@payloadcms/figma 0.0.1-alpha.9 → 0.1.0-alpha.1

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -1,16 +1,17 @@
-import { APIError, generateCookie, parseCookies } from 'payload';
-import { getSafeRedirect } from 'payload/shared';
-import { getProjectToken } from '../../api/figma-api.js';
-import { createCookieOptions } from '../utilities/createCookieOptions.js';
+import { APIError, parseCookies } from 'payload';
+import { formatAdminURL, getSafeRedirect } from 'payload/shared';
+import { FigmaApiError } from '../../api/figma-api.js';
+import { buildUnauthorizedRedirect } from '../utilities/buildUnauthorizedRedirect.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
+import { establishSession } from '../utilities/establishSession.js';
+import { exchangeCodeForAccessToken } from '../utilities/exchangeCodeForAccessToken.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
-import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
-const isAbsoluteURL = (url)=>/^[a-z][a-z\d+.-]*:/.test(url);
+import { buildCsrfCookieClearHeader, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
+import { isAbsoluteURL } from '../utilities/isAbsoluteURL.js';
 export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const { config } = req.payload;
-            const adminPath = getAdminPath(config);
+            const adminRoute = config.routes?.admin || '/admin';
             try {
                 await strategy.ensureMeta();
                 const path = req.pathname;
@@ -37,9 +38,26 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                 }
                 const stateRaw = jsonBody.state;
                 const state = JSON.parse(Buffer.from(stateRaw, 'base64').toString('utf-8'));
-                const redirectDestination = state.serverURL || pluginOptions.redirectServerURL || config.serverURL;
-                let failedRedirect = `${redirectDestination}${adminPath}/login`;
-                let redirectToUse = `${redirectDestination}${adminPath}`;
+                // Resolve the post-login redirect base. This MUST match the precedence
+                // used when the OAuth `redirect_uri` is minted at `/meta`
+                // (`getAuthorizeURL`: redirectServerURL → config.serverURL →
+                // state.serverURL). `state.serverURL` is the iframe's untrusted
+                // `window.location.origin` (a `/meta` query param), so it must rank
+                // LAST: trusting it first lets the redirect target diverge from the
+                // server-configured origin — in the Make preview that origin is http
+                // (mixed content) and, more visibly, it isn't in Payload's auto-derived
+                // `config.csrf` allowlist (sanitizeConfig pushes `config.serverURL`),
+                // so the CSRF origin check below 403s the callback.
+                const redirectServerURL = pluginOptions.redirectServerURL || config.serverURL || state.serverURL;
+                let failedRedirect = formatAdminURL({
+                    adminRoute,
+                    path: '/login',
+                    serverURL: redirectServerURL
+                });
+                let redirectToUse = formatAdminURL({
+                    adminRoute,
+                    serverURL: redirectServerURL
+                });
                 if (state.redirect) {
                     redirectToUse = state.redirect;
                 }
@@ -93,6 +111,16 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     req.payload.logger.error('Signature mismatch. Failing login and redirecting.');
                     return Response.redirect(failedRedirect);
                 }
+                // Verify CSRF cookie matches the nonce baked into state at /meta time.
+                // This is the browser-binding required by RFC 6749 §10.12 — without
+                // it, an attacker who mints (code, state) via /meta + consent could
+                // replay them into a victim's browser by URL.
+                const cookies = parseCookies(req.headers);
+                const cookieCsrf = cookies.get(OAUTH_STATE_CSRF_COOKIE_NAME);
+                if (!cookieCsrf || cookieCsrf !== state.csrf) {
+                    req.payload.logger.error('CSRF cookie mismatch. Failing login and redirecting.');
+                    return Response.redirect(failedRedirect);
+                }
                 if (!strategy.meta?.token_endpoint) {
                     debugLogger.error({
                         msg: `No metadata was obtained from the identity provider. Failing login and redirecting.`,
@@ -121,57 +149,26 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                const body = {
-                    client_id: strategy.clientID,
-                    code,
-                    code_verifier: req.payload.decrypt(state.verifier),
-                    grant_type: 'authorization_code',
-                    redirect_uri: `${redirectDestination}${config?.routes?.api || '/api'}/${collection.slug}/${endpointSlug}/login`
-                };
+                const redirectUri = formatAdminURL({
+                    apiRoute: config.routes?.api || '/api',
+                    path: `/${collection.slug}/${endpointSlug}/login`,
+                    serverURL: redirectServerURL
+                });
                 debugLogger.info({
                     msg: 'Exchanging code for access token',
-                    path,
-                    requestBody: body
+                    path
                 });
-                if (strategy.clientSecret) {
-                    body.client_secret = strategy.clientSecret;
-                }
-                const tokenRes = await fetch(strategy.meta?.token_endpoint, {
-                    body: new URLSearchParams(body),
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    },
-                    method: 'POST'
-                }).then((r)=>r.json());
-                debugLogger.info({
-                    msg: 'Token Response',
-                    path,
-                    tokenRes
+                const tokenRes = await exchangeCodeForAccessToken({
+                    code,
+                    codeVerifier: req.payload.decrypt(state.verifier),
+                    redirectUri,
+                    strategy
                 });
-                const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
                 debugLogger.info({
-                    msg: 'tokenResss',
-                    tokenRes
-                });
-                // Swap for project token
-                const project_token = await getProjectToken(tokenRes.access_token, 'someproject');
-                const refresh_token = access_token;
-                // Store project token as access_token
-                const token = project_token.token;
-                const expiresIn = project_token.expiresAt;
-                if (!token) {
-                    const errMsg = `No ${collectionOptions.token || 'access_token'} was returned from the identity provider.`;
-                    req.payload.logger.error({
-                        msg: errMsg,
-                        path
-                    });
-                    throw new APIError(errMsg);
-                }
-                const cookieOptions = createCookieOptions({
-                    collection,
-                    headers: req.headers,
-                    pluginOptions
+                    msg: 'Received token response',
+                    path
                 });
+                const { access_token, error, error_description, expires_in: refreshTokenExpires } = tokenRes;
                 if (error) {
                     req.payload.logger.error('Error swapping access code with access token:');
                     req.payload.logger.error({
@@ -180,42 +177,50 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     });
                     return Response.redirect(failedRedirect);
                 }
-                // get the payloadRedirect cookie value
-                const cookies = parseCookies(req.headers);
-                const payloadRedirect = 'payloadRedirect' in cookies ? cookies.payloadRedirect : '';
+                if (!access_token) {
+                    const errMsg = 'No access_token was returned from the identity provider.';
+                    req.payload.logger.error({
+                        msg: errMsg,
+                        path
+                    });
+                    throw new APIError(errMsg);
+                }
+                const payloadRedirect = cookies.get('payloadRedirect') ?? '';
                 if (!req.responseHeaders) {
                     req.responseHeaders = new Headers();
                 }
+                // Clear the CSRF cookie now that the flow has completed — the nonce
+                // is single-use; leaving it around lets a replay try again.
+                req.responseHeaders.append('Set-Cookie', buildCsrfCookieClearHeader());
                 if (payloadRedirect) {
                     if (isAbsoluteURL(payloadRedirect)) {
                         redirectToUse = payloadRedirect;
                     } else {
                         redirectToUse += payloadRedirect;
                     }
-                    req.responseHeaders.append('Set-Cookie', `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`);
-                }
-                if (refresh_token && !collectionOptions.usePayloadJWT) {
-                    debugLogger.info('Setting refresh token cookie');
-                    const refreshCookie = generateCookie({
-                        returnCookieAsObject: false,
-                        ...cookieOptions,
-                        name: `${strategy.cookieName}-refresh`,
-                        value: refresh_token,
-                        // Default to 1 year if no expiration
-                        expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpires ?? 31_556_952)
+                    req.responseHeaders.append('Set-Cookie', // Match the attributes the cookie was set with so the clear removes it
+                    // in the cross-site Make iframe.
+                    `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/; Secure; SameSite=None; Partitioned`);
+                }
+                try {
+                    await establishSession({
+                        accessToken: access_token,
+                        collection,
+                        collectionOptions,
+                        debugLogger,
+                        environmentId: config.custom.figma.environmentId,
+                        pluginOptions,
+                        refreshTokenExpiresIn: refreshTokenExpires,
+                        req,
+                        strategy
                     });
-                    req.responseHeaders.append('Set-Cookie', refreshCookie);
-                }
-                const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(expiresIn) // Project token uses epoch time
-                ;
-                const tokenCookie = generateCookie({
-                    ...cookieOptions,
-                    name: strategy.cookieName,
-                    expires: tokenExpires,
-                    returnCookieAsObject: false,
-                    value: token
-                });
-                req.responseHeaders.append('Set-Cookie', tokenCookie);
+                } catch (err) {
+                    // The admin-token endpoint returns 403 when the user cannot access this environment.
+                    if (err instanceof FigmaApiError && err.statusCode === 403) {
+                        return buildUnauthorizedRedirect(config);
+                    }
+                    throw err;
+                }
                 return Response.redirect(redirectToUse);
             } catch (err) {
                 req.payload.logger.error({
@@ -233,5 +238,3 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
         method: collectionOptions.authorizationURLParams?.response_mode === 'query' ? 'get' : 'post',
         path: `/${endpointSlug}/login`
     });
-
-//# sourceMappingURL=getLoginEndpoint.js.map

package/dist/oauth/endpoints/getLogoutEndpoint.d.ts

@@ -9,4 +9,3 @@ interface Args {
 }
 export declare const getLogoutEndpoint: ({ collection, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getLogoutEndpoint.d.ts.map

package/dist/oauth/endpoints/getLogoutEndpoint.js

@@ -1,9 +1,9 @@
 import jwt from 'jsonwebtoken';
 import { parseCookies } from 'payload';
+import { formatAdminURL } from 'payload/shared';
 import { clearCookie } from '../utilities/clearCookie.js';
 import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
 export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
@@ -23,12 +23,15 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
             }
             try {
                 await strategy.ensureMeta();
-                const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL;
-                let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`;
+                const redirectServerlURL = pluginOptions.redirectServerURL || config.serverURL;
+                let successfulLogoutRedirectDest = formatAdminURL({
+                    adminRoute: config.routes?.admin || '/admin',
+                    serverURL: redirectServerlURL
+                });
                 if (typeof req.query.redirect === 'string') {
                     successfulLogoutRedirectDest = req.query.redirect;
                 }
-                if (!baseRedirectDestination && !req.query.redirect) {
+                if (!redirectServerlURL && !req.query.redirect) {
                     debugLogger.error({
                         msg: 'No redirect URL provided',
                         path: req.pathname
@@ -95,5 +98,3 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
         method: 'get',
         path: `/${endpointSlug}/logout`
     });
-
-//# sourceMappingURL=getLogoutEndpoint.js.map

package/dist/oauth/endpoints/getMetaEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getMetaEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getMetaEndpoint.d.ts.map

package/dist/oauth/endpoints/getMetaEndpoint.js

@@ -1,10 +1,18 @@
-import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+import { parseCookies } from 'payload';
+import { buildCsrfCookieHeader, getAuthorizeURL, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
-            const authorizeURL = await getAuthorizeURL({
+            // Reuse the CSRF nonce from the existing cookie if one is set. Makes
+            // `/meta` idempotent: a second call from the same browser (Strict Mode
+            // re-mount, retry, multi-tab) returns the SAME state.csrf, so the
+            // cookie never has to change after the first call — no last-write-wins
+            // race between the cookie and the iframe's already-captured state.
+            const existingCsrfNonce = parseCookies(req.headers).get(OAUTH_STATE_CSRF_COOKIE_NAME);
+            const { authorizeURL, csrfNonce, params } = await getAuthorizeURL({
                 collection,
                 collectionOptions,
                 endpointSlug,
+                existingCsrfNonce,
                 failedRedirect: req.query.failedRedirect,
                 payload: req.payload,
                 pluginOptions,
@@ -12,8 +20,15 @@ export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, p
                 serverURLOverride: req.query.serverURL,
                 strategy
             });
+            if (!req.responseHeaders) {
+                req.responseHeaders = new Headers();
+            }
+            // Always re-emit Set-Cookie — when reusing, this just refreshes Max-Age
+            // so long-lived tabs don't expire the cookie mid-consent.
+            req.responseHeaders.append('Set-Cookie', buildCsrfCookieHeader(csrfNonce));
             return Response.json({
-                authorizeURL
+                authorizeURL,
+                params
             }, {
                 status: 200
             });
@@ -21,5 +36,3 @@ export const getMetaEndpoint = ({ collection, collectionOptions, endpointSlug, p
         method: 'get',
         path: `/${endpointSlug}/meta`
     });
-
-//# sourceMappingURL=getMetaEndpoint.js.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.d.ts

@@ -10,4 +10,3 @@ interface Args {
 }
 export declare const getRedirectToLoginEndpoint: ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy, }: Args) => Endpoint;
 export {};
-//# sourceMappingURL=getRedirectToLoginEndpoint.d.ts.map

package/dist/oauth/endpoints/getRedirectToLoginEndpoint.js

@@ -1,10 +1,15 @@
-import { getAuthorizeURL } from '../utilities/getAuthorizeURL.js';
+import { parseCookies } from 'payload';
+import { buildCsrfCookieHeader, getAuthorizeURL, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
-            const authorizeURL = await getAuthorizeURL({
+            // Reuse the CSRF nonce from the existing cookie if one is set. See
+            // getMetaEndpoint.ts for the idempotency rationale.
+            const existingCsrfNonce = parseCookies(req.headers).get(OAUTH_STATE_CSRF_COOKIE_NAME);
+            const { authorizeURL, csrfNonce } = await getAuthorizeURL({
                 collection,
                 collectionOptions,
                 endpointSlug,
+                existingCsrfNonce,
                 failedRedirect: req.query.failedRedirect,
                 payload: req.payload,
                 pluginOptions,
@@ -12,10 +17,12 @@ export const getRedirectToLoginEndpoint = ({ collection, collectionOptions, endp
                 serverURLOverride: req.query.serverURL,
                 strategy
             });
+            if (!req.responseHeaders) {
+                req.responseHeaders = new Headers();
+            }
+            req.responseHeaders.append('Set-Cookie', buildCsrfCookieHeader(csrfNonce));
             return Response.redirect(authorizeURL);
         },
         method: 'get',
         path: `/${endpointSlug}/login`
     });
-
-//# sourceMappingURL=getRedirectToLoginEndpoint.js.map

package/dist/oauth/exports/client.d.ts

@@ -1,3 +1,2 @@
 export { DefaultLoginButton } from '../components/LoginButton/index.jsx';
 export { LogoutButton } from '../components/LogoutButton/index.jsx';
-//# sourceMappingURL=client.d.ts.map

package/dist/oauth/exports/client.js

@@ -1,4 +1,2 @@
 export { DefaultLoginButton } from '../components/LoginButton/index.jsx';
 export { LogoutButton } from '../components/LogoutButton/index.jsx';
-
-//# sourceMappingURL=client.js.map

package/dist/oauth/hooks/afterLogout.d.ts

@@ -5,4 +5,3 @@ export declare const getAfterLogout: ({ collection, cookieName, pluginOptions, }
     cookieName: string;
     pluginOptions: PluginOptions;
 }) => CollectionAfterLogoutHook;
-//# sourceMappingURL=afterLogout.d.ts.map

package/dist/oauth/hooks/afterLogout.js

@@ -23,5 +23,3 @@ export const getAfterLogout = ({ collection, cookieName, pluginOptions })=>({ re
             req
         });
     };
-
-//# sourceMappingURL=afterLogout.js.map

package/dist/oauth/hooks/me.d.ts

@@ -2,4 +2,3 @@ import { type CollectionMeHook } from 'payload';
 export declare const getMeHook: ({ cookieName }: {
     cookieName: string;
 }) => CollectionMeHook;
-//# sourceMappingURL=me.d.ts.map

package/dist/oauth/hooks/me.js

@@ -51,5 +51,3 @@ export const getMeHook = ({ cookieName })=>// eslint-disable-next-line @typescri
         }
         return undefined;
     };
-
-//# sourceMappingURL=me.js.map

package/dist/oauth/hooks/refresh.d.ts

@@ -5,4 +5,3 @@ export declare const getRefreshHook: ({ pluginOptions, strategy, }: {
     pluginOptions: PluginOptions;
     strategy: Strategy;
 }) => CollectionRefreshHook;
-//# sourceMappingURL=refresh.d.ts.map

package/dist/oauth/hooks/refresh.js

@@ -6,6 +6,7 @@ import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
 import { mergeHeaders } from '../utilities/mergeHeaders.js';
 import { refreshTokens } from '../utilities/refreshTokens.js';
+import { withPartitionedCookie } from '../utilities/withPartitionedCookie.js';
 export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user })=>{
         if (!args.req.responseHeaders) {
             args.req.responseHeaders = new Headers();
@@ -47,7 +48,7 @@ export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user
                     }) ?? 31_556_952),
                     value: refreshedToken
                 });
-                args.req.responseHeaders.append('Set-Cookie', refreshCookie);
+                args.req.responseHeaders.append('Set-Cookie', withPartitionedCookie(refreshCookie));
                 const newDecoded = jwt.decode(refreshedToken);
                 strategy.debugLog('usePayloadJWT: true - Received new refresh token', {
                     newDecoded,
@@ -87,5 +88,3 @@ export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user
         }
         return undefined;
     };
-
-//# sourceMappingURL=refresh.js.map

package/dist/oauth/index.d.ts

@@ -1,4 +1,3 @@
 import type { Plugin } from 'payload';
 import type { PluginOptions } from './types.js';
 export declare const oAuth2Plugin: (pluginOptions: PluginOptions) => Plugin;
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.js

@@ -1,3 +1,4 @@
+import { fieldAffectsData } from 'payload/shared';
 import { defaultVerify } from './defaults.js';
 import { getLoginEndpoint } from './endpoints/getLoginEndpoint.js';
 import { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js';
@@ -94,7 +95,12 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                         ...existingCollection.fields,
                         {
                             name: 'email',
-                            type: 'email'
+                            type: 'email',
+                            admin: {
+                                description: 'Managed by Figma',
+                                readOnly: true
+                            },
+                            unique: true
                         }
                     ]
                 };
@@ -102,10 +108,22 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                     collection: collectionWithEmail,
                     collectionOptions
                 });
+                // Make username field readOnly (and add description for email fields)
+                const readOnlyUsernameField = {
+                    ...usernameField,
+                    admin: {
+                        ...usernameField.admin || {},
+                        ...usernameField.name === 'email' ? {
+                            description: 'Managed by Figma'
+                        } : {},
+                        readOnly: true
+                    }
+                };
+                const isUsernameFieldString = typeof adminCollectionOptions.usernameField === 'string';
                 const fields = [
-                    ...collectionWithEmail.fields,
-                    ...typeof adminCollectionOptions.usernameField === 'string' ? [] : [
-                        usernameField
+                    ...collectionWithEmail.fields.map((field)=>fieldAffectsData(field) && field.name === usernameField.name ? readOnlyUsernameField : field),
+                    ...isUsernameFieldString ? [] : [
+                        readOnlyUsernameField
                     ]
                 ];
                 if (disabled) {
@@ -116,7 +134,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 const strategy = new Strategy({
                     clientID: collectionOptions.clientID,
-                    clientSecret: collectionOptions.clientSecret,
                     collection: existingCollection,
                     collectionOptions,
                     cookieName,
@@ -127,6 +144,7 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                     verify: collectionOptions.verify ?? defaultVerify({
                         collection: existingCollection,
                         strategyName,
+                        userInfoCookieName: pluginOptions?.userInfoCookieName,
                         usernameField
                     })
                 });
@@ -148,6 +166,10 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 return {
                     ...existingCollection,
+                    access: {
+                        ...existingCollection.access || {},
+                        create: ()=>false
+                    },
                     auth: {
                         ...typeof existingCollection.auth === 'object' ? existingCollection.auth : {},
                         disableLocalStrategy,
@@ -218,5 +240,3 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
             })
         };
     };
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/strategy/index.d.ts

@@ -4,7 +4,6 @@ import * as jose from 'jose';
 import type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js';
 export interface Options {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;
@@ -16,7 +15,6 @@ export interface Options {
 }
 export declare class Strategy {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;
@@ -51,4 +49,3 @@ type JwtVerifyArgs = {
     token: string;
 };
 export {};
-//# sourceMappingURL=index.d.ts.map