@payloadcms/figma 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/plugin/build-config.js

@@ -18,6 +18,7 @@ import * as log from '../utils/log.js';
 import { logMissingCliAuth } from './auth-preflight.js';
 import { logMissingContentSystemId } from './bootstrap-preflight.js';
 import { getDevCookieNames } from './dev-cookie-names.js';
+import { createSandboxUploadFetchPlugin } from './sandbox-upload-fetch.js';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
  * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
@@ -392,7 +393,12 @@ export async function buildFigmaConfig(config) {
                 debug: !!process.env.DEBUG,
                 disabled: false
             }),
-            scheduleExtractPlugin()
+            scheduleExtractPlugin(),
+            // Not folded into createStoragePlugin, which is skipped when
+            // figma.storage is false and would break remote uploads for those apps.
+            createSandboxUploadFetchPlugin({
+                userCollections: config.collections
+            })
         ]
     };
     // Inject figma fields into users collection

package/dist/plugin/sandbox-upload-fetch.d.ts

@@ -0,0 +1,32 @@
+import type { Config } from 'payload';
+/**
+ * True inside the Make sandbox. agentplat injects `FIGMA=1`, absent locally and
+ * in the deployed Lambda; `FIGMA=true` matches the app template's vite config.
+ *
+ * KEEP_IN_SYNC(services/agentplat/scriptrun/script_runner.go): EnvFigma
+ */
+export declare function isMakeSandbox(): boolean;
+type SandboxUploadFetchOptions = {
+    /**
+     * The app's collections before any plugin runs. `plugin-cloud-storage` later
+     * rewrites `skipSafeFetch`, erasing whether the app set `false` or nothing, so
+     * intent must be read here.
+     */
+    userCollections: Config['collections'];
+};
+/**
+ * Defaults upload collections to skip `safeFetch` in the Make sandbox, where DNS
+ * maps external hostnames to unique-local IPv6 addresses (`fc00::/7`) that
+ * `safeFetch` rejects as non-unicast. A no-op elsewhere.
+ *
+ * Only a default: a collection that set `skipSafeFetch` itself keeps its value.
+ * `externalFileHeaderFilter` is left unset on purpose, since it would replace
+ * the cookie logic that forwards credentials for relative URLs.
+ *
+ * SSRF risks, bounded by the routes' auth gate and sandbox network limits:
+ * `getExternalFile` re-validates redirects only against `pasteURL.allowList`,
+ * any session can GET an arbitrary URL and read the body, and request cookies
+ * reach the target.
+ */
+export declare function createSandboxUploadFetchPlugin({ userCollections }: SandboxUploadFetchOptions): (config: Config) => Config;
+export {};

package/dist/plugin/sandbox-upload-fetch.js

@@ -0,0 +1,53 @@
+import * as log from '../utils/log.js';
+/**
+ * True inside the Make sandbox. agentplat injects `FIGMA=1`, absent locally and
+ * in the deployed Lambda; `FIGMA=true` matches the app template's vite config.
+ *
+ * KEEP_IN_SYNC(services/agentplat/scriptrun/script_runner.go): EnvFigma
+ */ export function isMakeSandbox() {
+    return process.env.FIGMA === '1' || process.env.FIGMA === 'true';
+}
+/**
+ * Defaults upload collections to skip `safeFetch` in the Make sandbox, where DNS
+ * maps external hostnames to unique-local IPv6 addresses (`fc00::/7`) that
+ * `safeFetch` rejects as non-unicast. A no-op elsewhere.
+ *
+ * Only a default: a collection that set `skipSafeFetch` itself keeps its value.
+ * `externalFileHeaderFilter` is left unset on purpose, since it would replace
+ * the cookie logic that forwards credentials for relative URLs.
+ *
+ * SSRF risks, bounded by the routes' auth gate and sandbox network limits:
+ * `getExternalFile` re-validates redirects only against `pasteURL.allowList`,
+ * any session can GET an arbitrary URL and read the body, and request cookies
+ * reach the target.
+ */ export function createSandboxUploadFetchPlugin({ userCollections }) {
+    const appOwnedSlugs = new Set((userCollections ?? []).filter((collection)=>typeof collection.upload === 'object' && 'skipSafeFetch' in collection.upload).map((collection)=>collection.slug));
+    return (config)=>{
+        if (!isMakeSandbox()) {
+            return config;
+        }
+        const modifiedSlugs = [];
+        const collections = (config.collections ?? []).map((collection)=>{
+            if (!collection.upload || appOwnedSlugs.has(collection.slug)) {
+                return collection;
+            }
+            modifiedSlugs.push(collection.slug);
+            const upload = collection.upload === true ? {} : collection.upload;
+            return {
+                ...collection,
+                upload: {
+                    ...upload,
+                    skipSafeFetch: true
+                }
+            };
+        });
+        if (modifiedSlugs.length === 0) {
+            return config;
+        }
+        log.debug(`Make sandbox detected: upload collections skip safeFetch (${modifiedSlugs.join(', ')})`);
+        return {
+            ...config,
+            collections
+        };
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.2",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {
@@ -97,6 +97,7 @@
     "generate:types": "tsx scripts/generate-types.ts",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "payload:cli": "tsx scripts/payload-cli.ts",
     "start": "pnpm build && node ./bin/cli.js",
     "test": "TEST_UNIT=true vitest run",
     "test:int": "TEST_INT=true vitest run --config vitest.config.int.ts",