@payloadcms/plugin-cloud-storage 4.0.0-canary.35 → 4.0.0-canary.36

package/dist/hooks/afterChange.spec.js

@@ -1,95 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { getAfterChangeHook } from './afterChange.js';
-describe('upload replacement cleanup', ()=>{
-    it.each([
-        [
-            'invoices',
-            'media/invoices',
-            true,
-            false
-        ],
-        [
-            'invoices',
-            'media/invoices',
-            true,
-            true
-        ],
-        [
-            '',
-            'media',
-            false,
-            false
-        ],
-        [
-            'media/invoices',
-            'media/invoices',
-            false,
-            false
-        ]
-    ])('should compare object locations when replacing %s with %s (delete: %s, selected: %s)', async (oldPrefix, newPrefix, shouldDelete, isSelected)=>{
-        const handleDelete = vi.fn();
-        const hook = getAfterChangeHook({
-            adapter: {
-                handleUpload: vi.fn(),
-                handleDelete
-            },
-            collection: {
-                slug: 'media'
-            },
-            collectionPrefix: 'media'
-        });
-        const uploadData = {
-            id: 1,
-            filename: 'file.png',
-            mimeType: 'image/png',
-            sizes: {
-                thumbnail: {
-                    filename: 'thumb.png'
-                }
-            },
-            prefix: newPrefix
-        };
-        await hook({
-            data: uploadData,
-            doc: isSelected ? {
-                id: 1
-            } : uploadData,
-            select: isSelected ? {} : undefined,
-            previousDoc: {
-                id: 1,
-                filename: 'file.png',
-                mimeType: 'image/png',
-                sizes: {
-                    thumbnail: {
-                        filename: 'thumb.png'
-                    }
-                },
-                prefix: oldPrefix
-            },
-            operation: 'update',
-            req: {
-                context: {},
-                file: {
-                    data: Buffer.from('file'),
-                    size: 4
-                },
-                payload: {
-                    logger: {
-                        error: vi.fn()
-                    }
-                }
-            }
-        });
-        expect(handleDelete).toHaveBeenCalledTimes(shouldDelete ? 2 : 0);
-        if (shouldDelete) {
-            expect(handleDelete).toHaveBeenCalledWith(expect.objectContaining({
-                doc: expect.objectContaining({
-                    prefix: oldPrefix
-                }),
-                filename: 'file.png'
-            }));
-        }
-    });
-});
-
-//# sourceMappingURL=afterChange.spec.js.map

package/dist/hooks/afterChange.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/hooks/afterChange.spec.ts"],"sourcesContent":["import { describe, expect, it, vi } from 'vitest'\n\nimport { getAfterChangeHook } from './afterChange.js'\n\ndescribe('upload replacement cleanup', () => {\n  it.each([\n    ['invoices', 'media/invoices', true, false],\n    ['invoices', 'media/invoices', true, true],\n    ['', 'media', false, false],\n    ['media/invoices', 'media/invoices', false, false],\n  ] as const)(\n    'should compare object locations when replacing %s with %s (delete: %s, selected: %s)',\n    async (oldPrefix, newPrefix, shouldDelete, isSelected) => {\n      const handleDelete = vi.fn()\n      const hook = getAfterChangeHook({\n        adapter: { handleUpload: vi.fn(), handleDelete } as never,\n        collection: { slug: 'media' } as never,\n        collectionPrefix: 'media',\n      })\n\n      const uploadData = {\n        id: 1,\n        filename: 'file.png',\n        mimeType: 'image/png',\n        sizes: { thumbnail: { filename: 'thumb.png' } },\n        prefix: newPrefix,\n      }\n\n      await hook({\n        data: uploadData,\n        doc: isSelected ? { id: 1 } : uploadData,\n        select: isSelected ? {} : undefined,\n        previousDoc: {\n          id: 1,\n          filename: 'file.png',\n          mimeType: 'image/png',\n          sizes: { thumbnail: { filename: 'thumb.png' } },\n          prefix: oldPrefix,\n        },\n        operation: 'update',\n        req: {\n          context: {},\n          file: { data: Buffer.from('file'), size: 4 },\n          payload: { logger: { error: vi.fn() } },\n        },\n      } as never)\n\n      expect(handleDelete).toHaveBeenCalledTimes(shouldDelete ? 2 : 0)\n      if (shouldDelete) {\n        expect(handleDelete).toHaveBeenCalledWith(\n          expect.objectContaining({\n            doc: expect.objectContaining({ prefix: oldPrefix }),\n            filename: 'file.png',\n          }),\n        )\n      }\n    },\n  )\n})\n"],"names":["describe","expect","it","vi","getAfterChangeHook","each","oldPrefix","newPrefix","shouldDelete","isSelected","handleDelete","fn","hook","adapter","handleUpload","collection","slug","collectionPrefix","uploadData","id","filename","mimeType","sizes","thumbnail","prefix","data","doc","select","undefined","previousDoc","operation","req","context","file","Buffer","from","size","payload","logger","error","toHaveBeenCalledTimes","toHaveBeenCalledWith","objectContaining"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,SAASC,kBAAkB,QAAQ,mBAAkB;AAErDJ,SAAS,8BAA8B;IACrCE,GAAGG,IAAI,CAAC;QACN;YAAC;YAAY;YAAkB;YAAM;SAAM;QAC3C;YAAC;YAAY;YAAkB;YAAM;SAAK;QAC1C;YAAC;YAAI;YAAS;YAAO;SAAM;QAC3B;YAAC;YAAkB;YAAkB;YAAO;SAAM;KACnD,EACC,wFACA,OAAOC,WAAWC,WAAWC,cAAcC;QACzC,MAAMC,eAAeP,GAAGQ,EAAE;QAC1B,MAAMC,OAAOR,mBAAmB;YAC9BS,SAAS;gBAAEC,cAAcX,GAAGQ,EAAE;gBAAID;YAAa;YAC/CK,YAAY;gBAAEC,MAAM;YAAQ;YAC5BC,kBAAkB;QACpB;QAEA,MAAMC,aAAa;YACjBC,IAAI;YACJC,UAAU;YACVC,UAAU;YACVC,OAAO;gBAAEC,WAAW;oBAAEH,UAAU;gBAAY;YAAE;YAC9CI,QAAQjB;QACV;QAEA,MAAMK,KAAK;YACTa,MAAMP;YACNQ,KAAKjB,aAAa;gBAAEU,IAAI;YAAE,IAAID;YAC9BS,QAAQlB,aAAa,CAAC,IAAImB;YAC1BC,aAAa;gBACXV,IAAI;gBACJC,UAAU;gBACVC,UAAU;gBACVC,OAAO;oBAAEC,WAAW;wBAAEH,UAAU;oBAAY;gBAAE;gBAC9CI,QAAQlB;YACV;YACAwB,WAAW;YACXC,KAAK;gBACHC,SAAS,CAAC;gBACVC,MAAM;oBAAER,MAAMS,OAAOC,IAAI,CAAC;oBAASC,MAAM;gBAAE;gBAC3CC,SAAS;oBAAEC,QAAQ;wBAAEC,OAAOpC,GAAGQ,EAAE;oBAAG;gBAAE;YACxC;QACF;QAEAV,OAAOS,cAAc8B,qBAAqB,CAAChC,eAAe,IAAI;QAC9D,IAAIA,cAAc;YAChBP,OAAOS,cAAc+B,oBAAoB,CACvCxC,OAAOyC,gBAAgB,CAAC;gBACtBhB,KAAKzB,OAAOyC,gBAAgB,CAAC;oBAAElB,QAAQlB;gBAAU;gBACjDc,UAAU;YACZ;QAEJ;IACF;AAEJ"}

package/dist/hooks/normalizeUploadPrefix.spec.js

@@ -1,154 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { getFields } from '../fields/getFields.js';
-import { getNormalizeUploadPrefixFieldHook, getNormalizeUploadPrefixHook } from './normalizeUploadPrefix.js';
-const runHook = ({ data, originalDoc, req = {
-    context: {},
-    file: {}
-} })=>getNormalizeUploadPrefixHook({
-        collectionPrefix: 'media'
-    })({
-        data,
-        originalDoc,
-        req
-    });
-describe('new upload prefixes', ()=>{
-    it('should normalize after custom prefix field hooks', async ()=>{
-        const fields = getFields({
-            collection: {
-                fields: [
-                    {
-                        name: 'prefix',
-                        type: 'text',
-                        hooks: {
-                            beforeChange: [
-                                ()=>'custom'
-                            ]
-                        }
-                    }
-                ]
-            },
-            prefix: 'media'
-        });
-        const field = fields.find((field)=>'name' in field && field.name === 'prefix');
-        let value = 'original';
-        for (const hook of field.hooks?.beforeChange || []){
-            value = await hook({
-                value,
-                data: {
-                    filename: 'file.png'
-                },
-                req: {
-                    file: {},
-                    context: {}
-                }
-            });
-        }
-        expect(value).toBe('media/custom');
-    });
-    it('should contain a prefix supplied with a file upload', async ()=>{
-        const result = await runHook({
-            data: {
-                filename: 'file.png',
-                prefix: 'legacy'
-            }
-        });
-        expect(result.prefix).toBe('media/legacy');
-    });
-    it('should leave internal cloud storage writes alone', async ()=>{
-        const result = await runHook({
-            data: {
-                filename: 'file.png',
-                prefix: 'legacy'
-            },
-            req: {
-                context: {
-                    skipCloudStorage: true
-                },
-                file: {}
-            }
-        });
-        expect(result.prefix).toBe('legacy');
-    });
-    /**
-   * The `prefix` field is writable through the REST/GraphQL/Local API, so a request
-   * carrying no file must not be able to point a document at a foreign object.
-   */ it('should contain a caller-supplied prefix on a metadata-only update', async ()=>{
-        const result = await runHook({
-            data: {
-                prefix: 'tenant-b/private'
-            },
-            originalDoc: {
-                prefix: 'media/legacy'
-            },
-            req: {
-                context: {}
-            }
-        });
-        expect(result.prefix).toBe('media/tenant-b/private');
-    });
-    it('should contain a caller-supplied prefix on a create without a file', async ()=>{
-        const result = await runHook({
-            data: {
-                prefix: 'tenant-b/private'
-            },
-            req: {
-                context: {}
-            }
-        });
-        expect(result.prefix).toBe('media/tenant-b/private');
-    });
-    it('should leave a stored prefix alone when the request omits it', async ()=>{
-        const result = await runHook({
-            data: {
-                filename: 'legacy.png'
-            },
-            originalDoc: {
-                prefix: 'legacy-invoices'
-            },
-            req: {
-                context: {}
-            }
-        });
-        expect(result.prefix).toBeUndefined();
-    });
-    it('should leave a stored prefix alone when the request repeats it unchanged', async ()=>{
-        const result = await runHook({
-            data: {
-                prefix: 'legacy-invoices'
-            },
-            originalDoc: {
-                prefix: 'legacy-invoices'
-            },
-            req: {
-                context: {}
-            }
-        });
-        expect(result.prefix).toBe('legacy-invoices');
-    });
-    describe('prefix field hook', ()=>{
-        const runFieldHook = ({ previousValue, req = {
-            context: {}
-        }, value })=>getNormalizeUploadPrefixFieldHook({
-                collectionPrefix: 'media'
-            })({
-                data: {},
-                previousValue,
-                req,
-                value
-            });
-        it('should contain a caller-supplied value without a file', async ()=>{
-            expect(await runFieldHook({
-                previousValue: 'media/legacy',
-                value: 'tenant-b/private'
-            })).toBe('media/tenant-b/private');
-        });
-        it('should leave an unchanged value alone', async ()=>{
-            expect(await runFieldHook({
-                previousValue: 'legacy-invoices',
-                value: 'legacy-invoices'
-            })).toBe('legacy-invoices');
-        });
-    });
-});
-
-//# sourceMappingURL=normalizeUploadPrefix.spec.js.map

package/dist/hooks/normalizeUploadPrefix.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/hooks/normalizeUploadPrefix.spec.ts"],"sourcesContent":["import type { CollectionConfig, TextField } from 'payload'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { getFields } from '../fields/getFields.js'\nimport {\n  getNormalizeUploadPrefixFieldHook,\n  getNormalizeUploadPrefixHook,\n} from './normalizeUploadPrefix.js'\n\nconst runHook = ({\n  data,\n  originalDoc,\n  req = { context: {}, file: {} },\n}: {\n  data: Record<string, unknown>\n  originalDoc?: Record<string, unknown>\n  req?: Record<string, unknown>\n}) =>\n  getNormalizeUploadPrefixHook({ collectionPrefix: 'media' })({\n    data,\n    originalDoc,\n    req,\n  } as never)\n\ndescribe('new upload prefixes', () => {\n  it('should normalize after custom prefix field hooks', async () => {\n    const fields = getFields({\n      collection: {\n        fields: [{ name: 'prefix', type: 'text', hooks: { beforeChange: [() => 'custom'] } }],\n      } as CollectionConfig,\n      prefix: 'media',\n    })\n    const field = fields.find((field) => 'name' in field && field.name === 'prefix') as TextField\n    let value = 'original'\n\n    for (const hook of field.hooks?.beforeChange || []) {\n      value = await hook({\n        value,\n        data: { filename: 'file.png' },\n        req: { file: {}, context: {} },\n      } as never)\n    }\n\n    expect(value).toBe('media/custom')\n  })\n\n  it('should contain a prefix supplied with a file upload', async () => {\n    const result = await runHook({ data: { filename: 'file.png', prefix: 'legacy' } })\n\n    expect(result.prefix).toBe('media/legacy')\n  })\n\n  it('should leave internal cloud storage writes alone', async () => {\n    const result = await runHook({\n      data: { filename: 'file.png', prefix: 'legacy' },\n      req: { context: { skipCloudStorage: true }, file: {} },\n    })\n\n    expect(result.prefix).toBe('legacy')\n  })\n\n  /**\n   * The `prefix` field is writable through the REST/GraphQL/Local API, so a request\n   * carrying no file must not be able to point a document at a foreign object.\n   */\n  it('should contain a caller-supplied prefix on a metadata-only update', async () => {\n    const result = await runHook({\n      data: { prefix: 'tenant-b/private' },\n      originalDoc: { prefix: 'media/legacy' },\n      req: { context: {} },\n    })\n\n    expect(result.prefix).toBe('media/tenant-b/private')\n  })\n\n  it('should contain a caller-supplied prefix on a create without a file', async () => {\n    const result = await runHook({\n      data: { prefix: 'tenant-b/private' },\n      req: { context: {} },\n    })\n\n    expect(result.prefix).toBe('media/tenant-b/private')\n  })\n\n  it('should leave a stored prefix alone when the request omits it', async () => {\n    const result = await runHook({\n      data: { filename: 'legacy.png' },\n      originalDoc: { prefix: 'legacy-invoices' },\n      req: { context: {} },\n    })\n\n    expect(result.prefix).toBeUndefined()\n  })\n\n  it('should leave a stored prefix alone when the request repeats it unchanged', async () => {\n    const result = await runHook({\n      data: { prefix: 'legacy-invoices' },\n      originalDoc: { prefix: 'legacy-invoices' },\n      req: { context: {} },\n    })\n\n    expect(result.prefix).toBe('legacy-invoices')\n  })\n\n  describe('prefix field hook', () => {\n    const runFieldHook = ({\n      previousValue,\n      req = { context: {} },\n      value,\n    }: {\n      previousValue?: string\n      req?: Record<string, unknown>\n      value: unknown\n    }) =>\n      getNormalizeUploadPrefixFieldHook({ collectionPrefix: 'media' })({\n        data: {},\n        previousValue,\n        req,\n        value,\n      } as never)\n\n    it('should contain a caller-supplied value without a file', async () => {\n      expect(await runFieldHook({ previousValue: 'media/legacy', value: 'tenant-b/private' })).toBe(\n        'media/tenant-b/private',\n      )\n    })\n\n    it('should leave an unchanged value alone', async () => {\n      expect(\n        await runFieldHook({ previousValue: 'legacy-invoices', value: 'legacy-invoices' }),\n      ).toBe('legacy-invoices')\n    })\n  })\n})\n"],"names":["describe","expect","it","getFields","getNormalizeUploadPrefixFieldHook","getNormalizeUploadPrefixHook","runHook","data","originalDoc","req","context","file","collectionPrefix","fields","collection","name","type","hooks","beforeChange","prefix","field","find","value","hook","filename","toBe","result","skipCloudStorage","toBeUndefined","runFieldHook","previousValue"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,SAAS,QAAQ,yBAAwB;AAClD,SACEC,iCAAiC,EACjCC,4BAA4B,QACvB,6BAA4B;AAEnC,MAAMC,UAAU,CAAC,EACfC,IAAI,EACJC,WAAW,EACXC,MAAM;IAAEC,SAAS,CAAC;IAAGC,MAAM,CAAC;AAAE,CAAC,EAKhC,GACCN,6BAA6B;QAAEO,kBAAkB;IAAQ,GAAG;QAC1DL;QACAC;QACAC;IACF;AAEFT,SAAS,uBAAuB;IAC9BE,GAAG,oDAAoD;QACrD,MAAMW,SAASV,UAAU;YACvBW,YAAY;gBACVD,QAAQ;oBAAC;wBAAEE,MAAM;wBAAUC,MAAM;wBAAQC,OAAO;4BAAEC,cAAc;gCAAC,IAAM;6BAAS;wBAAC;oBAAE;iBAAE;YACvF;YACAC,QAAQ;QACV;QACA,MAAMC,QAAQP,OAAOQ,IAAI,CAAC,CAACD,QAAU,UAAUA,SAASA,MAAML,IAAI,KAAK;QACvE,IAAIO,QAAQ;QAEZ,KAAK,MAAMC,QAAQH,MAAMH,KAAK,EAAEC,gBAAgB,EAAE,CAAE;YAClDI,QAAQ,MAAMC,KAAK;gBACjBD;gBACAf,MAAM;oBAAEiB,UAAU;gBAAW;gBAC7Bf,KAAK;oBAAEE,MAAM,CAAC;oBAAGD,SAAS,CAAC;gBAAE;YAC/B;QACF;QAEAT,OAAOqB,OAAOG,IAAI,CAAC;IACrB;IAEAvB,GAAG,uDAAuD;QACxD,MAAMwB,SAAS,MAAMpB,QAAQ;YAAEC,MAAM;gBAAEiB,UAAU;gBAAYL,QAAQ;YAAS;QAAE;QAEhFlB,OAAOyB,OAAOP,MAAM,EAAEM,IAAI,CAAC;IAC7B;IAEAvB,GAAG,oDAAoD;QACrD,MAAMwB,SAAS,MAAMpB,QAAQ;YAC3BC,MAAM;gBAAEiB,UAAU;gBAAYL,QAAQ;YAAS;YAC/CV,KAAK;gBAAEC,SAAS;oBAAEiB,kBAAkB;gBAAK;gBAAGhB,MAAM,CAAC;YAAE;QACvD;QAEAV,OAAOyB,OAAOP,MAAM,EAAEM,IAAI,CAAC;IAC7B;IAEA;;;GAGC,GACDvB,GAAG,qEAAqE;QACtE,MAAMwB,SAAS,MAAMpB,QAAQ;YAC3BC,MAAM;gBAAEY,QAAQ;YAAmB;YACnCX,aAAa;gBAAEW,QAAQ;YAAe;YACtCV,KAAK;gBAAEC,SAAS,CAAC;YAAE;QACrB;QAEAT,OAAOyB,OAAOP,MAAM,EAAEM,IAAI,CAAC;IAC7B;IAEAvB,GAAG,sEAAsE;QACvE,MAAMwB,SAAS,MAAMpB,QAAQ;YAC3BC,MAAM;gBAAEY,QAAQ;YAAmB;YACnCV,KAAK;gBAAEC,SAAS,CAAC;YAAE;QACrB;QAEAT,OAAOyB,OAAOP,MAAM,EAAEM,IAAI,CAAC;IAC7B;IAEAvB,GAAG,gEAAgE;QACjE,MAAMwB,SAAS,MAAMpB,QAAQ;YAC3BC,MAAM;gBAAEiB,UAAU;YAAa;YAC/BhB,aAAa;gBAAEW,QAAQ;YAAkB;YACzCV,KAAK;gBAAEC,SAAS,CAAC;YAAE;QACrB;QAEAT,OAAOyB,OAAOP,MAAM,EAAES,aAAa;IACrC;IAEA1B,GAAG,4EAA4E;QAC7E,MAAMwB,SAAS,MAAMpB,QAAQ;YAC3BC,MAAM;gBAAEY,QAAQ;YAAkB;YAClCX,aAAa;gBAAEW,QAAQ;YAAkB;YACzCV,KAAK;gBAAEC,SAAS,CAAC;YAAE;QACrB;QAEAT,OAAOyB,OAAOP,MAAM,EAAEM,IAAI,CAAC;IAC7B;IAEAzB,SAAS,qBAAqB;QAC5B,MAAM6B,eAAe,CAAC,EACpBC,aAAa,EACbrB,MAAM;YAAEC,SAAS,CAAC;QAAE,CAAC,EACrBY,KAAK,EAKN,GACClB,kCAAkC;gBAAEQ,kBAAkB;YAAQ,GAAG;gBAC/DL,MAAM,CAAC;gBACPuB;gBACArB;gBACAa;YACF;QAEFpB,GAAG,yDAAyD;YAC1DD,OAAO,MAAM4B,aAAa;gBAAEC,eAAe;gBAAgBR,OAAO;YAAmB,IAAIG,IAAI,CAC3F;QAEJ;QAEAvB,GAAG,yCAAyC;YAC1CD,OACE,MAAM4B,aAAa;gBAAEC,eAAe;gBAAmBR,OAAO;YAAkB,IAChFG,IAAI,CAAC;QACT;IACF;AACF"}

package/dist/plugin.spec.js

@@ -1,166 +0,0 @@
-import { createServer } from 'node:http';
-import { downloadFileToBuffer } from 'payload/internal';
-import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
-import { cloudStoragePlugin } from './plugin.js';
-const collectionSlug = 'media';
-describe('cloudStoragePlugin external file fetching', ()=>{
-    const server = createServer((_req, res)=>{
-        res.writeHead(200, {
-            'Content-Length': '12',
-            'Content-Type': 'text/plain'
-        });
-        res.end('stored file\n');
-    });
-    let port;
-    beforeAll(async ()=>{
-        await new Promise((resolve)=>server.listen(0, resolve));
-        port = server.address().port;
-    });
-    afterEach(()=>{
-        vi.unstubAllEnvs();
-    });
-    afterAll(async ()=>{
-        await new Promise((resolve, reject)=>{
-            server.close((error)=>error ? reject(error) : resolve());
-        });
-    });
-    it('should filter private URLs when Payload file access control is disabled', async ()=>{
-        vi.stubEnv('NODE_ENV', 'production');
-        const uploadConfig = buildUploadConfig();
-        await expect(fetchExternalFile({
-            uploadConfig,
-            url: `http://127.0.0.1:${port}/file.txt`
-        })).rejects.toThrow('Blocked unsafe attempt to 127.0.0.1');
-    });
-    it('should allow private URLs when skipSafeFetch is explicitly true', async ()=>{
-        vi.stubEnv('NODE_ENV', 'production');
-        const uploadConfig = buildUploadConfig(true);
-        const file = await fetchExternalFile({
-            uploadConfig,
-            url: `http://127.0.0.1:${port}/file.txt`
-        });
-        expect(file.data.toString()).toBe('stored file\n');
-    });
-    it('should allow private URLs that match an explicit skipSafeFetch allowlist', async ()=>{
-        vi.stubEnv('NODE_ENV', 'production');
-        const uploadConfig = buildUploadConfig([
-            {
-                hostname: '127.0.0.1',
-                port: String(port),
-                protocol: 'http'
-            }
-        ]);
-        const file = await fetchExternalFile({
-            uploadConfig,
-            url: `http://127.0.0.1:${port}/file.txt`
-        });
-        expect(file.data.toString()).toBe('stored file\n');
-    });
-    it('should allow localhost URLs outside production', async ()=>{
-        vi.stubEnv('NODE_ENV', 'development');
-        const uploadConfig = buildUploadConfig();
-        const file = await fetchExternalFile({
-            uploadConfig,
-            url: `http://localhost:${port}/file.txt`
-        });
-        expect(file.data.toString()).toBe('stored file\n');
-    });
-});
-function buildUploadConfig(skipSafeFetch) {
-    const config = cloudStoragePlugin({
-        collections: {
-            [collectionSlug]: {
-                adapter: ()=>({
-                        handleDelete: async ()=>undefined,
-                        handleUpload: async ()=>undefined,
-                        name: 'test-adapter',
-                        staticHandler: async ()=>new Response(null, {
-                                status: 404
-                            })
-                    }),
-                disablePayloadAccessControl: true
-            }
-        }
-    })({
-        collections: [
-            {
-                fields: [],
-                slug: collectionSlug,
-                upload: typeof skipSafeFetch === 'undefined' ? true : {
-                    skipSafeFetch
-                }
-            }
-        ]
-    });
-    const uploadConfig = config.collections?.[0]?.upload;
-    if (!uploadConfig || typeof uploadConfig !== 'object') {
-        throw new Error('Expected an upload configuration');
-    }
-    return uploadConfig;
-}
-async function fetchExternalFile({ uploadConfig, url }) {
-    return downloadFileToBuffer({
-        data: {
-            filename: 'file.txt',
-            url
-        },
-        req: {
-            headers: new Headers(),
-            payload: {
-                config: {
-                    cookiePrefix: 'payload'
-                }
-            }
-        },
-        uploadConfig
-    });
-}
-const adapter = ()=>({
-        handleDelete: ()=>undefined,
-        handleUpload: ()=>undefined,
-        name: 'test-adapter',
-        staticHandler: ()=>new Response()
-    });
-describe('cloudStoragePlugin', ()=>{
-    it('should normalize a stored prefix during a server-mediated upload', async ()=>{
-        const config = cloudStoragePlugin({
-            collections: {
-                media: {
-                    adapter
-                }
-            }
-        })({
-            collections: [
-                {
-                    fields: [],
-                    slug: 'media',
-                    upload: true
-                }
-            ]
-        });
-        const hooks = config.collections?.[0]?.hooks?.beforeChange || [];
-        const req = {
-            context: {},
-            file: {
-                mimetype: 'image/png',
-                name: 'photo.png',
-                size: 42
-            }
-        };
-        let data = {
-            filename: 'photo.png',
-            prefix: '/tenant/../acme'
-        };
-        for (const hook of hooks){
-            const result = await hook({
-                data,
-                operation: 'create',
-                req
-            });
-            data = result || data;
-        }
-        expect(data.prefix).toBe('tenant/acme');
-    });
-});
-
-//# sourceMappingURL=plugin.spec.js.map

package/dist/plugin.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/plugin.spec.ts"],"sourcesContent":["import type { AddressInfo } from 'node:net'\nimport type { Config, PayloadRequest, UploadConfig } from 'payload'\n\nimport { createServer } from 'node:http'\nimport { downloadFileToBuffer } from 'payload/internal'\nimport { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'\n\nimport { cloudStoragePlugin } from './plugin.js'\n\nconst collectionSlug = 'media'\n\ndescribe('cloudStoragePlugin external file fetching', () => {\n  const server = createServer((_req, res) => {\n    res.writeHead(200, {\n      'Content-Length': '12',\n      'Content-Type': 'text/plain',\n    })\n    res.end('stored file\\n')\n  })\n\n  let port: number\n\n  beforeAll(async () => {\n    await new Promise<void>((resolve) => server.listen(0, resolve))\n    port = (server.address() as AddressInfo).port\n  })\n\n  afterEach(() => {\n    vi.unstubAllEnvs()\n  })\n\n  afterAll(async () => {\n    await new Promise<void>((resolve, reject) => {\n      server.close((error) => (error ? reject(error) : resolve()))\n    })\n  })\n\n  it('should filter private URLs when Payload file access control is disabled', async () => {\n    vi.stubEnv('NODE_ENV', 'production')\n    const uploadConfig = buildUploadConfig()\n\n    await expect(\n      fetchExternalFile({ uploadConfig, url: `http://127.0.0.1:${port}/file.txt` }),\n    ).rejects.toThrow('Blocked unsafe attempt to 127.0.0.1')\n  })\n\n  it('should allow private URLs when skipSafeFetch is explicitly true', async () => {\n    vi.stubEnv('NODE_ENV', 'production')\n    const uploadConfig = buildUploadConfig(true)\n\n    const file = await fetchExternalFile({\n      uploadConfig,\n      url: `http://127.0.0.1:${port}/file.txt`,\n    })\n\n    expect(file.data.toString()).toBe('stored file\\n')\n  })\n\n  it('should allow private URLs that match an explicit skipSafeFetch allowlist', async () => {\n    vi.stubEnv('NODE_ENV', 'production')\n    const uploadConfig = buildUploadConfig([\n      {\n        hostname: '127.0.0.1',\n        port: String(port),\n        protocol: 'http',\n      },\n    ])\n\n    const file = await fetchExternalFile({\n      uploadConfig,\n      url: `http://127.0.0.1:${port}/file.txt`,\n    })\n\n    expect(file.data.toString()).toBe('stored file\\n')\n  })\n\n  it('should allow localhost URLs outside production', async () => {\n    vi.stubEnv('NODE_ENV', 'development')\n    const uploadConfig = buildUploadConfig()\n\n    const file = await fetchExternalFile({\n      uploadConfig,\n      url: `http://localhost:${port}/file.txt`,\n    })\n\n    expect(file.data.toString()).toBe('stored file\\n')\n  })\n})\n\nfunction buildUploadConfig(skipSafeFetch?: UploadConfig['skipSafeFetch']): UploadConfig {\n  const config = cloudStoragePlugin({\n    collections: {\n      [collectionSlug]: {\n        adapter: () => ({\n          handleDelete: async () => undefined,\n          handleUpload: async () => undefined,\n          name: 'test-adapter',\n          staticHandler: async () => new Response(null, { status: 404 }),\n        }),\n        disablePayloadAccessControl: true,\n      },\n    },\n  })({\n    collections: [\n      {\n        fields: [],\n        slug: collectionSlug,\n        upload: typeof skipSafeFetch === 'undefined' ? true : { skipSafeFetch },\n      },\n    ],\n  } as Config)\n\n  const uploadConfig = config.collections?.[0]?.upload\n  if (!uploadConfig || typeof uploadConfig !== 'object') {\n    throw new Error('Expected an upload configuration')\n  }\n\n  return uploadConfig\n}\n\nasync function fetchExternalFile({\n  uploadConfig,\n  url,\n}: {\n  uploadConfig: UploadConfig\n  url: string\n}) {\n  return downloadFileToBuffer({\n    data: {\n      filename: 'file.txt',\n      url,\n    },\n    req: {\n      headers: new Headers(),\n      payload: {\n        config: {\n          cookiePrefix: 'payload',\n        },\n      },\n    } as PayloadRequest,\n    uploadConfig,\n  })\n}\n\nconst adapter = () => ({\n  handleDelete: () => undefined,\n  handleUpload: () => undefined,\n  name: 'test-adapter',\n  staticHandler: () => new Response(),\n})\n\ndescribe('cloudStoragePlugin', () => {\n  it('should normalize a stored prefix during a server-mediated upload', async () => {\n    const config = cloudStoragePlugin({\n      collections: {\n        media: { adapter },\n      },\n    } as any)({\n      collections: [{ fields: [], slug: 'media', upload: true }],\n    } as any)\n    const hooks = config.collections?.[0]?.hooks?.beforeChange || []\n    const req = {\n      context: {},\n      file: { mimetype: 'image/png', name: 'photo.png', size: 42 },\n    }\n    let data = { filename: 'photo.png', prefix: '/tenant/../acme' }\n\n    for (const hook of hooks) {\n      const result = await hook({ data, operation: 'create', req } as any)\n      data = result || data\n    }\n\n    expect(data.prefix).toBe('tenant/acme')\n  })\n})\n"],"names":["createServer","downloadFileToBuffer","afterAll","afterEach","beforeAll","describe","expect","it","vi","cloudStoragePlugin","collectionSlug","server","_req","res","writeHead","end","port","Promise","resolve","listen","address","unstubAllEnvs","reject","close","error","stubEnv","uploadConfig","buildUploadConfig","fetchExternalFile","url","rejects","toThrow","file","data","toString","toBe","hostname","String","protocol","skipSafeFetch","config","collections","adapter","handleDelete","undefined","handleUpload","name","staticHandler","Response","status","disablePayloadAccessControl","fields","slug","upload","Error","filename","req","headers","Headers","payload","cookiePrefix","media","hooks","beforeChange","context","mimetype","size","prefix","hook","result","operation"],"mappings":"AAGA,SAASA,YAAY,QAAQ,YAAW;AACxC,SAASC,oBAAoB,QAAQ,mBAAkB;AACvD,SAASC,QAAQ,EAAEC,SAAS,EAAEC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjF,SAASC,kBAAkB,QAAQ,cAAa;AAEhD,MAAMC,iBAAiB;AAEvBL,SAAS,6CAA6C;IACpD,MAAMM,SAASX,aAAa,CAACY,MAAMC;QACjCA,IAAIC,SAAS,CAAC,KAAK;YACjB,kBAAkB;YAClB,gBAAgB;QAClB;QACAD,IAAIE,GAAG,CAAC;IACV;IAEA,IAAIC;IAEJZ,UAAU;QACR,MAAM,IAAIa,QAAc,CAACC,UAAYP,OAAOQ,MAAM,CAAC,GAAGD;QACtDF,OAAO,AAACL,OAAOS,OAAO,GAAmBJ,IAAI;IAC/C;IAEAb,UAAU;QACRK,GAAGa,aAAa;IAClB;IAEAnB,SAAS;QACP,MAAM,IAAIe,QAAc,CAACC,SAASI;YAChCX,OAAOY,KAAK,CAAC,CAACC,QAAWA,QAAQF,OAAOE,SAASN;QACnD;IACF;IAEAX,GAAG,2EAA2E;QAC5EC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC;QAErB,MAAMrB,OACJsB,kBAAkB;YAAEF;YAAcG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAAC,IAC3Ec,OAAO,CAACC,OAAO,CAAC;IACpB;IAEAxB,GAAG,mEAAmE;QACpEC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC,kBAAkB;QAEvC,MAAMK,OAAO,MAAMJ,kBAAkB;YACnCF;YACAG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAC1C;QAEAV,OAAO0B,KAAKC,IAAI,CAACC,QAAQ,IAAIC,IAAI,CAAC;IACpC;IAEA5B,GAAG,4EAA4E;QAC7EC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC,kBAAkB;YACrC;gBACES,UAAU;gBACVpB,MAAMqB,OAAOrB;gBACbsB,UAAU;YACZ;SACD;QAED,MAAMN,OAAO,MAAMJ,kBAAkB;YACnCF;YACAG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAC1C;QAEAV,OAAO0B,KAAKC,IAAI,CAACC,QAAQ,IAAIC,IAAI,CAAC;IACpC;IAEA5B,GAAG,kDAAkD;QACnDC,GAAGiB,OAAO,CAAC,YAAY;QACvB,MAAMC,eAAeC;QAErB,MAAMK,OAAO,MAAMJ,kBAAkB;YACnCF;YACAG,KAAK,CAAC,iBAAiB,EAAEb,KAAK,SAAS,CAAC;QAC1C;QAEAV,OAAO0B,KAAKC,IAAI,CAACC,QAAQ,IAAIC,IAAI,CAAC;IACpC;AACF;AAEA,SAASR,kBAAkBY,aAA6C;IACtE,MAAMC,SAAS/B,mBAAmB;QAChCgC,aAAa;YACX,CAAC/B,eAAe,EAAE;gBAChBgC,SAAS,IAAO,CAAA;wBACdC,cAAc,UAAYC;wBAC1BC,cAAc,UAAYD;wBAC1BE,MAAM;wBACNC,eAAe,UAAY,IAAIC,SAAS,MAAM;gCAAEC,QAAQ;4BAAI;oBAC9D,CAAA;gBACAC,6BAA6B;YAC/B;QACF;IACF,GAAG;QACDT,aAAa;YACX;gBACEU,QAAQ,EAAE;gBACVC,MAAM1C;gBACN2C,QAAQ,OAAOd,kBAAkB,cAAc,OAAO;oBAAEA;gBAAc;YACxE;SACD;IACH;IAEA,MAAMb,eAAec,OAAOC,WAAW,EAAE,CAAC,EAAE,EAAEY;IAC9C,IAAI,CAAC3B,gBAAgB,OAAOA,iBAAiB,UAAU;QACrD,MAAM,IAAI4B,MAAM;IAClB;IAEA,OAAO5B;AACT;AAEA,eAAeE,kBAAkB,EAC/BF,YAAY,EACZG,GAAG,EAIJ;IACC,OAAO5B,qBAAqB;QAC1BgC,MAAM;YACJsB,UAAU;YACV1B;QACF;QACA2B,KAAK;YACHC,SAAS,IAAIC;YACbC,SAAS;gBACPnB,QAAQ;oBACNoB,cAAc;gBAChB;YACF;QACF;QACAlC;IACF;AACF;AAEA,MAAMgB,UAAU,IAAO,CAAA;QACrBC,cAAc,IAAMC;QACpBC,cAAc,IAAMD;QACpBE,MAAM;QACNC,eAAe,IAAM,IAAIC;IAC3B,CAAA;AAEA3C,SAAS,sBAAsB;IAC7BE,GAAG,oEAAoE;QACrE,MAAMiC,SAAS/B,mBAAmB;YAChCgC,aAAa;gBACXoB,OAAO;oBAAEnB;gBAAQ;YACnB;QACF,GAAU;YACRD,aAAa;gBAAC;oBAAEU,QAAQ,EAAE;oBAAEC,MAAM;oBAASC,QAAQ;gBAAK;aAAE;QAC5D;QACA,MAAMS,QAAQtB,OAAOC,WAAW,EAAE,CAAC,EAAE,EAAEqB,OAAOC,gBAAgB,EAAE;QAChE,MAAMP,MAAM;YACVQ,SAAS,CAAC;YACVhC,MAAM;gBAAEiC,UAAU;gBAAanB,MAAM;gBAAaoB,MAAM;YAAG;QAC7D;QACA,IAAIjC,OAAO;YAAEsB,UAAU;YAAaY,QAAQ;QAAkB;QAE9D,KAAK,MAAMC,QAAQN,MAAO;YACxB,MAAMO,SAAS,MAAMD,KAAK;gBAAEnC;gBAAMqC,WAAW;gBAAUd;YAAI;YAC3DvB,OAAOoC,UAAUpC;QACnB;QAEA3B,OAAO2B,KAAKkC,MAAM,EAAEhC,IAAI,CAAC;IAC3B;AACF"}