@payloadcms/figma 0.0.1-alpha.9 → 0.1.0-alpha.1

package/dist/oauth/strategy/index.js

@@ -1,14 +1,13 @@
 import * as jose from 'jose';
 import { APIError, parseCookies } from 'payload';
-import { validateProjectToken } from '../../auth/jwt-validator.js';
-import { getEnvironment } from '../../constants.js';
+import { JWTValidationError, validatePayloadAdminToken } from '../../auth/jwt-validator.js';
+import { getInfraEnvironment } from '../../constants.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
 import { mergeHeaders } from '../utilities/mergeHeaders.js';
 import { refreshTokens } from '../utilities/refreshTokens.js';
 export class Strategy {
     clientID;
-    clientSecret;
     collection;
     collectionOptions;
     cookieName;
@@ -28,7 +27,6 @@ export class Strategy {
         this.verify = options.verify;
         this.cookieName = options.cookieName;
         this.clientID = options.clientID;
-        this.clientSecret = options.clientSecret;
         this.identityMetadataURL = options.identityMetadata;
         this.name = options.strategyName;
         this.collection = options.collection;
@@ -47,26 +45,28 @@ export class Strategy {
         let oauthToken = cookies.get(this.cookieName);
         const refreshToken = cookies.get(`${this.cookieName}-refresh`);
         debugLogger.info({
-            msg: 'Retrieved tokens from cookies',
-            oauthToken,
-            refreshToken
+            hasOauthToken: !!oauthToken,
+            hasRefreshToken: !!refreshToken,
+            msg: 'Retrieved tokens from cookies'
         });
         if (!this.collectionOptions.disableJWTFromHeader) {
             // Parse Authorization header if exists
             const jwtFromHeader = headers.get('authorization');
             if (typeof jwtFromHeader === 'string' && jwtFromHeader.startsWith('Bearer ')) {
                 debugLogger.info({
-                    jwtFromHeader,
                     msg: 'Found bearer token in authorization header'
                 });
                 oauthToken = jwtFromHeader.replace('Bearer ', '');
             }
         }
         if (!oauthToken) {
-            if (refreshToken && canSetHeaders) {
+            // Attempt refresh even when canSetHeaders=false (e.g., during RSC navigation).
+            // This allows authentication to succeed for the current request even when
+            // cookies cannot be updated. The cookie will be refreshed on the next
+            // full page load when canSetHeaders=true.
+            if (refreshToken) {
                 debugLogger.info({
-                    msg: 'No access token found, but refresh token exists. Attempting to refresh...',
-                    refreshToken
+                    msg: 'No access token found, but refresh token exists. Attempting to refresh...'
                 });
                 const refreshed = await refreshTokens({
                     payload,
@@ -83,25 +83,31 @@ export class Strategy {
                         msg: 'Token refreshed. Verifying...',
                         verifyResult
                     });
-                    if (verifyResult.responseHeaders) {
-                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    // Only return response headers (to set cookies) when canSetHeaders is true.
+                    // During RSC navigation, canSetHeaders=false because response streaming
+                    // has already started and cookies cannot be modified.
+                    if (canSetHeaders) {
+                        if (verifyResult.responseHeaders) {
+                            mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                        }
+                        return {
+                            responseHeaders: refreshed.headers,
+                            user: verifyResult.user
+                        };
                     }
+                    // Authenticate this request without updating cookies
                     return {
-                        responseHeaders: refreshed.headers,
                         user: verifyResult.user
                     };
                 } else {
                     debugLogger.info({
-                        msg: 'Token refresh failed',
-                        refreshed,
-                        refreshToken
+                        msg: 'Token refresh failed'
                     });
                 }
-            } else {
-                return {
-                    user: null
-                };
             }
+            return {
+                user: null
+            };
         }
         let oauthTokenVerifyResult = null;
         // First, try to verify token
@@ -136,16 +142,17 @@ export class Strategy {
                 });
             }
         }
-        if (oauthTokenVerifyResult instanceof Error && oauthTokenVerifyResult.name === 'TokenExpiredError' && refreshToken && !this.collectionOptions.usePayloadJWT && canSetHeaders) {
+        // Handle expired access token with valid refresh token.
+        // Same pattern as above: refresh regardless of canSetHeaders to support RSC navigation,
+        // but only update cookies when canSetHeaders=true.
+        if (oauthTokenVerifyResult instanceof JWTValidationError && oauthTokenVerifyResult.code === 'EXPIRED' && refreshToken && !this.collectionOptions.usePayloadJWT) {
             const refreshed = await refreshTokens({
                 payload,
                 refreshToken,
                 strategy: this
             });
             debugLogger.info({
-                msg: 'Token expired. Refreshing...',
-                refreshed,
-                refreshToken
+                msg: 'Token expired. Refreshing...'
             });
             if (refreshed) {
                 const verifyResult = await this.verify({
@@ -157,18 +164,22 @@ export class Strategy {
                     msg: 'Token refreshed. Verifying...',
                     verifyResult
                 });
-                if (verifyResult.responseHeaders) {
-                    mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                if (canSetHeaders) {
+                    if (verifyResult.responseHeaders) {
+                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    }
+                    return {
+                        responseHeaders: refreshed.headers,
+                        user: verifyResult.user
+                    };
                 }
+                // Authenticate this request without updating cookies
                 return {
-                    responseHeaders: refreshed.headers,
                     user: verifyResult.user
                 };
             } else {
                 debugLogger.info({
-                    msg: 'Token refresh failed',
-                    refreshed,
-                    refreshToken
+                    msg: 'Token refresh failed'
                 });
             }
         }
@@ -200,6 +211,10 @@ export class Strategy {
             for(let attempt = 1; attempt <= 5; attempt++){
                 try {
                     this.meta = await fetch(this.identityMetadataURL).then((res)=>res.json());
+                    if (this.meta) {
+                        // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration
+                        this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms';
+                    }
                     this.debugLog(`fetchMeta - success on attempt ${attempt}`);
                     if (this.meta?.jwks_uri) {
                         this.jwks = await fetch(this.meta.jwks_uri).then((res)=>res.json());
@@ -259,7 +274,15 @@ export class Strategy {
     }
     async jwtVerify({ payload, token }) {
         try {
-            const verified = await validateProjectToken(token, getEnvironment());
+            const audience = payload.config.custom.figma.environmentId;
+            if (!audience) {
+                throw new Error('Cannot validate token audience: environmentId is not configured');
+            }
+            const verified = await validatePayloadAdminToken({
+                audience,
+                environment: getInfraEnvironment(),
+                token
+            });
             if (typeof verified !== 'string') {
                 return verified;
             }
@@ -276,5 +299,3 @@ export class Strategy {
         return null;
     }
 }
-
-//# sourceMappingURL=index.js.map

package/dist/oauth/types.d.ts

@@ -30,7 +30,7 @@ export interface CollectionOptions {
      * Set to false to only accept the JWT from cookies
      */
     disableJWTFromHeader?: boolean;
-    disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy'];
+    disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy'];
     /**
      * The logout button will either redirect to the IDP logout screen or
      * automatically log the user out of the IDP depending on provider.
@@ -112,11 +112,6 @@ export interface PluginOptions {
      * @default 'payload-oauth-token'
      */
     cookieName?: string;
-    /**
-     * Debug mode will log additional information to the console.
-     *
-     * NOTE: This will log sensitive information to the console.
-     */
     /**
      * Accepts incoming request and allows for modification of cookie options
      */
@@ -125,6 +120,11 @@ export interface PluginOptions {
         cookieOptions: CookieOptions;
         headers: Headers;
     }) => CookieOptions;
+    /**
+     * Debug mode will log additional information to the console.
+     *
+     * NOTE: This will log sensitive information to the console.
+     */
     debug?: boolean;
     /**
      * Disables the plugin functionality while leaving in types, fields and component modifications.
@@ -148,6 +148,16 @@ export interface PluginOptions {
      * @default 'oauth'
      */
     strategyName?: string;
+    /**
+     * The name of the short-lived cookie used to carry Figma user profile
+     * info from the login endpoint to `defaultVerify`.
+     *
+     * Override in local dev when running multiple Payload apps on localhost
+     * to avoid cookie collisions (all localhost apps share a cookie jar).
+     *
+     * @default 'figma-user-info'
+     */
+    userInfoCookieName?: string;
 }
 export type CookieOptions = {
     domain?: string;
@@ -159,6 +169,13 @@ export type CookieOptions = {
     secure?: boolean;
 };
 export type StateObj = {
+    /**
+     * Random per-flow nonce. The server sets a matching HttpOnly cookie
+     * (`payload-oauth-state_csrf`) at the time the state is minted; `/sso/login`
+     * compares the value in state to the cookie on callback. This is the
+     * browser-bound CSRF defense required by RFC 6749 §10.12.
+     */
+    csrf: string;
     /**
      * Redirect to use if the login fails
      */
@@ -189,4 +206,3 @@ export type DebugLogger = {
     error: LogFn;
     info: LogFn;
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.js

@@ -1,3 +1 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */ export { };
-
-//# sourceMappingURL=types.js.map

package/dist/oauth/utilities/buildUnauthorizedRedirect.d.ts

@@ -0,0 +1,14 @@
+import type { SanitizedConfig } from 'payload';
+/**
+ * Resolves the admin panel's "unauthorized" view path for a given Payload
+ * config, honoring tenant-customized admin (`config.routes.admin`, default
+ * `/admin`) and unauthorized (`config.admin.routes.unauthorized`, default
+ * `/unauthorized`) route slugs, plus any Next.js `basePath`.
+ *
+ * @example '/admin/unauthorized' (defaults) — '/docs/cms/no-access' (basePath + customized)
+ */
+export declare function getUnauthorizedPath(config: SanitizedConfig): string;
+/**
+ * Builds a 302 redirect to the admin panel's "unauthorized" view.
+ */
+export declare function buildUnauthorizedRedirect(config: SanitizedConfig): Response;

package/dist/oauth/utilities/buildUnauthorizedRedirect.js

@@ -0,0 +1,28 @@
+import { formatAdminURL } from 'payload/shared';
+/**
+ * Resolves the admin panel's "unauthorized" view path for a given Payload
+ * config, honoring tenant-customized admin (`config.routes.admin`, default
+ * `/admin`) and unauthorized (`config.admin.routes.unauthorized`, default
+ * `/unauthorized`) route slugs, plus any Next.js `basePath`.
+ *
+ * @example '/admin/unauthorized' (defaults) — '/docs/cms/no-access' (basePath + customized)
+ */ export function getUnauthorizedPath(config) {
+    const adminRoute = config.routes?.admin || '/admin';
+    const unauthorizedRoute = config.admin?.routes?.unauthorized || '/unauthorized';
+    return formatAdminURL({
+        adminRoute,
+        includeBasePath: true,
+        path: unauthorizedRoute,
+        relative: true
+    });
+}
+/**
+ * Builds a 302 redirect to the admin panel's "unauthorized" view.
+ */ export function buildUnauthorizedRedirect(config) {
+    return new Response(null, {
+        headers: {
+            Location: getUnauthorizedPath(config)
+        },
+        status: 302
+    });
+}

package/dist/oauth/utilities/clearCookie.d.ts

@@ -6,4 +6,3 @@ export declare const clearCookie: (args: {
     overrides?: Partial<CookieOptions>;
     req: PayloadRequest;
 }) => void;
-//# sourceMappingURL=clearCookie.d.ts.map

package/dist/oauth/utilities/clearCookie.js

@@ -1,5 +1,6 @@
 import { generateCookie } from 'payload';
 import { getCookieExpiration } from './getCookieExpiration.js';
+import { withPartitionedCookie } from './withPartitionedCookie.js';
 export const clearCookie = (args)=>{
     const options = {
         ...args.cookieOptions,
@@ -15,7 +16,8 @@ export const clearCookie = (args)=>{
     if (!args.req.responseHeaders) {
         args.req.responseHeaders = new Headers();
     }
-    args.req.responseHeaders.append('Set-Cookie', clearedCookie);
+    // Match the Partitioned attribute the cookie was set with — a Max-Age=0 clear
+    // without it targets the unpartitioned jar and won't delete the partitioned
+    // cookie, so logout wouldn't clear the session in the cross-site Make iframe.
+    args.req.responseHeaders.append('Set-Cookie', withPartitionedCookie(clearedCookie));
 };
-
-//# sourceMappingURL=clearCookie.js.map

package/dist/oauth/utilities/createCookieOptions.d.ts

@@ -7,4 +7,3 @@ interface Args {
 }
 export declare const createCookieOptions: ({ collection, headers, pluginOptions, }: Args) => CookieOptions;
 export {};
-//# sourceMappingURL=createCookieOptions.d.ts.map

package/dist/oauth/utilities/createCookieOptions.js

@@ -1,10 +1,17 @@
 export const createCookieOptions = ({ collection, headers, pluginOptions })=>{
+    // Default to SameSite=None + Secure (and `Partitioned`, appended in
+    // establishSession via withPartitionedCookie) so the session cookies survive
+    // the cross-site Make-preview iframe — the admin panel runs on a different
+    // site from the top-level figma.com page, and a Lax/unmarked cookie is not
+    // sent back, looping the login. Mirrors the CSRF cookie (buildCsrfCookieHeader).
+    // Self-hosters on a same-site setup can override via collection.auth.cookies
+    // or pluginOptions.createCookieOptions below.
     let cookieOptions = {
         domain: undefined,
         httpOnly: true,
         path: '/',
-        sameSite: undefined,
-        secure: false
+        sameSite: 'None',
+        secure: true
     };
     if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {
         const { domain, sameSite, secure } = collection.auth.cookies;
@@ -38,5 +45,3 @@ export const createCookieOptions = ({ collection, headers, pluginOptions })=>{
     }
     return cookieOptions;
 };
-
-//# sourceMappingURL=createCookieOptions.js.map

package/dist/oauth/utilities/createDebugLogger.d.ts

@@ -1,4 +1,3 @@
 import type { Payload } from 'payload';
 import type { DebugLogger } from '../types.js';
 export declare const createDebugLogger: (payload: Payload, condition?: boolean) => DebugLogger;
-//# sourceMappingURL=createDebugLogger.d.ts.map

package/dist/oauth/utilities/createDebugLogger.js

@@ -12,5 +12,3 @@ export const createDebugLogger = (payload, condition)=>{
         }
     };
 };
-
-//# sourceMappingURL=createDebugLogger.js.map

package/dist/oauth/utilities/establishSession.d.ts

@@ -0,0 +1,22 @@
+import type { CollectionConfig, PayloadRequest } from 'payload';
+import type { Strategy } from '../strategy/index.js';
+import type { CollectionOptions, DebugLogger, PluginOptions } from '../types.js';
+interface Args {
+    accessToken: string;
+    collection: CollectionConfig;
+    collectionOptions: CollectionOptions;
+    debugLogger: DebugLogger;
+    environmentId: string;
+    pluginOptions: PluginOptions;
+    /** From the IdP token response (`expires_in`); used as a refresh-cookie expiry fallback. */
+    refreshTokenExpiresIn?: number;
+    req: PayloadRequest;
+    strategy: Strategy;
+}
+/**
+ * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
+ * Payload Admin token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the Admin token mint fails.
+ */
+export declare const establishSession: ({ accessToken, collection, collectionOptions, debugLogger, environmentId, pluginOptions, refreshTokenExpiresIn, req, strategy, }: Args) => Promise<void>;
+export {};

package/dist/oauth/utilities/establishSession.js

@@ -0,0 +1,80 @@
+import { APIError, generateCookie } from 'payload';
+import { getPayloadAdminToken, getUserInfo } from '../../api/figma-api.js';
+import { createCookieOptions } from './createCookieOptions.js';
+import { getCookieExpiration } from './getCookieExpiration.js';
+import { withPartitionedCookie } from './withPartitionedCookie.js';
+/**
+ * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
+ * Payload Admin token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the Admin token mint fails.
+ */ export const establishSession = async ({ accessToken, collection, collectionOptions, debugLogger, environmentId, pluginOptions, refreshTokenExpiresIn, req, strategy })=>{
+    const oauthCredential = {
+        type: 'oauth',
+        token: accessToken
+    };
+    // Non-fatal: user just won't have handle/image on first request.
+    let figmaUserInfo = null;
+    try {
+        figmaUserInfo = await getUserInfo(oauthCredential);
+        debugLogger.info({
+            msg: 'Fetched Figma user info'
+        });
+    } catch (err) {
+        debugLogger.error({
+            err,
+            msg: 'Failed to fetch Figma user info'
+        });
+    }
+    const adminToken = await getPayloadAdminToken(oauthCredential, environmentId);
+    if (!adminToken.token) {
+        const errMsg = 'No Payload Admin token returned from Figma API';
+        req.payload.logger.error({
+            msg: errMsg
+        });
+        throw new APIError(errMsg);
+    }
+    const cookieOptions = createCookieOptions({
+        collection,
+        headers: req.headers,
+        pluginOptions
+    });
+    if (!req.responseHeaders) {
+        req.responseHeaders = new Headers();
+    }
+    // The -refresh cookie holds the OAuth access_token so refreshTokens can
+    // re-mint project_tokens from it on JWT expiry.
+    if (!collectionOptions.usePayloadJWT) {
+        const refreshCookie = generateCookie({
+            ...cookieOptions,
+            name: `${strategy.cookieName}-refresh`,
+            expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpiresIn ?? 31_556_952),
+            returnCookieAsObject: false,
+            value: accessToken
+        });
+        req.responseHeaders.append('Set-Cookie', withPartitionedCookie(refreshCookie));
+    }
+    const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(adminToken.expiresAt);
+    const tokenCookie = generateCookie({
+        ...cookieOptions,
+        name: strategy.cookieName,
+        expires: tokenExpires,
+        returnCookieAsObject: false,
+        value: adminToken.token
+    });
+    req.responseHeaders.append('Set-Cookie', withPartitionedCookie(tokenCookie));
+    // Short-lived handoff cookie consumed by defaultVerify on the next request.
+    if (figmaUserInfo) {
+        const userInfoValue = Buffer.from(JSON.stringify({
+            handle: figmaUserInfo.handle,
+            img_url: figmaUserInfo.img_url
+        })).toString('base64');
+        const userInfoCookie = generateCookie({
+            ...cookieOptions,
+            name: pluginOptions?.userInfoCookieName ?? 'figma-user-info',
+            expires: new Date(Date.now() + 60_000),
+            returnCookieAsObject: false,
+            value: userInfoValue
+        });
+        req.responseHeaders.append('Set-Cookie', withPartitionedCookie(userInfoCookie));
+    }
+};

package/dist/oauth/utilities/exchangeCodeForAccessToken.d.ts

@@ -0,0 +1,23 @@
+import type { Strategy } from '../strategy/index.js';
+interface Args {
+    /** Authorization code received from the IdP redirect. */
+    code: string;
+    /** PKCE verifier; omit for non-PKCE flows. */
+    codeVerifier?: string;
+    /** Must match the redirect_uri the authorization request used. */
+    redirectUri: string;
+    strategy: Strategy;
+}
+export interface TokenEndpointResponse {
+    access_token?: null | string;
+    error?: string;
+    error_description?: string;
+    expires_in?: number;
+}
+/**
+ * POSTs an authorization code to the IdP's `token_endpoint` and returns the
+ * raw response body. Callers handle error/missing-token logging in their own
+ * style — this helper only owns the request shape.
+ */
+export declare const exchangeCodeForAccessToken: ({ code, codeVerifier, redirectUri, strategy, }: Args) => Promise<TokenEndpointResponse>;
+export {};

package/dist/oauth/utilities/exchangeCodeForAccessToken.js

@@ -0,0 +1,26 @@
+/**
+ * POSTs an authorization code to the IdP's `token_endpoint` and returns the
+ * raw response body. Callers handle error/missing-token logging in their own
+ * style — this helper only owns the request shape.
+ */ export const exchangeCodeForAccessToken = async ({ code, codeVerifier, redirectUri, strategy })=>{
+    const body = {
+        client_id: strategy.clientID,
+        code,
+        grant_type: 'authorization_code',
+        redirect_uri: redirectUri
+    };
+    if (codeVerifier) {
+        body.code_verifier = codeVerifier;
+    }
+    if (strategy.collectionOptions.clientSecret) {
+        body.client_secret = strategy.collectionOptions.clientSecret;
+    }
+    const res = await fetch(strategy.meta.token_endpoint, {
+        body: new URLSearchParams(body),
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        method: 'POST'
+    });
+    return await res.json();
+};

package/dist/oauth/utilities/extractOrigin.d.ts

@@ -1,2 +1 @@
 export declare const extractOrigin: (url: string) => null | string;
-//# sourceMappingURL=extractOrigin.d.ts.map

package/dist/oauth/utilities/extractOrigin.js

@@ -8,5 +8,3 @@ export const extractOrigin = (url)=>{
         ;
     }
 };
-
-//# sourceMappingURL=extractOrigin.js.map

package/dist/oauth/utilities/figmaHostnames.d.ts

@@ -0,0 +1,2 @@
+export declare const FIGMA_HOSTNAMES: Set<string>;
+export declare const isFigmaOrigin: (origin: string) => boolean;

package/dist/oauth/utilities/figmaHostnames.js

@@ -0,0 +1,24 @@
+// Copied from share/figma-url/src/hostnames.ts.
+// This package is published to npm (@payloadcms/figma) and cannot import from
+// the monorepo's internal share/ tree, so the list is duplicated here.
+export const FIGMA_HOSTNAMES = new Set([
+    'embed.figma.com',
+    'embed.figma-gov.com',
+    'embed.local.figma.engineering',
+    'embed.staging.figma.com',
+    'figma.com',
+    'figma-gov.com',
+    'local.figma.engineering',
+    'localhost',
+    'staging.figma.com',
+    'www.figma.com',
+    'www.figma-gov.com'
+]);
+export const isFigmaOrigin = (origin)=>{
+    try {
+        const { hostname } = new URL(origin);
+        return FIGMA_HOSTNAMES.has(hostname) || hostname.endsWith('.figdev.systems');
+    } catch  {
+        return false;
+    }
+};

package/dist/oauth/utilities/getAdminCollectionSlug.d.ts

@@ -1,3 +1,2 @@
 import type { Config } from 'payload';
 export declare const getAdminCollectionSlug: (config: Config) => string;
-//# sourceMappingURL=getAdminCollectionSlug.d.ts.map

package/dist/oauth/utilities/getAdminCollectionSlug.js

@@ -14,5 +14,3 @@ export const getAdminCollectionSlug = (config)=>{
     // Otherwise, assume that it'll be the built-in auth
     return 'users';
 };
-
-//# sourceMappingURL=getAdminCollectionSlug.js.map

package/dist/oauth/utilities/getAuthorizeURL.d.ts

@@ -5,6 +5,16 @@ interface Args {
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     endpointSlug: string;
+    /**
+     * If the request already has an `__Host-payload-oauth-state_csrf` cookie,
+     * pass its value here — `getAuthorizeURL` will reuse it as `state.csrf`
+     * instead of minting a fresh nonce. This is what makes `/meta`
+     * idempotent across multiple calls in a single browser session (React
+     * Strict Mode re-mounts, retry-after-failure, multiple tabs) and
+     * prevents the cookie/state mismatch race where one call overwrites
+     * another call's cookie.
+     */
+    existingCsrfNonce?: null | string;
     failedRedirect?: unknown;
     payload: Payload;
     pluginOptions: PluginOptions;
@@ -12,6 +22,59 @@ interface Args {
     serverURLOverride?: unknown;
     strategy: Strategy;
 }
-export declare const getAuthorizeURL: ({ collection, collectionOptions, endpointSlug, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy, }: Args) => Promise<string>;
+export interface AuthorizeURLParams {
+    [key: string]: string;
+    client_id: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    nonce: string;
+    redirect_uri: string;
+    response_mode: string;
+    response_type: string;
+    scope: string;
+    state: string;
+}
+export interface AuthorizeURLResult {
+    authorizeURL: string;
+    /**
+     * The plaintext CSRF nonce that the caller MUST set as an HttpOnly
+     * cookie on the response (see `OAUTH_STATE_CSRF_COOKIE_NAME`). `/sso/login`
+     * compares this value to the cookie on callback — this is the
+     * browser-binding required by RFC 6749 §10.12.
+     */
+    csrfNonce: string;
+    params: AuthorizeURLParams;
+}
+export declare const getAuthorizeURL: ({ collection, collectionOptions, endpointSlug, existingCsrfNonce, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy, }: Args) => Promise<AuthorizeURLResult>;
+/**
+ * Name of the HttpOnly cookie that carries the browser-bound CSRF nonce
+ * for the OAuth flow. The `__Host-` prefix instructs browsers to enforce:
+ * Secure, no Domain attribute (host-only), and Path=/ — which together
+ * prevent sibling subdomains from setting or overwriting it.
+ */
+export declare const OAUTH_STATE_CSRF_COOKIE_NAME = "__Host-payload-oauth-state_csrf";
+/**
+ * Build the `Set-Cookie` header value for the CSRF cookie. SameSite=None
+ * + Secure so the cookie survives the IdP cross-site redirect back into
+ * /sso/login, AND so the iframe auto-login path works (the iframe is a
+ * third-party context from the top-level Figma page). Path=/ is required
+ * by the `__Host-` prefix.
+ *
+ * `Partitioned` (CHIPS) is required because the Make preview embeds the
+ * admin panel in a cross-site iframe. Under Chrome's third-party-cookie
+ * restrictions a `SameSite=None` cookie set in a third-party context is
+ * NOT sent back unless it is partitioned by the top-level site. Without it
+ * the `__Host-payload-oauth-state_csrf` cookie is dropped on the way back
+ * to /sso/login, the cookie↔state.csrf binding check fails, and login dies
+ * with "CSRF cookie mismatch" (intermittent sign-in loop). `__Host-` and
+ * `Partitioned` are mutually compatible.
+ */
+export declare const buildCsrfCookieHeader: (nonce: string) => string;
+/**
+ * `Set-Cookie` header to clear the CSRF cookie after a successful (or
+ * failed) callback. Same attributes as the set version, plus Max-Age=0.
+ * Must include `Partitioned` so the clear targets the same partitioned
+ * cookie jar the set wrote to (an unpartitioned clear would not match).
+ */
+export declare const buildCsrfCookieClearHeader: () => string;
 export {};
-//# sourceMappingURL=getAuthorizeURL.d.ts.map