@payloadcms/figma 0.1.0-alpha.1 → 0.1.0-internal.e071575

package/dist/plugin/build-config.js

@@ -18,6 +18,7 @@ import * as log from '../utils/log.js';
 import { logMissingCliAuth } from './auth-preflight.js';
 import { logMissingContentSystemId } from './bootstrap-preflight.js';
 import { getDevCookieNames } from './dev-cookie-names.js';
+import { createSandboxUploadFetchPlugin } from './sandbox-upload-fetch.js';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
  * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
@@ -392,7 +393,10 @@ export async function buildFigmaConfig(config) {
                 debug: !!process.env.DEBUG,
                 disabled: false
             }),
-            scheduleExtractPlugin()
+            scheduleExtractPlugin(),
+            // Not folded into createStoragePlugin: that one is skipped when
+            // figma.storage is false, which would break remote uploads for those apps.
+            createSandboxUploadFetchPlugin()
         ]
     };
     // Inject figma fields into users collection

package/dist/plugin/sandbox-upload-fetch.d.ts

@@ -0,0 +1,30 @@
+import type { Config } from 'payload';
+/**
+ * True inside the Make sandbox. agentplat injects `FIGMA=1` into every sandbox
+ * process; it is absent locally and in the deployed Lambda. `FIGMA=true` is
+ * accepted because the Make app template's `vite.config.ts` treats both as
+ * sandbox markers.
+ *
+ * KEEP_IN_SYNC(services/agentplat/scriptrun/script_runner.go): EnvFigma
+ */
+export declare function isMakeSandbox(): boolean;
+/**
+ * Lets upload collections fetch remote files inside the Make sandbox, where DNS
+ * maps external hostnames to unique-local IPv6 addresses (`fc00::/7`) and
+ * `safeFetch` rejects every resolved range that is not `unicast`. Outside the
+ * sandbox this is a no-op.
+ *
+ * `skipSafeFetch` is forced rather than defaulted with `??`, because
+ * `@payloadcms/plugin-cloud-storage` recomputes it on every upload collection
+ * and a nullish default would never fire. An app's own setting loses here.
+ *
+ * `externalFileHeaderFilter` is deliberately left unset: it replaces Payload's
+ * cookie logic wholesale, including the branch that forwards cookies for
+ * relative URLs.
+ *
+ * Accepted risks, all bounded by the auth gate on the upload routes and the
+ * sandbox's network limits: `getExternalFile` re-validates its three redirect
+ * hops only against `pasteURL.allowList`; any session can make the server GET
+ * an arbitrary URL and read the body; request cookies reach the fetch target.
+ */
+export declare function createSandboxUploadFetchPlugin(): (config: Config) => Config;

package/dist/plugin/sandbox-upload-fetch.js

@@ -0,0 +1,59 @@
+import * as log from '../utils/log.js';
+/**
+ * True inside the Make sandbox. agentplat injects `FIGMA=1` into every sandbox
+ * process; it is absent locally and in the deployed Lambda. `FIGMA=true` is
+ * accepted because the Make app template's `vite.config.ts` treats both as
+ * sandbox markers.
+ *
+ * KEEP_IN_SYNC(services/agentplat/scriptrun/script_runner.go): EnvFigma
+ */ export function isMakeSandbox() {
+    return process.env.FIGMA === '1' || process.env.FIGMA === 'true';
+}
+/**
+ * Lets upload collections fetch remote files inside the Make sandbox, where DNS
+ * maps external hostnames to unique-local IPv6 addresses (`fc00::/7`) and
+ * `safeFetch` rejects every resolved range that is not `unicast`. Outside the
+ * sandbox this is a no-op.
+ *
+ * `skipSafeFetch` is forced rather than defaulted with `??`, because
+ * `@payloadcms/plugin-cloud-storage` recomputes it on every upload collection
+ * and a nullish default would never fire. An app's own setting loses here.
+ *
+ * `externalFileHeaderFilter` is deliberately left unset: it replaces Payload's
+ * cookie logic wholesale, including the branch that forwards cookies for
+ * relative URLs.
+ *
+ * Accepted risks, all bounded by the auth gate on the upload routes and the
+ * sandbox's network limits: `getExternalFile` re-validates its three redirect
+ * hops only against `pasteURL.allowList`; any session can make the server GET
+ * an arbitrary URL and read the body; request cookies reach the fetch target.
+ */ export function createSandboxUploadFetchPlugin() {
+    return (config)=>{
+        if (!isMakeSandbox()) {
+            return config;
+        }
+        const modifiedSlugs = [];
+        const collections = (config.collections ?? []).map((collection)=>{
+            if (!collection.upload) {
+                return collection;
+            }
+            modifiedSlugs.push(collection.slug);
+            const upload = collection.upload === true ? {} : collection.upload;
+            return {
+                ...collection,
+                upload: {
+                    ...upload,
+                    skipSafeFetch: true
+                }
+            };
+        });
+        if (modifiedSlugs.length === 0) {
+            return config;
+        }
+        log.debug(`Make sandbox detected: upload collections skip safeFetch (${modifiedSlugs.join(', ')})`);
+        return {
+            ...config,
+            collections
+        };
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-internal.e071575",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {
@@ -97,6 +97,7 @@
     "generate:types": "tsx scripts/generate-types.ts",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "payload:cli": "tsx scripts/payload-cli.ts",
     "start": "pnpm build && node ./bin/cli.js",
     "test": "TEST_UNIT=true vitest run",
     "test:int": "TEST_INT=true vitest run --config vitest.config.int.ts",