@payloadcms/figma 0.0.1-alpha.74 → 0.0.1-alpha.75

package/dist/db-content-api/utilities/data/pointShape.d.ts

@@ -0,0 +1,3 @@
+import type { Field, TabAsField } from 'payload';
+export declare function encodePointForWrite(field: Field | TabAsField, value: unknown): unknown;
+export declare function decodePointFromRead(field: Field | TabAsField, value: unknown): unknown;

package/dist/db-content-api/utilities/data/pointShape.js

@@ -0,0 +1,43 @@
+/**
+ * Payload stores a point as GeoJSON; the v1 server uses a bare `[lng, lat]`
+ * tuple. Unwrap on write, re-wrap on read so afterRead can restore the tuple.
+ */ function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isCoordinateTuple(value) {
+    return Array.isArray(value) && value.length === 2 && value.every((v)=>typeof v === 'number');
+}
+function pointLeafToWire(value) {
+    if (isPlainObject(value) && isCoordinateTuple(value.coordinates)) {
+        return value.coordinates;
+    }
+    return value;
+}
+function pointLeafFromWire(value) {
+    if (isCoordinateTuple(value)) {
+        return {
+            type: 'Point',
+            coordinates: value
+        };
+    }
+    return value;
+}
+function mapPoint(field, value, mapLeaf) {
+    if (field.type !== 'point' || value === null || value === undefined) {
+        return value;
+    }
+    if ('localized' in field && field.localized && isPlainObject(value)) {
+        const result = {};
+        for (const [locale, localeValue] of Object.entries(value)){
+            result[locale] = mapLeaf(localeValue);
+        }
+        return result;
+    }
+    return mapLeaf(value);
+}
+export function encodePointForWrite(field, value) {
+    return mapPoint(field, value, pointLeafToWire);
+}
+export function decodePointFromRead(field, value) {
+    return mapPoint(field, value, pointLeafFromWire);
+}

package/dist/db-content-api/utilities/data/richTextShape.d.ts

@@ -0,0 +1,3 @@
+import type { Field, Payload, TabAsField } from 'payload';
+export declare function encodeRichTextForWrite(field: Field | TabAsField, value: unknown): unknown;
+export declare function decodeRichTextFromRead(field: Field | TabAsField, value: unknown, payload: Payload, fieldPath: string, collectionSlug: string): unknown;

package/dist/db-content-api/utilities/data/richTextShape.js

@@ -0,0 +1,56 @@
+/**
+ * The v1 server stores richText as a serialized JSON string, so stringify on
+ * write and parse on read. A localized richText is a per-locale map, serialized
+ * and parsed per entry (not as one blob).
+ */ function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function richTextLeafToWire(value) {
+    if (value === null || value === undefined || typeof value === 'string') {
+        return value;
+    }
+    return JSON.stringify(value);
+}
+export function encodeRichTextForWrite(field, value) {
+    if (field.type !== 'richText' || value === null || value === undefined) {
+        return value;
+    }
+    if ('localized' in field && field.localized && isPlainObject(value)) {
+        const result = {};
+        for (const [locale, localeValue] of Object.entries(value)){
+            result[locale] = richTextLeafToWire(localeValue);
+        }
+        return result;
+    }
+    return richTextLeafToWire(value);
+}
+function richTextLeafFromWire(value, onError) {
+    if (typeof value !== 'string') {
+        return value;
+    }
+    try {
+        return JSON.parse(value);
+    } catch (error) {
+        onError(error);
+        return value;
+    }
+}
+export function decodeRichTextFromRead(field, value, payload, fieldPath, collectionSlug) {
+    if (field.type !== 'richText' || value === null || value === undefined) {
+        return value;
+    }
+    const onError = (error)=>{
+        payload.logger.warn({
+            err: error instanceof Error ? error : new Error(String(error)),
+            msg: `Failed to parse richtext field '${fieldPath}' in collection '${collectionSlug}'`
+        });
+    };
+    if ('localized' in field && field.localized && isPlainObject(value)) {
+        const result = {};
+        for (const [locale, localeValue] of Object.entries(value)){
+            result[locale] = richTextLeafFromWire(localeValue, onError);
+        }
+        return result;
+    }
+    return richTextLeafFromWire(value, onError);
+}

package/dist/db-content-api/utilities/schema/buildDocumentSchema.d.ts

@@ -0,0 +1,56 @@
+import type { Config } from 'payload';
+/**
+ * Wire form of the v1 `DocumentSchema` sent on every request so the server can
+ * classify each queried path against the index tables. Paths are
+ * period-delimited (e.g. `author.name`).
+ */
+export interface DocumentSchemaWire {
+    collections: Record<string, WireCollectionSchema>;
+    version: 1;
+}
+interface WireCollectionSchema {
+    hints: WireHint[];
+    name: string;
+    paths: Record<string, WireFieldSchema>;
+}
+type WireHint = {
+    paths: string[];
+    type: 'unique';
+};
+type WireFieldSchema = {
+    collection: string | string[];
+    on: string;
+    type: 'join';
+} | {
+    collection: string | string[];
+    hasMany: boolean;
+    localized: boolean;
+    type: 'relationship' | 'upload';
+    unique: boolean;
+} | {
+    format: 'lexical';
+    localized: boolean;
+    type: 'richText';
+} | {
+    hasMany: boolean;
+    localized: boolean;
+    type: 'group';
+} | {
+    hasMany: boolean;
+    localized: boolean;
+    type: 'number' | 'select' | 'text';
+    unique: boolean;
+} | {
+    localized: boolean;
+    type: 'array' | 'blocks';
+} | {
+    localized: boolean;
+    type: 'checkbox' | 'date' | 'json' | 'radio';
+} | {
+    localized: boolean;
+    type: 'code' | 'email' | 'point' | 'textarea';
+    unique: boolean;
+};
+export declare function buildDocumentSchema(config: Config): DocumentSchemaWire;
+export declare function buildVersionDocumentSchema(schema: DocumentSchemaWire, targetCollectionSlug: string): DocumentSchemaWire;
+export {};

package/dist/db-content-api/utilities/schema/buildDocumentSchema.js

@@ -0,0 +1,183 @@
+export function buildDocumentSchema(config) {
+    const collections = {};
+    const blocksBySlug = new Map();
+    for (const block of config.blocks ?? []){
+        blocksBySlug.set(block.slug, block);
+    }
+    for (const collection of config.collections ?? []){
+        collections[collection.slug] = buildCollectionSchema(collection.slug, collection.fields, blocksBySlug);
+    }
+    for (const global of config.globals ?? []){
+        const slug = `_global-${global.slug}`;
+        collections[slug] = buildCollectionSchema(slug, global.fields, blocksBySlug);
+    }
+    return {
+        collections,
+        version: 1
+    };
+}
+export function buildVersionDocumentSchema(schema, targetCollectionSlug) {
+    const target = schema.collections[targetCollectionSlug];
+    if (!target) {
+        return schema;
+    }
+    const prefixedPaths = {};
+    for (const [path, fieldSchema] of Object.entries(target.paths)){
+        prefixedPaths[`version.${path}`] = fieldSchema;
+    }
+    prefixedPaths['version._payloadAutosave'] = {
+        type: 'checkbox',
+        localized: false
+    };
+    return {
+        ...schema,
+        collections: {
+            ...schema.collections,
+            [targetCollectionSlug]: {
+                ...target,
+                paths: prefixedPaths
+            }
+        }
+    };
+}
+function buildCollectionSchema(name, fields, blocksBySlug) {
+    const paths = {};
+    collectPaths(fields, '', false, paths, blocksBySlug);
+    return {
+        name,
+        hints: [],
+        paths
+    };
+}
+function collectPaths(fields, prefix, absorbed, paths, blocksBySlug) {
+    for (const field of fields){
+        if (field.type === 'row' || field.type === 'collapsible' || field.type === 'group' && (!('name' in field) || !field.name)) {
+            collectPaths(field.fields, prefix, absorbed, paths, blocksBySlug);
+            continue;
+        }
+        if (field.type === 'tabs') {
+            for (const tab of field.tabs){
+                const tabOwnLocalized = 'localized' in tab && tab.localized === true;
+                if ('name' in tab && tab.name) {
+                    paths[`${prefix}${tab.name}`] = {
+                        type: 'group',
+                        hasMany: false,
+                        localized: tabOwnLocalized && !absorbed
+                    };
+                    collectPaths(tab.fields, `${prefix}${tab.name}.`, absorbed || tabOwnLocalized, paths, blocksBySlug);
+                } else {
+                    collectPaths(tab.fields, prefix, absorbed, paths, blocksBySlug);
+                }
+            }
+            continue;
+        }
+        if (field.type === 'ui' || !('name' in field) || !field.name) {
+            continue;
+        }
+        collectNamedField(field, prefix, absorbed, paths, blocksBySlug);
+    }
+}
+function collectNamedField(field, prefix, absorbed, paths, blocksBySlug) {
+    if (!('name' in field) || !field.name) {
+        return;
+    }
+    const path = `${prefix}${field.name}`;
+    const localized = 'localized' in field && field.localized === true && !absorbed;
+    const childAbsorbed = absorbed || 'localized' in field && field.localized === true;
+    const hasMany = 'hasMany' in field ? Boolean(field.hasMany) : false;
+    const unique = 'unique' in field ? Boolean(field.unique) : false;
+    switch(field.type){
+        case 'array':
+            paths[path] = {
+                type: 'array',
+                localized
+            };
+            collectPaths(field.fields, `${path}.`, childAbsorbed, paths, blocksBySlug);
+            return;
+        case 'blocks':
+            {
+                paths[path] = {
+                    type: 'blocks',
+                    localized
+                };
+                paths[`${path}.blockType`] = {
+                    type: 'text',
+                    hasMany: false,
+                    localized: false,
+                    unique: false
+                };
+                const blockFields = [];
+                for (const block of field.blocks){
+                    const resolved = typeof block === 'string' ? blocksBySlug.get(block) : block;
+                    if (resolved) {
+                        blockFields.push(...resolved.fields);
+                    }
+                }
+                collectPaths(blockFields, `${path}.`, childAbsorbed, paths, blocksBySlug);
+                return;
+            }
+        case 'checkbox':
+        case 'date':
+        case 'json':
+        case 'radio':
+            paths[path] = {
+                type: field.type,
+                localized
+            };
+            return;
+        case 'code':
+        case 'email':
+        case 'point':
+        case 'textarea':
+            paths[path] = {
+                type: field.type,
+                localized,
+                unique
+            };
+            return;
+        case 'group':
+            paths[path] = {
+                type: 'group',
+                hasMany,
+                localized
+            };
+            collectPaths(field.fields, `${path}.`, childAbsorbed, paths, blocksBySlug);
+            return;
+        case 'join':
+            paths[path] = {
+                type: 'join',
+                collection: field.collection,
+                on: field.on
+            };
+            return;
+        case 'number':
+        case 'select':
+        case 'text':
+            paths[path] = {
+                type: field.type,
+                hasMany,
+                localized,
+                unique
+            };
+            return;
+        case 'relationship':
+        case 'upload':
+            paths[path] = {
+                type: field.type,
+                collection: field.relationTo,
+                hasMany,
+                localized,
+                unique
+            };
+            return;
+        case 'richText':
+            paths[path] = {
+                type: 'richText',
+                format: 'lexical',
+                localized
+            };
+            return;
+        default:
+            return;
+    }
+}

package/dist/oauth/defaults.js

@@ -138,6 +138,14 @@ export const defaultVerify = ({ collection, strategyName, userInfoCookieName = D
             user.collection = collection.slug;
             user._strategy = strategyName;
             user.exp = token.exp;
+            // userGroups/makePermission are virtual (never persisted). Surface the live
+            // JWT claims on the authenticated user for this request so access control
+            // and self-reads see current values. Claims are snake_case on the wire; the
+            // collection fields are camelCase. The field afterRead hooks
+            // (see build-config.ts) read these back off req.user.
+            const userWithFigmaClaims = user;
+            userWithFigmaClaims.userGroups = Array.isArray(token.user_groups) ? token.user_groups : undefined;
+            userWithFigmaClaims.makePermission = token.make_permission === 'edit' || token.make_permission === 'view' ? token.make_permission : undefined;
             return {
                 responseHeaders,
                 user

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -163,9 +163,8 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     strategy
                 });
                 debugLogger.info({
-                    msg: 'Token Response',
-                    path,
-                    tokenRes
+                    msg: 'Received token response',
+                    path
                 });
                 const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
                 if (error) {
@@ -180,8 +179,7 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     const errMsg = 'No access_token was returned from the identity provider.';
                     req.payload.logger.error({
                         msg: errMsg,
-                        path,
-                        tokenRes
+                        path
                     });
                     throw new APIError(errMsg);
                 }
@@ -206,8 +204,8 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     accessToken: access_token,
                     collection,
                     collectionOptions,
-                    contentSystemId: config.custom.figma.contentSystemId,
                     debugLogger,
+                    environmentId: config.custom.figma.environmentId,
                     pluginOptions,
                     refreshTokenExpiresIn: refreshTokenExpires,
                     req,

package/dist/oauth/strategy/index.js

@@ -1,6 +1,6 @@
 import * as jose from 'jose';
 import { APIError, parseCookies } from 'payload';
-import { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js';
+import { JWTValidationError, validatePayloadAdminToken } from '../../auth/jwt-validator.js';
 import { getInfraEnvironment } from '../../constants.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
@@ -45,16 +45,15 @@ export class Strategy {
         let oauthToken = cookies.get(this.cookieName);
         const refreshToken = cookies.get(`${this.cookieName}-refresh`);
         debugLogger.info({
-            msg: 'Retrieved tokens from cookies',
-            oauthToken,
-            refreshToken
+            hasOauthToken: !!oauthToken,
+            hasRefreshToken: !!refreshToken,
+            msg: 'Retrieved tokens from cookies'
         });
         if (!this.collectionOptions.disableJWTFromHeader) {
             // Parse Authorization header if exists
             const jwtFromHeader = headers.get('authorization');
             if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {
                 debugLogger.info({
-                    jwtFromHeader,
                     msg: 'Found bearer token in authorization header'
                 });
                 oauthToken = jwtFromHeader.replace('Bearer ', '');
@@ -67,8 +66,7 @@ export class Strategy {
             // full page load when canSetHeaders=true.
             if (refreshToken) {
                 debugLogger.info({
-                    msg: 'No access token found, but refresh token exists. Attempting to refresh...',
-                    refreshToken
+                    msg: 'No access token found, but refresh token exists. Attempting to refresh...'
                 });
                 const refreshed = await refreshTokens({
                     payload,
@@ -103,9 +101,7 @@ export class Strategy {
                     };
                 } else {
                     debugLogger.info({
-                        msg: 'Token refresh failed',
-                        refreshed,
-                        refreshToken
+                        msg: 'Token refresh failed'
                     });
                 }
             }
@@ -156,9 +152,7 @@ export class Strategy {
                 strategy: this
             });
             debugLogger.info({
-                msg: 'Token expired. Refreshing...',
-                refreshed,
-                refreshToken
+                msg: 'Token expired. Refreshing...'
             });
             if (refreshed) {
                 const verifyResult = await this.verify({
@@ -185,9 +179,7 @@ export class Strategy {
                 };
             } else {
                 debugLogger.info({
-                    msg: 'Token refresh failed',
-                    refreshed,
-                    refreshToken
+                    msg: 'Token refresh failed'
                 });
             }
         }
@@ -282,11 +274,11 @@ export class Strategy {
     }
     async jwtVerify({ payload, token }) {
         try {
-            const audience = payload.config.custom.figma.contentSystemId;
+            const audience = payload.config.custom.figma.environmentId;
             if (!audience) {
-                throw new Error('Cannot validate token audience: contentSystemId is not configured');
+                throw new Error('Cannot validate token audience: environmentId is not configured');
             }
-            const verified = await validateProjectToken({
+            const verified = await validatePayloadAdminToken({
                 audience,
                 environment: getInfraEnvironment(),
                 token

package/dist/oauth/utilities/establishSession.d.ts

@@ -5,8 +5,8 @@ interface Args {
     accessToken: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
-    contentSystemId: string;
     debugLogger: DebugLogger;
+    environmentId: string;
     pluginOptions: PluginOptions;
     /** From the IdP token response (`expires_in`); used as a refresh-cookie expiry fallback. */
     refreshTokenExpiresIn?: number;
@@ -15,8 +15,8 @@ interface Args {
 }
 /**
  * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
- * project token, and write the main + refresh + user-info cookies to
- * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
+ * Payload Admin token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the Admin token mint fails.
  */
-export declare const establishSession: ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy, }: Args) => Promise<void>;
+export declare const establishSession: ({ accessToken, collection, collectionOptions, debugLogger, environmentId, pluginOptions, refreshTokenExpiresIn, req, strategy, }: Args) => Promise<void>;
 export {};

package/dist/oauth/utilities/establishSession.js

@@ -1,13 +1,13 @@
 import { APIError, generateCookie } from 'payload';
-import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
+import { getPayloadAdminToken, getUserInfo } from '../../api/figma-api.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { getCookieExpiration } from './getCookieExpiration.js';
 import { withPartitionedCookie } from './withPartitionedCookie.js';
 /**
  * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
- * project token, and write the main + refresh + user-info cookies to
- * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
- */ export const establishSession = async ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy })=>{
+ * Payload Admin token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the Admin token mint fails.
+ */ export const establishSession = async ({ accessToken, collection, collectionOptions, debugLogger, environmentId, pluginOptions, refreshTokenExpiresIn, req, strategy })=>{
     const oauthCredential = {
         type: 'oauth',
         token: accessToken
@@ -17,7 +17,6 @@ import { withPartitionedCookie } from './withPartitionedCookie.js';
     try {
         figmaUserInfo = await getUserInfo(oauthCredential);
         debugLogger.info({
-            figmaUserInfo,
             msg: 'Fetched Figma user info'
         });
     } catch (err) {
@@ -26,9 +25,9 @@ import { withPartitionedCookie } from './withPartitionedCookie.js';
             msg: 'Failed to fetch Figma user info'
         });
     }
-    const projectToken = await getProjectToken(oauthCredential, contentSystemId);
-    if (!projectToken.token) {
-        const errMsg = 'No project token returned from Figma API';
+    const adminToken = await getPayloadAdminToken(oauthCredential, environmentId);
+    if (!adminToken.token) {
+        const errMsg = 'No Payload Admin token returned from Figma API';
         req.payload.logger.error({
             msg: errMsg
         });
@@ -54,13 +53,13 @@ import { withPartitionedCookie } from './withPartitionedCookie.js';
         });
         req.responseHeaders.append('Set-Cookie', withPartitionedCookie(refreshCookie));
     }
-    const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(projectToken.expiresAt);
+    const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(adminToken.expiresAt);
     const tokenCookie = generateCookie({
         ...cookieOptions,
         name: strategy.cookieName,
         expires: tokenExpires,
         returnCookieAsObject: false,
-        value: projectToken.token
+        value: adminToken.token
     });
     req.responseHeaders.append('Set-Cookie', withPartitionedCookie(tokenCookie));
     // Short-lived handoff cookie consumed by defaultVerify on the next request.

package/dist/oauth/utilities/refreshTokens.js

@@ -1,6 +1,6 @@
 import { generateCookie } from 'payload';
-import { getProjectToken } from '../../api/figma-api.js';
-import { validateProjectToken } from '../../auth/jwt-validator.js';
+import { getPayloadAdminToken } from '../../api/figma-api.js';
+import { validatePayloadAdminToken } from '../../auth/jwt-validator.js';
 import { getInfraEnvironment } from '../../constants.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { createDebugLogger } from './createDebugLogger.js';
@@ -16,15 +16,18 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
     // but refresh token is still valid
     // so we will refresh both tokens
     try {
-        // Get another project token
-        const { expiresAt, token } = await getProjectToken({
+        // Get another Payload Admin token.
+        const environmentId = payload.config.custom.figma.environmentId;
+        if (!environmentId) {
+            throw new Error('Cannot refresh Payload Admin token: environmentId is not configured');
+        }
+        const { expiresAt, token } = await getPayloadAdminToken({
             type: 'oauth',
             token: refreshToken
-        }, payload.config.custom.figma.contentSystemId);
+        }, environmentId);
         debugLogger.info({
             expiresAt,
-            msg: 'Received new tokens from Figma API',
-            token
+            msg: 'Received new Payload Admin token from Figma API'
         });
         // On error, no user
         if (!token) {
@@ -35,8 +38,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
         }
         if (token) {
             debugLogger.info({
-                msg: 'Successfully refreshed project token',
-                token
+                msg: 'Successfully refreshed Payload Admin token'
             });
             const expires_in = new Date(expiresAt);
             const cookieOptions = createCookieOptions({
@@ -52,12 +54,8 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
                 value: token
             });
             headers.append('Set-Cookie', withPartitionedCookie(tokenCookie));
-            const audience = payload.config.custom.figma.contentSystemId;
-            if (!audience) {
-                throw new Error('Cannot validate token audience: contentSystemId is not configured');
-            }
-            const decodedOauthToken = await validateProjectToken({
-                audience,
+            const decodedOauthToken = await validatePayloadAdminToken({
+                audience: environmentId,
                 environment: getInfraEnvironment(),
                 token
             });

package/dist/plugin/build-config.d.ts

@@ -47,6 +47,7 @@ export type FigmaConfig = {
 } & {
     figma: {
         contentSystemId?: string;
+        environmentId?: string;
         storage?: boolean;
         useContentSystem?: boolean;
     };