@payloadcms/storage-azure 4.0.0-canary.32 → 4.0.0-canary.34

package/README.md

@@ -58,12 +58,15 @@ export default buildConfig({
 
 ### Configuration Options
 
-| Option                 | Description                                                              | Default |
-| ---------------------- | ------------------------------------------------------------------------ | ------- |
-| `enabled`              | Whether or not to enable the plugin                                      | `true`  |
-| `collections`          | Collections to apply the Azure Blob adapter to                           |         |
-| `allowContainerCreate` | Whether or not to allow the container to be created if it does not exist | `false` |
-| `baseURL`              | Base URL for the Azure Blob storage account                              |         |
-| `connectionString`     | Azure Blob storage connection string                                     |         |
-| `containerName`        | Azure Blob storage container name                                        |         |
-| `clientUploads`        | Upload directly to Azure instead of through Payload.                     |         |
+| Option                 | Description                                                                                                                                                                                                                                                               | Default     |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
+| `enabled`              | Whether or not to enable the plugin                                                                                                                                                                                                                                       | `true`      |
+| `collections`          | Collections to apply the Azure Blob adapter to                                                                                                                                                                                                                            |             |
+| `allowContainerCreate` | Whether or not to allow the container to be created if it does not exist                                                                                                                                                                                                  | `false`     |
+| `containerAccess`      | Public access level for a container the plugin creates. `'private'` (default) serves blobs only through Payload's access-controlled route; `'blob'` / `'container'` expose them to anonymous clients directly from Azure. Has no effect on containers that already exist. | `'private'` |
+| `baseURL`              | Base URL for the Azure Blob storage account                                                                                                                                                                                                                               |             |
+| `connectionString`     | Azure Blob storage connection string                                                                                                                                                                                                                                      |             |
+| `containerName`        | Azure Blob storage container name                                                                                                                                                                                                                                         |             |
+| `clientUploads`        | Upload directly to Azure instead of through Payload.                                                                                                                                                                                                                      |             |
+
+> **Breaking change (private by default):** When `allowContainerCreate: true`, the plugin now creates containers with **private** access. Previously it created them with public `blob` access. If you relied on files being served directly from the anonymous Azure blob URL (typically alongside `disablePayloadAccessControl: true`), set `containerAccess: 'blob'` to restore the old behaviour. This only affects **newly created** containers — existing containers keep their current access level, so you must flip their ACL manually if needed.

package/dist/adapter.d.ts

@@ -5,7 +5,7 @@ interface CreateAzureAdapterArgs {
     baseURL: string;
     clientUploads?: ClientUploadsConfig;
     containerName: string;
-    createContainerIfNotExists: () => void;
+    createContainerIfNotExists: () => Promise<void> | void;
     getStorageClient: () => ContainerClient;
     useCompositePrefixes?: boolean;
 }

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EACV,OAAO,EACP,mBAAmB,EAEpB,MAAM,wCAAwC,CAAA;AAQ/C,UAAU,sBAAsB;IAC9B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B,EAAE,MAAM,IAAI,CAAA;IACtC,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAgB,kBAAkB,CAAC,EACjC,oBAAoB,EACpB,OAAO,EACP,aAAa,EACb,aAAa,EACb,0BAA0B,EAC1B,gBAAgB,EAChB,oBAA4B,GAC7B,EAAE,sBAAsB,GAAG,OAAO,CAuElC"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EACV,OAAO,EACP,mBAAmB,EAEpB,MAAM,wCAAwC,CAAA;AAS/C,UAAU,sBAAsB;IAC9B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACtD,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAgB,kBAAkB,CAAC,EACjC,oBAAoB,EACpB,OAAO,EACP,aAAa,EACb,aAAa,EACb,0BAA0B,EAC1B,gBAAgB,EAChB,oBAA4B,GAC7B,EAAE,sBAAsB,GAAG,OAAO,CA+DlC"}

package/dist/adapter.js

@@ -2,6 +2,7 @@ import { deleteFile } from './deleteFile.js';
 import { generateUploadInstructions } from './generateUploadInstructions.js';
 import { generateURL } from './generateURL.js';
 import { getFile } from './getFile.js';
+import { isClientUploadAllowed } from './isClientUploadAllowed.js';
 import { uploadFile } from './uploadFile.js';
 export function createAzureAdapter({ allowContainerCreate, baseURL, clientUploads, containerName, createContainerIfNotExists, getStorageClient, useCompositePrefixes = false }) {
     return ({ collection, prefix = '' })=>({
@@ -18,7 +19,7 @@ export function createAzureAdapter({ allowContainerCreate, baseURL, clientUpload
                 adminHandler: {
                     path: '@payloadcms/storage-azure/client#AzureClientUploadHandler'
                 },
-                enabled: Boolean(clientUploads),
+                enabled: Boolean(clientUploads) && isClientUploadAllowed(collection),
                 generate: generateUploadInstructions({
                     access: typeof clientUploads === 'object' ? clientUploads.access : undefined,
                     collectionPrefix: prefix,
@@ -26,35 +27,30 @@ export function createAzureAdapter({ allowContainerCreate, baseURL, clientUpload
                     getStorageClient,
                     useCompositePrefixes
                 }),
+                requiresUploadReceipt: true,
                 useInAdmin: true
             },
-            handleDelete: ({ doc: { prefix: docPrefix = '' }, filename })=>deleteFile({
+            handleDelete: ({ storageFilePath })=>deleteFile({
                     client: getStorageClient(),
-                    collectionPrefix: prefix,
-                    docPrefix,
-                    filename,
-                    useCompositePrefixes
+                    storageFilePath
                 }),
-            handleUpload: async ({ data, file })=>{
+            handleUpload: async ({ data, file, storageFilePath })=>{
                 await uploadFile({
                     buffer: file.buffer,
                     client: getStorageClient(),
-                    collectionPrefix: prefix,
-                    docPrefix: data.prefix,
-                    filename: file.filename,
                     mimeType: file.mimeType,
-                    tempFilePath: file.tempFilePath,
-                    useCompositePrefixes
+                    storageFilePath,
+                    tempFilePath: file.tempFilePath
                 });
                 return data;
             },
-            staticHandler: (req, { headers, params: { filename, prefix: prefixQueryParam, uploadReference } })=>getFile({
+            staticHandler: (req, { doc, headers, params: { filename, uploadReference } })=>getFile({
                     client: getStorageClient(),
                     collection,
                     collectionPrefix: prefix,
+                    doc,
                     filename,
                     incomingHeaders: headers,
-                    prefixQueryParam,
                     req,
                     uploadReference,
                     useCompositePrefixes

package/dist/adapter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapter.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\nimport type {\n  Adapter,\n  ClientUploadsConfig,\n  GeneratedAdapter,\n} from '@payloadcms/plugin-cloud-storage/types'\n\nimport { deleteFile } from './deleteFile.js'\nimport { generateUploadInstructions } from './generateUploadInstructions.js'\nimport { generateURL } from './generateURL.js'\nimport { getFile } from './getFile.js'\nimport { uploadFile } from './uploadFile.js'\n\ninterface CreateAzureAdapterArgs {\n  allowContainerCreate: boolean\n  baseURL: string\n  clientUploads?: ClientUploadsConfig\n  containerName: string\n  createContainerIfNotExists: () => void\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport function createAzureAdapter({\n  allowContainerCreate,\n  baseURL,\n  clientUploads,\n  containerName,\n  createContainerIfNotExists,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: CreateAzureAdapterArgs): Adapter {\n  return ({ collection, prefix = '' }): GeneratedAdapter => ({\n    name: 'azure',\n\n    generateURL: ({ filename, prefix: urlPrefix = '' }) =>\n      generateURL({\n        baseURL,\n        collectionPrefix: prefix,\n        containerName,\n        filename,\n        prefix: urlPrefix,\n        useCompositePrefixes,\n      }),\n\n    uploadInstructions: {\n      adminHandler: {\n        path: '@payloadcms/storage-azure/client#AzureClientUploadHandler',\n      },\n      enabled: Boolean(clientUploads),\n      generate: generateUploadInstructions({\n        access: typeof clientUploads === 'object' ? clientUploads.access : undefined,\n        collectionPrefix: prefix,\n        containerName,\n        getStorageClient,\n        useCompositePrefixes,\n      }),\n      useInAdmin: true,\n    },\n\n    handleDelete: ({ doc: { prefix: docPrefix = '' }, filename }) =>\n      deleteFile({\n        client: getStorageClient(),\n        collectionPrefix: prefix,\n        docPrefix,\n        filename,\n        useCompositePrefixes,\n      }),\n\n    handleUpload: async ({ data, file }) => {\n      await uploadFile({\n        buffer: file.buffer,\n        client: getStorageClient(),\n        collectionPrefix: prefix,\n        docPrefix: data.prefix,\n        filename: file.filename,\n        mimeType: file.mimeType,\n        tempFilePath: file.tempFilePath,\n        useCompositePrefixes,\n      })\n\n      return data\n    },\n\n    staticHandler: (\n      req,\n      { headers, params: { filename, prefix: prefixQueryParam, uploadReference } },\n    ) =>\n      getFile({\n        client: getStorageClient(),\n        collection,\n        collectionPrefix: prefix,\n        filename,\n        incomingHeaders: headers,\n        prefixQueryParam,\n        req,\n        uploadReference,\n        useCompositePrefixes,\n      }),\n\n    ...(allowContainerCreate && { onInit: createContainerIfNotExists }),\n  })\n}\n"],"names":["deleteFile","generateUploadInstructions","generateURL","getFile","uploadFile","createAzureAdapter","allowContainerCreate","baseURL","clientUploads","containerName","createContainerIfNotExists","getStorageClient","useCompositePrefixes","collection","prefix","name","filename","urlPrefix","collectionPrefix","uploadInstructions","adminHandler","path","enabled","Boolean","generate","access","undefined","useInAdmin","handleDelete","doc","docPrefix","client","handleUpload","data","file","buffer","mimeType","tempFilePath","staticHandler","req","headers","params","prefixQueryParam","uploadReference","incomingHeaders","onInit"],"mappings":"AAOA,SAASA,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,0BAA0B,QAAQ,kCAAiC;AAC5E,SAASC,WAAW,QAAQ,mBAAkB;AAC9C,SAASC,OAAO,QAAQ,eAAc;AACtC,SAASC,UAAU,QAAQ,kBAAiB;AAY5C,OAAO,SAASC,mBAAmB,EACjCC,oBAAoB,EACpBC,OAAO,EACPC,aAAa,EACbC,aAAa,EACbC,0BAA0B,EAC1BC,gBAAgB,EAChBC,uBAAuB,KAAK,EACL;IACvB,OAAO,CAAC,EAAEC,UAAU,EAAEC,SAAS,EAAE,EAAE,GAAwB,CAAA;YACzDC,MAAM;YAENb,aAAa,CAAC,EAAEc,QAAQ,EAAEF,QAAQG,YAAY,EAAE,EAAE,GAChDf,YAAY;oBACVK;oBACAW,kBAAkBJ;oBAClBL;oBACAO;oBACAF,QAAQG;oBACRL;gBACF;YAEFO,oBAAoB;gBAClBC,cAAc;oBACZC,MAAM;gBACR;gBACAC,SAASC,QAAQf;gBACjBgB,UAAUvB,2BAA2B;oBACnCwB,QAAQ,OAAOjB,kBAAkB,WAAWA,cAAciB,MAAM,GAAGC;oBACnER,kBAAkBJ;oBAClBL;oBACAE;oBACAC;gBACF;gBACAe,YAAY;YACd;YAEAC,cAAc,CAAC,EAAEC,KAAK,EAAEf,QAAQgB,YAAY,EAAE,EAAE,EAAEd,QAAQ,EAAE,GAC1DhB,WAAW;oBACT+B,QAAQpB;oBACRO,kBAAkBJ;oBAClBgB;oBACAd;oBACAJ;gBACF;YAEFoB,cAAc,OAAO,EAAEC,IAAI,EAAEC,IAAI,EAAE;gBACjC,MAAM9B,WAAW;oBACf+B,QAAQD,KAAKC,MAAM;oBACnBJ,QAAQpB;oBACRO,kBAAkBJ;oBAClBgB,WAAWG,KAAKnB,MAAM;oBACtBE,UAAUkB,KAAKlB,QAAQ;oBACvBoB,UAAUF,KAAKE,QAAQ;oBACvBC,cAAcH,KAAKG,YAAY;oBAC/BzB;gBACF;gBAEA,OAAOqB;YACT;YAEAK,eAAe,CACbC,KACA,EAAEC,OAAO,EAAEC,QAAQ,EAAEzB,QAAQ,EAAEF,QAAQ4B,gBAAgB,EAAEC,eAAe,EAAE,EAAE,GAE5ExC,QAAQ;oBACN4B,QAAQpB;oBACRE;oBACAK,kBAAkBJ;oBAClBE;oBACA4B,iBAAiBJ;oBACjBE;oBACAH;oBACAI;oBACA/B;gBACF;YAEF,GAAIN,wBAAwB;gBAAEuC,QAAQnC;YAA2B,CAAC;QACpE,CAAA;AACF"}
+{"version":3,"sources":["../src/adapter.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\nimport type {\n  Adapter,\n  ClientUploadsConfig,\n  GeneratedAdapter,\n} from '@payloadcms/plugin-cloud-storage/types'\n\nimport { deleteFile } from './deleteFile.js'\nimport { generateUploadInstructions } from './generateUploadInstructions.js'\nimport { generateURL } from './generateURL.js'\nimport { getFile } from './getFile.js'\nimport { isClientUploadAllowed } from './isClientUploadAllowed.js'\nimport { uploadFile } from './uploadFile.js'\n\ninterface CreateAzureAdapterArgs {\n  allowContainerCreate: boolean\n  baseURL: string\n  clientUploads?: ClientUploadsConfig\n  containerName: string\n  createContainerIfNotExists: () => Promise<void> | void\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport function createAzureAdapter({\n  allowContainerCreate,\n  baseURL,\n  clientUploads,\n  containerName,\n  createContainerIfNotExists,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: CreateAzureAdapterArgs): Adapter {\n  return ({ collection, prefix = '' }): GeneratedAdapter => ({\n    name: 'azure',\n\n    generateURL: ({ filename, prefix: urlPrefix = '' }) =>\n      generateURL({\n        baseURL,\n        collectionPrefix: prefix,\n        containerName,\n        filename,\n        prefix: urlPrefix,\n        useCompositePrefixes,\n      }),\n\n    uploadInstructions: {\n      adminHandler: {\n        path: '@payloadcms/storage-azure/client#AzureClientUploadHandler',\n      },\n      enabled: Boolean(clientUploads) && isClientUploadAllowed(collection),\n      generate: generateUploadInstructions({\n        access: typeof clientUploads === 'object' ? clientUploads.access : undefined,\n        collectionPrefix: prefix,\n        containerName,\n        getStorageClient,\n        useCompositePrefixes,\n      }),\n      requiresUploadReceipt: true,\n      useInAdmin: true,\n    },\n\n    handleDelete: ({ storageFilePath }) =>\n      deleteFile({\n        client: getStorageClient(),\n        storageFilePath,\n      }),\n\n    handleUpload: async ({ data, file, storageFilePath }) => {\n      await uploadFile({\n        buffer: file.buffer,\n        client: getStorageClient(),\n        mimeType: file.mimeType,\n        storageFilePath,\n        tempFilePath: file.tempFilePath,\n      })\n\n      return data\n    },\n\n    staticHandler: (req, { doc, headers, params: { filename, uploadReference } }) =>\n      getFile({\n        client: getStorageClient(),\n        collection,\n        collectionPrefix: prefix,\n        doc,\n        filename,\n        incomingHeaders: headers,\n        req,\n        uploadReference,\n        useCompositePrefixes,\n      }),\n\n    ...(allowContainerCreate && { onInit: createContainerIfNotExists }),\n  })\n}\n"],"names":["deleteFile","generateUploadInstructions","generateURL","getFile","isClientUploadAllowed","uploadFile","createAzureAdapter","allowContainerCreate","baseURL","clientUploads","containerName","createContainerIfNotExists","getStorageClient","useCompositePrefixes","collection","prefix","name","filename","urlPrefix","collectionPrefix","uploadInstructions","adminHandler","path","enabled","Boolean","generate","access","undefined","requiresUploadReceipt","useInAdmin","handleDelete","storageFilePath","client","handleUpload","data","file","buffer","mimeType","tempFilePath","staticHandler","req","doc","headers","params","uploadReference","incomingHeaders","onInit"],"mappings":"AAOA,SAASA,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,0BAA0B,QAAQ,kCAAiC;AAC5E,SAASC,WAAW,QAAQ,mBAAkB;AAC9C,SAASC,OAAO,QAAQ,eAAc;AACtC,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,UAAU,QAAQ,kBAAiB;AAY5C,OAAO,SAASC,mBAAmB,EACjCC,oBAAoB,EACpBC,OAAO,EACPC,aAAa,EACbC,aAAa,EACbC,0BAA0B,EAC1BC,gBAAgB,EAChBC,uBAAuB,KAAK,EACL;IACvB,OAAO,CAAC,EAAEC,UAAU,EAAEC,SAAS,EAAE,EAAE,GAAwB,CAAA;YACzDC,MAAM;YAENd,aAAa,CAAC,EAAEe,QAAQ,EAAEF,QAAQG,YAAY,EAAE,EAAE,GAChDhB,YAAY;oBACVM;oBACAW,kBAAkBJ;oBAClBL;oBACAO;oBACAF,QAAQG;oBACRL;gBACF;YAEFO,oBAAoB;gBAClBC,cAAc;oBACZC,MAAM;gBACR;gBACAC,SAASC,QAAQf,kBAAkBL,sBAAsBU;gBACzDW,UAAUxB,2BAA2B;oBACnCyB,QAAQ,OAAOjB,kBAAkB,WAAWA,cAAciB,MAAM,GAAGC;oBACnER,kBAAkBJ;oBAClBL;oBACAE;oBACAC;gBACF;gBACAe,uBAAuB;gBACvBC,YAAY;YACd;YAEAC,cAAc,CAAC,EAAEC,eAAe,EAAE,GAChC/B,WAAW;oBACTgC,QAAQpB;oBACRmB;gBACF;YAEFE,cAAc,OAAO,EAAEC,IAAI,EAAEC,IAAI,EAAEJ,eAAe,EAAE;gBAClD,MAAM1B,WAAW;oBACf+B,QAAQD,KAAKC,MAAM;oBACnBJ,QAAQpB;oBACRyB,UAAUF,KAAKE,QAAQ;oBACvBN;oBACAO,cAAcH,KAAKG,YAAY;gBACjC;gBAEA,OAAOJ;YACT;YAEAK,eAAe,CAACC,KAAK,EAAEC,GAAG,EAAEC,OAAO,EAAEC,QAAQ,EAAE1B,QAAQ,EAAE2B,eAAe,EAAE,EAAE,GAC1EzC,QAAQ;oBACN6B,QAAQpB;oBACRE;oBACAK,kBAAkBJ;oBAClB0B;oBACAxB;oBACA4B,iBAAiBH;oBACjBF;oBACAI;oBACA/B;gBACF;YAEF,GAAIN,wBAAwB;gBAAEuC,QAAQnC;YAA2B,CAAC;QACpE,CAAA;AACF"}

package/dist/adapter.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter.spec.d.ts.map

package/dist/adapter.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.spec.d.ts","sourceRoot":"","sources":["../src/adapter.spec.ts"],"names":[],"mappings":""}

package/dist/adapter.spec.js

@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from 'vitest';
+import { createAzureAdapter } from './adapter.js';
+const createAdapter = ()=>createAzureAdapter({
+        allowContainerCreate: false,
+        baseURL: 'https://account.blob.core.windows.net',
+        clientUploads: true,
+        containerName: 'media',
+        createContainerIfNotExists: vi.fn(),
+        getStorageClient: vi.fn()
+    });
+describe('Azure client uploads', ()=>{
+    it.each([
+        [
+            'secure defaults',
+            {
+                upload: true
+            },
+            false
+        ],
+        [
+            'explicit opt-out',
+            {
+                upload: {
+                    allowRestrictedFileTypes: true
+                }
+            },
+            true
+        ]
+    ])('should use server uploads for %s', (_, collection, expected)=>{
+        const adapter = createAdapter()({
+            collection: collection,
+            prefix: ''
+        });
+        expect(adapter.uploadInstructions?.enabled).toBe(expected);
+    });
+});
+it('should generate a public URL for the stored legacy prefix', ()=>{
+    const collection = {
+        slug: 'media',
+        fields: []
+    };
+    const adapter = createAdapter()({
+        collection,
+        prefix: 'uploads'
+    });
+    expect(adapter.generateURL({
+        collection,
+        data: {},
+        filename: 'file.png',
+        prefix: 'legacy'
+    })).toBe('https://account.blob.core.windows.net/media/legacy/file.png');
+});
+
+//# sourceMappingURL=adapter.spec.js.map

package/dist/adapter.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapter.spec.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport { describe, expect, it, vi } from 'vitest'\n\nimport { createAzureAdapter } from './adapter.js'\n\nconst createAdapter = () =>\n  createAzureAdapter({\n    allowContainerCreate: false,\n    baseURL: 'https://account.blob.core.windows.net',\n    clientUploads: true,\n    containerName: 'media',\n    createContainerIfNotExists: vi.fn(),\n    getStorageClient: vi.fn(),\n  })\n\ndescribe('Azure client uploads', () => {\n  it.each([\n    ['secure defaults', { upload: true }, false],\n    ['explicit opt-out', { upload: { allowRestrictedFileTypes: true } }, true],\n  ])('should use server uploads for %s', (_, collection, expected) => {\n    const adapter = createAdapter()({\n      collection: collection as unknown as CollectionConfig,\n      prefix: '',\n    })\n\n    expect(adapter.uploadInstructions?.enabled).toBe(expected)\n  })\n})\n\nit('should generate a public URL for the stored legacy prefix', () => {\n  const collection: CollectionConfig = { slug: 'media', fields: [] }\n  const adapter = createAdapter()({\n    collection,\n    prefix: 'uploads',\n  })\n\n  expect(\n    adapter.generateURL!({ collection, data: {}, filename: 'file.png', prefix: 'legacy' }),\n  ).toBe('https://account.blob.core.windows.net/media/legacy/file.png')\n})\n"],"names":["describe","expect","it","vi","createAzureAdapter","createAdapter","allowContainerCreate","baseURL","clientUploads","containerName","createContainerIfNotExists","fn","getStorageClient","each","upload","allowRestrictedFileTypes","_","collection","expected","adapter","prefix","uploadInstructions","enabled","toBe","slug","fields","generateURL","data","filename"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,SAASC,kBAAkB,QAAQ,eAAc;AAEjD,MAAMC,gBAAgB,IACpBD,mBAAmB;QACjBE,sBAAsB;QACtBC,SAAS;QACTC,eAAe;QACfC,eAAe;QACfC,4BAA4BP,GAAGQ,EAAE;QACjCC,kBAAkBT,GAAGQ,EAAE;IACzB;AAEFX,SAAS,wBAAwB;IAC/BE,GAAGW,IAAI,CAAC;QACN;YAAC;YAAmB;gBAAEC,QAAQ;YAAK;YAAG;SAAM;QAC5C;YAAC;YAAoB;gBAAEA,QAAQ;oBAAEC,0BAA0B;gBAAK;YAAE;YAAG;SAAK;KAC3E,EAAE,oCAAoC,CAACC,GAAGC,YAAYC;QACrD,MAAMC,UAAUd,gBAAgB;YAC9BY,YAAYA;YACZG,QAAQ;QACV;QAEAnB,OAAOkB,QAAQE,kBAAkB,EAAEC,SAASC,IAAI,CAACL;IACnD;AACF;AAEAhB,GAAG,6DAA6D;IAC9D,MAAMe,aAA+B;QAAEO,MAAM;QAASC,QAAQ,EAAE;IAAC;IACjE,MAAMN,UAAUd,gBAAgB;QAC9BY;QACAG,QAAQ;IACV;IAEAnB,OACEkB,QAAQO,WAAW,CAAE;QAAET;QAAYU,MAAM,CAAC;QAAGC,UAAU;QAAYR,QAAQ;IAAS,IACpFG,IAAI,CAAC;AACT"}

package/dist/deleteFile.d.ts

@@ -1,11 +1,8 @@
 import type { ContainerClient } from '@azure/storage-blob';
 interface DeleteArgs {
     client: ContainerClient;
-    collectionPrefix?: string;
-    docPrefix: string;
-    filename: string;
-    useCompositePrefixes?: boolean;
+    storageFilePath: string;
 }
-export declare function deleteFile({ client, collectionPrefix, docPrefix, filename, useCompositePrefixes, }: DeleteArgs): Promise<void>;
+export declare function deleteFile({ client, storageFilePath }: DeleteArgs): Promise<void>;
 export {};
 //# sourceMappingURL=deleteFile.d.ts.map

package/dist/deleteFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteFile.d.ts","sourceRoot":"","sources":["../src/deleteFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAI1D,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAsB,UAAU,CAAC,EAC/B,MAAM,EACN,gBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,oBAA4B,GAC7B,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5B"}
+{"version":3,"file":"deleteFile.d.ts","sourceRoot":"","sources":["../src/deleteFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1D,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,wBAAsB,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvF"}

package/dist/deleteFile.js

@@ -1,12 +1,5 @@
-import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
-export async function deleteFile({ client, collectionPrefix = '', docPrefix, filename, useCompositePrefixes = false }) {
-    const { fileKey } = getFileKey({
-        collectionPrefix,
-        docPrefix,
-        filename,
-        useCompositePrefixes
-    });
-    const blockBlobClient = client.getBlockBlobClient(fileKey);
+export async function deleteFile({ client, storageFilePath }) {
+    const blockBlobClient = client.getBlockBlobClient(storageFilePath);
     await blockBlobClient.deleteIfExists();
 }
 

package/dist/deleteFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/deleteFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\nimport { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities'\n\ninterface DeleteArgs {\n  client: ContainerClient\n  collectionPrefix?: string\n  docPrefix: string\n  filename: string\n  useCompositePrefixes?: boolean\n}\n\nexport async function deleteFile({\n  client,\n  collectionPrefix = '',\n  docPrefix,\n  filename,\n  useCompositePrefixes = false,\n}: DeleteArgs): Promise<void> {\n  const { fileKey } = getFileKey({\n    collectionPrefix,\n    docPrefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  const blockBlobClient = client.getBlockBlobClient(fileKey)\n\n  await blockBlobClient.deleteIfExists()\n}\n"],"names":["getFileKey","deleteFile","client","collectionPrefix","docPrefix","filename","useCompositePrefixes","fileKey","blockBlobClient","getBlockBlobClient","deleteIfExists"],"mappings":"AAEA,SAASA,UAAU,QAAQ,6CAA4C;AAUvE,OAAO,eAAeC,WAAW,EAC/BC,MAAM,EACNC,mBAAmB,EAAE,EACrBC,SAAS,EACTC,QAAQ,EACRC,uBAAuB,KAAK,EACjB;IACX,MAAM,EAAEC,OAAO,EAAE,GAAGP,WAAW;QAC7BG;QACAC;QACAC;QACAC;IACF;IAEA,MAAME,kBAAkBN,OAAOO,kBAAkB,CAACF;IAElD,MAAMC,gBAAgBE,cAAc;AACtC"}
+{"version":3,"sources":["../src/deleteFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\ninterface DeleteArgs {\n  client: ContainerClient\n  storageFilePath: string\n}\n\nexport async function deleteFile({ client, storageFilePath }: DeleteArgs): Promise<void> {\n  const blockBlobClient = client.getBlockBlobClient(storageFilePath)\n\n  await blockBlobClient.deleteIfExists()\n}\n"],"names":["deleteFile","client","storageFilePath","blockBlobClient","getBlockBlobClient","deleteIfExists"],"mappings":"AAOA,OAAO,eAAeA,WAAW,EAAEC,MAAM,EAAEC,eAAe,EAAc;IACtE,MAAMC,kBAAkBF,OAAOG,kBAAkB,CAACF;IAElD,MAAMC,gBAAgBE,cAAc;AACtC"}

package/dist/generateURL.js

@@ -1,12 +1,12 @@
-import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
+import { buildStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities';
 export function generateURL({ baseURL, collectionPrefix = '', containerName, filename, prefix, useCompositePrefixes = false }) {
-    const { fileKey } = getFileKey({
+    const { storageFilePath } = buildStoragePathData({
         collectionPrefix,
         docPrefix: prefix,
         filename,
         useCompositePrefixes
     });
-    return `${baseURL}/${containerName}/${fileKey}`;
+    return `${baseURL}/${containerName}/${storageFilePath}`;
 }
 
 //# sourceMappingURL=generateURL.js.map

package/dist/generateURL.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/generateURL.ts"],"sourcesContent":["import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities'\n\ninterface GenerateURLArgs {\n  baseURL: string\n  collectionPrefix?: string\n  containerName: string\n  filename: string\n  prefix: string\n  useCompositePrefixes?: boolean\n}\n\nexport function generateURL({\n  baseURL,\n  collectionPrefix = '',\n  containerName,\n  filename,\n  prefix,\n  useCompositePrefixes = false,\n}: GenerateURLArgs): string {\n  const { fileKey } = getFileKey({\n    collectionPrefix,\n    docPrefix: prefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  return `${baseURL}/${containerName}/${fileKey}`\n}\n"],"names":["getFileKey","generateURL","baseURL","collectionPrefix","containerName","filename","prefix","useCompositePrefixes","fileKey","docPrefix"],"mappings":"AAAA,SAASA,UAAU,QAAQ,6CAA4C;AAWvE,OAAO,SAASC,YAAY,EAC1BC,OAAO,EACPC,mBAAmB,EAAE,EACrBC,aAAa,EACbC,QAAQ,EACRC,MAAM,EACNC,uBAAuB,KAAK,EACZ;IAChB,MAAM,EAAEC,OAAO,EAAE,GAAGR,WAAW;QAC7BG;QACAM,WAAWH;QACXD;QACAE;IACF;IAEA,OAAO,GAAGL,QAAQ,CAAC,EAAEE,cAAc,CAAC,EAAEI,SAAS;AACjD"}
+{"version":3,"sources":["../src/generateURL.ts"],"sourcesContent":["import { buildStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities'\n\ninterface GenerateURLArgs {\n  baseURL: string\n  collectionPrefix?: string\n  containerName: string\n  filename: string\n  prefix: string\n  useCompositePrefixes?: boolean\n}\n\nexport function generateURL({\n  baseURL,\n  collectionPrefix = '',\n  containerName,\n  filename,\n  prefix,\n  useCompositePrefixes = false,\n}: GenerateURLArgs): string {\n  const { storageFilePath } = buildStoragePathData({\n    collectionPrefix,\n    docPrefix: prefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  return `${baseURL}/${containerName}/${storageFilePath}`\n}\n"],"names":["buildStoragePathData","generateURL","baseURL","collectionPrefix","containerName","filename","prefix","useCompositePrefixes","storageFilePath","docPrefix"],"mappings":"AAAA,SAASA,oBAAoB,QAAQ,6CAA4C;AAWjF,OAAO,SAASC,YAAY,EAC1BC,OAAO,EACPC,mBAAmB,EAAE,EACrBC,aAAa,EACbC,QAAQ,EACRC,MAAM,EACNC,uBAAuB,KAAK,EACZ;IAChB,MAAM,EAAEC,eAAe,EAAE,GAAGR,qBAAqB;QAC/CG;QACAM,WAAWH;QACXD;QACAE;IACF;IAEA,OAAO,GAAGL,QAAQ,CAAC,EAAEE,cAAc,CAAC,EAAEI,iBAAiB;AACzD"}

package/dist/generateUploadInstructions.createOnly.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=generateUploadInstructions.createOnly.spec.d.ts.map

package/dist/generateUploadInstructions.createOnly.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateUploadInstructions.createOnly.spec.d.ts","sourceRoot":"","sources":["../src/generateUploadInstructions.createOnly.spec.ts"],"names":[],"mappings":""}

package/dist/generateUploadInstructions.createOnly.spec.js

@@ -0,0 +1,63 @@
+import { describe, expect, it, vi } from 'vitest';
+const azureMocks = vi.hoisted(()=>({
+        generateBlobSASQueryParameters: vi.fn(()=>({
+                toString: ()=>'signature'
+            })),
+        parsePermissions: vi.fn(()=>({
+                create: true
+            }))
+    }));
+vi.mock('@azure/storage-blob', ()=>({
+        BlobSASPermissions: {
+            parse: azureMocks.parsePermissions
+        },
+        generateBlobSASQueryParameters: azureMocks.generateBlobSASQueryParameters
+    }));
+vi.mock('@payloadcms/plugin-cloud-storage/utilities', ()=>({
+        resolveSignedURLKey: vi.fn(async ()=>({
+                storageFilePath: 'reference.png',
+                sanitizedDocPrefix: '',
+                sanitizedFilename: 'reference.png'
+            }))
+    }));
+import { generateUploadInstructions } from './generateUploadInstructions.js';
+describe('generateUploadInstructions', ()=>{
+    it('should issue create-only Azure upload instructions', async ()=>{
+        const generate = generateUploadInstructions({
+            collectionPrefix: '',
+            containerName: 'media',
+            getStorageClient: ()=>({
+                    credential: {},
+                    getBlobClient: ()=>({
+                            url: 'https://example.com/reference.png'
+                        })
+                })
+        });
+        await generate({
+            collectionSlug: 'media',
+            filename: 'reference.png',
+            filesize: 100,
+            mimeType: 'image/png',
+            overrideAccess: true,
+            req: {
+                payload: {
+                    collections: {
+                        media: {
+                            config: {
+                                upload: {
+                                    allowRestrictedFileTypes: true
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        });
+        expect(azureMocks.parsePermissions).toHaveBeenCalledExactlyOnceWith('c');
+        expect(azureMocks.generateBlobSASQueryParameters).toHaveBeenCalledWith(expect.objectContaining({
+            version: '2026-04-06'
+        }), expect.anything());
+    });
+});
+
+//# sourceMappingURL=generateUploadInstructions.createOnly.spec.js.map

package/dist/generateUploadInstructions.createOnly.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/generateUploadInstructions.createOnly.spec.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\nimport type { PayloadRequest } from 'payload'\n\nimport { describe, expect, it, vi } from 'vitest'\n\nconst azureMocks = vi.hoisted(() => ({\n  generateBlobSASQueryParameters: vi.fn(() => ({ toString: () => 'signature' })),\n  parsePermissions: vi.fn(() => ({ create: true })),\n}))\n\nvi.mock('@azure/storage-blob', () => ({\n  BlobSASPermissions: { parse: azureMocks.parsePermissions },\n  generateBlobSASQueryParameters: azureMocks.generateBlobSASQueryParameters,\n}))\n\nvi.mock('@payloadcms/plugin-cloud-storage/utilities', () => ({\n  resolveSignedURLKey: vi.fn(async () => ({\n    storageFilePath: 'reference.png',\n    sanitizedDocPrefix: '',\n    sanitizedFilename: 'reference.png',\n  })),\n}))\n\nimport { generateUploadInstructions } from './generateUploadInstructions.js'\n\ndescribe('generateUploadInstructions', () => {\n  it('should issue create-only Azure upload instructions', async () => {\n    const generate = generateUploadInstructions({\n      collectionPrefix: '',\n      containerName: 'media',\n      getStorageClient: () =>\n        ({\n          credential: {},\n          getBlobClient: () => ({ url: 'https://example.com/reference.png' }),\n        }) as unknown as ContainerClient,\n    })\n\n    await generate({\n      collectionSlug: 'media',\n      filename: 'reference.png',\n      filesize: 100,\n      mimeType: 'image/png',\n      overrideAccess: true,\n      req: {\n        payload: {\n          collections: {\n            media: {\n              config: {\n                upload: { allowRestrictedFileTypes: true },\n              },\n            },\n          },\n        },\n      } as unknown as PayloadRequest,\n    })\n\n    expect(azureMocks.parsePermissions).toHaveBeenCalledExactlyOnceWith('c')\n    expect(azureMocks.generateBlobSASQueryParameters).toHaveBeenCalledWith(\n      expect.objectContaining({ version: '2026-04-06' }),\n      expect.anything(),\n    )\n  })\n})\n"],"names":["describe","expect","it","vi","azureMocks","hoisted","generateBlobSASQueryParameters","fn","toString","parsePermissions","create","mock","BlobSASPermissions","parse","resolveSignedURLKey","storageFilePath","sanitizedDocPrefix","sanitizedFilename","generateUploadInstructions","generate","collectionPrefix","containerName","getStorageClient","credential","getBlobClient","url","collectionSlug","filename","filesize","mimeType","overrideAccess","req","payload","collections","media","config","upload","allowRestrictedFileTypes","toHaveBeenCalledExactlyOnceWith","toHaveBeenCalledWith","objectContaining","version","anything"],"mappings":"AAGA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,MAAMC,aAAaD,GAAGE,OAAO,CAAC,IAAO,CAAA;QACnCC,gCAAgCH,GAAGI,EAAE,CAAC,IAAO,CAAA;gBAAEC,UAAU,IAAM;YAAY,CAAA;QAC3EC,kBAAkBN,GAAGI,EAAE,CAAC,IAAO,CAAA;gBAAEG,QAAQ;YAAK,CAAA;IAChD,CAAA;AAEAP,GAAGQ,IAAI,CAAC,uBAAuB,IAAO,CAAA;QACpCC,oBAAoB;YAAEC,OAAOT,WAAWK,gBAAgB;QAAC;QACzDH,gCAAgCF,WAAWE,8BAA8B;IAC3E,CAAA;AAEAH,GAAGQ,IAAI,CAAC,8CAA8C,IAAO,CAAA;QAC3DG,qBAAqBX,GAAGI,EAAE,CAAC,UAAa,CAAA;gBACtCQ,iBAAiB;gBACjBC,oBAAoB;gBACpBC,mBAAmB;YACrB,CAAA;IACF,CAAA;AAEA,SAASC,0BAA0B,QAAQ,kCAAiC;AAE5ElB,SAAS,8BAA8B;IACrCE,GAAG,sDAAsD;QACvD,MAAMiB,WAAWD,2BAA2B;YAC1CE,kBAAkB;YAClBC,eAAe;YACfC,kBAAkB,IACf,CAAA;oBACCC,YAAY,CAAC;oBACbC,eAAe,IAAO,CAAA;4BAAEC,KAAK;wBAAoC,CAAA;gBACnE,CAAA;QACJ;QAEA,MAAMN,SAAS;YACbO,gBAAgB;YAChBC,UAAU;YACVC,UAAU;YACVC,UAAU;YACVC,gBAAgB;YAChBC,KAAK;gBACHC,SAAS;oBACPC,aAAa;wBACXC,OAAO;4BACLC,QAAQ;gCACNC,QAAQ;oCAAEC,0BAA0B;gCAAK;4BAC3C;wBACF;oBACF;gBACF;YACF;QACF;QAEApC,OAAOG,WAAWK,gBAAgB,EAAE6B,+BAA+B,CAAC;QACpErC,OAAOG,WAAWE,8BAA8B,EAAEiC,oBAAoB,CACpEtC,OAAOuC,gBAAgB,CAAC;YAAEC,SAAS;QAAa,IAChDxC,OAAOyC,QAAQ;IAEnB;AACF"}

package/dist/generateUploadInstructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateUploadInstructions.d.ts","sourceRoot":"","sources":["../src/generateUploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA8B,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAMnF,UAAU,IAAI;IACZ,MAAM,CAAC,EAAE,wBAAwB,CAAA;IACjC,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,eAAO,MAAM,0BAA0B,yFAMpC,IAAI,KAAG,0BAmDT,CAAA"}
+{"version":3,"file":"generateUploadInstructions.d.ts","sourceRoot":"","sources":["../src/generateUploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA8B,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AASnF,UAAU,IAAI;IACZ,MAAM,CAAC,EAAE,wBAAwB,CAAA;IACjC,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,eAAO,MAAM,0BAA0B,yFAMpC,IAAI,KAAG,0BA8DT,CAAA"}

package/dist/generateUploadInstructions.js

@@ -1,6 +1,8 @@
 import { BlobSASPermissions, generateBlobSASQueryParameters } from '@azure/storage-blob';
 import { resolveSignedURLKey } from '@payloadcms/plugin-cloud-storage/utilities';
-import { Forbidden } from 'payload';
+import { APIError, Forbidden } from 'payload';
+import { assertClientUploadAllowed } from 'payload/internal';
+import { isClientUploadAllowed } from './isClientUploadAllowed.js';
 export const generateUploadInstructions = ({ access, collectionPrefix, containerName, getStorageClient, useCompositePrefixes = false })=>{
     return async ({ collectionSlug, docPrefix, filename, filesize, mimeType, overrideAccess, req })=>{
         if (!overrideAccess && (access ? !await access({
@@ -9,7 +11,16 @@ export const generateUploadInstructions = ({ access, collectionPrefix, container
         }) : !req.user)) {
             throw new Forbidden(req.t);
         }
-        const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({
+        const collection = req.payload.collections[collectionSlug]?.config;
+        if (!isClientUploadAllowed(collection)) {
+            throw new APIError('Azure client uploads require allowRestrictedFileTypes to be enabled.', 400);
+        }
+        assertClientUploadAllowed({
+            collection,
+            filename,
+            mimeType
+        });
+        const { sanitizedFilename, storageFilePath, uploadReference } = await resolveSignedURLKey({
             collectionPrefix,
             collectionSlug,
             docPrefix,
@@ -17,14 +28,15 @@ export const generateUploadInstructions = ({ access, collectionPrefix, container
             req,
             useCompositePrefixes
         });
-        const blobClient = getStorageClient().getBlobClient(fileKey);
+        const blobClient = getStorageClient().getBlobClient(storageFilePath);
         const sasToken = generateBlobSASQueryParameters({
-            blobName: fileKey,
+            blobName: storageFilePath,
             containerName,
             contentType: mimeType,
             expiresOn: new Date(Date.now() + 3 * 60 * 60 * 1000),
-            permissions: BlobSASPermissions.parse('w'),
-            startsOn: new Date()
+            permissions: BlobSASPermissions.parse('c'),
+            startsOn: new Date(),
+            version: '2026-04-06'
         }, getStorageClient().credential);
         return {
             name: 'uploadToAzure',
@@ -36,9 +48,7 @@ export const generateUploadInstructions = ({ access, collectionPrefix, container
                 filename: sanitizedFilename,
                 mimeType,
                 size: filesize,
-                uploadReference: {
-                    prefix: sanitizedDocPrefix
-                }
+                uploadReference
             }
         };
     };

package/dist/generateUploadInstructions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/generateUploadInstructions.ts"],"sourcesContent":["import type { ContainerClient, StorageSharedKeyCredential } from '@azure/storage-blob'\nimport type { GenerateUploadInstructions, UploadInstructionsAccess } from 'payload'\n\nimport { BlobSASPermissions, generateBlobSASQueryParameters } from '@azure/storage-blob'\nimport { resolveSignedURLKey } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { Forbidden } from 'payload'\n\ninterface Args {\n  access?: UploadInstructionsAccess\n  collectionPrefix: string\n  containerName: string\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport const generateUploadInstructions = ({\n  access,\n  collectionPrefix,\n  containerName,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: Args): GenerateUploadInstructions => {\n  return async ({\n    collectionSlug,\n    docPrefix,\n    filename,\n    filesize,\n    mimeType,\n    overrideAccess,\n    req,\n  }) => {\n    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {\n      throw new Forbidden(req.t)\n    }\n\n    const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({\n      collectionPrefix,\n      collectionSlug,\n      docPrefix,\n      filename,\n      req,\n      useCompositePrefixes,\n    })\n\n    const blobClient = getStorageClient().getBlobClient(fileKey)\n\n    const sasToken = generateBlobSASQueryParameters(\n      {\n        blobName: fileKey,\n        containerName,\n        contentType: mimeType,\n        expiresOn: new Date(Date.now() + 3 * 60 * 60 * 1000),\n        permissions: BlobSASPermissions.parse('w'),\n        startsOn: new Date(),\n      },\n      getStorageClient().credential as StorageSharedKeyCredential,\n    )\n\n    return {\n      name: 'uploadToAzure',\n      type: 'dispatch',\n      data: {\n        url: `${blobClient.url}?${sasToken.toString()}`,\n      },\n      file: {\n        filename: sanitizedFilename,\n        mimeType,\n        size: filesize,\n        uploadReference: { prefix: sanitizedDocPrefix },\n      },\n    }\n  }\n}\n"],"names":["BlobSASPermissions","generateBlobSASQueryParameters","resolveSignedURLKey","Forbidden","generateUploadInstructions","access","collectionPrefix","containerName","getStorageClient","useCompositePrefixes","collectionSlug","docPrefix","filename","filesize","mimeType","overrideAccess","req","user","t","fileKey","sanitizedDocPrefix","sanitizedFilename","blobClient","getBlobClient","sasToken","blobName","contentType","expiresOn","Date","now","permissions","parse","startsOn","credential","name","type","data","url","toString","file","size","uploadReference","prefix"],"mappings":"AAGA,SAASA,kBAAkB,EAAEC,8BAA8B,QAAQ,sBAAqB;AACxF,SAASC,mBAAmB,QAAQ,6CAA4C;AAChF,SAASC,SAAS,QAAQ,UAAS;AAUnC,OAAO,MAAMC,6BAA6B,CAAC,EACzCC,MAAM,EACNC,gBAAgB,EAChBC,aAAa,EACbC,gBAAgB,EAChBC,uBAAuB,KAAK,EACvB;IACL,OAAO,OAAO,EACZC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,QAAQ,EACRC,cAAc,EACdC,GAAG,EACJ;QACC,IAAI,CAACD,kBAAmBV,CAAAA,SAAS,CAAE,MAAMA,OAAO;YAAEK;YAAgBM;QAAI,KAAM,CAACA,IAAIC,IAAI,AAAD,GAAI;YACtF,MAAM,IAAId,UAAUa,IAAIE,CAAC;QAC3B;QAEA,MAAM,EAAEC,OAAO,EAAEC,kBAAkB,EAAEC,iBAAiB,EAAE,GAAG,MAAMnB,oBAAoB;YACnFI;YACAI;YACAC;YACAC;YACAI;YACAP;QACF;QAEA,MAAMa,aAAad,mBAAmBe,aAAa,CAACJ;QAEpD,MAAMK,WAAWvB,+BACf;YACEwB,UAAUN;YACVZ;YACAmB,aAAaZ;YACba,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAK,IAAI,KAAK,KAAK;YAC/CC,aAAa9B,mBAAmB+B,KAAK,CAAC;YACtCC,UAAU,IAAIJ;QAChB,GACApB,mBAAmByB,UAAU;QAG/B,OAAO;YACLC,MAAM;YACNC,MAAM;YACNC,MAAM;gBACJC,KAAK,GAAGf,WAAWe,GAAG,CAAC,CAAC,EAAEb,SAASc,QAAQ,IAAI;YACjD;YACAC,MAAM;gBACJ3B,UAAUS;gBACVP;gBACA0B,MAAM3B;gBACN4B,iBAAiB;oBAAEC,QAAQtB;gBAAmB;YAChD;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../src/generateUploadInstructions.ts"],"sourcesContent":["import type { ContainerClient, StorageSharedKeyCredential } from '@azure/storage-blob'\nimport type { GenerateUploadInstructions, UploadInstructionsAccess } from 'payload'\n\nimport { BlobSASPermissions, generateBlobSASQueryParameters } from '@azure/storage-blob'\nimport { resolveSignedURLKey } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { APIError, Forbidden } from 'payload'\nimport { assertClientUploadAllowed } from 'payload/internal'\n\nimport { isClientUploadAllowed } from './isClientUploadAllowed.js'\n\ninterface Args {\n  access?: UploadInstructionsAccess\n  collectionPrefix: string\n  containerName: string\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport const generateUploadInstructions = ({\n  access,\n  collectionPrefix,\n  containerName,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: Args): GenerateUploadInstructions => {\n  return async ({\n    collectionSlug,\n    docPrefix,\n    filename,\n    filesize,\n    mimeType,\n    overrideAccess,\n    req,\n  }) => {\n    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {\n      throw new Forbidden(req.t)\n    }\n\n    const collection = req.payload.collections[collectionSlug]?.config\n    if (!isClientUploadAllowed(collection)) {\n      throw new APIError(\n        'Azure client uploads require allowRestrictedFileTypes to be enabled.',\n        400,\n      )\n    }\n\n    assertClientUploadAllowed({ collection, filename, mimeType })\n\n    const { sanitizedFilename, storageFilePath, uploadReference } = await resolveSignedURLKey({\n      collectionPrefix,\n      collectionSlug,\n      docPrefix,\n      filename,\n      req,\n      useCompositePrefixes,\n    })\n\n    const blobClient = getStorageClient().getBlobClient(storageFilePath)\n\n    const sasToken = generateBlobSASQueryParameters(\n      {\n        blobName: storageFilePath,\n        containerName,\n        contentType: mimeType,\n        expiresOn: new Date(Date.now() + 3 * 60 * 60 * 1000),\n        permissions: BlobSASPermissions.parse('c'),\n        startsOn: new Date(),\n        version: '2026-04-06',\n      },\n      getStorageClient().credential as StorageSharedKeyCredential,\n    )\n\n    return {\n      name: 'uploadToAzure',\n      type: 'dispatch',\n      data: {\n        url: `${blobClient.url}?${sasToken.toString()}`,\n      },\n      file: {\n        filename: sanitizedFilename,\n        mimeType,\n        size: filesize,\n        uploadReference,\n      },\n    }\n  }\n}\n"],"names":["BlobSASPermissions","generateBlobSASQueryParameters","resolveSignedURLKey","APIError","Forbidden","assertClientUploadAllowed","isClientUploadAllowed","generateUploadInstructions","access","collectionPrefix","containerName","getStorageClient","useCompositePrefixes","collectionSlug","docPrefix","filename","filesize","mimeType","overrideAccess","req","user","t","collection","payload","collections","config","sanitizedFilename","storageFilePath","uploadReference","blobClient","getBlobClient","sasToken","blobName","contentType","expiresOn","Date","now","permissions","parse","startsOn","version","credential","name","type","data","url","toString","file","size"],"mappings":"AAGA,SAASA,kBAAkB,EAAEC,8BAA8B,QAAQ,sBAAqB;AACxF,SAASC,mBAAmB,QAAQ,6CAA4C;AAChF,SAASC,QAAQ,EAAEC,SAAS,QAAQ,UAAS;AAC7C,SAASC,yBAAyB,QAAQ,mBAAkB;AAE5D,SAASC,qBAAqB,QAAQ,6BAA4B;AAUlE,OAAO,MAAMC,6BAA6B,CAAC,EACzCC,MAAM,EACNC,gBAAgB,EAChBC,aAAa,EACbC,gBAAgB,EAChBC,uBAAuB,KAAK,EACvB;IACL,OAAO,OAAO,EACZC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,QAAQ,EACRC,cAAc,EACdC,GAAG,EACJ;QACC,IAAI,CAACD,kBAAmBV,CAAAA,SAAS,CAAE,MAAMA,OAAO;YAAEK;YAAgBM;QAAI,KAAM,CAACA,IAAIC,IAAI,AAAD,GAAI;YACtF,MAAM,IAAIhB,UAAUe,IAAIE,CAAC;QAC3B;QAEA,MAAMC,aAAaH,IAAII,OAAO,CAACC,WAAW,CAACX,eAAe,EAAEY;QAC5D,IAAI,CAACnB,sBAAsBgB,aAAa;YACtC,MAAM,IAAInB,SACR,wEACA;QAEJ;QAEAE,0BAA0B;YAAEiB;YAAYP;YAAUE;QAAS;QAE3D,MAAM,EAAES,iBAAiB,EAAEC,eAAe,EAAEC,eAAe,EAAE,GAAG,MAAM1B,oBAAoB;YACxFO;YACAI;YACAC;YACAC;YACAI;YACAP;QACF;QAEA,MAAMiB,aAAalB,mBAAmBmB,aAAa,CAACH;QAEpD,MAAMI,WAAW9B,+BACf;YACE+B,UAAUL;YACVjB;YACAuB,aAAahB;YACbiB,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAK,IAAI,KAAK,KAAK;YAC/CC,aAAarC,mBAAmBsC,KAAK,CAAC;YACtCC,UAAU,IAAIJ;YACdK,SAAS;QACX,GACA7B,mBAAmB8B,UAAU;QAG/B,OAAO;YACLC,MAAM;YACNC,MAAM;YACNC,MAAM;gBACJC,KAAK,GAAGhB,WAAWgB,GAAG,CAAC,CAAC,EAAEd,SAASe,QAAQ,IAAI;YACjD;YACAC,MAAM;gBACJhC,UAAUW;gBACVT;gBACA+B,MAAMhC;gBACNY;YACF;QACF;IACF;AACF,EAAC"}

package/dist/generateUploadInstructions.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=generateUploadInstructions.spec.d.ts.map

package/dist/generateUploadInstructions.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateUploadInstructions.spec.d.ts","sourceRoot":"","sources":["../src/generateUploadInstructions.spec.ts"],"names":[],"mappings":""}

package/dist/generateUploadInstructions.spec.js

@@ -0,0 +1,72 @@
+import { StorageSharedKeyCredential } from '@azure/storage-blob';
+import { describe, expect, it, vi } from 'vitest';
+import { generateUploadInstructions } from './generateUploadInstructions.js';
+const createRequest = (allowRestrictedFileTypes)=>({
+        payload: {
+            collections: {
+                media: {
+                    config: {
+                        slug: 'media',
+                        upload: {
+                            allowRestrictedFileTypes
+                        }
+                    }
+                }
+            },
+            config: {
+                upload: {}
+            },
+            db: {
+                findOne: ()=>Promise.resolve(null)
+            }
+        },
+        user: {
+            id: 'user-id'
+        }
+    });
+const createGenerator = (getStorageClient)=>generateUploadInstructions({
+        collectionPrefix: '',
+        containerName: 'media',
+        getStorageClient
+    });
+describe('generateUploadInstructions', ()=>{
+    it('should use Payload uploads under secure defaults', async ()=>{
+        const getStorageClient = vi.fn();
+        await expect(createGenerator(getStorageClient)({
+            collectionSlug: 'media',
+            filename: 'reference.png',
+            filesize: 1,
+            mimeType: 'image/png',
+            overrideAccess: false,
+            req: createRequest(false)
+        })).rejects.toThrow('Azure client uploads require allowRestrictedFileTypes to be enabled.');
+        expect(getStorageClient).not.toHaveBeenCalled();
+    });
+    it('should generate direct instructions for the explicit opt-out', async ()=>{
+        const credential = new StorageSharedKeyCredential('account', Buffer.alloc(32, 'a').toString('base64'));
+        const getStorageClient = ()=>({
+                credential,
+                getBlobClient: (key)=>({
+                        url: `https://account.blob.core.windows.net/media/${key}`
+                    })
+            });
+        await expect(createGenerator(getStorageClient)({
+            collectionSlug: 'media',
+            filename: 'reference.png',
+            filesize: 1,
+            mimeType: 'image/png',
+            overrideAccess: false,
+            req: createRequest(true)
+        })).resolves.toMatchObject({
+            file: {
+                filename: 'reference.png',
+                mimeType: 'image/png',
+                size: 1
+            },
+            name: 'uploadToAzure',
+            type: 'dispatch'
+        });
+    });
+});
+
+//# sourceMappingURL=generateUploadInstructions.spec.js.map

package/dist/generateUploadInstructions.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/generateUploadInstructions.spec.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\nimport type { PayloadRequest } from 'payload'\n\nimport { StorageSharedKeyCredential } from '@azure/storage-blob'\nimport { describe, expect, it, vi } from 'vitest'\n\nimport { generateUploadInstructions } from './generateUploadInstructions.js'\n\nconst createRequest = (allowRestrictedFileTypes: boolean): PayloadRequest =>\n  ({\n    payload: {\n      collections: {\n        media: {\n          config: {\n            slug: 'media',\n            upload: { allowRestrictedFileTypes },\n          },\n        },\n      },\n      config: { upload: {} },\n      db: { findOne: () => Promise.resolve(null) },\n    },\n    user: { id: 'user-id' },\n  }) as unknown as PayloadRequest\n\nconst createGenerator = (getStorageClient: () => ContainerClient) =>\n  generateUploadInstructions({\n    collectionPrefix: '',\n    containerName: 'media',\n    getStorageClient,\n  })\n\ndescribe('generateUploadInstructions', () => {\n  it('should use Payload uploads under secure defaults', async () => {\n    const getStorageClient = vi.fn()\n\n    await expect(\n      createGenerator(getStorageClient)({\n        collectionSlug: 'media',\n        filename: 'reference.png',\n        filesize: 1,\n        mimeType: 'image/png',\n        overrideAccess: false,\n        req: createRequest(false),\n      }),\n    ).rejects.toThrow('Azure client uploads require allowRestrictedFileTypes to be enabled.')\n\n    expect(getStorageClient).not.toHaveBeenCalled()\n  })\n\n  it('should generate direct instructions for the explicit opt-out', async () => {\n    const credential = new StorageSharedKeyCredential(\n      'account',\n      Buffer.alloc(32, 'a').toString('base64'),\n    )\n    const getStorageClient = () =>\n      ({\n        credential,\n        getBlobClient: (key: string) => ({\n          url: `https://account.blob.core.windows.net/media/${key}`,\n        }),\n      }) as unknown as ContainerClient\n\n    await expect(\n      createGenerator(getStorageClient)({\n        collectionSlug: 'media',\n        filename: 'reference.png',\n        filesize: 1,\n        mimeType: 'image/png',\n        overrideAccess: false,\n        req: createRequest(true),\n      }),\n    ).resolves.toMatchObject({\n      file: {\n        filename: 'reference.png',\n        mimeType: 'image/png',\n        size: 1,\n      },\n      name: 'uploadToAzure',\n      type: 'dispatch',\n    })\n  })\n})\n"],"names":["StorageSharedKeyCredential","describe","expect","it","vi","generateUploadInstructions","createRequest","allowRestrictedFileTypes","payload","collections","media","config","slug","upload","db","findOne","Promise","resolve","user","id","createGenerator","getStorageClient","collectionPrefix","containerName","fn","collectionSlug","filename","filesize","mimeType","overrideAccess","req","rejects","toThrow","not","toHaveBeenCalled","credential","Buffer","alloc","toString","getBlobClient","key","url","resolves","toMatchObject","file","size","name","type"],"mappings":"AAGA,SAASA,0BAA0B,QAAQ,sBAAqB;AAChE,SAASC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,SAASC,0BAA0B,QAAQ,kCAAiC;AAE5E,MAAMC,gBAAgB,CAACC,2BACpB,CAAA;QACCC,SAAS;YACPC,aAAa;gBACXC,OAAO;oBACLC,QAAQ;wBACNC,MAAM;wBACNC,QAAQ;4BAAEN;wBAAyB;oBACrC;gBACF;YACF;YACAI,QAAQ;gBAAEE,QAAQ,CAAC;YAAE;YACrBC,IAAI;gBAAEC,SAAS,IAAMC,QAAQC,OAAO,CAAC;YAAM;QAC7C;QACAC,MAAM;YAAEC,IAAI;QAAU;IACxB,CAAA;AAEF,MAAMC,kBAAkB,CAACC,mBACvBhB,2BAA2B;QACzBiB,kBAAkB;QAClBC,eAAe;QACfF;IACF;AAEFpB,SAAS,8BAA8B;IACrCE,GAAG,oDAAoD;QACrD,MAAMkB,mBAAmBjB,GAAGoB,EAAE;QAE9B,MAAMtB,OACJkB,gBAAgBC,kBAAkB;YAChCI,gBAAgB;YAChBC,UAAU;YACVC,UAAU;YACVC,UAAU;YACVC,gBAAgB;YAChBC,KAAKxB,cAAc;QACrB,IACAyB,OAAO,CAACC,OAAO,CAAC;QAElB9B,OAAOmB,kBAAkBY,GAAG,CAACC,gBAAgB;IAC/C;IAEA/B,GAAG,gEAAgE;QACjE,MAAMgC,aAAa,IAAInC,2BACrB,WACAoC,OAAOC,KAAK,CAAC,IAAI,KAAKC,QAAQ,CAAC;QAEjC,MAAMjB,mBAAmB,IACtB,CAAA;gBACCc;gBACAI,eAAe,CAACC,MAAiB,CAAA;wBAC/BC,KAAK,CAAC,4CAA4C,EAAED,KAAK;oBAC3D,CAAA;YACF,CAAA;QAEF,MAAMtC,OACJkB,gBAAgBC,kBAAkB;YAChCI,gBAAgB;YAChBC,UAAU;YACVC,UAAU;YACVC,UAAU;YACVC,gBAAgB;YAChBC,KAAKxB,cAAc;QACrB,IACAoC,QAAQ,CAACC,aAAa,CAAC;YACvBC,MAAM;gBACJlB,UAAU;gBACVE,UAAU;gBACViB,MAAM;YACR;YACAC,MAAM;YACNC,MAAM;QACR;IACF;AACF"}

package/dist/getFile.d.ts

@@ -1,16 +1,16 @@
 import type { ContainerClient } from '@azure/storage-blob';
-import type { CollectionConfig, PayloadRequest } from 'payload';
+import type { CollectionConfig, PayloadRequest, TypeWithID } from 'payload';
 interface GetFileArgs {
     client: ContainerClient;
     collection: CollectionConfig;
     collectionPrefix?: string;
+    doc?: TypeWithID;
     filename: string;
     incomingHeaders?: Headers;
-    prefixQueryParam?: string;
     req: PayloadRequest;
     uploadReference?: unknown;
     useCompositePrefixes?: boolean;
 }
-export declare function getFile({ client, collection, collectionPrefix, filename, incomingHeaders, prefixQueryParam, req, uploadReference, useCompositePrefixes, }: GetFileArgs): Promise<Response>;
+export declare function getFile({ client, collection, collectionPrefix, doc, filename, incomingHeaders, req, uploadReference, useCompositePrefixes, }: GetFileArgs): Promise<Response>;
 export {};
 //# sourceMappingURL=getFile.d.ts.map

package/dist/getFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../src/getFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA8B,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAU/D,UAAU,WAAW;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAgCD,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,UAAU,EACV,gBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,GAAG,EACH,eAAe,EACf,oBAA4B,GAC7B,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuHjC"}
+{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../src/getFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA8B,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAU3E,UAAU,WAAW;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAgCD,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,UAAU,EACV,gBAAqB,EACrB,GAAG,EACH,QAAQ,EACR,eAAe,EACf,GAAG,EACH,eAAe,EACf,oBAA4B,GAC7B,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyHjC"}

package/dist/getFile.js

@@ -1,6 +1,6 @@
 import { RestError } from '@azure/storage-blob';
-import { getFilePrefix as getDocPrefix, getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
-import { getRangeRequestInfo } from 'payload/internal';
+import { buildStoragePathData, getFilePrefix as getDocPrefix } from '@payloadcms/plugin-cloud-storage/utilities';
+import { getRangeRequestInfo, isXmlMimeType, uploadContentSecurityPolicy } from 'payload/internal';
 const isNodeReadableStream = (body)=>{
     return typeof body === 'object' && body !== null && 'pipe' in body && typeof body.pipe === 'function' && 'destroy' in body && typeof body.destroy === 'function';
 };
@@ -13,7 +13,7 @@ const abortRequestAndDestroyStream = ({ abortController, blob })=>{
         blob.readableStreamBody.destroy();
     }
 };
-export async function getFile({ client, collection, collectionPrefix = '', filename, incomingHeaders, prefixQueryParam, req, uploadReference, useCompositePrefixes = false }) {
+export async function getFile({ client, collection, collectionPrefix = '', doc, filename, incomingHeaders, req, uploadReference, useCompositePrefixes = false }) {
     let blob = undefined;
     let streamed = false;
     const abortController = new AbortController();
@@ -28,18 +28,20 @@ export async function getFile({ client, collection, collectionPrefix = '', filen
     try {
         const docPrefix = await getDocPrefix({
             collection,
+            collectionPrefix,
+            doc,
             filename,
-            prefixQueryParam,
             req,
-            uploadReference
+            uploadReference,
+            useCompositePrefixes
         });
-        const { fileKey } = getFileKey({
+        const { storageFilePath } = buildStoragePathData({
             collectionPrefix,
             docPrefix,
             filename,
             useCompositePrefixes
         });
-        const blockBlobClient = client.getBlockBlobClient(fileKey);
+        const blockBlobClient = client.getBlockBlobClient(storageFilePath);
         // Get file size for range validation
         const properties = await blockBlobClient.getProperties();
         const fileSize = properties.contentLength;
@@ -76,9 +78,9 @@ export async function getFile({ client, collection, collectionPrefix = '', filen
         if (properties.etag) {
             headers.append('ETag', String(properties.etag));
         }
-        // Add Content-Security-Policy header for SVG files to prevent executable code
-        if (properties.contentType === 'image/svg+xml') {
-            headers.append('Content-Security-Policy', "script-src 'none'");
+        // Apply a restrictive policy to XML-family responses served through Payload.
+        if (isXmlMimeType(properties.contentType)) {
+            headers.append('Content-Security-Policy', uploadContentSecurityPolicy);
         }
         const etagFromHeaders = req.headers.get('etag') || req.headers.get('if-none-match');
         if (collection.upload && typeof collection.upload === 'object' && typeof collection.upload.modifyResponseHeaders === 'function') {

package/dist/getFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/getFile.ts"],"sourcesContent":["import type { BlobDownloadResponseParsed, ContainerClient } from '@azure/storage-blob'\nimport type { CollectionConfig, PayloadRequest } from 'payload'\nimport type { Readable } from 'stream'\n\nimport { RestError } from '@azure/storage-blob'\nimport {\n  getFilePrefix as getDocPrefix,\n  getFileKey,\n} from '@payloadcms/plugin-cloud-storage/utilities'\nimport { getRangeRequestInfo } from 'payload/internal'\n\ninterface GetFileArgs {\n  client: ContainerClient\n  collection: CollectionConfig\n  collectionPrefix?: string\n  filename: string\n  incomingHeaders?: Headers\n  prefixQueryParam?: string\n  req: PayloadRequest\n  uploadReference?: unknown\n  useCompositePrefixes?: boolean\n}\n\nconst isNodeReadableStream = (\n  body: BlobDownloadResponseParsed['readableStreamBody'],\n): body is Readable => {\n  return (\n    typeof body === 'object' &&\n    body !== null &&\n    'pipe' in body &&\n    typeof body.pipe === 'function' &&\n    'destroy' in body &&\n    typeof body.destroy === 'function'\n  )\n}\n\nconst abortRequestAndDestroyStream = ({\n  abortController,\n  blob,\n}: {\n  abortController: AbortController\n  blob?: BlobDownloadResponseParsed\n}) => {\n  try {\n    abortController.abort()\n  } catch {\n    /* noop */\n  }\n  if (blob?.readableStreamBody && isNodeReadableStream(blob.readableStreamBody)) {\n    blob.readableStreamBody.destroy()\n  }\n}\n\nexport async function getFile({\n  client,\n  collection,\n  collectionPrefix = '',\n  filename,\n  incomingHeaders,\n  prefixQueryParam,\n  req,\n  uploadReference,\n  useCompositePrefixes = false,\n}: GetFileArgs): Promise<Response> {\n  let blob: BlobDownloadResponseParsed | undefined = undefined\n  let streamed = false\n\n  const abortController = new AbortController()\n  if (req.signal) {\n    req.signal.addEventListener('abort', () => {\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n  }\n\n  try {\n    const docPrefix = await getDocPrefix({\n      collection,\n      filename,\n      prefixQueryParam,\n      req,\n      uploadReference,\n    })\n\n    const { fileKey } = getFileKey({\n      collectionPrefix,\n      docPrefix,\n      filename,\n      useCompositePrefixes,\n    })\n\n    const blockBlobClient = client.getBlockBlobClient(fileKey)\n\n    // Get file size for range validation\n    const properties = await blockBlobClient.getProperties()\n    const fileSize = properties.contentLength\n\n    if (!fileSize) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    // Handle range request\n    const rangeHeader = req.headers.get('range')\n    const rangeResult = getRangeRequestInfo({ fileSize, rangeHeader })\n\n    if (rangeResult.type === 'invalid') {\n      return new Response(null, {\n        headers: new Headers(rangeResult.headers),\n        status: rangeResult.status,\n      })\n    }\n\n    // Download with range if partial\n    blob =\n      rangeResult.type === 'partial'\n        ? await blockBlobClient.download(\n            rangeResult.rangeStart,\n            rangeResult.rangeEnd - rangeResult.rangeStart + 1,\n            { abortSignal: abortController.signal },\n          )\n        : await blockBlobClient.download(0, undefined, { abortSignal: abortController.signal })\n\n    let headers = new Headers(incomingHeaders)\n\n    // Add range-related headers from the result\n    for (const [key, value] of Object.entries(rangeResult.headers)) {\n      headers.append(key, value)\n    }\n\n    // Add Azure-specific headers\n    headers.append('Content-Type', String(properties.contentType))\n    if (properties.etag) {\n      headers.append('ETag', String(properties.etag))\n    }\n\n    // Add Content-Security-Policy header for SVG files to prevent executable code\n    if (properties.contentType === 'image/svg+xml') {\n      headers.append('Content-Security-Policy', \"script-src 'none'\")\n    }\n\n    const etagFromHeaders = req.headers.get('etag') || req.headers.get('if-none-match')\n\n    if (\n      collection.upload &&\n      typeof collection.upload === 'object' &&\n      typeof collection.upload.modifyResponseHeaders === 'function'\n    ) {\n      headers = collection.upload.modifyResponseHeaders({ headers }) || headers\n    }\n\n    if (etagFromHeaders && etagFromHeaders === properties.etag) {\n      return new Response(null, {\n        headers,\n        status: 304,\n      })\n    }\n\n    if (!blob.readableStreamBody || !isNodeReadableStream(blob.readableStreamBody)) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    const stream = blob.readableStreamBody\n    stream.on('error', (err: Error) => {\n      req.payload.logger.error({\n        err,\n        msg: 'Error while streaming Azure blob (aborting)',\n      })\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n\n    streamed = true\n    return new Response(stream, { headers, status: rangeResult.status })\n  } catch (err: unknown) {\n    if (err instanceof RestError && err.statusCode === 404) {\n      return new Response(null, { status: 404, statusText: 'Not Found' })\n    }\n    req.payload.logger.error(err)\n    return new Response('Internal Server Error', { status: 500 })\n  } finally {\n    if (!streamed) {\n      abortRequestAndDestroyStream({ abortController, blob })\n    }\n  }\n}\n"],"names":["RestError","getFilePrefix","getDocPrefix","getFileKey","getRangeRequestInfo","isNodeReadableStream","body","pipe","destroy","abortRequestAndDestroyStream","abortController","blob","abort","readableStreamBody","getFile","client","collection","collectionPrefix","filename","incomingHeaders","prefixQueryParam","req","uploadReference","useCompositePrefixes","undefined","streamed","AbortController","signal","addEventListener","docPrefix","fileKey","blockBlobClient","getBlockBlobClient","properties","getProperties","fileSize","contentLength","Response","status","rangeHeader","headers","get","rangeResult","type","Headers","download","rangeStart","rangeEnd","abortSignal","key","value","Object","entries","append","String","contentType","etag","etagFromHeaders","upload","modifyResponseHeaders","stream","on","err","payload","logger","error","msg","statusCode","statusText"],"mappings":"AAIA,SAASA,SAAS,QAAQ,sBAAqB;AAC/C,SACEC,iBAAiBC,YAAY,EAC7BC,UAAU,QACL,6CAA4C;AACnD,SAASC,mBAAmB,QAAQ,mBAAkB;AActD,MAAMC,uBAAuB,CAC3BC;IAEA,OACE,OAAOA,SAAS,YAChBA,SAAS,QACT,UAAUA,QACV,OAAOA,KAAKC,IAAI,KAAK,cACrB,aAAaD,QACb,OAAOA,KAAKE,OAAO,KAAK;AAE5B;AAEA,MAAMC,+BAA+B,CAAC,EACpCC,eAAe,EACfC,IAAI,EAIL;IACC,IAAI;QACFD,gBAAgBE,KAAK;IACvB,EAAE,OAAM;IACN,QAAQ,GACV;IACA,IAAID,MAAME,sBAAsBR,qBAAqBM,KAAKE,kBAAkB,GAAG;QAC7EF,KAAKE,kBAAkB,CAACL,OAAO;IACjC;AACF;AAEA,OAAO,eAAeM,QAAQ,EAC5BC,MAAM,EACNC,UAAU,EACVC,mBAAmB,EAAE,EACrBC,QAAQ,EACRC,eAAe,EACfC,gBAAgB,EAChBC,GAAG,EACHC,eAAe,EACfC,uBAAuB,KAAK,EAChB;IACZ,IAAIZ,OAA+Ca;IACnD,IAAIC,WAAW;IAEf,MAAMf,kBAAkB,IAAIgB;IAC5B,IAAIL,IAAIM,MAAM,EAAE;QACdN,IAAIM,MAAM,CAACC,gBAAgB,CAAC,SAAS;YACnCnB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;IAEA,IAAI;QACF,MAAMkB,YAAY,MAAM3B,aAAa;YACnCc;YACAE;YACAE;YACAC;YACAC;QACF;QAEA,MAAM,EAAEQ,OAAO,EAAE,GAAG3B,WAAW;YAC7Bc;YACAY;YACAX;YACAK;QACF;QAEA,MAAMQ,kBAAkBhB,OAAOiB,kBAAkB,CAACF;QAElD,qCAAqC;QACrC,MAAMG,aAAa,MAAMF,gBAAgBG,aAAa;QACtD,MAAMC,WAAWF,WAAWG,aAAa;QAEzC,IAAI,CAACD,UAAU;YACb,OAAO,IAAIE,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,uBAAuB;QACvB,MAAMC,cAAclB,IAAImB,OAAO,CAACC,GAAG,CAAC;QACpC,MAAMC,cAActC,oBAAoB;YAAE+B;YAAUI;QAAY;QAEhE,IAAIG,YAAYC,IAAI,KAAK,WAAW;YAClC,OAAO,IAAIN,SAAS,MAAM;gBACxBG,SAAS,IAAII,QAAQF,YAAYF,OAAO;gBACxCF,QAAQI,YAAYJ,MAAM;YAC5B;QACF;QAEA,iCAAiC;QACjC3B,OACE+B,YAAYC,IAAI,KAAK,YACjB,MAAMZ,gBAAgBc,QAAQ,CAC5BH,YAAYI,UAAU,EACtBJ,YAAYK,QAAQ,GAAGL,YAAYI,UAAU,GAAG,GAChD;YAAEE,aAAatC,gBAAgBiB,MAAM;QAAC,KAExC,MAAMI,gBAAgBc,QAAQ,CAAC,GAAGrB,WAAW;YAAEwB,aAAatC,gBAAgBiB,MAAM;QAAC;QAEzF,IAAIa,UAAU,IAAII,QAAQzB;QAE1B,4CAA4C;QAC5C,KAAK,MAAM,CAAC8B,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACV,YAAYF,OAAO,EAAG;YAC9DA,QAAQa,MAAM,CAACJ,KAAKC;QACtB;QAEA,6BAA6B;QAC7BV,QAAQa,MAAM,CAAC,gBAAgBC,OAAOrB,WAAWsB,WAAW;QAC5D,IAAItB,WAAWuB,IAAI,EAAE;YACnBhB,QAAQa,MAAM,CAAC,QAAQC,OAAOrB,WAAWuB,IAAI;QAC/C;QAEA,8EAA8E;QAC9E,IAAIvB,WAAWsB,WAAW,KAAK,iBAAiB;YAC9Cf,QAAQa,MAAM,CAAC,2BAA2B;QAC5C;QAEA,MAAMI,kBAAkBpC,IAAImB,OAAO,CAACC,GAAG,CAAC,WAAWpB,IAAImB,OAAO,CAACC,GAAG,CAAC;QAEnE,IACEzB,WAAW0C,MAAM,IACjB,OAAO1C,WAAW0C,MAAM,KAAK,YAC7B,OAAO1C,WAAW0C,MAAM,CAACC,qBAAqB,KAAK,YACnD;YACAnB,UAAUxB,WAAW0C,MAAM,CAACC,qBAAqB,CAAC;gBAAEnB;YAAQ,MAAMA;QACpE;QAEA,IAAIiB,mBAAmBA,oBAAoBxB,WAAWuB,IAAI,EAAE;YAC1D,OAAO,IAAInB,SAAS,MAAM;gBACxBG;gBACAF,QAAQ;YACV;QACF;QAEA,IAAI,CAAC3B,KAAKE,kBAAkB,IAAI,CAACR,qBAAqBM,KAAKE,kBAAkB,GAAG;YAC9E,OAAO,IAAIwB,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMsB,SAASjD,KAAKE,kBAAkB;QACtC+C,OAAOC,EAAE,CAAC,SAAS,CAACC;YAClBzC,IAAI0C,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;gBACvBH;gBACAI,KAAK;YACP;YACAzD,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;QAEAc,WAAW;QACX,OAAO,IAAIY,SAASuB,QAAQ;YAAEpB;YAASF,QAAQI,YAAYJ,MAAM;QAAC;IACpE,EAAE,OAAOwB,KAAc;QACrB,IAAIA,eAAe9D,aAAa8D,IAAIK,UAAU,KAAK,KAAK;YACtD,OAAO,IAAI9B,SAAS,MAAM;gBAAEC,QAAQ;gBAAK8B,YAAY;YAAY;QACnE;QACA/C,IAAI0C,OAAO,CAACC,MAAM,CAACC,KAAK,CAACH;QACzB,OAAO,IAAIzB,SAAS,yBAAyB;YAAEC,QAAQ;QAAI;IAC7D,SAAU;QACR,IAAI,CAACb,UAAU;YACbhB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;AACF"}
+{"version":3,"sources":["../src/getFile.ts"],"sourcesContent":["import type { BlobDownloadResponseParsed, ContainerClient } from '@azure/storage-blob'\nimport type { CollectionConfig, PayloadRequest, TypeWithID } from 'payload'\nimport type { Readable } from 'stream'\n\nimport { RestError } from '@azure/storage-blob'\nimport {\n  buildStoragePathData,\n  getFilePrefix as getDocPrefix,\n} from '@payloadcms/plugin-cloud-storage/utilities'\nimport { getRangeRequestInfo, isXmlMimeType, uploadContentSecurityPolicy } from 'payload/internal'\n\ninterface GetFileArgs {\n  client: ContainerClient\n  collection: CollectionConfig\n  collectionPrefix?: string\n  doc?: TypeWithID\n  filename: string\n  incomingHeaders?: Headers\n  req: PayloadRequest\n  uploadReference?: unknown\n  useCompositePrefixes?: boolean\n}\n\nconst isNodeReadableStream = (\n  body: BlobDownloadResponseParsed['readableStreamBody'],\n): body is Readable => {\n  return (\n    typeof body === 'object' &&\n    body !== null &&\n    'pipe' in body &&\n    typeof body.pipe === 'function' &&\n    'destroy' in body &&\n    typeof body.destroy === 'function'\n  )\n}\n\nconst abortRequestAndDestroyStream = ({\n  abortController,\n  blob,\n}: {\n  abortController: AbortController\n  blob?: BlobDownloadResponseParsed\n}) => {\n  try {\n    abortController.abort()\n  } catch {\n    /* noop */\n  }\n  if (blob?.readableStreamBody && isNodeReadableStream(blob.readableStreamBody)) {\n    blob.readableStreamBody.destroy()\n  }\n}\n\nexport async function getFile({\n  client,\n  collection,\n  collectionPrefix = '',\n  doc,\n  filename,\n  incomingHeaders,\n  req,\n  uploadReference,\n  useCompositePrefixes = false,\n}: GetFileArgs): Promise<Response> {\n  let blob: BlobDownloadResponseParsed | undefined = undefined\n  let streamed = false\n\n  const abortController = new AbortController()\n  if (req.signal) {\n    req.signal.addEventListener('abort', () => {\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n  }\n\n  try {\n    const docPrefix = await getDocPrefix({\n      collection,\n      collectionPrefix,\n      doc,\n      filename,\n      req,\n      uploadReference,\n      useCompositePrefixes,\n    })\n\n    const { storageFilePath } = buildStoragePathData({\n      collectionPrefix,\n      docPrefix,\n      filename,\n      useCompositePrefixes,\n    })\n\n    const blockBlobClient = client.getBlockBlobClient(storageFilePath)\n\n    // Get file size for range validation\n    const properties = await blockBlobClient.getProperties()\n    const fileSize = properties.contentLength\n\n    if (!fileSize) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    // Handle range request\n    const rangeHeader = req.headers.get('range')\n    const rangeResult = getRangeRequestInfo({ fileSize, rangeHeader })\n\n    if (rangeResult.type === 'invalid') {\n      return new Response(null, {\n        headers: new Headers(rangeResult.headers),\n        status: rangeResult.status,\n      })\n    }\n\n    // Download with range if partial\n    blob =\n      rangeResult.type === 'partial'\n        ? await blockBlobClient.download(\n            rangeResult.rangeStart,\n            rangeResult.rangeEnd - rangeResult.rangeStart + 1,\n            { abortSignal: abortController.signal },\n          )\n        : await blockBlobClient.download(0, undefined, { abortSignal: abortController.signal })\n\n    let headers = new Headers(incomingHeaders)\n\n    // Add range-related headers from the result\n    for (const [key, value] of Object.entries(rangeResult.headers)) {\n      headers.append(key, value)\n    }\n\n    // Add Azure-specific headers\n    headers.append('Content-Type', String(properties.contentType))\n    if (properties.etag) {\n      headers.append('ETag', String(properties.etag))\n    }\n\n    // Apply a restrictive policy to XML-family responses served through Payload.\n    if (isXmlMimeType(properties.contentType)) {\n      headers.append('Content-Security-Policy', uploadContentSecurityPolicy)\n    }\n\n    const etagFromHeaders = req.headers.get('etag') || req.headers.get('if-none-match')\n\n    if (\n      collection.upload &&\n      typeof collection.upload === 'object' &&\n      typeof collection.upload.modifyResponseHeaders === 'function'\n    ) {\n      headers = collection.upload.modifyResponseHeaders({ headers }) || headers\n    }\n\n    if (etagFromHeaders && etagFromHeaders === properties.etag) {\n      return new Response(null, {\n        headers,\n        status: 304,\n      })\n    }\n\n    if (!blob.readableStreamBody || !isNodeReadableStream(blob.readableStreamBody)) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    const stream = blob.readableStreamBody\n    stream.on('error', (err: Error) => {\n      req.payload.logger.error({\n        err,\n        msg: 'Error while streaming Azure blob (aborting)',\n      })\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n\n    streamed = true\n    return new Response(stream, { headers, status: rangeResult.status })\n  } catch (err: unknown) {\n    if (err instanceof RestError && err.statusCode === 404) {\n      return new Response(null, { status: 404, statusText: 'Not Found' })\n    }\n    req.payload.logger.error(err)\n    return new Response('Internal Server Error', { status: 500 })\n  } finally {\n    if (!streamed) {\n      abortRequestAndDestroyStream({ abortController, blob })\n    }\n  }\n}\n"],"names":["RestError","buildStoragePathData","getFilePrefix","getDocPrefix","getRangeRequestInfo","isXmlMimeType","uploadContentSecurityPolicy","isNodeReadableStream","body","pipe","destroy","abortRequestAndDestroyStream","abortController","blob","abort","readableStreamBody","getFile","client","collection","collectionPrefix","doc","filename","incomingHeaders","req","uploadReference","useCompositePrefixes","undefined","streamed","AbortController","signal","addEventListener","docPrefix","storageFilePath","blockBlobClient","getBlockBlobClient","properties","getProperties","fileSize","contentLength","Response","status","rangeHeader","headers","get","rangeResult","type","Headers","download","rangeStart","rangeEnd","abortSignal","key","value","Object","entries","append","String","contentType","etag","etagFromHeaders","upload","modifyResponseHeaders","stream","on","err","payload","logger","error","msg","statusCode","statusText"],"mappings":"AAIA,SAASA,SAAS,QAAQ,sBAAqB;AAC/C,SACEC,oBAAoB,EACpBC,iBAAiBC,YAAY,QACxB,6CAA4C;AACnD,SAASC,mBAAmB,EAAEC,aAAa,EAAEC,2BAA2B,QAAQ,mBAAkB;AAclG,MAAMC,uBAAuB,CAC3BC;IAEA,OACE,OAAOA,SAAS,YAChBA,SAAS,QACT,UAAUA,QACV,OAAOA,KAAKC,IAAI,KAAK,cACrB,aAAaD,QACb,OAAOA,KAAKE,OAAO,KAAK;AAE5B;AAEA,MAAMC,+BAA+B,CAAC,EACpCC,eAAe,EACfC,IAAI,EAIL;IACC,IAAI;QACFD,gBAAgBE,KAAK;IACvB,EAAE,OAAM;IACN,QAAQ,GACV;IACA,IAAID,MAAME,sBAAsBR,qBAAqBM,KAAKE,kBAAkB,GAAG;QAC7EF,KAAKE,kBAAkB,CAACL,OAAO;IACjC;AACF;AAEA,OAAO,eAAeM,QAAQ,EAC5BC,MAAM,EACNC,UAAU,EACVC,mBAAmB,EAAE,EACrBC,GAAG,EACHC,QAAQ,EACRC,eAAe,EACfC,GAAG,EACHC,eAAe,EACfC,uBAAuB,KAAK,EAChB;IACZ,IAAIZ,OAA+Ca;IACnD,IAAIC,WAAW;IAEf,MAAMf,kBAAkB,IAAIgB;IAC5B,IAAIL,IAAIM,MAAM,EAAE;QACdN,IAAIM,MAAM,CAACC,gBAAgB,CAAC,SAAS;YACnCnB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;IAEA,IAAI;QACF,MAAMkB,YAAY,MAAM5B,aAAa;YACnCe;YACAC;YACAC;YACAC;YACAE;YACAC;YACAC;QACF;QAEA,MAAM,EAAEO,eAAe,EAAE,GAAG/B,qBAAqB;YAC/CkB;YACAY;YACAV;YACAI;QACF;QAEA,MAAMQ,kBAAkBhB,OAAOiB,kBAAkB,CAACF;QAElD,qCAAqC;QACrC,MAAMG,aAAa,MAAMF,gBAAgBG,aAAa;QACtD,MAAMC,WAAWF,WAAWG,aAAa;QAEzC,IAAI,CAACD,UAAU;YACb,OAAO,IAAIE,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,uBAAuB;QACvB,MAAMC,cAAclB,IAAImB,OAAO,CAACC,GAAG,CAAC;QACpC,MAAMC,cAAcxC,oBAAoB;YAAEiC;YAAUI;QAAY;QAEhE,IAAIG,YAAYC,IAAI,KAAK,WAAW;YAClC,OAAO,IAAIN,SAAS,MAAM;gBACxBG,SAAS,IAAII,QAAQF,YAAYF,OAAO;gBACxCF,QAAQI,YAAYJ,MAAM;YAC5B;QACF;QAEA,iCAAiC;QACjC3B,OACE+B,YAAYC,IAAI,KAAK,YACjB,MAAMZ,gBAAgBc,QAAQ,CAC5BH,YAAYI,UAAU,EACtBJ,YAAYK,QAAQ,GAAGL,YAAYI,UAAU,GAAG,GAChD;YAAEE,aAAatC,gBAAgBiB,MAAM;QAAC,KAExC,MAAMI,gBAAgBc,QAAQ,CAAC,GAAGrB,WAAW;YAAEwB,aAAatC,gBAAgBiB,MAAM;QAAC;QAEzF,IAAIa,UAAU,IAAII,QAAQxB;QAE1B,4CAA4C;QAC5C,KAAK,MAAM,CAAC6B,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACV,YAAYF,OAAO,EAAG;YAC9DA,QAAQa,MAAM,CAACJ,KAAKC;QACtB;QAEA,6BAA6B;QAC7BV,QAAQa,MAAM,CAAC,gBAAgBC,OAAOrB,WAAWsB,WAAW;QAC5D,IAAItB,WAAWuB,IAAI,EAAE;YACnBhB,QAAQa,MAAM,CAAC,QAAQC,OAAOrB,WAAWuB,IAAI;QAC/C;QAEA,6EAA6E;QAC7E,IAAIrD,cAAc8B,WAAWsB,WAAW,GAAG;YACzCf,QAAQa,MAAM,CAAC,2BAA2BjD;QAC5C;QAEA,MAAMqD,kBAAkBpC,IAAImB,OAAO,CAACC,GAAG,CAAC,WAAWpB,IAAImB,OAAO,CAACC,GAAG,CAAC;QAEnE,IACEzB,WAAW0C,MAAM,IACjB,OAAO1C,WAAW0C,MAAM,KAAK,YAC7B,OAAO1C,WAAW0C,MAAM,CAACC,qBAAqB,KAAK,YACnD;YACAnB,UAAUxB,WAAW0C,MAAM,CAACC,qBAAqB,CAAC;gBAAEnB;YAAQ,MAAMA;QACpE;QAEA,IAAIiB,mBAAmBA,oBAAoBxB,WAAWuB,IAAI,EAAE;YAC1D,OAAO,IAAInB,SAAS,MAAM;gBACxBG;gBACAF,QAAQ;YACV;QACF;QAEA,IAAI,CAAC3B,KAAKE,kBAAkB,IAAI,CAACR,qBAAqBM,KAAKE,kBAAkB,GAAG;YAC9E,OAAO,IAAIwB,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMsB,SAASjD,KAAKE,kBAAkB;QACtC+C,OAAOC,EAAE,CAAC,SAAS,CAACC;YAClBzC,IAAI0C,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;gBACvBH;gBACAI,KAAK;YACP;YACAzD,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;QAEAc,WAAW;QACX,OAAO,IAAIY,SAASuB,QAAQ;YAAEpB;YAASF,QAAQI,YAAYJ,MAAM;QAAC;IACpE,EAAE,OAAOwB,KAAc;QACrB,IAAIA,eAAehE,aAAagE,IAAIK,UAAU,KAAK,KAAK;YACtD,OAAO,IAAI9B,SAAS,MAAM;gBAAEC,QAAQ;gBAAK8B,YAAY;YAAY;QACnE;QACA/C,IAAI0C,OAAO,CAACC,MAAM,CAACC,KAAK,CAACH;QACzB,OAAO,IAAIzB,SAAS,yBAAyB;YAAEC,QAAQ;QAAI;IAC7D,SAAU;QACR,IAAI,CAACb,UAAU;YACbhB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;AACF"}

package/dist/index.d.ts

@@ -47,6 +47,21 @@ export type AzureStorageOptions = {
      * Azure Blob storage connection string
      */
     connectionString: string;
+    /**
+     * Public access level applied to a container that the plugin creates via
+     * `allowContainerCreate`. Has no effect on containers that already exist.
+     *
+     * - `'private'` (default): no anonymous access. Blobs are reachable only
+     *   through Payload's access-controlled file route.
+     * - `'blob'`: unauthenticated clients can read any blob directly from Azure.
+     * - `'container'`: unauthenticated clients can read and list blobs directly.
+     *
+     * Only choose `'blob'` or `'container'` if you deliberately want files served
+     * publicly from Azure, bypassing Payload read access control.
+     *
+     * @default 'private'
+     */
+    containerAccess?: 'blob' | 'container' | 'private';
     /**
      * Azure Blob storage container name
      */
@@ -59,14 +74,15 @@ export type AzureStorageOptions = {
     enabled?: boolean;
     /**
      * When true, the collection-level prefix and document-level prefix are combined
-     * (compositional). When false (default), document prefix overrides collection
-     * prefix entirely.
+     * (compositional). When false (default), a document prefix already within the
+     * collection prefix is used as-is for new uploads; otherwise it is nested beneath it.
+     * Existing files retain their stored prefixes for reads, URLs, and cleanup.
      *
-     * Example:
-     * - collection prefix: `collection-prefix/`
-     * - document prefix: `document-prefix/`
-     * - resulting prefix with useCompositePrefixes=true: `collection-prefix/document-prefix/`
-     * - resulting prefix with useCompositePrefixes=false: `document-prefix/`
+     * Example with a document prefix already contained by the collection prefix:
+     * - collection prefix: `uploads/`
+     * - document prefix: `uploads/documents/`
+     * - resulting prefix with useCompositePrefixes=true: `uploads/uploads/documents/`
+     * - resulting prefix with useCompositePrefixes=false: `uploads/documents/`
      *
      * @default false
      */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEnB,iBAAiB,EAClB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,KAAK,EAAU,cAAc,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAK3E,OAAO,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEtF,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IAEnC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;IAE7F;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED,KAAK,mBAAmB,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,KAAK,cAAc,CAAA;AAEpF,eAAO,MAAM,YAAY,EAAE,mBA2EzB,CAAA;AAEF,OAAO,EAAE,oBAAoB,IAAI,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEnB,iBAAiB,EAClB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,KAAK,EAAU,cAAc,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAK3E,OAAO,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEtF,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IAEnC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;IAE7F;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAA;IAExB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAA;IAElD;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED,KAAK,mBAAmB,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,KAAK,cAAc,CAAA;AAEpF,eAAO,MAAM,YAAY,EAAE,mBAkFzB,CAAA;AAEF,OAAO,EAAE,oBAAoB,IAAI,gBAAgB,EAAE,CAAA"}

package/dist/index.js

@@ -13,13 +13,20 @@ export const azureStorage = (azureStorageOptions)=>({
             if (isPluginDisabled) {
                 return incomingConfig;
             }
-            const createContainerIfNotExists = ()=>{
-                void getStorageClientFunc({
+            const createContainerIfNotExists = async ()=>{
+                const containerClient = getStorageClientFunc({
                     connectionString: azureStorageOptions.connectionString,
                     containerName: azureStorageOptions.containerName
-                }).createIfNotExists({
-                    access: 'blob'
                 });
+                // Private by default; public access is opt-in via `containerAccess`.
+                const containerAccess = azureStorageOptions.containerAccess ?? 'private';
+                if (containerAccess === 'private') {
+                    await containerClient.createIfNotExists();
+                } else {
+                    await containerClient.createIfNotExists({
+                        access: containerAccess
+                    });
+                }
             };
             const adapter = createAzureAdapter({
                 allowContainerCreate: azureStorageOptions.allowContainerCreate,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  ClientUploadsConfig,\n  PluginOptions as CloudStoragePluginOptions,\n  CollectionOptions,\n} from '@payloadcms/plugin-cloud-storage/types'\nimport type { Config, StorageAdapter, UploadCollectionSlug } from 'payload'\n\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\n\nimport { createAzureAdapter } from './adapter.js'\nimport { getStorageClient as getStorageClientFunc } from './utils/getStorageClient.js'\n\nexport type AzureStorageOptions = {\n  /**\n   * Whether or not to allow the container to be created if it does not exist\n   *\n   * @default false\n   */\n  allowContainerCreate: boolean\n\n  /**\n   * When enabled, fields (like the prefix field) will always be inserted into\n   * the collection schema regardless of whether the plugin is enabled. This\n   * ensures a consistent schema across all environments.\n   *\n   * This will be enabled by default in Payload v4.\n   *\n   * @default false\n   */\n  alwaysInsertFields?: boolean\n\n  /**\n   * Base URL for the Azure Blob storage account\n   */\n  baseURL: string\n\n  /**\n   * Optional cache key to identify the Azure Blob storage client instance.\n   * If not provided, a default key will be used.\n   *\n   * @default `azure:containerName`\n   */\n  clientCacheKey?: string\n\n  /**\n   * Do uploads directly on the client to bypass limits on Vercel.\n   *\n   * Client uploads use the Azure Blob SDK, which splits large files into blocks\n   * (avoiding the ~5GB limit of a single upload request). The SDK sends `x-ms-*`\n   * headers, so the browser issues a CORS preflight: your storage account's CORS\n   * rules must allow the `OPTIONS` and `PUT` methods and the required headers\n   * (allowed headers `*`, or at minimum `x-ms-*,content-type,content-length`).\n   */\n  clientUploads?: ClientUploadsConfig\n\n  /**\n   * Collection options to apply the Azure Blob adapter to.\n   */\n  collections: Partial<Record<UploadCollectionSlug, Omit<CollectionOptions, 'adapter'> | true>>\n\n  /**\n   * Azure Blob storage connection string\n   */\n  connectionString: string\n\n  /**\n   * Azure Blob storage container name\n   */\n  containerName: string\n\n  /**\n   * Whether or not to enable the plugin\n   *\n   * Default: true\n   */\n  enabled?: boolean\n  /**\n   * When true, the collection-level prefix and document-level prefix are combined\n   * (compositional). When false (default), document prefix overrides collection\n   * prefix entirely.\n   *\n   * Example:\n   * - collection prefix: `collection-prefix/`\n   * - document prefix: `document-prefix/`\n   * - resulting prefix with useCompositePrefixes=true: `collection-prefix/document-prefix/`\n   * - resulting prefix with useCompositePrefixes=false: `document-prefix/`\n   *\n   * @default false\n   */\n  useCompositePrefixes?: boolean\n}\n\ntype AzureStorageFactory = (azureStorageArgs: AzureStorageOptions) => StorageAdapter\n\nexport const azureStorage: AzureStorageFactory = (\n  azureStorageOptions: AzureStorageOptions,\n): StorageAdapter => ({\n  name: 'azure',\n  collections: Object.keys(azureStorageOptions.collections),\n  init: (incomingConfig: Config): Config => {\n    const getStorageClient = () =>\n      getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      })\n\n    const isPluginDisabled = azureStorageOptions.enabled === false\n\n    if (isPluginDisabled) {\n      return incomingConfig\n    }\n\n    const createContainerIfNotExists = () => {\n      void getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      }).createIfNotExists({\n        access: 'blob',\n      })\n    }\n\n    const adapter = createAzureAdapter({\n      allowContainerCreate: azureStorageOptions.allowContainerCreate,\n      baseURL: azureStorageOptions.baseURL,\n      clientUploads: azureStorageOptions.clientUploads,\n      containerName: azureStorageOptions.containerName,\n      createContainerIfNotExists,\n      getStorageClient,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })\n\n    // Add adapter to each collection option object\n    const collectionsWithAdapter: CloudStoragePluginOptions['collections'] = Object.entries(\n      azureStorageOptions.collections,\n    ).reduce(\n      (acc, [slug, collOptions]) => ({\n        ...acc,\n        [slug]: {\n          ...(collOptions === true ? {} : collOptions),\n          adapter,\n        },\n      }),\n      {} as Record<string, CollectionOptions>,\n    )\n\n    // Set disableLocalStorage: true for collections specified in the plugin options\n    const config = {\n      ...incomingConfig,\n      collections: (incomingConfig.collections || []).map((collection) => {\n        if (!collectionsWithAdapter[collection.slug]) {\n          return collection\n        }\n\n        return {\n          ...collection,\n          upload: {\n            ...(typeof collection.upload === 'object' ? collection.upload : {}),\n            disableLocalStorage: true,\n          },\n        }\n      }),\n    }\n\n    return cloudStoragePlugin({\n      alwaysInsertFields: azureStorageOptions.alwaysInsertFields,\n      collections: collectionsWithAdapter,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })(config)\n  },\n})\n\nexport { getStorageClientFunc as getStorageClient }\n"],"names":["cloudStoragePlugin","createAzureAdapter","getStorageClient","getStorageClientFunc","azureStorage","azureStorageOptions","name","collections","Object","keys","init","incomingConfig","connectionString","containerName","isPluginDisabled","enabled","createContainerIfNotExists","createIfNotExists","access","adapter","allowContainerCreate","baseURL","clientUploads","useCompositePrefixes","collectionsWithAdapter","entries","reduce","acc","slug","collOptions","config","map","collection","upload","disableLocalStorage","alwaysInsertFields"],"mappings":"AAOA,SAASA,kBAAkB,QAAQ,mCAAkC;AAErE,SAASC,kBAAkB,QAAQ,eAAc;AACjD,SAASC,oBAAoBC,oBAAoB,QAAQ,8BAA6B;AAoFtF,OAAO,MAAMC,eAAoC,CAC/CC,sBACoB,CAAA;QACpBC,MAAM;QACNC,aAAaC,OAAOC,IAAI,CAACJ,oBAAoBE,WAAW;QACxDG,MAAM,CAACC;YACL,MAAMT,mBAAmB,IACvBC,qBAAqB;oBACnBS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD;YAEF,MAAMC,mBAAmBT,oBAAoBU,OAAO,KAAK;YAEzD,IAAID,kBAAkB;gBACpB,OAAOH;YACT;YAEA,MAAMK,6BAA6B;gBACjC,KAAKb,qBAAqB;oBACxBS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD,GAAGI,iBAAiB,CAAC;oBACnBC,QAAQ;gBACV;YACF;YAEA,MAAMC,UAAUlB,mBAAmB;gBACjCmB,sBAAsBf,oBAAoBe,oBAAoB;gBAC9DC,SAAShB,oBAAoBgB,OAAO;gBACpCC,eAAejB,oBAAoBiB,aAAa;gBAChDT,eAAeR,oBAAoBQ,aAAa;gBAChDG;gBACAd;gBACAqB,sBAAsBlB,oBAAoBkB,oBAAoB;YAChE;YAEA,+CAA+C;YAC/C,MAAMC,yBAAmEhB,OAAOiB,OAAO,CACrFpB,oBAAoBE,WAAW,EAC/BmB,MAAM,CACN,CAACC,KAAK,CAACC,MAAMC,YAAY,GAAM,CAAA;oBAC7B,GAAGF,GAAG;oBACN,CAACC,KAAK,EAAE;wBACN,GAAIC,gBAAgB,OAAO,CAAC,IAAIA,WAAW;wBAC3CV;oBACF;gBACF,CAAA,GACA,CAAC;YAGH,gFAAgF;YAChF,MAAMW,SAAS;gBACb,GAAGnB,cAAc;gBACjBJ,aAAa,AAACI,CAAAA,eAAeJ,WAAW,IAAI,EAAE,AAAD,EAAGwB,GAAG,CAAC,CAACC;oBACnD,IAAI,CAACR,sBAAsB,CAACQ,WAAWJ,IAAI,CAAC,EAAE;wBAC5C,OAAOI;oBACT;oBAEA,OAAO;wBACL,GAAGA,UAAU;wBACbC,QAAQ;4BACN,GAAI,OAAOD,WAAWC,MAAM,KAAK,WAAWD,WAAWC,MAAM,GAAG,CAAC,CAAC;4BAClEC,qBAAqB;wBACvB;oBACF;gBACF;YACF;YAEA,OAAOlC,mBAAmB;gBACxBmC,oBAAoB9B,oBAAoB8B,kBAAkB;gBAC1D5B,aAAaiB;gBACbD,sBAAsBlB,oBAAoBkB,oBAAoB;YAChE,GAAGO;QACL;IACF,CAAA,EAAE;AAEF,SAAS3B,wBAAwBD,gBAAgB,GAAE"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  ClientUploadsConfig,\n  PluginOptions as CloudStoragePluginOptions,\n  CollectionOptions,\n} from '@payloadcms/plugin-cloud-storage/types'\nimport type { Config, StorageAdapter, UploadCollectionSlug } from 'payload'\n\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\n\nimport { createAzureAdapter } from './adapter.js'\nimport { getStorageClient as getStorageClientFunc } from './utils/getStorageClient.js'\n\nexport type AzureStorageOptions = {\n  /**\n   * Whether or not to allow the container to be created if it does not exist\n   *\n   * @default false\n   */\n  allowContainerCreate: boolean\n\n  /**\n   * When enabled, fields (like the prefix field) will always be inserted into\n   * the collection schema regardless of whether the plugin is enabled. This\n   * ensures a consistent schema across all environments.\n   *\n   * This will be enabled by default in Payload v4.\n   *\n   * @default false\n   */\n  alwaysInsertFields?: boolean\n\n  /**\n   * Base URL for the Azure Blob storage account\n   */\n  baseURL: string\n\n  /**\n   * Optional cache key to identify the Azure Blob storage client instance.\n   * If not provided, a default key will be used.\n   *\n   * @default `azure:containerName`\n   */\n  clientCacheKey?: string\n\n  /**\n   * Do uploads directly on the client to bypass limits on Vercel.\n   *\n   * Client uploads use the Azure Blob SDK, which splits large files into blocks\n   * (avoiding the ~5GB limit of a single upload request). The SDK sends `x-ms-*`\n   * headers, so the browser issues a CORS preflight: your storage account's CORS\n   * rules must allow the `OPTIONS` and `PUT` methods and the required headers\n   * (allowed headers `*`, or at minimum `x-ms-*,content-type,content-length`).\n   */\n  clientUploads?: ClientUploadsConfig\n\n  /**\n   * Collection options to apply the Azure Blob adapter to.\n   */\n  collections: Partial<Record<UploadCollectionSlug, Omit<CollectionOptions, 'adapter'> | true>>\n\n  /**\n   * Azure Blob storage connection string\n   */\n  connectionString: string\n\n  /**\n   * Public access level applied to a container that the plugin creates via\n   * `allowContainerCreate`. Has no effect on containers that already exist.\n   *\n   * - `'private'` (default): no anonymous access. Blobs are reachable only\n   *   through Payload's access-controlled file route.\n   * - `'blob'`: unauthenticated clients can read any blob directly from Azure.\n   * - `'container'`: unauthenticated clients can read and list blobs directly.\n   *\n   * Only choose `'blob'` or `'container'` if you deliberately want files served\n   * publicly from Azure, bypassing Payload read access control.\n   *\n   * @default 'private'\n   */\n  containerAccess?: 'blob' | 'container' | 'private'\n\n  /**\n   * Azure Blob storage container name\n   */\n  containerName: string\n\n  /**\n   * Whether or not to enable the plugin\n   *\n   * Default: true\n   */\n  enabled?: boolean\n  /**\n   * When true, the collection-level prefix and document-level prefix are combined\n   * (compositional). When false (default), a document prefix already within the\n   * collection prefix is used as-is for new uploads; otherwise it is nested beneath it.\n   * Existing files retain their stored prefixes for reads, URLs, and cleanup.\n   *\n   * Example with a document prefix already contained by the collection prefix:\n   * - collection prefix: `uploads/`\n   * - document prefix: `uploads/documents/`\n   * - resulting prefix with useCompositePrefixes=true: `uploads/uploads/documents/`\n   * - resulting prefix with useCompositePrefixes=false: `uploads/documents/`\n   *\n   * @default false\n   */\n  useCompositePrefixes?: boolean\n}\n\ntype AzureStorageFactory = (azureStorageArgs: AzureStorageOptions) => StorageAdapter\n\nexport const azureStorage: AzureStorageFactory = (\n  azureStorageOptions: AzureStorageOptions,\n): StorageAdapter => ({\n  name: 'azure',\n  collections: Object.keys(azureStorageOptions.collections),\n  init: (incomingConfig: Config): Config => {\n    const getStorageClient = () =>\n      getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      })\n\n    const isPluginDisabled = azureStorageOptions.enabled === false\n\n    if (isPluginDisabled) {\n      return incomingConfig\n    }\n\n    const createContainerIfNotExists = async (): Promise<void> => {\n      const containerClient = getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      })\n\n      // Private by default; public access is opt-in via `containerAccess`.\n      const containerAccess = azureStorageOptions.containerAccess ?? 'private'\n\n      if (containerAccess === 'private') {\n        await containerClient.createIfNotExists()\n      } else {\n        await containerClient.createIfNotExists({ access: containerAccess })\n      }\n    }\n\n    const adapter = createAzureAdapter({\n      allowContainerCreate: azureStorageOptions.allowContainerCreate,\n      baseURL: azureStorageOptions.baseURL,\n      clientUploads: azureStorageOptions.clientUploads,\n      containerName: azureStorageOptions.containerName,\n      createContainerIfNotExists,\n      getStorageClient,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })\n\n    // Add adapter to each collection option object\n    const collectionsWithAdapter: CloudStoragePluginOptions['collections'] = Object.entries(\n      azureStorageOptions.collections,\n    ).reduce(\n      (acc, [slug, collOptions]) => ({\n        ...acc,\n        [slug]: {\n          ...(collOptions === true ? {} : collOptions),\n          adapter,\n        },\n      }),\n      {} as Record<string, CollectionOptions>,\n    )\n\n    // Set disableLocalStorage: true for collections specified in the plugin options\n    const config = {\n      ...incomingConfig,\n      collections: (incomingConfig.collections || []).map((collection) => {\n        if (!collectionsWithAdapter[collection.slug]) {\n          return collection\n        }\n\n        return {\n          ...collection,\n          upload: {\n            ...(typeof collection.upload === 'object' ? collection.upload : {}),\n            disableLocalStorage: true,\n          },\n        }\n      }),\n    }\n\n    return cloudStoragePlugin({\n      alwaysInsertFields: azureStorageOptions.alwaysInsertFields,\n      collections: collectionsWithAdapter,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })(config)\n  },\n})\n\nexport { getStorageClientFunc as getStorageClient }\n"],"names":["cloudStoragePlugin","createAzureAdapter","getStorageClient","getStorageClientFunc","azureStorage","azureStorageOptions","name","collections","Object","keys","init","incomingConfig","connectionString","containerName","isPluginDisabled","enabled","createContainerIfNotExists","containerClient","containerAccess","createIfNotExists","access","adapter","allowContainerCreate","baseURL","clientUploads","useCompositePrefixes","collectionsWithAdapter","entries","reduce","acc","slug","collOptions","config","map","collection","upload","disableLocalStorage","alwaysInsertFields"],"mappings":"AAOA,SAASA,kBAAkB,QAAQ,mCAAkC;AAErE,SAASC,kBAAkB,QAAQ,eAAc;AACjD,SAASC,oBAAoBC,oBAAoB,QAAQ,8BAA6B;AAqGtF,OAAO,MAAMC,eAAoC,CAC/CC,sBACoB,CAAA;QACpBC,MAAM;QACNC,aAAaC,OAAOC,IAAI,CAACJ,oBAAoBE,WAAW;QACxDG,MAAM,CAACC;YACL,MAAMT,mBAAmB,IACvBC,qBAAqB;oBACnBS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD;YAEF,MAAMC,mBAAmBT,oBAAoBU,OAAO,KAAK;YAEzD,IAAID,kBAAkB;gBACpB,OAAOH;YACT;YAEA,MAAMK,6BAA6B;gBACjC,MAAMC,kBAAkBd,qBAAqB;oBAC3CS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD;gBAEA,qEAAqE;gBACrE,MAAMK,kBAAkBb,oBAAoBa,eAAe,IAAI;gBAE/D,IAAIA,oBAAoB,WAAW;oBACjC,MAAMD,gBAAgBE,iBAAiB;gBACzC,OAAO;oBACL,MAAMF,gBAAgBE,iBAAiB,CAAC;wBAAEC,QAAQF;oBAAgB;gBACpE;YACF;YAEA,MAAMG,UAAUpB,mBAAmB;gBACjCqB,sBAAsBjB,oBAAoBiB,oBAAoB;gBAC9DC,SAASlB,oBAAoBkB,OAAO;gBACpCC,eAAenB,oBAAoBmB,aAAa;gBAChDX,eAAeR,oBAAoBQ,aAAa;gBAChDG;gBACAd;gBACAuB,sBAAsBpB,oBAAoBoB,oBAAoB;YAChE;YAEA,+CAA+C;YAC/C,MAAMC,yBAAmElB,OAAOmB,OAAO,CACrFtB,oBAAoBE,WAAW,EAC/BqB,MAAM,CACN,CAACC,KAAK,CAACC,MAAMC,YAAY,GAAM,CAAA;oBAC7B,GAAGF,GAAG;oBACN,CAACC,KAAK,EAAE;wBACN,GAAIC,gBAAgB,OAAO,CAAC,IAAIA,WAAW;wBAC3CV;oBACF;gBACF,CAAA,GACA,CAAC;YAGH,gFAAgF;YAChF,MAAMW,SAAS;gBACb,GAAGrB,cAAc;gBACjBJ,aAAa,AAACI,CAAAA,eAAeJ,WAAW,IAAI,EAAE,AAAD,EAAG0B,GAAG,CAAC,CAACC;oBACnD,IAAI,CAACR,sBAAsB,CAACQ,WAAWJ,IAAI,CAAC,EAAE;wBAC5C,OAAOI;oBACT;oBAEA,OAAO;wBACL,GAAGA,UAAU;wBACbC,QAAQ;4BACN,GAAI,OAAOD,WAAWC,MAAM,KAAK,WAAWD,WAAWC,MAAM,GAAG,CAAC,CAAC;4BAClEC,qBAAqB;wBACvB;oBACF;gBACF;YACF;YAEA,OAAOpC,mBAAmB;gBACxBqC,oBAAoBhC,oBAAoBgC,kBAAkB;gBAC1D9B,aAAamB;gBACbD,sBAAsBpB,oBAAoBoB,oBAAoB;YAChE,GAAGO;QACL;IACF,CAAA,EAAE;AAEF,SAAS7B,wBAAwBD,gBAAgB,GAAE"}

package/dist/index.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.spec.d.ts.map

package/dist/index.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.spec.d.ts","sourceRoot":"","sources":["../src/index.spec.ts"],"names":[],"mappings":""}

package/dist/index.spec.js

@@ -0,0 +1,80 @@
+import { describe, expect, it, vi } from 'vitest';
+// Inspect the access level the adapter passes when it provisions a container.
+const { createIfNotExists } = vi.hoisted(()=>({
+        createIfNotExists: vi.fn()
+    }));
+// Capture the closure index.ts hands to the adapter (normally run via onInit).
+const captured = vi.hoisted(()=>({
+        createContainerIfNotExists: undefined
+    }));
+vi.mock('./utils/getStorageClient.js', ()=>({
+        getStorageClient: ()=>({
+                createIfNotExists
+            })
+    }));
+vi.mock('./adapter.js', ()=>({
+        createAzureAdapter: (args)=>{
+            captured.createContainerIfNotExists = args.createContainerIfNotExists;
+            return ()=>({
+                    name: 'azure'
+                });
+        }
+    }));
+vi.mock('@payloadcms/plugin-cloud-storage', ()=>({
+        cloudStoragePlugin: ()=>(config)=>config
+    }));
+const { azureStorage } = await import('./index.js');
+const runContainerCreate = (containerAccess)=>{
+    createIfNotExists.mockClear();
+    const adapter = azureStorage({
+        allowContainerCreate: true,
+        baseURL: 'https://account.blob.core.windows.net',
+        collections: {
+            media: true
+        },
+        connectionString: 'UseDevelopmentStorage=true',
+        containerAccess,
+        containerName: 'media'
+    });
+    adapter.init({
+        collections: []
+    });
+    captured.createContainerIfNotExists?.();
+    return createIfNotExists.mock.calls[0]?.[0];
+};
+describe('azureStorage container creation', ()=>{
+    it('should not create the container with anonymous public blob access by default', ()=>{
+        const options = runContainerCreate();
+        expect(createIfNotExists).toHaveBeenCalledTimes(1);
+        // No access level == private. Any public value would bypass Payload's
+        // access-controlled route, so the default must stay private.
+        expect(options?.access).toBeUndefined();
+    });
+    it('should create a private container when containerAccess is private', ()=>{
+        const options = runContainerCreate('private');
+        expect(options?.access).toBeUndefined();
+    });
+    it('should apply public access only when explicitly opted in', ()=>{
+        expect(runContainerCreate('blob')?.access).toBe('blob');
+        expect(runContainerCreate('container')?.access).toBe('container');
+    });
+    it('should surface a creation failure as an awaitable rejection, not a swallowed promise', async ()=>{
+        createIfNotExists.mockClear();
+        createIfNotExists.mockRejectedValueOnce(new Error('AuthorizationFailure: public access is not permitted on this storage account'));
+        const adapter = azureStorage({
+            allowContainerCreate: true,
+            baseURL: 'https://account.blob.core.windows.net',
+            collections: {
+                media: true
+            },
+            connectionString: 'UseDevelopmentStorage=true',
+            containerName: 'media'
+        });
+        adapter.init({
+            collections: []
+        });
+        await expect(captured.createContainerIfNotExists?.()).rejects.toThrow('AuthorizationFailure');
+    });
+});
+
+//# sourceMappingURL=index.spec.js.map

package/dist/index.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.spec.ts"],"sourcesContent":["import type { Config } from 'payload'\n\nimport { describe, expect, it, vi } from 'vitest'\n\n// Inspect the access level the adapter passes when it provisions a container.\nconst { createIfNotExists } = vi.hoisted(() => ({ createIfNotExists: vi.fn() }))\n\n// Capture the closure index.ts hands to the adapter (normally run via onInit).\nconst captured = vi.hoisted(\n  () => ({ createContainerIfNotExists: undefined }) as { createContainerIfNotExists?: () => void },\n)\n\nvi.mock('./utils/getStorageClient.js', () => ({\n  getStorageClient: () => ({ createIfNotExists }),\n}))\n\nvi.mock('./adapter.js', () => ({\n  createAzureAdapter: (args: { createContainerIfNotExists: () => void }) => {\n    captured.createContainerIfNotExists = args.createContainerIfNotExists\n    return () => ({ name: 'azure' })\n  },\n}))\n\nvi.mock('@payloadcms/plugin-cloud-storage', () => ({\n  cloudStoragePlugin: () => (config: Config) => config,\n}))\n\nconst { azureStorage } = await import('./index.js')\n\nconst runContainerCreate = (\n  containerAccess?: 'blob' | 'container' | 'private',\n): { access?: string } | undefined => {\n  createIfNotExists.mockClear()\n\n  const adapter = azureStorage({\n    allowContainerCreate: true,\n    baseURL: 'https://account.blob.core.windows.net',\n    collections: { media: true },\n    connectionString: 'UseDevelopmentStorage=true',\n    containerAccess,\n    containerName: 'media',\n  })\n\n  adapter.init({ collections: [] } as unknown as Config)\n\n  captured.createContainerIfNotExists?.()\n\n  return createIfNotExists.mock.calls[0]?.[0] as { access?: string } | undefined\n}\n\ndescribe('azureStorage container creation', () => {\n  it('should not create the container with anonymous public blob access by default', () => {\n    const options = runContainerCreate()\n\n    expect(createIfNotExists).toHaveBeenCalledTimes(1)\n    // No access level == private. Any public value would bypass Payload's\n    // access-controlled route, so the default must stay private.\n    expect(options?.access).toBeUndefined()\n  })\n\n  it('should create a private container when containerAccess is private', () => {\n    const options = runContainerCreate('private')\n\n    expect(options?.access).toBeUndefined()\n  })\n\n  it('should apply public access only when explicitly opted in', () => {\n    expect(runContainerCreate('blob')?.access).toBe('blob')\n    expect(runContainerCreate('container')?.access).toBe('container')\n  })\n\n  it('should surface a creation failure as an awaitable rejection, not a swallowed promise', async () => {\n    createIfNotExists.mockClear()\n    createIfNotExists.mockRejectedValueOnce(\n      new Error('AuthorizationFailure: public access is not permitted on this storage account'),\n    )\n\n    const adapter = azureStorage({\n      allowContainerCreate: true,\n      baseURL: 'https://account.blob.core.windows.net',\n      collections: { media: true },\n      connectionString: 'UseDevelopmentStorage=true',\n      containerName: 'media',\n    })\n\n    adapter.init({ collections: [] } as unknown as Config)\n\n    await expect(captured.createContainerIfNotExists?.()).rejects.toThrow('AuthorizationFailure')\n  })\n})\n"],"names":["describe","expect","it","vi","createIfNotExists","hoisted","fn","captured","createContainerIfNotExists","undefined","mock","getStorageClient","createAzureAdapter","args","name","cloudStoragePlugin","config","azureStorage","runContainerCreate","containerAccess","mockClear","adapter","allowContainerCreate","baseURL","collections","media","connectionString","containerName","init","calls","options","toHaveBeenCalledTimes","access","toBeUndefined","toBe","mockRejectedValueOnce","Error","rejects","toThrow"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,8EAA8E;AAC9E,MAAM,EAAEC,iBAAiB,EAAE,GAAGD,GAAGE,OAAO,CAAC,IAAO,CAAA;QAAED,mBAAmBD,GAAGG,EAAE;IAAG,CAAA;AAE7E,+EAA+E;AAC/E,MAAMC,WAAWJ,GAAGE,OAAO,CACzB,IAAO,CAAA;QAAEG,4BAA4BC;IAAU,CAAA;AAGjDN,GAAGO,IAAI,CAAC,+BAA+B,IAAO,CAAA;QAC5CC,kBAAkB,IAAO,CAAA;gBAAEP;YAAkB,CAAA;IAC/C,CAAA;AAEAD,GAAGO,IAAI,CAAC,gBAAgB,IAAO,CAAA;QAC7BE,oBAAoB,CAACC;YACnBN,SAASC,0BAA0B,GAAGK,KAAKL,0BAA0B;YACrE,OAAO,IAAO,CAAA;oBAAEM,MAAM;gBAAQ,CAAA;QAChC;IACF,CAAA;AAEAX,GAAGO,IAAI,CAAC,oCAAoC,IAAO,CAAA;QACjDK,oBAAoB,IAAM,CAACC,SAAmBA;IAChD,CAAA;AAEA,MAAM,EAAEC,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC;AAEtC,MAAMC,qBAAqB,CACzBC;IAEAf,kBAAkBgB,SAAS;IAE3B,MAAMC,UAAUJ,aAAa;QAC3BK,sBAAsB;QACtBC,SAAS;QACTC,aAAa;YAAEC,OAAO;QAAK;QAC3BC,kBAAkB;QAClBP;QACAQ,eAAe;IACjB;IAEAN,QAAQO,IAAI,CAAC;QAAEJ,aAAa,EAAE;IAAC;IAE/BjB,SAASC,0BAA0B;IAEnC,OAAOJ,kBAAkBM,IAAI,CAACmB,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE;AAC7C;AAEA7B,SAAS,mCAAmC;IAC1CE,GAAG,gFAAgF;QACjF,MAAM4B,UAAUZ;QAEhBjB,OAAOG,mBAAmB2B,qBAAqB,CAAC;QAChD,sEAAsE;QACtE,6DAA6D;QAC7D9B,OAAO6B,SAASE,QAAQC,aAAa;IACvC;IAEA/B,GAAG,qEAAqE;QACtE,MAAM4B,UAAUZ,mBAAmB;QAEnCjB,OAAO6B,SAASE,QAAQC,aAAa;IACvC;IAEA/B,GAAG,4DAA4D;QAC7DD,OAAOiB,mBAAmB,SAASc,QAAQE,IAAI,CAAC;QAChDjC,OAAOiB,mBAAmB,cAAcc,QAAQE,IAAI,CAAC;IACvD;IAEAhC,GAAG,wFAAwF;QACzFE,kBAAkBgB,SAAS;QAC3BhB,kBAAkB+B,qBAAqB,CACrC,IAAIC,MAAM;QAGZ,MAAMf,UAAUJ,aAAa;YAC3BK,sBAAsB;YACtBC,SAAS;YACTC,aAAa;gBAAEC,OAAO;YAAK;YAC3BC,kBAAkB;YAClBC,eAAe;QACjB;QAEAN,QAAQO,IAAI,CAAC;YAAEJ,aAAa,EAAE;QAAC;QAE/B,MAAMvB,OAAOM,SAASC,0BAA0B,MAAM6B,OAAO,CAACC,OAAO,CAAC;IACxE;AACF"}

package/dist/isClientUploadAllowed.d.ts

@@ -0,0 +1,6 @@
+export declare const isClientUploadAllowed: (collection?: {
+    upload?: {
+        allowRestrictedFileTypes?: boolean;
+    } | boolean;
+}) => boolean;
+//# sourceMappingURL=isClientUploadAllowed.d.ts.map

package/dist/isClientUploadAllowed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isClientUploadAllowed.d.ts","sourceRoot":"","sources":["../src/isClientUploadAllowed.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,gBAAiB;IACjD,MAAM,CAAC,EAAE;QAAE,wBAAwB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAA;CAC1D,KAAG,OAKD,CAAA"}

package/dist/isClientUploadAllowed.js

@@ -0,0 +1,3 @@
+export const isClientUploadAllowed = (collection)=>Boolean(collection && typeof collection.upload === 'object' && collection.upload.allowRestrictedFileTypes);
+
+//# sourceMappingURL=isClientUploadAllowed.js.map

package/dist/isClientUploadAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/isClientUploadAllowed.ts"],"sourcesContent":["export const isClientUploadAllowed = (collection?: {\n  upload?: { allowRestrictedFileTypes?: boolean } | boolean\n}): boolean =>\n  Boolean(\n    collection &&\n      typeof collection.upload === 'object' &&\n      collection.upload.allowRestrictedFileTypes,\n  )\n"],"names":["isClientUploadAllowed","collection","Boolean","upload","allowRestrictedFileTypes"],"mappings":"AAAA,OAAO,MAAMA,wBAAwB,CAACC,aAGpCC,QACED,cACE,OAAOA,WAAWE,MAAM,KAAK,YAC7BF,WAAWE,MAAM,CAACC,wBAAwB,EAC7C"}

package/dist/uploadFile.d.ts

@@ -2,13 +2,10 @@ import type { ContainerClient } from '@azure/storage-blob';
 interface UploadArgs {
     buffer: Buffer;
     client: ContainerClient;
-    collectionPrefix?: string;
-    docPrefix?: string;
-    filename: string;
     mimeType: string;
+    storageFilePath: string;
     tempFilePath?: string;
-    useCompositePrefixes?: boolean;
 }
-export declare function uploadFile({ buffer, client, collectionPrefix, docPrefix, filename, mimeType, tempFilePath, useCompositePrefixes, }: UploadArgs): Promise<void>;
+export declare function uploadFile({ buffer, client, mimeType, storageFilePath, tempFilePath, }: UploadArgs): Promise<void>;
 export {};
 //# sourceMappingURL=uploadFile.d.ts.map

package/dist/uploadFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploadFile.d.ts","sourceRoot":"","sources":["../src/uploadFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAO1D,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,eAAe,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAID,wBAAsB,UAAU,CAAC,EAC/B,MAAM,EACN,MAAM,EACN,gBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,oBAA4B,GAC7B,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B5B"}
+{"version":3,"file":"uploadFile.d.ts","sourceRoot":"","sources":["../src/uploadFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAM1D,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,eAAe,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAID,wBAAsB,UAAU,CAAC,EAC/B,MAAM,EACN,MAAM,EACN,QAAQ,EACR,eAAe,EACf,YAAY,GACb,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB5B"}

package/dist/uploadFile.js

@@ -1,17 +1,10 @@
 import { AbortController } from '@azure/abort-controller';
-import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
 import fs from 'fs';
 import { Readable } from 'stream';
 const multipartThreshold = 1024 * 1024 * 50 // 50MB
 ;
-export async function uploadFile({ buffer, client, collectionPrefix = '', docPrefix, filename, mimeType, tempFilePath, useCompositePrefixes = false }) {
-    const { fileKey } = getFileKey({
-        collectionPrefix,
-        docPrefix,
-        filename,
-        useCompositePrefixes
-    });
-    const blockBlobClient = client.getBlockBlobClient(fileKey);
+export async function uploadFile({ buffer, client, mimeType, storageFilePath, tempFilePath }) {
+    const blockBlobClient = client.getBlockBlobClient(storageFilePath);
     // when there are no temp files, or the upload is less than the threshold size, do not stream files
     if (!tempFilePath && buffer.length > 0 && buffer.length < multipartThreshold) {
         await blockBlobClient.upload(buffer, buffer.byteLength, {

package/dist/uploadFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/uploadFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\nimport { AbortController } from '@azure/abort-controller'\nimport { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities'\nimport fs from 'fs'\nimport { Readable } from 'stream'\n\ninterface UploadArgs {\n  buffer: Buffer\n  client: ContainerClient\n  collectionPrefix?: string\n  docPrefix?: string\n  filename: string\n  mimeType: string\n  tempFilePath?: string\n  useCompositePrefixes?: boolean\n}\n\nconst multipartThreshold = 1024 * 1024 * 50 // 50MB\n\nexport async function uploadFile({\n  buffer,\n  client,\n  collectionPrefix = '',\n  docPrefix,\n  filename,\n  mimeType,\n  tempFilePath,\n  useCompositePrefixes = false,\n}: UploadArgs): Promise<void> {\n  const { fileKey } = getFileKey({\n    collectionPrefix,\n    docPrefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  const blockBlobClient = client.getBlockBlobClient(fileKey)\n\n  // when there are no temp files, or the upload is less than the threshold size, do not stream files\n  if (!tempFilePath && buffer.length > 0 && buffer.length < multipartThreshold) {\n    await blockBlobClient.upload(buffer, buffer.byteLength, {\n      blobHTTPHeaders: { blobContentType: mimeType },\n    })\n    return\n  }\n\n  const fileBufferOrStream: Readable = tempFilePath\n    ? fs.createReadStream(tempFilePath)\n    : Readable.from(buffer)\n\n  await blockBlobClient.uploadStream(fileBufferOrStream, 4 * 1024 * 1024, 4, {\n    abortSignal: AbortController.timeout(30 * 60 * 1000),\n    blobHTTPHeaders: { blobContentType: mimeType },\n  })\n}\n"],"names":["AbortController","getFileKey","fs","Readable","multipartThreshold","uploadFile","buffer","client","collectionPrefix","docPrefix","filename","mimeType","tempFilePath","useCompositePrefixes","fileKey","blockBlobClient","getBlockBlobClient","length","upload","byteLength","blobHTTPHeaders","blobContentType","fileBufferOrStream","createReadStream","from","uploadStream","abortSignal","timeout"],"mappings":"AAEA,SAASA,eAAe,QAAQ,0BAAyB;AACzD,SAASC,UAAU,QAAQ,6CAA4C;AACvE,OAAOC,QAAQ,KAAI;AACnB,SAASC,QAAQ,QAAQ,SAAQ;AAajC,MAAMC,qBAAqB,OAAO,OAAO,GAAG,OAAO;;AAEnD,OAAO,eAAeC,WAAW,EAC/BC,MAAM,EACNC,MAAM,EACNC,mBAAmB,EAAE,EACrBC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,YAAY,EACZC,uBAAuB,KAAK,EACjB;IACX,MAAM,EAAEC,OAAO,EAAE,GAAGb,WAAW;QAC7BO;QACAC;QACAC;QACAG;IACF;IAEA,MAAME,kBAAkBR,OAAOS,kBAAkB,CAACF;IAElD,mGAAmG;IACnG,IAAI,CAACF,gBAAgBN,OAAOW,MAAM,GAAG,KAAKX,OAAOW,MAAM,GAAGb,oBAAoB;QAC5E,MAAMW,gBAAgBG,MAAM,CAACZ,QAAQA,OAAOa,UAAU,EAAE;YACtDC,iBAAiB;gBAAEC,iBAAiBV;YAAS;QAC/C;QACA;IACF;IAEA,MAAMW,qBAA+BV,eACjCV,GAAGqB,gBAAgB,CAACX,gBACpBT,SAASqB,IAAI,CAAClB;IAElB,MAAMS,gBAAgBU,YAAY,CAACH,oBAAoB,IAAI,OAAO,MAAM,GAAG;QACzEI,aAAa1B,gBAAgB2B,OAAO,CAAC,KAAK,KAAK;QAC/CP,iBAAiB;YAAEC,iBAAiBV;QAAS;IAC/C;AACF"}
+{"version":3,"sources":["../src/uploadFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\nimport { AbortController } from '@azure/abort-controller'\nimport fs from 'fs'\nimport { Readable } from 'stream'\n\ninterface UploadArgs {\n  buffer: Buffer\n  client: ContainerClient\n  mimeType: string\n  storageFilePath: string\n  tempFilePath?: string\n}\n\nconst multipartThreshold = 1024 * 1024 * 50 // 50MB\n\nexport async function uploadFile({\n  buffer,\n  client,\n  mimeType,\n  storageFilePath,\n  tempFilePath,\n}: UploadArgs): Promise<void> {\n  const blockBlobClient = client.getBlockBlobClient(storageFilePath)\n\n  // when there are no temp files, or the upload is less than the threshold size, do not stream files\n  if (!tempFilePath && buffer.length > 0 && buffer.length < multipartThreshold) {\n    await blockBlobClient.upload(buffer, buffer.byteLength, {\n      blobHTTPHeaders: { blobContentType: mimeType },\n    })\n    return\n  }\n\n  const fileBufferOrStream: Readable = tempFilePath\n    ? fs.createReadStream(tempFilePath)\n    : Readable.from(buffer)\n\n  await blockBlobClient.uploadStream(fileBufferOrStream, 4 * 1024 * 1024, 4, {\n    abortSignal: AbortController.timeout(30 * 60 * 1000),\n    blobHTTPHeaders: { blobContentType: mimeType },\n  })\n}\n"],"names":["AbortController","fs","Readable","multipartThreshold","uploadFile","buffer","client","mimeType","storageFilePath","tempFilePath","blockBlobClient","getBlockBlobClient","length","upload","byteLength","blobHTTPHeaders","blobContentType","fileBufferOrStream","createReadStream","from","uploadStream","abortSignal","timeout"],"mappings":"AAEA,SAASA,eAAe,QAAQ,0BAAyB;AACzD,OAAOC,QAAQ,KAAI;AACnB,SAASC,QAAQ,QAAQ,SAAQ;AAUjC,MAAMC,qBAAqB,OAAO,OAAO,GAAG,OAAO;;AAEnD,OAAO,eAAeC,WAAW,EAC/BC,MAAM,EACNC,MAAM,EACNC,QAAQ,EACRC,eAAe,EACfC,YAAY,EACD;IACX,MAAMC,kBAAkBJ,OAAOK,kBAAkB,CAACH;IAElD,mGAAmG;IACnG,IAAI,CAACC,gBAAgBJ,OAAOO,MAAM,GAAG,KAAKP,OAAOO,MAAM,GAAGT,oBAAoB;QAC5E,MAAMO,gBAAgBG,MAAM,CAACR,QAAQA,OAAOS,UAAU,EAAE;YACtDC,iBAAiB;gBAAEC,iBAAiBT;YAAS;QAC/C;QACA;IACF;IAEA,MAAMU,qBAA+BR,eACjCR,GAAGiB,gBAAgB,CAACT,gBACpBP,SAASiB,IAAI,CAACd;IAElB,MAAMK,gBAAgBU,YAAY,CAACH,oBAAoB,IAAI,OAAO,MAAM,GAAG;QACzEI,aAAarB,gBAAgBsB,OAAO,CAAC,KAAK,KAAK;QAC/CP,iBAAiB;YAAEC,iBAAiBT;QAAS;IAC/C;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/storage-azure",
-  "version": "4.0.0-canary.32",
+  "version": "4.0.0-canary.34",
   "description": "Payload storage adapter for Azure Blob Storage",
   "homepage": "https://payloadcms.com",
   "repository": {
@@ -38,14 +38,14 @@
   ],
   "dependencies": {
     "@azure/abort-controller": "^1.1.0",
-    "@azure/storage-blob": "^12.11.0",
-    "@payloadcms/plugin-cloud-storage": "4.0.0-canary.32"
+    "@azure/storage-blob": "^12.33.0",
+    "@payloadcms/plugin-cloud-storage": "4.0.0-canary.34"
   },
   "devDependencies": {
-    "payload": "4.0.0-canary.32"
+    "payload": "4.0.0-canary.34"
   },
   "peerDependencies": {
-    "payload": "4.0.0-canary.32"
+    "payload": "4.0.0-canary.34"
   },
   "engines": {
     "node": ">=24.15.0"