@payloadcms/figma 0.0.1-alpha.9 → 0.1.0-alpha.0

package/dist/plugin/build-config.js

@@ -1,26 +1,374 @@
+import { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage';
 import { lexicalEditor } from '@payloadcms/richtext-lexical';
 import { buildConfig as payloadBuildConfig } from 'payload';
+import { getBootstrapInfo } from '../api/control-plane.js';
+import { getValidCredential } from '../auth/oauth-flow.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { getEnvConfig } from '../constants.js';
+import { contentAPIAdapter } from '../db-content-api/index.js';
+import { scheduleExtractPlugin } from '../deploy/schedule-extract-plugin.js';
+import { health } from '../endpoints/health.js';
+import { schema } from '../endpoints/schema.js';
 import { oAuth2Plugin } from '../oauth/index.js';
-import { figmaContentSystem } from './adapter.js';
+import { createStorageClient } from '../storage-content-api/client.js';
+import { contentApiStorageAdapter } from '../storage-content-api/index.js';
+import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
+import { getEnvVarSync } from '../utils/env-management.js';
+import * as log from '../utils/log.js';
+import { logMissingCliAuth } from './auth-preflight.js';
+import { logMissingContentSystemId } from './bootstrap-preflight.js';
+import { getDevCookieNames } from './dev-cookie-names.js';
 /**
- * Figma platform wrapper for Payload's buildConfig.
- * Automatically injects:
- * - Figma database adapter
- * - Secret (platform-provided)
- * - Default lexicalEditor (if no custom editor specified)
+ * Worker-trusted marker injected by Figma's sites-worker after it validates the
+ * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
+ * `jobs.access.run` below honors this marker so Sinatra (async-job-workflow)
+ * can drive job runs without the bypass secret ever reaching tenant code.
  *
- * @param config - Payload configuration (db and secret omitted, editor optional)
- * @returns Promise<SanitizedConfig> - Built Payload configuration
- */ export async function buildConfig(config) {
+ * KEEP_IN_SYNC(cloudflare/wrangler/sites-worker/src/auth.ts): FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER
+ */ export const FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER = 'figma-internal-forwarded-has-auth-bypass';
+/**
+ * Fields added to users collection for Figma profile info
+ */ const figmaUserFields = [
+    {
+        name: 'figmaHandle',
+        type: 'text',
+        admin: {
+            readOnly: true
+        },
+        label: 'Name'
+    },
+    {
+        name: 'figmaImageUrl',
+        type: 'text',
+        admin: {
+            components: {
+                Cell: '@payloadcms/figma/client#FigmaAvatarCell'
+            },
+            disabled: {
+                bulkEdit: true
+            },
+            hidden: true,
+            readOnly: true
+        },
+        label: 'Profile Picture'
+    },
+    // Virtual (never persisted): populated per-request from the session JWT. The
+    // afterRead hook surfaces the claim on the requester's OWN user record only —
+    // a JWT describes its bearer, so these are meaningful for req.user, not for
+    // reads of other users. See defaults.ts (defaultVerify) which attaches the
+    // live claim to req.user.
+    {
+        name: 'userGroups',
+        type: 'text',
+        access: {
+            read: ({ id, req })=>req.user?.id === id
+        },
+        admin: {
+            readOnly: true
+        },
+        hasMany: true,
+        hooks: {
+            afterRead: [
+                ({ data, req })=>data?.id !== undefined && req.user?.id === data.id ? req.user.userGroups : undefined
+            ]
+        },
+        label: 'User Groups',
+        virtual: true
+    },
+    // KEEP_IN_SYNC(sinatra/controllers/api/api_payload_control_plane.rb) — resolve_make_permission
+    {
+        name: 'makePermission',
+        type: 'select',
+        access: {
+            read: ({ id, req })=>req.user?.id === id
+        },
+        admin: {
+            readOnly: true
+        },
+        hooks: {
+            afterRead: [
+                ({ data, req })=>data?.id !== undefined && req.user?.id === data.id ? req.user.makePermission : undefined
+            ]
+        },
+        label: 'Make Permission',
+        options: [
+            {
+                label: 'View',
+                value: 'view'
+            },
+            {
+                label: 'Edit',
+                value: 'edit'
+            }
+        ],
+        virtual: true
+    }
+];
+function missingOAuthCredential(name) {
+    log.warning(`${name} could not be resolved. OAuth login will not work until this is configured. ` + 'Run `npx @payloadcms/figma init` to set up your project.');
+    return '';
+}
+/**
+ * Fetch bootstrap data from the API and cache all environments locally.
+ * Returns the requested environment's data, or a typed failure reason.
+ */ async function resolveAndCacheBootstrap(store, projectId, environmentName) {
+    let credential;
+    try {
+        credential = await getValidCredential(store);
+    } catch (error) {
+        return {
+            ok: false,
+            reason: {
+                kind: 'network',
+                message: messageOf(error)
+            }
+        };
+    }
+    if (!credential) {
+        return {
+            ok: false,
+            reason: {
+                kind: 'unauthenticated'
+            }
+        };
+    }
+    try {
+        const bootstrapInfo = await getBootstrapInfo(credential, projectId);
+        cacheAllEnvironments(store, projectId, bootstrapInfo);
+    } catch (error) {
+        return {
+            ok: false,
+            reason: {
+                kind: 'network',
+                message: messageOf(error)
+            }
+        };
+    }
+    const data = store.getBootstrapData(projectId, environmentName);
+    if (!data) {
+        return {
+            ok: false,
+            reason: {
+                environmentName,
+                kind: 'environment-not-found',
+                projectId
+            }
+        };
+    }
+    return {
+        data,
+        ok: true
+    };
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : 'Unknown error';
+}
+/**
+ * Creates storage configuration for upload collections
+ */ function createStorageConfig(url, contentSystemId) {
+    const storageConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
+        baseUrl: url,
+        contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
+    } : process.env.FIGMA_DEV_JWT === 'true' ? {
+        auth: {
+            mode: 'devJwt'
+        },
+        baseUrl: url,
+        contentSystemId
+    } : {
+        auth: {
+            mode: 'tokenStore',
+            tokenStore: getTokenStore()
+        },
+        baseUrl: url,
+        contentSystemId
+    };
+    const adapter = contentApiStorageAdapter(storageConfig);
+    const storageClient = createStorageClient(storageConfig);
+    return {
+        adapter,
+        storageClient
+    };
+}
+/**
+ * Plugin that applies cloud storage configuration to all upload-enabled collections.
+ * Runs at the end of the plugin chain so it sees collections added by user plugins too.
+ */ function createStoragePlugin(url, contentSystemId) {
+    return (incomingConfig)=>{
+        const uploadCollections = (incomingConfig.collections || []).filter((c)=>c.upload);
+        if (uploadCollections.length === 0) {
+            return incomingConfig;
+        }
+        const { adapter } = createStorageConfig(url, contentSystemId);
+        const collectionsMap = uploadCollections.reduce((acc, c)=>{
+            acc[c.slug] = {
+                adapter,
+                disableLocalStorage: true
+            };
+            return acc;
+        }, {});
+        const storagePlugin = cloudStoragePlugin({
+            collections: collectionsMap
+        });
+        return storagePlugin(incomingConfig);
+    };
+}
+export async function buildFigmaConfig(config) {
+    const envConfig = getEnvConfig();
+    // Resolve contentSystemId: config first, env var, then local store fallback (dev)
+    let { contentSystemId } = config.figma;
+    let environmentId = config.figma.environmentId ?? process.env.FIGMA_EID;
+    contentSystemId ??= process.env.FIGMA_CONTENT_API_CONTENT_SYSTEM_ID;
+    let bootstrapData = null;
+    let bootstrapReason = null;
+    // Local dev: resolve from project ID + bootstrap cache
+    // Use getEnvVarSync fallback because Next.js evaluates config before dotenv populates process.env
+    if (!contentSystemId) {
+        const projectId = process.env.FIGMA_PROJECT_ID ?? getEnvVarSync(process.cwd(), 'FIGMA_PROJECT_ID');
+        const environmentName = process.env.FIGMA_ENVIRONMENT_NAME ?? getEnvVarSync(process.cwd(), 'FIGMA_ENVIRONMENT_NAME');
+        if (!projectId || !environmentName) {
+            bootstrapReason = {
+                kind: 'no-config'
+            };
+        } else {
+            const store = getTokenStore();
+            bootstrapData = store.getBootstrapData(projectId, environmentName);
+            // Runtime fallback: fetch from API if not cached (e.g. environment switch without re-init)
+            if (!bootstrapData) {
+                const resolution = await resolveAndCacheBootstrap(store, projectId, environmentName);
+                if (resolution.ok) {
+                    bootstrapData = resolution.data;
+                } else {
+                    bootstrapReason = resolution.reason;
+                }
+            }
+            if (bootstrapData) {
+                contentSystemId = bootstrapData.contentSystemId;
+                environmentId ??= bootstrapData.tenantInstanceId;
+            }
+        }
+    }
+    if (!environmentId) {
+        const projectId = process.env.FIGMA_PROJECT_ID ?? getEnvVarSync(process.cwd(), 'FIGMA_PROJECT_ID');
+        const environmentName = process.env.FIGMA_ENVIRONMENT_NAME ?? getEnvVarSync(process.cwd(), 'FIGMA_ENVIRONMENT_NAME');
+        if (projectId && environmentName) {
+            bootstrapData ??= getTokenStore().getBootstrapData(projectId, environmentName);
+            environmentId = bootstrapData?.tenantInstanceId;
+        }
+    }
+    if (!environmentId) {
+        throw new Error('Environment ID could not be resolved. Set FIGMA_EID or initialize the project.');
+    }
+    if (!contentSystemId) {
+        logMissingContentSystemId(bootstrapReason ?? {
+            kind: 'no-config'
+        });
+        throw new Error('Content System ID could not be resolved. ' + 'Run `npx @payloadcms/figma init` to set up your project.');
+    }
+    const url = process.env.FIGMA_CONTENT_API_URL || envConfig.contentApiUrl;
+    const isProduction = process.env.NODE_ENV === 'production';
+    // The deployed Lambda runs all queued jobs; locally there is no runner, so the db adapter logs
+    // a heads-up whenever a job is queued. Deployed environments set DISABLE_LOCAL_JOB_QUEUE_NOTIFICATIONS=true
+    // (injected by the control plane); end-users can also set it locally to silence the notice.
+    const notifyLocalJobQueue = process.env.DISABLE_LOCAL_JOB_QUEUE_NOTIFICATIONS !== 'true';
+    const usesTokenStoreAuth = !process.env.FIGMA_CONTENT_API_ACCESS_KEY && process.env.FIGMA_DEV_JWT !== 'true';
+    if (usesTokenStoreAuth) {
+        logMissingCliAuth(getTokenStore());
+    }
+    // Determine database adapter based on environment
+    let db;
+    if (config.figma.useContentSystem === false) {
+        db = config.db;
+    } else if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
+        db = contentAPIAdapter({
+            auth: {
+                apiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY,
+                mode: 'apiKey'
+            },
+            contentSystemId,
+            environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
+            url
+        });
+    } else if (process.env.FIGMA_DEV_JWT === 'true') {
+        db = contentAPIAdapter({
+            auth: {
+                mode: 'devJwt'
+            },
+            contentSystemId,
+            environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
+            url
+        });
+    } else {
+        db = contentAPIAdapter({
+            auth: {
+                mode: 'tokenStore',
+                tokenStore: getTokenStore()
+            },
+            contentSystemId,
+            environmentName: process.env.FIGMA_ENVIRONMENT_NAME,
+            notifyLocalJobQueue,
+            url
+        });
+    }
+    const userJobsAccessRun = config.jobs?.access?.run;
     // Build complete config with Figma platform defaults
     const configWithFigmaDefaults = {
         ...config,
-        db: config.figma.useContentSystem ? figmaContentSystem() : config.db,
+        admin: {
+            // Auto-refresh tokens before expiry to prevent unexpected logouts.
+            autoRefresh: true,
+            avatar: {
+                Component: '@payloadcms/figma/client#FigmaAvatar'
+            },
+            ...config.admin
+        },
+        custom: {
+            figma: {
+                ...config.figma,
+                contentSystemId,
+                environmentId
+            }
+        },
+        db,
         editor: config.editor ?? lexicalEditor(),
+        endpoints: [
+            ...config.endpoints ?? [],
+            health,
+            schema
+        ],
+        // Gate /api/payload-jobs/run and /api/payload-jobs/handle-schedules. Honor the
+        // sites-worker trust marker so Figma infra job runs never break, defer to the
+        // tenant's jobs.access.run if they set one, otherwise fall back to Payload's
+        // "logged-in user" default so the admin "Run jobs" UI keeps working.
+        jobs: {
+            ...config.jobs ?? {},
+            access: {
+                ...config.jobs?.access ?? {},
+                run: (args)=>{
+                    if (args.req.headers.get(FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER) === '1') {
+                        return true;
+                    }
+                    if (userJobsAccessRun) {
+                        return userJobsAccessRun(args);
+                    }
+                    return !!args.req.user;
+                }
+            }
+        },
+        ...isProduction && !config.logger ? {
+            logger: {
+                options: {}
+            }
+        } : {},
         secret: 'MY_SECRET',
         // Add oauth to plugins if not already present
         plugins: [
             ...config.plugins ?? [],
+            ...config.figma.storage !== false ? [
+                createStoragePlugin(url, contentSystemId)
+            ] : [],
             oAuth2Plugin({
                 collections: [
                     {
@@ -30,9 +378,9 @@ import { figmaContentSystem } from './adapter.js';
                             response_mode: 'query',
                             response_type: 'code'
                         },
-                        clientID: process.env.FIGMA_OAUTH_CLIENT_ID,
-                        clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,
-                        identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',
+                        clientID: process.env.FIGMA_OAUTH_CLIENT_ID ?? bootstrapData?.oauthClientId ?? missingOAuthCredential('FIGMA_OAUTH_CLIENT_ID'),
+                        clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET ?? bootstrapData?.oauthClientSecret,
+                        identityMetadata: envConfig.identityMetadata,
                         scope: [
                             'current_user:read'
                         ],
@@ -40,13 +388,29 @@ import { figmaContentSystem } from './adapter.js';
                         usernameField: 'email'
                     }
                 ],
+                ...isProduction ? {} : getDevCookieNames(contentSystemId),
                 debug: !!process.env.DEBUG,
                 disabled: false
-            })
+            }),
+            scheduleExtractPlugin()
         ]
     };
+    // Inject figma fields into users collection
+    const collections = configWithFigmaDefaults.collections?.map((col)=>{
+        if (col.slug === 'users') {
+            return {
+                ...col,
+                fields: [
+                    ...col.fields || [],
+                    ...figmaUserFields
+                ]
+            };
+        }
+        return col;
+    });
+    if (collections) {
+        configWithFigmaDefaults.collections = collections;
+    }
     // Delegate to Payload's buildConfig
     return await payloadBuildConfig(configWithFigmaDefaults);
 }
-
-//# sourceMappingURL=build-config.js.map

package/dist/plugin/dev-cookie-names.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Namespace OAuth cookies per-app in local dev so multiple Payload apps
+ * running on localhost (shared cookie jar across ports) don't clobber each
+ * other's sessions on logout. Uses projectId so the cookie stays stable when
+ * switching environments in the same checkout; falls back to contentSystemId
+ * when projectId isn't in `.env`.
+ *
+ * In production, cookies are isolated by unique hostnames and this is unused.
+ */
+export declare function getDevCookieNames(contentSystemId: string): {
+    cookieName: string;
+    userInfoCookieName: string;
+};

package/dist/plugin/dev-cookie-names.js

@@ -0,0 +1,17 @@
+import { getEnvVarSync } from '../utils/env-management.js';
+/**
+ * Namespace OAuth cookies per-app in local dev so multiple Payload apps
+ * running on localhost (shared cookie jar across ports) don't clobber each
+ * other's sessions on logout. Uses projectId so the cookie stays stable when
+ * switching environments in the same checkout; falls back to contentSystemId
+ * when projectId isn't in `.env`.
+ *
+ * In production, cookies are isolated by unique hostnames and this is unused.
+ */ export function getDevCookieNames(contentSystemId) {
+    const projectId = process.env.FIGMA_PROJECT_ID ?? getEnvVarSync(process.cwd(), 'FIGMA_PROJECT_ID') ?? contentSystemId;
+    const suffix = projectId.slice(0, 8);
+    return {
+        cookieName: `figma-${suffix}-oauth-token`,
+        userInfoCookieName: `figma-${suffix}-user-info`
+    };
+}

package/dist/scss.d.js

@@ -0,0 +1,2 @@
+// Side-effect SCSS imports in admin components carry styling only; declaring the
+// module lets the type checker accept them while SWC/copyfiles handle the assets.

package/dist/storage-content-api/api-types.d.ts

@@ -0,0 +1,183 @@
+/**
+ * Upload API types extracted from Content API OpenAPI spec.
+ * These are kept separate to avoid breaking changes when the main spec is regenerated.
+ */
+type UploadErrorResponse = {
+    content: {
+        'application/json': {
+            code?: string;
+            message: string;
+        };
+    };
+};
+type UploadErrorResponses = {
+    400: UploadErrorResponse;
+    401: UploadErrorResponse;
+    403: UploadErrorResponse;
+    404: UploadErrorResponse;
+    503: UploadErrorResponse;
+};
+export type UploadPaths = {
+    '/api/v0/uploads/{collectionId}/{filename}': {
+        delete: {
+            parameters: {
+                path: {
+                    collectionId: string;
+                    filename: string;
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            success: true;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/download/sign': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        expiresIn: number;
+                        filename: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            url: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    '/api/v0/uploads/multipart/abort': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        filename: string;
+                        uploadId: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            success: true;
+                        };
+                    };
+                };
+            } & UploadErrorResponses;
+        };
+    };
+    '/api/v0/uploads/multipart/complete': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        filename: string;
+                        parts: Array<{
+                            ETag: string;
+                            PartNumber: number;
+                        }>;
+                        uploadId: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            success: true;
+                        };
+                    };
+                };
+            } & UploadErrorResponses;
+        };
+    };
+    '/api/v0/uploads/multipart/initiate': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        contentType: string;
+                        filename: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            uploadId: string;
+                        };
+                    };
+                };
+            } & UploadErrorResponses;
+        };
+    };
+    '/api/v0/uploads/multipart/parts': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        expiresIn: number;
+                        filename: string;
+                        partNumbers: number[];
+                        uploadId: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            parts: Array<{
+                                partNumber: number;
+                                url: string;
+                            }>;
+                        };
+                    };
+                };
+            } & UploadErrorResponses;
+        };
+    };
+    '/api/v0/uploads/sign': {
+        post: {
+            requestBody: {
+                content: {
+                    'application/json': {
+                        collectionId: string;
+                        contentType?: string;
+                        expiresIn: number;
+                        filename: string;
+                    };
+                };
+            };
+            responses: {
+                200: {
+                    content: {
+                        'application/json': {
+                            url: string;
+                        };
+                    };
+                };
+            } & UploadErrorResponses;
+        };
+    };
+};
+export {};

package/dist/storage-content-api/api-types.js

@@ -0,0 +1,4 @@
+/**
+ * Upload API types extracted from Content API OpenAPI spec.
+ * These are kept separate to avoid breaking changes when the main spec is regenerated.
+ */ export { };

package/dist/storage-content-api/client-uploads/generate.d.ts

@@ -0,0 +1,14 @@
+import type { GenerateUploadInstructions, UploadInstructionsAccess } from 'payload';
+import type { StorageClient } from '../client.js';
+type Args = {
+    access?: UploadInstructionsAccess;
+    client: StorageClient;
+};
+/**
+ * v4 client-upload entry point. Payload core calls this from
+ * `POST /api/upload-instructions`; we sign a Content API upload URL and hand the
+ * browser an `http` PUT instruction plus an `uploadReference` that
+ * `handleUpload`/`staticHandler` use to recognize the already-uploaded file.
+ */
+export declare const getGenerateUploadInstructions: ({ access, client, }: Args) => GenerateUploadInstructions;
+export {};