@payloadcms/plugin-cloud-storage 3.89.0 → 3.90.0

package/dist/plugin.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/plugin.spec.ts"],"sourcesContent":["import type { AddressInfo } from 'node:net'\nimport type { Config, PayloadRequest, UploadConfig } from 'payload'\n\nimport { createServer } from 'node:http'\nimport { getExternalFile } from 'payload/internal'\nimport { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'\n\nimport { cloudStoragePlugin } from './plugin.js'\n\nconst collectionSlug = 'media'\n\ndescribe('cloudStoragePlugin external file fetching', () => {\n  const server = createServer((_req, res) => {\n    res.writeHead(200, {\n      'Content-Length': '12',\n      'Content-Type': 'text/plain',\n    })\n    res.end('stored file\\n')\n  })\n\n  let port: number\n\n  beforeAll(async () => {\n    await new Promise<void>((resolve) => server.listen(0, resolve))\n    port = (server.address() as AddressInfo).port\n  })\n\n  afterEach(() => {\n    vi.unstubAllEnvs()\n  })\n\n  afterAll(async () => {\n    await new Promise<void>((resolve, reject) => {\n      server.close((error) => (error ? reject(error) : resolve()))\n    })\n  })\n\n  it('should filter private URLs when Payload file access control is disabled', async () => {\n    vi.stubEnv('NODE_ENV', 'production')\n    const uploadConfig = buildUploadConfig()\n\n    await expect(\n      fetchExternalFile({ uploadConfig, url: `http://127.0.0.1:${port}/file.txt` }),\n    ).rejects.toThrow('Blocked unsafe attempt to 127.0.0.1')\n  })\n\n  it('should allow private URLs when skipSafeFetch is explicitly true', async () => {\n    vi.stubEnv('NODE_ENV', 'production')\n    const uploadConfig = buildUploadConfig(true)\n\n    const file = await fetchExternalFile({\n      uploadConfig,\n      url: `http://127.0.0.1:${port}/file.txt`,\n    })\n\n    expect(file.data.toString()).toBe('stored file\\n')\n  })\n\n  it('should allow private URLs that match an explicit skipSafeFetch allowlist', async () => {\n    vi.stubEnv('NODE_ENV', 'production')\n    const uploadConfig = buildUploadConfig([\n      {\n        hostname: '127.0.0.1',\n        port: String(port),\n        protocol: 'http',\n      },\n    ])\n\n    const file = await fetchExternalFile({\n      uploadConfig,\n      url: `http://127.0.0.1:${port}/file.txt`,\n    })\n\n    expect(file.data.toString()).toBe('stored file\\n')\n  })\n\n  it('should allow localhost URLs outside production', async () => {\n    vi.stubEnv('NODE_ENV', 'development')\n    const uploadConfig = buildUploadConfig()\n\n    const file = await fetchExternalFile({\n      uploadConfig,\n      url: `http://localhost:${port}/file.txt`,\n    })\n\n    expect(file.data.toString()).toBe('stored file\\n')\n  })\n})\n\nfunction buildUploadConfig(skipSafeFetch?: UploadConfig['skipSafeFetch']): UploadConfig {\n  const config = cloudStoragePlugin({\n    collections: {\n      [collectionSlug]: {\n        adapter: () => ({\n          handleDelete: async () => undefined,\n          handleUpload: async () => undefined,\n          name: 'test-adapter',\n          staticHandler: async () => new Response(null, { status: 404 }),\n        }),\n        disablePayloadAccessControl: true,\n      },\n    },\n  })({\n    collections: [\n      {\n        fields: [],\n        slug: collectionSlug,\n        upload: typeof skipSafeFetch === 'undefined' ? true : { skipSafeFetch },\n      },\n    ],\n  } as Config)\n\n  const uploadConfig = config.collections?.[0]?.upload\n  if (!uploadConfig || typeof uploadConfig !== 'object') {\n    throw new Error('Expected an upload configuration')\n  }\n\n  return uploadConfig\n}\n\nasync function fetchExternalFile({\n  uploadConfig,\n  url,\n}: {\n  uploadConfig: UploadConfig\n  url: string\n}) {\n  return getExternalFile({\n    data: {\n      filename: 'file.txt',\n      url,\n    },\n    req: {\n      headers: new Headers(),\n      payload: {\n        config: {\n          cookiePrefix: 'payload',\n        },\n      },\n    } as PayloadRequest,\n    uploadConfig,\n  })\n}\n\nconst adapter = () => ({\n  handleDelete: () => undefined,\n  handleUpload: () => undefined,\n  name: 'test-adapter',\n  staticHandler: () => new Response(),\n})\n\ndescribe('cloudStoragePlugin', () => {\n  it('should normalize a stored prefix during a server-mediated upload', async () => {\n    const config = cloudStoragePlugin({\n      collections: {\n        media: { adapter },\n      },\n    } as any)({\n      collections: [{ fields: [], slug: 'media', upload: true }],\n    } as any)\n    const hooks = config.collections?.[0]?.hooks?.beforeChange || []\n    const req = {\n      context: {},\n      file: { mimetype: 'image/png', name: 'photo.png', size: 42 },\n    }\n    let data = { filename: 'photo.png', prefix: '/tenant/../acme' }\n\n    for (const hook of hooks) {\n      const result = await hook({ data, operation: 'create', req } as any)\n      data = result || data\n    }\n\n    expect(data.prefix).toBe('tenant/acme')\n  })\n})\n"],"names":["createServer","getExternalFile","afterAll","afterEach","beforeAll","describe","expect","it","vi","cloudStoragePlugin","collectionSlug","server","_req","res","writeHead","end","port","Promise","resolve","listen","address","unstubAllEnvs","reject","close","error","stubEnv","uploadConfig","buildUploadConfig","fetchExternalFile","url","rejects","toThrow","file","data","toString","toBe","hostname","String","protocol","skipSafeFetch","config","collections","adapter","handleDelete","undefined","handleUpload","name","staticHandler","Response","status","disablePayloadAccessControl","fields","slug","upload","Error","filename","req","headers","Headers","payload","cookiePrefix","media","hooks","beforeChange","context","mimetype","size","prefix","hook","result","operation"],"mappings":"AAGA,SAASA,YAAY,QAAQ,YAAW;AACxC,SAASC,eAAe,QAAQ,mBAAkB;AAClD,SAASC,QAAQ,EAAEC,SAAS,EAAEC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjF,SAASC,kBAAkB,QAAQ,cAAa;AAEhD,MAAMC,iBAAiB;AAEvBL,SAAS,6CAA6C;IACpD,MAAMM,SAASX,aAAa,CAACY,MAAMC;QACjCA,IAAIC,SAAS,CAAC,KAAK;YACjB,kBAAkB;YAClB,gBAAgB;QAClB;QACAD,IAAIE,GAAG,CAAC;IACV;IAEA,IAAIC;IAEJZ,UAAU;QACR,MAAM,IAAIa,QAAc,CAACC,UAAYP,OAAOQ,MAAM,CAAC,GAAGD;QACtDF,OAAO,AAACL,OAAOS,OAAO,GAAmBJ,IAAI;IAC/C;IAEAb,UAAU;QACRK,GAAGa,aAAa;IAClB;IAEAnB,SAAS;QACP,MAAM,IAAIe,QAAc,CAACC,SAASI;YAChCX,OAAOY,KAAK,CAAC,CAACC,QAAWA,QAAQF,OAAOE,SAASN;QACnD;IACF;IAEAX,GAAG,2EAA2E;QAC5EC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC;QAErB,MAAMrB,OACJsB,kBAAkB;YAAEF;YAAcG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAAC,IAC3Ec,OAAO,CAACC,OAAO,CAAC;IACpB;IAEAxB,GAAG,mEAAmE;QACpEC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC,kBAAkB;QAEvC,MAAMK,OAAO,MAAMJ,kBAAkB;YACnCF;YACAG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAC1C;QAEAV,OAAO0B,KAAKC,IAAI,CAACC,QAAQ,IAAIC,IAAI,CAAC;IACpC;IAEA5B,GAAG,4EAA4E;QAC7EC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC,kBAAkB;YACrC;gBACES,UAAU;gBACVpB,MAAMqB,OAAOrB;gBACbsB,UAAU;YACZ;SACD;QAED,MAAMN,OAAO,MAAMJ,kBAAkB;YACnCF;YACAG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAC1C;QAEAV,OAAO0B,KAAKC,IAAI,CAACC,QAAQ,IAAIC,IAAI,CAAC;IACpC;IAEA5B,GAAG,kDAAkD;QACnDC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC;QAErB,MAAMK,OAAO,MAAMJ,kBAAkB;YACnCF;YACAG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAC1C;QAEAV,OAAO0B,KAAKC,IAAI,CAACC,QAAQ,IAAIC,IAAI,CAAC;IACpC;AACF;AAEA,SAASR,kBAAkBY,aAA6C;IACtE,MAAMC,SAAS/B,mBAAmB;QAChCgC,aAAa;YACX,CAAC/B,eAAe,EAAE;gBAChBgC,SAAS,IAAO,CAAA;wBACdC,cAAc,UAAYC;wBAC1BC,cAAc,UAAYD;wBAC1BE,MAAM;wBACNC,eAAe,UAAY,IAAIC,SAAS,MAAM;gCAAEC,QAAQ;4BAAI;oBAC9D,CAAA;gBACAC,6BAA6B;YAC/B;QACF;IACF,GAAG;QACDT,aAAa;YACX;gBACEU,QAAQ,EAAE;gBACVC,MAAM1C;gBACN2C,QAAQ,OAAOd,kBAAkB,cAAc,OAAO;oBAAEA;gBAAc;YACxE;SACD;IACH;IAEA,MAAMb,eAAec,OAAOC,WAAW,EAAE,CAAC,EAAE,EAAEY;IAC9C,IAAI,CAAC3B,gBAAgB,OAAOA,iBAAiB,UAAU;QACrD,MAAM,IAAI4B,MAAM;IAClB;IAEA,OAAO5B;AACT;AAEA,eAAeE,kBAAkB,EAC/BF,YAAY,EACZG,GAAG,EAIJ;IACC,OAAO5B,gBAAgB;QACrBgC,MAAM;YACJsB,UAAU;YACV1B;QACF;QACA2B,KAAK;YACHC,SAAS,IAAIC;YACbC,SAAS;gBACPnB,QAAQ;oBACNoB,cAAc;gBAChB;YACF;QACF;QACAlC;IACF;AACF;AAEA,MAAMgB,UAAU,IAAO,CAAA;QACrBC,cAAc,IAAMC;QACpBC,cAAc,IAAMD;QACpBE,MAAM;QACNC,eAAe,IAAM,IAAIC;IAC3B,CAAA;AAEA3C,SAAS,sBAAsB;IAC7BE,GAAG,oEAAoE;QACrE,MAAMiC,SAAS/B,mBAAmB;YAChCgC,aAAa;gBACXoB,OAAO;oBAAEnB;gBAAQ;YACnB;QACF,GAAU;YACRD,aAAa;gBAAC;oBAAEU,QAAQ,EAAE;oBAAEC,MAAM;oBAASC,QAAQ;gBAAK;aAAE;QAC5D;QACA,MAAMS,QAAQtB,OAAOC,WAAW,EAAE,CAAC,EAAE,EAAEqB,OAAOC,gBAAgB,EAAE;QAChE,MAAMP,MAAM;YACVQ,SAAS,CAAC;YACVhC,MAAM;gBAAEiC,UAAU;gBAAanB,MAAM;gBAAaoB,MAAM;YAAG;QAC7D;QACA,IAAIjC,OAAO;YAAEsB,UAAU;YAAaY,QAAQ;QAAkB;QAE9D,KAAK,MAAMC,QAAQN,MAAO;YACxB,MAAMO,SAAS,MAAMD,KAAK;gBAAEnC;gBAAMqC,WAAW;gBAAUd;YAAI;YAC3DvB,OAAOoC,UAAUpC;QACnB;QAEA3B,OAAO2B,KAAKkC,MAAM,EAAEhC,IAAI,CAAC;IAC3B;AACF"}

package/dist/types.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionConfig, Field, FileData, ImageSize, PayloadRequest, TypeWithID, UploadCollectionSlug } from 'payload';
+import type { SignedClientUploadReceipt } from 'payload/internal';
 export interface File {
     buffer: Buffer;
     clientUploadContext?: unknown;
@@ -14,12 +15,27 @@ export type ClientUploadsAccess = (args: {
 export type ClientUploadsConfig = {
     access?: ClientUploadsAccess;
 } | boolean;
+/**
+ * Context returned by a client-upload handler and submitted with the document
+ * create request. `prefix` plus the server-owned `_objectKey` segment locate the object.
+ */
+export type ClientUploadContext = {
+    _objectKey?: string;
+    prefix: string;
+    signedReceipt: SignedClientUploadReceipt;
+};
 export type HandleUpload = (args: {
     clientUploadContext: unknown;
     collection: CollectionConfig;
     data: any;
     file: File;
     req: PayloadRequest;
+    /**
+     * Pre-resolved storage file path (`_objectKey` folded in, contained beneath the collection prefix).
+     * Path-based adapters upload to it; provider-id adapters (e.g. uploadthing) ignore it and assign
+     * their own key.
+     */
+    storageFilePath: string;
 }) => Partial<FileData & TypeWithID> | Promise<Partial<FileData & TypeWithID>> | Promise<void> | void;
 export interface TypeWithPrefix {
     prefix?: string;
@@ -29,6 +45,11 @@ export type HandleDelete = (args: {
     doc: FileData & TypeWithID & TypeWithPrefix;
     filename: string;
     req: PayloadRequest;
+    /**
+     * Pre-resolved storage file path of the object to delete. Path-based adapters delete it; provider-id
+     * adapters (e.g. uploadthing) ignore it and locate the object via `doc`.
+     */
+    storageFilePath: string;
 }) => Promise<void> | void;
 export type GenerateURL = (args: {
     collection: CollectionConfig;
@@ -59,7 +80,8 @@ export interface GeneratedAdapter {
     handleDelete: HandleDelete;
     handleUpload: HandleUpload;
     name: string;
-    onInit?: () => void;
+    onInit?: () => Promise<void> | void;
+    requiresClientUploadReceipt?: boolean;
     staticHandler: StaticHandler;
 }
 export type Adapter = (args: {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,KAAK,EACL,QAAQ,EACR,SAAS,EACT,cAAc,EACd,UAAU,EACV,oBAAoB,EACrB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,cAAc,EAAE,oBAAoB,CAAA;IACpC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAEhC,MAAM,MAAM,mBAAmB,GAC3B;IACE,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B,GACD,OAAO,CAAA;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE;IAChC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,GAAG,CAAA;IACT,IAAI,EAAE,IAAI,CAAA;IACV,GAAG,EAAE,cAAc,CAAA;CACpB,KACG,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,GAC9B,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,GACb,IAAI,CAAA;AAER,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,GAAG,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAA;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,GAAG,CAAA;IACT,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,UAAU,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACjG,KACE,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;AAEjC,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;OAEG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,CAAA;IAChB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,EAAE,YAAY,CAAA;IAC1B,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,IAAI,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,gBAAgB,CAAA;AAEnG,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE;IACnC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,2BAA2B,CAAC,EAAE,IAAI,CAAA;IAClC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAA;IACrE;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,KAAK,EACL,QAAQ,EACR,SAAS,EACT,cAAc,EACd,UAAU,EACV,oBAAoB,EACrB,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAEjE,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE;IACvC,cAAc,EAAE,oBAAoB,CAAA;IACpC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAEhC,MAAM,MAAM,mBAAmB,GAC3B;IACE,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B,GACD,OAAO,CAAA;AAEX;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,yBAAyB,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE;IAChC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,GAAG,CAAA;IACT,IAAI,EAAE,IAAI,CAAA;IACV,GAAG,EAAE,cAAc,CAAA;IACnB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;CACxB,KACG,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,GAC9B,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,GACb,IAAI,CAAA;AAER,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,GAAG,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAA;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,GAAG,CAAA;IACT,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,UAAU,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACjG,KACE,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;AAEjC,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;OAEG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,CAAA;IAChB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,EAAE,YAAY,CAAA;IAC1B,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACnC,2BAA2B,CAAC,EAAE,OAAO,CAAA;IACrC,aAAa,EAAE,aAAa,CAAA;CAC7B;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,gBAAgB,CAAA;AAEnG,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE;IACnC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,2BAA2B,CAAC,EAAE,IAAI,CAAA;IAClC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAA;IACrE;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  CollectionConfig,\n  Field,\n  FileData,\n  ImageSize,\n  PayloadRequest,\n  TypeWithID,\n  UploadCollectionSlug,\n} from 'payload'\n\nexport interface File {\n  buffer: Buffer\n  clientUploadContext?: unknown\n  filename: string\n  filesize: number\n  mimeType: string\n  tempFilePath?: string\n}\n\nexport type ClientUploadsAccess = (args: {\n  collectionSlug: UploadCollectionSlug\n  req: PayloadRequest\n}) => boolean | Promise<boolean>\n\nexport type ClientUploadsConfig =\n  | {\n      access?: ClientUploadsAccess\n    }\n  | boolean\n\nexport type HandleUpload = (args: {\n  clientUploadContext: unknown\n  collection: CollectionConfig\n  data: any\n  file: File\n  req: PayloadRequest\n}) =>\n  | Partial<FileData & TypeWithID>\n  | Promise<Partial<FileData & TypeWithID>>\n  | Promise<void>\n  | void\n\nexport interface TypeWithPrefix {\n  prefix?: string\n}\n\nexport type HandleDelete = (args: {\n  collection: CollectionConfig\n  doc: FileData & TypeWithID & TypeWithPrefix\n  filename: string\n  req: PayloadRequest\n}) => Promise<void> | void\n\nexport type GenerateURL = (args: {\n  collection: CollectionConfig\n  data: any\n  filename: string\n  prefix?: string\n}) => Promise<string> | string\n\nexport type StaticHandler = (\n  req: PayloadRequest,\n  args: {\n    doc?: TypeWithID\n    headers?: Headers\n    params: { clientUploadContext?: unknown; collection: string; filename: string; prefix?: string }\n  },\n) => Promise<Response> | Response\n\nexport interface GeneratedAdapter {\n  clientUploads?: ClientUploadsConfig\n  /**\n   * Additional fields to be injected into the base collection and image sizes\n   */\n  fields?: Field[]\n  /**\n   * Generates the public URL for a file\n   */\n  generateURL?: GenerateURL\n  handleDelete: HandleDelete\n  handleUpload: HandleUpload\n  name: string\n  onInit?: () => void\n  staticHandler: StaticHandler\n}\n\nexport type Adapter = (args: { collection: CollectionConfig; prefix?: string }) => GeneratedAdapter\n\nexport type AllowList = Array<{\n  hostname: string\n  pathname?: string\n  port?: string\n  protocol?: 'http' | 'https'\n  search?: string\n}>\n\nexport type GenerateFileURL = (args: {\n  collection: CollectionConfig\n  filename: string\n  prefix?: string\n  size?: ImageSize\n}) => Promise<string> | string\n\nexport interface CollectionOptions {\n  adapter: Adapter | null\n  disableLocalStorage?: boolean\n  disablePayloadAccessControl?: true\n  generateFileURL?: GenerateFileURL\n  prefix?: string\n}\n\nexport interface PluginOptions {\n  /**\n   * When enabled, fields (like the prefix field) will always be inserted into\n   * the collection schema regardless of whether the plugin is enabled. This\n   * ensures a consistent schema across all environments.\n   *\n   * This will be enabled by default in Payload v4.\n   *\n   * @default false\n   */\n  alwaysInsertFields?: boolean\n  collections: Partial<Record<UploadCollectionSlug, CollectionOptions>>\n  /**\n   * Whether or not to enable the plugin\n   *\n   * Default: true\n   */\n  enabled?: boolean\n  /**\n   * When true (compositional prefixes), the stored `prefix` field is only the\n   * document-level segment; the collection prefix comes from plugin options and\n   * must not be pre-filled as the field default.\n   *\n   * Set by storage adapters that support compositional prefixes (e.g. S3, Azure, R2, Vercel Blob, GCS).\n   *\n   * @default false\n   */\n  useCompositePrefixes?: boolean\n}\n"],"names":[],"mappings":"AA+GA,WA4BC"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  CollectionConfig,\n  Field,\n  FileData,\n  ImageSize,\n  PayloadRequest,\n  TypeWithID,\n  UploadCollectionSlug,\n} from 'payload'\nimport type { SignedClientUploadReceipt } from 'payload/internal'\n\nexport interface File {\n  buffer: Buffer\n  clientUploadContext?: unknown\n  filename: string\n  filesize: number\n  mimeType: string\n  tempFilePath?: string\n}\n\nexport type ClientUploadsAccess = (args: {\n  collectionSlug: UploadCollectionSlug\n  req: PayloadRequest\n}) => boolean | Promise<boolean>\n\nexport type ClientUploadsConfig =\n  | {\n      access?: ClientUploadsAccess\n    }\n  | boolean\n\n/**\n * Context returned by a client-upload handler and submitted with the document\n * create request. `prefix` plus the server-owned `_objectKey` segment locate the object.\n */\nexport type ClientUploadContext = {\n  _objectKey?: string\n  prefix: string\n  signedReceipt: SignedClientUploadReceipt\n}\n\nexport type HandleUpload = (args: {\n  clientUploadContext: unknown\n  collection: CollectionConfig\n  data: any\n  file: File\n  req: PayloadRequest\n  /**\n   * Pre-resolved storage file path (`_objectKey` folded in, contained beneath the collection prefix).\n   * Path-based adapters upload to it; provider-id adapters (e.g. uploadthing) ignore it and assign\n   * their own key.\n   */\n  storageFilePath: string\n}) =>\n  | Partial<FileData & TypeWithID>\n  | Promise<Partial<FileData & TypeWithID>>\n  | Promise<void>\n  | void\n\nexport interface TypeWithPrefix {\n  prefix?: string\n}\n\nexport type HandleDelete = (args: {\n  collection: CollectionConfig\n  doc: FileData & TypeWithID & TypeWithPrefix\n  filename: string\n  req: PayloadRequest\n  /**\n   * Pre-resolved storage file path of the object to delete. Path-based adapters delete it; provider-id\n   * adapters (e.g. uploadthing) ignore it and locate the object via `doc`.\n   */\n  storageFilePath: string\n}) => Promise<void> | void\n\nexport type GenerateURL = (args: {\n  collection: CollectionConfig\n  data: any\n  filename: string\n  prefix?: string\n}) => Promise<string> | string\n\nexport type StaticHandler = (\n  req: PayloadRequest,\n  args: {\n    doc?: TypeWithID\n    headers?: Headers\n    params: { clientUploadContext?: unknown; collection: string; filename: string; prefix?: string }\n  },\n) => Promise<Response> | Response\n\nexport interface GeneratedAdapter {\n  clientUploads?: ClientUploadsConfig\n  /**\n   * Additional fields to be injected into the base collection and image sizes\n   */\n  fields?: Field[]\n  /**\n   * Generates the public URL for a file\n   */\n  generateURL?: GenerateURL\n  handleDelete: HandleDelete\n  handleUpload: HandleUpload\n  name: string\n  onInit?: () => Promise<void> | void\n  requiresClientUploadReceipt?: boolean\n  staticHandler: StaticHandler\n}\n\nexport type Adapter = (args: { collection: CollectionConfig; prefix?: string }) => GeneratedAdapter\n\nexport type AllowList = Array<{\n  hostname: string\n  pathname?: string\n  port?: string\n  protocol?: 'http' | 'https'\n  search?: string\n}>\n\nexport type GenerateFileURL = (args: {\n  collection: CollectionConfig\n  filename: string\n  prefix?: string\n  size?: ImageSize\n}) => Promise<string> | string\n\nexport interface CollectionOptions {\n  adapter: Adapter | null\n  disableLocalStorage?: boolean\n  disablePayloadAccessControl?: true\n  generateFileURL?: GenerateFileURL\n  prefix?: string\n}\n\nexport interface PluginOptions {\n  /**\n   * When enabled, fields (like the prefix field) will always be inserted into\n   * the collection schema regardless of whether the plugin is enabled. This\n   * ensures a consistent schema across all environments.\n   *\n   * This will be enabled by default in Payload v4.\n   *\n   * @default false\n   */\n  alwaysInsertFields?: boolean\n  collections: Partial<Record<UploadCollectionSlug, CollectionOptions>>\n  /**\n   * Whether or not to enable the plugin\n   *\n   * Default: true\n   */\n  enabled?: boolean\n  /**\n   * When true (compositional prefixes), the stored `prefix` field is only the\n   * document-level segment; the collection prefix comes from plugin options and\n   * must not be pre-filled as the field default.\n   *\n   * Set by storage adapters that support compositional prefixes (e.g. S3, Azure, R2, Vercel Blob, GCS).\n   *\n   * @default false\n   */\n  useCompositePrefixes?: boolean\n}\n"],"names":[],"mappings":"AAsIA,WA4BC"}

package/dist/utilities/assertReceiptMatchesFileKey.d.ts

@@ -0,0 +1,15 @@
+import type { ClientUploadReceipt } from 'payload/internal';
+type Args = {
+    collectionPrefix?: string;
+    expectedFileKey: string;
+    receipt: ClientUploadReceipt;
+    useCompositePrefixes?: boolean;
+};
+/**
+ * Asserts a signed client-upload receipt authorizes writing to `expectedFileKey` by recomputing
+ * the key from the receipt's own prefix, `_objectKey`, and filename. Collection binding is enforced
+ * separately by {@link verifyClientUploadReceipt}.
+ */
+export declare function assertReceiptMatchesFileKey({ collectionPrefix, expectedFileKey, receipt, useCompositePrefixes, }: Args): void;
+export {};
+//# sourceMappingURL=assertReceiptMatchesFileKey.d.ts.map

package/dist/utilities/assertReceiptMatchesFileKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertReceiptMatchesFileKey.d.ts","sourceRoot":"","sources":["../../src/utilities/assertReceiptMatchesFileKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAO3D,KAAK,IAAI,GAAG;IACV,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,gBAAqB,EACrB,eAAe,EACf,OAAO,EACP,oBAA4B,GAC7B,EAAE,IAAI,GAAG,IAAI,CAqBb"}

package/dist/utilities/assertReceiptMatchesFileKey.js

@@ -0,0 +1,31 @@
+import { APIError } from 'payload';
+import { buildPrefixWithObjectKey } from './buildPrefixWithObjectKey.js';
+import { buildStoragePathData } from './buildStoragePathData.js';
+/**
+ * Asserts a signed client-upload receipt authorizes writing to `expectedFileKey` by recomputing
+ * the key from the receipt's own prefix, `_objectKey`, and filename. Collection binding is enforced
+ * separately by {@link verifyClientUploadReceipt}.
+ */ export function assertReceiptMatchesFileKey({ collectionPrefix = '', expectedFileKey, receipt, useCompositePrefixes = false }) {
+    const receiptPrefix = receipt.context.prefix;
+    if (typeof receiptPrefix !== 'string') {
+        throw new APIError('Client upload reference does not match this request.', 400);
+    }
+    const objectKey = receipt?.context?._objectKey ?? '';
+    if (objectKey && typeof objectKey !== 'string') {
+        throw new APIError('Client upload reference does not match this request.', 400);
+    }
+    const { storageFilePath } = buildStoragePathData({
+        collectionPrefix,
+        docPrefix: buildPrefixWithObjectKey({
+            objectKey,
+            prefix: receiptPrefix
+        }),
+        filename: receipt.filename,
+        useCompositePrefixes
+    });
+    if (storageFilePath !== expectedFileKey) {
+        throw new APIError('Client upload reference does not match this request.', 400);
+    }
+}
+
+//# sourceMappingURL=assertReceiptMatchesFileKey.js.map

package/dist/utilities/assertReceiptMatchesFileKey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/assertReceiptMatchesFileKey.ts"],"sourcesContent":["import type { ClientUploadReceipt } from 'payload/internal'\n\nimport { APIError } from 'payload'\n\nimport { buildPrefixWithObjectKey } from './buildPrefixWithObjectKey.js'\nimport { buildStoragePathData } from './buildStoragePathData.js'\n\ntype Args = {\n  collectionPrefix?: string\n  expectedFileKey: string\n  receipt: ClientUploadReceipt\n  useCompositePrefixes?: boolean\n}\n\n/**\n * Asserts a signed client-upload receipt authorizes writing to `expectedFileKey` by recomputing\n * the key from the receipt's own prefix, `_objectKey`, and filename. Collection binding is enforced\n * separately by {@link verifyClientUploadReceipt}.\n */\nexport function assertReceiptMatchesFileKey({\n  collectionPrefix = '',\n  expectedFileKey,\n  receipt,\n  useCompositePrefixes = false,\n}: Args): void {\n  const receiptPrefix = receipt.context.prefix\n  if (typeof receiptPrefix !== 'string') {\n    throw new APIError('Client upload reference does not match this request.', 400)\n  }\n\n  const objectKey: string = (receipt?.context?._objectKey as string) ?? ''\n  if (objectKey && typeof objectKey !== 'string') {\n    throw new APIError('Client upload reference does not match this request.', 400)\n  }\n\n  const { storageFilePath } = buildStoragePathData({\n    collectionPrefix,\n    docPrefix: buildPrefixWithObjectKey({ objectKey, prefix: receiptPrefix }),\n    filename: receipt.filename,\n    useCompositePrefixes,\n  })\n\n  if (storageFilePath !== expectedFileKey) {\n    throw new APIError('Client upload reference does not match this request.', 400)\n  }\n}\n"],"names":["APIError","buildPrefixWithObjectKey","buildStoragePathData","assertReceiptMatchesFileKey","collectionPrefix","expectedFileKey","receipt","useCompositePrefixes","receiptPrefix","context","prefix","objectKey","_objectKey","storageFilePath","docPrefix","filename"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,UAAS;AAElC,SAASC,wBAAwB,QAAQ,gCAA+B;AACxE,SAASC,oBAAoB,QAAQ,4BAA2B;AAShE;;;;CAIC,GACD,OAAO,SAASC,4BAA4B,EAC1CC,mBAAmB,EAAE,EACrBC,eAAe,EACfC,OAAO,EACPC,uBAAuB,KAAK,EACvB;IACL,MAAMC,gBAAgBF,QAAQG,OAAO,CAACC,MAAM;IAC5C,IAAI,OAAOF,kBAAkB,UAAU;QACrC,MAAM,IAAIR,SAAS,wDAAwD;IAC7E;IAEA,MAAMW,YAAoB,AAACL,SAASG,SAASG,cAAyB;IACtE,IAAID,aAAa,OAAOA,cAAc,UAAU;QAC9C,MAAM,IAAIX,SAAS,wDAAwD;IAC7E;IAEA,MAAM,EAAEa,eAAe,EAAE,GAAGX,qBAAqB;QAC/CE;QACAU,WAAWb,yBAAyB;YAAEU;YAAWD,QAAQF;QAAc;QACvEO,UAAUT,QAAQS,QAAQ;QAC1BR;IACF;IAEA,IAAIM,oBAAoBR,iBAAiB;QACvC,MAAM,IAAIL,SAAS,wDAAwD;IAC7E;AACF"}

package/dist/utilities/buildPrefixWithObjectKey.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Joins the semantic prefix and the `_objectKey` segment into the object's folder; either may be empty.
+ */
+export declare const buildPrefixWithObjectKey: ({ objectKey, prefix, }: {
+    objectKey?: string;
+    prefix?: string;
+}) => string;
+//# sourceMappingURL=buildPrefixWithObjectKey.d.ts.map

package/dist/utilities/buildPrefixWithObjectKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildPrefixWithObjectKey.d.ts","sourceRoot":"","sources":["../../src/utilities/buildPrefixWithObjectKey.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,wBAAwB,2BAGlC;IACD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,KAAG,MASH,CAAA"}

package/dist/utilities/buildPrefixWithObjectKey.js

@@ -0,0 +1,13 @@
+import { sanitizePrefix } from './sanitizePrefix.js';
+/**
+ * Joins the semantic prefix and the `_objectKey` segment into the object's folder; either may be empty.
+ */ export const buildPrefixWithObjectKey = ({ objectKey, prefix })=>{
+    const safePrefix = sanitizePrefix(prefix ?? '');
+    const safeObjectKey = sanitizePrefix(objectKey ?? '');
+    if (safePrefix && safeObjectKey) {
+        return `${safePrefix}/${safeObjectKey}`;
+    }
+    return safePrefix || safeObjectKey;
+};
+
+//# sourceMappingURL=buildPrefixWithObjectKey.js.map

package/dist/utilities/buildPrefixWithObjectKey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/buildPrefixWithObjectKey.ts"],"sourcesContent":["import { sanitizePrefix } from './sanitizePrefix.js'\n\n/**\n * Joins the semantic prefix and the `_objectKey` segment into the object's folder; either may be empty.\n */\nexport const buildPrefixWithObjectKey = ({\n  objectKey,\n  prefix,\n}: {\n  objectKey?: string\n  prefix?: string\n}): string => {\n  const safePrefix = sanitizePrefix(prefix ?? '')\n  const safeObjectKey = sanitizePrefix(objectKey ?? '')\n\n  if (safePrefix && safeObjectKey) {\n    return `${safePrefix}/${safeObjectKey}`\n  }\n\n  return safePrefix || safeObjectKey\n}\n"],"names":["sanitizePrefix","buildPrefixWithObjectKey","objectKey","prefix","safePrefix","safeObjectKey"],"mappings":"AAAA,SAASA,cAAc,QAAQ,sBAAqB;AAEpD;;CAEC,GACD,OAAO,MAAMC,2BAA2B,CAAC,EACvCC,SAAS,EACTC,MAAM,EAIP;IACC,MAAMC,aAAaJ,eAAeG,UAAU;IAC5C,MAAME,gBAAgBL,eAAeE,aAAa;IAElD,IAAIE,cAAcC,eAAe;QAC/B,OAAO,GAAGD,WAAW,CAAC,EAAEC,eAAe;IACzC;IAEA,OAAOD,cAAcC;AACvB,EAAC"}

package/dist/utilities/buildStoragePathData.d.ts

@@ -0,0 +1,55 @@
+type BuildFilePathDataArgs = {
+    collectionPrefix?: string;
+    docPrefix?: string;
+    filename: string;
+    useCompositePrefixes?: boolean;
+};
+type BuildFilePathDataResult = {
+    /**
+     * @deprecated Use `storageFilePath` instead.
+     *
+     * The full path to the file within the storage backend.
+     */
+    fileKey: string;
+    sanitizedCollectionPrefix: string;
+    sanitizedDocPrefix: string;
+    sanitizedFilename: string;
+    /**
+     * The full path to the file within the storage backend.
+     */
+    storageFilePath: string;
+};
+export declare function isStoragePathWithinCollectionPrefix({ collectionPrefix, docPrefix, }: {
+    collectionPrefix?: string;
+    docPrefix: string;
+}): boolean;
+/**
+ * Resolves where a new upload must be stored, without needing a filename.
+ *
+ * In non-composite mode (useCompositePrefixes: false), docPrefix is treated as a complete prefix
+ * when it is already within collectionPrefix and is otherwise nested beneath collectionPrefix.
+ * In composite mode (useCompositePrefixes: true), the collection prefix is joined when the key is
+ * built, so the persisted document prefix stays relative to it.
+ *
+ * Prefix-only callers (such as the upload prefix hooks) use this directly; use
+ * {@link buildUploadStoragePathData} when a full object key is needed.
+ */
+export declare function buildUploadPrefix({ collectionPrefix, docPrefix, useCompositePrefixes, }: Omit<BuildFilePathDataArgs, 'filename'>): {
+    sanitizedCollectionPrefix: string;
+    sanitizedDocPrefix: string;
+    uploadPrefix: string;
+};
+/**
+ * Resolves a new upload destination beneath the configured collection prefix.
+ * Both prefixes are passed through {@link sanitizePrefix} so keys stay normalized.
+ */
+export declare function buildUploadStoragePathData({ collectionPrefix, docPrefix, filename, useCompositePrefixes, }: BuildFilePathDataArgs): BuildFilePathDataResult;
+/**
+ * Resolves the exact location represented by persisted upload metadata.
+ * Non-composite document prefixes historically override the collection prefix;
+ * keep that behavior for reads, URLs, and cleanup of pre-upgrade files.
+ * New writes must use buildUploadStoragePathData instead.
+ */
+export declare function buildStoragePathData({ collectionPrefix, docPrefix, filename, useCompositePrefixes, }: BuildFilePathDataArgs): BuildFilePathDataResult;
+export {};
+//# sourceMappingURL=buildStoragePathData.d.ts.map

package/dist/utilities/buildStoragePathData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildStoragePathData.d.ts","sourceRoot":"","sources":["../../src/utilities/buildStoragePathData.ts"],"names":[],"mappings":"AAKA,KAAK,qBAAqB,GAAG;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC7B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,yBAAyB,EAAE,MAAM,CAAA;IACjC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,iBAAiB,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,wBAAgB,mCAAmC,CAAC,EAClD,gBAAgB,EAChB,SAAS,GACV,EAAE;IACD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,OAAO,CAQV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,gBAAgB,EAChB,SAAS,EACT,oBAA4B,GAC7B,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,GAAG;IAC3C,yBAAyB,EAAE,MAAM,CAAA;IACjC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;CACrB,CAiBA;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,oBAA4B,GAC7B,EAAE,qBAAqB,GAAG,uBAAuB,CAmBjD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,oBAA4B,GAC7B,EAAE,qBAAqB,GAAG,uBAAuB,CAejD"}

package/dist/utilities/buildStoragePathData.js

@@ -0,0 +1,69 @@
+import path from 'path';
+import { sanitizeFilename } from 'payload/shared';
+import { sanitizePrefix } from './sanitizePrefix.js';
+export function isStoragePathWithinCollectionPrefix({ collectionPrefix, docPrefix }) {
+    const safeCollectionPrefix = sanitizePrefix(collectionPrefix || '');
+    return !safeCollectionPrefix || docPrefix === safeCollectionPrefix || docPrefix.startsWith(`${safeCollectionPrefix}/`);
+}
+/**
+ * Resolves where a new upload must be stored, without needing a filename.
+ *
+ * In non-composite mode (useCompositePrefixes: false), docPrefix is treated as a complete prefix
+ * when it is already within collectionPrefix and is otherwise nested beneath collectionPrefix.
+ * In composite mode (useCompositePrefixes: true), the collection prefix is joined when the key is
+ * built, so the persisted document prefix stays relative to it.
+ *
+ * Prefix-only callers (such as the upload prefix hooks) use this directly; use
+ * {@link buildUploadStoragePathData} when a full object key is needed.
+ */ export function buildUploadPrefix({ collectionPrefix, docPrefix, useCompositePrefixes = false }) {
+    const safeCollectionPrefix = sanitizePrefix(collectionPrefix || '');
+    const safeDocPrefix = sanitizePrefix(docPrefix || '');
+    const uploadPrefix = safeDocPrefix && !isStoragePathWithinCollectionPrefix({
+        collectionPrefix: safeCollectionPrefix,
+        docPrefix: safeDocPrefix
+    }) ? path.posix.join(safeCollectionPrefix, safeDocPrefix) : safeDocPrefix || safeCollectionPrefix;
+    return {
+        sanitizedCollectionPrefix: safeCollectionPrefix,
+        sanitizedDocPrefix: !useCompositePrefixes && safeDocPrefix ? uploadPrefix : safeDocPrefix,
+        uploadPrefix
+    };
+}
+/**
+ * Resolves a new upload destination beneath the configured collection prefix.
+ * Both prefixes are passed through {@link sanitizePrefix} so keys stay normalized.
+ */ export function buildUploadStoragePathData({ collectionPrefix, docPrefix, filename, useCompositePrefixes = false }) {
+    const { sanitizedCollectionPrefix, sanitizedDocPrefix, uploadPrefix } = buildUploadPrefix({
+        collectionPrefix,
+        docPrefix,
+        useCompositePrefixes
+    });
+    const safeFilename = sanitizeFilename(filename);
+    const storageFilePath = useCompositePrefixes ? path.posix.join(sanitizedCollectionPrefix, sanitizedDocPrefix, safeFilename) : path.posix.join(uploadPrefix, safeFilename);
+    return {
+        fileKey: storageFilePath,
+        sanitizedCollectionPrefix,
+        sanitizedDocPrefix,
+        sanitizedFilename: safeFilename,
+        storageFilePath
+    };
+}
+/**
+ * Resolves the exact location represented by persisted upload metadata.
+ * Non-composite document prefixes historically override the collection prefix;
+ * keep that behavior for reads, URLs, and cleanup of pre-upgrade files.
+ * New writes must use buildUploadStoragePathData instead.
+ */ export function buildStoragePathData({ collectionPrefix, docPrefix, filename, useCompositePrefixes = false }) {
+    const sanitizedCollectionPrefix = sanitizePrefix(collectionPrefix || '');
+    const sanitizedDocPrefix = sanitizePrefix(docPrefix || '');
+    const sanitizedFilename = sanitizeFilename(filename);
+    const storageFilePath = useCompositePrefixes ? path.posix.join(sanitizedCollectionPrefix, sanitizedDocPrefix, sanitizedFilename) : path.posix.join(sanitizedDocPrefix || sanitizedCollectionPrefix, sanitizedFilename);
+    return {
+        fileKey: storageFilePath,
+        sanitizedCollectionPrefix,
+        sanitizedDocPrefix,
+        sanitizedFilename,
+        storageFilePath
+    };
+}
+
+//# sourceMappingURL=buildStoragePathData.js.map

package/dist/utilities/buildStoragePathData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/buildStoragePathData.ts"],"sourcesContent":["import path from 'path'\nimport { sanitizeFilename } from 'payload/shared'\n\nimport { sanitizePrefix } from './sanitizePrefix.js'\n\ntype BuildFilePathDataArgs = {\n  collectionPrefix?: string\n  docPrefix?: string\n  filename: string\n  useCompositePrefixes?: boolean\n}\n\ntype BuildFilePathDataResult = {\n  /**\n   * @deprecated Use `storageFilePath` instead.\n   *\n   * The full path to the file within the storage backend.\n   */\n  fileKey: string\n  sanitizedCollectionPrefix: string\n  sanitizedDocPrefix: string\n  sanitizedFilename: string\n  /**\n   * The full path to the file within the storage backend.\n   */\n  storageFilePath: string\n}\n\nexport function isStoragePathWithinCollectionPrefix({\n  collectionPrefix,\n  docPrefix,\n}: {\n  collectionPrefix?: string\n  docPrefix: string\n}): boolean {\n  const safeCollectionPrefix = sanitizePrefix(collectionPrefix || '')\n\n  return (\n    !safeCollectionPrefix ||\n    docPrefix === safeCollectionPrefix ||\n    docPrefix.startsWith(`${safeCollectionPrefix}/`)\n  )\n}\n\n/**\n * Resolves where a new upload must be stored, without needing a filename.\n *\n * In non-composite mode (useCompositePrefixes: false), docPrefix is treated as a complete prefix\n * when it is already within collectionPrefix and is otherwise nested beneath collectionPrefix.\n * In composite mode (useCompositePrefixes: true), the collection prefix is joined when the key is\n * built, so the persisted document prefix stays relative to it.\n *\n * Prefix-only callers (such as the upload prefix hooks) use this directly; use\n * {@link buildUploadStoragePathData} when a full object key is needed.\n */\nexport function buildUploadPrefix({\n  collectionPrefix,\n  docPrefix,\n  useCompositePrefixes = false,\n}: Omit<BuildFilePathDataArgs, 'filename'>): {\n  sanitizedCollectionPrefix: string\n  sanitizedDocPrefix: string\n  uploadPrefix: string\n} {\n  const safeCollectionPrefix = sanitizePrefix(collectionPrefix || '')\n  const safeDocPrefix = sanitizePrefix(docPrefix || '')\n  const uploadPrefix =\n    safeDocPrefix &&\n    !isStoragePathWithinCollectionPrefix({\n      collectionPrefix: safeCollectionPrefix,\n      docPrefix: safeDocPrefix,\n    })\n      ? path.posix.join(safeCollectionPrefix, safeDocPrefix)\n      : safeDocPrefix || safeCollectionPrefix\n\n  return {\n    sanitizedCollectionPrefix: safeCollectionPrefix,\n    sanitizedDocPrefix: !useCompositePrefixes && safeDocPrefix ? uploadPrefix : safeDocPrefix,\n    uploadPrefix,\n  }\n}\n\n/**\n * Resolves a new upload destination beneath the configured collection prefix.\n * Both prefixes are passed through {@link sanitizePrefix} so keys stay normalized.\n */\nexport function buildUploadStoragePathData({\n  collectionPrefix,\n  docPrefix,\n  filename,\n  useCompositePrefixes = false,\n}: BuildFilePathDataArgs): BuildFilePathDataResult {\n  const { sanitizedCollectionPrefix, sanitizedDocPrefix, uploadPrefix } = buildUploadPrefix({\n    collectionPrefix,\n    docPrefix,\n    useCompositePrefixes,\n  })\n  const safeFilename = sanitizeFilename(filename)\n\n  const storageFilePath = useCompositePrefixes\n    ? path.posix.join(sanitizedCollectionPrefix, sanitizedDocPrefix, safeFilename)\n    : path.posix.join(uploadPrefix, safeFilename)\n\n  return {\n    fileKey: storageFilePath,\n    sanitizedCollectionPrefix,\n    sanitizedDocPrefix,\n    sanitizedFilename: safeFilename,\n    storageFilePath,\n  }\n}\n\n/**\n * Resolves the exact location represented by persisted upload metadata.\n * Non-composite document prefixes historically override the collection prefix;\n * keep that behavior for reads, URLs, and cleanup of pre-upgrade files.\n * New writes must use buildUploadStoragePathData instead.\n */\nexport function buildStoragePathData({\n  collectionPrefix,\n  docPrefix,\n  filename,\n  useCompositePrefixes = false,\n}: BuildFilePathDataArgs): BuildFilePathDataResult {\n  const sanitizedCollectionPrefix = sanitizePrefix(collectionPrefix || '')\n  const sanitizedDocPrefix = sanitizePrefix(docPrefix || '')\n  const sanitizedFilename = sanitizeFilename(filename)\n  const storageFilePath = useCompositePrefixes\n    ? path.posix.join(sanitizedCollectionPrefix, sanitizedDocPrefix, sanitizedFilename)\n    : path.posix.join(sanitizedDocPrefix || sanitizedCollectionPrefix, sanitizedFilename)\n\n  return {\n    fileKey: storageFilePath,\n    sanitizedCollectionPrefix,\n    sanitizedDocPrefix,\n    sanitizedFilename,\n    storageFilePath,\n  }\n}\n"],"names":["path","sanitizeFilename","sanitizePrefix","isStoragePathWithinCollectionPrefix","collectionPrefix","docPrefix","safeCollectionPrefix","startsWith","buildUploadPrefix","useCompositePrefixes","safeDocPrefix","uploadPrefix","posix","join","sanitizedCollectionPrefix","sanitizedDocPrefix","buildUploadStoragePathData","filename","safeFilename","storageFilePath","fileKey","sanitizedFilename","buildStoragePathData"],"mappings":"AAAA,OAAOA,UAAU,OAAM;AACvB,SAASC,gBAAgB,QAAQ,iBAAgB;AAEjD,SAASC,cAAc,QAAQ,sBAAqB;AAyBpD,OAAO,SAASC,oCAAoC,EAClDC,gBAAgB,EAChBC,SAAS,EAIV;IACC,MAAMC,uBAAuBJ,eAAeE,oBAAoB;IAEhE,OACE,CAACE,wBACDD,cAAcC,wBACdD,UAAUE,UAAU,CAAC,GAAGD,qBAAqB,CAAC,CAAC;AAEnD;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASE,kBAAkB,EAChCJ,gBAAgB,EAChBC,SAAS,EACTI,uBAAuB,KAAK,EACY;IAKxC,MAAMH,uBAAuBJ,eAAeE,oBAAoB;IAChE,MAAMM,gBAAgBR,eAAeG,aAAa;IAClD,MAAMM,eACJD,iBACA,CAACP,oCAAoC;QACnCC,kBAAkBE;QAClBD,WAAWK;IACb,KACIV,KAAKY,KAAK,CAACC,IAAI,CAACP,sBAAsBI,iBACtCA,iBAAiBJ;IAEvB,OAAO;QACLQ,2BAA2BR;QAC3BS,oBAAoB,CAACN,wBAAwBC,gBAAgBC,eAAeD;QAC5EC;IACF;AACF;AAEA;;;CAGC,GACD,OAAO,SAASK,2BAA2B,EACzCZ,gBAAgB,EAChBC,SAAS,EACTY,QAAQ,EACRR,uBAAuB,KAAK,EACN;IACtB,MAAM,EAAEK,yBAAyB,EAAEC,kBAAkB,EAAEJ,YAAY,EAAE,GAAGH,kBAAkB;QACxFJ;QACAC;QACAI;IACF;IACA,MAAMS,eAAejB,iBAAiBgB;IAEtC,MAAME,kBAAkBV,uBACpBT,KAAKY,KAAK,CAACC,IAAI,CAACC,2BAA2BC,oBAAoBG,gBAC/DlB,KAAKY,KAAK,CAACC,IAAI,CAACF,cAAcO;IAElC,OAAO;QACLE,SAASD;QACTL;QACAC;QACAM,mBAAmBH;QACnBC;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASG,qBAAqB,EACnClB,gBAAgB,EAChBC,SAAS,EACTY,QAAQ,EACRR,uBAAuB,KAAK,EACN;IACtB,MAAMK,4BAA4BZ,eAAeE,oBAAoB;IACrE,MAAMW,qBAAqBb,eAAeG,aAAa;IACvD,MAAMgB,oBAAoBpB,iBAAiBgB;IAC3C,MAAME,kBAAkBV,uBACpBT,KAAKY,KAAK,CAACC,IAAI,CAACC,2BAA2BC,oBAAoBM,qBAC/DrB,KAAKY,KAAK,CAACC,IAAI,CAACE,sBAAsBD,2BAA2BO;IAErE,OAAO;QACLD,SAASD;QACTL;QACAC;QACAM;QACAF;IACF;AACF"}

package/dist/utilities/buildStoragePathData.spec.js

@@ -0,0 +1,254 @@
+import { buildStoragePathData, buildUploadStoragePathData, isStoragePathWithinCollectionPrefix } from './buildStoragePathData.js';
+import { describe, expect, it } from 'vitest';
+describe('buildStoragePathData', ()=>{
+    describe('non-composite mode (useCompositePrefixes: false)', ()=>{
+        it('should preserve the key of a legacy document outside the collection prefix', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: 'media/',
+                docPrefix: 'media-archive',
+                filename: 'test.png',
+                useCompositePrefixes: false
+            });
+            expect(result).toEqual({
+                fileKey: 'media-archive/test.png',
+                sanitizedCollectionPrefix: 'media',
+                sanitizedDocPrefix: 'media-archive',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'media-archive/test.png'
+            });
+        });
+        it('should fallback to collectionPrefix when docPrefix is empty', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: 'collection',
+                docPrefix: '',
+                filename: 'test.png',
+                useCompositePrefixes: false
+            });
+            expect(result).toEqual({
+                fileKey: 'collection/test.png',
+                sanitizedCollectionPrefix: 'collection',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'collection/test.png'
+            });
+        });
+        it('should fallback to collectionPrefix when docPrefix is undefined', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: 'collection',
+                filename: 'test.png',
+                useCompositePrefixes: false
+            });
+            expect(result).toEqual({
+                fileKey: 'collection/test.png',
+                sanitizedCollectionPrefix: 'collection',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'collection/test.png'
+            });
+        });
+        it('should return only filename when both prefixes are empty', ()=>{
+            const result = buildStoragePathData({
+                filename: 'test.png',
+                useCompositePrefixes: false
+            });
+            expect(result).toEqual({
+                fileKey: 'test.png',
+                sanitizedCollectionPrefix: '',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'test.png'
+            });
+        });
+    });
+    describe('composite mode (useCompositePrefixes: true)', ()=>{
+        it('should combine collectionPrefix and docPrefix', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: 'collection',
+                docPrefix: 'document',
+                filename: 'test.png',
+                useCompositePrefixes: true
+            });
+            expect(result).toEqual({
+                fileKey: 'collection/document/test.png',
+                sanitizedCollectionPrefix: 'collection',
+                sanitizedDocPrefix: 'document',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'collection/document/test.png'
+            });
+        });
+        it('should work with only collectionPrefix', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: 'collection',
+                filename: 'test.png',
+                useCompositePrefixes: true
+            });
+            expect(result).toEqual({
+                fileKey: 'collection/test.png',
+                sanitizedCollectionPrefix: 'collection',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'collection/test.png'
+            });
+        });
+        it('should work with only docPrefix', ()=>{
+            const result = buildStoragePathData({
+                docPrefix: 'document',
+                filename: 'test.png',
+                useCompositePrefixes: true
+            });
+            expect(result).toEqual({
+                fileKey: 'document/test.png',
+                sanitizedCollectionPrefix: '',
+                sanitizedDocPrefix: 'document',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'document/test.png'
+            });
+        });
+        it('should return only filename when both prefixes are empty', ()=>{
+            const result = buildStoragePathData({
+                filename: 'test.png',
+                useCompositePrefixes: true
+            });
+            expect(result).toEqual({
+                fileKey: 'test.png',
+                sanitizedCollectionPrefix: '',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'test.png'
+            });
+        });
+    });
+    describe('collection prefix boundaries', ()=>{
+        it('should accept a file key within a slash-terminated collection prefix', ()=>{
+            expect(isStoragePathWithinCollectionPrefix({
+                collectionPrefix: 'media/',
+                docPrefix: 'media/documents/test.png'
+            })).toBe(true);
+        });
+    });
+    describe('sanitization', ()=>{
+        it.each([
+            './media/./images',
+            'media\\images',
+            '/media//images'
+        ])('should canonicalize equivalent prefix paths', (docPrefix)=>{
+            const result = buildStoragePathData({
+                docPrefix,
+                filename: 'test.png'
+            });
+            expect(result).toEqual({
+                fileKey: 'media/images/test.png',
+                sanitizedCollectionPrefix: '',
+                sanitizedDocPrefix: 'media/images',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'media/images/test.png'
+            });
+        });
+        it('should remove path traversal segments from collectionPrefix', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: '../../../etc',
+                filename: 'test.png',
+                useCompositePrefixes: false
+            });
+            expect(result).toEqual({
+                fileKey: 'etc/test.png',
+                sanitizedCollectionPrefix: 'etc',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'etc/test.png'
+            });
+            expect(result.fileKey).not.toContain('..');
+        });
+        it('should remove path traversal segments from docPrefix', ()=>{
+            const result = buildStoragePathData({
+                docPrefix: 'a/../../outside',
+                filename: 'test.png',
+                useCompositePrefixes: false
+            });
+            expect(result).toEqual({
+                fileKey: 'a/outside/test.png',
+                sanitizedCollectionPrefix: '',
+                sanitizedDocPrefix: 'a/outside',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'a/outside/test.png'
+            });
+            expect(result.fileKey).not.toContain('..');
+        });
+        it('should remove control characters from prefixes', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: 'test\x00\x1fprefix',
+                filename: 'test.png',
+                useCompositePrefixes: false
+            });
+            expect(result).toEqual({
+                fileKey: 'testprefix/test.png',
+                sanitizedCollectionPrefix: 'testprefix',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'testprefix/test.png'
+            });
+            expect(result.fileKey).not.toMatch(/[\x00-\x1f]/);
+        });
+        it('should normalize both prefixes after removing control characters in composite mode', ()=>{
+            const result = buildStoragePathData({
+                collectionPrefix: '.\x00./collection',
+                docPrefix: '.\x00./doc',
+                filename: 'test.png',
+                useCompositePrefixes: true
+            });
+            expect(result).toEqual({
+                fileKey: 'collection/doc/test.png',
+                sanitizedCollectionPrefix: 'collection',
+                sanitizedDocPrefix: 'doc',
+                sanitizedFilename: 'test.png',
+                storageFilePath: 'collection/doc/test.png'
+            });
+            expect(result.fileKey).not.toContain('..');
+        });
+    });
+});
+describe('buildUploadStoragePathData', ()=>{
+    it.each([
+        [
+            'invoices',
+            false,
+            'media/invoices/file.png',
+            'media/invoices'
+        ],
+        [
+            'media/invoices',
+            false,
+            'media/invoices/file.png',
+            'media/invoices'
+        ],
+        [
+            '',
+            false,
+            'media/file.png',
+            ''
+        ],
+        [
+            'invoices',
+            true,
+            'media/invoices/file.png',
+            'invoices'
+        ]
+    ])('should persist a readable destination for %s (composite %s)', (docPrefix, useCompositePrefixes, fileKey, storedPrefix)=>{
+        const result = buildUploadStoragePathData({
+            collectionPrefix: 'media',
+            docPrefix,
+            filename: 'file.png',
+            useCompositePrefixes
+        });
+        expect(result.storageFilePath).toBe(fileKey);
+        expect(result.sanitizedDocPrefix).toBe(storedPrefix);
+        expect(buildStoragePathData({
+            collectionPrefix: 'media',
+            docPrefix: result.sanitizedDocPrefix,
+            filename: 'file.png',
+            useCompositePrefixes
+        }).fileKey).toBe(fileKey);
+    });
+});
+
+//# sourceMappingURL=buildStoragePathData.spec.js.map