,
                     collection,
                     collectionOptions,
-                    contentSystemId: config.custom.figma.contentSystemId,
                     debugLogger,
+                    environmentId: config.custom.figma.environmentId,
                     pluginOptions,
                     refreshTokenExpiresIn: refreshTokenExpires,
                     req,
@@ -230,5 +228,3 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
         method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',
         path: `/${endpointSlug}/login`
     });
-
-//# sourceMappingURL=getLoginEndpoint.js.map

package/dist/oauth/endpoints/getLogoutEndpoint.d.ts

@@ -9,4 +9,3 @@ interface Args {
 }
 export declare const getLogoutEndpoint: ({ collection, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getLogoutEndpoint.d.ts.map

package/dist/oauth/endpoints/getLogoutEndpoint.js

@@ -98,5 +98,3 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
         method: 'get',
         path: `/${endpointSlug}/logout`
     });
-
-//# sourceMappingURL=getLogoutEndpoint.js.map

package/dist/oauth/endpoints/getMetaEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getMetaEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getMetaEndpoint.d.ts.map

package/dist/oauth/endpoints/getMetaEndpoint.js

@@ -36,5 +36,3 @@ export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, p
         method: 'get',
         path: `/${endpointSlug}/meta`
     });
-
-//# sourceMappingURL=getMetaEndpoint.js.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getRedirectToLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getRedirectToLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.js

@@ -26,5 +26,3 @@ export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endp
         method: 'get',
         path: `/${endpointSlug}/login`
     });
-
-//# sourceMappingURL=getRedirectToLoginEndpoint.js.map

package/dist/oauth/exports/client.d.ts

@@ -1,3 +1,2 @@
 export { DefaultLoginButton } from '../components/LoginButton/index.jsx';
 export { LogoutButton } from '../components/LogoutButton/index.jsx';
-//# sourceMappingURL=client.d.ts.map

package/dist/oauth/exports/client.js

@@ -1,4 +1,2 @@
 export { DefaultLoginButton } from '../components/LoginButton/index.jsx';
 export { LogoutButton } from '../components/LogoutButton/index.jsx';
-
-//# sourceMappingURL=client.js.map

package/dist/oauth/hooks/afterLogout.d.ts

@@ -5,4 +5,3 @@ export declare const getAfterLogout: ({ collection, cookieName, pluginOptions, }
     cookieName: string;
     pluginOptions: PluginOptions;
 }) => CollectionAfterLogoutHook;
-//# sourceMappingURL=afterLogout.d.ts.map

package/dist/oauth/hooks/afterLogout.js

@@ -23,5 +23,3 @@ export const getAfterLogout = ({ collection, cookieName, pluginOptions })=>({ re
             req
         });
     };
-
-//# sourceMappingURL=afterLogout.js.map

package/dist/oauth/hooks/me.d.ts

@@ -2,4 +2,3 @@ import { type CollectionMeHook } from 'payload';
 export declare const getMeHook: ({ cookieName }: {
     cookieName: string;
 }) => CollectionMeHook;
-//# sourceMappingURL=me.d.ts.map

package/dist/oauth/hooks/me.js

@@ -51,5 +51,3 @@ export const getMeHook = ({ cookieName })=>// eslint-disable-next-line @typescri
         }
         return undefined;
     };
-
-//# sourceMappingURL=me.js.map

package/dist/oauth/hooks/refresh.d.ts

@@ -5,4 +5,3 @@ export declare const getRefreshHook: ({ pluginOptions, strategy, }: {
     pluginOptions: PluginOptions;
     strategy: Strategy;
 }) => CollectionRefreshHook;
-//# sourceMappingURL=refresh.d.ts.map

package/dist/oauth/hooks/refresh.js

@@ -88,5 +88,3 @@ export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user
         }
         return undefined;
     };
-
-//# sourceMappingURL=refresh.js.map

package/dist/oauth/index.d.ts

@@ -1,4 +1,3 @@
 import type { Plugin } from 'payload';
 import type { PluginOptions } from './types.js';
 export declare const oAuth2Plugin: (pluginOptions: PluginOptions) => Plugin;
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.js

@@ -240,5 +240,3 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
             })
         };
     };
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/strategy/index.d.ts

@@ -49,4 +49,3 @@ type JwtVerifyArgs = {
     token: string;
 };
 export {};
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/strategy/index.js

@@ -1,6 +1,6 @@
 import * as jose from 'jose';
 import { APIError, parseCookies } from 'payload';
-import { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js';
+import { JWTValidationError, validatePayloadAdminToken } from '../../auth/jwt-validator.js';
 import { getInfraEnvironment } from '../../constants.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
@@ -45,16 +45,15 @@ export class Strategy {
         let oauthToken = cookies.get(this.cookieName);
         const refreshToken = cookies.get(`${this.cookieName}-refresh`);
         debugLogger.info({
-            msg: 'Retrieved tokens from cookies',
-            oauthToken,
-            refreshToken
+            hasOauthToken: !!oauthToken,
+            hasRefreshToken: !!refreshToken,
+            msg: 'Retrieved tokens from cookies'
         });
         if (!this.collectionOptions.disableJWTFromHeader) {
             // Parse Authorization header if exists
             const jwtFromHeader = headers.get('authorization');
             if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {
                 debugLogger.info({
-                    jwtFromHeader,
                     msg: 'Found bearer token in authorization header'
                 });
                 oauthToken = jwtFromHeader.replace('Bearer ', '');
@@ -67,8 +66,7 @@ export class Strategy {
             // full page load when canSetHeaders=true.
             if (refreshToken) {
                 debugLogger.info({
-                    msg: 'No access token found, but refresh token exists. Attempting to refresh...',
-                    refreshToken
+                    msg: 'No access token found, but refresh token exists. Attempting to refresh...'
                 });
                 const refreshed = await refreshTokens({
                     payload,
@@ -103,9 +101,7 @@ export class Strategy {
                     };
                 } else {
                     debugLogger.info({
-                        msg: 'Token refresh failed',
-                        refreshed,
-                        refreshToken
+                        msg: 'Token refresh failed'
                     });
                 }
             }
@@ -156,9 +152,7 @@ export class Strategy {
                 strategy: this
             });
             debugLogger.info({
-                msg: 'Token expired. Refreshing...',
-                refreshed,
-                refreshToken
+                msg: 'Token expired. Refreshing...'
             });
             if (refreshed) {
                 const verifyResult = await this.verify({
@@ -185,9 +179,7 @@ export class Strategy {
                 };
             } else {
                 debugLogger.info({
-                    msg: 'Token refresh failed',
-                    refreshed,
-                    refreshToken
+                    msg: 'Token refresh failed'
                 });
             }
         }
@@ -282,7 +274,15 @@ export class Strategy {
     }
     async jwtVerify({ payload, token }) {
         try {
-            const verified = await validateProjectToken(token, getInfraEnvironment());
+            const audience = payload.config.custom.figma.environmentId;
+            if (!audience) {
+                throw new Error('Cannot validate token audience: environmentId is not configured');
+            }
+            const verified = await validatePayloadAdminToken({
+                audience,
+                environment: getInfraEnvironment(),
+                token
+            });
             if (typeof verified !== 'string') {
                 return verified;
             }
@@ -299,5 +299,3 @@ export class Strategy {
         return null;
     }
 }
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/types.d.ts

@@ -206,4 +206,3 @@ export type DebugLogger = {
     error: LogFn;
     info: LogFn;
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.js

@@ -1,3 +1 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */ export { };
-
-//# sourceMappingURL=types.js.map

package/dist/oauth/utilities/clearCookie.d.ts

@@ -6,4 +6,3 @@ export declare const clearCookie: (args: {
     overrides?: Partial<CookieOptions>;
     req: PayloadRequest;
 }) => void;
-//# sourceMappingURL=clearCookie.d.ts.map

package/dist/oauth/utilities/clearCookie.js

@@ -21,5 +21,3 @@ export const clearCookie = (args)=>{
     // cookie, so logout wouldn't clear the session in the cross-site Make iframe.
     args.req.responseHeaders.append('Set-Cookie', withPartitionedCookie(clearedCookie));
 };
-
-//# sourceMappingURL=clearCookie.js.map

package/dist/oauth/utilities/createCookieOptions.d.ts

@@ -7,4 +7,3 @@ interface Args {
 }
 export declare const createCookieOptions: ({ collection, headers, pluginOptions, }: Args) => CookieOptions;
 export {};
-//# sourceMappingURL=createCookieOptions.d.ts.map

package/dist/oauth/utilities/createCookieOptions.js

@@ -45,5 +45,3 @@ export const createCookieOptions = ({ collection, headers, pluginOptions })=>{
     }
     return cookieOptions;
 };
-
-//# sourceMappingURL=createCookieOptions.js.map

package/dist/oauth/utilities/createDebugLogger.d.ts

@@ -1,4 +1,3 @@
 import type { Payload } from 'payload';
 import type { DebugLogger } from '../types.js';
 export declare const createDebugLogger: (payload: Payload, condition?: boolean) => DebugLogger;
-//# sourceMappingURL=createDebugLogger.d.ts.map

package/dist/oauth/utilities/createDebugLogger.js

@@ -12,5 +12,3 @@ export const createDebugLogger = (payload, condition)=>{
         }
     };
 };
-
-//# sourceMappingURL=createDebugLogger.js.map

package/dist/oauth/utilities/establishSession.d.ts

@@ -5,8 +5,8 @@ interface Args {
     accessToken: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
-    contentSystemId: string;
     debugLogger: DebugLogger;
+    environmentId: string;
     pluginOptions: PluginOptions;
     /** From the IdP token response (`expires_in`); used as a refresh-cookie expiry fallback. */
     refreshTokenExpiresIn?: number;
@@ -15,9 +15,8 @@ interface Args {
 }
 /**
  * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
- * project token, and write the main + refresh + user-info cookies to
- * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
+ * Payload Admin token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the Admin token mint fails.
  */
-export declare const establishSession: ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy, }: Args) => Promise<void>;
+export declare const establishSession: ({ accessToken, collection, collectionOptions, debugLogger, environmentId, pluginOptions, refreshTokenExpiresIn, req, strategy, }: Args) => Promise<void>;
 export {};
-//# sourceMappingURL=establishSession.d.ts.map

package/dist/oauth/utilities/establishSession.js

@@ -1,13 +1,13 @@
 import { APIError, generateCookie } from 'payload';
-import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
+import { getPayloadAdminToken, getUserInfo } from '../../api/figma-api.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { getCookieExpiration } from './getCookieExpiration.js';
 import { withPartitionedCookie } from './withPartitionedCookie.js';
 /**
  * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
- * project token, and write the main + refresh + user-info cookies to
- * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
- */ export const establishSession = async ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy })=>{
+ * Payload Admin token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the Admin token mint fails.
+ */ export const establishSession = async ({ accessToken, collection, collectionOptions, debugLogger, environmentId, pluginOptions, refreshTokenExpiresIn, req, strategy })=>{
     const oauthCredential = {
         type: 'oauth',
         token: accessToken
@@ -17,7 +17,6 @@ import { withPartitionedCookie } from './withPartitionedCookie.js';
     try {
         figmaUserInfo = await getUserInfo(oauthCredential);
         debugLogger.info({
-            figmaUserInfo,
             msg: 'Fetched Figma user info'
         });
     } catch (err) {
@@ -26,9 +25,9 @@ import { withPartitionedCookie } from './withPartitionedCookie.js';
             msg: 'Failed to fetch Figma user info'
         });
     }
-    const projectToken = await getProjectToken(oauthCredential, contentSystemId);
-    if (!projectToken.token) {
-        const errMsg = 'No project token returned from Figma API';
+    const adminToken = await getPayloadAdminToken(oauthCredential, environmentId);
+    if (!adminToken.token) {
+        const errMsg = 'No Payload Admin token returned from Figma API';
         req.payload.logger.error({
             msg: errMsg
         });
@@ -54,13 +53,13 @@ import { withPartitionedCookie } from './withPartitionedCookie.js';
         });
         req.responseHeaders.append('Set-Cookie', withPartitionedCookie(refreshCookie));
     }
-    const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(projectToken.expiresAt);
+    const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(adminToken.expiresAt);
     const tokenCookie = generateCookie({
         ...cookieOptions,
         name: strategy.cookieName,
         expires: tokenExpires,
         returnCookieAsObject: false,
-        value: projectToken.token
+        value: adminToken.token
     });
     req.responseHeaders.append('Set-Cookie', withPartitionedCookie(tokenCookie));
     // Short-lived handoff cookie consumed by defaultVerify on the next request.
@@ -79,5 +78,3 @@ import { withPartitionedCookie } from './withPartitionedCookie.js';
         req.responseHeaders.append('Set-Cookie', withPartitionedCookie(userInfoCookie));
     }
 };
-
-//# sourceMappingURL=establishSession.js.map

package/dist/oauth/utilities/exchangeCodeForAccessToken.d.ts

@@ -21,4 +21,3 @@ export interface TokenEndpointResponse {
  */
 export declare const exchangeCodeForAccessToken: ({ code, codeVerifier, redirectUri, strategy, }: Args) => Promise<TokenEndpointResponse>;
 export {};
-//# sourceMappingURL=exchangeCodeForAccessToken.d.ts.map

package/dist/oauth/utilities/exchangeCodeForAccessToken.js

@@ -24,5 +24,3 @@
     });
     return await res.json();
 };
-
-//# sourceMappingURL=exchangeCodeForAccessToken.js.map

package/dist/oauth/utilities/extractOrigin.d.ts

@@ -1,2 +1 @@
 export declare const extractOrigin: (url: string) => null | string;
-//# sourceMappingURL=extractOrigin.d.ts.map

package/dist/oauth/utilities/extractOrigin.js

@@ -8,5 +8,3 @@ export const extractOrigin = (url)=>{
         ;
     }
 };
-
-//# sourceMappingURL=extractOrigin.js.map

package/dist/oauth/utilities/figmaHostnames.d.ts

@@ -1,3 +1,2 @@
 export declare const FIGMA_HOSTNAMES: Set<string>;
 export declare const isFigmaOrigin: (origin: string) => boolean;
-//# sourceMappingURL=figmaHostnames.d.ts.map

package/dist/oauth/utilities/figmaHostnames.js

@@ -22,5 +22,3 @@ export const isFigmaOrigin = (origin)=>{
         return false;
     }
 };
-
-//# sourceMappingURL=figmaHostnames.js.map

package/dist/oauth/utilities/getAdminCollectionSlug.d.ts

@@ -1,3 +1,2 @@
 import type { Config } from 'payload';
 export declare const getAdminCollectionSlug: (config: Config) => string;
-//# sourceMappingURL=getAdminCollectionSlug.d.ts.map

package/dist/oauth/utilities/getAdminCollectionSlug.js

@@ -14,5 +14,3 @@ export const getAdminCollectionSlug = (config)=>{
     // Otherwise, assume that it'll be the built-in auth
     return 'users';
 };
-
-//# sourceMappingURL=getAdminCollectionSlug.js.map

package/dist/oauth/utilities/getAuthorizeURL.d.ts

@@ -78,4 +78,3 @@ export declare const buildCsrfCookieHeader: (nonce: string) => string;
  */
 export declare const buildCsrfCookieClearHeader: () => string;
 export {};
-//# sourceMappingURL=getAuthorizeURL.d.ts.map