@payloadcms/plugin-cloud-storage 3.89.0 → 3.90.0

package/dist/utilities/resolveSignedURLKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveSignedURLKey.d.ts","sourceRoot":"","sources":["../../src/utilities/resolveSignedURLKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAM7C,KAAK,IAAI,GAAG;IACV,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,gBAAqB,EACrB,cAAc,EACd,SAAS,EACT,QAAQ,EACR,GAAG,EACH,oBAA4B,GAC7B,EAAE,IAAI;;;;GAgBN"}
+{"version":3,"file":"resolveSignedURLKey.d.ts","sourceRoot":"","sources":["../../src/utilities/resolveSignedURLKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAM7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,KAAK,IAAI,GAAG;IACV,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,gBAAqB,EACrB,cAAc,EACd,SAAS,EACT,QAAQ,EACR,GAAG,EACH,oBAA4B,GAC7B,EAAE,IAAI;;;;;;;GAiDN"}

package/dist/utilities/resolveSignedURLKey.js

@@ -1,29 +1,64 @@
-import { getSafeFileName } from 'payload/internal';
-import { getFileKey } from './getFileKey.js';
+import { randomUUID } from 'crypto';
+import { createClientUploadReceipt, getSafeFileName } from 'payload/internal';
+import { getSanitizedUploadFilename } from 'payload/shared';
+import { buildUploadPrefix, buildUploadStoragePathData } from './buildStoragePathData.js';
 /**
  * Resolves the storage key for a clientUploads signed-URL request, deduping
  * the filename via {@link getSafeFileName} so a duplicate upload does not
  * overwrite an existing blob.
  *
+ * A per-upload segment is persisted in `_objectKey` (not `prefix`), so the stored `prefix`
+ * and `filename` stay clean.
+ *
  * The resolved `sanitizedFilename` is returned so the browser-side handler
  * can update the form via `updateFilename`.
+ *
+ * The semantic prefix is resolved with {@link buildUploadPrefix} and the final key with
+ * {@link buildUploadStoragePathData}, so the receipt only ever signs a key beneath the configured
+ * collection prefix.
  */ export async function resolveSignedURLKey({ collectionPrefix = '', collectionSlug, docPrefix, filename, req, useCompositePrefixes = false }) {
+    // Sanitize with the same helper generateFileData uses for the DB filename so the storage key
+    // and doc.filename stay in sync (#16694).
     const sanitizedFilename = await getSafeFileName({
         collectionSlug,
-        desiredFilename: filename,
-        prefix: docPrefix,
+        desiredFilename: getSanitizedUploadFilename(filename),
         req
     });
-    const { fileKey, sanitizedDocPrefix } = getFileKey({
+    const rawBaseDocPrefix = useCompositePrefixes ? docPrefix : docPrefix || collectionPrefix;
+    const { sanitizedDocPrefix } = buildUploadPrefix({
         collectionPrefix,
-        docPrefix,
+        docPrefix: rawBaseDocPrefix,
+        useCompositePrefixes
+    });
+    const _objectKey = randomUUID();
+    // Persisted in `_objectKey`, keeping `prefix` semantic.
+    const keyedDocPrefix = sanitizedDocPrefix ? `${sanitizedDocPrefix}/${_objectKey}` : _objectKey;
+    const { storageFilePath } = buildUploadStoragePathData({
+        collectionPrefix,
+        docPrefix: keyedDocPrefix,
         filename: sanitizedFilename,
         useCompositePrefixes
     });
+    const context = {
+        _objectKey,
+        prefix: sanitizedDocPrefix
+    };
+    const clientUploadContext = {
+        ...context,
+        signedReceipt: createClientUploadReceipt({
+            collectionSlug,
+            context,
+            filename: sanitizedFilename,
+            req
+        })
+    };
     return {
-        fileKey,
+        _objectKey,
+        clientUploadContext,
+        fileKey: storageFilePath,
         sanitizedDocPrefix,
-        sanitizedFilename
+        sanitizedFilename,
+        storageFilePath
     };
 }
 

package/dist/utilities/resolveSignedURLKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/resolveSignedURLKey.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { getSafeFileName } from 'payload/internal'\n\nimport { getFileKey } from './getFileKey.js'\n\ntype Args = {\n  collectionPrefix?: string\n  collectionSlug: string\n  docPrefix?: string\n  filename: string\n  req: PayloadRequest\n  useCompositePrefixes?: boolean\n}\n\n/**\n * Resolves the storage key for a clientUploads signed-URL request, deduping\n * the filename via {@link getSafeFileName} so a duplicate upload does not\n * overwrite an existing blob.\n *\n * The resolved `sanitizedFilename` is returned so the browser-side handler\n * can update the form via `updateFilename`.\n */\nexport async function resolveSignedURLKey({\n  collectionPrefix = '',\n  collectionSlug,\n  docPrefix,\n  filename,\n  req,\n  useCompositePrefixes = false,\n}: Args) {\n  const sanitizedFilename = await getSafeFileName({\n    collectionSlug,\n    desiredFilename: filename,\n    prefix: docPrefix,\n    req,\n  })\n\n  const { fileKey, sanitizedDocPrefix } = getFileKey({\n    collectionPrefix,\n    docPrefix,\n    filename: sanitizedFilename,\n    useCompositePrefixes,\n  })\n\n  return { fileKey, sanitizedDocPrefix, sanitizedFilename }\n}\n"],"names":["getSafeFileName","getFileKey","resolveSignedURLKey","collectionPrefix","collectionSlug","docPrefix","filename","req","useCompositePrefixes","sanitizedFilename","desiredFilename","prefix","fileKey","sanitizedDocPrefix"],"mappings":"AAEA,SAASA,eAAe,QAAQ,mBAAkB;AAElD,SAASC,UAAU,QAAQ,kBAAiB;AAW5C;;;;;;;CAOC,GACD,OAAO,eAAeC,oBAAoB,EACxCC,mBAAmB,EAAE,EACrBC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,GAAG,EACHC,uBAAuB,KAAK,EACvB;IACL,MAAMC,oBAAoB,MAAMT,gBAAgB;QAC9CI;QACAM,iBAAiBJ;QACjBK,QAAQN;QACRE;IACF;IAEA,MAAM,EAAEK,OAAO,EAAEC,kBAAkB,EAAE,GAAGZ,WAAW;QACjDE;QACAE;QACAC,UAAUG;QACVD;IACF;IAEA,OAAO;QAAEI;QAASC;QAAoBJ;IAAkB;AAC1D"}
+{"version":3,"sources":["../../src/utilities/resolveSignedURLKey.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { randomUUID } from 'crypto'\nimport { createClientUploadReceipt, getSafeFileName } from 'payload/internal'\nimport { getSanitizedUploadFilename } from 'payload/shared'\n\nimport type { ClientUploadContext } from '../types.js'\n\nimport { buildUploadPrefix, buildUploadStoragePathData } from './buildStoragePathData.js'\n\ntype Args = {\n  collectionPrefix?: string\n  collectionSlug: string\n  docPrefix?: string\n  filename: string\n  req: PayloadRequest\n  useCompositePrefixes?: boolean\n}\n\n/**\n * Resolves the storage key for a clientUploads signed-URL request, deduping\n * the filename via {@link getSafeFileName} so a duplicate upload does not\n * overwrite an existing blob.\n *\n * A per-upload segment is persisted in `_objectKey` (not `prefix`), so the stored `prefix`\n * and `filename` stay clean.\n *\n * The resolved `sanitizedFilename` is returned so the browser-side handler\n * can update the form via `updateFilename`.\n *\n * The semantic prefix is resolved with {@link buildUploadPrefix} and the final key with\n * {@link buildUploadStoragePathData}, so the receipt only ever signs a key beneath the configured\n * collection prefix.\n */\nexport async function resolveSignedURLKey({\n  collectionPrefix = '',\n  collectionSlug,\n  docPrefix,\n  filename,\n  req,\n  useCompositePrefixes = false,\n}: Args) {\n  // Sanitize with the same helper generateFileData uses for the DB filename so the storage key\n  // and doc.filename stay in sync (#16694).\n  const sanitizedFilename = await getSafeFileName({\n    collectionSlug,\n    desiredFilename: getSanitizedUploadFilename(filename),\n    req,\n  })\n\n  const rawBaseDocPrefix = useCompositePrefixes ? docPrefix : docPrefix || collectionPrefix\n  const { sanitizedDocPrefix } = buildUploadPrefix({\n    collectionPrefix,\n    docPrefix: rawBaseDocPrefix,\n    useCompositePrefixes,\n  })\n\n  const _objectKey = randomUUID()\n  // Persisted in `_objectKey`, keeping `prefix` semantic.\n  const keyedDocPrefix = sanitizedDocPrefix ? `${sanitizedDocPrefix}/${_objectKey}` : _objectKey\n\n  const { storageFilePath } = buildUploadStoragePathData({\n    collectionPrefix,\n    docPrefix: keyedDocPrefix,\n    filename: sanitizedFilename,\n    useCompositePrefixes,\n  })\n\n  const context = {\n    _objectKey,\n    prefix: sanitizedDocPrefix,\n  }\n  const clientUploadContext: ClientUploadContext = {\n    ...context,\n    signedReceipt: createClientUploadReceipt({\n      collectionSlug,\n      context,\n      filename: sanitizedFilename,\n      req,\n    }),\n  }\n\n  return {\n    _objectKey,\n    clientUploadContext,\n    fileKey: storageFilePath,\n    sanitizedDocPrefix,\n    sanitizedFilename,\n    storageFilePath,\n  }\n}\n"],"names":["randomUUID","createClientUploadReceipt","getSafeFileName","getSanitizedUploadFilename","buildUploadPrefix","buildUploadStoragePathData","resolveSignedURLKey","collectionPrefix","collectionSlug","docPrefix","filename","req","useCompositePrefixes","sanitizedFilename","desiredFilename","rawBaseDocPrefix","sanitizedDocPrefix","_objectKey","keyedDocPrefix","storageFilePath","context","prefix","clientUploadContext","signedReceipt","fileKey"],"mappings":"AAEA,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,yBAAyB,EAAEC,eAAe,QAAQ,mBAAkB;AAC7E,SAASC,0BAA0B,QAAQ,iBAAgB;AAI3D,SAASC,iBAAiB,EAAEC,0BAA0B,QAAQ,4BAA2B;AAWzF;;;;;;;;;;;;;;CAcC,GACD,OAAO,eAAeC,oBAAoB,EACxCC,mBAAmB,EAAE,EACrBC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,GAAG,EACHC,uBAAuB,KAAK,EACvB;IACL,6FAA6F;IAC7F,0CAA0C;IAC1C,MAAMC,oBAAoB,MAAMX,gBAAgB;QAC9CM;QACAM,iBAAiBX,2BAA2BO;QAC5CC;IACF;IAEA,MAAMI,mBAAmBH,uBAAuBH,YAAYA,aAAaF;IACzE,MAAM,EAAES,kBAAkB,EAAE,GAAGZ,kBAAkB;QAC/CG;QACAE,WAAWM;QACXH;IACF;IAEA,MAAMK,aAAajB;IACnB,wDAAwD;IACxD,MAAMkB,iBAAiBF,qBAAqB,GAAGA,mBAAmB,CAAC,EAAEC,YAAY,GAAGA;IAEpF,MAAM,EAAEE,eAAe,EAAE,GAAGd,2BAA2B;QACrDE;QACAE,WAAWS;QACXR,UAAUG;QACVD;IACF;IAEA,MAAMQ,UAAU;QACdH;QACAI,QAAQL;IACV;IACA,MAAMM,sBAA2C;QAC/C,GAAGF,OAAO;QACVG,eAAetB,0BAA0B;YACvCO;YACAY;YACAV,UAAUG;YACVF;QACF;IACF;IAEA,OAAO;QACLM;QACAK;QACAE,SAASL;QACTH;QACAH;QACAM;IACF;AACF"}

package/dist/utilities/resolveSignedURLKey.spec.js

@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { createClientUploadReceipt, getSafeFileName } from 'payload/internal';
+import { resolveSignedURLKey } from './resolveSignedURLKey.js';
+vi.mock('payload/internal', ()=>({
+        createClientUploadReceipt: vi.fn(()=>'receipt'),
+        getSafeFileName: vi.fn()
+    }));
+describe('resolveSignedURLKey', ()=>{
+    beforeEach(()=>{
+        vi.clearAllMocks();
+    });
+    it('should deduplicate within the resolved document prefix', async ()=>{
+        vi.mocked(getSafeFileName).mockImplementation(async ({ desiredFilename })=>{
+            expect(desiredFilename).toBe('photo.jpg');
+            return 'photo-1.jpg';
+        });
+        const result = await resolveSignedURLKey({
+            collectionPrefix: 'media',
+            collectionSlug: 'media',
+            docPrefix: 'media-archive',
+            filename: 'photo.jpg',
+            req: {}
+        });
+        expect(result.sanitizedDocPrefix).toBe('media/media-archive');
+        expect(result.fileKey).toMatch(/^media\/media-archive\/[0-9a-f-]+\/photo-1\.jpg$/);
+        expect(result.sanitizedFilename).toBe('photo-1.jpg');
+        expect(result._objectKey).toMatch(/^[0-9a-f-]+$/);
+        expect(result.clientUploadContext).toMatchObject({
+            _objectKey: result._objectKey,
+            prefix: 'media/media-archive',
+            signedReceipt: 'receipt'
+        });
+    });
+    it('should mint the receipt for a prefix contained by the collection prefix', async ()=>{
+        vi.mocked(getSafeFileName).mockResolvedValue('photo-1.jpg');
+        const { _objectKey, sanitizedDocPrefix } = await resolveSignedURLKey({
+            collectionPrefix: 'media',
+            collectionSlug: 'media',
+            docPrefix: 'media-archive',
+            filename: 'photo.jpg',
+            req: {}
+        });
+        expect(sanitizedDocPrefix).toBe('media/media-archive');
+        expect(createClientUploadReceipt).toHaveBeenCalledWith({
+            collectionSlug: 'media',
+            context: {
+                _objectKey,
+                prefix: sanitizedDocPrefix
+            },
+            filename: 'photo-1.jpg',
+            req: {}
+        });
+    });
+});
+
+//# sourceMappingURL=resolveSignedURLKey.spec.js.map

package/dist/utilities/resolveSignedURLKey.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/resolveSignedURLKey.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport { createClientUploadReceipt, getSafeFileName } from 'payload/internal'\n\nimport { resolveSignedURLKey } from './resolveSignedURLKey.js'\n\nvi.mock('payload/internal', () => ({\n  createClientUploadReceipt: vi.fn(() => 'receipt'),\n  getSafeFileName: vi.fn(),\n}))\n\ndescribe('resolveSignedURLKey', () => {\n  beforeEach(() => {\n    vi.clearAllMocks()\n  })\n\n  it('should deduplicate within the resolved document prefix', async () => {\n    vi.mocked(getSafeFileName).mockImplementation(async ({ desiredFilename }) => {\n      expect(desiredFilename).toBe('photo.jpg')\n      return 'photo-1.jpg'\n    })\n\n    const result = await resolveSignedURLKey({\n      collectionPrefix: 'media',\n      collectionSlug: 'media',\n      docPrefix: 'media-archive',\n      filename: 'photo.jpg',\n      req: {} as PayloadRequest,\n    })\n\n    expect(result.sanitizedDocPrefix).toBe('media/media-archive')\n    expect(result.fileKey).toMatch(/^media\\/media-archive\\/[0-9a-f-]+\\/photo-1\\.jpg$/)\n    expect(result.sanitizedFilename).toBe('photo-1.jpg')\n    expect(result._objectKey).toMatch(/^[0-9a-f-]+$/)\n    expect(result.clientUploadContext).toMatchObject({\n      _objectKey: result._objectKey,\n      prefix: 'media/media-archive',\n      signedReceipt: 'receipt',\n    })\n  })\n\n  it('should mint the receipt for a prefix contained by the collection prefix', async () => {\n    vi.mocked(getSafeFileName).mockResolvedValue('photo-1.jpg')\n\n    const { _objectKey, sanitizedDocPrefix } = await resolveSignedURLKey({\n      collectionPrefix: 'media',\n      collectionSlug: 'media',\n      docPrefix: 'media-archive',\n      filename: 'photo.jpg',\n      req: {} as PayloadRequest,\n    })\n\n    expect(sanitizedDocPrefix).toBe('media/media-archive')\n    expect(createClientUploadReceipt).toHaveBeenCalledWith({\n      collectionSlug: 'media',\n      context: { _objectKey, prefix: sanitizedDocPrefix },\n      filename: 'photo-1.jpg',\n      req: {},\n    })\n  })\n})\n"],"names":["beforeEach","describe","expect","it","vi","createClientUploadReceipt","getSafeFileName","resolveSignedURLKey","mock","fn","clearAllMocks","mocked","mockImplementation","desiredFilename","toBe","result","collectionPrefix","collectionSlug","docPrefix","filename","req","sanitizedDocPrefix","fileKey","toMatch","sanitizedFilename","_objectKey","clientUploadContext","toMatchObject","prefix","signedReceipt","mockResolvedValue","toHaveBeenCalledWith","context"],"mappings":"AAEA,SAASA,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE7D,SAASC,yBAAyB,EAAEC,eAAe,QAAQ,mBAAkB;AAE7E,SAASC,mBAAmB,QAAQ,2BAA0B;AAE9DH,GAAGI,IAAI,CAAC,oBAAoB,IAAO,CAAA;QACjCH,2BAA2BD,GAAGK,EAAE,CAAC,IAAM;QACvCH,iBAAiBF,GAAGK,EAAE;IACxB,CAAA;AAEAR,SAAS,uBAAuB;IAC9BD,WAAW;QACTI,GAAGM,aAAa;IAClB;IAEAP,GAAG,0DAA0D;QAC3DC,GAAGO,MAAM,CAACL,iBAAiBM,kBAAkB,CAAC,OAAO,EAAEC,eAAe,EAAE;YACtEX,OAAOW,iBAAiBC,IAAI,CAAC;YAC7B,OAAO;QACT;QAEA,MAAMC,SAAS,MAAMR,oBAAoB;YACvCS,kBAAkB;YAClBC,gBAAgB;YAChBC,WAAW;YACXC,UAAU;YACVC,KAAK,CAAC;QACR;QAEAlB,OAAOa,OAAOM,kBAAkB,EAAEP,IAAI,CAAC;QACvCZ,OAAOa,OAAOO,OAAO,EAAEC,OAAO,CAAC;QAC/BrB,OAAOa,OAAOS,iBAAiB,EAAEV,IAAI,CAAC;QACtCZ,OAAOa,OAAOU,UAAU,EAAEF,OAAO,CAAC;QAClCrB,OAAOa,OAAOW,mBAAmB,EAAEC,aAAa,CAAC;YAC/CF,YAAYV,OAAOU,UAAU;YAC7BG,QAAQ;YACRC,eAAe;QACjB;IACF;IAEA1B,GAAG,2EAA2E;QAC5EC,GAAGO,MAAM,CAACL,iBAAiBwB,iBAAiB,CAAC;QAE7C,MAAM,EAAEL,UAAU,EAAEJ,kBAAkB,EAAE,GAAG,MAAMd,oBAAoB;YACnES,kBAAkB;YAClBC,gBAAgB;YAChBC,WAAW;YACXC,UAAU;YACVC,KAAK,CAAC;QACR;QAEAlB,OAAOmB,oBAAoBP,IAAI,CAAC;QAChCZ,OAAOG,2BAA2B0B,oBAAoB,CAAC;YACrDd,gBAAgB;YAChBe,SAAS;gBAAEP;gBAAYG,QAAQP;YAAmB;YAClDF,UAAU;YACVC,KAAK,CAAC;QACR;IACF;AACF"}

package/dist/utilities/sanitizePrefix.d.ts

@@ -3,8 +3,8 @@
  *
  * Decodes URI components once (so query-style `%2F` becomes `/`), rejects
  * values that still contain percent-encodings after decoding (e.g. `%252f`),
- * then normalizes slashes, drops `.` / `..` segments, strips leading slashes,
- * and removes control characters.
+ * then removes control characters, normalizes slashes, drops `.` / `..` segments,
+ * and strips leading slashes.
  */
 export declare function sanitizePrefix(prefix: string): string;
 //# sourceMappingURL=sanitizePrefix.d.ts.map

package/dist/utilities/sanitizePrefix.js

@@ -3,8 +3,8 @@
  *
  * Decodes URI components once (so query-style `%2F` becomes `/`), rejects
  * values that still contain percent-encodings after decoding (e.g. `%252f`),
- * then normalizes slashes, drops `.` / `..` segments, strips leading slashes,
- * and removes control characters.
+ * then removes control characters, normalizes slashes, drops `.` / `..` segments,
+ * and strips leading slashes.
  */ export function sanitizePrefix(prefix) {
     let decodedPrefix;
     try {
@@ -16,8 +16,8 @@
     if (/%[0-9a-f]{2}/i.test(decodedPrefix)) {
         return '';
     }
-    return decodedPrefix.replace(/\\/g, '/').split('/').filter((segment)=>segment !== '..' && segment !== '.').join('/').replace(/^\/+/, '')// eslint-disable-next-line no-control-regex
-    .replace(/[\x00-\x1f\x80-\x9f]/g, '');
+    return decodedPrefix// eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x1f\x80-\x9f]/g, '').replace(/\\/g, '/').split('/').filter((segment)=>segment && segment !== '..' && segment !== '.').join('/').replace(/^\/+/, '');
 }
 
 //# sourceMappingURL=sanitizePrefix.js.map

package/dist/utilities/sanitizePrefix.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/sanitizePrefix.ts"],"sourcesContent":["/**\n * Normalizes a storage prefix for use in object keys and URLs.\n *\n * Decodes URI components once (so query-style `%2F` becomes `/`), rejects\n * values that still contain percent-encodings after decoding (e.g. `%252f`),\n * then normalizes slashes, drops `.` / `..` segments, strips leading slashes,\n * and removes control characters.\n */\nexport function sanitizePrefix(prefix: string): string {\n  let decodedPrefix: string\n\n  try {\n    decodedPrefix = decodeURIComponent(prefix)\n  } catch {\n    return ''\n  }\n\n  // Reject multi-encoded values (e.g. `%252f`) by allowing only a single decode pass.\n  if (/%[0-9a-f]{2}/i.test(decodedPrefix)) {\n    return ''\n  }\n\n  return (\n    decodedPrefix\n      .replace(/\\\\/g, '/')\n      .split('/')\n      .filter((segment) => segment !== '..' && segment !== '.')\n      .join('/')\n      .replace(/^\\/+/, '')\n      // eslint-disable-next-line no-control-regex\n      .replace(/[\\x00-\\x1f\\x80-\\x9f]/g, '')\n  )\n}\n"],"names":["sanitizePrefix","prefix","decodedPrefix","decodeURIComponent","test","replace","split","filter","segment","join"],"mappings":"AAAA;;;;;;;CAOC,GACD,OAAO,SAASA,eAAeC,MAAc;IAC3C,IAAIC;IAEJ,IAAI;QACFA,gBAAgBC,mBAAmBF;IACrC,EAAE,OAAM;QACN,OAAO;IACT;IAEA,oFAAoF;IACpF,IAAI,gBAAgBG,IAAI,CAACF,gBAAgB;QACvC,OAAO;IACT;IAEA,OACEA,cACGG,OAAO,CAAC,OAAO,KACfC,KAAK,CAAC,KACNC,MAAM,CAAC,CAACC,UAAYA,YAAY,QAAQA,YAAY,KACpDC,IAAI,CAAC,KACLJ,OAAO,CAAC,QAAQ,GACjB,4CAA4C;KAC3CA,OAAO,CAAC,yBAAyB;AAExC"}
+{"version":3,"sources":["../../src/utilities/sanitizePrefix.ts"],"sourcesContent":["/**\n * Normalizes a storage prefix for use in object keys and URLs.\n *\n * Decodes URI components once (so query-style `%2F` becomes `/`), rejects\n * values that still contain percent-encodings after decoding (e.g. `%252f`),\n * then removes control characters, normalizes slashes, drops `.` / `..` segments,\n * and strips leading slashes.\n */\nexport function sanitizePrefix(prefix: string): string {\n  let decodedPrefix: string\n\n  try {\n    decodedPrefix = decodeURIComponent(prefix)\n  } catch {\n    return ''\n  }\n\n  // Reject multi-encoded values (e.g. `%252f`) by allowing only a single decode pass.\n  if (/%[0-9a-f]{2}/i.test(decodedPrefix)) {\n    return ''\n  }\n\n  return (\n    decodedPrefix\n      // eslint-disable-next-line no-control-regex\n      .replace(/[\\x00-\\x1f\\x80-\\x9f]/g, '')\n      .replace(/\\\\/g, '/')\n      .split('/')\n      .filter((segment) => segment && segment !== '..' && segment !== '.')\n      .join('/')\n      .replace(/^\\/+/, '')\n  )\n}\n"],"names":["sanitizePrefix","prefix","decodedPrefix","decodeURIComponent","test","replace","split","filter","segment","join"],"mappings":"AAAA;;;;;;;CAOC,GACD,OAAO,SAASA,eAAeC,MAAc;IAC3C,IAAIC;IAEJ,IAAI;QACFA,gBAAgBC,mBAAmBF;IACrC,EAAE,OAAM;QACN,OAAO;IACT;IAEA,oFAAoF;IACpF,IAAI,gBAAgBG,IAAI,CAACF,gBAAgB;QACvC,OAAO;IACT;IAEA,OACEA,aACE,4CAA4C;KAC3CG,OAAO,CAAC,yBAAyB,IACjCA,OAAO,CAAC,OAAO,KACfC,KAAK,CAAC,KACNC,MAAM,CAAC,CAACC,UAAYA,WAAWA,YAAY,QAAQA,YAAY,KAC/DC,IAAI,CAAC,KACLJ,OAAO,CAAC,QAAQ;AAEvB"}

package/dist/utilities/verifyClientUploadReceiptForFileKey.d.ts

@@ -0,0 +1,20 @@
+import type { PayloadRequest } from 'payload';
+import type { ClientUploadReceipt } from 'payload/internal';
+type Args = {
+    collectionPrefix?: string;
+    collectionSlug: string;
+    expectedFileKey: string;
+    req: PayloadRequest;
+    signedReceipt: string;
+    useCompositePrefixes?: boolean;
+};
+/**
+ * Authenticates a client-upload receipt and asserts it authorizes writing to
+ * `expectedFileKey`, returning the verified receipt. Combines
+ * {@link verifyClientUploadReceipt} (authentication + collection binding) with
+ * {@link assertReceiptMatchesFileKey} (storage-key binding) so an adapter binds
+ * the receipt to its request in a single call.
+ */
+export declare function verifyClientUploadReceiptForFileKey({ collectionPrefix, collectionSlug, expectedFileKey, req, signedReceipt, useCompositePrefixes, }: Args): ClientUploadReceipt;
+export {};
+//# sourceMappingURL=verifyClientUploadReceiptForFileKey.d.ts.map

package/dist/utilities/verifyClientUploadReceiptForFileKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyClientUploadReceiptForFileKey.d.ts","sourceRoot":"","sources":["../../src/utilities/verifyClientUploadReceiptForFileKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAM3D,KAAK,IAAI,GAAG;IACV,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,EAClD,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,GAAG,EACH,aAAa,EACb,oBAAoB,GACrB,EAAE,IAAI,GAAG,mBAAmB,CAM5B"}

package/dist/utilities/verifyClientUploadReceiptForFileKey.js

@@ -0,0 +1,24 @@
+import { verifyClientUploadReceipt } from 'payload/internal';
+import { assertReceiptMatchesFileKey } from './assertReceiptMatchesFileKey.js';
+/**
+ * Authenticates a client-upload receipt and asserts it authorizes writing to
+ * `expectedFileKey`, returning the verified receipt. Combines
+ * {@link verifyClientUploadReceipt} (authentication + collection binding) with
+ * {@link assertReceiptMatchesFileKey} (storage-key binding) so an adapter binds
+ * the receipt to its request in a single call.
+ */ export function verifyClientUploadReceiptForFileKey({ collectionPrefix, collectionSlug, expectedFileKey, req, signedReceipt, useCompositePrefixes }) {
+    const receipt = verifyClientUploadReceipt({
+        collectionSlug,
+        req,
+        signedReceipt
+    });
+    assertReceiptMatchesFileKey({
+        collectionPrefix,
+        expectedFileKey,
+        receipt,
+        useCompositePrefixes
+    });
+    return receipt;
+}
+
+//# sourceMappingURL=verifyClientUploadReceiptForFileKey.js.map

package/dist/utilities/verifyClientUploadReceiptForFileKey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/verifyClientUploadReceiptForFileKey.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\nimport type { ClientUploadReceipt } from 'payload/internal'\n\nimport { verifyClientUploadReceipt } from 'payload/internal'\n\nimport { assertReceiptMatchesFileKey } from './assertReceiptMatchesFileKey.js'\n\ntype Args = {\n  collectionPrefix?: string\n  collectionSlug: string\n  expectedFileKey: string\n  req: PayloadRequest\n  signedReceipt: string\n  useCompositePrefixes?: boolean\n}\n\n/**\n * Authenticates a client-upload receipt and asserts it authorizes writing to\n * `expectedFileKey`, returning the verified receipt. Combines\n * {@link verifyClientUploadReceipt} (authentication + collection binding) with\n * {@link assertReceiptMatchesFileKey} (storage-key binding) so an adapter binds\n * the receipt to its request in a single call.\n */\nexport function verifyClientUploadReceiptForFileKey({\n  collectionPrefix,\n  collectionSlug,\n  expectedFileKey,\n  req,\n  signedReceipt,\n  useCompositePrefixes,\n}: Args): ClientUploadReceipt {\n  const receipt = verifyClientUploadReceipt({ collectionSlug, req, signedReceipt })\n\n  assertReceiptMatchesFileKey({ collectionPrefix, expectedFileKey, receipt, useCompositePrefixes })\n\n  return receipt\n}\n"],"names":["verifyClientUploadReceipt","assertReceiptMatchesFileKey","verifyClientUploadReceiptForFileKey","collectionPrefix","collectionSlug","expectedFileKey","req","signedReceipt","useCompositePrefixes","receipt"],"mappings":"AAGA,SAASA,yBAAyB,QAAQ,mBAAkB;AAE5D,SAASC,2BAA2B,QAAQ,mCAAkC;AAW9E;;;;;;CAMC,GACD,OAAO,SAASC,oCAAoC,EAClDC,gBAAgB,EAChBC,cAAc,EACdC,eAAe,EACfC,GAAG,EACHC,aAAa,EACbC,oBAAoB,EACf;IACL,MAAMC,UAAUT,0BAA0B;QAAEI;QAAgBE;QAAKC;IAAc;IAE/EN,4BAA4B;QAAEE;QAAkBE;QAAiBI;QAASD;IAAqB;IAE/F,OAAOC;AACT"}

package/dist/utilities/verifyClientUploadReceiptForFileKey.spec.js

@@ -0,0 +1,108 @@
+import { createClientUploadReceipt } from 'payload/internal';
+import { describe, expect, it } from 'vitest';
+import { verifyClientUploadReceiptForFileKey } from './verifyClientUploadReceiptForFileKey.js';
+const req = {
+    payload: {
+        secret: 'test-secret'
+    }
+};
+const issueReceipt = ({ collectionSlug = 'media', filename = 'photo.png', prefix })=>createClientUploadReceipt({
+        collectionSlug,
+        context: {
+            prefix
+        },
+        filename,
+        req
+    });
+const verify = ({ expectedFileKey, signedReceipt, useCompositePrefixes })=>verifyClientUploadReceiptForFileKey({
+        collectionPrefix: 'media',
+        collectionSlug: 'media',
+        expectedFileKey,
+        req,
+        signedReceipt,
+        useCompositePrefixes
+    });
+/**
+ * This guard is what lets adapters accept a caller-supplied storage key: the key is
+ * recomputed from the signed prefix and filename, so a receipt issued for one location
+ * cannot be replayed against another.
+ */ describe('verifyClientUploadReceiptForFileKey', ()=>{
+    it('should accept the key the receipt was issued for', ()=>{
+        const signedReceipt = issueReceipt({
+            prefix: 'media/documents'
+        });
+        expect(verify({
+            expectedFileKey: 'media/documents/photo.png',
+            signedReceipt
+        }).filename).toBe('photo.png');
+    });
+    it.each([
+        [
+            'a sibling of the collection prefix',
+            'media-archive/photo.png'
+        ],
+        [
+            'another collection',
+            'invoices/photo.png'
+        ],
+        [
+            'another document prefix in the same collection',
+            'media/other-doc/photo.png'
+        ],
+        [
+            'another filename under the issued prefix',
+            'media/documents/payroll.pdf'
+        ]
+    ])('should reject %s', (_case, expectedFileKey)=>{
+        const signedReceipt = issueReceipt({
+            prefix: 'media/documents'
+        });
+        expect(()=>verify({
+                expectedFileKey,
+                signedReceipt
+            })).toThrow('Client upload reference does not match this request.');
+    });
+    it('should reject a receipt issued for another collection', ()=>{
+        const signedReceipt = issueReceipt({
+            collectionSlug: 'invoices',
+            prefix: 'media/documents'
+        });
+        expect(()=>verify({
+                expectedFileKey: 'media/documents/photo.png',
+                signedReceipt
+            })).toThrow('Invalid or expired client upload reference.');
+    });
+    it('should reject a receipt whose prefix is not a string', ()=>{
+        const signedReceipt = issueReceipt({
+            prefix: {
+                nested: true
+            }
+        });
+        expect(()=>verify({
+                expectedFileKey: 'media/photo.png',
+                signedReceipt
+            })).toThrow('Client upload reference does not match this request.');
+    });
+    it('should reject a tampered signature', ()=>{
+        const signedReceipt = issueReceipt({
+            prefix: 'media/documents'
+        });
+        const [encodedReceipt] = signedReceipt.split('.');
+        expect(()=>verify({
+                expectedFileKey: 'media/documents/photo.png',
+                signedReceipt: `${encodedReceipt}.not-the-signature`
+            })).toThrow();
+    });
+    it('should recompute the key in composite mode', ()=>{
+        const signedReceipt = issueReceipt({
+            prefix: 'documents'
+        });
+        expect(verify({
+            expectedFileKey: 'media/documents/photo.png',
+            signedReceipt,
+            useCompositePrefixes: true
+        }).filename).toBe('photo.png');
+    });
+});
+
+//# sourceMappingURL=verifyClientUploadReceiptForFileKey.spec.js.map

package/dist/utilities/verifyClientUploadReceiptForFileKey.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/verifyClientUploadReceiptForFileKey.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { createClientUploadReceipt } from 'payload/internal'\nimport { describe, expect, it } from 'vitest'\n\nimport { verifyClientUploadReceiptForFileKey } from './verifyClientUploadReceiptForFileKey.js'\n\nconst req = { payload: { secret: 'test-secret' } } as unknown as PayloadRequest\n\nconst issueReceipt = ({\n  collectionSlug = 'media',\n  filename = 'photo.png',\n  prefix,\n}: {\n  collectionSlug?: string\n  filename?: string\n  prefix: unknown\n}) =>\n  createClientUploadReceipt({\n    collectionSlug,\n    context: { prefix },\n    filename,\n    req,\n  })\n\nconst verify = ({\n  expectedFileKey,\n  signedReceipt,\n  useCompositePrefixes,\n}: {\n  expectedFileKey: string\n  signedReceipt: string\n  useCompositePrefixes?: boolean\n}) =>\n  verifyClientUploadReceiptForFileKey({\n    collectionPrefix: 'media',\n    collectionSlug: 'media',\n    expectedFileKey,\n    req,\n    signedReceipt,\n    useCompositePrefixes,\n  })\n\n/**\n * This guard is what lets adapters accept a caller-supplied storage key: the key is\n * recomputed from the signed prefix and filename, so a receipt issued for one location\n * cannot be replayed against another.\n */\ndescribe('verifyClientUploadReceiptForFileKey', () => {\n  it('should accept the key the receipt was issued for', () => {\n    const signedReceipt = issueReceipt({ prefix: 'media/documents' })\n\n    expect(verify({ expectedFileKey: 'media/documents/photo.png', signedReceipt }).filename).toBe(\n      'photo.png',\n    )\n  })\n\n  it.each([\n    ['a sibling of the collection prefix', 'media-archive/photo.png'],\n    ['another collection', 'invoices/photo.png'],\n    ['another document prefix in the same collection', 'media/other-doc/photo.png'],\n    ['another filename under the issued prefix', 'media/documents/payroll.pdf'],\n  ])('should reject %s', (_case, expectedFileKey) => {\n    const signedReceipt = issueReceipt({ prefix: 'media/documents' })\n\n    expect(() => verify({ expectedFileKey, signedReceipt })).toThrow(\n      'Client upload reference does not match this request.',\n    )\n  })\n\n  it('should reject a receipt issued for another collection', () => {\n    const signedReceipt = issueReceipt({ collectionSlug: 'invoices', prefix: 'media/documents' })\n\n    expect(() => verify({ expectedFileKey: 'media/documents/photo.png', signedReceipt })).toThrow(\n      'Invalid or expired client upload reference.',\n    )\n  })\n\n  it('should reject a receipt whose prefix is not a string', () => {\n    const signedReceipt = issueReceipt({ prefix: { nested: true } })\n\n    expect(() => verify({ expectedFileKey: 'media/photo.png', signedReceipt })).toThrow(\n      'Client upload reference does not match this request.',\n    )\n  })\n\n  it('should reject a tampered signature', () => {\n    const signedReceipt = issueReceipt({ prefix: 'media/documents' })\n    const [encodedReceipt] = signedReceipt.split('.')\n\n    expect(() =>\n      verify({\n        expectedFileKey: 'media/documents/photo.png',\n        signedReceipt: `${encodedReceipt}.not-the-signature`,\n      }),\n    ).toThrow()\n  })\n\n  it('should recompute the key in composite mode', () => {\n    const signedReceipt = issueReceipt({ prefix: 'documents' })\n\n    expect(\n      verify({\n        expectedFileKey: 'media/documents/photo.png',\n        signedReceipt,\n        useCompositePrefixes: true,\n      }).filename,\n    ).toBe('photo.png')\n  })\n})\n"],"names":["createClientUploadReceipt","describe","expect","it","verifyClientUploadReceiptForFileKey","req","payload","secret","issueReceipt","collectionSlug","filename","prefix","context","verify","expectedFileKey","signedReceipt","useCompositePrefixes","collectionPrefix","toBe","each","_case","toThrow","nested","encodedReceipt","split"],"mappings":"AAEA,SAASA,yBAAyB,QAAQ,mBAAkB;AAC5D,SAASC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,mCAAmC,QAAQ,2CAA0C;AAE9F,MAAMC,MAAM;IAAEC,SAAS;QAAEC,QAAQ;IAAc;AAAE;AAEjD,MAAMC,eAAe,CAAC,EACpBC,iBAAiB,OAAO,EACxBC,WAAW,WAAW,EACtBC,MAAM,EAKP,GACCX,0BAA0B;QACxBS;QACAG,SAAS;YAAED;QAAO;QAClBD;QACAL;IACF;AAEF,MAAMQ,SAAS,CAAC,EACdC,eAAe,EACfC,aAAa,EACbC,oBAAoB,EAKrB,GACCZ,oCAAoC;QAClCa,kBAAkB;QAClBR,gBAAgB;QAChBK;QACAT;QACAU;QACAC;IACF;AAEF;;;;CAIC,GACDf,SAAS,uCAAuC;IAC9CE,GAAG,oDAAoD;QACrD,MAAMY,gBAAgBP,aAAa;YAAEG,QAAQ;QAAkB;QAE/DT,OAAOW,OAAO;YAAEC,iBAAiB;YAA6BC;QAAc,GAAGL,QAAQ,EAAEQ,IAAI,CAC3F;IAEJ;IAEAf,GAAGgB,IAAI,CAAC;QACN;YAAC;YAAsC;SAA0B;QACjE;YAAC;YAAsB;SAAqB;QAC5C;YAAC;YAAkD;SAA4B;QAC/E;YAAC;YAA4C;SAA8B;KAC5E,EAAE,oBAAoB,CAACC,OAAON;QAC7B,MAAMC,gBAAgBP,aAAa;YAAEG,QAAQ;QAAkB;QAE/DT,OAAO,IAAMW,OAAO;gBAAEC;gBAAiBC;YAAc,IAAIM,OAAO,CAC9D;IAEJ;IAEAlB,GAAG,yDAAyD;QAC1D,MAAMY,gBAAgBP,aAAa;YAAEC,gBAAgB;YAAYE,QAAQ;QAAkB;QAE3FT,OAAO,IAAMW,OAAO;gBAAEC,iBAAiB;gBAA6BC;YAAc,IAAIM,OAAO,CAC3F;IAEJ;IAEAlB,GAAG,wDAAwD;QACzD,MAAMY,gBAAgBP,aAAa;YAAEG,QAAQ;gBAAEW,QAAQ;YAAK;QAAE;QAE9DpB,OAAO,IAAMW,OAAO;gBAAEC,iBAAiB;gBAAmBC;YAAc,IAAIM,OAAO,CACjF;IAEJ;IAEAlB,GAAG,sCAAsC;QACvC,MAAMY,gBAAgBP,aAAa;YAAEG,QAAQ;QAAkB;QAC/D,MAAM,CAACY,eAAe,GAAGR,cAAcS,KAAK,CAAC;QAE7CtB,OAAO,IACLW,OAAO;gBACLC,iBAAiB;gBACjBC,eAAe,GAAGQ,eAAe,kBAAkB,CAAC;YACtD,IACAF,OAAO;IACX;IAEAlB,GAAG,8CAA8C;QAC/C,MAAMY,gBAAgBP,aAAa;YAAEG,QAAQ;QAAY;QAEzDT,OACEW,OAAO;YACLC,iBAAiB;YACjBC;YACAC,sBAAsB;QACxB,GAAGN,QAAQ,EACXQ,IAAI,CAAC;IACT;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-cloud-storage",
-  "version": "3.89.0",
+  "version": "3.90.0",
   "description": "The official cloud storage plugin for Payload CMS",
   "homepage": "https://payloadcms.com",
   "repository": {
@@ -51,18 +51,18 @@
   "dependencies": {
     "find-node-modules": "^2.1.3",
     "range-parser": "^1.2.1",
-    "@payloadcms/ui": "3.89.0"
+    "@payloadcms/ui": "3.90.0"
   },
   "devDependencies": {
     "@types/find-node-modules": "^2.1.2",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
-    "payload": "3.89.0"
+    "payload": "3.90.0"
   },
   "peerDependencies": {
     "react": "^19.0.1 || ^19.1.2 || ^19.2.1",
     "react-dom": "^19.0.1 || ^19.1.2 || ^19.2.1",
-    "payload": "3.89.0"
+    "payload": "3.90.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"