@payloadcms/figma 0.0.1-alpha.74 → 0.0.1-alpha.75

package/dist/api/figma-api.d.ts

@@ -30,7 +30,7 @@ export declare class FigmaApiError extends Error {
  * requests to the Content API. The token contains the CMS ID and
  * user identifying information in its claims.
  *
- * Endpoint: GET https://api.figma.com/v1/cms/:id/token/
+ * Endpoint: POST https://api.figma.com/v1/cms/content-systems/:id/token/
  *
  * @param accessToken - OAuth access token for authentication
  * @param tenantId - The tenant/CMS ID
@@ -38,6 +38,7 @@ export declare class FigmaApiError extends Error {
  * @throws {FigmaApiError} If the API call fails
  */
 export declare function getProjectToken(credential: AuthCredential, tenantId: string): Promise<ProjectToken>;
+export declare function getPayloadAdminToken(credential: AuthCredential, environmentId: string): Promise<ProjectToken>;
 /**
  * Get user info from Figma API
  *

package/dist/api/figma-api.js

@@ -24,7 +24,7 @@ import { parseControlPlaneApiError } from './error-response.js';
  * requests to the Content API. The token contains the CMS ID and
  * user identifying information in its claims.
  *
- * Endpoint: GET https://api.figma.com/v1/cms/:id/token/
+ * Endpoint: POST https://api.figma.com/v1/cms/content-systems/:id/token/
  *
  * @param accessToken - OAuth access token for authentication
  * @param tenantId - The tenant/CMS ID
@@ -66,7 +66,7 @@ import { parseControlPlaneApiError } from './error-response.js';
         if (shouldMock) {
             // MOCK IMPLEMENTATION: Generate a mock JWT token for testing
             log.debug('Using mock project token API for getProjectToken (FIGMA_MOCK_PROJECT_TOKEN = "true")');
-            const mockToken = createMockJWT(tenantId, 25) // 25 minutes expiry
+            const mockToken = createMockJWT(`csid_${tenantId}`, 25) // 25 minutes expiry
             ;
             // Mock response data
             const data = {
@@ -87,7 +87,7 @@ import { parseControlPlaneApiError } from './error-response.js';
         }
         // REAL API IMPLEMENTATION
         const baseUrl = getEnvConfig().apiBaseUrl;
-        const url = `${baseUrl}/v1/cms/${tenantId}/token/`;
+        const url = `${baseUrl}/v1/cms/content-systems/${tenantId}/token/`;
         const response = await fetch(url, {
             headers: getAuthHeaders(credential),
             method: 'POST'
@@ -122,6 +122,36 @@ import { parseControlPlaneApiError } from './error-response.js';
         throw new FigmaApiError(`Failed to get project token: ${error instanceof Error ? error.message : 'Unknown error'}`, undefined, error instanceof Error ? error : undefined);
     }
 }
+export async function getPayloadAdminToken(credential, environmentId) {
+    if (process.env.FIGMA_MOCK_PROJECT_TOKEN === 'true') {
+        const token = createMockJWT(`eid_${environmentId}`, 25);
+        return {
+            expiresAt: parseJwtExpiry(token),
+            tenantId: environmentId,
+            token
+        };
+    }
+    const baseUrl = getEnvConfig().apiBaseUrl;
+    const response = await fetch(`${baseUrl}/v1/cms/environments/${environmentId}/admin-token`, {
+        headers: getAuthHeaders(credential),
+        method: 'POST'
+    });
+    if (!response.ok) {
+        throw new FigmaApiError(await parseControlPlaneApiError({
+            context: 'get Payload Admin token',
+            response
+        }), response.status);
+    }
+    const data = await response.json();
+    if (!data.meta?.token) {
+        throw new FigmaApiError('Invalid response: missing token in meta');
+    }
+    return {
+        expiresAt: parseJwtExpiry(data.meta.token),
+        tenantId: environmentId,
+        token: data.meta.token
+    };
+}
 /**
  * Create a mock JWT token for testing
  * TODO: Remove this when real API is available

package/dist/auth/jwt-validator.d.ts

@@ -4,9 +4,9 @@ import type { JWTPayload } from './types.js';
  * JWT validation error with specific error codes
  */
 export declare class JWTValidationError extends Error {
-    code: 'AUDIENCE_INVALID' | 'EXPIRED' | 'JWKS_FETCH_FAILED' | 'MISSING_KID' | 'SIGNATURE_INVALID';
+    code: 'AUDIENCE_INVALID' | 'EXPIRED' | 'JWKS_FETCH_FAILED' | 'MISSING_KID' | 'SIGNATURE_INVALID' | 'TOKEN_CLAIMS_INVALID';
     cause?: Error | undefined;
-    constructor(message: string, code: 'AUDIENCE_INVALID' | 'EXPIRED' | 'JWKS_FETCH_FAILED' | 'MISSING_KID' | 'SIGNATURE_INVALID', cause?: Error | undefined);
+    constructor(message: string, code: 'AUDIENCE_INVALID' | 'EXPIRED' | 'JWKS_FETCH_FAILED' | 'MISSING_KID' | 'SIGNATURE_INVALID' | 'TOKEN_CLAIMS_INVALID', cause?: Error | undefined);
 }
 /**
  * Validate a project token JWT
@@ -36,6 +36,16 @@ export declare function validateProjectToken(params: {
     environment: Environment;
     token: string;
 }): Promise<JWTPayload>;
+export declare function validatePayloadAdminToken(params: {
+    audience: string;
+    environment: Environment;
+    token: string;
+}): Promise<JWTPayload>;
+export declare function validateContentApiToken(params: {
+    audience: string;
+    environment: Environment;
+    token: string;
+}): Promise<JWTPayload>;
 /**
  * Clear JWKS cache (useful for testing or forcing refresh)
  *

package/dist/auth/jwt-validator.js

@@ -63,7 +63,7 @@ import { getEnvConfig } from '../constants.js';
     try {
         const JWKS = getJWKSResolver(environment);
         const { payload } = await jwtVerify(token, JWKS, {
-            clockTolerance: 300,
+            clockTolerance: 30,
             ...audience ? {
                 audience
             } : {}
@@ -108,6 +108,24 @@ import { getEnvConfig } from '../constants.js';
         throw new JWTValidationError(`JWT validation failed: ${message}`, 'SIGNATURE_INVALID', error instanceof Error ? error : undefined);
     }
 }
+export async function validatePayloadAdminToken(params) {
+    const payload = await validateProjectToken({
+        ...params,
+        audience: `eid_${params.audience}`
+    });
+    if (typeof payload.sub !== 'string' || typeof payload.email !== 'string') {
+        throw new JWTValidationError('Payload Admin token claims are invalid', 'TOKEN_CLAIMS_INVALID');
+    }
+    return payload;
+}
+export async function validateContentApiToken(params) {
+    // Content API tokens are issued by the content-system-scoped endpoint, which
+    // prefixes the `aud` with `csid_` (mirrors the `eid_` admin-token scoping).
+    return validateProjectToken({
+        ...params,
+        audience: `csid_${params.audience}`
+    });
+}
 /**
  * Clear JWKS cache (useful for testing or forcing refresh)
  *

package/dist/auth/project-token.js

@@ -8,7 +8,7 @@
 import { PROJECT_TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js';
 import { getInfraEnvironment } from '../constants.js';
 import * as log from '../utils/log.js';
-import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
+import { JWTValidationError, validateContentApiToken } from './jwt-validator.js';
 import { getValidCredential } from './oauth-flow.js';
 /**
  * Error during project token operations
@@ -153,7 +153,8 @@ function isCachedTokenValid(entry) {
             validatedClaims = parseJWTClaims(fetchedToken.token);
         } else {
             try {
-                validatedClaims = await validateProjectToken({
+                validatedClaims = await validateContentApiToken({
+                    audience: resolvedTenantId,
                     environment: getInfraEnvironment(),
                     token: fetchedToken.token
                 });

package/dist/auth/types.d.ts

@@ -197,8 +197,12 @@ export interface JWTPayload extends JoseJWTPayload {
     [key: string]: unknown;
     /** User email address */
     email?: string;
+    /** Make permission tier the authed user holds on this CMS */
+    make_permission?: 'edit' | 'view';
     /** Tenant/CMS ID this token is scoped to */
     tenant_id?: string;
+    /** File user groups the authed user is a member of (scoped to the linked Make file) */
+    user_groups?: string[];
 }
 /**
  * Project token (JWT) for authenticating to Content API
@@ -216,7 +220,7 @@ export interface ProjectToken {
 }
 /**
  * Raw project token response from Figma API
- * Response from GET https://api.figma.com/v1/cms/:id/token/
+ * Response from POST https://api.figma.com/v1/cms/content-systems/:id/token/
  */
 export interface ProjectTokenResponse {
     /** Response metadata containing the JWT token */

package/dist/auth/types.js

@@ -1,4 +1,4 @@
 /**
  * Raw project token response from Figma API
- * Response from GET https://api.figma.com/v1/cms/:id/token/
+ * Response from POST https://api.figma.com/v1/cms/content-systems/:id/token/
  */ export { };

package/dist/cli.js

@@ -12,6 +12,7 @@ import { listTokensCommand } from './commands/list-tokens.js';
 import { loginCommand } from './commands/login.js';
 import { logoutCommand } from './commands/logout.js';
 import { upgradeCommand } from './commands/upgrade.js';
+import { uploadSchemaCommand } from './commands/upload-schema.js';
 import { setInfraEnvironment } from './constants.js';
 import { helpMessage } from './utils/messages.js';
 /**
@@ -178,6 +179,12 @@ class Main {
                         isDryRun: this.args['--dry-run']
                     });
                     break;
+                case 'upload-schema':
+                    await uploadSchemaCommand({
+                        id: this.args['--id'],
+                        env: this.args['--env']
+                    });
+                    break;
                 default:
                     p.log.error(pc.red(`Unknown command: ${subcommand}`));
                     p.note('Use --help to see available commands', 'Tip');

package/dist/commands/upload-schema.d.ts

@@ -0,0 +1,8 @@
+export interface UploadSchemaCommandOptions {
+    /** Environment name (overrides FIGMA_ENVIRONMENT_NAME). */
+    env?: string;
+    /** CMS Resource ID (overrides FIGMA_PROJECT_ID). */
+    id?: string;
+}
+/** Upload the current Payload collection schema for Content API migration tooling. */
+export declare function uploadSchemaCommand(options?: UploadSchemaCommandOptions): Promise<void>;

package/dist/commands/upload-schema.js

@@ -0,0 +1,91 @@
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+import { getBootstrapInfo } from '../api/control-plane.js';
+import { tryGetCredential } from '../auth/oauth-flow.js';
+import { getValidProjectToken } from '../auth/project-token.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { getEnvConfig } from '../constants.js';
+import { buildDocumentSchema } from '../db-content-api/utilities/schema/buildDocumentSchema.js';
+import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
+import { getEnvVar } from '../utils/env-management.js';
+import { loadPayloadConfig } from '../utils/load-payload-config.js';
+import { resolveEnvironment } from '../utils/resolve-environment.js';
+import { loginCommand } from './login.js';
+/** Upload the current Payload collection schema for Content API migration tooling. */ export async function uploadSchemaCommand(options = {}) {
+    const projectPath = process.cwd();
+    const projectId = options.id ?? await getEnvVar(projectPath, 'FIGMA_PROJECT_ID') ?? undefined;
+    const environmentName = options.env ?? await getEnvVar(projectPath, 'FIGMA_ENVIRONMENT_NAME') ?? undefined;
+    if (!projectId) {
+        p.log.error(pc.red('Project ID not found. Run `@payloadcms/figma init` first, or use --id.'));
+        process.exit(1);
+    }
+    // Bootstrap still requires a CLI login when the upload uses the Content API key.
+    const tokenStore = getTokenStore();
+    let credential = await tryGetCredential(tokenStore);
+    if (!credential) {
+        p.log.message('Please log in to continue');
+        await loginCommand();
+        credential = await tryGetCredential(tokenStore);
+    }
+    if (!credential) {
+        p.log.error(pc.red('Authentication failed'));
+        process.exit(1);
+    }
+    const spinner = p.spinner();
+    spinner.start('Resolving schema upload target...');
+    try {
+        const bootstrapInfo = await getBootstrapInfo(credential, projectId);
+        const environment = resolveEnvironment({
+            environmentName,
+            environments: bootstrapInfo.environments
+        });
+        cacheAllEnvironments(tokenStore, projectId, bootstrapInfo);
+        spinner.message('Loading Payload config...');
+        // --id/--env select the upload target only. Collections conditionally configured from
+        // FIGMA_ENVIRONMENT_NAME still use process.env/.env and may not match that upload target.
+        const config = await loadPayloadConfig(projectPath);
+        const documentSchema = buildDocumentSchema(config);
+        spinner.message('Uploading collection schema...');
+        const apiKey = process.env.FIGMA_CONTENT_API_ACCESS_KEY;
+        const projectToken = apiKey ? null : await getValidProjectToken({
+            projectInfo: {
+                environmentName: environment.name,
+                projectId
+            },
+            tenantId: environment.contentSystemId,
+            tokenStore
+        });
+        if (!apiKey && !projectToken) {
+            throw new Error('Could not get a project token. Run `@payloadcms/figma login` and retry.');
+        }
+        // --infra-env is applied by the CLI before this fallback selects the Content API URL.
+        const contentApiUrl = process.env.FIGMA_CONTENT_API_URL || getEnvConfig().contentApiUrl;
+        if (!contentApiUrl) {
+            throw new Error('FIGMA_CONTENT_API_URL is required for this infrastructure environment.');
+        }
+        const response = await fetch(`${contentApiUrl}/api/v0/content_systems/${encodeURIComponent(environment.contentSystemId)}/jsonb_to_index_migration_schema`, {
+            body: JSON.stringify({
+                documentSchema
+            }),
+            headers: {
+                'Content-Type': 'application/json',
+                ...apiKey ? {
+                    'X-Api-Key': apiKey
+                } : {
+                    Authorization: `Bearer ${projectToken}`
+                }
+            },
+            method: 'PUT'
+        });
+        if (!response.ok) {
+            const responseBody = await response.text();
+            throw new Error(`Content API returned ${response.status}${responseBody ? `: ${responseBody}` : ''}`);
+        }
+        const collectionCount = Object.keys(documentSchema.collections).length;
+        spinner.stop(pc.green(`Uploaded ${collectionCount} collection schema${collectionCount === 1 ? '' : 's'} to ${environment.name}`));
+    } catch (error) {
+        spinner.stop(pc.red('Failed to upload collection schema'));
+        p.log.error(error instanceof Error ? error.message : 'Unknown error');
+        process.exit(1);
+    }
+}