@payloadcms/storage-azure 4.0.0-internal.f11981a → 4.0.0-internal.f2a04f7

package/README.md

@@ -58,12 +58,15 @@ export default buildConfig({
 
 ### Configuration Options
 
-| Option                 | Description                                                              | Default |
-| ---------------------- | ------------------------------------------------------------------------ | ------- |
-| `enabled`              | Whether or not to enable the plugin                                      | `true`  |
-| `collections`          | Collections to apply the Azure Blob adapter to                           |         |
-| `allowContainerCreate` | Whether or not to allow the container to be created if it does not exist | `false` |
-| `baseURL`              | Base URL for the Azure Blob storage account                              |         |
-| `connectionString`     | Azure Blob storage connection string                                     |         |
-| `containerName`        | Azure Blob storage container name                                        |         |
-| `clientUploads`        | Upload directly to Azure instead of through Payload.                     |         |
+| Option                 | Description                                                                                                                                                                                                                                                               | Default     |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
+| `enabled`              | Whether or not to enable the plugin                                                                                                                                                                                                                                       | `true`      |
+| `collections`          | Collections to apply the Azure Blob adapter to                                                                                                                                                                                                                            |             |
+| `allowContainerCreate` | Whether or not to allow the container to be created if it does not exist                                                                                                                                                                                                  | `false`     |
+| `containerAccess`      | Public access level for a container the plugin creates. `'private'` (default) serves blobs only through Payload's access-controlled route; `'blob'` / `'container'` expose them to anonymous clients directly from Azure. Has no effect on containers that already exist. | `'private'` |
+| `baseURL`              | Base URL for the Azure Blob storage account                                                                                                                                                                                                                               |             |
+| `connectionString`     | Azure Blob storage connection string                                                                                                                                                                                                                                      |             |
+| `containerName`        | Azure Blob storage container name                                                                                                                                                                                                                                         |             |
+| `clientUploads`        | Upload directly to Azure instead of through Payload.                                                                                                                                                                                                                      |             |
+
+> **Breaking change (private by default):** When `allowContainerCreate: true`, the plugin now creates containers with **private** access. Previously it created them with public `blob` access. If you relied on files being served directly from the anonymous Azure blob URL (typically alongside `disablePayloadAccessControl: true`), set `containerAccess: 'blob'` to restore the old behaviour. This only affects **newly created** containers — existing containers keep their current access level, so you must flip their ACL manually if needed.

package/dist/adapter.d.ts

@@ -5,7 +5,7 @@ interface CreateAzureAdapterArgs {
     baseURL: string;
     clientUploads?: ClientUploadsConfig;
     containerName: string;
-    createContainerIfNotExists: () => void;
+    createContainerIfNotExists: () => Promise<void> | void;
     getStorageClient: () => ContainerClient;
     useCompositePrefixes?: boolean;
 }

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EACV,OAAO,EACP,mBAAmB,EAEpB,MAAM,wCAAwC,CAAA;AAQ/C,UAAU,sBAAsB;IAC9B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B,EAAE,MAAM,IAAI,CAAA;IACtC,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAgB,kBAAkB,CAAC,EACjC,oBAAoB,EACpB,OAAO,EACP,aAAa,EACb,aAAa,EACb,0BAA0B,EAC1B,gBAAgB,EAChB,oBAA4B,GAC7B,EAAE,sBAAsB,GAAG,OAAO,CAuElC"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EACV,OAAO,EACP,mBAAmB,EAGpB,MAAM,wCAAwC,CAAA;AAU/C,UAAU,sBAAsB;IAC9B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACtD,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAgB,kBAAkB,CAAC,EACjC,oBAAoB,EACpB,OAAO,EACP,aAAa,EACb,aAAa,EACb,0BAA0B,EAC1B,gBAAgB,EAChB,oBAA4B,GAC7B,EAAE,sBAAsB,GAAG,OAAO,CAmElC"}

package/dist/adapter.js

@@ -1,11 +1,25 @@
+import { copyAzureFile } from './copyFile.js';
 import { deleteFile } from './deleteFile.js';
 import { generateUploadInstructions } from './generateUploadInstructions.js';
 import { generateURL } from './generateURL.js';
 import { getFile } from './getFile.js';
+import { isClientUploadAllowed } from './isClientUploadAllowed.js';
 import { uploadFile } from './uploadFile.js';
 export function createAzureAdapter({ allowContainerCreate, baseURL, clientUploads, containerName, createContainerIfNotExists, getStorageClient, useCompositePrefixes = false }) {
+    const deleteStoredFile = ({ storageFilePath })=>deleteFile({
+            client: getStorageClient(),
+            storageFilePath
+        });
     return ({ collection, prefix = '' })=>({
             name: 'azure',
+            supportsTempFiles: true,
+            copyFile: ({ from, req, to })=>copyAzureFile({
+                    client: getStorageClient(),
+                    from,
+                    req,
+                    to
+                }),
+            deleteFile: deleteStoredFile,
             generateURL: ({ filename, prefix: urlPrefix = '' })=>generateURL({
                     baseURL,
                     collectionPrefix: prefix,
@@ -18,7 +32,7 @@ export function createAzureAdapter({ allowContainerCreate, baseURL, clientUpload
                 adminHandler: {
                     path: '@payloadcms/storage-azure/client#AzureClientUploadHandler'
                 },
-                enabled: Boolean(clientUploads),
+                enabled: Boolean(clientUploads) && isClientUploadAllowed(collection),
                 generate: generateUploadInstructions({
                     access: typeof clientUploads === 'object' ? clientUploads.access : undefined,
                     collectionPrefix: prefix,
@@ -26,35 +40,28 @@ export function createAzureAdapter({ allowContainerCreate, baseURL, clientUpload
                     getStorageClient,
                     useCompositePrefixes
                 }),
+                requiresUploadReceipt: true,
                 useInAdmin: true
             },
-            handleDelete: ({ doc: { prefix: docPrefix = '' }, filename })=>deleteFile({
-                    client: getStorageClient(),
-                    collectionPrefix: prefix,
-                    docPrefix,
-                    filename,
-                    useCompositePrefixes
-                }),
-            handleUpload: async ({ data, file })=>{
+            handleDelete: deleteStoredFile,
+            handleUpload: async ({ data, file, storageFilePath })=>{
                 await uploadFile({
                     buffer: file.buffer,
                     client: getStorageClient(),
-                    collectionPrefix: prefix,
-                    docPrefix: data.prefix,
-                    filename: file.filename,
                     mimeType: file.mimeType,
-                    tempFilePath: file.tempFilePath,
-                    useCompositePrefixes
+                    storageFilePath,
+                    tempFilePath: file.tempFilePath
                 });
                 return data;
             },
-            staticHandler: (req, { headers, params: { filename, prefix: prefixQueryParam, uploadReference } })=>getFile({
+            staticHandler: (req, { doc, headers, params: { filename, operation, uploadReference } })=>getFile({
                     client: getStorageClient(),
                     collection,
                     collectionPrefix: prefix,
+                    doc,
                     filename,
                     incomingHeaders: headers,
-                    prefixQueryParam,
+                    operation,
                     req,
                     uploadReference,
                     useCompositePrefixes

package/dist/adapter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapter.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\nimport type {\n  Adapter,\n  ClientUploadsConfig,\n  GeneratedAdapter,\n} from '@payloadcms/plugin-cloud-storage/types'\n\nimport { deleteFile } from './deleteFile.js'\nimport { generateUploadInstructions } from './generateUploadInstructions.js'\nimport { generateURL } from './generateURL.js'\nimport { getFile } from './getFile.js'\nimport { uploadFile } from './uploadFile.js'\n\ninterface CreateAzureAdapterArgs {\n  allowContainerCreate: boolean\n  baseURL: string\n  clientUploads?: ClientUploadsConfig\n  containerName: string\n  createContainerIfNotExists: () => void\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport function createAzureAdapter({\n  allowContainerCreate,\n  baseURL,\n  clientUploads,\n  containerName,\n  createContainerIfNotExists,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: CreateAzureAdapterArgs): Adapter {\n  return ({ collection, prefix = '' }): GeneratedAdapter => ({\n    name: 'azure',\n\n    generateURL: ({ filename, prefix: urlPrefix = '' }) =>\n      generateURL({\n        baseURL,\n        collectionPrefix: prefix,\n        containerName,\n        filename,\n        prefix: urlPrefix,\n        useCompositePrefixes,\n      }),\n\n    uploadInstructions: {\n      adminHandler: {\n        path: '@payloadcms/storage-azure/client#AzureClientUploadHandler',\n      },\n      enabled: Boolean(clientUploads),\n      generate: generateUploadInstructions({\n        access: typeof clientUploads === 'object' ? clientUploads.access : undefined,\n        collectionPrefix: prefix,\n        containerName,\n        getStorageClient,\n        useCompositePrefixes,\n      }),\n      useInAdmin: true,\n    },\n\n    handleDelete: ({ doc: { prefix: docPrefix = '' }, filename }) =>\n      deleteFile({\n        client: getStorageClient(),\n        collectionPrefix: prefix,\n        docPrefix,\n        filename,\n        useCompositePrefixes,\n      }),\n\n    handleUpload: async ({ data, file }) => {\n      await uploadFile({\n        buffer: file.buffer,\n        client: getStorageClient(),\n        collectionPrefix: prefix,\n        docPrefix: data.prefix,\n        filename: file.filename,\n        mimeType: file.mimeType,\n        tempFilePath: file.tempFilePath,\n        useCompositePrefixes,\n      })\n\n      return data\n    },\n\n    staticHandler: (\n      req,\n      { headers, params: { filename, prefix: prefixQueryParam, uploadReference } },\n    ) =>\n      getFile({\n        client: getStorageClient(),\n        collection,\n        collectionPrefix: prefix,\n        filename,\n        incomingHeaders: headers,\n        prefixQueryParam,\n        req,\n        uploadReference,\n        useCompositePrefixes,\n      }),\n\n    ...(allowContainerCreate && { onInit: createContainerIfNotExists }),\n  })\n}\n"],"names":["deleteFile","generateUploadInstructions","generateURL","getFile","uploadFile","createAzureAdapter","allowContainerCreate","baseURL","clientUploads","containerName","createContainerIfNotExists","getStorageClient","useCompositePrefixes","collection","prefix","name","filename","urlPrefix","collectionPrefix","uploadInstructions","adminHandler","path","enabled","Boolean","generate","access","undefined","useInAdmin","handleDelete","doc","docPrefix","client","handleUpload","data","file","buffer","mimeType","tempFilePath","staticHandler","req","headers","params","prefixQueryParam","uploadReference","incomingHeaders","onInit"],"mappings":"AAOA,SAASA,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,0BAA0B,QAAQ,kCAAiC;AAC5E,SAASC,WAAW,QAAQ,mBAAkB;AAC9C,SAASC,OAAO,QAAQ,eAAc;AACtC,SAASC,UAAU,QAAQ,kBAAiB;AAY5C,OAAO,SAASC,mBAAmB,EACjCC,oBAAoB,EACpBC,OAAO,EACPC,aAAa,EACbC,aAAa,EACbC,0BAA0B,EAC1BC,gBAAgB,EAChBC,uBAAuB,KAAK,EACL;IACvB,OAAO,CAAC,EAAEC,UAAU,EAAEC,SAAS,EAAE,EAAE,GAAwB,CAAA;YACzDC,MAAM;YAENb,aAAa,CAAC,EAAEc,QAAQ,EAAEF,QAAQG,YAAY,EAAE,EAAE,GAChDf,YAAY;oBACVK;oBACAW,kBAAkBJ;oBAClBL;oBACAO;oBACAF,QAAQG;oBACRL;gBACF;YAEFO,oBAAoB;gBAClBC,cAAc;oBACZC,MAAM;gBACR;gBACAC,SAASC,QAAQf;gBACjBgB,UAAUvB,2BAA2B;oBACnCwB,QAAQ,OAAOjB,kBAAkB,WAAWA,cAAciB,MAAM,GAAGC;oBACnER,kBAAkBJ;oBAClBL;oBACAE;oBACAC;gBACF;gBACAe,YAAY;YACd;YAEAC,cAAc,CAAC,EAAEC,KAAK,EAAEf,QAAQgB,YAAY,EAAE,EAAE,EAAEd,QAAQ,EAAE,GAC1DhB,WAAW;oBACT+B,QAAQpB;oBACRO,kBAAkBJ;oBAClBgB;oBACAd;oBACAJ;gBACF;YAEFoB,cAAc,OAAO,EAAEC,IAAI,EAAEC,IAAI,EAAE;gBACjC,MAAM9B,WAAW;oBACf+B,QAAQD,KAAKC,MAAM;oBACnBJ,QAAQpB;oBACRO,kBAAkBJ;oBAClBgB,WAAWG,KAAKnB,MAAM;oBACtBE,UAAUkB,KAAKlB,QAAQ;oBACvBoB,UAAUF,KAAKE,QAAQ;oBACvBC,cAAcH,KAAKG,YAAY;oBAC/BzB;gBACF;gBAEA,OAAOqB;YACT;YAEAK,eAAe,CACbC,KACA,EAAEC,OAAO,EAAEC,QAAQ,EAAEzB,QAAQ,EAAEF,QAAQ4B,gBAAgB,EAAEC,eAAe,EAAE,EAAE,GAE5ExC,QAAQ;oBACN4B,QAAQpB;oBACRE;oBACAK,kBAAkBJ;oBAClBE;oBACA4B,iBAAiBJ;oBACjBE;oBACAH;oBACAI;oBACA/B;gBACF;YAEF,GAAIN,wBAAwB;gBAAEuC,QAAQnC;YAA2B,CAAC;QACpE,CAAA;AACF"}
+{"version":3,"sources":["../src/adapter.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\nimport type {\n  Adapter,\n  ClientUploadsConfig,\n  DeleteFile,\n  GeneratedAdapter,\n} from '@payloadcms/plugin-cloud-storage/types'\n\nimport { copyAzureFile } from './copyFile.js'\nimport { deleteFile } from './deleteFile.js'\nimport { generateUploadInstructions } from './generateUploadInstructions.js'\nimport { generateURL } from './generateURL.js'\nimport { getFile } from './getFile.js'\nimport { isClientUploadAllowed } from './isClientUploadAllowed.js'\nimport { uploadFile } from './uploadFile.js'\n\ninterface CreateAzureAdapterArgs {\n  allowContainerCreate: boolean\n  baseURL: string\n  clientUploads?: ClientUploadsConfig\n  containerName: string\n  createContainerIfNotExists: () => Promise<void> | void\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport function createAzureAdapter({\n  allowContainerCreate,\n  baseURL,\n  clientUploads,\n  containerName,\n  createContainerIfNotExists,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: CreateAzureAdapterArgs): Adapter {\n  const deleteStoredFile: DeleteFile = ({ storageFilePath }) =>\n    deleteFile({ client: getStorageClient(), storageFilePath })\n\n  return ({ collection, prefix = '' }): GeneratedAdapter => ({\n    name: 'azure',\n    supportsTempFiles: true,\n\n    copyFile: ({ from, req, to }) => copyAzureFile({ client: getStorageClient(), from, req, to }),\n    deleteFile: deleteStoredFile,\n\n    generateURL: ({ filename, prefix: urlPrefix = '' }) =>\n      generateURL({\n        baseURL,\n        collectionPrefix: prefix,\n        containerName,\n        filename,\n        prefix: urlPrefix,\n        useCompositePrefixes,\n      }),\n\n    uploadInstructions: {\n      adminHandler: {\n        path: '@payloadcms/storage-azure/client#AzureClientUploadHandler',\n      },\n      enabled: Boolean(clientUploads) && isClientUploadAllowed(collection),\n      generate: generateUploadInstructions({\n        access: typeof clientUploads === 'object' ? clientUploads.access : undefined,\n        collectionPrefix: prefix,\n        containerName,\n        getStorageClient,\n        useCompositePrefixes,\n      }),\n      requiresUploadReceipt: true,\n      useInAdmin: true,\n    },\n\n    handleDelete: deleteStoredFile,\n\n    handleUpload: async ({ data, file, storageFilePath }) => {\n      await uploadFile({\n        buffer: file.buffer,\n        client: getStorageClient(),\n        mimeType: file.mimeType,\n        storageFilePath,\n        tempFilePath: file.tempFilePath,\n      })\n\n      return data\n    },\n\n    staticHandler: (req, { doc, headers, params: { filename, operation, uploadReference } }) =>\n      getFile({\n        client: getStorageClient(),\n        collection,\n        collectionPrefix: prefix,\n        doc,\n        filename,\n        incomingHeaders: headers,\n        operation,\n        req,\n        uploadReference,\n        useCompositePrefixes,\n      }),\n\n    ...(allowContainerCreate && { onInit: createContainerIfNotExists }),\n  })\n}\n"],"names":["copyAzureFile","deleteFile","generateUploadInstructions","generateURL","getFile","isClientUploadAllowed","uploadFile","createAzureAdapter","allowContainerCreate","baseURL","clientUploads","containerName","createContainerIfNotExists","getStorageClient","useCompositePrefixes","deleteStoredFile","storageFilePath","client","collection","prefix","name","supportsTempFiles","copyFile","from","req","to","filename","urlPrefix","collectionPrefix","uploadInstructions","adminHandler","path","enabled","Boolean","generate","access","undefined","requiresUploadReceipt","useInAdmin","handleDelete","handleUpload","data","file","buffer","mimeType","tempFilePath","staticHandler","doc","headers","params","operation","uploadReference","incomingHeaders","onInit"],"mappings":"AAQA,SAASA,aAAa,QAAQ,gBAAe;AAC7C,SAASC,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,0BAA0B,QAAQ,kCAAiC;AAC5E,SAASC,WAAW,QAAQ,mBAAkB;AAC9C,SAASC,OAAO,QAAQ,eAAc;AACtC,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,UAAU,QAAQ,kBAAiB;AAY5C,OAAO,SAASC,mBAAmB,EACjCC,oBAAoB,EACpBC,OAAO,EACPC,aAAa,EACbC,aAAa,EACbC,0BAA0B,EAC1BC,gBAAgB,EAChBC,uBAAuB,KAAK,EACL;IACvB,MAAMC,mBAA+B,CAAC,EAAEC,eAAe,EAAE,GACvDf,WAAW;YAAEgB,QAAQJ;YAAoBG;QAAgB;IAE3D,OAAO,CAAC,EAAEE,UAAU,EAAEC,SAAS,EAAE,EAAE,GAAwB,CAAA;YACzDC,MAAM;YACNC,mBAAmB;YAEnBC,UAAU,CAAC,EAAEC,IAAI,EAAEC,GAAG,EAAEC,EAAE,EAAE,GAAKzB,cAAc;oBAAEiB,QAAQJ;oBAAoBU;oBAAMC;oBAAKC;gBAAG;YAC3FxB,YAAYc;YAEZZ,aAAa,CAAC,EAAEuB,QAAQ,EAAEP,QAAQQ,YAAY,EAAE,EAAE,GAChDxB,YAAY;oBACVM;oBACAmB,kBAAkBT;oBAClBR;oBACAe;oBACAP,QAAQQ;oBACRb;gBACF;YAEFe,oBAAoB;gBAClBC,cAAc;oBACZC,MAAM;gBACR;gBACAC,SAASC,QAAQvB,kBAAkBL,sBAAsBa;gBACzDgB,UAAUhC,2BAA2B;oBACnCiC,QAAQ,OAAOzB,kBAAkB,WAAWA,cAAcyB,MAAM,GAAGC;oBACnER,kBAAkBT;oBAClBR;oBACAE;oBACAC;gBACF;gBACAuB,uBAAuB;gBACvBC,YAAY;YACd;YAEAC,cAAcxB;YAEdyB,cAAc,OAAO,EAAEC,IAAI,EAAEC,IAAI,EAAE1B,eAAe,EAAE;gBAClD,MAAMV,WAAW;oBACfqC,QAAQD,KAAKC,MAAM;oBACnB1B,QAAQJ;oBACR+B,UAAUF,KAAKE,QAAQ;oBACvB5B;oBACA6B,cAAcH,KAAKG,YAAY;gBACjC;gBAEA,OAAOJ;YACT;YAEAK,eAAe,CAACtB,KAAK,EAAEuB,GAAG,EAAEC,OAAO,EAAEC,QAAQ,EAAEvB,QAAQ,EAAEwB,SAAS,EAAEC,eAAe,EAAE,EAAE,GACrF/C,QAAQ;oBACNa,QAAQJ;oBACRK;oBACAU,kBAAkBT;oBAClB4B;oBACArB;oBACA0B,iBAAiBJ;oBACjBE;oBACA1B;oBACA2B;oBACArC;gBACF;YAEF,GAAIN,wBAAwB;gBAAE6C,QAAQzC;YAA2B,CAAC;QACpE,CAAA;AACF"}

package/dist/copyFile.d.ts

@@ -0,0 +1,11 @@
+import type { ContainerClient } from '@azure/storage-blob';
+import type { PayloadRequest } from 'payload';
+type Args = {
+    client: ContainerClient;
+    from: string;
+    req?: PayloadRequest;
+    to: string;
+};
+export declare const copyAzureFile: ({ client, from, req, to }: Args) => Promise<void>;
+export {};
+//# sourceMappingURL=copyFile.d.ts.map

package/dist/copyFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copyFile.d.ts","sourceRoot":"","sources":["../src/copyFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,KAAK,IAAI,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,cAAc,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvF,eAAO,MAAM,aAAa,8BAAqC,IAAI,KAAG,OAAO,CAAC,IAAI,CAqDjF,CAAA"}

package/dist/copyFile.js

@@ -0,0 +1,52 @@
+export const copyAzureFile = async ({ client, from, req, to })=>{
+    if (from === to) {
+        throw new Error('Storage copy requires different source and destination keys');
+    }
+    const source = client.getBlockBlobClient(from);
+    const destination = client.getBlockBlobClient(to);
+    const properties = await source.getProperties();
+    const { tags } = await source.getTags();
+    const download = await source.download();
+    if (!download.readableStreamBody) {
+        throw new Error(`Azure storage source is not readable: ${from}`);
+    }
+    const uploaded = await destination.uploadStream(download.readableStreamBody, 4 * 1024 * 1024, 4, {
+        blobHTTPHeaders: {
+            blobCacheControl: properties.cacheControl,
+            blobContentDisposition: properties.contentDisposition,
+            blobContentEncoding: properties.contentEncoding,
+            blobContentLanguage: properties.contentLanguage,
+            blobContentType: properties.contentType
+        },
+        conditions: {
+            ifNoneMatch: '*'
+        },
+        metadata: properties.metadata,
+        tags
+    });
+    try {
+        const copied = await destination.getProperties();
+        if (copied.contentLength !== properties.contentLength) {
+            throw new Error(`Copied Azure object is not readable at its expected length: ${to}`);
+        }
+    } catch (err) {
+        try {
+            if (!uploaded.etag) {
+                throw new Error('Azure copy did not return an ETag for safe cleanup');
+            }
+            await destination.deleteIfExists({
+                conditions: {
+                    ifMatch: uploaded.etag
+                }
+            });
+        } catch (cleanupError) {
+            req?.payload.logger.error({
+                err: cleanupError,
+                msg: `Failed to remove unsuccessful Azure copy at ${client.containerName}/${to}`
+            });
+        }
+        throw err;
+    }
+};
+
+//# sourceMappingURL=copyFile.js.map

package/dist/copyFile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/copyFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\nimport type { Readable } from 'node:stream'\nimport type { PayloadRequest } from 'payload'\n\ntype Args = { client: ContainerClient; from: string; req?: PayloadRequest; to: string }\n\nexport const copyAzureFile = async ({ client, from, req, to }: Args): Promise<void> => {\n  if (from === to) {\n    throw new Error('Storage copy requires different source and destination keys')\n  }\n\n  const source = client.getBlockBlobClient(from)\n  const destination = client.getBlockBlobClient(to)\n  const properties = await source.getProperties()\n  const { tags } = await source.getTags()\n  const download = await source.download()\n\n  if (!download.readableStreamBody) {\n    throw new Error(`Azure storage source is not readable: ${from}`)\n  }\n\n  const uploaded = await destination.uploadStream(\n    download.readableStreamBody as Readable,\n    4 * 1024 * 1024,\n    4,\n    {\n      blobHTTPHeaders: {\n        blobCacheControl: properties.cacheControl,\n        blobContentDisposition: properties.contentDisposition,\n        blobContentEncoding: properties.contentEncoding,\n        blobContentLanguage: properties.contentLanguage,\n        blobContentType: properties.contentType,\n      },\n      conditions: { ifNoneMatch: '*' },\n      metadata: properties.metadata,\n      tags,\n    },\n  )\n\n  try {\n    const copied = await destination.getProperties()\n\n    if (copied.contentLength !== properties.contentLength) {\n      throw new Error(`Copied Azure object is not readable at its expected length: ${to}`)\n    }\n  } catch (err) {\n    try {\n      if (!uploaded.etag) {\n        throw new Error('Azure copy did not return an ETag for safe cleanup')\n      }\n      await destination.deleteIfExists({ conditions: { ifMatch: uploaded.etag } })\n    } catch (cleanupError) {\n      req?.payload.logger.error({\n        err: cleanupError,\n        msg: `Failed to remove unsuccessful Azure copy at ${client.containerName}/${to}`,\n      })\n    }\n    throw err\n  }\n}\n"],"names":["copyAzureFile","client","from","req","to","Error","source","getBlockBlobClient","destination","properties","getProperties","tags","getTags","download","readableStreamBody","uploaded","uploadStream","blobHTTPHeaders","blobCacheControl","cacheControl","blobContentDisposition","contentDisposition","blobContentEncoding","contentEncoding","blobContentLanguage","contentLanguage","blobContentType","contentType","conditions","ifNoneMatch","metadata","copied","contentLength","err","etag","deleteIfExists","ifMatch","cleanupError","payload","logger","error","msg","containerName"],"mappings":"AAMA,OAAO,MAAMA,gBAAgB,OAAO,EAAEC,MAAM,EAAEC,IAAI,EAAEC,GAAG,EAAEC,EAAE,EAAQ;IACjE,IAAIF,SAASE,IAAI;QACf,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,SAASL,OAAOM,kBAAkB,CAACL;IACzC,MAAMM,cAAcP,OAAOM,kBAAkB,CAACH;IAC9C,MAAMK,aAAa,MAAMH,OAAOI,aAAa;IAC7C,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAML,OAAOM,OAAO;IACrC,MAAMC,WAAW,MAAMP,OAAOO,QAAQ;IAEtC,IAAI,CAACA,SAASC,kBAAkB,EAAE;QAChC,MAAM,IAAIT,MAAM,CAAC,sCAAsC,EAAEH,MAAM;IACjE;IAEA,MAAMa,WAAW,MAAMP,YAAYQ,YAAY,CAC7CH,SAASC,kBAAkB,EAC3B,IAAI,OAAO,MACX,GACA;QACEG,iBAAiB;YACfC,kBAAkBT,WAAWU,YAAY;YACzCC,wBAAwBX,WAAWY,kBAAkB;YACrDC,qBAAqBb,WAAWc,eAAe;YAC/CC,qBAAqBf,WAAWgB,eAAe;YAC/CC,iBAAiBjB,WAAWkB,WAAW;QACzC;QACAC,YAAY;YAAEC,aAAa;QAAI;QAC/BC,UAAUrB,WAAWqB,QAAQ;QAC7BnB;IACF;IAGF,IAAI;QACF,MAAMoB,SAAS,MAAMvB,YAAYE,aAAa;QAE9C,IAAIqB,OAAOC,aAAa,KAAKvB,WAAWuB,aAAa,EAAE;YACrD,MAAM,IAAI3B,MAAM,CAAC,4DAA4D,EAAED,IAAI;QACrF;IACF,EAAE,OAAO6B,KAAK;QACZ,IAAI;YACF,IAAI,CAAClB,SAASmB,IAAI,EAAE;gBAClB,MAAM,IAAI7B,MAAM;YAClB;YACA,MAAMG,YAAY2B,cAAc,CAAC;gBAAEP,YAAY;oBAAEQ,SAASrB,SAASmB,IAAI;gBAAC;YAAE;QAC5E,EAAE,OAAOG,cAAc;YACrBlC,KAAKmC,QAAQC,OAAOC,MAAM;gBACxBP,KAAKI;gBACLI,KAAK,CAAC,4CAA4C,EAAExC,OAAOyC,aAAa,CAAC,CAAC,EAAEtC,IAAI;YAClF;QACF;QACA,MAAM6B;IACR;AACF,EAAC"}

package/dist/deleteFile.d.ts

@@ -1,11 +1,8 @@
 import type { ContainerClient } from '@azure/storage-blob';
 interface DeleteArgs {
     client: ContainerClient;
-    collectionPrefix?: string;
-    docPrefix: string;
-    filename: string;
-    useCompositePrefixes?: boolean;
+    storageFilePath: string;
 }
-export declare function deleteFile({ client, collectionPrefix, docPrefix, filename, useCompositePrefixes, }: DeleteArgs): Promise<void>;
+export declare function deleteFile({ client, storageFilePath }: DeleteArgs): Promise<void>;
 export {};
 //# sourceMappingURL=deleteFile.d.ts.map

package/dist/deleteFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteFile.d.ts","sourceRoot":"","sources":["../src/deleteFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAI1D,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,wBAAsB,UAAU,CAAC,EAC/B,MAAM,EACN,gBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,oBAA4B,GAC7B,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5B"}
+{"version":3,"file":"deleteFile.d.ts","sourceRoot":"","sources":["../src/deleteFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1D,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,wBAAsB,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvF"}

package/dist/deleteFile.js

@@ -1,12 +1,5 @@
-import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
-export async function deleteFile({ client, collectionPrefix = '', docPrefix, filename, useCompositePrefixes = false }) {
-    const { fileKey } = getFileKey({
-        collectionPrefix,
-        docPrefix,
-        filename,
-        useCompositePrefixes
-    });
-    const blockBlobClient = client.getBlockBlobClient(fileKey);
+export async function deleteFile({ client, storageFilePath }) {
+    const blockBlobClient = client.getBlockBlobClient(storageFilePath);
     await blockBlobClient.deleteIfExists();
 }
 

package/dist/deleteFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/deleteFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\nimport { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities'\n\ninterface DeleteArgs {\n  client: ContainerClient\n  collectionPrefix?: string\n  docPrefix: string\n  filename: string\n  useCompositePrefixes?: boolean\n}\n\nexport async function deleteFile({\n  client,\n  collectionPrefix = '',\n  docPrefix,\n  filename,\n  useCompositePrefixes = false,\n}: DeleteArgs): Promise<void> {\n  const { fileKey } = getFileKey({\n    collectionPrefix,\n    docPrefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  const blockBlobClient = client.getBlockBlobClient(fileKey)\n\n  await blockBlobClient.deleteIfExists()\n}\n"],"names":["getFileKey","deleteFile","client","collectionPrefix","docPrefix","filename","useCompositePrefixes","fileKey","blockBlobClient","getBlockBlobClient","deleteIfExists"],"mappings":"AAEA,SAASA,UAAU,QAAQ,6CAA4C;AAUvE,OAAO,eAAeC,WAAW,EAC/BC,MAAM,EACNC,mBAAmB,EAAE,EACrBC,SAAS,EACTC,QAAQ,EACRC,uBAAuB,KAAK,EACjB;IACX,MAAM,EAAEC,OAAO,EAAE,GAAGP,WAAW;QAC7BG;QACAC;QACAC;QACAC;IACF;IAEA,MAAME,kBAAkBN,OAAOO,kBAAkB,CAACF;IAElD,MAAMC,gBAAgBE,cAAc;AACtC"}
+{"version":3,"sources":["../src/deleteFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\ninterface DeleteArgs {\n  client: ContainerClient\n  storageFilePath: string\n}\n\nexport async function deleteFile({ client, storageFilePath }: DeleteArgs): Promise<void> {\n  const blockBlobClient = client.getBlockBlobClient(storageFilePath)\n\n  await blockBlobClient.deleteIfExists()\n}\n"],"names":["deleteFile","client","storageFilePath","blockBlobClient","getBlockBlobClient","deleteIfExists"],"mappings":"AAOA,OAAO,eAAeA,WAAW,EAAEC,MAAM,EAAEC,eAAe,EAAc;IACtE,MAAMC,kBAAkBF,OAAOG,kBAAkB,CAACF;IAElD,MAAMC,gBAAgBE,cAAc;AACtC"}

package/dist/generateURL.js

@@ -1,12 +1,12 @@
-import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
+import { buildStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities';
 export function generateURL({ baseURL, collectionPrefix = '', containerName, filename, prefix, useCompositePrefixes = false }) {
-    const { fileKey } = getFileKey({
+    const { storageFilePath } = buildStoragePathData({
         collectionPrefix,
         docPrefix: prefix,
         filename,
         useCompositePrefixes
     });
-    return `${baseURL}/${containerName}/${fileKey}`;
+    return `${baseURL}/${containerName}/${storageFilePath}`;
 }
 
 //# sourceMappingURL=generateURL.js.map

package/dist/generateURL.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/generateURL.ts"],"sourcesContent":["import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities'\n\ninterface GenerateURLArgs {\n  baseURL: string\n  collectionPrefix?: string\n  containerName: string\n  filename: string\n  prefix: string\n  useCompositePrefixes?: boolean\n}\n\nexport function generateURL({\n  baseURL,\n  collectionPrefix = '',\n  containerName,\n  filename,\n  prefix,\n  useCompositePrefixes = false,\n}: GenerateURLArgs): string {\n  const { fileKey } = getFileKey({\n    collectionPrefix,\n    docPrefix: prefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  return `${baseURL}/${containerName}/${fileKey}`\n}\n"],"names":["getFileKey","generateURL","baseURL","collectionPrefix","containerName","filename","prefix","useCompositePrefixes","fileKey","docPrefix"],"mappings":"AAAA,SAASA,UAAU,QAAQ,6CAA4C;AAWvE,OAAO,SAASC,YAAY,EAC1BC,OAAO,EACPC,mBAAmB,EAAE,EACrBC,aAAa,EACbC,QAAQ,EACRC,MAAM,EACNC,uBAAuB,KAAK,EACZ;IAChB,MAAM,EAAEC,OAAO,EAAE,GAAGR,WAAW;QAC7BG;QACAM,WAAWH;QACXD;QACAE;IACF;IAEA,OAAO,GAAGL,QAAQ,CAAC,EAAEE,cAAc,CAAC,EAAEI,SAAS;AACjD"}
+{"version":3,"sources":["../src/generateURL.ts"],"sourcesContent":["import { buildStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities'\n\ninterface GenerateURLArgs {\n  baseURL: string\n  collectionPrefix?: string\n  containerName: string\n  filename: string\n  prefix: string\n  useCompositePrefixes?: boolean\n}\n\nexport function generateURL({\n  baseURL,\n  collectionPrefix = '',\n  containerName,\n  filename,\n  prefix,\n  useCompositePrefixes = false,\n}: GenerateURLArgs): string {\n  const { storageFilePath } = buildStoragePathData({\n    collectionPrefix,\n    docPrefix: prefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  return `${baseURL}/${containerName}/${storageFilePath}`\n}\n"],"names":["buildStoragePathData","generateURL","baseURL","collectionPrefix","containerName","filename","prefix","useCompositePrefixes","storageFilePath","docPrefix"],"mappings":"AAAA,SAASA,oBAAoB,QAAQ,6CAA4C;AAWjF,OAAO,SAASC,YAAY,EAC1BC,OAAO,EACPC,mBAAmB,EAAE,EACrBC,aAAa,EACbC,QAAQ,EACRC,MAAM,EACNC,uBAAuB,KAAK,EACZ;IAChB,MAAM,EAAEC,eAAe,EAAE,GAAGR,qBAAqB;QAC/CG;QACAM,WAAWH;QACXD;QACAE;IACF;IAEA,OAAO,GAAGL,QAAQ,CAAC,EAAEE,cAAc,CAAC,EAAEI,iBAAiB;AACzD"}

package/dist/generateUploadInstructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateUploadInstructions.d.ts","sourceRoot":"","sources":["../src/generateUploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA8B,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAMnF,UAAU,IAAI;IACZ,MAAM,CAAC,EAAE,wBAAwB,CAAA;IACjC,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,eAAO,MAAM,0BAA0B,yFAMpC,IAAI,KAAG,0BAmDT,CAAA"}
+{"version":3,"file":"generateUploadInstructions.d.ts","sourceRoot":"","sources":["../src/generateUploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA8B,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AASnF,UAAU,IAAI;IACZ,MAAM,CAAC,EAAE,wBAAwB,CAAA;IACjC,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,eAAe,CAAA;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,eAAO,MAAM,0BAA0B,yFAMpC,IAAI,KAAG,0BA8DT,CAAA"}

package/dist/generateUploadInstructions.js

@@ -1,6 +1,8 @@
 import { BlobSASPermissions, generateBlobSASQueryParameters } from '@azure/storage-blob';
 import { resolveSignedURLKey } from '@payloadcms/plugin-cloud-storage/utilities';
-import { Forbidden } from 'payload';
+import { APIError, Forbidden } from 'payload';
+import { assertClientUploadAllowed } from 'payload/internal';
+import { isClientUploadAllowed } from './isClientUploadAllowed.js';
 export const generateUploadInstructions = ({ access, collectionPrefix, containerName, getStorageClient, useCompositePrefixes = false })=>{
     return async ({ collectionSlug, docPrefix, filename, filesize, mimeType, overrideAccess, req })=>{
         if (!overrideAccess && (access ? !await access({
@@ -9,7 +11,16 @@ export const generateUploadInstructions = ({ access, collectionPrefix, container
         }) : !req.user)) {
             throw new Forbidden(req.t);
         }
-        const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({
+        const collection = req.payload.collections[collectionSlug]?.config;
+        if (!isClientUploadAllowed(collection)) {
+            throw new APIError('Azure client uploads require allowRestrictedFileTypes to be enabled.', 400);
+        }
+        assertClientUploadAllowed({
+            collection,
+            filename,
+            mimeType
+        });
+        const { sanitizedFilename, storageFilePath, uploadReference } = await resolveSignedURLKey({
             collectionPrefix,
             collectionSlug,
             docPrefix,
@@ -17,14 +28,15 @@ export const generateUploadInstructions = ({ access, collectionPrefix, container
             req,
             useCompositePrefixes
         });
-        const blobClient = getStorageClient().getBlobClient(fileKey);
+        const blobClient = getStorageClient().getBlobClient(storageFilePath);
         const sasToken = generateBlobSASQueryParameters({
-            blobName: fileKey,
+            blobName: storageFilePath,
             containerName,
             contentType: mimeType,
             expiresOn: new Date(Date.now() + 3 * 60 * 60 * 1000),
-            permissions: BlobSASPermissions.parse('w'),
-            startsOn: new Date()
+            permissions: BlobSASPermissions.parse('c'),
+            startsOn: new Date(),
+            version: '2026-04-06'
         }, getStorageClient().credential);
         return {
             name: 'uploadToAzure',
@@ -36,9 +48,7 @@ export const generateUploadInstructions = ({ access, collectionPrefix, container
                 filename: sanitizedFilename,
                 mimeType,
                 size: filesize,
-                uploadReference: {
-                    prefix: sanitizedDocPrefix
-                }
+                uploadReference
             }
         };
     };

package/dist/generateUploadInstructions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/generateUploadInstructions.ts"],"sourcesContent":["import type { ContainerClient, StorageSharedKeyCredential } from '@azure/storage-blob'\nimport type { GenerateUploadInstructions, UploadInstructionsAccess } from 'payload'\n\nimport { BlobSASPermissions, generateBlobSASQueryParameters } from '@azure/storage-blob'\nimport { resolveSignedURLKey } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { Forbidden } from 'payload'\n\ninterface Args {\n  access?: UploadInstructionsAccess\n  collectionPrefix: string\n  containerName: string\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport const generateUploadInstructions = ({\n  access,\n  collectionPrefix,\n  containerName,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: Args): GenerateUploadInstructions => {\n  return async ({\n    collectionSlug,\n    docPrefix,\n    filename,\n    filesize,\n    mimeType,\n    overrideAccess,\n    req,\n  }) => {\n    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {\n      throw new Forbidden(req.t)\n    }\n\n    const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({\n      collectionPrefix,\n      collectionSlug,\n      docPrefix,\n      filename,\n      req,\n      useCompositePrefixes,\n    })\n\n    const blobClient = getStorageClient().getBlobClient(fileKey)\n\n    const sasToken = generateBlobSASQueryParameters(\n      {\n        blobName: fileKey,\n        containerName,\n        contentType: mimeType,\n        expiresOn: new Date(Date.now() + 3 * 60 * 60 * 1000),\n        permissions: BlobSASPermissions.parse('w'),\n        startsOn: new Date(),\n      },\n      getStorageClient().credential as StorageSharedKeyCredential,\n    )\n\n    return {\n      name: 'uploadToAzure',\n      type: 'dispatch',\n      data: {\n        url: `${blobClient.url}?${sasToken.toString()}`,\n      },\n      file: {\n        filename: sanitizedFilename,\n        mimeType,\n        size: filesize,\n        uploadReference: { prefix: sanitizedDocPrefix },\n      },\n    }\n  }\n}\n"],"names":["BlobSASPermissions","generateBlobSASQueryParameters","resolveSignedURLKey","Forbidden","generateUploadInstructions","access","collectionPrefix","containerName","getStorageClient","useCompositePrefixes","collectionSlug","docPrefix","filename","filesize","mimeType","overrideAccess","req","user","t","fileKey","sanitizedDocPrefix","sanitizedFilename","blobClient","getBlobClient","sasToken","blobName","contentType","expiresOn","Date","now","permissions","parse","startsOn","credential","name","type","data","url","toString","file","size","uploadReference","prefix"],"mappings":"AAGA,SAASA,kBAAkB,EAAEC,8BAA8B,QAAQ,sBAAqB;AACxF,SAASC,mBAAmB,QAAQ,6CAA4C;AAChF,SAASC,SAAS,QAAQ,UAAS;AAUnC,OAAO,MAAMC,6BAA6B,CAAC,EACzCC,MAAM,EACNC,gBAAgB,EAChBC,aAAa,EACbC,gBAAgB,EAChBC,uBAAuB,KAAK,EACvB;IACL,OAAO,OAAO,EACZC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,QAAQ,EACRC,cAAc,EACdC,GAAG,EACJ;QACC,IAAI,CAACD,kBAAmBV,CAAAA,SAAS,CAAE,MAAMA,OAAO;YAAEK;YAAgBM;QAAI,KAAM,CAACA,IAAIC,IAAI,AAAD,GAAI;YACtF,MAAM,IAAId,UAAUa,IAAIE,CAAC;QAC3B;QAEA,MAAM,EAAEC,OAAO,EAAEC,kBAAkB,EAAEC,iBAAiB,EAAE,GAAG,MAAMnB,oBAAoB;YACnFI;YACAI;YACAC;YACAC;YACAI;YACAP;QACF;QAEA,MAAMa,aAAad,mBAAmBe,aAAa,CAACJ;QAEpD,MAAMK,WAAWvB,+BACf;YACEwB,UAAUN;YACVZ;YACAmB,aAAaZ;YACba,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAK,IAAI,KAAK,KAAK;YAC/CC,aAAa9B,mBAAmB+B,KAAK,CAAC;YACtCC,UAAU,IAAIJ;QAChB,GACApB,mBAAmByB,UAAU;QAG/B,OAAO;YACLC,MAAM;YACNC,MAAM;YACNC,MAAM;gBACJC,KAAK,GAAGf,WAAWe,GAAG,CAAC,CAAC,EAAEb,SAASc,QAAQ,IAAI;YACjD;YACAC,MAAM;gBACJ3B,UAAUS;gBACVP;gBACA0B,MAAM3B;gBACN4B,iBAAiB;oBAAEC,QAAQtB;gBAAmB;YAChD;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../src/generateUploadInstructions.ts"],"sourcesContent":["import type { ContainerClient, StorageSharedKeyCredential } from '@azure/storage-blob'\nimport type { GenerateUploadInstructions, UploadInstructionsAccess } from 'payload'\n\nimport { BlobSASPermissions, generateBlobSASQueryParameters } from '@azure/storage-blob'\nimport { resolveSignedURLKey } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { APIError, Forbidden } from 'payload'\nimport { assertClientUploadAllowed } from 'payload/internal'\n\nimport { isClientUploadAllowed } from './isClientUploadAllowed.js'\n\ninterface Args {\n  access?: UploadInstructionsAccess\n  collectionPrefix: string\n  containerName: string\n  getStorageClient: () => ContainerClient\n  useCompositePrefixes?: boolean\n}\n\nexport const generateUploadInstructions = ({\n  access,\n  collectionPrefix,\n  containerName,\n  getStorageClient,\n  useCompositePrefixes = false,\n}: Args): GenerateUploadInstructions => {\n  return async ({\n    collectionSlug,\n    docPrefix,\n    filename,\n    filesize,\n    mimeType,\n    overrideAccess,\n    req,\n  }) => {\n    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {\n      throw new Forbidden(req.t)\n    }\n\n    const collection = req.payload.collections[collectionSlug]?.config\n    if (!isClientUploadAllowed(collection)) {\n      throw new APIError(\n        'Azure client uploads require allowRestrictedFileTypes to be enabled.',\n        400,\n      )\n    }\n\n    assertClientUploadAllowed({ collection, filename, mimeType })\n\n    const { sanitizedFilename, storageFilePath, uploadReference } = await resolveSignedURLKey({\n      collectionPrefix,\n      collectionSlug,\n      docPrefix,\n      filename,\n      req,\n      useCompositePrefixes,\n    })\n\n    const blobClient = getStorageClient().getBlobClient(storageFilePath)\n\n    const sasToken = generateBlobSASQueryParameters(\n      {\n        blobName: storageFilePath,\n        containerName,\n        contentType: mimeType,\n        expiresOn: new Date(Date.now() + 3 * 60 * 60 * 1000),\n        permissions: BlobSASPermissions.parse('c'),\n        startsOn: new Date(),\n        version: '2026-04-06',\n      },\n      getStorageClient().credential as StorageSharedKeyCredential,\n    )\n\n    return {\n      name: 'uploadToAzure',\n      type: 'dispatch',\n      data: {\n        url: `${blobClient.url}?${sasToken.toString()}`,\n      },\n      file: {\n        filename: sanitizedFilename,\n        mimeType,\n        size: filesize,\n        uploadReference,\n      },\n    }\n  }\n}\n"],"names":["BlobSASPermissions","generateBlobSASQueryParameters","resolveSignedURLKey","APIError","Forbidden","assertClientUploadAllowed","isClientUploadAllowed","generateUploadInstructions","access","collectionPrefix","containerName","getStorageClient","useCompositePrefixes","collectionSlug","docPrefix","filename","filesize","mimeType","overrideAccess","req","user","t","collection","payload","collections","config","sanitizedFilename","storageFilePath","uploadReference","blobClient","getBlobClient","sasToken","blobName","contentType","expiresOn","Date","now","permissions","parse","startsOn","version","credential","name","type","data","url","toString","file","size"],"mappings":"AAGA,SAASA,kBAAkB,EAAEC,8BAA8B,QAAQ,sBAAqB;AACxF,SAASC,mBAAmB,QAAQ,6CAA4C;AAChF,SAASC,QAAQ,EAAEC,SAAS,QAAQ,UAAS;AAC7C,SAASC,yBAAyB,QAAQ,mBAAkB;AAE5D,SAASC,qBAAqB,QAAQ,6BAA4B;AAUlE,OAAO,MAAMC,6BAA6B,CAAC,EACzCC,MAAM,EACNC,gBAAgB,EAChBC,aAAa,EACbC,gBAAgB,EAChBC,uBAAuB,KAAK,EACvB;IACL,OAAO,OAAO,EACZC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,QAAQ,EACRC,cAAc,EACdC,GAAG,EACJ;QACC,IAAI,CAACD,kBAAmBV,CAAAA,SAAS,CAAE,MAAMA,OAAO;YAAEK;YAAgBM;QAAI,KAAM,CAACA,IAAIC,IAAI,AAAD,GAAI;YACtF,MAAM,IAAIhB,UAAUe,IAAIE,CAAC;QAC3B;QAEA,MAAMC,aAAaH,IAAII,OAAO,CAACC,WAAW,CAACX,eAAe,EAAEY;QAC5D,IAAI,CAACnB,sBAAsBgB,aAAa;YACtC,MAAM,IAAInB,SACR,wEACA;QAEJ;QAEAE,0BAA0B;YAAEiB;YAAYP;YAAUE;QAAS;QAE3D,MAAM,EAAES,iBAAiB,EAAEC,eAAe,EAAEC,eAAe,EAAE,GAAG,MAAM1B,oBAAoB;YACxFO;YACAI;YACAC;YACAC;YACAI;YACAP;QACF;QAEA,MAAMiB,aAAalB,mBAAmBmB,aAAa,CAACH;QAEpD,MAAMI,WAAW9B,+BACf;YACE+B,UAAUL;YACVjB;YACAuB,aAAahB;YACbiB,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAK,IAAI,KAAK,KAAK;YAC/CC,aAAarC,mBAAmBsC,KAAK,CAAC;YACtCC,UAAU,IAAIJ;YACdK,SAAS;QACX,GACA7B,mBAAmB8B,UAAU;QAG/B,OAAO;YACLC,MAAM;YACNC,MAAM;YACNC,MAAM;gBACJC,KAAK,GAAGhB,WAAWgB,GAAG,CAAC,CAAC,EAAEd,SAASe,QAAQ,IAAI;YACjD;YACAC,MAAM;gBACJhC,UAAUW;gBACVT;gBACA+B,MAAMhC;gBACNY;YACF;QACF;IACF;AACF,EAAC"}

package/dist/getFile.d.ts

@@ -1,16 +1,17 @@
 import type { ContainerClient } from '@azure/storage-blob';
-import type { CollectionConfig, PayloadRequest } from 'payload';
+import type { CollectionConfig, FileHandlerOperation, PayloadRequest, TypeWithID } from 'payload';
 interface GetFileArgs {
     client: ContainerClient;
     collection: CollectionConfig;
     collectionPrefix?: string;
+    doc?: TypeWithID;
     filename: string;
     incomingHeaders?: Headers;
-    prefixQueryParam?: string;
+    operation?: FileHandlerOperation;
     req: PayloadRequest;
     uploadReference?: unknown;
     useCompositePrefixes?: boolean;
 }
-export declare function getFile({ client, collection, collectionPrefix, filename, incomingHeaders, prefixQueryParam, req, uploadReference, useCompositePrefixes, }: GetFileArgs): Promise<Response>;
+export declare function getFile({ client, collection, collectionPrefix, doc, filename, incomingHeaders, operation, req, uploadReference, useCompositePrefixes, }: GetFileArgs): Promise<Response>;
 export {};
 //# sourceMappingURL=getFile.d.ts.map

package/dist/getFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../src/getFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA8B,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAU/D,UAAU,WAAW;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAgCD,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,UAAU,EACV,gBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,GAAG,EACH,eAAe,EACf,oBAA4B,GAC7B,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuHjC"}
+{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../src/getFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA8B,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAUjG,UAAU,WAAW;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,SAAS,CAAC,EAAE,oBAAoB,CAAA;IAChC,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAgCD,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,UAAU,EACV,gBAAqB,EACrB,GAAG,EACH,QAAQ,EACR,eAAe,EACf,SAAkB,EAClB,GAAG,EACH,eAAe,EACf,oBAA4B,GAC7B,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsHjC"}

package/dist/getFile.js

@@ -1,6 +1,6 @@
 import { RestError } from '@azure/storage-blob';
-import { getFilePrefix as getDocPrefix, getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
-import { getRangeRequestInfo } from 'payload/internal';
+import { buildStoragePathData, getFilePrefix as getDocPrefix } from '@payloadcms/plugin-cloud-storage/utilities';
+import { getRangeRequestInfo, isXmlMimeType, uploadContentSecurityPolicy } from 'payload/internal';
 const isNodeReadableStream = (body)=>{
     return typeof body === 'object' && body !== null && 'pipe' in body && typeof body.pipe === 'function' && 'destroy' in body && typeof body.destroy === 'function';
 };
@@ -13,7 +13,8 @@ const abortRequestAndDestroyStream = ({ abortController, blob })=>{
         blob.readableStreamBody.destroy();
     }
 };
-export async function getFile({ client, collection, collectionPrefix = '', filename, incomingHeaders, prefixQueryParam, req, uploadReference, useCompositePrefixes = false }) {
+export async function getFile({ client, collection, collectionPrefix = '', doc, filename, incomingHeaders, operation = 'read', req, uploadReference, useCompositePrefixes = false }) {
+    const isTransformSource = operation === 'transform';
     let blob = undefined;
     let streamed = false;
     const abortController = new AbortController();
@@ -28,19 +29,20 @@ export async function getFile({ client, collection, collectionPrefix = '', filen
     try {
         const docPrefix = await getDocPrefix({
             collection,
+            collectionPrefix,
+            doc,
             filename,
-            prefixQueryParam,
             req,
-            uploadReference
+            uploadReference,
+            useCompositePrefixes
         });
-        const { fileKey } = getFileKey({
+        const { storageFilePath } = buildStoragePathData({
             collectionPrefix,
             docPrefix,
             filename,
             useCompositePrefixes
         });
-        const blockBlobClient = client.getBlockBlobClient(fileKey);
-        // Get file size for range validation
+        const blockBlobClient = client.getBlockBlobClient(storageFilePath);
         const properties = await blockBlobClient.getProperties();
         const fileSize = properties.contentLength;
         if (!fileSize) {
@@ -48,8 +50,7 @@ export async function getFile({ client, collection, collectionPrefix = '', filen
                 status: 500
             });
         }
-        // Handle range request
-        const rangeHeader = req.headers.get('range');
+        const rangeHeader = isTransformSource ? null : req.headers.get('range');
         const rangeResult = getRangeRequestInfo({
             fileSize,
             rangeHeader
@@ -60,33 +61,30 @@ export async function getFile({ client, collection, collectionPrefix = '', filen
                 status: rangeResult.status
             });
         }
-        // Download with range if partial
         blob = rangeResult.type === 'partial' ? await blockBlobClient.download(rangeResult.rangeStart, rangeResult.rangeEnd - rangeResult.rangeStart + 1, {
             abortSignal: abortController.signal
         }) : await blockBlobClient.download(0, undefined, {
             abortSignal: abortController.signal
         });
         let headers = new Headers(incomingHeaders);
-        // Add range-related headers from the result
         for (const [key, value] of Object.entries(rangeResult.headers)){
             headers.append(key, value);
         }
-        // Add Azure-specific headers
         headers.append('Content-Type', String(properties.contentType));
         if (properties.etag) {
             headers.append('ETag', String(properties.etag));
         }
-        // Add Content-Security-Policy header for SVG files to prevent executable code
-        if (properties.contentType === 'image/svg+xml') {
-            headers.append('Content-Security-Policy', "script-src 'none'");
+        // Apply a restrictive policy to XML-family responses served through Payload.
+        if (isXmlMimeType(properties.contentType)) {
+            headers.append('Content-Security-Policy', uploadContentSecurityPolicy);
         }
         const etagFromHeaders = req.headers.get('etag') || req.headers.get('if-none-match');
-        if (collection.upload && typeof collection.upload === 'object' && typeof collection.upload.modifyResponseHeaders === 'function') {
+        if (!isTransformSource && collection.upload && typeof collection.upload === 'object' && typeof collection.upload.modifyResponseHeaders === 'function') {
             headers = collection.upload.modifyResponseHeaders({
                 headers
             }) || headers;
         }
-        if (etagFromHeaders && etagFromHeaders === properties.etag) {
+        if (!isTransformSource && etagFromHeaders && etagFromHeaders === properties.etag) {
             return new Response(null, {
                 headers,
                 status: 304

package/dist/getFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/getFile.ts"],"sourcesContent":["import type { BlobDownloadResponseParsed, ContainerClient } from '@azure/storage-blob'\nimport type { CollectionConfig, PayloadRequest } from 'payload'\nimport type { Readable } from 'stream'\n\nimport { RestError } from '@azure/storage-blob'\nimport {\n  getFilePrefix as getDocPrefix,\n  getFileKey,\n} from '@payloadcms/plugin-cloud-storage/utilities'\nimport { getRangeRequestInfo } from 'payload/internal'\n\ninterface GetFileArgs {\n  client: ContainerClient\n  collection: CollectionConfig\n  collectionPrefix?: string\n  filename: string\n  incomingHeaders?: Headers\n  prefixQueryParam?: string\n  req: PayloadRequest\n  uploadReference?: unknown\n  useCompositePrefixes?: boolean\n}\n\nconst isNodeReadableStream = (\n  body: BlobDownloadResponseParsed['readableStreamBody'],\n): body is Readable => {\n  return (\n    typeof body === 'object' &&\n    body !== null &&\n    'pipe' in body &&\n    typeof body.pipe === 'function' &&\n    'destroy' in body &&\n    typeof body.destroy === 'function'\n  )\n}\n\nconst abortRequestAndDestroyStream = ({\n  abortController,\n  blob,\n}: {\n  abortController: AbortController\n  blob?: BlobDownloadResponseParsed\n}) => {\n  try {\n    abortController.abort()\n  } catch {\n    /* noop */\n  }\n  if (blob?.readableStreamBody && isNodeReadableStream(blob.readableStreamBody)) {\n    blob.readableStreamBody.destroy()\n  }\n}\n\nexport async function getFile({\n  client,\n  collection,\n  collectionPrefix = '',\n  filename,\n  incomingHeaders,\n  prefixQueryParam,\n  req,\n  uploadReference,\n  useCompositePrefixes = false,\n}: GetFileArgs): Promise<Response> {\n  let blob: BlobDownloadResponseParsed | undefined = undefined\n  let streamed = false\n\n  const abortController = new AbortController()\n  if (req.signal) {\n    req.signal.addEventListener('abort', () => {\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n  }\n\n  try {\n    const docPrefix = await getDocPrefix({\n      collection,\n      filename,\n      prefixQueryParam,\n      req,\n      uploadReference,\n    })\n\n    const { fileKey } = getFileKey({\n      collectionPrefix,\n      docPrefix,\n      filename,\n      useCompositePrefixes,\n    })\n\n    const blockBlobClient = client.getBlockBlobClient(fileKey)\n\n    // Get file size for range validation\n    const properties = await blockBlobClient.getProperties()\n    const fileSize = properties.contentLength\n\n    if (!fileSize) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    // Handle range request\n    const rangeHeader = req.headers.get('range')\n    const rangeResult = getRangeRequestInfo({ fileSize, rangeHeader })\n\n    if (rangeResult.type === 'invalid') {\n      return new Response(null, {\n        headers: new Headers(rangeResult.headers),\n        status: rangeResult.status,\n      })\n    }\n\n    // Download with range if partial\n    blob =\n      rangeResult.type === 'partial'\n        ? await blockBlobClient.download(\n            rangeResult.rangeStart,\n            rangeResult.rangeEnd - rangeResult.rangeStart + 1,\n            { abortSignal: abortController.signal },\n          )\n        : await blockBlobClient.download(0, undefined, { abortSignal: abortController.signal })\n\n    let headers = new Headers(incomingHeaders)\n\n    // Add range-related headers from the result\n    for (const [key, value] of Object.entries(rangeResult.headers)) {\n      headers.append(key, value)\n    }\n\n    // Add Azure-specific headers\n    headers.append('Content-Type', String(properties.contentType))\n    if (properties.etag) {\n      headers.append('ETag', String(properties.etag))\n    }\n\n    // Add Content-Security-Policy header for SVG files to prevent executable code\n    if (properties.contentType === 'image/svg+xml') {\n      headers.append('Content-Security-Policy', \"script-src 'none'\")\n    }\n\n    const etagFromHeaders = req.headers.get('etag') || req.headers.get('if-none-match')\n\n    if (\n      collection.upload &&\n      typeof collection.upload === 'object' &&\n      typeof collection.upload.modifyResponseHeaders === 'function'\n    ) {\n      headers = collection.upload.modifyResponseHeaders({ headers }) || headers\n    }\n\n    if (etagFromHeaders && etagFromHeaders === properties.etag) {\n      return new Response(null, {\n        headers,\n        status: 304,\n      })\n    }\n\n    if (!blob.readableStreamBody || !isNodeReadableStream(blob.readableStreamBody)) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    const stream = blob.readableStreamBody\n    stream.on('error', (err: Error) => {\n      req.payload.logger.error({\n        err,\n        msg: 'Error while streaming Azure blob (aborting)',\n      })\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n\n    streamed = true\n    return new Response(stream, { headers, status: rangeResult.status })\n  } catch (err: unknown) {\n    if (err instanceof RestError && err.statusCode === 404) {\n      return new Response(null, { status: 404, statusText: 'Not Found' })\n    }\n    req.payload.logger.error(err)\n    return new Response('Internal Server Error', { status: 500 })\n  } finally {\n    if (!streamed) {\n      abortRequestAndDestroyStream({ abortController, blob })\n    }\n  }\n}\n"],"names":["RestError","getFilePrefix","getDocPrefix","getFileKey","getRangeRequestInfo","isNodeReadableStream","body","pipe","destroy","abortRequestAndDestroyStream","abortController","blob","abort","readableStreamBody","getFile","client","collection","collectionPrefix","filename","incomingHeaders","prefixQueryParam","req","uploadReference","useCompositePrefixes","undefined","streamed","AbortController","signal","addEventListener","docPrefix","fileKey","blockBlobClient","getBlockBlobClient","properties","getProperties","fileSize","contentLength","Response","status","rangeHeader","headers","get","rangeResult","type","Headers","download","rangeStart","rangeEnd","abortSignal","key","value","Object","entries","append","String","contentType","etag","etagFromHeaders","upload","modifyResponseHeaders","stream","on","err","payload","logger","error","msg","statusCode","statusText"],"mappings":"AAIA,SAASA,SAAS,QAAQ,sBAAqB;AAC/C,SACEC,iBAAiBC,YAAY,EAC7BC,UAAU,QACL,6CAA4C;AACnD,SAASC,mBAAmB,QAAQ,mBAAkB;AActD,MAAMC,uBAAuB,CAC3BC;IAEA,OACE,OAAOA,SAAS,YAChBA,SAAS,QACT,UAAUA,QACV,OAAOA,KAAKC,IAAI,KAAK,cACrB,aAAaD,QACb,OAAOA,KAAKE,OAAO,KAAK;AAE5B;AAEA,MAAMC,+BAA+B,CAAC,EACpCC,eAAe,EACfC,IAAI,EAIL;IACC,IAAI;QACFD,gBAAgBE,KAAK;IACvB,EAAE,OAAM;IACN,QAAQ,GACV;IACA,IAAID,MAAME,sBAAsBR,qBAAqBM,KAAKE,kBAAkB,GAAG;QAC7EF,KAAKE,kBAAkB,CAACL,OAAO;IACjC;AACF;AAEA,OAAO,eAAeM,QAAQ,EAC5BC,MAAM,EACNC,UAAU,EACVC,mBAAmB,EAAE,EACrBC,QAAQ,EACRC,eAAe,EACfC,gBAAgB,EAChBC,GAAG,EACHC,eAAe,EACfC,uBAAuB,KAAK,EAChB;IACZ,IAAIZ,OAA+Ca;IACnD,IAAIC,WAAW;IAEf,MAAMf,kBAAkB,IAAIgB;IAC5B,IAAIL,IAAIM,MAAM,EAAE;QACdN,IAAIM,MAAM,CAACC,gBAAgB,CAAC,SAAS;YACnCnB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;IAEA,IAAI;QACF,MAAMkB,YAAY,MAAM3B,aAAa;YACnCc;YACAE;YACAE;YACAC;YACAC;QACF;QAEA,MAAM,EAAEQ,OAAO,EAAE,GAAG3B,WAAW;YAC7Bc;YACAY;YACAX;YACAK;QACF;QAEA,MAAMQ,kBAAkBhB,OAAOiB,kBAAkB,CAACF;QAElD,qCAAqC;QACrC,MAAMG,aAAa,MAAMF,gBAAgBG,aAAa;QACtD,MAAMC,WAAWF,WAAWG,aAAa;QAEzC,IAAI,CAACD,UAAU;YACb,OAAO,IAAIE,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,uBAAuB;QACvB,MAAMC,cAAclB,IAAImB,OAAO,CAACC,GAAG,CAAC;QACpC,MAAMC,cAActC,oBAAoB;YAAE+B;YAAUI;QAAY;QAEhE,IAAIG,YAAYC,IAAI,KAAK,WAAW;YAClC,OAAO,IAAIN,SAAS,MAAM;gBACxBG,SAAS,IAAII,QAAQF,YAAYF,OAAO;gBACxCF,QAAQI,YAAYJ,MAAM;YAC5B;QACF;QAEA,iCAAiC;QACjC3B,OACE+B,YAAYC,IAAI,KAAK,YACjB,MAAMZ,gBAAgBc,QAAQ,CAC5BH,YAAYI,UAAU,EACtBJ,YAAYK,QAAQ,GAAGL,YAAYI,UAAU,GAAG,GAChD;YAAEE,aAAatC,gBAAgBiB,MAAM;QAAC,KAExC,MAAMI,gBAAgBc,QAAQ,CAAC,GAAGrB,WAAW;YAAEwB,aAAatC,gBAAgBiB,MAAM;QAAC;QAEzF,IAAIa,UAAU,IAAII,QAAQzB;QAE1B,4CAA4C;QAC5C,KAAK,MAAM,CAAC8B,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACV,YAAYF,OAAO,EAAG;YAC9DA,QAAQa,MAAM,CAACJ,KAAKC;QACtB;QAEA,6BAA6B;QAC7BV,QAAQa,MAAM,CAAC,gBAAgBC,OAAOrB,WAAWsB,WAAW;QAC5D,IAAItB,WAAWuB,IAAI,EAAE;YACnBhB,QAAQa,MAAM,CAAC,QAAQC,OAAOrB,WAAWuB,IAAI;QAC/C;QAEA,8EAA8E;QAC9E,IAAIvB,WAAWsB,WAAW,KAAK,iBAAiB;YAC9Cf,QAAQa,MAAM,CAAC,2BAA2B;QAC5C;QAEA,MAAMI,kBAAkBpC,IAAImB,OAAO,CAACC,GAAG,CAAC,WAAWpB,IAAImB,OAAO,CAACC,GAAG,CAAC;QAEnE,IACEzB,WAAW0C,MAAM,IACjB,OAAO1C,WAAW0C,MAAM,KAAK,YAC7B,OAAO1C,WAAW0C,MAAM,CAACC,qBAAqB,KAAK,YACnD;YACAnB,UAAUxB,WAAW0C,MAAM,CAACC,qBAAqB,CAAC;gBAAEnB;YAAQ,MAAMA;QACpE;QAEA,IAAIiB,mBAAmBA,oBAAoBxB,WAAWuB,IAAI,EAAE;YAC1D,OAAO,IAAInB,SAAS,MAAM;gBACxBG;gBACAF,QAAQ;YACV;QACF;QAEA,IAAI,CAAC3B,KAAKE,kBAAkB,IAAI,CAACR,qBAAqBM,KAAKE,kBAAkB,GAAG;YAC9E,OAAO,IAAIwB,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMsB,SAASjD,KAAKE,kBAAkB;QACtC+C,OAAOC,EAAE,CAAC,SAAS,CAACC;YAClBzC,IAAI0C,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;gBACvBH;gBACAI,KAAK;YACP;YACAzD,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;QAEAc,WAAW;QACX,OAAO,IAAIY,SAASuB,QAAQ;YAAEpB;YAASF,QAAQI,YAAYJ,MAAM;QAAC;IACpE,EAAE,OAAOwB,KAAc;QACrB,IAAIA,eAAe9D,aAAa8D,IAAIK,UAAU,KAAK,KAAK;YACtD,OAAO,IAAI9B,SAAS,MAAM;gBAAEC,QAAQ;gBAAK8B,YAAY;YAAY;QACnE;QACA/C,IAAI0C,OAAO,CAACC,MAAM,CAACC,KAAK,CAACH;QACzB,OAAO,IAAIzB,SAAS,yBAAyB;YAAEC,QAAQ;QAAI;IAC7D,SAAU;QACR,IAAI,CAACb,UAAU;YACbhB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;AACF"}
+{"version":3,"sources":["../src/getFile.ts"],"sourcesContent":["import type { BlobDownloadResponseParsed, ContainerClient } from '@azure/storage-blob'\nimport type { CollectionConfig, FileHandlerOperation, PayloadRequest, TypeWithID } from 'payload'\nimport type { Readable } from 'stream'\n\nimport { RestError } from '@azure/storage-blob'\nimport {\n  buildStoragePathData,\n  getFilePrefix as getDocPrefix,\n} from '@payloadcms/plugin-cloud-storage/utilities'\nimport { getRangeRequestInfo, isXmlMimeType, uploadContentSecurityPolicy } from 'payload/internal'\n\ninterface GetFileArgs {\n  client: ContainerClient\n  collection: CollectionConfig\n  collectionPrefix?: string\n  doc?: TypeWithID\n  filename: string\n  incomingHeaders?: Headers\n  operation?: FileHandlerOperation\n  req: PayloadRequest\n  uploadReference?: unknown\n  useCompositePrefixes?: boolean\n}\n\nconst isNodeReadableStream = (\n  body: BlobDownloadResponseParsed['readableStreamBody'],\n): body is Readable => {\n  return (\n    typeof body === 'object' &&\n    body !== null &&\n    'pipe' in body &&\n    typeof body.pipe === 'function' &&\n    'destroy' in body &&\n    typeof body.destroy === 'function'\n  )\n}\n\nconst abortRequestAndDestroyStream = ({\n  abortController,\n  blob,\n}: {\n  abortController: AbortController\n  blob?: BlobDownloadResponseParsed\n}) => {\n  try {\n    abortController.abort()\n  } catch {\n    /* noop */\n  }\n  if (blob?.readableStreamBody && isNodeReadableStream(blob.readableStreamBody)) {\n    blob.readableStreamBody.destroy()\n  }\n}\n\nexport async function getFile({\n  client,\n  collection,\n  collectionPrefix = '',\n  doc,\n  filename,\n  incomingHeaders,\n  operation = 'read',\n  req,\n  uploadReference,\n  useCompositePrefixes = false,\n}: GetFileArgs): Promise<Response> {\n  const isTransformSource = operation === 'transform'\n  let blob: BlobDownloadResponseParsed | undefined = undefined\n  let streamed = false\n\n  const abortController = new AbortController()\n  if (req.signal) {\n    req.signal.addEventListener('abort', () => {\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n  }\n\n  try {\n    const docPrefix = await getDocPrefix({\n      collection,\n      collectionPrefix,\n      doc,\n      filename,\n      req,\n      uploadReference,\n      useCompositePrefixes,\n    })\n\n    const { storageFilePath } = buildStoragePathData({\n      collectionPrefix,\n      docPrefix,\n      filename,\n      useCompositePrefixes,\n    })\n\n    const blockBlobClient = client.getBlockBlobClient(storageFilePath)\n\n    const properties = await blockBlobClient.getProperties()\n    const fileSize = properties.contentLength\n\n    if (!fileSize) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    const rangeHeader = isTransformSource ? null : req.headers.get('range')\n    const rangeResult = getRangeRequestInfo({ fileSize, rangeHeader })\n\n    if (rangeResult.type === 'invalid') {\n      return new Response(null, {\n        headers: new Headers(rangeResult.headers),\n        status: rangeResult.status,\n      })\n    }\n\n    blob =\n      rangeResult.type === 'partial'\n        ? await blockBlobClient.download(\n            rangeResult.rangeStart,\n            rangeResult.rangeEnd - rangeResult.rangeStart + 1,\n            { abortSignal: abortController.signal },\n          )\n        : await blockBlobClient.download(0, undefined, { abortSignal: abortController.signal })\n\n    let headers = new Headers(incomingHeaders)\n\n    for (const [key, value] of Object.entries(rangeResult.headers)) {\n      headers.append(key, value)\n    }\n\n    headers.append('Content-Type', String(properties.contentType))\n    if (properties.etag) {\n      headers.append('ETag', String(properties.etag))\n    }\n\n    // Apply a restrictive policy to XML-family responses served through Payload.\n    if (isXmlMimeType(properties.contentType)) {\n      headers.append('Content-Security-Policy', uploadContentSecurityPolicy)\n    }\n\n    const etagFromHeaders = req.headers.get('etag') || req.headers.get('if-none-match')\n\n    if (\n      !isTransformSource &&\n      collection.upload &&\n      typeof collection.upload === 'object' &&\n      typeof collection.upload.modifyResponseHeaders === 'function'\n    ) {\n      headers = collection.upload.modifyResponseHeaders({ headers }) || headers\n    }\n\n    if (!isTransformSource && etagFromHeaders && etagFromHeaders === properties.etag) {\n      return new Response(null, {\n        headers,\n        status: 304,\n      })\n    }\n\n    if (!blob.readableStreamBody || !isNodeReadableStream(blob.readableStreamBody)) {\n      return new Response('Internal Server Error', { status: 500 })\n    }\n\n    const stream = blob.readableStreamBody\n    stream.on('error', (err: Error) => {\n      req.payload.logger.error({\n        err,\n        msg: 'Error while streaming Azure blob (aborting)',\n      })\n      abortRequestAndDestroyStream({ abortController, blob })\n    })\n\n    streamed = true\n    return new Response(stream, { headers, status: rangeResult.status })\n  } catch (err: unknown) {\n    if (err instanceof RestError && err.statusCode === 404) {\n      return new Response(null, { status: 404, statusText: 'Not Found' })\n    }\n    req.payload.logger.error(err)\n    return new Response('Internal Server Error', { status: 500 })\n  } finally {\n    if (!streamed) {\n      abortRequestAndDestroyStream({ abortController, blob })\n    }\n  }\n}\n"],"names":["RestError","buildStoragePathData","getFilePrefix","getDocPrefix","getRangeRequestInfo","isXmlMimeType","uploadContentSecurityPolicy","isNodeReadableStream","body","pipe","destroy","abortRequestAndDestroyStream","abortController","blob","abort","readableStreamBody","getFile","client","collection","collectionPrefix","doc","filename","incomingHeaders","operation","req","uploadReference","useCompositePrefixes","isTransformSource","undefined","streamed","AbortController","signal","addEventListener","docPrefix","storageFilePath","blockBlobClient","getBlockBlobClient","properties","getProperties","fileSize","contentLength","Response","status","rangeHeader","headers","get","rangeResult","type","Headers","download","rangeStart","rangeEnd","abortSignal","key","value","Object","entries","append","String","contentType","etag","etagFromHeaders","upload","modifyResponseHeaders","stream","on","err","payload","logger","error","msg","statusCode","statusText"],"mappings":"AAIA,SAASA,SAAS,QAAQ,sBAAqB;AAC/C,SACEC,oBAAoB,EACpBC,iBAAiBC,YAAY,QACxB,6CAA4C;AACnD,SAASC,mBAAmB,EAAEC,aAAa,EAAEC,2BAA2B,QAAQ,mBAAkB;AAelG,MAAMC,uBAAuB,CAC3BC;IAEA,OACE,OAAOA,SAAS,YAChBA,SAAS,QACT,UAAUA,QACV,OAAOA,KAAKC,IAAI,KAAK,cACrB,aAAaD,QACb,OAAOA,KAAKE,OAAO,KAAK;AAE5B;AAEA,MAAMC,+BAA+B,CAAC,EACpCC,eAAe,EACfC,IAAI,EAIL;IACC,IAAI;QACFD,gBAAgBE,KAAK;IACvB,EAAE,OAAM;IACN,QAAQ,GACV;IACA,IAAID,MAAME,sBAAsBR,qBAAqBM,KAAKE,kBAAkB,GAAG;QAC7EF,KAAKE,kBAAkB,CAACL,OAAO;IACjC;AACF;AAEA,OAAO,eAAeM,QAAQ,EAC5BC,MAAM,EACNC,UAAU,EACVC,mBAAmB,EAAE,EACrBC,GAAG,EACHC,QAAQ,EACRC,eAAe,EACfC,YAAY,MAAM,EAClBC,GAAG,EACHC,eAAe,EACfC,uBAAuB,KAAK,EAChB;IACZ,MAAMC,oBAAoBJ,cAAc;IACxC,IAAIV,OAA+Ce;IACnD,IAAIC,WAAW;IAEf,MAAMjB,kBAAkB,IAAIkB;IAC5B,IAAIN,IAAIO,MAAM,EAAE;QACdP,IAAIO,MAAM,CAACC,gBAAgB,CAAC,SAAS;YACnCrB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;IAEA,IAAI;QACF,MAAMoB,YAAY,MAAM9B,aAAa;YACnCe;YACAC;YACAC;YACAC;YACAG;YACAC;YACAC;QACF;QAEA,MAAM,EAAEQ,eAAe,EAAE,GAAGjC,qBAAqB;YAC/CkB;YACAc;YACAZ;YACAK;QACF;QAEA,MAAMS,kBAAkBlB,OAAOmB,kBAAkB,CAACF;QAElD,MAAMG,aAAa,MAAMF,gBAAgBG,aAAa;QACtD,MAAMC,WAAWF,WAAWG,aAAa;QAEzC,IAAI,CAACD,UAAU;YACb,OAAO,IAAIE,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMC,cAAchB,oBAAoB,OAAOH,IAAIoB,OAAO,CAACC,GAAG,CAAC;QAC/D,MAAMC,cAAc1C,oBAAoB;YAAEmC;YAAUI;QAAY;QAEhE,IAAIG,YAAYC,IAAI,KAAK,WAAW;YAClC,OAAO,IAAIN,SAAS,MAAM;gBACxBG,SAAS,IAAII,QAAQF,YAAYF,OAAO;gBACxCF,QAAQI,YAAYJ,MAAM;YAC5B;QACF;QAEA7B,OACEiC,YAAYC,IAAI,KAAK,YACjB,MAAMZ,gBAAgBc,QAAQ,CAC5BH,YAAYI,UAAU,EACtBJ,YAAYK,QAAQ,GAAGL,YAAYI,UAAU,GAAG,GAChD;YAAEE,aAAaxC,gBAAgBmB,MAAM;QAAC,KAExC,MAAMI,gBAAgBc,QAAQ,CAAC,GAAGrB,WAAW;YAAEwB,aAAaxC,gBAAgBmB,MAAM;QAAC;QAEzF,IAAIa,UAAU,IAAII,QAAQ1B;QAE1B,KAAK,MAAM,CAAC+B,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACV,YAAYF,OAAO,EAAG;YAC9DA,QAAQa,MAAM,CAACJ,KAAKC;QACtB;QAEAV,QAAQa,MAAM,CAAC,gBAAgBC,OAAOrB,WAAWsB,WAAW;QAC5D,IAAItB,WAAWuB,IAAI,EAAE;YACnBhB,QAAQa,MAAM,CAAC,QAAQC,OAAOrB,WAAWuB,IAAI;QAC/C;QAEA,6EAA6E;QAC7E,IAAIvD,cAAcgC,WAAWsB,WAAW,GAAG;YACzCf,QAAQa,MAAM,CAAC,2BAA2BnD;QAC5C;QAEA,MAAMuD,kBAAkBrC,IAAIoB,OAAO,CAACC,GAAG,CAAC,WAAWrB,IAAIoB,OAAO,CAACC,GAAG,CAAC;QAEnE,IACE,CAAClB,qBACDT,WAAW4C,MAAM,IACjB,OAAO5C,WAAW4C,MAAM,KAAK,YAC7B,OAAO5C,WAAW4C,MAAM,CAACC,qBAAqB,KAAK,YACnD;YACAnB,UAAU1B,WAAW4C,MAAM,CAACC,qBAAqB,CAAC;gBAAEnB;YAAQ,MAAMA;QACpE;QAEA,IAAI,CAACjB,qBAAqBkC,mBAAmBA,oBAAoBxB,WAAWuB,IAAI,EAAE;YAChF,OAAO,IAAInB,SAAS,MAAM;gBACxBG;gBACAF,QAAQ;YACV;QACF;QAEA,IAAI,CAAC7B,KAAKE,kBAAkB,IAAI,CAACR,qBAAqBM,KAAKE,kBAAkB,GAAG;YAC9E,OAAO,IAAI0B,SAAS,yBAAyB;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMsB,SAASnD,KAAKE,kBAAkB;QACtCiD,OAAOC,EAAE,CAAC,SAAS,CAACC;YAClB1C,IAAI2C,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;gBACvBH;gBACAI,KAAK;YACP;YACA3D,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;QAEAgB,WAAW;QACX,OAAO,IAAIY,SAASuB,QAAQ;YAAEpB;YAASF,QAAQI,YAAYJ,MAAM;QAAC;IACpE,EAAE,OAAOwB,KAAc;QACrB,IAAIA,eAAelE,aAAakE,IAAIK,UAAU,KAAK,KAAK;YACtD,OAAO,IAAI9B,SAAS,MAAM;gBAAEC,QAAQ;gBAAK8B,YAAY;YAAY;QACnE;QACAhD,IAAI2C,OAAO,CAACC,MAAM,CAACC,KAAK,CAACH;QACzB,OAAO,IAAIzB,SAAS,yBAAyB;YAAEC,QAAQ;QAAI;IAC7D,SAAU;QACR,IAAI,CAACb,UAAU;YACblB,6BAA6B;gBAAEC;gBAAiBC;YAAK;QACvD;IACF;AACF"}

package/dist/index.d.ts

@@ -8,16 +8,6 @@ export type AzureStorageOptions = {
      * @default false
      */
     allowContainerCreate: boolean;
-    /**
-     * When enabled, fields (like the prefix field) will always be inserted into
-     * the collection schema regardless of whether the plugin is enabled. This
-     * ensures a consistent schema across all environments.
-     *
-     * This will be enabled by default in Payload v4.
-     *
-     * @default false
-     */
-    alwaysInsertFields?: boolean;
     /**
      * Base URL for the Azure Blob storage account
      */
@@ -47,6 +37,21 @@ export type AzureStorageOptions = {
      * Azure Blob storage connection string
      */
     connectionString: string;
+    /**
+     * Public access level applied to a container that the plugin creates via
+     * `allowContainerCreate`. Has no effect on containers that already exist.
+     *
+     * - `'private'` (default): no anonymous access. Blobs are reachable only
+     *   through Payload's access-controlled file route.
+     * - `'blob'`: unauthenticated clients can read any blob directly from Azure.
+     * - `'container'`: unauthenticated clients can read and list blobs directly.
+     *
+     * Only choose `'blob'` or `'container'` if you deliberately want files served
+     * publicly from Azure, bypassing Payload read access control.
+     *
+     * @default 'private'
+     */
+    containerAccess?: 'blob' | 'container' | 'private';
     /**
      * Azure Blob storage container name
      */
@@ -59,14 +64,15 @@ export type AzureStorageOptions = {
     enabled?: boolean;
     /**
      * When true, the collection-level prefix and document-level prefix are combined
-     * (compositional). When false (default), document prefix overrides collection
-     * prefix entirely.
+     * (compositional). When false (default), a document prefix already within the
+     * collection prefix is used as-is for new uploads; otherwise it is nested beneath it.
+     * Existing files retain their stored prefixes for reads, URLs, and cleanup.
      *
-     * Example:
-     * - collection prefix: `collection-prefix/`
-     * - document prefix: `document-prefix/`
-     * - resulting prefix with useCompositePrefixes=true: `collection-prefix/document-prefix/`
-     * - resulting prefix with useCompositePrefixes=false: `document-prefix/`
+     * Example with a document prefix already contained by the collection prefix:
+     * - collection prefix: `uploads/`
+     * - document prefix: `uploads/documents/`
+     * - resulting prefix with useCompositePrefixes=true: `uploads/uploads/documents/`
+     * - resulting prefix with useCompositePrefixes=false: `uploads/documents/`
      *
      * @default false
      */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEnB,iBAAiB,EAClB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,KAAK,EAAU,cAAc,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAK3E,OAAO,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEtF,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IAEnC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;IAE7F;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED,KAAK,mBAAmB,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,KAAK,cAAc,CAAA;AAEpF,eAAO,MAAM,YAAY,EAAE,mBA2EzB,CAAA;AAEF,OAAO,EAAE,oBAAoB,IAAI,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEnB,iBAAiB,EAClB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,KAAK,EAAU,cAAc,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAK3E,OAAO,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEtF,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAE7B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IAEnC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;IAE7F;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAA;IAExB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAA;IAElD;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAED,KAAK,mBAAmB,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,KAAK,cAAc,CAAA;AAEpF,eAAO,MAAM,YAAY,EAAE,mBAiGzB,CAAA;AAEF,OAAO,EAAE,oBAAoB,IAAI,gBAAgB,EAAE,CAAA"}

package/dist/index.js

@@ -11,15 +11,35 @@ export const azureStorage = (azureStorageOptions)=>({
                 });
             const isPluginDisabled = azureStorageOptions.enabled === false;
             if (isPluginDisabled) {
-                return incomingConfig;
+                // Still call cloudStoragePlugin with adapter: null so fields (like prefix) are
+                // inserted into the schema, keeping it consistent across environments.
+                const collectionsWithoutAdapter = Object.entries(azureStorageOptions.collections).reduce((acc, [slug, collOptions])=>({
+                        ...acc,
+                        [slug]: {
+                            ...collOptions === true ? {} : collOptions,
+                            adapter: null
+                        }
+                    }), {});
+                return cloudStoragePlugin({
+                    collections: collectionsWithoutAdapter,
+                    enabled: false,
+                    useCompositePrefixes: azureStorageOptions.useCompositePrefixes
+                })(incomingConfig);
             }
-            const createContainerIfNotExists = ()=>{
-                void getStorageClientFunc({
+            const createContainerIfNotExists = async ()=>{
+                const containerClient = getStorageClientFunc({
                     connectionString: azureStorageOptions.connectionString,
                     containerName: azureStorageOptions.containerName
-                }).createIfNotExists({
-                    access: 'blob'
                 });
+                // Private by default; public access is opt-in via `containerAccess`.
+                const containerAccess = azureStorageOptions.containerAccess ?? 'private';
+                if (containerAccess === 'private') {
+                    await containerClient.createIfNotExists();
+                } else {
+                    await containerClient.createIfNotExists({
+                        access: containerAccess
+                    });
+                }
             };
             const adapter = createAzureAdapter({
                 allowContainerCreate: azureStorageOptions.allowContainerCreate,
@@ -55,7 +75,6 @@ export const azureStorage = (azureStorageOptions)=>({
                 })
             };
             return cloudStoragePlugin({
-                alwaysInsertFields: azureStorageOptions.alwaysInsertFields,
                 collections: collectionsWithAdapter,
                 useCompositePrefixes: azureStorageOptions.useCompositePrefixes
             })(config);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  ClientUploadsConfig,\n  PluginOptions as CloudStoragePluginOptions,\n  CollectionOptions,\n} from '@payloadcms/plugin-cloud-storage/types'\nimport type { Config, StorageAdapter, UploadCollectionSlug } from 'payload'\n\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\n\nimport { createAzureAdapter } from './adapter.js'\nimport { getStorageClient as getStorageClientFunc } from './utils/getStorageClient.js'\n\nexport type AzureStorageOptions = {\n  /**\n   * Whether or not to allow the container to be created if it does not exist\n   *\n   * @default false\n   */\n  allowContainerCreate: boolean\n\n  /**\n   * When enabled, fields (like the prefix field) will always be inserted into\n   * the collection schema regardless of whether the plugin is enabled. This\n   * ensures a consistent schema across all environments.\n   *\n   * This will be enabled by default in Payload v4.\n   *\n   * @default false\n   */\n  alwaysInsertFields?: boolean\n\n  /**\n   * Base URL for the Azure Blob storage account\n   */\n  baseURL: string\n\n  /**\n   * Optional cache key to identify the Azure Blob storage client instance.\n   * If not provided, a default key will be used.\n   *\n   * @default `azure:containerName`\n   */\n  clientCacheKey?: string\n\n  /**\n   * Do uploads directly on the client to bypass limits on Vercel.\n   *\n   * Client uploads use the Azure Blob SDK, which splits large files into blocks\n   * (avoiding the ~5GB limit of a single upload request). The SDK sends `x-ms-*`\n   * headers, so the browser issues a CORS preflight: your storage account's CORS\n   * rules must allow the `OPTIONS` and `PUT` methods and the required headers\n   * (allowed headers `*`, or at minimum `x-ms-*,content-type,content-length`).\n   */\n  clientUploads?: ClientUploadsConfig\n\n  /**\n   * Collection options to apply the Azure Blob adapter to.\n   */\n  collections: Partial<Record<UploadCollectionSlug, Omit<CollectionOptions, 'adapter'> | true>>\n\n  /**\n   * Azure Blob storage connection string\n   */\n  connectionString: string\n\n  /**\n   * Azure Blob storage container name\n   */\n  containerName: string\n\n  /**\n   * Whether or not to enable the plugin\n   *\n   * Default: true\n   */\n  enabled?: boolean\n  /**\n   * When true, the collection-level prefix and document-level prefix are combined\n   * (compositional). When false (default), document prefix overrides collection\n   * prefix entirely.\n   *\n   * Example:\n   * - collection prefix: `collection-prefix/`\n   * - document prefix: `document-prefix/`\n   * - resulting prefix with useCompositePrefixes=true: `collection-prefix/document-prefix/`\n   * - resulting prefix with useCompositePrefixes=false: `document-prefix/`\n   *\n   * @default false\n   */\n  useCompositePrefixes?: boolean\n}\n\ntype AzureStorageFactory = (azureStorageArgs: AzureStorageOptions) => StorageAdapter\n\nexport const azureStorage: AzureStorageFactory = (\n  azureStorageOptions: AzureStorageOptions,\n): StorageAdapter => ({\n  name: 'azure',\n  collections: Object.keys(azureStorageOptions.collections),\n  init: (incomingConfig: Config): Config => {\n    const getStorageClient = () =>\n      getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      })\n\n    const isPluginDisabled = azureStorageOptions.enabled === false\n\n    if (isPluginDisabled) {\n      return incomingConfig\n    }\n\n    const createContainerIfNotExists = () => {\n      void getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      }).createIfNotExists({\n        access: 'blob',\n      })\n    }\n\n    const adapter = createAzureAdapter({\n      allowContainerCreate: azureStorageOptions.allowContainerCreate,\n      baseURL: azureStorageOptions.baseURL,\n      clientUploads: azureStorageOptions.clientUploads,\n      containerName: azureStorageOptions.containerName,\n      createContainerIfNotExists,\n      getStorageClient,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })\n\n    // Add adapter to each collection option object\n    const collectionsWithAdapter: CloudStoragePluginOptions['collections'] = Object.entries(\n      azureStorageOptions.collections,\n    ).reduce(\n      (acc, [slug, collOptions]) => ({\n        ...acc,\n        [slug]: {\n          ...(collOptions === true ? {} : collOptions),\n          adapter,\n        },\n      }),\n      {} as Record<string, CollectionOptions>,\n    )\n\n    // Set disableLocalStorage: true for collections specified in the plugin options\n    const config = {\n      ...incomingConfig,\n      collections: (incomingConfig.collections || []).map((collection) => {\n        if (!collectionsWithAdapter[collection.slug]) {\n          return collection\n        }\n\n        return {\n          ...collection,\n          upload: {\n            ...(typeof collection.upload === 'object' ? collection.upload : {}),\n            disableLocalStorage: true,\n          },\n        }\n      }),\n    }\n\n    return cloudStoragePlugin({\n      alwaysInsertFields: azureStorageOptions.alwaysInsertFields,\n      collections: collectionsWithAdapter,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })(config)\n  },\n})\n\nexport { getStorageClientFunc as getStorageClient }\n"],"names":["cloudStoragePlugin","createAzureAdapter","getStorageClient","getStorageClientFunc","azureStorage","azureStorageOptions","name","collections","Object","keys","init","incomingConfig","connectionString","containerName","isPluginDisabled","enabled","createContainerIfNotExists","createIfNotExists","access","adapter","allowContainerCreate","baseURL","clientUploads","useCompositePrefixes","collectionsWithAdapter","entries","reduce","acc","slug","collOptions","config","map","collection","upload","disableLocalStorage","alwaysInsertFields"],"mappings":"AAOA,SAASA,kBAAkB,QAAQ,mCAAkC;AAErE,SAASC,kBAAkB,QAAQ,eAAc;AACjD,SAASC,oBAAoBC,oBAAoB,QAAQ,8BAA6B;AAoFtF,OAAO,MAAMC,eAAoC,CAC/CC,sBACoB,CAAA;QACpBC,MAAM;QACNC,aAAaC,OAAOC,IAAI,CAACJ,oBAAoBE,WAAW;QACxDG,MAAM,CAACC;YACL,MAAMT,mBAAmB,IACvBC,qBAAqB;oBACnBS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD;YAEF,MAAMC,mBAAmBT,oBAAoBU,OAAO,KAAK;YAEzD,IAAID,kBAAkB;gBACpB,OAAOH;YACT;YAEA,MAAMK,6BAA6B;gBACjC,KAAKb,qBAAqB;oBACxBS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD,GAAGI,iBAAiB,CAAC;oBACnBC,QAAQ;gBACV;YACF;YAEA,MAAMC,UAAUlB,mBAAmB;gBACjCmB,sBAAsBf,oBAAoBe,oBAAoB;gBAC9DC,SAAShB,oBAAoBgB,OAAO;gBACpCC,eAAejB,oBAAoBiB,aAAa;gBAChDT,eAAeR,oBAAoBQ,aAAa;gBAChDG;gBACAd;gBACAqB,sBAAsBlB,oBAAoBkB,oBAAoB;YAChE;YAEA,+CAA+C;YAC/C,MAAMC,yBAAmEhB,OAAOiB,OAAO,CACrFpB,oBAAoBE,WAAW,EAC/BmB,MAAM,CACN,CAACC,KAAK,CAACC,MAAMC,YAAY,GAAM,CAAA;oBAC7B,GAAGF,GAAG;oBACN,CAACC,KAAK,EAAE;wBACN,GAAIC,gBAAgB,OAAO,CAAC,IAAIA,WAAW;wBAC3CV;oBACF;gBACF,CAAA,GACA,CAAC;YAGH,gFAAgF;YAChF,MAAMW,SAAS;gBACb,GAAGnB,cAAc;gBACjBJ,aAAa,AAACI,CAAAA,eAAeJ,WAAW,IAAI,EAAE,AAAD,EAAGwB,GAAG,CAAC,CAACC;oBACnD,IAAI,CAACR,sBAAsB,CAACQ,WAAWJ,IAAI,CAAC,EAAE;wBAC5C,OAAOI;oBACT;oBAEA,OAAO;wBACL,GAAGA,UAAU;wBACbC,QAAQ;4BACN,GAAI,OAAOD,WAAWC,MAAM,KAAK,WAAWD,WAAWC,MAAM,GAAG,CAAC,CAAC;4BAClEC,qBAAqB;wBACvB;oBACF;gBACF;YACF;YAEA,OAAOlC,mBAAmB;gBACxBmC,oBAAoB9B,oBAAoB8B,kBAAkB;gBAC1D5B,aAAaiB;gBACbD,sBAAsBlB,oBAAoBkB,oBAAoB;YAChE,GAAGO;QACL;IACF,CAAA,EAAE;AAEF,SAAS3B,wBAAwBD,gBAAgB,GAAE"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  ClientUploadsConfig,\n  PluginOptions as CloudStoragePluginOptions,\n  CollectionOptions,\n} from '@payloadcms/plugin-cloud-storage/types'\nimport type { Config, StorageAdapter, UploadCollectionSlug } from 'payload'\n\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\n\nimport { createAzureAdapter } from './adapter.js'\nimport { getStorageClient as getStorageClientFunc } from './utils/getStorageClient.js'\n\nexport type AzureStorageOptions = {\n  /**\n   * Whether or not to allow the container to be created if it does not exist\n   *\n   * @default false\n   */\n  allowContainerCreate: boolean\n\n  /**\n   * Base URL for the Azure Blob storage account\n   */\n  baseURL: string\n\n  /**\n   * Optional cache key to identify the Azure Blob storage client instance.\n   * If not provided, a default key will be used.\n   *\n   * @default `azure:containerName`\n   */\n  clientCacheKey?: string\n\n  /**\n   * Do uploads directly on the client to bypass limits on Vercel.\n   *\n   * Client uploads use the Azure Blob SDK, which splits large files into blocks\n   * (avoiding the ~5GB limit of a single upload request). The SDK sends `x-ms-*`\n   * headers, so the browser issues a CORS preflight: your storage account's CORS\n   * rules must allow the `OPTIONS` and `PUT` methods and the required headers\n   * (allowed headers `*`, or at minimum `x-ms-*,content-type,content-length`).\n   */\n  clientUploads?: ClientUploadsConfig\n\n  /**\n   * Collection options to apply the Azure Blob adapter to.\n   */\n  collections: Partial<Record<UploadCollectionSlug, Omit<CollectionOptions, 'adapter'> | true>>\n\n  /**\n   * Azure Blob storage connection string\n   */\n  connectionString: string\n\n  /**\n   * Public access level applied to a container that the plugin creates via\n   * `allowContainerCreate`. Has no effect on containers that already exist.\n   *\n   * - `'private'` (default): no anonymous access. Blobs are reachable only\n   *   through Payload's access-controlled file route.\n   * - `'blob'`: unauthenticated clients can read any blob directly from Azure.\n   * - `'container'`: unauthenticated clients can read and list blobs directly.\n   *\n   * Only choose `'blob'` or `'container'` if you deliberately want files served\n   * publicly from Azure, bypassing Payload read access control.\n   *\n   * @default 'private'\n   */\n  containerAccess?: 'blob' | 'container' | 'private'\n\n  /**\n   * Azure Blob storage container name\n   */\n  containerName: string\n\n  /**\n   * Whether or not to enable the plugin\n   *\n   * Default: true\n   */\n  enabled?: boolean\n  /**\n   * When true, the collection-level prefix and document-level prefix are combined\n   * (compositional). When false (default), a document prefix already within the\n   * collection prefix is used as-is for new uploads; otherwise it is nested beneath it.\n   * Existing files retain their stored prefixes for reads, URLs, and cleanup.\n   *\n   * Example with a document prefix already contained by the collection prefix:\n   * - collection prefix: `uploads/`\n   * - document prefix: `uploads/documents/`\n   * - resulting prefix with useCompositePrefixes=true: `uploads/uploads/documents/`\n   * - resulting prefix with useCompositePrefixes=false: `uploads/documents/`\n   *\n   * @default false\n   */\n  useCompositePrefixes?: boolean\n}\n\ntype AzureStorageFactory = (azureStorageArgs: AzureStorageOptions) => StorageAdapter\n\nexport const azureStorage: AzureStorageFactory = (\n  azureStorageOptions: AzureStorageOptions,\n): StorageAdapter => ({\n  name: 'azure',\n  collections: Object.keys(azureStorageOptions.collections),\n  init: (incomingConfig: Config): Config => {\n    const getStorageClient = () =>\n      getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      })\n\n    const isPluginDisabled = azureStorageOptions.enabled === false\n\n    if (isPluginDisabled) {\n      // Still call cloudStoragePlugin with adapter: null so fields (like prefix) are\n      // inserted into the schema, keeping it consistent across environments.\n      const collectionsWithoutAdapter: CloudStoragePluginOptions['collections'] = Object.entries(\n        azureStorageOptions.collections,\n      ).reduce(\n        (acc, [slug, collOptions]) => ({\n          ...acc,\n          [slug]: { ...(collOptions === true ? {} : collOptions), adapter: null },\n        }),\n        {} as Record<string, CollectionOptions>,\n      )\n\n      return cloudStoragePlugin({\n        collections: collectionsWithoutAdapter,\n        enabled: false,\n        useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n      })(incomingConfig)\n    }\n\n    const createContainerIfNotExists = async (): Promise<void> => {\n      const containerClient = getStorageClientFunc({\n        connectionString: azureStorageOptions.connectionString,\n        containerName: azureStorageOptions.containerName,\n      })\n\n      // Private by default; public access is opt-in via `containerAccess`.\n      const containerAccess = azureStorageOptions.containerAccess ?? 'private'\n\n      if (containerAccess === 'private') {\n        await containerClient.createIfNotExists()\n      } else {\n        await containerClient.createIfNotExists({ access: containerAccess })\n      }\n    }\n\n    const adapter = createAzureAdapter({\n      allowContainerCreate: azureStorageOptions.allowContainerCreate,\n      baseURL: azureStorageOptions.baseURL,\n      clientUploads: azureStorageOptions.clientUploads,\n      containerName: azureStorageOptions.containerName,\n      createContainerIfNotExists,\n      getStorageClient,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })\n\n    // Add adapter to each collection option object\n    const collectionsWithAdapter: CloudStoragePluginOptions['collections'] = Object.entries(\n      azureStorageOptions.collections,\n    ).reduce(\n      (acc, [slug, collOptions]) => ({\n        ...acc,\n        [slug]: {\n          ...(collOptions === true ? {} : collOptions),\n          adapter,\n        },\n      }),\n      {} as Record<string, CollectionOptions>,\n    )\n\n    // Set disableLocalStorage: true for collections specified in the plugin options\n    const config = {\n      ...incomingConfig,\n      collections: (incomingConfig.collections || []).map((collection) => {\n        if (!collectionsWithAdapter[collection.slug]) {\n          return collection\n        }\n\n        return {\n          ...collection,\n          upload: {\n            ...(typeof collection.upload === 'object' ? collection.upload : {}),\n            disableLocalStorage: true,\n          },\n        }\n      }),\n    }\n\n    return cloudStoragePlugin({\n      collections: collectionsWithAdapter,\n      useCompositePrefixes: azureStorageOptions.useCompositePrefixes,\n    })(config)\n  },\n})\n\nexport { getStorageClientFunc as getStorageClient }\n"],"names":["cloudStoragePlugin","createAzureAdapter","getStorageClient","getStorageClientFunc","azureStorage","azureStorageOptions","name","collections","Object","keys","init","incomingConfig","connectionString","containerName","isPluginDisabled","enabled","collectionsWithoutAdapter","entries","reduce","acc","slug","collOptions","adapter","useCompositePrefixes","createContainerIfNotExists","containerClient","containerAccess","createIfNotExists","access","allowContainerCreate","baseURL","clientUploads","collectionsWithAdapter","config","map","collection","upload","disableLocalStorage"],"mappings":"AAOA,SAASA,kBAAkB,QAAQ,mCAAkC;AAErE,SAASC,kBAAkB,QAAQ,eAAc;AACjD,SAASC,oBAAoBC,oBAAoB,QAAQ,8BAA6B;AA0FtF,OAAO,MAAMC,eAAoC,CAC/CC,sBACoB,CAAA;QACpBC,MAAM;QACNC,aAAaC,OAAOC,IAAI,CAACJ,oBAAoBE,WAAW;QACxDG,MAAM,CAACC;YACL,MAAMT,mBAAmB,IACvBC,qBAAqB;oBACnBS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD;YAEF,MAAMC,mBAAmBT,oBAAoBU,OAAO,KAAK;YAEzD,IAAID,kBAAkB;gBACpB,+EAA+E;gBAC/E,uEAAuE;gBACvE,MAAME,4BAAsER,OAAOS,OAAO,CACxFZ,oBAAoBE,WAAW,EAC/BW,MAAM,CACN,CAACC,KAAK,CAACC,MAAMC,YAAY,GAAM,CAAA;wBAC7B,GAAGF,GAAG;wBACN,CAACC,KAAK,EAAE;4BAAE,GAAIC,gBAAgB,OAAO,CAAC,IAAIA,WAAW;4BAAGC,SAAS;wBAAK;oBACxE,CAAA,GACA,CAAC;gBAGH,OAAOtB,mBAAmB;oBACxBO,aAAaS;oBACbD,SAAS;oBACTQ,sBAAsBlB,oBAAoBkB,oBAAoB;gBAChE,GAAGZ;YACL;YAEA,MAAMa,6BAA6B;gBACjC,MAAMC,kBAAkBtB,qBAAqB;oBAC3CS,kBAAkBP,oBAAoBO,gBAAgB;oBACtDC,eAAeR,oBAAoBQ,aAAa;gBAClD;gBAEA,qEAAqE;gBACrE,MAAMa,kBAAkBrB,oBAAoBqB,eAAe,IAAI;gBAE/D,IAAIA,oBAAoB,WAAW;oBACjC,MAAMD,gBAAgBE,iBAAiB;gBACzC,OAAO;oBACL,MAAMF,gBAAgBE,iBAAiB,CAAC;wBAAEC,QAAQF;oBAAgB;gBACpE;YACF;YAEA,MAAMJ,UAAUrB,mBAAmB;gBACjC4B,sBAAsBxB,oBAAoBwB,oBAAoB;gBAC9DC,SAASzB,oBAAoByB,OAAO;gBACpCC,eAAe1B,oBAAoB0B,aAAa;gBAChDlB,eAAeR,oBAAoBQ,aAAa;gBAChDW;gBACAtB;gBACAqB,sBAAsBlB,oBAAoBkB,oBAAoB;YAChE;YAEA,+CAA+C;YAC/C,MAAMS,yBAAmExB,OAAOS,OAAO,CACrFZ,oBAAoBE,WAAW,EAC/BW,MAAM,CACN,CAACC,KAAK,CAACC,MAAMC,YAAY,GAAM,CAAA;oBAC7B,GAAGF,GAAG;oBACN,CAACC,KAAK,EAAE;wBACN,GAAIC,gBAAgB,OAAO,CAAC,IAAIA,WAAW;wBAC3CC;oBACF;gBACF,CAAA,GACA,CAAC;YAGH,gFAAgF;YAChF,MAAMW,SAAS;gBACb,GAAGtB,cAAc;gBACjBJ,aAAa,AAACI,CAAAA,eAAeJ,WAAW,IAAI,EAAE,AAAD,EAAG2B,GAAG,CAAC,CAACC;oBACnD,IAAI,CAACH,sBAAsB,CAACG,WAAWf,IAAI,CAAC,EAAE;wBAC5C,OAAOe;oBACT;oBAEA,OAAO;wBACL,GAAGA,UAAU;wBACbC,QAAQ;4BACN,GAAI,OAAOD,WAAWC,MAAM,KAAK,WAAWD,WAAWC,MAAM,GAAG,CAAC,CAAC;4BAClEC,qBAAqB;wBACvB;oBACF;gBACF;YACF;YAEA,OAAOrC,mBAAmB;gBACxBO,aAAayB;gBACbT,sBAAsBlB,oBAAoBkB,oBAAoB;YAChE,GAAGU;QACL;IACF,CAAA,EAAE;AAEF,SAAS9B,wBAAwBD,gBAAgB,GAAE"}

package/dist/isClientUploadAllowed.d.ts

@@ -0,0 +1,6 @@
+export declare const isClientUploadAllowed: (collection?: {
+    upload?: {
+        allowRestrictedFileTypes?: boolean;
+    } | boolean;
+}) => boolean;
+//# sourceMappingURL=isClientUploadAllowed.d.ts.map

package/dist/isClientUploadAllowed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isClientUploadAllowed.d.ts","sourceRoot":"","sources":["../src/isClientUploadAllowed.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,gBAAiB;IACjD,MAAM,CAAC,EAAE;QAAE,wBAAwB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAA;CAC1D,KAAG,OAKD,CAAA"}

package/dist/isClientUploadAllowed.js

@@ -0,0 +1,3 @@
+export const isClientUploadAllowed = (collection)=>Boolean(collection && typeof collection.upload === 'object' && collection.upload.allowRestrictedFileTypes);
+
+//# sourceMappingURL=isClientUploadAllowed.js.map

package/dist/isClientUploadAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/isClientUploadAllowed.ts"],"sourcesContent":["export const isClientUploadAllowed = (collection?: {\n  upload?: { allowRestrictedFileTypes?: boolean } | boolean\n}): boolean =>\n  Boolean(\n    collection &&\n    typeof collection.upload === 'object' &&\n    collection.upload.allowRestrictedFileTypes,\n  )\n"],"names":["isClientUploadAllowed","collection","Boolean","upload","allowRestrictedFileTypes"],"mappings":"AAAA,OAAO,MAAMA,wBAAwB,CAACC,aAGpCC,QACED,cACA,OAAOA,WAAWE,MAAM,KAAK,YAC7BF,WAAWE,MAAM,CAACC,wBAAwB,EAC3C"}

package/dist/uploadFile.d.ts

@@ -2,13 +2,10 @@ import type { ContainerClient } from '@azure/storage-blob';
 interface UploadArgs {
     buffer: Buffer;
     client: ContainerClient;
-    collectionPrefix?: string;
-    docPrefix?: string;
-    filename: string;
     mimeType: string;
+    storageFilePath: string;
     tempFilePath?: string;
-    useCompositePrefixes?: boolean;
 }
-export declare function uploadFile({ buffer, client, collectionPrefix, docPrefix, filename, mimeType, tempFilePath, useCompositePrefixes, }: UploadArgs): Promise<void>;
+export declare function uploadFile({ buffer, client, mimeType, storageFilePath, tempFilePath, }: UploadArgs): Promise<void>;
 export {};
 //# sourceMappingURL=uploadFile.d.ts.map

package/dist/uploadFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploadFile.d.ts","sourceRoot":"","sources":["../src/uploadFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAO1D,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,eAAe,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAID,wBAAsB,UAAU,CAAC,EAC/B,MAAM,EACN,MAAM,EACN,gBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,oBAA4B,GAC7B,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B5B"}
+{"version":3,"file":"uploadFile.d.ts","sourceRoot":"","sources":["../src/uploadFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAM1D,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,eAAe,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAID,wBAAsB,UAAU,CAAC,EAC/B,MAAM,EACN,MAAM,EACN,QAAQ,EACR,eAAe,EACf,YAAY,GACb,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB5B"}

package/dist/uploadFile.js

@@ -1,17 +1,10 @@
 import { AbortController } from '@azure/abort-controller';
-import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
 import fs from 'fs';
 import { Readable } from 'stream';
 const multipartThreshold = 1024 * 1024 * 50 // 50MB
 ;
-export async function uploadFile({ buffer, client, collectionPrefix = '', docPrefix, filename, mimeType, tempFilePath, useCompositePrefixes = false }) {
-    const { fileKey } = getFileKey({
-        collectionPrefix,
-        docPrefix,
-        filename,
-        useCompositePrefixes
-    });
-    const blockBlobClient = client.getBlockBlobClient(fileKey);
+export async function uploadFile({ buffer, client, mimeType, storageFilePath, tempFilePath }) {
+    const blockBlobClient = client.getBlockBlobClient(storageFilePath);
     // when there are no temp files, or the upload is less than the threshold size, do not stream files
     if (!tempFilePath && buffer.length > 0 && buffer.length < multipartThreshold) {
         await blockBlobClient.upload(buffer, buffer.byteLength, {

package/dist/uploadFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/uploadFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\nimport { AbortController } from '@azure/abort-controller'\nimport { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities'\nimport fs from 'fs'\nimport { Readable } from 'stream'\n\ninterface UploadArgs {\n  buffer: Buffer\n  client: ContainerClient\n  collectionPrefix?: string\n  docPrefix?: string\n  filename: string\n  mimeType: string\n  tempFilePath?: string\n  useCompositePrefixes?: boolean\n}\n\nconst multipartThreshold = 1024 * 1024 * 50 // 50MB\n\nexport async function uploadFile({\n  buffer,\n  client,\n  collectionPrefix = '',\n  docPrefix,\n  filename,\n  mimeType,\n  tempFilePath,\n  useCompositePrefixes = false,\n}: UploadArgs): Promise<void> {\n  const { fileKey } = getFileKey({\n    collectionPrefix,\n    docPrefix,\n    filename,\n    useCompositePrefixes,\n  })\n\n  const blockBlobClient = client.getBlockBlobClient(fileKey)\n\n  // when there are no temp files, or the upload is less than the threshold size, do not stream files\n  if (!tempFilePath && buffer.length > 0 && buffer.length < multipartThreshold) {\n    await blockBlobClient.upload(buffer, buffer.byteLength, {\n      blobHTTPHeaders: { blobContentType: mimeType },\n    })\n    return\n  }\n\n  const fileBufferOrStream: Readable = tempFilePath\n    ? fs.createReadStream(tempFilePath)\n    : Readable.from(buffer)\n\n  await blockBlobClient.uploadStream(fileBufferOrStream, 4 * 1024 * 1024, 4, {\n    abortSignal: AbortController.timeout(30 * 60 * 1000),\n    blobHTTPHeaders: { blobContentType: mimeType },\n  })\n}\n"],"names":["AbortController","getFileKey","fs","Readable","multipartThreshold","uploadFile","buffer","client","collectionPrefix","docPrefix","filename","mimeType","tempFilePath","useCompositePrefixes","fileKey","blockBlobClient","getBlockBlobClient","length","upload","byteLength","blobHTTPHeaders","blobContentType","fileBufferOrStream","createReadStream","from","uploadStream","abortSignal","timeout"],"mappings":"AAEA,SAASA,eAAe,QAAQ,0BAAyB;AACzD,SAASC,UAAU,QAAQ,6CAA4C;AACvE,OAAOC,QAAQ,KAAI;AACnB,SAASC,QAAQ,QAAQ,SAAQ;AAajC,MAAMC,qBAAqB,OAAO,OAAO,GAAG,OAAO;;AAEnD,OAAO,eAAeC,WAAW,EAC/BC,MAAM,EACNC,MAAM,EACNC,mBAAmB,EAAE,EACrBC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,YAAY,EACZC,uBAAuB,KAAK,EACjB;IACX,MAAM,EAAEC,OAAO,EAAE,GAAGb,WAAW;QAC7BO;QACAC;QACAC;QACAG;IACF;IAEA,MAAME,kBAAkBR,OAAOS,kBAAkB,CAACF;IAElD,mGAAmG;IACnG,IAAI,CAACF,gBAAgBN,OAAOW,MAAM,GAAG,KAAKX,OAAOW,MAAM,GAAGb,oBAAoB;QAC5E,MAAMW,gBAAgBG,MAAM,CAACZ,QAAQA,OAAOa,UAAU,EAAE;YACtDC,iBAAiB;gBAAEC,iBAAiBV;YAAS;QAC/C;QACA;IACF;IAEA,MAAMW,qBAA+BV,eACjCV,GAAGqB,gBAAgB,CAACX,gBACpBT,SAASqB,IAAI,CAAClB;IAElB,MAAMS,gBAAgBU,YAAY,CAACH,oBAAoB,IAAI,OAAO,MAAM,GAAG;QACzEI,aAAa1B,gBAAgB2B,OAAO,CAAC,KAAK,KAAK;QAC/CP,iBAAiB;YAAEC,iBAAiBV;QAAS;IAC/C;AACF"}
+{"version":3,"sources":["../src/uploadFile.ts"],"sourcesContent":["import type { ContainerClient } from '@azure/storage-blob'\n\nimport { AbortController } from '@azure/abort-controller'\nimport fs from 'fs'\nimport { Readable } from 'stream'\n\ninterface UploadArgs {\n  buffer: Buffer\n  client: ContainerClient\n  mimeType: string\n  storageFilePath: string\n  tempFilePath?: string\n}\n\nconst multipartThreshold = 1024 * 1024 * 50 // 50MB\n\nexport async function uploadFile({\n  buffer,\n  client,\n  mimeType,\n  storageFilePath,\n  tempFilePath,\n}: UploadArgs): Promise<void> {\n  const blockBlobClient = client.getBlockBlobClient(storageFilePath)\n\n  // when there are no temp files, or the upload is less than the threshold size, do not stream files\n  if (!tempFilePath && buffer.length > 0 && buffer.length < multipartThreshold) {\n    await blockBlobClient.upload(buffer, buffer.byteLength, {\n      blobHTTPHeaders: { blobContentType: mimeType },\n    })\n    return\n  }\n\n  const fileBufferOrStream: Readable = tempFilePath\n    ? fs.createReadStream(tempFilePath)\n    : Readable.from(buffer)\n\n  await blockBlobClient.uploadStream(fileBufferOrStream, 4 * 1024 * 1024, 4, {\n    abortSignal: AbortController.timeout(30 * 60 * 1000),\n    blobHTTPHeaders: { blobContentType: mimeType },\n  })\n}\n"],"names":["AbortController","fs","Readable","multipartThreshold","uploadFile","buffer","client","mimeType","storageFilePath","tempFilePath","blockBlobClient","getBlockBlobClient","length","upload","byteLength","blobHTTPHeaders","blobContentType","fileBufferOrStream","createReadStream","from","uploadStream","abortSignal","timeout"],"mappings":"AAEA,SAASA,eAAe,QAAQ,0BAAyB;AACzD,OAAOC,QAAQ,KAAI;AACnB,SAASC,QAAQ,QAAQ,SAAQ;AAUjC,MAAMC,qBAAqB,OAAO,OAAO,GAAG,OAAO;;AAEnD,OAAO,eAAeC,WAAW,EAC/BC,MAAM,EACNC,MAAM,EACNC,QAAQ,EACRC,eAAe,EACfC,YAAY,EACD;IACX,MAAMC,kBAAkBJ,OAAOK,kBAAkB,CAACH;IAElD,mGAAmG;IACnG,IAAI,CAACC,gBAAgBJ,OAAOO,MAAM,GAAG,KAAKP,OAAOO,MAAM,GAAGT,oBAAoB;QAC5E,MAAMO,gBAAgBG,MAAM,CAACR,QAAQA,OAAOS,UAAU,EAAE;YACtDC,iBAAiB;gBAAEC,iBAAiBT;YAAS;QAC/C;QACA;IACF;IAEA,MAAMU,qBAA+BR,eACjCR,GAAGiB,gBAAgB,CAACT,gBACpBP,SAASiB,IAAI,CAACd;IAElB,MAAMK,gBAAgBU,YAAY,CAACH,oBAAoB,IAAI,OAAO,MAAM,GAAG;QACzEI,aAAarB,gBAAgBsB,OAAO,CAAC,KAAK,KAAK;QAC/CP,iBAAiB;YAAEC,iBAAiBT;QAAS;IAC/C;AACF"}

package/package.json

@@ -1,13 +1,8 @@
 {
   "name": "@payloadcms/storage-azure",
-  "version": "4.0.0-internal.f11981a",
+  "version": "4.0.0-internal.f2a04f7",
   "description": "Payload storage adapter for Azure Blob Storage",
   "homepage": "https://payloadcms.com",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/payloadcms/payload.git",
-    "directory": "packages/storage-azure"
-  },
   "license": "MIT",
   "author": "Payload <dev@payloadcms.com> (https://payloadcms.com)",
   "maintainers": [
@@ -17,8 +12,18 @@
       "url": "https://payloadcms.com"
     }
   ],
-  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/payloadcms/payload.git",
+    "directory": "packages/storage-azure"
+  },
+  "files": [
+    "dist"
+  ],
   "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "import": "./dist/index.js",
@@ -31,21 +36,16 @@
       "default": "./dist/exports/client.js"
     }
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "files": [
-    "dist"
-  ],
   "dependencies": {
     "@azure/abort-controller": "^1.1.0",
-    "@azure/storage-blob": "^12.11.0",
-    "@payloadcms/plugin-cloud-storage": "4.0.0-internal.f11981a"
+    "@azure/storage-blob": "^12.33.0",
+    "@payloadcms/plugin-cloud-storage": "4.0.0-internal.f2a04f7"
   },
   "devDependencies": {
-    "payload": "4.0.0-internal.f11981a"
+    "payload": "4.0.0-internal.f2a04f7"
   },
   "peerDependencies": {
-    "payload": "4.0.0-internal.f11981a"
+    "payload": "4.0.0-internal.f2a04f7"
   },
   "engines": {
     "node": ">=24.15.0"

package/dist/client/handleAzureUpload.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=handleAzureUpload.spec.d.ts.map

package/dist/client/handleAzureUpload.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"handleAzureUpload.spec.d.ts","sourceRoot":"","sources":["../../src/client/handleAzureUpload.spec.ts"],"names":[],"mappings":""}

package/dist/client/handleAzureUpload.spec.js

@@ -1,65 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-const uploadDataMock = vi.fn();
-const blockBlobClientMock = vi.fn(function() {
-    return {
-        uploadData: uploadDataMock
-    };
-});
-vi.mock('@azure/storage-blob', ()=>({
-        BlockBlobClient: blockBlobClientMock
-    }));
-import { handleAzureUpload } from './handleAzureUpload.js';
-const signedURL = 'https://account.blob.core.windows.net/container/file.png?sig=abc';
-const createFile = ()=>new File([
-        new Uint8Array([
-            1,
-            2,
-            3
-        ])
-    ], 'file.png', {
-        type: 'image/png'
-    });
-describe('handleAzureUpload', ()=>{
-    beforeEach(()=>{
-        vi.clearAllMocks();
-        uploadDataMock.mockResolvedValue(undefined);
-    });
-    it('should upload via BlockBlobClient.uploadData', async ()=>{
-        const file = createFile();
-        await handleAzureUpload({
-            data: {
-                url: signedURL
-            },
-            file
-        });
-        expect(blockBlobClientMock).toHaveBeenCalledWith(signedURL);
-        expect(uploadDataMock).toHaveBeenCalledTimes(1);
-        const [uploadedFile, options] = uploadDataMock.mock.calls[0];
-        expect(uploadedFile).toBe(file);
-        expect(options.blockSize).toBeGreaterThan(0);
-        expect(options.concurrency).toBeGreaterThan(0);
-    });
-    it('should pass the file content type to the blob headers', async ()=>{
-        await handleAzureUpload({
-            data: {
-                url: signedURL
-            },
-            file: createFile()
-        });
-        const [, options] = uploadDataMock.mock.calls[0];
-        expect(options.blobHTTPHeaders).toEqual({
-            blobContentType: 'image/png'
-        });
-    });
-    it('should propagate errors from uploadData', async ()=>{
-        uploadDataMock.mockRejectedValue(new Error('block upload failed'));
-        await expect(handleAzureUpload({
-            data: {
-                url: signedURL
-            },
-            file: createFile()
-        })).rejects.toThrow('block upload failed');
-    });
-});
-
-//# sourceMappingURL=handleAzureUpload.spec.js.map

package/dist/client/handleAzureUpload.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/client/handleAzureUpload.spec.ts"],"sourcesContent":["import { beforeEach, describe, expect, it, vi } from 'vitest'\n\nconst uploadDataMock = vi.fn()\nconst blockBlobClientMock = vi.fn(function () {\n  return { uploadData: uploadDataMock }\n})\n\nvi.mock('@azure/storage-blob', () => ({\n  BlockBlobClient: blockBlobClientMock,\n}))\n\nimport { handleAzureUpload } from './handleAzureUpload.js'\n\nconst signedURL = 'https://account.blob.core.windows.net/container/file.png?sig=abc'\n\nconst createFile = () => new File([new Uint8Array([1, 2, 3])], 'file.png', { type: 'image/png' })\n\ndescribe('handleAzureUpload', () => {\n  beforeEach(() => {\n    vi.clearAllMocks()\n    uploadDataMock.mockResolvedValue(undefined)\n  })\n\n  it('should upload via BlockBlobClient.uploadData', async () => {\n    const file = createFile()\n\n    await handleAzureUpload({ data: { url: signedURL }, file })\n\n    expect(blockBlobClientMock).toHaveBeenCalledWith(signedURL)\n    expect(uploadDataMock).toHaveBeenCalledTimes(1)\n\n    const [uploadedFile, options] = uploadDataMock.mock.calls[0]!\n    expect(uploadedFile).toBe(file)\n    expect(options.blockSize).toBeGreaterThan(0)\n    expect(options.concurrency).toBeGreaterThan(0)\n  })\n\n  it('should pass the file content type to the blob headers', async () => {\n    await handleAzureUpload({ data: { url: signedURL }, file: createFile() })\n\n    const [, options] = uploadDataMock.mock.calls[0]!\n    expect(options.blobHTTPHeaders).toEqual({ blobContentType: 'image/png' })\n  })\n\n  it('should propagate errors from uploadData', async () => {\n    uploadDataMock.mockRejectedValue(new Error('block upload failed'))\n\n    await expect(\n      handleAzureUpload({ data: { url: signedURL }, file: createFile() }),\n    ).rejects.toThrow('block upload failed')\n  })\n})\n"],"names":["beforeEach","describe","expect","it","vi","uploadDataMock","fn","blockBlobClientMock","uploadData","mock","BlockBlobClient","handleAzureUpload","signedURL","createFile","File","Uint8Array","type","clearAllMocks","mockResolvedValue","undefined","file","data","url","toHaveBeenCalledWith","toHaveBeenCalledTimes","uploadedFile","options","calls","toBe","blockSize","toBeGreaterThan","concurrency","blobHTTPHeaders","toEqual","blobContentType","mockRejectedValue","Error","rejects","toThrow"],"mappings":"AAAA,SAASA,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE7D,MAAMC,iBAAiBD,GAAGE,EAAE;AAC5B,MAAMC,sBAAsBH,GAAGE,EAAE,CAAC;IAChC,OAAO;QAAEE,YAAYH;IAAe;AACtC;AAEAD,GAAGK,IAAI,CAAC,uBAAuB,IAAO,CAAA;QACpCC,iBAAiBH;IACnB,CAAA;AAEA,SAASI,iBAAiB,QAAQ,yBAAwB;AAE1D,MAAMC,YAAY;AAElB,MAAMC,aAAa,IAAM,IAAIC,KAAK;QAAC,IAAIC,WAAW;YAAC;YAAG;YAAG;SAAE;KAAE,EAAE,YAAY;QAAEC,MAAM;IAAY;AAE/Ff,SAAS,qBAAqB;IAC5BD,WAAW;QACTI,GAAGa,aAAa;QAChBZ,eAAea,iBAAiB,CAACC;IACnC;IAEAhB,GAAG,gDAAgD;QACjD,MAAMiB,OAAOP;QAEb,MAAMF,kBAAkB;YAAEU,MAAM;gBAAEC,KAAKV;YAAU;YAAGQ;QAAK;QAEzDlB,OAAOK,qBAAqBgB,oBAAoB,CAACX;QACjDV,OAAOG,gBAAgBmB,qBAAqB,CAAC;QAE7C,MAAM,CAACC,cAAcC,QAAQ,GAAGrB,eAAeI,IAAI,CAACkB,KAAK,CAAC,EAAE;QAC5DzB,OAAOuB,cAAcG,IAAI,CAACR;QAC1BlB,OAAOwB,QAAQG,SAAS,EAAEC,eAAe,CAAC;QAC1C5B,OAAOwB,QAAQK,WAAW,EAAED,eAAe,CAAC;IAC9C;IAEA3B,GAAG,yDAAyD;QAC1D,MAAMQ,kBAAkB;YAAEU,MAAM;gBAAEC,KAAKV;YAAU;YAAGQ,MAAMP;QAAa;QAEvE,MAAM,GAAGa,QAAQ,GAAGrB,eAAeI,IAAI,CAACkB,KAAK,CAAC,EAAE;QAChDzB,OAAOwB,QAAQM,eAAe,EAAEC,OAAO,CAAC;YAAEC,iBAAiB;QAAY;IACzE;IAEA/B,GAAG,2CAA2C;QAC5CE,eAAe8B,iBAAiB,CAAC,IAAIC,MAAM;QAE3C,MAAMlC,OACJS,kBAAkB;YAAEU,MAAM;gBAAEC,KAAKV;YAAU;YAAGQ,MAAMP;QAAa,IACjEwB,OAAO,CAACC,OAAO,CAAC;IACpB;AACF"}