@payloadcms/next 3.0.0-canary.294ea5c → 3.0.0-canary.2d0dd26

package/dist/routes/graphql/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/routes/graphql/handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqC,eAAe,EAAE,MAAM,SAAS,CAAA;AAsDjF,eAAO,MAAM,UAAU,WAAkB,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,iBAyBlF,CAAA;AAED,eAAO,MAAM,IAAI,WACN,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,eAAqB,OAAO,sBAyD9E,CAAA"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/routes/graphql/handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqC,eAAe,EAAE,MAAM,SAAS,CAAA;AAmEjF,eAAO,MAAM,UAAU,WAAkB,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,iBAyBlF,CAAA;AAED,eAAO,MAAM,IAAI,WACN,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,eAAqB,OAAO,sBAsD9E,CAAA"}

package/dist/routes/graphql/handler.js

@@ -6,33 +6,42 @@ import { addLocalesToRequestFromData } from '../../utilities/addLocalesToRequest
 import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
 import { mergeHeaders } from '../../utilities/mergeHeaders.js';
-const handleError = async (payload, err, debug, afterErrorHook) => {
+const handleError = async ({
+  err,
+  payload,
+  req
+}) => {
   const status = err.originalError.status || httpStatus.INTERNAL_SERVER_ERROR;
   let errorMessage = err.message;
   payload.logger.error(err.stack);
   // Internal server errors can contain anything, including potentially sensitive data.
   // Therefore, error details will be hidden from the response unless `config.debug` is `true`
-  if (!debug && status === httpStatus.INTERNAL_SERVER_ERROR) {
+  if (!payload.config.debug && status === httpStatus.INTERNAL_SERVER_ERROR) {
     errorMessage = 'Something went wrong.';
   }
   let response = {
     extensions: {
       name: err?.originalError?.name || undefined,
       data: err && err.originalError && err.originalError.data || undefined,
-      stack: debug ? err.stack : undefined,
+      stack: payload.config.debug ? err.stack : undefined,
       statusCode: status
     },
     locations: err.locations,
     message: errorMessage,
     path: err.path
   };
-  if (afterErrorHook) {
-    ({
-      response
-    } = afterErrorHook(err, response, null, null) || {
-      response
+  await payload.config.hooks.afterError?.reduce(async (promise, hook) => {
+    await promise;
+    const result = await hook({
+      context: req.context,
+      error: err,
+      graphqlResult: response,
+      req
     });
-  }
+    if (result) {
+      response = result.graphqlResult || response;
+    }
+  }, Promise.resolve());
   return response;
 };
 let cached = global._payload_graphql;
@@ -82,7 +91,6 @@ export const POST = config => async request => {
   const {
     payload
   } = req;
-  const afterErrorHook = typeof payload.config.hooks.afterError === 'function' ? payload.config.hooks.afterError : null;
   const headers = {};
   const apiResponse = await createHandler({
     context: {
@@ -97,7 +105,11 @@ export const POST = config => async request => {
       }) : result;
       if (response.errors) {
         const errors = await Promise.all(result.errors.map(error => {
-          return handleError(payload, error, payload.config.debug, afterErrorHook);
+          return handleError({
+            err: error,
+            payload,
+            req
+          });
         }));
         // errors type should be FormattedGraphQLError[] but onOperation has a return type of ExecutionResult instead of FormattedExecutionResult
         return {

package/dist/routes/graphql/handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler.js","names":["configToSchema","createHandler","httpStatus","addDataAndFileToRequest","addLocalesToRequestFromData","createPayloadRequest","headersWithCors","mergeHeaders","handleError","payload","err","debug","afterErrorHook","status","originalError","INTERNAL_SERVER_ERROR","errorMessage","message","logger","error","stack","response","extensions","name","undefined","data","statusCode","locations","path","cached","global","_payload_graphql","graphql","promise","getGraphql","config","process","env","NODE_ENV","resolvedConfig","Promise","resolve","schema","e","POST","request","originalRequest","clone","req","validationRules","hooks","afterError","headers","apiResponse","context","onOperation","args","result","errors","all","map","_","defaultRules","concat","resHeaders","Headers","key","append","Response","body","responseHeaders"],"sources":["../../../src/routes/graphql/handler.ts"],"sourcesContent":["import type { GraphQLError, GraphQLFormattedError } from 'graphql'\nimport type { CollectionAfterErrorHook, Payload, SanitizedConfig } from 'payload'\n\nimport { configToSchema } from '@payloadcms/graphql'\nimport { createHandler } from 'graphql-http/lib/use/fetch'\nimport httpStatus from 'http-status'\n\nimport { addDataAndFileToRequest } from '../../utilities/addDataAndFileToRequest.js'\nimport { addLocalesToRequestFromData } from '../../utilities/addLocalesToRequest.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { mergeHeaders } from '../../utilities/mergeHeaders.js'\n\nconst handleError = async (\n  payload: Payload,\n  err: any,\n  debug: boolean,\n  afterErrorHook: CollectionAfterErrorHook,\n  // eslint-disable-next-line @typescript-eslint/require-await\n): Promise<GraphQLFormattedError> => {\n  const status = err.originalError.status || httpStatus.INTERNAL_SERVER_ERROR\n  let errorMessage = err.message\n  payload.logger.error(err.stack)\n\n  // Internal server errors can contain anything, including potentially sensitive data.\n  // Therefore, error details will be hidden from the response unless `config.debug` is `true`\n  if (!debug && status === httpStatus.INTERNAL_SERVER_ERROR) {\n    errorMessage = 'Something went wrong.'\n  }\n\n  let response: GraphQLFormattedError = {\n    extensions: {\n      name: err?.originalError?.name || undefined,\n      data: (err && err.originalError && err.originalError.data) || undefined,\n      stack: debug ? err.stack : undefined,\n      statusCode: status,\n    },\n    locations: err.locations,\n    message: errorMessage,\n    path: err.path,\n  }\n\n  if (afterErrorHook) {\n    ;({ response } = afterErrorHook(err, response, null, null) || { response })\n  }\n\n  return response\n}\n\nlet cached = global._payload_graphql\n\nif (!cached) {\n  cached = global._payload_graphql = { graphql: null, promise: null }\n}\n\nexport const getGraphql = async (config: Promise<SanitizedConfig> | SanitizedConfig) => {\n  if (process.env.NODE_ENV === 'development') {\n    cached = global._payload_graphql = { graphql: null, promise: null }\n  }\n\n  if (cached.graphql) {\n    return cached.graphql\n  }\n\n  if (!cached.promise) {\n    const resolvedConfig = await config\n    cached.promise = new Promise((resolve) => {\n      const schema = configToSchema(resolvedConfig)\n      resolve(cached.graphql || schema)\n    })\n  }\n\n  try {\n    cached.graphql = await cached.promise\n  } catch (e) {\n    cached.promise = null\n    throw e\n  }\n\n  return cached.graphql\n}\n\nexport const POST =\n  (config: Promise<SanitizedConfig> | SanitizedConfig) => async (request: Request) => {\n    const originalRequest = request.clone()\n    const req = await createPayloadRequest({\n      config,\n      request,\n    })\n\n    await addDataAndFileToRequest(req)\n    addLocalesToRequestFromData(req)\n\n    const { schema, validationRules } = await getGraphql(config)\n\n    const { payload } = req\n\n    const afterErrorHook =\n      typeof payload.config.hooks.afterError === 'function' ? payload.config.hooks.afterError : null\n\n    const headers = {}\n    const apiResponse = await createHandler({\n      context: { headers, req },\n      onOperation: async (request, args, result) => {\n        const response =\n          typeof payload.extensions === 'function'\n            ? await payload.extensions({\n                args,\n                req: request,\n                result,\n              })\n            : result\n        if (response.errors) {\n          const errors = (await Promise.all(\n            result.errors.map((error) => {\n              return handleError(payload, error, payload.config.debug, afterErrorHook)\n            }),\n          )) as GraphQLError[]\n          // errors type should be FormattedGraphQLError[] but onOperation has a return type of ExecutionResult instead of FormattedExecutionResult\n          return { ...response, errors }\n        }\n        return response\n      },\n      schema,\n      validationRules: (_, args, defaultRules) => defaultRules.concat(validationRules(args)),\n    })(originalRequest)\n\n    const resHeaders = headersWithCors({\n      headers: new Headers(apiResponse.headers),\n      req,\n    })\n\n    for (const key in headers) {\n      resHeaders.append(key, headers[key])\n    }\n\n    return new Response(apiResponse.body, {\n      headers: req.responseHeaders ? mergeHeaders(req.responseHeaders, resHeaders) : resHeaders,\n      status: apiResponse.status,\n    })\n  }\n"],"mappings":"AAGA,SAASA,cAAc,QAAQ;AAC/B,SAASC,aAAa,QAAQ;AAC9B,OAAOC,UAAA,MAAgB;AAEvB,SAASC,uBAAuB,QAAQ;AACxC,SAASC,2BAA2B,QAAQ;AAC5C,SAASC,oBAAoB,QAAQ;AACrC,SAASC,eAAe,QAAQ;AAChC,SAASC,YAAY,QAAQ;AAE7B,MAAMC,WAAA,GAAc,MAAAA,CAClBC,OAAA,EACAC,GAAA,EACAC,KAAA,EACAC,cAAA;EAGA,MAAMC,MAAA,GAASH,GAAA,CAAII,aAAa,CAACD,MAAM,IAAIX,UAAA,CAAWa,qBAAqB;EAC3E,IAAIC,YAAA,GAAeN,GAAA,CAAIO,OAAO;EAC9BR,OAAA,CAAQS,MAAM,CAACC,KAAK,CAACT,GAAA,CAAIU,KAAK;EAE9B;EACA;EACA,IAAI,CAACT,KAAA,IAASE,MAAA,KAAWX,UAAA,CAAWa,qBAAqB,EAAE;IACzDC,YAAA,GAAe;EACjB;EAEA,IAAIK,QAAA,GAAkC;IACpCC,UAAA,EAAY;MACVC,IAAA,EAAMb,GAAA,EAAKI,aAAA,EAAeS,IAAA,IAAQC,SAAA;MAClCC,IAAA,EAAMf,GAAC,IAAOA,GAAA,CAAII,aAAa,IAAIJ,GAAA,CAAII,aAAa,CAACW,IAAI,IAAKD,SAAA;MAC9DJ,KAAA,EAAOT,KAAA,GAAQD,GAAA,CAAIU,KAAK,GAAGI,SAAA;MAC3BE,UAAA,EAAYb;IACd;IACAc,SAAA,EAAWjB,GAAA,CAAIiB,SAAS;IACxBV,OAAA,EAASD,YAAA;IACTY,IAAA,EAAMlB,GAAA,CAAIkB;EACZ;EAEA,IAAIhB,cAAA,EAAgB;IAChB;MAAES;IAAQ,CAAE,GAAGT,cAAA,CAAeF,GAAA,EAAKW,QAAA,EAAU,MAAM,SAAS;MAAEA;IAAS;EAC3E;EAEA,OAAOA,QAAA;AACT;AAEA,IAAIQ,MAAA,GAASC,MAAA,CAAOC,gBAAgB;AAEpC,IAAI,CAACF,MAAA,EAAQ;EACXA,MAAA,GAASC,MAAA,CAAOC,gBAAgB,GAAG;IAAEC,OAAA,EAAS;IAAMC,OAAA,EAAS;EAAK;AACpE;AAEA,OAAO,MAAMC,UAAA,GAAa,MAAOC,MAAA;EAC/B,IAAIC,OAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe;IAC1CT,MAAA,GAASC,MAAA,CAAOC,gBAAgB,GAAG;MAAEC,OAAA,EAAS;MAAMC,OAAA,EAAS;IAAK;EACpE;EAEA,IAAIJ,MAAA,CAAOG,OAAO,EAAE;IAClB,OAAOH,MAAA,CAAOG,OAAO;EACvB;EAEA,IAAI,CAACH,MAAA,CAAOI,OAAO,EAAE;IACnB,MAAMM,cAAA,GAAiB,MAAMJ,MAAA;IAC7BN,MAAA,CAAOI,OAAO,GAAG,IAAIO,OAAA,CAASC,OAAA;MAC5B,MAAMC,MAAA,GAAS1C,cAAA,CAAeuC,cAAA;MAC9BE,OAAA,CAAQZ,MAAA,CAAOG,OAAO,IAAIU,MAAA;IAC5B;EACF;EAEA,IAAI;IACFb,MAAA,CAAOG,OAAO,GAAG,MAAMH,MAAA,CAAOI,OAAO;EACvC,EAAE,OAAOU,CAAA,EAAG;IACVd,MAAA,CAAOI,OAAO,GAAG;IACjB,MAAMU,CAAA;EACR;EAEA,OAAOd,MAAA,CAAOG,OAAO;AACvB;AAEA,OAAO,MAAMY,IAAA,GACVT,MAAA,IAAuD,MAAOU,OAAA;EAC7D,MAAMC,eAAA,GAAkBD,OAAA,CAAQE,KAAK;EACrC,MAAMC,GAAA,GAAM,MAAM3C,oBAAA,CAAqB;IACrC8B,MAAA;IACAU;EACF;EAEA,MAAM1C,uBAAA,CAAwB6C,GAAA;EAC9B5C,2BAAA,CAA4B4C,GAAA;EAE5B,MAAM;IAAEN,MAAM;IAAEO;EAAe,CAAE,GAAG,MAAMf,UAAA,CAAWC,MAAA;EAErD,MAAM;IAAE1B;EAAO,CAAE,GAAGuC,GAAA;EAEpB,MAAMpC,cAAA,GACJ,OAAOH,OAAA,CAAQ0B,MAAM,CAACe,KAAK,CAACC,UAAU,KAAK,aAAa1C,OAAA,CAAQ0B,MAAM,CAACe,KAAK,CAACC,UAAU,GAAG;EAE5F,MAAMC,OAAA,GAAU,CAAC;EACjB,MAAMC,WAAA,GAAc,MAAMpD,aAAA,CAAc;IACtCqD,OAAA,EAAS;MAAEF,OAAA;MAASJ;IAAI;IACxBO,WAAA,EAAa,MAAAA,CAAOV,OAAA,EAASW,IAAA,EAAMC,MAAA;MACjC,MAAMpC,QAAA,GACJ,OAAOZ,OAAA,CAAQa,UAAU,KAAK,aAC1B,MAAMb,OAAA,CAAQa,UAAU,CAAC;QACvBkC,IAAA;QACAR,GAAA,EAAKH,OAAA;QACLY;MACF,KACAA,MAAA;MACN,IAAIpC,QAAA,CAASqC,MAAM,EAAE;QACnB,MAAMA,MAAA,GAAU,MAAMlB,OAAA,CAAQmB,GAAG,CAC/BF,MAAA,CAAOC,MAAM,CAACE,GAAG,CAAEzC,KAAA;UACjB,OAAOX,WAAA,CAAYC,OAAA,EAASU,KAAA,EAAOV,OAAA,CAAQ0B,MAAM,CAACxB,KAAK,EAAEC,cAAA;QAC3D;QAEF;QACA,OAAO;UAAE,GAAGS,QAAQ;UAAEqC;QAAO;MAC/B;MACA,OAAOrC,QAAA;IACT;IACAqB,MAAA;IACAO,eAAA,EAAiBA,CAACY,CAAA,EAAGL,IAAA,EAAMM,YAAA,KAAiBA,YAAA,CAAaC,MAAM,CAACd,eAAA,CAAgBO,IAAA;EAClF,GAAGV,eAAA;EAEH,MAAMkB,UAAA,GAAa1D,eAAA,CAAgB;IACjC8C,OAAA,EAAS,IAAIa,OAAA,CAAQZ,WAAA,CAAYD,OAAO;IACxCJ;EACF;EAEA,KAAK,MAAMkB,GAAA,IAAOd,OAAA,EAAS;IACzBY,UAAA,CAAWG,MAAM,CAACD,GAAA,EAAKd,OAAO,CAACc,GAAA,CAAI;EACrC;EAEA,OAAO,IAAIE,QAAA,CAASf,WAAA,CAAYgB,IAAI,EAAE;IACpCjB,OAAA,EAASJ,GAAA,CAAIsB,eAAe,GAAG/D,YAAA,CAAayC,GAAA,CAAIsB,eAAe,EAAEN,UAAA,IAAcA,UAAA;IAC/EnD,MAAA,EAAQwC,WAAA,CAAYxC;EACtB;AACF","ignoreList":[]}
+{"version":3,"file":"handler.js","names":["configToSchema","createHandler","httpStatus","addDataAndFileToRequest","addLocalesToRequestFromData","createPayloadRequest","headersWithCors","mergeHeaders","handleError","err","payload","req","status","originalError","INTERNAL_SERVER_ERROR","errorMessage","message","logger","error","stack","config","debug","response","extensions","name","undefined","data","statusCode","locations","path","hooks","afterError","reduce","promise","hook","result","context","graphqlResult","Promise","resolve","cached","global","_payload_graphql","graphql","getGraphql","process","env","NODE_ENV","resolvedConfig","schema","e","POST","request","originalRequest","clone","validationRules","headers","apiResponse","onOperation","args","errors","all","map","_","defaultRules","concat","resHeaders","Headers","key","append","Response","body","responseHeaders"],"sources":["../../../src/routes/graphql/handler.ts"],"sourcesContent":["import type { GraphQLError, GraphQLFormattedError } from 'graphql'\nimport type { APIError, Payload, PayloadRequest, SanitizedConfig } from 'payload'\n\nimport { configToSchema } from '@payloadcms/graphql'\nimport { createHandler } from 'graphql-http/lib/use/fetch'\nimport httpStatus from 'http-status'\n\nimport { addDataAndFileToRequest } from '../../utilities/addDataAndFileToRequest.js'\nimport { addLocalesToRequestFromData } from '../../utilities/addLocalesToRequest.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { mergeHeaders } from '../../utilities/mergeHeaders.js'\n\nconst handleError = async ({\n  err,\n  payload,\n  req,\n}: {\n  err: GraphQLError\n  payload: Payload\n  req: PayloadRequest\n}): Promise<GraphQLFormattedError> => {\n  const status = (err.originalError as APIError).status || httpStatus.INTERNAL_SERVER_ERROR\n  let errorMessage = err.message\n  payload.logger.error(err.stack)\n\n  // Internal server errors can contain anything, including potentially sensitive data.\n  // Therefore, error details will be hidden from the response unless `config.debug` is `true`\n  if (!payload.config.debug && status === httpStatus.INTERNAL_SERVER_ERROR) {\n    errorMessage = 'Something went wrong.'\n  }\n\n  let response: GraphQLFormattedError = {\n    extensions: {\n      name: err?.originalError?.name || undefined,\n      data: (err && err.originalError && (err.originalError as APIError).data) || undefined,\n      stack: payload.config.debug ? err.stack : undefined,\n      statusCode: status,\n    },\n    locations: err.locations,\n    message: errorMessage,\n    path: err.path,\n  }\n\n  await payload.config.hooks.afterError?.reduce(async (promise, hook) => {\n    await promise\n\n    const result = await hook({\n      context: req.context,\n      error: err,\n      graphqlResult: response,\n      req,\n    })\n\n    if (result) {\n      response = result.graphqlResult || response\n    }\n  }, Promise.resolve())\n\n  return response\n}\n\nlet cached = global._payload_graphql\n\nif (!cached) {\n  cached = global._payload_graphql = { graphql: null, promise: null }\n}\n\nexport const getGraphql = async (config: Promise<SanitizedConfig> | SanitizedConfig) => {\n  if (process.env.NODE_ENV === 'development') {\n    cached = global._payload_graphql = { graphql: null, promise: null }\n  }\n\n  if (cached.graphql) {\n    return cached.graphql\n  }\n\n  if (!cached.promise) {\n    const resolvedConfig = await config\n    cached.promise = new Promise((resolve) => {\n      const schema = configToSchema(resolvedConfig)\n      resolve(cached.graphql || schema)\n    })\n  }\n\n  try {\n    cached.graphql = await cached.promise\n  } catch (e) {\n    cached.promise = null\n    throw e\n  }\n\n  return cached.graphql\n}\n\nexport const POST =\n  (config: Promise<SanitizedConfig> | SanitizedConfig) => async (request: Request) => {\n    const originalRequest = request.clone()\n    const req = await createPayloadRequest({\n      config,\n      request,\n    })\n\n    await addDataAndFileToRequest(req)\n    addLocalesToRequestFromData(req)\n\n    const { schema, validationRules } = await getGraphql(config)\n\n    const { payload } = req\n\n    const headers = {}\n    const apiResponse = await createHandler({\n      context: { headers, req },\n      onOperation: async (request, args, result) => {\n        const response =\n          typeof payload.extensions === 'function'\n            ? await payload.extensions({\n                args,\n                req: request,\n                result,\n              })\n            : result\n        if (response.errors) {\n          const errors = (await Promise.all(\n            result.errors.map((error) => {\n              return handleError({ err: error, payload, req })\n            }),\n          )) as GraphQLError[]\n          // errors type should be FormattedGraphQLError[] but onOperation has a return type of ExecutionResult instead of FormattedExecutionResult\n          return { ...response, errors }\n        }\n        return response\n      },\n      schema,\n      validationRules: (_, args, defaultRules) => defaultRules.concat(validationRules(args)),\n    })(originalRequest)\n\n    const resHeaders = headersWithCors({\n      headers: new Headers(apiResponse.headers),\n      req,\n    })\n\n    for (const key in headers) {\n      resHeaders.append(key, headers[key])\n    }\n\n    return new Response(apiResponse.body, {\n      headers: req.responseHeaders ? mergeHeaders(req.responseHeaders, resHeaders) : resHeaders,\n      status: apiResponse.status,\n    })\n  }\n"],"mappings":"AAGA,SAASA,cAAc,QAAQ;AAC/B,SAASC,aAAa,QAAQ;AAC9B,OAAOC,UAAA,MAAgB;AAEvB,SAASC,uBAAuB,QAAQ;AACxC,SAASC,2BAA2B,QAAQ;AAC5C,SAASC,oBAAoB,QAAQ;AACrC,SAASC,eAAe,QAAQ;AAChC,SAASC,YAAY,QAAQ;AAE7B,MAAMC,WAAA,GAAc,MAAAA,CAAO;EACzBC,GAAG;EACHC,OAAO;EACPC;AAAG,CAKJ;EACC,MAAMC,MAAA,GAASH,GAAC,CAAII,aAAa,CAAcD,MAAM,IAAIV,UAAA,CAAWY,qBAAqB;EACzF,IAAIC,YAAA,GAAeN,GAAA,CAAIO,OAAO;EAC9BN,OAAA,CAAQO,MAAM,CAACC,KAAK,CAACT,GAAA,CAAIU,KAAK;EAE9B;EACA;EACA,IAAI,CAACT,OAAA,CAAQU,MAAM,CAACC,KAAK,IAAIT,MAAA,KAAWV,UAAA,CAAWY,qBAAqB,EAAE;IACxEC,YAAA,GAAe;EACjB;EAEA,IAAIO,QAAA,GAAkC;IACpCC,UAAA,EAAY;MACVC,IAAA,EAAMf,GAAA,EAAKI,aAAA,EAAeW,IAAA,IAAQC,SAAA;MAClCC,IAAA,EAAMjB,GAAC,IAAOA,GAAA,CAAII,aAAa,IAAIJ,GAAC,CAAII,aAAa,CAAca,IAAI,IAAKD,SAAA;MAC5EN,KAAA,EAAOT,OAAA,CAAQU,MAAM,CAACC,KAAK,GAAGZ,GAAA,CAAIU,KAAK,GAAGM,SAAA;MAC1CE,UAAA,EAAYf;IACd;IACAgB,SAAA,EAAWnB,GAAA,CAAImB,SAAS;IACxBZ,OAAA,EAASD,YAAA;IACTc,IAAA,EAAMpB,GAAA,CAAIoB;EACZ;EAEA,MAAMnB,OAAA,CAAQU,MAAM,CAACU,KAAK,CAACC,UAAU,EAAEC,MAAA,CAAO,OAAOC,OAAA,EAASC,IAAA;IAC5D,MAAMD,OAAA;IAEN,MAAME,MAAA,GAAS,MAAMD,IAAA,CAAK;MACxBE,OAAA,EAASzB,GAAA,CAAIyB,OAAO;MACpBlB,KAAA,EAAOT,GAAA;MACP4B,aAAA,EAAef,QAAA;MACfX;IACF;IAEA,IAAIwB,MAAA,EAAQ;MACVb,QAAA,GAAWa,MAAA,CAAOE,aAAa,IAAIf,QAAA;IACrC;EACF,GAAGgB,OAAA,CAAQC,OAAO;EAElB,OAAOjB,QAAA;AACT;AAEA,IAAIkB,MAAA,GAASC,MAAA,CAAOC,gBAAgB;AAEpC,IAAI,CAACF,MAAA,EAAQ;EACXA,MAAA,GAASC,MAAA,CAAOC,gBAAgB,GAAG;IAAEC,OAAA,EAAS;IAAMV,OAAA,EAAS;EAAK;AACpE;AAEA,OAAO,MAAMW,UAAA,GAAa,MAAOxB,MAAA;EAC/B,IAAIyB,OAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe;IAC1CP,MAAA,GAASC,MAAA,CAAOC,gBAAgB,GAAG;MAAEC,OAAA,EAAS;MAAMV,OAAA,EAAS;IAAK;EACpE;EAEA,IAAIO,MAAA,CAAOG,OAAO,EAAE;IAClB,OAAOH,MAAA,CAAOG,OAAO;EACvB;EAEA,IAAI,CAACH,MAAA,CAAOP,OAAO,EAAE;IACnB,MAAMe,cAAA,GAAiB,MAAM5B,MAAA;IAC7BoB,MAAA,CAAOP,OAAO,GAAG,IAAIK,OAAA,CAASC,OAAA;MAC5B,MAAMU,MAAA,GAASjD,cAAA,CAAegD,cAAA;MAC9BT,OAAA,CAAQC,MAAA,CAAOG,OAAO,IAAIM,MAAA;IAC5B;EACF;EAEA,IAAI;IACFT,MAAA,CAAOG,OAAO,GAAG,MAAMH,MAAA,CAAOP,OAAO;EACvC,EAAE,OAAOiB,CAAA,EAAG;IACVV,MAAA,CAAOP,OAAO,GAAG;IACjB,MAAMiB,CAAA;EACR;EAEA,OAAOV,MAAA,CAAOG,OAAO;AACvB;AAEA,OAAO,MAAMQ,IAAA,GACV/B,MAAA,IAAuD,MAAOgC,OAAA;EAC7D,MAAMC,eAAA,GAAkBD,OAAA,CAAQE,KAAK;EACrC,MAAM3C,GAAA,GAAM,MAAMN,oBAAA,CAAqB;IACrCe,MAAA;IACAgC;EACF;EAEA,MAAMjD,uBAAA,CAAwBQ,GAAA;EAC9BP,2BAAA,CAA4BO,GAAA;EAE5B,MAAM;IAAEsC,MAAM;IAAEM;EAAe,CAAE,GAAG,MAAMX,UAAA,CAAWxB,MAAA;EAErD,MAAM;IAAEV;EAAO,CAAE,GAAGC,GAAA;EAEpB,MAAM6C,OAAA,GAAU,CAAC;EACjB,MAAMC,WAAA,GAAc,MAAMxD,aAAA,CAAc;IACtCmC,OAAA,EAAS;MAAEoB,OAAA;MAAS7C;IAAI;IACxB+C,WAAA,EAAa,MAAAA,CAAON,OAAA,EAASO,IAAA,EAAMxB,MAAA;MACjC,MAAMb,QAAA,GACJ,OAAOZ,OAAA,CAAQa,UAAU,KAAK,aAC1B,MAAMb,OAAA,CAAQa,UAAU,CAAC;QACvBoC,IAAA;QACAhD,GAAA,EAAKyC,OAAA;QACLjB;MACF,KACAA,MAAA;MACN,IAAIb,QAAA,CAASsC,MAAM,EAAE;QACnB,MAAMA,MAAA,GAAU,MAAMtB,OAAA,CAAQuB,GAAG,CAC/B1B,MAAA,CAAOyB,MAAM,CAACE,GAAG,CAAE5C,KAAA;UACjB,OAAOV,WAAA,CAAY;YAAEC,GAAA,EAAKS,KAAA;YAAOR,OAAA;YAASC;UAAI;QAChD;QAEF;QACA,OAAO;UAAE,GAAGW,QAAQ;UAAEsC;QAAO;MAC/B;MACA,OAAOtC,QAAA;IACT;IACA2B,MAAA;IACAM,eAAA,EAAiBA,CAACQ,CAAA,EAAGJ,IAAA,EAAMK,YAAA,KAAiBA,YAAA,CAAaC,MAAM,CAACV,eAAA,CAAgBI,IAAA;EAClF,GAAGN,eAAA;EAEH,MAAMa,UAAA,GAAa5D,eAAA,CAAgB;IACjCkD,OAAA,EAAS,IAAIW,OAAA,CAAQV,WAAA,CAAYD,OAAO;IACxC7C;EACF;EAEA,KAAK,MAAMyD,GAAA,IAAOZ,OAAA,EAAS;IACzBU,UAAA,CAAWG,MAAM,CAACD,GAAA,EAAKZ,OAAO,CAACY,GAAA,CAAI;EACrC;EAEA,OAAO,IAAIE,QAAA,CAASb,WAAA,CAAYc,IAAI,EAAE;IACpCf,OAAA,EAAS7C,GAAA,CAAI6D,eAAe,GAAGjE,YAAA,CAAaI,GAAA,CAAI6D,eAAe,EAAEN,UAAA,IAAcA,UAAA;IAC/EtD,MAAA,EAAQ6C,WAAA,CAAY7C;EACtB;AACF","ignoreList":[]}

package/dist/routes/rest/auth/login.js

@@ -26,8 +26,8 @@ export const login = async ({
     req
   });
   const cookie = generatePayloadCookie({
-    collectionConfig: collection.config,
-    payload: req.payload,
+    collectionAuthConfig: collection.config.auth,
+    cookiePrefix: req.payload.config.cookiePrefix,
     token: result.token
   });
   if (collection.config.auth.removeTokenFromResponses) {

package/dist/routes/rest/auth/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","names":["httpStatus","generatePayloadCookie","loginOperation","isNumber","headersWithCors","login","collection","req","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","result","Number","undefined","cookie","collectionConfig","payload","token","removeTokenFromResponses","Response","json","message","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/auth/login.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, loginOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const login: CollectionRouteHandler = async ({ collection, req }) => {\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const result = await loginOperation({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionConfig: collection.config,\n    payload: req.payload,\n    token: result.token,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,cAAc,QAAQ;AACtD,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,KAAA,GAAgC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACrE,MAAM;IAAEC,YAAY;IAAEC;EAAC,CAAE,GAAGF,GAAA;EAC5B,MAAMG,KAAA,GAAQF,YAAA,CAAaG,GAAG,CAAC;EAC/B,MAAMC,QAAA,GACJN,UAAA,CAAWO,MAAM,CAACC,IAAI,EAAEC,iBAAA,KAAsB,QAC1C;IACEC,KAAA,EAAO,OAAOT,GAAA,CAAIU,IAAI,EAAED,KAAA,KAAU,WAAWT,GAAA,CAAIU,IAAI,CAACD,KAAK,GAAG;IAC9DE,QAAA,EAAU,OAAOX,GAAA,CAAIU,IAAI,EAAEC,QAAA,KAAa,WAAWX,GAAA,CAAIU,IAAI,CAACC,QAAQ,GAAG;IACvEC,QAAA,EAAU,OAAOZ,GAAA,CAAIU,IAAI,EAAEE,QAAA,KAAa,WAAWZ,GAAA,CAAIU,IAAI,CAACE,QAAQ,GAAG;EACzE,IACA;IACEH,KAAA,EAAO,OAAOT,GAAA,CAAIU,IAAI,EAAED,KAAA,KAAU,WAAWT,GAAA,CAAIU,IAAI,CAACD,KAAK,GAAG;IAC9DE,QAAA,EAAU,OAAOX,GAAA,CAAIU,IAAI,EAAEC,QAAA,KAAa,WAAWX,GAAA,CAAIU,IAAI,CAACC,QAAQ,GAAG;EACzE;EAEN,MAAME,MAAA,GAAS,MAAMlB,cAAA,CAAe;IAClCI,UAAA;IACAW,IAAA,EAAML,QAAA;IACNF,KAAA,EAAOP,QAAA,CAASO,KAAA,IAASW,MAAA,CAAOX,KAAA,IAASY,SAAA;IACzCf;EACF;EAEA,MAAMgB,MAAA,GAAStB,qBAAA,CAAsB;IACnCuB,gBAAA,EAAkBlB,UAAA,CAAWO,MAAM;IACnCY,OAAA,EAASlB,GAAA,CAAIkB,OAAO;IACpBC,KAAA,EAAON,MAAA,CAAOM;EAChB;EAEA,IAAIpB,UAAA,CAAWO,MAAM,CAACC,IAAI,CAACa,wBAAwB,EAAE;IACnD,OAAOP,MAAA,CAAOM,KAAK;EACrB;EAEA,OAAOE,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAASrB,CAAA,CAAE;IACX,GAAGW;EACL,GACA;IACEW,OAAA,EAAS3B,eAAA,CAAgB;MACvB2B,OAAA,EAAS,IAAIC,OAAA,CAAQ;QACnB,cAAcT;MAChB;MACAhB;IACF;IACA0B,MAAA,EAAQjC,UAAA,CAAWkC;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"login.js","names":["httpStatus","generatePayloadCookie","loginOperation","isNumber","headersWithCors","login","collection","req","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","result","Number","undefined","cookie","collectionAuthConfig","cookiePrefix","payload","token","removeTokenFromResponses","Response","json","message","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/auth/login.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, loginOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const login: CollectionRouteHandler = async ({ collection, req }) => {\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const result = await loginOperation({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,cAAc,QAAQ;AACtD,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,KAAA,GAAgC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACrE,MAAM;IAAEC,YAAY;IAAEC;EAAC,CAAE,GAAGF,GAAA;EAC5B,MAAMG,KAAA,GAAQF,YAAA,CAAaG,GAAG,CAAC;EAC/B,MAAMC,QAAA,GACJN,UAAA,CAAWO,MAAM,CAACC,IAAI,EAAEC,iBAAA,KAAsB,QAC1C;IACEC,KAAA,EAAO,OAAOT,GAAA,CAAIU,IAAI,EAAED,KAAA,KAAU,WAAWT,GAAA,CAAIU,IAAI,CAACD,KAAK,GAAG;IAC9DE,QAAA,EAAU,OAAOX,GAAA,CAAIU,IAAI,EAAEC,QAAA,KAAa,WAAWX,GAAA,CAAIU,IAAI,CAACC,QAAQ,GAAG;IACvEC,QAAA,EAAU,OAAOZ,GAAA,CAAIU,IAAI,EAAEE,QAAA,KAAa,WAAWZ,GAAA,CAAIU,IAAI,CAACE,QAAQ,GAAG;EACzE,IACA;IACEH,KAAA,EAAO,OAAOT,GAAA,CAAIU,IAAI,EAAED,KAAA,KAAU,WAAWT,GAAA,CAAIU,IAAI,CAACD,KAAK,GAAG;IAC9DE,QAAA,EAAU,OAAOX,GAAA,CAAIU,IAAI,EAAEC,QAAA,KAAa,WAAWX,GAAA,CAAIU,IAAI,CAACC,QAAQ,GAAG;EACzE;EAEN,MAAME,MAAA,GAAS,MAAMlB,cAAA,CAAe;IAClCI,UAAA;IACAW,IAAA,EAAML,QAAA;IACNF,KAAA,EAAOP,QAAA,CAASO,KAAA,IAASW,MAAA,CAAOX,KAAA,IAASY,SAAA;IACzCf;EACF;EAEA,MAAMgB,MAAA,GAAStB,qBAAA,CAAsB;IACnCuB,oBAAA,EAAsBlB,UAAA,CAAWO,MAAM,CAACC,IAAI;IAC5CW,YAAA,EAAclB,GAAA,CAAImB,OAAO,CAACb,MAAM,CAACY,YAAY;IAC7CE,KAAA,EAAOP,MAAA,CAAOO;EAChB;EAEA,IAAIrB,UAAA,CAAWO,MAAM,CAACC,IAAI,CAACc,wBAAwB,EAAE;IACnD,OAAOR,MAAA,CAAOO,KAAK;EACrB;EAEA,OAAOE,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAAStB,CAAA,CAAE;IACX,GAAGW;EACL,GACA;IACEY,OAAA,EAAS5B,eAAA,CAAgB;MACvB4B,OAAA,EAAS,IAAIC,OAAA,CAAQ;QACnB,cAAcV;MAChB;MACAhB;IACF;IACA2B,MAAA,EAAQlC,UAAA,CAAWmC;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/auth/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/auth/logout.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIzD,eAAO,MAAM,MAAM,EAAE,sBAwCpB,CAAA"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/auth/logout.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIzD,eAAO,MAAM,MAAM,EAAE,sBAyCpB,CAAA"}

package/dist/routes/rest/auth/logout.js

@@ -25,8 +25,9 @@ export const logout = async ({
     });
   }
   const expiredCookie = generateExpiredPayloadCookie({
-    collectionConfig: collection.config,
-    payload: req.payload
+    collectionAuthConfig: collection.config.auth,
+    config: req.payload.config,
+    cookiePrefix: req.payload.config.cookiePrefix
   });
   headers.set('Set-Cookie', expiredCookie);
   return Response.json({

package/dist/routes/rest/auth/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","names":["httpStatus","generateExpiredPayloadCookie","logoutOperation","headersWithCors","logout","collection","req","t","result","headers","Headers","Response","json","message","status","BAD_REQUEST","expiredCookie","collectionConfig","config","payload","set","OK"],"sources":["../../../../src/routes/rest/auth/logout.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generateExpiredPayloadCookie, logoutOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const logout: CollectionRouteHandler = async ({ collection, req }) => {\n  const { t } = req\n  const result = await logoutOperation({\n    collection,\n    req,\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (!result) {\n    return Response.json(\n      {\n        message: t('error:logoutFailed'),\n      },\n      {\n        headers,\n        status: httpStatus.BAD_REQUEST,\n      },\n    )\n  }\n\n  const expiredCookie = generateExpiredPayloadCookie({\n    collectionConfig: collection.config,\n    payload: req.payload,\n  })\n\n  headers.set('Set-Cookie', expiredCookie)\n\n  return Response.json(\n    {\n      message: t('authentication:logoutSuccessful'),\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,4BAA4B,EAAEC,eAAe,QAAQ;AAI9D,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,MAAA,GAAiC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACtE,MAAM;IAAEC;EAAC,CAAE,GAAGD,GAAA;EACd,MAAME,MAAA,GAAS,MAAMN,eAAA,CAAgB;IACnCG,UAAA;IACAC;EACF;EAEA,MAAMG,OAAA,GAAUN,eAAA,CAAgB;IAC9BM,OAAA,EAAS,IAAIC,OAAA;IACbJ;EACF;EAEA,IAAI,CAACE,MAAA,EAAQ;IACX,OAAOG,QAAA,CAASC,IAAI,CAClB;MACEC,OAAA,EAASN,CAAA,CAAE;IACb,GACA;MACEE,OAAA;MACAK,MAAA,EAAQd,UAAA,CAAWe;IACrB;EAEJ;EAEA,MAAMC,aAAA,GAAgBf,4BAAA,CAA6B;IACjDgB,gBAAA,EAAkBZ,UAAA,CAAWa,MAAM;IACnCC,OAAA,EAASb,GAAA,CAAIa;EACf;EAEAV,OAAA,CAAQW,GAAG,CAAC,cAAcJ,aAAA;EAE1B,OAAOL,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAASN,CAAA,CAAE;EACb,GACA;IACEE,OAAA;IACAK,MAAA,EAAQd,UAAA,CAAWqB;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"logout.js","names":["httpStatus","generateExpiredPayloadCookie","logoutOperation","headersWithCors","logout","collection","req","t","result","headers","Headers","Response","json","message","status","BAD_REQUEST","expiredCookie","collectionAuthConfig","config","auth","payload","cookiePrefix","set","OK"],"sources":["../../../../src/routes/rest/auth/logout.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generateExpiredPayloadCookie, logoutOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const logout: CollectionRouteHandler = async ({ collection, req }) => {\n  const { t } = req\n  const result = await logoutOperation({\n    collection,\n    req,\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (!result) {\n    return Response.json(\n      {\n        message: t('error:logoutFailed'),\n      },\n      {\n        headers,\n        status: httpStatus.BAD_REQUEST,\n      },\n    )\n  }\n\n  const expiredCookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    config: req.payload.config,\n    cookiePrefix: req.payload.config.cookiePrefix,\n  })\n\n  headers.set('Set-Cookie', expiredCookie)\n\n  return Response.json(\n    {\n      message: t('authentication:logoutSuccessful'),\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,4BAA4B,EAAEC,eAAe,QAAQ;AAI9D,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,MAAA,GAAiC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACtE,MAAM;IAAEC;EAAC,CAAE,GAAGD,GAAA;EACd,MAAME,MAAA,GAAS,MAAMN,eAAA,CAAgB;IACnCG,UAAA;IACAC;EACF;EAEA,MAAMG,OAAA,GAAUN,eAAA,CAAgB;IAC9BM,OAAA,EAAS,IAAIC,OAAA;IACbJ;EACF;EAEA,IAAI,CAACE,MAAA,EAAQ;IACX,OAAOG,QAAA,CAASC,IAAI,CAClB;MACEC,OAAA,EAASN,CAAA,CAAE;IACb,GACA;MACEE,OAAA;MACAK,MAAA,EAAQd,UAAA,CAAWe;IACrB;EAEJ;EAEA,MAAMC,aAAA,GAAgBf,4BAAA,CAA6B;IACjDgB,oBAAA,EAAsBZ,UAAA,CAAWa,MAAM,CAACC,IAAI;IAC5CD,MAAA,EAAQZ,GAAA,CAAIc,OAAO,CAACF,MAAM;IAC1BG,YAAA,EAAcf,GAAA,CAAIc,OAAO,CAACF,MAAM,CAACG;EACnC;EAEAZ,OAAA,CAAQa,GAAG,CAAC,cAAcN,aAAA;EAE1B,OAAOL,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAASN,CAAA,CAAE;EACb,GACA;IACEE,OAAA;IACAK,MAAA,EAAQd,UAAA,CAAWuB;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/auth/refresh.js

@@ -18,8 +18,8 @@ export const refresh = async ({
   });
   if (result.setCookie) {
     const cookie = generatePayloadCookie({
-      collectionConfig: collection.config,
-      payload: req.payload,
+      collectionAuthConfig: collection.config.auth,
+      cookiePrefix: req.payload.config.cookiePrefix,
       token: result.refreshedToken
     });
     if (collection.config.auth.removeTokenFromResponses) {

package/dist/routes/rest/auth/refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.js","names":["httpStatus","generatePayloadCookie","refreshOperation","headersWithCors","refresh","collection","req","t","headers","Headers","result","setCookie","cookie","collectionConfig","config","payload","token","refreshedToken","auth","removeTokenFromResponses","set","Response","json","message","status","OK"],"sources":["../../../../src/routes/rest/auth/refresh.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, refreshOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const refresh: CollectionRouteHandler = async ({ collection, req }) => {\n  const { t } = req\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  const result = await refreshOperation({\n    collection,\n    req,\n  })\n\n  if (result.setCookie) {\n    const cookie = generatePayloadCookie({\n      collectionConfig: collection.config,\n      payload: req.payload,\n      token: result.refreshedToken,\n    })\n\n    if (collection.config.auth.removeTokenFromResponses) {\n      delete result.refreshedToken\n    }\n\n    headers.set('Set-Cookie', cookie)\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:tokenRefreshSuccessful'),\n      ...result,\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,gBAAgB,QAAQ;AAIxD,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,OAAA,GAAkC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACvE,MAAM;IAAEC;EAAC,CAAE,GAAGD,GAAA;EAEd,MAAME,OAAA,GAAUL,eAAA,CAAgB;IAC9BK,OAAA,EAAS,IAAIC,OAAA;IACbH;EACF;EAEA,MAAMI,MAAA,GAAS,MAAMR,gBAAA,CAAiB;IACpCG,UAAA;IACAC;EACF;EAEA,IAAII,MAAA,CAAOC,SAAS,EAAE;IACpB,MAAMC,MAAA,GAASX,qBAAA,CAAsB;MACnCY,gBAAA,EAAkBR,UAAA,CAAWS,MAAM;MACnCC,OAAA,EAAST,GAAA,CAAIS,OAAO;MACpBC,KAAA,EAAON,MAAA,CAAOO;IAChB;IAEA,IAAIZ,UAAA,CAAWS,MAAM,CAACI,IAAI,CAACC,wBAAwB,EAAE;MACnD,OAAOT,MAAA,CAAOO,cAAc;IAC9B;IAEAT,OAAA,CAAQY,GAAG,CAAC,cAAcR,MAAA;EAC5B;EAEA,OAAOS,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAAShB,CAAA,CAAE;IACX,GAAGG;EACL,GACA;IACEF,OAAA;IACAgB,MAAA,EAAQxB,UAAA,CAAWyB;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"refresh.js","names":["httpStatus","generatePayloadCookie","refreshOperation","headersWithCors","refresh","collection","req","t","headers","Headers","result","setCookie","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","token","refreshedToken","removeTokenFromResponses","set","Response","json","message","status","OK"],"sources":["../../../../src/routes/rest/auth/refresh.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, refreshOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const refresh: CollectionRouteHandler = async ({ collection, req }) => {\n  const { t } = req\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  const result = await refreshOperation({\n    collection,\n    req,\n  })\n\n  if (result.setCookie) {\n    const cookie = generatePayloadCookie({\n      collectionAuthConfig: collection.config.auth,\n      cookiePrefix: req.payload.config.cookiePrefix,\n      token: result.refreshedToken,\n    })\n\n    if (collection.config.auth.removeTokenFromResponses) {\n      delete result.refreshedToken\n    }\n\n    headers.set('Set-Cookie', cookie)\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:tokenRefreshSuccessful'),\n      ...result,\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,gBAAgB,QAAQ;AAIxD,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,OAAA,GAAkC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACvE,MAAM;IAAEC;EAAC,CAAE,GAAGD,GAAA;EAEd,MAAME,OAAA,GAAUL,eAAA,CAAgB;IAC9BK,OAAA,EAAS,IAAIC,OAAA;IACbH;EACF;EAEA,MAAMI,MAAA,GAAS,MAAMR,gBAAA,CAAiB;IACpCG,UAAA;IACAC;EACF;EAEA,IAAII,MAAA,CAAOC,SAAS,EAAE;IACpB,MAAMC,MAAA,GAASX,qBAAA,CAAsB;MACnCY,oBAAA,EAAsBR,UAAA,CAAWS,MAAM,CAACC,IAAI;MAC5CC,YAAA,EAAcV,GAAA,CAAIW,OAAO,CAACH,MAAM,CAACE,YAAY;MAC7CE,KAAA,EAAOR,MAAA,CAAOS;IAChB;IAEA,IAAId,UAAA,CAAWS,MAAM,CAACC,IAAI,CAACK,wBAAwB,EAAE;MACnD,OAAOV,MAAA,CAAOS,cAAc;IAC9B;IAEAX,OAAA,CAAQa,GAAG,CAAC,cAAcT,MAAA;EAC5B;EAEA,OAAOU,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAASjB,CAAA,CAAE;IACX,GAAGG;EACL,GACA;IACEF,OAAA;IACAiB,MAAA,EAAQzB,UAAA,CAAW0B;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/auth/registerFirstUser.js

@@ -26,8 +26,8 @@ export const registerFirstUser = async ({
     req
   });
   const cookie = generatePayloadCookie({
-    collectionConfig: collection.config,
-    payload: req.payload,
+    collectionAuthConfig: collection.config.auth,
+    cookiePrefix: req.payload.config.cookiePrefix,
     token: result.token
   });
   return Response.json({

package/dist/routes/rest/auth/registerFirstUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"registerFirstUser.js","names":["httpStatus","generatePayloadCookie","registerFirstUserOperation","headersWithCors","registerFirstUser","collection","req","data","t","authData","config","auth","loginWithUsername","email","password","username","result","cookie","collectionConfig","payload","token","Response","json","exp","message","user","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/auth/registerFirstUser.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, registerFirstUserOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const registerFirstUser: CollectionRouteHandler = async ({ collection, req }) => {\n  const { data, t } = req\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n      }\n\n  const result = await registerFirstUserOperation({\n    collection,\n    data: {\n      ...data,\n      ...authData,\n    },\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionConfig: collection.config,\n    payload: req.payload,\n    token: result.token,\n  })\n\n  return Response.json(\n    {\n      exp: result.exp,\n      message: t('authentication:successfullyRegisteredFirstUser'),\n      token: result.token,\n      user: result.user,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,0BAA0B,QAAQ;AAIlE,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,iBAAA,GAA4C,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACjF,MAAM;IAAEC,IAAI;IAAEC;EAAC,CAAE,GAAGF,GAAA;EACpB,MAAMG,QAAA,GAAWJ,UAAA,CAAWK,MAAM,CAACC,IAAI,EAAEC,iBAAA,GACrC;IACEC,KAAA,EAAO,OAAOP,GAAA,CAAIC,IAAI,EAAEM,KAAA,KAAU,WAAWP,GAAA,CAAIC,IAAI,CAACM,KAAK,GAAG;IAC9DC,QAAA,EAAU,OAAOR,GAAA,CAAIC,IAAI,EAAEO,QAAA,KAAa,WAAWR,GAAA,CAAIC,IAAI,CAACO,QAAQ,GAAG;IACvEC,QAAA,EAAU,OAAOT,GAAA,CAAIC,IAAI,EAAEQ,QAAA,KAAa,WAAWT,GAAA,CAAIC,IAAI,CAACQ,QAAQ,GAAG;EACzE,IACA;IACEF,KAAA,EAAO,OAAOP,GAAA,CAAIC,IAAI,EAAEM,KAAA,KAAU,WAAWP,GAAA,CAAIC,IAAI,CAACM,KAAK,GAAG;IAC9DC,QAAA,EAAU,OAAOR,GAAA,CAAIC,IAAI,EAAEO,QAAA,KAAa,WAAWR,GAAA,CAAIC,IAAI,CAACO,QAAQ,GAAG;EACzE;EAEJ,MAAME,MAAA,GAAS,MAAMd,0BAAA,CAA2B;IAC9CG,UAAA;IACAE,IAAA,EAAM;MACJ,GAAGA,IAAI;MACP,GAAGE;IACL;IACAH;EACF;EAEA,MAAMW,MAAA,GAAShB,qBAAA,CAAsB;IACnCiB,gBAAA,EAAkBb,UAAA,CAAWK,MAAM;IACnCS,OAAA,EAASb,GAAA,CAAIa,OAAO;IACpBC,KAAA,EAAOJ,MAAA,CAAOI;EAChB;EAEA,OAAOC,QAAA,CAASC,IAAI,CAClB;IACEC,GAAA,EAAKP,MAAA,CAAOO,GAAG;IACfC,OAAA,EAAShB,CAAA,CAAE;IACXY,KAAA,EAAOJ,MAAA,CAAOI,KAAK;IACnBK,IAAA,EAAMT,MAAA,CAAOS;EACf,GACA;IACEC,OAAA,EAASvB,eAAA,CAAgB;MACvBuB,OAAA,EAAS,IAAIC,OAAA,CAAQ;QACnB,cAAcV;MAChB;MACAX;IACF;IACAsB,MAAA,EAAQ5B,UAAA,CAAW6B;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"registerFirstUser.js","names":["httpStatus","generatePayloadCookie","registerFirstUserOperation","headersWithCors","registerFirstUser","collection","req","data","t","authData","config","auth","loginWithUsername","email","password","username","result","cookie","collectionAuthConfig","cookiePrefix","payload","token","Response","json","exp","message","user","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/auth/registerFirstUser.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, registerFirstUserOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const registerFirstUser: CollectionRouteHandler = async ({ collection, req }) => {\n  const { data, t } = req\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n      }\n\n  const result = await registerFirstUserOperation({\n    collection,\n    data: {\n      ...data,\n      ...authData,\n    },\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token,\n  })\n\n  return Response.json(\n    {\n      exp: result.exp,\n      message: t('authentication:successfullyRegisteredFirstUser'),\n      token: result.token,\n      user: result.user,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,0BAA0B,QAAQ;AAIlE,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,iBAAA,GAA4C,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACjF,MAAM;IAAEC,IAAI;IAAEC;EAAC,CAAE,GAAGF,GAAA;EACpB,MAAMG,QAAA,GAAWJ,UAAA,CAAWK,MAAM,CAACC,IAAI,EAAEC,iBAAA,GACrC;IACEC,KAAA,EAAO,OAAOP,GAAA,CAAIC,IAAI,EAAEM,KAAA,KAAU,WAAWP,GAAA,CAAIC,IAAI,CAACM,KAAK,GAAG;IAC9DC,QAAA,EAAU,OAAOR,GAAA,CAAIC,IAAI,EAAEO,QAAA,KAAa,WAAWR,GAAA,CAAIC,IAAI,CAACO,QAAQ,GAAG;IACvEC,QAAA,EAAU,OAAOT,GAAA,CAAIC,IAAI,EAAEQ,QAAA,KAAa,WAAWT,GAAA,CAAIC,IAAI,CAACQ,QAAQ,GAAG;EACzE,IACA;IACEF,KAAA,EAAO,OAAOP,GAAA,CAAIC,IAAI,EAAEM,KAAA,KAAU,WAAWP,GAAA,CAAIC,IAAI,CAACM,KAAK,GAAG;IAC9DC,QAAA,EAAU,OAAOR,GAAA,CAAIC,IAAI,EAAEO,QAAA,KAAa,WAAWR,GAAA,CAAIC,IAAI,CAACO,QAAQ,GAAG;EACzE;EAEJ,MAAME,MAAA,GAAS,MAAMd,0BAAA,CAA2B;IAC9CG,UAAA;IACAE,IAAA,EAAM;MACJ,GAAGA,IAAI;MACP,GAAGE;IACL;IACAH;EACF;EAEA,MAAMW,MAAA,GAAShB,qBAAA,CAAsB;IACnCiB,oBAAA,EAAsBb,UAAA,CAAWK,MAAM,CAACC,IAAI;IAC5CQ,YAAA,EAAcb,GAAA,CAAIc,OAAO,CAACV,MAAM,CAACS,YAAY;IAC7CE,KAAA,EAAOL,MAAA,CAAOK;EAChB;EAEA,OAAOC,QAAA,CAASC,IAAI,CAClB;IACEC,GAAA,EAAKR,MAAA,CAAOQ,GAAG;IACfC,OAAA,EAASjB,CAAA,CAAE;IACXa,KAAA,EAAOL,MAAA,CAAOK,KAAK;IACnBK,IAAA,EAAMV,MAAA,CAAOU;EACf,GACA;IACEC,OAAA,EAASxB,eAAA,CAAgB;MACvBwB,OAAA,EAAS,IAAIC,OAAA,CAAQ;QACnB,cAAcX;MAChB;MACAX;IACF;IACAuB,MAAA,EAAQ7B,UAAA,CAAW8B;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/auth/resetPassword.js

@@ -20,8 +20,8 @@ export const resetPassword = async ({
     req
   });
   const cookie = generatePayloadCookie({
-    collectionConfig: collection.config,
-    payload: req.payload,
+    collectionAuthConfig: collection.config.auth,
+    cookiePrefix: req.payload.config.cookiePrefix,
     token: result.token
   });
   if (collection.config.auth.removeTokenFromResponses) {

package/dist/routes/rest/auth/resetPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"resetPassword.js","names":["httpStatus","generatePayloadCookie","resetPasswordOperation","headersWithCors","resetPassword","collection","req","searchParams","t","depth","get","result","data","password","token","Number","undefined","cookie","collectionConfig","config","payload","auth","removeTokenFromResponses","Response","json","message","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/auth/resetPassword.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, resetPasswordOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const resetPassword: CollectionRouteHandler = async ({ collection, req }) => {\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n\n  const result = await resetPasswordOperation({\n    collection,\n    data: {\n      password: typeof req.data?.password === 'string' ? req.data.password : '',\n      token: typeof req.data?.token === 'string' ? req.data.token : '',\n    },\n    depth: depth ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionConfig: collection.config,\n    payload: req.payload,\n    token: result.token,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passwordResetSuccessfully'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,sBAAsB,QAAQ;AAI9D,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,aAAA,GAAwC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EAC7E,MAAM;IAAEC,YAAY;IAAEC;EAAC,CAAE,GAAGF,GAAA;EAC5B,MAAMG,KAAA,GAAQF,YAAA,CAAaG,GAAG,CAAC;EAE/B,MAAMC,MAAA,GAAS,MAAMT,sBAAA,CAAuB;IAC1CG,UAAA;IACAO,IAAA,EAAM;MACJC,QAAA,EAAU,OAAOP,GAAA,CAAIM,IAAI,EAAEC,QAAA,KAAa,WAAWP,GAAA,CAAIM,IAAI,CAACC,QAAQ,GAAG;MACvEC,KAAA,EAAO,OAAOR,GAAA,CAAIM,IAAI,EAAEE,KAAA,KAAU,WAAWR,GAAA,CAAIM,IAAI,CAACE,KAAK,GAAG;IAChE;IACAL,KAAA,EAAOA,KAAA,GAAQM,MAAA,CAAON,KAAA,IAASO,SAAA;IAC/BV;EACF;EAEA,MAAMW,MAAA,GAAShB,qBAAA,CAAsB;IACnCiB,gBAAA,EAAkBb,UAAA,CAAWc,MAAM;IACnCC,OAAA,EAASd,GAAA,CAAIc,OAAO;IACpBN,KAAA,EAAOH,MAAA,CAAOG;EAChB;EAEA,IAAIT,UAAA,CAAWc,MAAM,CAACE,IAAI,CAACC,wBAAwB,EAAE;IACnD,OAAOX,MAAA,CAAOG,KAAK;EACrB;EAEA,OAAOS,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAASjB,CAAA,CAAE;IACX,GAAGG;EACL,GACA;IACEe,OAAA,EAASvB,eAAA,CAAgB;MACvBuB,OAAA,EAAS,IAAIC,OAAA,CAAQ;QACnB,cAAcV;MAChB;MACAX;IACF;IACAsB,MAAA,EAAQ5B,UAAA,CAAW6B;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"resetPassword.js","names":["httpStatus","generatePayloadCookie","resetPasswordOperation","headersWithCors","resetPassword","collection","req","searchParams","t","depth","get","result","data","password","token","Number","undefined","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","removeTokenFromResponses","Response","json","message","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/auth/resetPassword.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { generatePayloadCookie, resetPasswordOperation } from 'payload'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const resetPassword: CollectionRouteHandler = async ({ collection, req }) => {\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n\n  const result = await resetPasswordOperation({\n    collection,\n    data: {\n      password: typeof req.data?.password === 'string' ? req.data.password : '',\n      token: typeof req.data?.token === 'string' ? req.data.token : '',\n    },\n    depth: depth ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passwordResetSuccessfully'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,qBAAqB,EAAEC,sBAAsB,QAAQ;AAI9D,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,aAAA,GAAwC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EAC7E,MAAM;IAAEC,YAAY;IAAEC;EAAC,CAAE,GAAGF,GAAA;EAC5B,MAAMG,KAAA,GAAQF,YAAA,CAAaG,GAAG,CAAC;EAE/B,MAAMC,MAAA,GAAS,MAAMT,sBAAA,CAAuB;IAC1CG,UAAA;IACAO,IAAA,EAAM;MACJC,QAAA,EAAU,OAAOP,GAAA,CAAIM,IAAI,EAAEC,QAAA,KAAa,WAAWP,GAAA,CAAIM,IAAI,CAACC,QAAQ,GAAG;MACvEC,KAAA,EAAO,OAAOR,GAAA,CAAIM,IAAI,EAAEE,KAAA,KAAU,WAAWR,GAAA,CAAIM,IAAI,CAACE,KAAK,GAAG;IAChE;IACAL,KAAA,EAAOA,KAAA,GAAQM,MAAA,CAAON,KAAA,IAASO,SAAA;IAC/BV;EACF;EAEA,MAAMW,MAAA,GAAShB,qBAAA,CAAsB;IACnCiB,oBAAA,EAAsBb,UAAA,CAAWc,MAAM,CAACC,IAAI;IAC5CC,YAAA,EAAcf,GAAA,CAAIgB,OAAO,CAACH,MAAM,CAACE,YAAY;IAC7CP,KAAA,EAAOH,MAAA,CAAOG;EAChB;EAEA,IAAIT,UAAA,CAAWc,MAAM,CAACC,IAAI,CAACG,wBAAwB,EAAE;IACnD,OAAOZ,MAAA,CAAOG,KAAK;EACrB;EAEA,OAAOU,QAAA,CAASC,IAAI,CAClB;IACEC,OAAA,EAASlB,CAAA,CAAE;IACX,GAAGG;EACL,GACA;IACEgB,OAAA,EAASxB,eAAA,CAAgB;MACvBwB,OAAA,EAAS,IAAIC,OAAA,CAAQ;QACnB,cAAcX;MAChB;MACAX;IACF;IACAuB,MAAA,EAAQ7B,UAAA,CAAW8B;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/collections/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/create.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIzD,eAAO,MAAM,MAAM,EAAE,sBA8BpB,CAAA"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/create.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAMzD,eAAO,MAAM,MAAM,EAAE,sBAgCpB,CAAA"}

package/dist/routes/rest/collections/create.js

@@ -3,6 +3,8 @@ import httpStatus from 'http-status';
 import { createOperation } from 'payload';
 import { isNumber } from 'payload/shared';
 import { headersWithCors } from '../../../utilities/headersWithCors.js';
+import { sanitizePopulate } from '../utilities/sanitizePopulate.js';
+import { sanitizeSelect } from '../utilities/sanitizeSelect.js';
 export const create = async ({
   collection,
   req
@@ -19,7 +21,9 @@ export const create = async ({
     data: req.data,
     depth: isNumber(depth) ? depth : undefined,
     draft,
-    req
+    populate: sanitizePopulate(req.query.populate),
+    req,
+    select: sanitizeSelect(req.query.select)
   });
   return Response.json({
     doc,

package/dist/routes/rest/collections/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","names":["getTranslation","httpStatus","createOperation","isNumber","headersWithCors","create","collection","req","searchParams","autosave","get","draft","depth","doc","data","undefined","Response","json","message","t","label","config","labels","singular","i18n","headers","Headers","status","CREATED"],"sources":["../../../../src/routes/rest/collections/create.ts"],"sourcesContent":["import { getTranslation } from '@payloadcms/translations'\nimport httpStatus from 'http-status'\nimport { createOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const create: CollectionRouteHandler = async ({ collection, req }) => {\n  const { searchParams } = req\n  const autosave = searchParams.get('autosave') === 'true'\n  const draft = searchParams.get('draft') === 'true'\n  const depth = searchParams.get('depth')\n\n  const doc = await createOperation({\n    autosave,\n    collection,\n    data: req.data,\n    depth: isNumber(depth) ? depth : undefined,\n    draft,\n    req,\n  })\n\n  return Response.json(\n    {\n      doc,\n      message: req.t('general:successfullyCreated', {\n        label: getTranslation(collection.config.labels.singular, req.i18n),\n      }),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.CREATED,\n    },\n  )\n}\n"],"mappings":"AAAA,SAASA,cAAc,QAAQ;AAC/B,OAAOC,UAAA,MAAgB;AACvB,SAASC,eAAe,QAAQ;AAChC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,MAAA,GAAiC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACtE,MAAM;IAAEC;EAAY,CAAE,GAAGD,GAAA;EACzB,MAAME,QAAA,GAAWD,YAAA,CAAaE,GAAG,CAAC,gBAAgB;EAClD,MAAMC,KAAA,GAAQH,YAAA,CAAaE,GAAG,CAAC,aAAa;EAC5C,MAAME,KAAA,GAAQJ,YAAA,CAAaE,GAAG,CAAC;EAE/B,MAAMG,GAAA,GAAM,MAAMX,eAAA,CAAgB;IAChCO,QAAA;IACAH,UAAA;IACAQ,IAAA,EAAMP,GAAA,CAAIO,IAAI;IACdF,KAAA,EAAOT,QAAA,CAASS,KAAA,IAASA,KAAA,GAAQG,SAAA;IACjCJ,KAAA;IACAJ;EACF;EAEA,OAAOS,QAAA,CAASC,IAAI,CAClB;IACEJ,GAAA;IACAK,OAAA,EAASX,GAAA,CAAIY,CAAC,CAAC,+BAA+B;MAC5CC,KAAA,EAAOpB,cAAA,CAAeM,UAAA,CAAWe,MAAM,CAACC,MAAM,CAACC,QAAQ,EAAEhB,GAAA,CAAIiB,IAAI;IACnE;EACF,GACA;IACEC,OAAA,EAASrB,eAAA,CAAgB;MACvBqB,OAAA,EAAS,IAAIC,OAAA;MACbnB;IACF;IACAoB,MAAA,EAAQ1B,UAAA,CAAW2B;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"create.js","names":["getTranslation","httpStatus","createOperation","isNumber","headersWithCors","sanitizePopulate","sanitizeSelect","create","collection","req","searchParams","autosave","get","draft","depth","doc","data","undefined","populate","query","select","Response","json","message","t","label","config","labels","singular","i18n","headers","Headers","status","CREATED"],"sources":["../../../../src/routes/rest/collections/create.ts"],"sourcesContent":["import { getTranslation } from '@payloadcms/translations'\nimport httpStatus from 'http-status'\nimport { createOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\nimport { sanitizePopulate } from '../utilities/sanitizePopulate.js'\nimport { sanitizeSelect } from '../utilities/sanitizeSelect.js'\n\nexport const create: CollectionRouteHandler = async ({ collection, req }) => {\n  const { searchParams } = req\n  const autosave = searchParams.get('autosave') === 'true'\n  const draft = searchParams.get('draft') === 'true'\n  const depth = searchParams.get('depth')\n\n  const doc = await createOperation({\n    autosave,\n    collection,\n    data: req.data,\n    depth: isNumber(depth) ? depth : undefined,\n    draft,\n    populate: sanitizePopulate(req.query.populate),\n    req,\n    select: sanitizeSelect(req.query.select),\n  })\n\n  return Response.json(\n    {\n      doc,\n      message: req.t('general:successfullyCreated', {\n        label: getTranslation(collection.config.labels.singular, req.i18n),\n      }),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.CREATED,\n    },\n  )\n}\n"],"mappings":"AAAA,SAASA,cAAc,QAAQ;AAC/B,OAAOC,UAAA,MAAgB;AACvB,SAASC,eAAe,QAAQ;AAChC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAChC,SAASC,gBAAgB,QAAQ;AACjC,SAASC,cAAc,QAAQ;AAE/B,OAAO,MAAMC,MAAA,GAAiC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACtE,MAAM;IAAEC;EAAY,CAAE,GAAGD,GAAA;EACzB,MAAME,QAAA,GAAWD,YAAA,CAAaE,GAAG,CAAC,gBAAgB;EAClD,MAAMC,KAAA,GAAQH,YAAA,CAAaE,GAAG,CAAC,aAAa;EAC5C,MAAME,KAAA,GAAQJ,YAAA,CAAaE,GAAG,CAAC;EAE/B,MAAMG,GAAA,GAAM,MAAMb,eAAA,CAAgB;IAChCS,QAAA;IACAH,UAAA;IACAQ,IAAA,EAAMP,GAAA,CAAIO,IAAI;IACdF,KAAA,EAAOX,QAAA,CAASW,KAAA,IAASA,KAAA,GAAQG,SAAA;IACjCJ,KAAA;IACAK,QAAA,EAAUb,gBAAA,CAAiBI,GAAA,CAAIU,KAAK,CAACD,QAAQ;IAC7CT,GAAA;IACAW,MAAA,EAAQd,cAAA,CAAeG,GAAA,CAAIU,KAAK,CAACC,MAAM;EACzC;EAEA,OAAOC,QAAA,CAASC,IAAI,CAClB;IACEP,GAAA;IACAQ,OAAA,EAASd,GAAA,CAAIe,CAAC,CAAC,+BAA+B;MAC5CC,KAAA,EAAOzB,cAAA,CAAeQ,UAAA,CAAWkB,MAAM,CAACC,MAAM,CAACC,QAAQ,EAAEnB,GAAA,CAAIoB,IAAI;IACnE;EACF,GACA;IACEC,OAAA,EAAS1B,eAAA,CAAgB;MACvB0B,OAAA,EAAS,IAAIC,OAAA;MACbtB;IACF;IACAuB,MAAA,EAAQ/B,UAAA,CAAWgC;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/collections/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/delete.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIzD,eAAO,MAAM,SAAS,EAAE,sBAyDvB,CAAA"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/delete.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAMzD,eAAO,MAAM,SAAS,EAAE,sBA+DvB,CAAA"}

package/dist/routes/rest/collections/delete.js

@@ -3,18 +3,26 @@ import httpStatus from 'http-status';
 import { deleteOperation } from 'payload';
 import { isNumber } from 'payload/shared';
 import { headersWithCors } from '../../../utilities/headersWithCors.js';
+import { sanitizePopulate } from '../utilities/sanitizePopulate.js';
+import { sanitizeSelect } from '../utilities/sanitizeSelect.js';
 export const deleteDoc = async ({
   collection,
   req
 }) => {
   const {
     depth,
+    overrideLock,
+    populate,
+    select,
     where
   } = req.query;
   const result = await deleteOperation({
     collection,
     depth: isNumber(depth) ? Number(depth) : undefined,
+    overrideLock: Boolean(overrideLock === 'true'),
+    populate: sanitizePopulate(populate),
     req,
+    select: sanitizeSelect(select),
     where
   });
   const headers = headersWithCors({

package/dist/routes/rest/collections/delete.js.map

@@ -1 +1 @@
-{"version":3,"file":"delete.js","names":["getTranslation","httpStatus","deleteOperation","isNumber","headersWithCors","deleteDoc","collection","req","depth","where","query","result","Number","undefined","headers","Headers","errors","length","message","t","count","docs","label","config","labels","i18n","Response","json","status","OK","total","BAD_REQUEST"],"sources":["../../../../src/routes/rest/collections/delete.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport { getTranslation } from '@payloadcms/translations'\nimport httpStatus from 'http-status'\nimport { deleteOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const deleteDoc: CollectionRouteHandler = async ({ collection, req }) => {\n  const { depth, where } = req.query as {\n    depth?: string\n    where?: Where\n  }\n\n  const result = await deleteOperation({\n    collection,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n    where,\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (result.errors.length === 0) {\n    const message = req.t('general:deletedCountSuccessfully', {\n      count: result.docs.length,\n      label: getTranslation(\n        collection.config.labels[result.docs.length > 1 ? 'plural' : 'singular'],\n        req.i18n,\n      ),\n    })\n\n    return Response.json(\n      {\n        ...result,\n        message,\n      },\n      {\n        headers,\n        status: httpStatus.OK,\n      },\n    )\n  }\n\n  const total = result.docs.length + result.errors.length\n\n  const message = req.t('error:unableToDeleteCount', {\n    count: result.errors.length,\n    label: getTranslation(collection.config.labels[total > 1 ? 'plural' : 'singular'], req.i18n),\n    total,\n  })\n\n  return Response.json(\n    {\n      ...result,\n      message,\n    },\n    {\n      headers,\n      status: httpStatus.BAD_REQUEST,\n    },\n  )\n}\n"],"mappings":"AAEA,SAASA,cAAc,QAAQ;AAC/B,OAAOC,UAAA,MAAgB;AACvB,SAASC,eAAe,QAAQ;AAChC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,SAAA,GAAoC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACzE,MAAM;IAAEC,KAAK;IAAEC;EAAK,CAAE,GAAGF,GAAA,CAAIG,KAAK;EAKlC,MAAMC,MAAA,GAAS,MAAMT,eAAA,CAAgB;IACnCI,UAAA;IACAE,KAAA,EAAOL,QAAA,CAASK,KAAA,IAASI,MAAA,CAAOJ,KAAA,IAASK,SAAA;IACzCN,GAAA;IACAE;EACF;EAEA,MAAMK,OAAA,GAAUV,eAAA,CAAgB;IAC9BU,OAAA,EAAS,IAAIC,OAAA;IACbR;EACF;EAEA,IAAII,MAAA,CAAOK,MAAM,CAACC,MAAM,KAAK,GAAG;IAC9B,MAAMC,OAAA,GAAUX,GAAA,CAAIY,CAAC,CAAC,oCAAoC;MACxDC,KAAA,EAAOT,MAAA,CAAOU,IAAI,CAACJ,MAAM;MACzBK,KAAA,EAAOtB,cAAA,CACLM,UAAA,CAAWiB,MAAM,CAACC,MAAM,CAACb,MAAA,CAAOU,IAAI,CAACJ,MAAM,GAAG,IAAI,WAAW,WAAW,EACxEV,GAAA,CAAIkB,IAAI;IAEZ;IAEA,OAAOC,QAAA,CAASC,IAAI,CAClB;MACE,GAAGhB,MAAM;MACTO;IACF,GACA;MACEJ,OAAA;MACAc,MAAA,EAAQ3B,UAAA,CAAW4B;IACrB;EAEJ;EAEA,MAAMC,KAAA,GAAQnB,MAAA,CAAOU,IAAI,CAACJ,MAAM,GAAGN,MAAA,CAAOK,MAAM,CAACC,MAAM;EAEvD,MAAMC,OAAA,GAAUX,GAAA,CAAIY,CAAC,CAAC,6BAA6B;IACjDC,KAAA,EAAOT,MAAA,CAAOK,MAAM,CAACC,MAAM;IAC3BK,KAAA,EAAOtB,cAAA,CAAeM,UAAA,CAAWiB,MAAM,CAACC,MAAM,CAACM,KAAA,GAAQ,IAAI,WAAW,WAAW,EAAEvB,GAAA,CAAIkB,IAAI;IAC3FK;EACF;EAEA,OAAOJ,QAAA,CAASC,IAAI,CAClB;IACE,GAAGhB,MAAM;IACTO;EACF,GACA;IACEJ,OAAA;IACAc,MAAA,EAAQ3B,UAAA,CAAW8B;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"delete.js","names":["getTranslation","httpStatus","deleteOperation","isNumber","headersWithCors","sanitizePopulate","sanitizeSelect","deleteDoc","collection","req","depth","overrideLock","populate","select","where","query","result","Number","undefined","Boolean","headers","Headers","errors","length","message","t","count","docs","label","config","labels","i18n","Response","json","status","OK","total","BAD_REQUEST"],"sources":["../../../../src/routes/rest/collections/delete.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport { getTranslation } from '@payloadcms/translations'\nimport httpStatus from 'http-status'\nimport { deleteOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\nimport { sanitizePopulate } from '../utilities/sanitizePopulate.js'\nimport { sanitizeSelect } from '../utilities/sanitizeSelect.js'\n\nexport const deleteDoc: CollectionRouteHandler = async ({ collection, req }) => {\n  const { depth, overrideLock, populate, select, where } = req.query as {\n    depth?: string\n    overrideLock?: string\n    populate?: Record<string, unknown>\n    select?: Record<string, unknown>\n    where?: Where\n  }\n\n  const result = await deleteOperation({\n    collection,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    overrideLock: Boolean(overrideLock === 'true'),\n    populate: sanitizePopulate(populate),\n    req,\n    select: sanitizeSelect(select),\n    where,\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (result.errors.length === 0) {\n    const message = req.t('general:deletedCountSuccessfully', {\n      count: result.docs.length,\n      label: getTranslation(\n        collection.config.labels[result.docs.length > 1 ? 'plural' : 'singular'],\n        req.i18n,\n      ),\n    })\n\n    return Response.json(\n      {\n        ...result,\n        message,\n      },\n      {\n        headers,\n        status: httpStatus.OK,\n      },\n    )\n  }\n\n  const total = result.docs.length + result.errors.length\n\n  const message = req.t('error:unableToDeleteCount', {\n    count: result.errors.length,\n    label: getTranslation(collection.config.labels[total > 1 ? 'plural' : 'singular'], req.i18n),\n    total,\n  })\n\n  return Response.json(\n    {\n      ...result,\n      message,\n    },\n    {\n      headers,\n      status: httpStatus.BAD_REQUEST,\n    },\n  )\n}\n"],"mappings":"AAEA,SAASA,cAAc,QAAQ;AAC/B,OAAOC,UAAA,MAAgB;AACvB,SAASC,eAAe,QAAQ;AAChC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAChC,SAASC,gBAAgB,QAAQ;AACjC,SAASC,cAAc,QAAQ;AAE/B,OAAO,MAAMC,SAAA,GAAoC,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACzE,MAAM;IAAEC,KAAK;IAAEC,YAAY;IAAEC,QAAQ;IAAEC,MAAM;IAAEC;EAAK,CAAE,GAAGL,GAAA,CAAIM,KAAK;EAQlE,MAAMC,MAAA,GAAS,MAAMd,eAAA,CAAgB;IACnCM,UAAA;IACAE,KAAA,EAAOP,QAAA,CAASO,KAAA,IAASO,MAAA,CAAOP,KAAA,IAASQ,SAAA;IACzCP,YAAA,EAAcQ,OAAA,CAAQR,YAAA,KAAiB;IACvCC,QAAA,EAAUP,gBAAA,CAAiBO,QAAA;IAC3BH,GAAA;IACAI,MAAA,EAAQP,cAAA,CAAeO,MAAA;IACvBC;EACF;EAEA,MAAMM,OAAA,GAAUhB,eAAA,CAAgB;IAC9BgB,OAAA,EAAS,IAAIC,OAAA;IACbZ;EACF;EAEA,IAAIO,MAAA,CAAOM,MAAM,CAACC,MAAM,KAAK,GAAG;IAC9B,MAAMC,OAAA,GAAUf,GAAA,CAAIgB,CAAC,CAAC,oCAAoC;MACxDC,KAAA,EAAOV,MAAA,CAAOW,IAAI,CAACJ,MAAM;MACzBK,KAAA,EAAO5B,cAAA,CACLQ,UAAA,CAAWqB,MAAM,CAACC,MAAM,CAACd,MAAA,CAAOW,IAAI,CAACJ,MAAM,GAAG,IAAI,WAAW,WAAW,EACxEd,GAAA,CAAIsB,IAAI;IAEZ;IAEA,OAAOC,QAAA,CAASC,IAAI,CAClB;MACE,GAAGjB,MAAM;MACTQ;IACF,GACA;MACEJ,OAAA;MACAc,MAAA,EAAQjC,UAAA,CAAWkC;IACrB;EAEJ;EAEA,MAAMC,KAAA,GAAQpB,MAAA,CAAOW,IAAI,CAACJ,MAAM,GAAGP,MAAA,CAAOM,MAAM,CAACC,MAAM;EAEvD,MAAMC,OAAA,GAAUf,GAAA,CAAIgB,CAAC,CAAC,6BAA6B;IACjDC,KAAA,EAAOV,MAAA,CAAOM,MAAM,CAACC,MAAM;IAC3BK,KAAA,EAAO5B,cAAA,CAAeQ,UAAA,CAAWqB,MAAM,CAACC,MAAM,CAACM,KAAA,GAAQ,IAAI,WAAW,WAAW,EAAE3B,GAAA,CAAIsB,IAAI;IAC3FK;EACF;EAEA,OAAOJ,QAAA,CAASC,IAAI,CAClB;IACE,GAAGjB,MAAM;IACTQ;EACF,GACA;IACEJ,OAAA;IACAc,MAAA,EAAQjC,UAAA,CAAWoC;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/collections/deleteByID.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteByID.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/deleteByID.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAK/D,eAAO,MAAM,UAAU,EAAE,4BAgDxB,CAAA"}
+{"version":3,"file":"deleteByID.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/deleteByID.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAO/D,eAAO,MAAM,UAAU,EAAE,4BAoDxB,CAAA"}

package/dist/routes/rest/collections/deleteByID.js

@@ -3,6 +3,8 @@ import { deleteByIDOperation } from 'payload';
 import { isNumber } from 'payload/shared';
 import { headersWithCors } from '../../../utilities/headersWithCors.js';
 import { sanitizeCollectionID } from '../utilities/sanitizeCollectionID.js';
+import { sanitizePopulate } from '../utilities/sanitizePopulate.js';
+import { sanitizeSelect } from '../utilities/sanitizeSelect.js';
 export const deleteByID = async ({
   id: incomingID,
   collection,
@@ -12,6 +14,7 @@ export const deleteByID = async ({
     searchParams
   } = req;
   const depth = searchParams.get('depth');
+  const overrideLock = searchParams.get('overrideLock');
   const id = sanitizeCollectionID({
     id: incomingID,
     collectionSlug: collection.config.slug,
@@ -21,7 +24,10 @@ export const deleteByID = async ({
     id,
     collection,
     depth: isNumber(depth) ? depth : undefined,
-    req
+    overrideLock: Boolean(overrideLock === 'true'),
+    populate: sanitizePopulate(req.query.populate),
+    req,
+    select: sanitizeSelect(req.query.select)
   });
   const headers = headersWithCors({
     headers: new Headers(),

package/dist/routes/rest/collections/deleteByID.js.map

@@ -1 +1 @@
-{"version":3,"file":"deleteByID.js","names":["httpStatus","deleteByIDOperation","isNumber","headersWithCors","sanitizeCollectionID","deleteByID","id","incomingID","collection","req","searchParams","depth","get","collectionSlug","config","slug","payload","doc","undefined","headers","Headers","Response","json","message","t","status","NOT_FOUND","OK"],"sources":["../../../../src/routes/rest/collections/deleteByID.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { deleteByIDOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandlerWithID } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\nimport { sanitizeCollectionID } from '../utilities/sanitizeCollectionID.js'\n\nexport const deleteByID: CollectionRouteHandlerWithID = async ({\n  id: incomingID,\n  collection,\n  req,\n}) => {\n  const { searchParams } = req\n  const depth = searchParams.get('depth')\n\n  const id = sanitizeCollectionID({\n    id: incomingID,\n    collectionSlug: collection.config.slug,\n    payload: req.payload,\n  })\n\n  const doc = await deleteByIDOperation({\n    id,\n    collection,\n    depth: isNumber(depth) ? depth : undefined,\n    req,\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (!doc) {\n    return Response.json(\n      {\n        message: req.t('general:notFound'),\n      },\n      {\n        headers,\n        status: httpStatus.NOT_FOUND,\n      },\n    )\n  }\n\n  return Response.json(\n    {\n      doc,\n      message: req.t('general:deletedSuccessfully'),\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,mBAAmB,QAAQ;AACpC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAChC,SAASC,oBAAoB,QAAQ;AAErC,OAAO,MAAMC,UAAA,GAA2C,MAAAA,CAAO;EAC7DC,EAAA,EAAIC,UAAU;EACdC,UAAU;EACVC;AAAG,CACJ;EACC,MAAM;IAAEC;EAAY,CAAE,GAAGD,GAAA;EACzB,MAAME,KAAA,GAAQD,YAAA,CAAaE,GAAG,CAAC;EAE/B,MAAMN,EAAA,GAAKF,oBAAA,CAAqB;IAC9BE,EAAA,EAAIC,UAAA;IACJM,cAAA,EAAgBL,UAAA,CAAWM,MAAM,CAACC,IAAI;IACtCC,OAAA,EAASP,GAAA,CAAIO;EACf;EAEA,MAAMC,GAAA,GAAM,MAAMhB,mBAAA,CAAoB;IACpCK,EAAA;IACAE,UAAA;IACAG,KAAA,EAAOT,QAAA,CAASS,KAAA,IAASA,KAAA,GAAQO,SAAA;IACjCT;EACF;EAEA,MAAMU,OAAA,GAAUhB,eAAA,CAAgB;IAC9BgB,OAAA,EAAS,IAAIC,OAAA;IACbX;EACF;EAEA,IAAI,CAACQ,GAAA,EAAK;IACR,OAAOI,QAAA,CAASC,IAAI,CAClB;MACEC,OAAA,EAASd,GAAA,CAAIe,CAAC,CAAC;IACjB,GACA;MACEL,OAAA;MACAM,MAAA,EAAQzB,UAAA,CAAW0B;IACrB;EAEJ;EAEA,OAAOL,QAAA,CAASC,IAAI,CAClB;IACEL,GAAA;IACAM,OAAA,EAASd,GAAA,CAAIe,CAAC,CAAC;EACjB,GACA;IACEL,OAAA;IACAM,MAAA,EAAQzB,UAAA,CAAW2B;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"deleteByID.js","names":["httpStatus","deleteByIDOperation","isNumber","headersWithCors","sanitizeCollectionID","sanitizePopulate","sanitizeSelect","deleteByID","id","incomingID","collection","req","searchParams","depth","get","overrideLock","collectionSlug","config","slug","payload","doc","undefined","Boolean","populate","query","select","headers","Headers","Response","json","message","t","status","NOT_FOUND","OK"],"sources":["../../../../src/routes/rest/collections/deleteByID.ts"],"sourcesContent":["import httpStatus from 'http-status'\nimport { deleteByIDOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandlerWithID } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\nimport { sanitizeCollectionID } from '../utilities/sanitizeCollectionID.js'\nimport { sanitizePopulate } from '../utilities/sanitizePopulate.js'\nimport { sanitizeSelect } from '../utilities/sanitizeSelect.js'\n\nexport const deleteByID: CollectionRouteHandlerWithID = async ({\n  id: incomingID,\n  collection,\n  req,\n}) => {\n  const { searchParams } = req\n  const depth = searchParams.get('depth')\n  const overrideLock = searchParams.get('overrideLock')\n\n  const id = sanitizeCollectionID({\n    id: incomingID,\n    collectionSlug: collection.config.slug,\n    payload: req.payload,\n  })\n\n  const doc = await deleteByIDOperation({\n    id,\n    collection,\n    depth: isNumber(depth) ? depth : undefined,\n    overrideLock: Boolean(overrideLock === 'true'),\n    populate: sanitizePopulate(req.query.populate),\n    req,\n    select: sanitizeSelect(req.query.select),\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (!doc) {\n    return Response.json(\n      {\n        message: req.t('general:notFound'),\n      },\n      {\n        headers,\n        status: httpStatus.NOT_FOUND,\n      },\n    )\n  }\n\n  return Response.json(\n    {\n      doc,\n      message: req.t('general:deletedSuccessfully'),\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,mBAAmB,QAAQ;AACpC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAChC,SAASC,oBAAoB,QAAQ;AACrC,SAASC,gBAAgB,QAAQ;AACjC,SAASC,cAAc,QAAQ;AAE/B,OAAO,MAAMC,UAAA,GAA2C,MAAAA,CAAO;EAC7DC,EAAA,EAAIC,UAAU;EACdC,UAAU;EACVC;AAAG,CACJ;EACC,MAAM;IAAEC;EAAY,CAAE,GAAGD,GAAA;EACzB,MAAME,KAAA,GAAQD,YAAA,CAAaE,GAAG,CAAC;EAC/B,MAAMC,YAAA,GAAeH,YAAA,CAAaE,GAAG,CAAC;EAEtC,MAAMN,EAAA,GAAKJ,oBAAA,CAAqB;IAC9BI,EAAA,EAAIC,UAAA;IACJO,cAAA,EAAgBN,UAAA,CAAWO,MAAM,CAACC,IAAI;IACtCC,OAAA,EAASR,GAAA,CAAIQ;EACf;EAEA,MAAMC,GAAA,GAAM,MAAMnB,mBAAA,CAAoB;IACpCO,EAAA;IACAE,UAAA;IACAG,KAAA,EAAOX,QAAA,CAASW,KAAA,IAASA,KAAA,GAAQQ,SAAA;IACjCN,YAAA,EAAcO,OAAA,CAAQP,YAAA,KAAiB;IACvCQ,QAAA,EAAUlB,gBAAA,CAAiBM,GAAA,CAAIa,KAAK,CAACD,QAAQ;IAC7CZ,GAAA;IACAc,MAAA,EAAQnB,cAAA,CAAeK,GAAA,CAAIa,KAAK,CAACC,MAAM;EACzC;EAEA,MAAMC,OAAA,GAAUvB,eAAA,CAAgB;IAC9BuB,OAAA,EAAS,IAAIC,OAAA;IACbhB;EACF;EAEA,IAAI,CAACS,GAAA,EAAK;IACR,OAAOQ,QAAA,CAASC,IAAI,CAClB;MACEC,OAAA,EAASnB,GAAA,CAAIoB,CAAC,CAAC;IACjB,GACA;MACEL,OAAA;MACAM,MAAA,EAAQhC,UAAA,CAAWiC;IACrB;EAEJ;EAEA,OAAOL,QAAA,CAASC,IAAI,CAClB;IACET,GAAA;IACAU,OAAA,EAASnB,GAAA,CAAIoB,CAAC,CAAC;EACjB,GACA;IACEL,OAAA;IACAM,MAAA,EAAQhC,UAAA,CAAWkC;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/collections/duplicate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/duplicate.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAK/D,eAAO,MAAM,SAAS,EAAE,4BAyCvB,CAAA"}
+{"version":3,"file":"duplicate.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/duplicate.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAO/D,eAAO,MAAM,SAAS,EAAE,4BA2CvB,CAAA"}

package/dist/routes/rest/collections/duplicate.js

@@ -4,6 +4,8 @@ import { duplicateOperation } from 'payload';
 import { isNumber } from 'payload/shared';
 import { headersWithCors } from '../../../utilities/headersWithCors.js';
 import { sanitizeCollectionID } from '../utilities/sanitizeCollectionID.js';
+import { sanitizePopulate } from '../utilities/sanitizePopulate.js';
+import { sanitizeSelect } from '../utilities/sanitizeSelect.js';
 export const duplicate = async ({
   id: incomingID,
   collection,
@@ -25,7 +27,9 @@ export const duplicate = async ({
     collection,
     depth: isNumber(depth) ? Number(depth) : undefined,
     draft,
-    req
+    populate: sanitizePopulate(req.query.populate),
+    req,
+    select: sanitizeSelect(req.query.select)
   });
   const message = req.t('general:successfullyDuplicated', {
     label: getTranslation(collection.config.labels.singular, req.i18n)

package/dist/routes/rest/collections/duplicate.js.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate.js","names":["getTranslation","httpStatus","duplicateOperation","isNumber","headersWithCors","sanitizeCollectionID","duplicate","id","incomingID","collection","req","searchParams","depth","get","draft","collectionSlug","config","slug","payload","doc","Number","undefined","message","t","label","labels","singular","i18n","Response","json","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/collections/duplicate.ts"],"sourcesContent":["import { getTranslation } from '@payloadcms/translations'\nimport httpStatus from 'http-status'\nimport { duplicateOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandlerWithID } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\nimport { sanitizeCollectionID } from '../utilities/sanitizeCollectionID.js'\n\nexport const duplicate: CollectionRouteHandlerWithID = async ({\n  id: incomingID,\n  collection,\n  req,\n}) => {\n  const { searchParams } = req\n  const depth = searchParams.get('depth')\n  // draft defaults to true, unless explicitly set requested as false to prevent the newly duplicated document from being published\n  const draft = searchParams.get('draft') !== 'false'\n\n  const id = sanitizeCollectionID({\n    id: incomingID,\n    collectionSlug: collection.config.slug,\n    payload: req.payload,\n  })\n\n  const doc = await duplicateOperation({\n    id,\n    collection,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    draft,\n    req,\n  })\n\n  const message = req.t('general:successfullyDuplicated', {\n    label: getTranslation(collection.config.labels.singular, req.i18n),\n  })\n\n  return Response.json(\n    {\n      doc,\n      message,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,SAASA,cAAc,QAAQ;AAC/B,OAAOC,UAAA,MAAgB;AACvB,SAASC,kBAAkB,QAAQ;AACnC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAChC,SAASC,oBAAoB,QAAQ;AAErC,OAAO,MAAMC,SAAA,GAA0C,MAAAA,CAAO;EAC5DC,EAAA,EAAIC,UAAU;EACdC,UAAU;EACVC;AAAG,CACJ;EACC,MAAM;IAAEC;EAAY,CAAE,GAAGD,GAAA;EACzB,MAAME,KAAA,GAAQD,YAAA,CAAaE,GAAG,CAAC;EAC/B;EACA,MAAMC,KAAA,GAAQH,YAAA,CAAaE,GAAG,CAAC,aAAa;EAE5C,MAAMN,EAAA,GAAKF,oBAAA,CAAqB;IAC9BE,EAAA,EAAIC,UAAA;IACJO,cAAA,EAAgBN,UAAA,CAAWO,MAAM,CAACC,IAAI;IACtCC,OAAA,EAASR,GAAA,CAAIQ;EACf;EAEA,MAAMC,GAAA,GAAM,MAAMjB,kBAAA,CAAmB;IACnCK,EAAA;IACAE,UAAA;IACAG,KAAA,EAAOT,QAAA,CAASS,KAAA,IAASQ,MAAA,CAAOR,KAAA,IAASS,SAAA;IACzCP,KAAA;IACAJ;EACF;EAEA,MAAMY,OAAA,GAAUZ,GAAA,CAAIa,CAAC,CAAC,kCAAkC;IACtDC,KAAA,EAAOxB,cAAA,CAAeS,UAAA,CAAWO,MAAM,CAACS,MAAM,CAACC,QAAQ,EAAEhB,GAAA,CAAIiB,IAAI;EACnE;EAEA,OAAOC,QAAA,CAASC,IAAI,CAClB;IACEV,GAAA;IACAG;EACF,GACA;IACEQ,OAAA,EAAS1B,eAAA,CAAgB;MACvB0B,OAAA,EAAS,IAAIC,OAAA;MACbrB;IACF;IACAsB,MAAA,EAAQ/B,UAAA,CAAWgC;EACrB;AAEJ","ignoreList":[]}
+{"version":3,"file":"duplicate.js","names":["getTranslation","httpStatus","duplicateOperation","isNumber","headersWithCors","sanitizeCollectionID","sanitizePopulate","sanitizeSelect","duplicate","id","incomingID","collection","req","searchParams","depth","get","draft","collectionSlug","config","slug","payload","doc","Number","undefined","populate","query","select","message","t","label","labels","singular","i18n","Response","json","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/collections/duplicate.ts"],"sourcesContent":["import { getTranslation } from '@payloadcms/translations'\nimport httpStatus from 'http-status'\nimport { duplicateOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandlerWithID } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\nimport { sanitizeCollectionID } from '../utilities/sanitizeCollectionID.js'\nimport { sanitizePopulate } from '../utilities/sanitizePopulate.js'\nimport { sanitizeSelect } from '../utilities/sanitizeSelect.js'\n\nexport const duplicate: CollectionRouteHandlerWithID = async ({\n  id: incomingID,\n  collection,\n  req,\n}) => {\n  const { searchParams } = req\n  const depth = searchParams.get('depth')\n  // draft defaults to true, unless explicitly set requested as false to prevent the newly duplicated document from being published\n  const draft = searchParams.get('draft') !== 'false'\n\n  const id = sanitizeCollectionID({\n    id: incomingID,\n    collectionSlug: collection.config.slug,\n    payload: req.payload,\n  })\n\n  const doc = await duplicateOperation({\n    id,\n    collection,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    draft,\n    populate: sanitizePopulate(req.query.populate),\n    req,\n    select: sanitizeSelect(req.query.select),\n  })\n\n  const message = req.t('general:successfullyDuplicated', {\n    label: getTranslation(collection.config.labels.singular, req.i18n),\n  })\n\n  return Response.json(\n    {\n      doc,\n      message,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"mappings":"AAAA,SAASA,cAAc,QAAQ;AAC/B,OAAOC,UAAA,MAAgB;AACvB,SAASC,kBAAkB,QAAQ;AACnC,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAChC,SAASC,oBAAoB,QAAQ;AACrC,SAASC,gBAAgB,QAAQ;AACjC,SAASC,cAAc,QAAQ;AAE/B,OAAO,MAAMC,SAAA,GAA0C,MAAAA,CAAO;EAC5DC,EAAA,EAAIC,UAAU;EACdC,UAAU;EACVC;AAAG,CACJ;EACC,MAAM;IAAEC;EAAY,CAAE,GAAGD,GAAA;EACzB,MAAME,KAAA,GAAQD,YAAA,CAAaE,GAAG,CAAC;EAC/B;EACA,MAAMC,KAAA,GAAQH,YAAA,CAAaE,GAAG,CAAC,aAAa;EAE5C,MAAMN,EAAA,GAAKJ,oBAAA,CAAqB;IAC9BI,EAAA,EAAIC,UAAA;IACJO,cAAA,EAAgBN,UAAA,CAAWO,MAAM,CAACC,IAAI;IACtCC,OAAA,EAASR,GAAA,CAAIQ;EACf;EAEA,MAAMC,GAAA,GAAM,MAAMnB,kBAAA,CAAmB;IACnCO,EAAA;IACAE,UAAA;IACAG,KAAA,EAAOX,QAAA,CAASW,KAAA,IAASQ,MAAA,CAAOR,KAAA,IAASS,SAAA;IACzCP,KAAA;IACAQ,QAAA,EAAUlB,gBAAA,CAAiBM,GAAA,CAAIa,KAAK,CAACD,QAAQ;IAC7CZ,GAAA;IACAc,MAAA,EAAQnB,cAAA,CAAeK,GAAA,CAAIa,KAAK,CAACC,MAAM;EACzC;EAEA,MAAMC,OAAA,GAAUf,GAAA,CAAIgB,CAAC,CAAC,kCAAkC;IACtDC,KAAA,EAAO7B,cAAA,CAAeW,UAAA,CAAWO,MAAM,CAACY,MAAM,CAACC,QAAQ,EAAEnB,GAAA,CAAIoB,IAAI;EACnE;EAEA,OAAOC,QAAA,CAASC,IAAI,CAClB;IACEb,GAAA;IACAM;EACF,GACA;IACEQ,OAAA,EAAS/B,eAAA,CAAgB;MACvB+B,OAAA,EAAS,IAAIC,OAAA;MACbxB;IACF;IACAyB,MAAA,EAAQpC,UAAA,CAAWqC;EACrB;AAEJ","ignoreList":[]}

package/dist/routes/rest/collections/find.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/find.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIzD,eAAO,MAAM,IAAI,EAAE,sBA4BlB,CAAA"}
+{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/find.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAOzD,eAAO,MAAM,IAAI,EAAE,sBAkClB,CAAA"}

package/dist/routes/rest/collections/find.js

@@ -2,6 +2,9 @@ import httpStatus from 'http-status';
 import { findOperation } from 'payload';
 import { isNumber } from 'payload/shared';
 import { headersWithCors } from '../../../utilities/headersWithCors.js';
+import { sanitizeJoinParams } from '../utilities/sanitizeJoinParams.js';
+import { sanitizePopulate } from '../utilities/sanitizePopulate.js';
+import { sanitizeSelect } from '../utilities/sanitizeSelect.js';
 export const find = async ({
   collection,
   req
@@ -9,8 +12,11 @@ export const find = async ({
   const {
     depth,
     draft,
+    joins,
     limit,
     page,
+    populate,
+    select,
     sort,
     where
   } = req.query;
@@ -18,10 +24,13 @@ export const find = async ({
     collection,
     depth: isNumber(depth) ? Number(depth) : undefined,
     draft: draft === 'true',
+    joins: sanitizeJoinParams(joins),
     limit: isNumber(limit) ? Number(limit) : undefined,
     page: isNumber(page) ? Number(page) : undefined,
+    populate: sanitizePopulate(populate),
     req,
-    sort,
+    select: sanitizeSelect(select),
+    sort: typeof sort === 'string' ? sort.split(',') : undefined,
     where
   });
   return Response.json(result, {

package/dist/routes/rest/collections/find.js.map

@@ -1 +1 @@
-{"version":3,"file":"find.js","names":["httpStatus","findOperation","isNumber","headersWithCors","find","collection","req","depth","draft","limit","page","sort","where","query","result","Number","undefined","Response","json","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/collections/find.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport httpStatus from 'http-status'\nimport { findOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\n\nexport const find: CollectionRouteHandler = async ({ collection, req }) => {\n  const { depth, draft, limit, page, sort, where } = req.query as {\n    depth?: string\n    draft?: string\n    limit?: string\n    page?: string\n    sort?: string\n    where?: Where\n  }\n\n  const result = await findOperation({\n    collection,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    draft: draft === 'true',\n    limit: isNumber(limit) ? Number(limit) : undefined,\n    page: isNumber(page) ? Number(page) : undefined,\n    req,\n    sort,\n    where,\n  })\n\n  return Response.json(result, {\n    headers: headersWithCors({\n      headers: new Headers(),\n      req,\n    }),\n    status: httpStatus.OK,\n  })\n}\n"],"mappings":"AAEA,OAAOA,UAAA,MAAgB;AACvB,SAASC,aAAa,QAAQ;AAC9B,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAEhC,OAAO,MAAMC,IAAA,GAA+B,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACpE,MAAM;IAAEC,KAAK;IAAEC,KAAK;IAAEC,KAAK;IAAEC,IAAI;IAAEC,IAAI;IAAEC;EAAK,CAAE,GAAGN,GAAA,CAAIO,KAAK;EAS5D,MAAMC,MAAA,GAAS,MAAMb,aAAA,CAAc;IACjCI,UAAA;IACAE,KAAA,EAAOL,QAAA,CAASK,KAAA,IAASQ,MAAA,CAAOR,KAAA,IAASS,SAAA;IACzCR,KAAA,EAAOA,KAAA,KAAU;IACjBC,KAAA,EAAOP,QAAA,CAASO,KAAA,IAASM,MAAA,CAAON,KAAA,IAASO,SAAA;IACzCN,IAAA,EAAMR,QAAA,CAASQ,IAAA,IAAQK,MAAA,CAAOL,IAAA,IAAQM,SAAA;IACtCV,GAAA;IACAK,IAAA;IACAC;EACF;EAEA,OAAOK,QAAA,CAASC,IAAI,CAACJ,MAAA,EAAQ;IAC3BK,OAAA,EAAShB,eAAA,CAAgB;MACvBgB,OAAA,EAAS,IAAIC,OAAA;MACbd;IACF;IACAe,MAAA,EAAQrB,UAAA,CAAWsB;EACrB;AACF","ignoreList":[]}
+{"version":3,"file":"find.js","names":["httpStatus","findOperation","isNumber","headersWithCors","sanitizeJoinParams","sanitizePopulate","sanitizeSelect","find","collection","req","depth","draft","joins","limit","page","populate","select","sort","where","query","result","Number","undefined","split","Response","json","headers","Headers","status","OK"],"sources":["../../../../src/routes/rest/collections/find.ts"],"sourcesContent":["import type { JoinQuery, Where } from 'payload'\n\nimport httpStatus from 'http-status'\nimport { findOperation } from 'payload'\nimport { isNumber } from 'payload/shared'\n\nimport type { CollectionRouteHandler } from '../types.js'\n\nimport { headersWithCors } from '../../../utilities/headersWithCors.js'\nimport { sanitizeJoinParams } from '../utilities/sanitizeJoinParams.js'\nimport { sanitizePopulate } from '../utilities/sanitizePopulate.js'\nimport { sanitizeSelect } from '../utilities/sanitizeSelect.js'\n\nexport const find: CollectionRouteHandler = async ({ collection, req }) => {\n  const { depth, draft, joins, limit, page, populate, select, sort, where } = req.query as {\n    depth?: string\n    draft?: string\n    joins?: JoinQuery\n    limit?: string\n    page?: string\n    populate?: Record<string, unknown>\n    select?: Record<string, unknown>\n    sort?: string\n    where?: Where\n  }\n\n  const result = await findOperation({\n    collection,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    draft: draft === 'true',\n    joins: sanitizeJoinParams(joins),\n    limit: isNumber(limit) ? Number(limit) : undefined,\n    page: isNumber(page) ? Number(page) : undefined,\n    populate: sanitizePopulate(populate),\n    req,\n    select: sanitizeSelect(select),\n    sort: typeof sort === 'string' ? sort.split(',') : undefined,\n    where,\n  })\n\n  return Response.json(result, {\n    headers: headersWithCors({\n      headers: new Headers(),\n      req,\n    }),\n    status: httpStatus.OK,\n  })\n}\n"],"mappings":"AAEA,OAAOA,UAAA,MAAgB;AACvB,SAASC,aAAa,QAAQ;AAC9B,SAASC,QAAQ,QAAQ;AAIzB,SAASC,eAAe,QAAQ;AAChC,SAASC,kBAAkB,QAAQ;AACnC,SAASC,gBAAgB,QAAQ;AACjC,SAASC,cAAc,QAAQ;AAE/B,OAAO,MAAMC,IAAA,GAA+B,MAAAA,CAAO;EAAEC,UAAU;EAAEC;AAAG,CAAE;EACpE,MAAM;IAAEC,KAAK;IAAEC,KAAK;IAAEC,KAAK;IAAEC,KAAK;IAAEC,IAAI;IAAEC,QAAQ;IAAEC,MAAM;IAAEC,IAAI;IAAEC;EAAK,CAAE,GAAGT,GAAA,CAAIU,KAAK;EAYrF,MAAMC,MAAA,GAAS,MAAMnB,aAAA,CAAc;IACjCO,UAAA;IACAE,KAAA,EAAOR,QAAA,CAASQ,KAAA,IAASW,MAAA,CAAOX,KAAA,IAASY,SAAA;IACzCX,KAAA,EAAOA,KAAA,KAAU;IACjBC,KAAA,EAAOR,kBAAA,CAAmBQ,KAAA;IAC1BC,KAAA,EAAOX,QAAA,CAASW,KAAA,IAASQ,MAAA,CAAOR,KAAA,IAASS,SAAA;IACzCR,IAAA,EAAMZ,QAAA,CAASY,IAAA,IAAQO,MAAA,CAAOP,IAAA,IAAQQ,SAAA;IACtCP,QAAA,EAAUV,gBAAA,CAAiBU,QAAA;IAC3BN,GAAA;IACAO,MAAA,EAAQV,cAAA,CAAeU,MAAA;IACvBC,IAAA,EAAM,OAAOA,IAAA,KAAS,WAAWA,IAAA,CAAKM,KAAK,CAAC,OAAOD,SAAA;IACnDJ;EACF;EAEA,OAAOM,QAAA,CAASC,IAAI,CAACL,MAAA,EAAQ;IAC3BM,OAAA,EAASvB,eAAA,CAAgB;MACvBuB,OAAA,EAAS,IAAIC,OAAA;MACblB;IACF;IACAmB,MAAA,EAAQ5B,UAAA,CAAW6B;EACrB;AACF","ignoreList":[]}

package/dist/routes/rest/collections/findByID.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findByID.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/findByID.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAK/D,eAAO,MAAM,QAAQ,EAAE,4BA6BtB,CAAA"}
+{"version":3,"file":"findByID.d.ts","sourceRoot":"","sources":["../../../../src/routes/rest/collections/findByID.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAQ/D,eAAO,MAAM,QAAQ,EAAE,4BAgCtB,CAAA"}

package/dist/routes/rest/collections/findByID.js

@@ -3,6 +3,9 @@ import { findByIDOperation } from 'payload';
 import { isNumber } from 'payload/shared';
 import { headersWithCors } from '../../../utilities/headersWithCors.js';
 import { sanitizeCollectionID } from '../utilities/sanitizeCollectionID.js';
+import { sanitizeJoinParams } from '../utilities/sanitizeJoinParams.js';
+import { sanitizePopulate } from '../utilities/sanitizePopulate.js';
+import { sanitizeSelect } from '../utilities/sanitizeSelect.js';
 export const findByID = async ({
   id: incomingID,
   collection,
@@ -22,7 +25,10 @@ export const findByID = async ({
     collection,
     depth: isNumber(depth) ? Number(depth) : undefined,
     draft: searchParams.get('draft') === 'true',
-    req
+    joins: sanitizeJoinParams(req.query.joins),
+    populate: sanitizePopulate(req.query.populate),
+    req,
+    select: sanitizeSelect(req.query.select)
   });
   return Response.json(result, {
     headers: headersWithCors({