@payloadcms/figma 0.0.1-alpha.8 → 0.1.0-alpha.0

package/dist/oauth/defaults.js

@@ -1,5 +1,20 @@
+import { parseCookies } from 'payload';
 import { v4 as uuid } from 'uuid';
 import { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js';
+import { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js';
+export const DEFAULT_USER_INFO_COOKIE_NAME = 'figma-user-info';
+function getFigmaUserInfo(headers, cookieName) {
+    try {
+        const cookies = parseCookies(headers);
+        const encoded = cookies.get(cookieName);
+        if (!encoded) {
+            return null;
+        }
+        return JSON.parse(Buffer.from(encoded, 'base64').toString('utf-8'));
+    } catch  {
+        return null;
+    }
+}
 export const defaultScope = [
     'openid',
     'profile',
@@ -14,7 +29,7 @@ export const defaultUsernameField = {
     },
     unique: true
 };
-export const defaultVerify = ({ collection, strategyName, usernameField })=>async ({ payload, token })=>{
+export const defaultVerify = ({ collection, strategyName, userInfoCookieName = DEFAULT_USER_INFO_COOKIE_NAME, usernameField })=>async ({ headers, payload, token })=>{
         let tokenUsername = 'preferred_username';
         if (usernameField.name !== 'preferredUsername') {
             tokenUsername = usernameField.name;
@@ -24,6 +39,16 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
                 user: null
             };
         }
+        const figmaUserInfo = getFigmaUserInfo(headers, userInfoCookieName);
+        let responseHeaders;
+        // Clear the cookie after reading
+        if (figmaUserInfo) {
+            responseHeaders = new Headers();
+            // SameSite=None; Secure; Partitioned so the clear matches the attributes
+            // the cookie was set with (establishSession) and actually removes it in the
+            // cross-site Make iframe.
+            responseHeaders.append('Set-Cookie', `${userInfoCookieName}=; Max-Age=0; Path=/; Secure; SameSite=None; Partitioned`);
+        }
         let user = null;
         const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined;
         try {
@@ -40,13 +65,19 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
             });
             if (results.docs.length > 0) {
                 user = results.docs[0];
-                // Update user with new token data
-                if (hasUserTokenPropsChanged(user, token)) {
+                // Check if update needed (token changed OR figma info missing/changed)
+                const userWithFigma = user;
+                const needsFigmaUpdate = figmaUserInfo && (userWithFigma.figmaHandle !== figmaUserInfo.handle || userWithFigma.figmaImageUrl !== figmaUserInfo.img_url);
+                if (hasUserTokenPropsChanged(user, token) || needsFigmaUpdate) {
                     user = await payload.update({
                         id: user.id,
                         collection: collection.slug,
                         data: {
-                            ...token
+                            ...token,
+                            ...figmaUserInfo && {
+                                figmaHandle: figmaUserInfo.handle,
+                                figmaImageUrl: figmaUserInfo.img_url
+                            }
                         },
                         depth
                     });
@@ -55,16 +86,43 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
                 const newUser = {
                     email: token.preferredUsername || token.email,
                     [usernameField.name]: token[tokenUsername],
-                    ...token
+                    ...token,
+                    ...figmaUserInfo && {
+                        figmaHandle: figmaUserInfo.handle,
+                        figmaImageUrl: figmaUserInfo.img_url
+                    }
                 };
                 if (typeof collection.auth === 'object' && !collection.auth.disableLocalStrategy) {
                     newUser.password = uuid();
                 }
-                user = await payload.create({
-                    collection: collection.slug,
-                    data: newUser,
-                    depth
-                });
+                try {
+                    user = await payload.create({
+                        collection: collection.slug,
+                        data: newUser,
+                        depth,
+                        overrideAccess: true
+                    });
+                } catch (createErr) {
+                    // Race condition: if unique constraint violation, user was created by concurrent request
+                    if (isDuplicateKeyError(createErr)) {
+                        const retryResults = await payload.find({
+                            collection: collection.slug,
+                            depth,
+                            limit: 1,
+                            pagination: false,
+                            where: {
+                                [usernameField.name]: {
+                                    equals: token[tokenUsername]
+                                }
+                            }
+                        });
+                        if (retryResults.docs.length > 0) {
+                            user = retryResults.docs[0];
+                        }
+                    } else {
+                        throw createErr;
+                    }
+                }
             }
         } catch (err) {
             payload.logger.error({
@@ -72,6 +130,7 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
                 msg: 'Error verifying user from defaultVerify.'
             });
             return {
+                responseHeaders,
                 user: null
             };
         }
@@ -79,13 +138,21 @@ export const defaultVerify = ({ collection, strategyName, usernameField })=>asyn
             user.collection = collection.slug;
             user._strategy = strategyName;
             user.exp = token.exp;
+            // userGroups/makePermission are virtual (never persisted). Surface the live
+            // JWT claims on the authenticated user for this request so access control
+            // and self-reads see current values. Claims are snake_case on the wire; the
+            // collection fields are camelCase. The field afterRead hooks
+            // (see build-config.ts) read these back off req.user.
+            const userWithFigmaClaims = user;
+            userWithFigmaClaims.userGroups = Array.isArray(token.user_groups) ? token.user_groups : undefined;
+            userWithFigmaClaims.makePermission = token.make_permission === 'edit' || token.make_permission === 'view' ? token.make_permission : undefined;
             return {
+                responseHeaders,
                 user
             };
         }
         return {
+            responseHeaders,
             user: null
         };
     };
-
-//# sourceMappingURL=defaults.js.map

package/dist/oauth/endpoints/getLoginEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -1,16 +1,17 @@
-import { APIError, generateCookie, parseCookies } from 'payload';
-import { getSafeRedirect } from 'payload/shared';
-import { getProjectToken } from '../../api/figma-api.js';
-import { createCookieOptions } from '../utilities/createCookieOptions.js';
+import { APIError, parseCookies } from 'payload';
+import { formatAdminURL, getSafeRedirect } from 'payload/shared';
+import { FigmaApiError } from '../../api/figma-api.js';
+import { buildUnauthorizedRedirect } from '../utilities/buildUnauthorizedRedirect.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { establishSession } from '../utilities/establishSession.js';
+import { exchangeCodeForAccessToken } from '../utilities/exchangeCodeForAccessToken.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
-import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
-const isAbsoluteURL = (url)=>/^[a-z][a-z\d+.-]*:/.test(url);
+import { buildCsrfCookieClearHeader, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
+import { isAbsoluteURL } from '../utilities/isAbsoluteURL.js';
 export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const { config } = req.payload;
-            const adminPath = getAdminPath(config);
+            const adminRoute = config.routes?.admin || '/admin';
             try {
                 await strategy.ensureMeta();
                 const path = req.pathname;
@@ -37,9 +38,26 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                 }
                 const stateRaw = jsonBody.state;
                 const state = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'));
-                const redirectDestination = state.serverURL || pluginOptions.redirectServerURL || config.serverURL;
-                let failedRedirect = `${redirectDestination}${adminPath}/login`;
-                let redirectToUse = `${redirectDestination}${adminPath}`;
+                // Resolve the post-login redirect base. This MUST match the precedence
+                // used when the OAuth `redirect_uri` is minted at `/meta`
+                // (`getAuthorizeURL`: redirectServerURL → config.serverURL →
+                // state.serverURL). `state.serverURL` is the iframe's untrusted
+                // `window.location.origin` (a `/meta` query param), so it must rank
+                // LAST: trusting it first lets the redirect target diverge from the
+                // server-configured origin — in the Make preview that origin is http
+                // (mixed content) and, more visibly, it isn't in Payload's auto-derived
+                // `config.csrf` allowlist (sanitizeConfig pushes `config.serverURL`),
+                // so the CSRF origin check below 403s the callback.
+                const redirectServerURL = pluginOptions.redirectServerURL || config.serverURL || state.serverURL;
+                let failedRedirect = formatAdminURL({
+                    adminRoute,
+                    path: '/login',
+                    serverURL: redirectServerURL
+                });
+                let redirectToUse = formatAdminURL({
+                    adminRoute,
+                    serverURL: redirectServerURL
+                });
                 if (state.redirect) {
                     redirectToUse = state.redirect;
                 }
@@ -93,6 +111,16 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     req.payload.logger.error('Signature mismatch. Failing login and redirecting.');
                     return Response.redirect(failedRedirect);
                 }
+                // Verify CSRF cookie matches the nonce baked into state at /meta time.
+                // This is the browser-binding required by RFC 6749 §10.12 — without
+                // it, an attacker who mints (code, state) via /meta + consent could
+                // replay them into a victim's browser by URL.
+                const cookies = parseCookies(req.headers);
+                const cookieCsrf = cookies.get(OAUTH_STATE_CSRF_COOKIE_NAME);
+                if (!cookieCsrf || cookieCsrf !== state.csrf) {
+                    req.payload.logger.error('CSRF cookie mismatch. Failing login and redirecting.');
+                    return Response.redirect(failedRedirect);
+                }
                 if (!strategy.meta?.token_endpoint) {
                     debugLogger.error({
                         msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,
@@ -121,57 +149,26 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                const body = {
-                    client_id: strategy.clientID,
-                    code,
-                    code_verifier: req.payload.decrypt(state.verifier),
-                    grant_type: 'authorization_code',
-                    redirect_uri: `${redirectDestination}${config?.routes?.api || '/api'}/${collection.slug}/${endpointSlug}/login`
-                };
+                const redirectUri = formatAdminURL({
+                    apiRoute: config.routes?.api || '/api',
+                    path: `/${collection.slug}/${endpointSlug}/login`,
+                    serverURL: redirectServerURL
+                });
                 debugLogger.info({
                     msg: 'Exchanging code for access token',
-                    path,
-                    requestBody: body
+                    path
                 });
-                if (strategy.clientSecret) {
-                    body.client_secret = strategy.clientSecret;
-                }
-                const tokenRes = await fetch(strategy.meta?.token_endpoint, {
-                    body: new URLSearchParams(body),
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    },
-                    method: 'POST'
-                }).then((r)=>r.json());
-                debugLogger.info({
-                    msg: 'Token Response',
-                    path,
-                    tokenRes
+                const tokenRes = await exchangeCodeForAccessToken({
+                    code,
+                    codeVerifier: req.payload.decrypt(state.verifier),
+                    redirectUri,
+                    strategy
                 });
-                const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
                 debugLogger.info({
-                    msg: 'tokenResss',
-                    tokenRes
-                });
-                // Swap for project token
-                const project_token = await getProjectToken(tokenRes.access_token, 'someproject');
-                const refresh_token = access_token;
-                // Store project token as access_token
-                const token = project_token.token;
-                const expiresIn = project_token.expiresAt;
-                if (!token) {
-                    const errMsg = `No ${collectionOptions.token || 'access_token'} was returned from the identity provider.`;
-                    req.payload.logger.error({
-                        msg: errMsg,
-                        path
-                    });
-                    throw new APIError(errMsg);
-                }
-                const cookieOptions = createCookieOptions({
-                    collection,
-                    headers: req.headers,
-                    pluginOptions
+                    msg: 'Received token response',
+                    path
                 });
+                const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
                 if (error) {
                     req.payload.logger.error('Error swapping access code with access token:');
                     req.payload.logger.error({
@@ -180,42 +177,50 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                // get the payloadRedirect cookie value
-                const cookies = parseCookies(req.headers);
-                const payloadRedirect = 'payloadRedirect' in cookies ? cookies.payloadRedirect : '';
+                if (!access_token) {
+                    const errMsg = 'No access_token was returned from the identity provider.';
+                    req.payload.logger.error({
+                        msg: errMsg,
+                        path
+                    });
+                    throw new APIError(errMsg);
+                }
+                const payloadRedirect = cookies.get('payloadRedirect') ?? '';
                 if (!req.responseHeaders) {
                     req.responseHeaders = new Headers();
                 }
+                // Clear the CSRF cookie now that the flow has completed — the nonce
+                // is single-use; leaving it around lets a replay try again.
+                req.responseHeaders.append('Set-Cookie', buildCsrfCookieClearHeader());
                 if (payloadRedirect) {
                     if (isAbsoluteURL(payloadRedirect)) {
                         redirectToUse = payloadRedirect;
                     } else {
                         redirectToUse += payloadRedirect;
                     }
-                    req.responseHeaders.append('Set-Cookie', `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`);
-                }
-                if (refresh_token && !collectionOptions.usePayloadJWT) {
-                    debugLogger.info('Setting refresh token cookie');
-                    const refreshCookie = generateCookie({
-                        returnCookieAsObject: false,
-                        ...cookieOptions,
-                        name: `${strategy.cookieName}-refresh`,
-                        value: refresh_token,
-                        // Default to 1 year if no expiration
-                        expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952)
+                    req.responseHeaders.append('Set-Cookie', // Match the attributes the cookie was set with so the clear removes it
+                    // in the cross-site Make iframe.
+                    `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/; Secure; SameSite=None; Partitioned`);
+                }
+                try {
+                    await establishSession({
+                        accessToken: access_token,
+                        collection,
+                        collectionOptions,
+                        debugLogger,
+                        environmentId: config.custom.figma.environmentId,
+                        pluginOptions,
+                        refreshTokenExpiresIn: refreshTokenExpires,
+                        req,
+                        strategy
                     });
-                    req.responseHeaders.append('Set-Cookie', refreshCookie);
-                }
-                const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(expiresIn) // Project token uses epoch time
-                ;
-                const tokenCookie = generateCookie({
-                    ...cookieOptions,
-                    name: strategy.cookieName,
-                    expires: tokenExpires,
-                    returnCookieAsObject: false,
-                    value: token
-                });
-                req.responseHeaders.append('Set-Cookie', tokenCookie);
+                } catch (err) {
+                    // The admin-token endpoint returns 403 when the user cannot access this environment.
+                    if (err instanceof FigmaApiError && err.statusCode === 403) {
+                        return buildUnauthorizedRedirect(config);
+                    }
+                    throw err;
+                }
                 return Response.redirect(redirectToUse);
             } catch (err) {
                 req.payload.logger.error({
@@ -233,5 +238,3 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
         method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',
         path: `/${endpointSlug}/login`
     });
-
-//# sourceMappingURL=getLoginEndpoint.js.map

package/dist/oauth/endpoints/getLogoutEndpoint.d.ts

@@ -9,4 +9,3 @@ interface Args {
 }
 export declare const getLogoutEndpoint: ({ collection, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getLogoutEndpoint.d.ts.map

package/dist/oauth/endpoints/getLogoutEndpoint.js

@@ -1,9 +1,9 @@
 import jwt from 'jsonwebtoken';
 import { parseCookies } from 'payload';
+import { formatAdminURL } from 'payload/shared';
 import { clearCookie } from '../utilities/clearCookie.js';
 import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
 export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
@@ -23,12 +23,15 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
             }
             try {
                 await strategy.ensureMeta();
-                const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL;
-                let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`;
+                const redirectServerlURL = pluginOptions.redirectServerURL || config.serverURL;
+                let successfulLogoutRedirectDest = formatAdminURL({
+                    adminRoute: config.routes?.admin || '/admin',
+                    serverURL: redirectServerlURL
+                });
                 if (typeof req.query.redirect === 'string') {
                     successfulLogoutRedirectDest = req.query.redirect;
                 }
-                if (!baseRedirectDestination && !req.query.redirect) {
+                if (!redirectServerlURL && !req.query.redirect) {
                     debugLogger.error({
                         msg: 'No redirect URL provided',
                         path: req.pathname
@@ -95,5 +98,3 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
         method: 'get',
         path: `/${endpointSlug}/logout`
     });
-
-//# sourceMappingURL=getLogoutEndpoint.js.map

package/dist/oauth/endpoints/getMetaEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getMetaEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getMetaEndpoint.d.ts.map

package/dist/oauth/endpoints/getMetaEndpoint.js

@@ -1,10 +1,18 @@
-import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+import { parseCookies } from 'payload';
+import { buildCsrfCookieHeader, getAuthorizeURL, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
-            const authorizeURL = await getAuthorizeURL({
+            // Reuse the CSRF nonce from the existing cookie if one is set. Makes
+            // `/meta` idempotent: a second call from the same browser (Strict Mode
+            // re-mount, retry, multi-tab) returns the SAME state.csrf, so the
+            // cookie never has to change after the first call — no last-write-wins
+            // race between the cookie and the iframe's already-captured state.
+            const existingCsrfNonce = parseCookies(req.headers).get(OAUTH_STATE_CSRF_COOKIE_NAME);
+            const { authorizeURL, csrfNonce, params } = await getAuthorizeURL({
                 collection,
                 collectionOptions,
                 endpointSlug,
+                existingCsrfNonce,
                 failedRedirect: req.query.failedRedirect,
                 payload: req.payload,
                 pluginOptions,
@@ -12,8 +20,15 @@ export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, p
                 serverURLOverride: req.query.serverURL,
                 strategy
             });
+            if (!req.responseHeaders) {
+                req.responseHeaders = new Headers();
+            }
+            // Always re-emit Set-Cookie — when reusing, this just refreshes Max-Age
+            // so long-lived tabs don't expire the cookie mid-consent.
+            req.responseHeaders.append('Set-Cookie', buildCsrfCookieHeader(csrfNonce));
             return Response.json({
-                authorizeURL
+                authorizeURL,
+                params
             }, {
                 status: 200
             });
@@ -21,5 +36,3 @@ export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, p
         method: 'get',
         path: `/${endpointSlug}/meta`
     });
-
-//# sourceMappingURL=getMetaEndpoint.js.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getRedirectToLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getRedirectToLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.js

@@ -1,10 +1,15 @@
-import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+import { parseCookies } from 'payload';
+import { buildCsrfCookieHeader, getAuthorizeURL, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
-            const authorizeURL = await getAuthorizeURL({
+            // Reuse the CSRF nonce from the existing cookie if one is set. See
+            // getMetaEndpoint.ts for the idempotency rationale.
+            const existingCsrfNonce = parseCookies(req.headers).get(OAUTH_STATE_CSRF_COOKIE_NAME);
+            const { authorizeURL, csrfNonce } = await getAuthorizeURL({
                 collection,
                 collectionOptions,
                 endpointSlug,
+                existingCsrfNonce,
                 failedRedirect: req.query.failedRedirect,
                 payload: req.payload,
                 pluginOptions,
@@ -12,10 +17,12 @@ export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endp
                 serverURLOverride: req.query.serverURL,
                 strategy
             });
+            if (!req.responseHeaders) {
+                req.responseHeaders = new Headers();
+            }
+            req.responseHeaders.append('Set-Cookie', buildCsrfCookieHeader(csrfNonce));
             return Response.redirect(authorizeURL);
         },
         method: 'get',
         path: `/${endpointSlug}/login`
     });
-
-//# sourceMappingURL=getRedirectToLoginEndpoint.js.map

package/dist/oauth/exports/client.d.ts

@@ -1,3 +1,2 @@
 export { DefaultLoginButton } from '../components/LoginButton/index.jsx';
 export { LogoutButton } from '../components/LogoutButton/index.jsx';
-//# sourceMappingURL=client.d.ts.map

package/dist/oauth/exports/client.js

@@ -1,4 +1,2 @@
 export { DefaultLoginButton } from '../components/LoginButton/index.jsx';
 export { LogoutButton } from '../components/LogoutButton/index.jsx';
-
-//# sourceMappingURL=client.js.map

package/dist/oauth/hooks/afterLogout.d.ts

@@ -5,4 +5,3 @@ export declare const getAfterLogout: ({ collection, cookieName, pluginOptions, }
     cookieName: string;
     pluginOptions: PluginOptions;
 }) => CollectionAfterLogoutHook;
-//# sourceMappingURL=afterLogout.d.ts.map

package/dist/oauth/hooks/afterLogout.js

@@ -23,5 +23,3 @@ export const getAfterLogout = ({ collection, cookieName, pluginOptions })=>({ re
             req
         });
     };
-
-//# sourceMappingURL=afterLogout.js.map

package/dist/oauth/hooks/me.d.ts

@@ -2,4 +2,3 @@ import { type CollectionMeHook } from 'payload';
 export declare const getMeHook: ({ cookieName }: {
     cookieName: string;
 }) => CollectionMeHook;
-//# sourceMappingURL=me.d.ts.map

package/dist/oauth/hooks/me.js

@@ -51,5 +51,3 @@ export const getMeHook = ({ cookieName })=>// eslint-disable-next-line @typescri
         }
         return undefined;
     };
-
-//# sourceMappingURL=me.js.map

package/dist/oauth/hooks/refresh.d.ts

@@ -5,4 +5,3 @@ export declare const getRefreshHook: ({ pluginOptions, strategy, }: {
     pluginOptions: PluginOptions;
     strategy: Strategy;
 }) => CollectionRefreshHook;
-//# sourceMappingURL=refresh.d.ts.map

package/dist/oauth/hooks/refresh.js

@@ -6,6 +6,7 @@ import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
 import { mergeHeaders } from '../utilities/mergeHeaders.js';
 import { refreshTokens } from '../utilities/refreshTokens.js';
+import { withPartitionedCookie } from '../utilities/withPartitionedCookie.js';
 export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user })=>{
         if (!args.req.responseHeaders) {
             args.req.responseHeaders = new Headers();
@@ -47,7 +48,7 @@ export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user
                     }) ?? 31_556_952),
                     value: refreshedToken
                 });
-                args.req.responseHeaders.append('Set-Cookie', refreshCookie);
+                args.req.responseHeaders.append('Set-Cookie', withPartitionedCookie(refreshCookie));
                 const newDecoded = jwt.decode(refreshedToken);
                 strategy.debugLog('usePayloadJWT: true - Received new refresh token', {
                     newDecoded,
@@ -87,5 +88,3 @@ export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user
         }
         return undefined;
     };
-
-//# sourceMappingURL=refresh.js.map

package/dist/oauth/index.d.ts

@@ -1,4 +1,3 @@
 import type { Plugin } from 'payload';
 import type { PluginOptions } from './types.js';
 export declare const oAuth2Plugin: (pluginOptions: PluginOptions) => Plugin;
-//# sourceMappingURL=index.d.ts.map