@ploaness/governance 1.0.0 → 1.2.0

package/dist/payload-defaults.d.ts

@@ -0,0 +1,128 @@
+/** The operations a collection must decide; the static rule holds a written config to the same list. */
+export declare const COLLECTION_OPERATIONS: readonly string[];
+/** The operations a global must decide. */
+export declare const GLOBAL_OPERATIONS: readonly string[];
+/** The operation an auth collection decides on top of the four: who may clear a locked account. */
+export declare const UNLOCK_OPERATION: string;
+/** The operation a versioned collection or global decides: who may read a stored version. */
+export declare const READ_VERSIONS_OPERATION: string;
+/** What an entity of the built configuration is, as far as the operations it owes depend on it. */
+export interface PayloadSubjectTraits {
+    readonly kind: PayloadSubjectKind;
+    readonly hasAuth: boolean;
+    readonly hasVersions: boolean;
+}
+/**
+ * The access operations one entity owes a decision on. Two of them are conditional, and neither may be
+ * added to the lists above: Payload writes `unlock` onto EVERY collection during sanitisation, auth or
+ * not, so demanding it unconditionally would report the whole configuration, and `readVersions` means
+ * nothing on an entity that keeps no versions.
+ * @param traits what the entity is: its kind, and whether it authenticates or keeps versions.
+ * @returns the operations that entity must decide, in the order they are reported.
+ */
+export declare const accessOperationsFor: (traits: PayloadSubjectTraits) => readonly string[];
+/**
+ * The prefix the probe prints its report behind. A plugin may log on import, and a line the parser can
+ * name is what separates the report from that chatter.
+ */
+export declare const INHERITED_ACCESS_REPORT_MARKER: string;
+/** One entity of the built configuration and the operations it left to Payload's default. */
+export interface InheritedAccessEntry {
+    readonly slug: string;
+    readonly inherited: readonly string[];
+}
+/**
+ * What a read rule answered an anonymous caller, as the probe observed it. `filtered` carries the
+ * query constraint the rule returned, which is the half `/api/access` reports and the anonymous sweep
+ * never opens; `undecidable` is a rule that threw when asked, which is reported rather than assumed
+ * safe.
+ */
+export type AnonymousRead = {
+    readonly kind: 'denied';
+} | {
+    readonly kind: 'filtered';
+    readonly where: unknown;
+} | {
+    readonly kind: 'open';
+} | {
+    readonly kind: 'undecidable';
+    readonly reason: string;
+};
+/** One entity that keeps drafts, and what its read rule answers a caller with no credentials. */
+export interface DraftReadEntry {
+    readonly kind: PayloadSubjectKind;
+    readonly slug: string;
+    readonly anonymousRead: AnonymousRead;
+}
+/** What the probe reports: every collection and every global, decided ones included. */
+export interface InheritedAccessReport {
+    readonly collections: readonly InheritedAccessEntry[];
+    readonly draftReads: readonly DraftReadEntry[];
+    readonly globals: readonly InheritedAccessEntry[];
+}
+/** The two kinds of entity a Payload configuration holds. */
+export type PayloadSubjectKind = 'collection' | 'global';
+/** One entity Payload builds for its own bookkeeping, which keeps the default access by design. */
+export interface ExemptPayloadSubject {
+    readonly kind: PayloadSubjectKind;
+    readonly slug: string;
+    readonly reason: string;
+}
+/** The entities exempt from the rule, each with the reason. Nothing a project declares extends this. */
+export declare const EXEMPT_PAYLOAD_SUBJECTS: readonly ExemptPayloadSubject[];
+/**
+ * The saved-filter collection Payload builds behind `enableQueryPresets`.
+ *
+ * It is named here because the probe has to read its access from somewhere other than the collection.
+ * `getAccess` wraps EVERY operation of this one collection in a closure that calls the project's rule
+ * where there is one and Payload's own default where there is not, so the built collection carries four
+ * functions that match neither the default by reference nor its source text. Read there, a project that
+ * decided nothing is indistinguishable from one that decided everything - and undecided means an
+ * unconstrained `create` for any signed-in user, and a preset shared as `everyone` readable by every
+ * role that can log in, the ones a project keeps outside its editorial staff included.
+ */
+export declare const QUERY_PRESETS_SLUG: string;
+/**
+ * Every entity of the built configuration that still carries Payload's default access on a judged
+ * operation, in configuration order, each naming where the project decides it.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when every entity decides its access.
+ */
+export declare const findInheritedAccess: (report: InheritedAccessReport) => readonly string[];
+/**
+ * Whether a read filter admits published documents alone.
+ *
+ * A clause under `and` is enough on its own, because every conjunct holds. A clause under `or` counts
+ * only when EVERY branch carries one, because a single branch without it is a way in - which is the
+ * shape of the defect this rule exists for.
+ * @param where the query constraint the read rule returned.
+ * @returns whether every document the filter admits is a published one.
+ */
+export declare const requiresPublishedStatus: (where: unknown) => boolean;
+/**
+ * Every entity that keeps drafts and lets a stranger read something that was never approved, in
+ * configuration order.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when no drafts read admits an unapproved document.
+ */
+export declare const findUnconstrainedDraftReads: (report: InheritedAccessReport) => readonly string[];
+/**
+ * Read the probe's report out of everything the probe wrote to standard output.
+ *
+ * The LAST marker line is the report, so a plugin that logs during import cannot hide it, and a report
+ * that fails to parse or has the wrong shape is undefined rather than empty: a probe that printed a
+ * stack trace must fail the gate, never pass it as "no findings".
+ * @param text the probe's standard output.
+ * @returns the report, or undefined when no well-formed report was printed.
+ */
+export declare const parseInheritedAccessReport: (text: string) => InheritedAccessReport | undefined;
+/** Where a Payload member keeps its configuration when its tsconfig says nothing else. */
+export declare const DEFAULT_PAYLOAD_CONFIG_PATH: string;
+/**
+ * The path of the Payload configuration a member's tsconfig aliases as `@payload-config`, which is the
+ * alias `ploaness init` writes and Payload's own CLI resolves through.
+ * @param tsconfig the parsed tsconfig, or anything when it could not be read.
+ * @returns the configured path relative to the member root, or the default path.
+ */
+export declare const payloadConfigPathOf: (tsconfig: unknown) => string;
+//# sourceMappingURL=payload-defaults.d.ts.map

package/dist/payload-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-defaults.d.ts","sourceRoot":"","sources":["../src/payload-defaults.ts"],"names":[],"mappings":"AAgBA,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA2C,CAAA;AAE9F,2CAA2C;AAC3C,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAuB,CAAA;AAEtE,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,EAAE,MAAiB,CAAA;AAEhD,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,EAAE,MAAuB,CAAA;AAE7D,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,oBAAoB,KAAG,SAAS,MAAM,EAIjF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAqC,CAAA;AAElF,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7D,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAClD;AAED,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAA;AAExD,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EA4BlE,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAgC,CAAA;AAyCjE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,qBAAqB,KAAG,SAAS,MAAM,EAGlF,CAAA;AA2BD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,OAAO,KAAG,OAoBxD,CAAA;AA8BD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,qBAAqB,KAAG,SAAS,MAAM,EAIvF,CAAA;AA4EJ;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,KAAG,qBAAqB,GAAG,SAoBjF,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,EAAE,MAAgC,CAAA;AAI1E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,KAAG,MAYvD,CAAA"}

package/dist/payload-defaults.js

@@ -0,0 +1,295 @@
+// Whether every collection and global in a BUILT Payload configuration decides its own access.
+//
+// The static rule in payload-access.ts reads the access block a project wrote, and it can only read what
+// the project wrote. Payload builds collections the project never writes: the folder tree behind
+// `folders`, the job queue behind `jobs`, the saved filters behind `queryPresets`, and whatever a plugin
+// adds. Each arrives with the access Payload gives an undeclared operation, `defaultAccess`, which admits
+// every signed-in user to every operation. The anonymous sweep cannot see that either, because a
+// signed-in stakeholder is not anonymous. So a probe imports the built configuration and reports, per
+// entity, which operations still carry that function; this module decides what the report means.
+//
+// Payload's own bookkeeping keeps the default on purpose, and those entities are exempt by name here,
+// with the reason each. No project setting widens the list: a rule a project can edit is not a rule, and
+// the repair is always available - write the access explicitly, through the override the framework
+// offers for the entity it built.
+import { asRecord, asText, isArray, isRecord, readKey } from './json-shapes.js';
+/** The operations a collection must decide; the static rule holds a written config to the same list. */
+export const COLLECTION_OPERATIONS = ['create', 'read', 'update', 'delete'];
+/** The operations a global must decide. */
+export const GLOBAL_OPERATIONS = ['read', 'update'];
+/** The operation an auth collection decides on top of the four: who may clear a locked account. */
+export const UNLOCK_OPERATION = 'unlock';
+/** The operation a versioned collection or global decides: who may read a stored version. */
+export const READ_VERSIONS_OPERATION = 'readVersions';
+/**
+ * The access operations one entity owes a decision on. Two of them are conditional, and neither may be
+ * added to the lists above: Payload writes `unlock` onto EVERY collection during sanitisation, auth or
+ * not, so demanding it unconditionally would report the whole configuration, and `readVersions` means
+ * nothing on an entity that keeps no versions.
+ * @param traits what the entity is: its kind, and whether it authenticates or keeps versions.
+ * @returns the operations that entity must decide, in the order they are reported.
+ */
+export const accessOperationsFor = (traits) => [
+    ...(traits.kind === 'collection' ? COLLECTION_OPERATIONS : GLOBAL_OPERATIONS),
+    ...(traits.kind === 'collection' && traits.hasAuth ? [UNLOCK_OPERATION] : []),
+    ...(traits.hasVersions ? [READ_VERSIONS_OPERATION] : []),
+];
+/**
+ * The prefix the probe prints its report behind. A plugin may log on import, and a line the parser can
+ * name is what separates the report from that chatter.
+ */
+export const INHERITED_ACCESS_REPORT_MARKER = 'ploaness-inherited-access:';
+/** The entities exempt from the rule, each with the reason. Nothing a project declares extends this. */
+export const EXEMPT_PAYLOAD_SUBJECTS = [
+    {
+        kind: 'collection',
+        slug: 'payload-locked-documents',
+        reason: 'the document-lock ledger, which declares the default deliberately so that any signed-in editor ' +
+            'can hold and release a lock',
+    },
+    {
+        kind: 'collection',
+        slug: 'payload-preferences',
+        reason: 'per-user admin preferences; Payload scopes read and delete to the owner, and leaves create and ' +
+            'update to the default on purpose',
+    },
+    {
+        kind: 'collection',
+        slug: 'payload-migrations',
+        reason: 'the migration ledger, with no endpoint and no GraphQL surface; only the framework writes it',
+    },
+    {
+        kind: 'global',
+        slug: 'payload-jobs-stats',
+        reason: 'the scheduling counters Payload keeps beside the job queue; the framework offers no override ' +
+            'for it, so no explicit access can be written, and the queue it counts is judged',
+    },
+];
+/**
+ * The saved-filter collection Payload builds behind `enableQueryPresets`.
+ *
+ * It is named here because the probe has to read its access from somewhere other than the collection.
+ * `getAccess` wraps EVERY operation of this one collection in a closure that calls the project's rule
+ * where there is one and Payload's own default where there is not, so the built collection carries four
+ * functions that match neither the default by reference nor its source text. Read there, a project that
+ * decided nothing is indistinguishable from one that decided everything - and undecided means an
+ * unconstrained `create` for any signed-in user, and a preset shared as `everyone` readable by every
+ * role that can log in, the ones a project keeps outside its editorial staff included.
+ */
+export const QUERY_PRESETS_SLUG = 'payload-query-presets';
+// Where the framework lets a project decide the access of an entity it built. Anything else is either
+// the project's own collection, which has an access block, or a plugin's, which has an override option.
+const FRAMEWORK_REPAIRS = {
+    'payload-folders': 'folders.collectionOverrides',
+    'payload-jobs': 'jobs.jobsCollectionOverrides',
+    [QUERY_PRESETS_SLUG]: 'queryPresets.access',
+};
+const isExempt = (kind, slug) => EXEMPT_PAYLOAD_SUBJECTS.some((subject) => subject.kind === kind && subject.slug === slug);
+const repairFor = (slug, pronoun) => {
+    const framework = FRAMEWORK_REPAIRS[slug];
+    return framework === undefined
+        ? `decide ${pronoun} in its access block, or in the override its plugin offers`
+        : `decide ${pronoun} in ${framework}`;
+};
+const describeInherited = (kind, entry) => {
+    const pronoun = entry.inherited.length === 1 ? 'it' : 'them';
+    return (`${kind} "${entry.slug}" leaves ${entry.inherited.join(', ')} to Payload's default access, ` +
+        `which admits every signed-in user; ${repairFor(entry.slug, pronoun)}`);
+};
+const judge = (kind, entries) => entries
+    .filter((entry) => entry.inherited.length > 0 && !isExempt(kind, entry.slug))
+    .map((entry) => describeInherited(kind, entry));
+/**
+ * Every entity of the built configuration that still carries Payload's default access on a judged
+ * operation, in configuration order, each naming where the project decides it.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when every entity decides its access.
+ */
+export const findInheritedAccess = (report) => [
+    ...judge('collection', report.collections),
+    ...judge('global', report.globals),
+];
+// The read a drafts-enabled entity grants a stranger.
+//
+// A draft is a document nobody has approved. Payload writes an unpublished save to the versions table
+// and leaves the main row alone, so a document that has never been published carries `_status: 'draft'`
+// in the row a plain list reads - which means an unconstrained read serves unapproved content through
+// the ordinary endpoint, not only through `?draft=true`.
+//
+// The static rule in payload-access.ts can only catch the inline spelling `read: (): boolean => true`,
+// and the shipped ESLint config forbids exactly that spelling in a config file, so a conforming project
+// writes `read: someHelper` and the static rule is blind to it. The anonymous sweep is blind too: it
+// separates a grant that carries a query constraint from one that does not, and never opens the
+// constraint to see what it constrains. Between the two, a read filtered by audience but not by status
+// passed everything. This is the rule that reads the constraint.
+/** The status Payload stamps on the version that is live. */
+const PUBLISHED_STATUS = 'published';
+/** The field Payload adds to an entity that keeps drafts. */
+const STATUS_FIELD = '_status';
+const declaresPublished = (where) => {
+    const status = where[STATUS_FIELD];
+    return isRecord(status) && status['equals'] === PUBLISHED_STATUS;
+};
+/**
+ * Whether a read filter admits published documents alone.
+ *
+ * A clause under `and` is enough on its own, because every conjunct holds. A clause under `or` counts
+ * only when EVERY branch carries one, because a single branch without it is a way in - which is the
+ * shape of the defect this rule exists for.
+ * @param where the query constraint the read rule returned.
+ * @returns whether every document the filter admits is a published one.
+ */
+export const requiresPublishedStatus = (where) => {
+    if (!isRecord(where)) {
+        return false;
+    }
+    if (declaresPublished(where)) {
+        return true;
+    }
+    const conjuncts = where['and'];
+    if (isArray(conjuncts) &&
+        conjuncts.some((one) => requiresPublishedStatus(one))) {
+        return true;
+    }
+    const disjuncts = where['or'];
+    return (isArray(disjuncts) &&
+        disjuncts.length > 0 &&
+        disjuncts.every((one) => requiresPublishedStatus(one)));
+};
+const DRAFT_READ_REPAIR = 'a read that keeps unapproved work from a stranger either refuses them outright or filters on ' +
+    `${STATUS_FIELD} equals ${PUBLISHED_STATUS}`;
+const describeDraftRead = (entry) => {
+    const subject = `${entry.kind} "${entry.slug}" keeps drafts and`;
+    const read = entry.anonymousRead;
+    if (read.kind === 'open') {
+        return (`${subject} grants an unconditional anonymous read, so every unapproved document in it is ` +
+            `served to anyone; ${DRAFT_READ_REPAIR}`);
+    }
+    if (read.kind === 'undecidable') {
+        return (`${subject} its read rule could not be decided from the request alone (${read.reason}); an ` +
+            'access rule is a pure decision over the caller it is handed, so the harness can read it');
+    }
+    if (read.kind === 'filtered' && !requiresPublishedStatus(read.where)) {
+        return (`${subject} filters its anonymous read without constraining ${STATUS_FIELD}, so an ` +
+            `unapproved document is served to anyone the filter admits; ${DRAFT_READ_REPAIR}`);
+    }
+    return undefined;
+};
+/**
+ * Every entity that keeps drafts and lets a stranger read something that was never approved, in
+ * configuration order.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when no drafts read admits an unapproved document.
+ */
+export const findUnconstrainedDraftReads = (report) => report.draftReads.flatMap((entry) => {
+    const finding = describeDraftRead(entry);
+    return finding === undefined ? [] : [finding];
+});
+const asEntry = (raw) => {
+    if (!isRecord(raw)) {
+        return undefined;
+    }
+    const slug = raw['slug'];
+    const inherited = raw['inherited'];
+    if (typeof slug !== 'string' || !isArray(inherited)) {
+        return undefined;
+    }
+    return inherited.every((operation) => typeof operation === 'string')
+        ? { slug, inherited: inherited.map((operation) => asText(operation)) }
+        : undefined;
+};
+const asEntries = (raw) => {
+    if (!isArray(raw)) {
+        return undefined;
+    }
+    const entries = raw.map((entry) => asEntry(entry));
+    return entries.every((entry) => entry !== undefined)
+        ? entries
+        : undefined;
+};
+const asAnonymousRead = (raw) => {
+    const kind = readKey(raw, 'kind');
+    if (kind === 'denied') {
+        return { kind };
+    }
+    if (kind === 'open') {
+        return { kind };
+    }
+    if (kind === 'filtered') {
+        return { kind, where: readKey(raw, 'where') };
+    }
+    return kind === 'undecidable' ? { kind, reason: asText(readKey(raw, 'reason')) } : undefined;
+};
+const asDraftRead = (raw) => {
+    const slug = readKey(raw, 'slug');
+    const kind = readKey(raw, 'kind');
+    const anonymousRead = asAnonymousRead(readKey(raw, 'anonymousRead'));
+    if (typeof slug !== 'string' || anonymousRead === undefined) {
+        return undefined;
+    }
+    return kind === 'collection' || kind === 'global' ? { kind, slug, anonymousRead } : undefined;
+};
+const asDraftReads = (raw) => {
+    if (!isArray(raw)) {
+        return undefined;
+    }
+    const entries = raw.map((entry) => asDraftRead(entry));
+    return entries.every((entry) => entry !== undefined)
+        ? entries
+        : undefined;
+};
+const parseJson = (text) => {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Read the probe's report out of everything the probe wrote to standard output.
+ *
+ * The LAST marker line is the report, so a plugin that logs during import cannot hide it, and a report
+ * that fails to parse or has the wrong shape is undefined rather than empty: a probe that printed a
+ * stack trace must fail the gate, never pass it as "no findings".
+ * @param text the probe's standard output.
+ * @returns the report, or undefined when no well-formed report was printed.
+ */
+export const parseInheritedAccessReport = (text) => {
+    const line = text
+        .split('\n')
+        .map((candidate) => candidate.trim())
+        .findLast((candidate) => candidate.startsWith(INHERITED_ACCESS_REPORT_MARKER));
+    if (line === undefined) {
+        return undefined;
+    }
+    const parsed = parseJson(line.slice(INHERITED_ACCESS_REPORT_MARKER.length));
+    const collections = asEntries(readKey(parsed, 'collections'));
+    const globals = asEntries(readKey(parsed, 'globals'));
+    const draftReads = asDraftReads(readKey(parsed, 'draftReads'));
+    if (collections === undefined || globals === undefined || draftReads === undefined) {
+        return undefined;
+    }
+    return { collections, draftReads, globals };
+};
+/** Where a Payload member keeps its configuration when its tsconfig says nothing else. */
+export const DEFAULT_PAYLOAD_CONFIG_PATH = 'src/payload.config.ts';
+const CURRENT_DIRECTORY_PREFIX = './';
+/**
+ * The path of the Payload configuration a member's tsconfig aliases as `@payload-config`, which is the
+ * alias `ploaness init` writes and Payload's own CLI resolves through.
+ * @param tsconfig the parsed tsconfig, or anything when it could not be read.
+ * @returns the configured path relative to the member root, or the default path.
+ */
+export const payloadConfigPathOf = (tsconfig) => {
+    const paths = asRecord(readKey(readKey(tsconfig, 'compilerOptions'), 'paths'));
+    const alias = paths['@payload-config'];
+    const first = isArray(alias) ? alias[0] : undefined;
+    if (typeof first !== 'string' || first.length === 0) {
+        return DEFAULT_PAYLOAD_CONFIG_PATH;
+    }
+    return first.startsWith(CURRENT_DIRECTORY_PREFIX)
+        ? first.slice(CURRENT_DIRECTORY_PREFIX.length)
+        : first;
+};
+//# sourceMappingURL=payload-defaults.js.map

package/dist/payload-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-defaults.js","sourceRoot":"","sources":["../src/payload-defaults.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,EAAE;AACF,yGAAyG;AACzG,iGAAiG;AACjG,yGAAyG;AACzG,0GAA0G;AAC1G,iGAAiG;AACjG,sGAAsG;AACtG,iGAAiG;AACjG,EAAE;AACF,sGAAsG;AACtG,yGAAyG;AACzG,mGAAmG;AACnG,kCAAkC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE/E,wGAAwG;AACxG,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE9F,2CAA2C;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAEtE,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAW,QAAQ,CAAA;AAEhD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAW,cAAc,CAAA;AAS7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAA4B,EAAqB,EAAE,CAAC;IACtF,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACzD,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,4BAA4B,CAAA;AA4ClF,wGAAwG;AACxG,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,0BAA0B;QAChC,MAAM,EACJ,iGAAiG;YACjG,6BAA6B;KAChC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EACJ,iGAAiG;YACjG,kCAAkC;KACrC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EACJ,6FAA6F;KAChG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EACJ,+FAA+F;YAC/F,iFAAiF;KACpF;CACF,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW,uBAAuB,CAAA;AAEjE,sGAAsG;AACtG,wGAAwG;AACxG,MAAM,iBAAiB,GAAqC;IAC1D,iBAAiB,EAAE,6BAA6B;IAChD,cAAc,EAAE,8BAA8B;IAC9C,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;CAC5C,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAW,EAAE,CACnE,uBAAuB,CAAC,IAAI,CAC1B,CAAC,OAA6B,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAC3F,CAAA;AAEH,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE;IAC1D,MAAM,SAAS,GAAuB,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,UAAU,OAAO,4DAA4D;QAC/E,CAAC,CAAC,UAAU,OAAO,OAAO,SAAS,EAAE,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,IAAwB,EAAE,KAA2B,EAAU,EAAE;IAC1F,MAAM,OAAO,GAAW,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IACpE,OAAO,CACL,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;QAC5F,sCAAsC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CACvE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CACZ,IAAwB,EACxB,OAAwC,EACrB,EAAE,CACrB,OAAO;KACJ,MAAM,CACL,CAAC,KAA2B,EAAW,EAAE,CACvC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAC5D;KACA,GAAG,CAAC,CAAC,KAA2B,EAAU,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAA6B,EAAqB,EAAE,CAAC;IACvF,GAAG,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC;IAC1C,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;CACnC,CAAA;AAED,sDAAsD;AACtD,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,sGAAsG;AACtG,yDAAyD;AACzD,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,qGAAqG;AACrG,gGAAgG;AAChG,uGAAuG;AACvG,iEAAiE;AAEjE,6DAA6D;AAC7D,MAAM,gBAAgB,GAAW,WAAW,CAAA;AAE5C,6DAA6D;AAC7D,MAAM,YAAY,GAAW,SAAS,CAAA;AAEtC,MAAM,iBAAiB,GAAG,CAAC,KAA8B,EAAW,EAAE;IACpE,MAAM,MAAM,GAAY,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAA;AAClE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IACjE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAY,KAAK,CAAC,KAAK,CAAC,CAAA;IACvC,IACE,OAAO,CAAC,SAAS,CAAC;QAClB,SAAS,CAAC,IAAI,CAAC,CAAC,GAAY,EAAW,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,EACvE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAY,KAAK,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,CACL,OAAO,CAAC,SAAS,CAAC;QAClB,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,SAAS,CAAC,KAAK,CAAC,CAAC,GAAY,EAAW,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CACzE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GACrB,+FAA+F;IAC/F,GAAG,YAAY,WAAW,gBAAgB,EAAE,CAAA;AAE9C,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAsB,EAAE;IACtE,MAAM,OAAO,GAAW,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,oBAAoB,CAAA;IACxE,MAAM,IAAI,GAAkB,KAAK,CAAC,aAAa,CAAA;IAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,CACL,GAAG,OAAO,iFAAiF;YAC3F,qBAAqB,iBAAiB,EAAE,CACzC,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,+DAA+D,IAAI,CAAC,MAAM,QAAQ;YAC5F,yFAAyF,CAC1F,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,CACL,GAAG,OAAO,oDAAoD,YAAY,UAAU;YACpF,8DAA8D,iBAAiB,EAAE,CAClF,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,MAA6B,EAAqB,EAAE,CAC9F,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAqB,EAAqB,EAAE;IACrE,MAAM,OAAO,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAC5D,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC,CAAC,CAAA;AAEJ,MAAM,OAAO,GAAG,CAAC,GAAY,EAAoC,EAAE;IACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAY,GAAG,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,SAAS,GAAY,GAAG,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,SAAkB,EAAW,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC;QACpF,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,SAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;QACvF,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,GAAY,EAA+C,EAAE;IAC9E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAkD,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CACxF,OAAO,CAAC,KAAK,CAAC,CACf,CAAA;IACD,OAAO,OAAO,CAAC,KAAK,CAClB,CAAC,KAAuC,EAAiC,EAAE,CAAC,KAAK,KAAK,SAAS,CAChG;QACC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAY,EAA6B,EAAE;IAClE,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9F,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAY,EAA8B,EAAE;IAC/D,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,aAAa,GAA8B,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAA;IAC/F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,GAAY,EAAyC,EAAE;IAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAA4C,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CAClF,WAAW,CAAC,KAAK,CAAC,CACnB,CAAA;IACD,OAAO,OAAO,CAAC,KAAK,CAClB,CAAC,KAAiC,EAA2B,EAAE,CAAC,KAAK,KAAK,SAAS,CACpF;QACC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAqC,EAAE;IAC5F,MAAM,IAAI,GAAuB,IAAI;SAClC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACpD,QAAQ,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC,CAAA;IACjG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,MAAM,GAAY,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAA;IACpF,MAAM,WAAW,GAAgD,SAAS,CACxE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAC/B,CAAA;IACD,MAAM,OAAO,GAAgD,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;IAClG,MAAM,UAAU,GAA0C,YAAY,CACpE,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAC9B,CAAA;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACnF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAC7C,CAAC,CAAA;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAW,uBAAuB,CAAA;AAE1E,MAAM,wBAAwB,GAAW,IAAI,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAiB,EAAU,EAAE;IAC/D,MAAM,KAAK,GAA4B,QAAQ,CAC7C,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CACvD,CAAA;IACD,MAAM,KAAK,GAAY,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,2BAA2B,CAAA;IACpC,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAC/C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAA;AACX,CAAC,CAAA"}

package/dist/payload-field-access.d.ts

@@ -0,0 +1,4 @@
+import { type PayloadViolation } from './payload-source.js';
+/** Report privilege-bearing auth fields without explicit create and update access. */
+export declare const findUnprotectedPrivilegedFields: (source: string) => readonly PayloadViolation[];
+//# sourceMappingURL=payload-field-access.d.ts.map

package/dist/payload-field-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-field-access.d.ts","sourceRoot":"","sources":["../src/payload-field-access.ts"],"names":[],"mappings":"AASA,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA+C7F,sFAAsF;AACtF,eAAO,MAAM,+BAA+B,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAUrF,CAAA"}

package/dist/payload-field-access.js

@@ -0,0 +1,51 @@
+// Field-level access decisions that protect an account's authority.
+//
+// A collection access rule and a field access rule defend different boundaries. The collection rule
+// decides who may update an account at all; the field rule decides whether that caller may change the
+// part which grants authority. Requiring both prevents a later widening of collection access from
+// silently turning an ordinary profile update into privilege escalation.
+import { directFieldsIn, payloadConfigsIn } from './payload-configs.js';
+import { depthOneBlockKeys, depthOneValue } from './payload-source.js';
+const PRIVILEGED_FIELD_NAMES = new Set([
+    'role',
+    'roles',
+    'isAdmin',
+    'isStaff',
+    'permission',
+    'permissions',
+    'capability',
+    'capabilities',
+]);
+const REQUIRED_OPERATIONS = ['create', 'update'];
+const quotedValue = (value) => /^\s*['"`]([^'"`]+)['"`]/.exec(value ?? '')?.[1];
+const isAuthCollection = (config) => {
+    if (config.kind.kind !== 'collection') {
+        return false;
+    }
+    const auth = depthOneValue(config.body, 'auth');
+    return /^\s*(?:true\b|\{)/.test(auth ?? '');
+};
+const violationFor = (field) => {
+    const name = quotedValue(depthOneValue(field.body, 'name'));
+    if (name === undefined || !PRIVILEGED_FIELD_NAMES.has(name)) {
+        return undefined;
+    }
+    const declared = depthOneBlockKeys(field.body, 'access');
+    const missing = REQUIRED_OPERATIONS.filter((operation) => !declared.includes(operation));
+    return missing.length === 0
+        ? undefined
+        : {
+            line: field.line,
+            rule: 'require-privileged-field-access',
+            reason: `the privilege-bearing field "${name}" must declare field access for create and update; ` +
+                `${missing.join(' and ')} is not protected from assignment by a caller who can write ` +
+                'the auth collection',
+        };
+};
+/** Report privilege-bearing auth fields without explicit create and update access. */
+export const findUnprotectedPrivilegedFields = (source) => payloadConfigsIn(source)
+    .filter((config) => isAuthCollection(config))
+    .flatMap((config) => directFieldsIn(source, config))
+    .map((field) => violationFor(field))
+    .filter((violation) => violation !== undefined);
+//# sourceMappingURL=payload-field-access.js.map

package/dist/payload-field-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-field-access.js","sourceRoot":"","sources":["../src/payload-field-access.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,kGAAkG;AAClG,yEAAyE;AAGzE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAyB,MAAM,qBAAqB,CAAA;AAE7F,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,MAAM;IACN,OAAO;IACP,SAAS;IACT,SAAS;IACT,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAEnE,MAAM,WAAW,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACpE,yBAAyB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAElD,MAAM,gBAAgB,GAAG,CAAC,MAA0B,EAAW,EAAE;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAgC,EAAE;IAC9E,MAAM,IAAI,GAAuB,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,iCAAiC;YACvC,MAAM,EACJ,gCAAgC,IAAI,qDAAqD;gBACzF,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,8DAA8D;gBACtF,qBAAqB;SACxB,CAAA;AACP,CAAC,CAAA;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC7F,gBAAgB,CAAC,MAAM,CAAC;KACrB,MAAM,CAAC,CAAC,MAA0B,EAAW,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;KACzE,OAAO,CAAC,CAAC,MAA0B,EAAgC,EAAE,CACpE,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAC/B;KACA,GAAG,CAAC,CAAC,KAAwB,EAAgC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;KACpF,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CAAA"}

package/dist/payload-policy.d.ts

@@ -15,4 +15,17 @@ export declare const findSourceViolations: (source: string) => readonly PayloadV
  * @returns one violation per offending line.
  */
 export declare const findPayloadViolations: (source: string) => readonly PayloadViolation[];
+/**
+ * The access decision a route handler has to state rather than inherit.
+ *
+ * The two rules that already read `overrideAccess` judge a value that is written down: one bans `true`,
+ * the other requires `false` beside a `user`. Neither can see an absent property, and absent is the
+ * dangerous spelling - Payload defaults `overrideAccess` to `true`, so the call that says nothing is
+ * the call that runs as an administrator. Under `src/endpoints` the omission is therefore the
+ * violation, which is why this rule reads the path and the others do not.
+ * @param filePath the repository-relative path of the file, which decides whether the rule applies.
+ * @param source the file's text.
+ * @returns one violation per Local API call that leaves the decision to the default.
+ */
+export declare const findEndpointViolations: (filePath: string, source: string) => readonly PayloadViolation[];
 //# sourceMappingURL=payload-policy.d.ts.map

package/dist/payload-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-policy.d.ts","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA6H3D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAC/B,CAAA;AAEhD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAY/E,CAAA"}
+{"version":3,"file":"payload-policy.d.ts","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAqT3D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG9E,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAmB/E,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAU,MAAM,EAChB,QAAQ,MAAM,KACb,SAAS,gBAAgB,EAiB3B,CAAA"}