cortex-auth 1.1.1 → 1.2.0

package/dist/index.d.ts

@@ -1,2 +1,4 @@
 export * from './payload-jwt';
+export * from './payload-access';
+export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA;AAC7B,cAAc,kBAAkB,CAAA;AAChC,cAAc,SAAS,CAAA"}

package/dist/index.js

@@ -1,2 +1,4 @@
 export * from './payload-jwt';
+export * from './payload-access';
+export * from './types';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA;AAC7B,cAAc,kBAAkB,CAAA;AAChC,cAAc,SAAS,CAAA"}

package/dist/payload-access/access.d.ts

@@ -0,0 +1,36 @@
+import { AccessArgs } from 'payload';
+import type { Where } from 'payload';
+import type { User } from '../types';
+/**
+ * Checks that the request is authenticated
+ */
+export declare const isAuthenticated: ({ req: { user } }: AccessArgs<Partial<Partial<User>>>) => boolean;
+/**
+ * Checks that the user is a 'user' or 'admin' i.e. they are human
+ */
+export declare const isUser: ({ req: { user } }: AccessArgs<Partial<User>>) => boolean;
+/**
+ * Checks that the user is a 'digital-colleague'
+ */
+export declare const isDigitalColleague: ({ req: { user } }: AccessArgs<Partial<User>>) => boolean;
+/**
+ * Checks that the user is an 'admin'
+ */
+export declare const isAdmin: ({ req: { user } }: AccessArgs<Partial<User>>) => boolean;
+/**
+ * Users can edit their own profile
+ */
+export declare const editOwnProfile: ({ req: { user }, data }: AccessArgs<Partial<User>>) => boolean;
+/**
+ * can edit owned items
+ */
+export declare const isOwned: ({ req: { user } }: AccessArgs<Partial<User>>) => boolean | Where;
+/**
+ * User is in the member relationship of the item
+ */
+export declare const isMember: ({ req: { user } }: AccessArgs<Partial<User>>) => boolean | Where;
+/**
+ * User is in the member relationship of the item
+ */
+export declare const isMemberOrOwner: ({ req: { user } }: AccessArgs<Partial<User>>) => boolean | Where;
+//# sourceMappingURL=access.d.ts.map

package/dist/payload-access/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/payload-access/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,EAAG,KAAK,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAEnC;;GAEG;AAEH,eAAO,MAAM,eAAe,GAAI,mBAAmB,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAEpF,CAAA;AAED;;GAEG;AAEH,eAAO,MAAM,MAAM,GAAI,mBAAmB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YASlE,CAAA;AAED;;GAEG;AAEH,eAAO,MAAM,kBAAkB,GAAI,mBAAmB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAM9E,CAAA;AAED;;GAEG;AAEH,eAAO,MAAM,OAAO,GAAI,mBAAmB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAG,OAMtE,CAAA;AAGD;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,yBAAyB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAG,OAQnF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,OAAO,GAAI,mBAAmB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAG,OAAO,GAAG,KAchF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,GAAI,mBAAmB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAG,OAAO,GAAG,KAgBjF,CAAA;AAGD;;GAEG;AACH,eAAO,MAAM,eAAe,GAAI,mBAAmB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAG,OAAO,GAAG,KAuBxF,CAAA"}

package/dist/payload-access/access.js

@@ -0,0 +1,116 @@
+/**
+ * Checks that the request is authenticated
+ */
+export const isAuthenticated = ({ req: { user } }) => {
+    return Boolean(user);
+};
+/**
+ * Checks that the user is a 'user' or 'admin' i.e. they are human
+ */
+export const isUser = ({ req: { user } }) => {
+    if (!user)
+        return false;
+    if (user.role === 'user') {
+        return true;
+    }
+    if (user.role === 'admin') {
+        return true;
+    }
+    return false;
+};
+/**
+ * Checks that the user is a 'digital-colleague'
+ */
+export const isDigitalColleague = ({ req: { user } }) => {
+    if (!user)
+        return false;
+    if (user.role === 'digital-colleague') {
+        return true;
+    }
+    return false;
+};
+/**
+ * Checks that the user is an 'admin'
+ */
+export const isAdmin = ({ req: { user } }) => {
+    // console.log('Checking isAdminUser for user:', user)
+    if (user?.role === 'admin') {
+        return true;
+    }
+    return false;
+};
+/**
+ * Users can edit their own profile
+ */
+export const editOwnProfile = ({ req: { user }, data }) => {
+    // Allow admins to edit anything
+    if (user?.role === 'admin') {
+        return true;
+    }
+    // Allow users to edit their own record
+    return user?.id === data?.id;
+};
+/**
+ * can edit owned items
+ */
+export const isOwned = ({ req: { user } }) => {
+    if (!user)
+        return false;
+    // Allow admins to edit anything
+    if (user?.role === 'admin') {
+        return true;
+    }
+    // Allow users to edit their own record
+    const query = {
+        owner: {
+            equals: user.id,
+        },
+    };
+    return query;
+};
+/**
+ * User is in the member relationship of the item
+ */
+export const isMember = ({ req: { user } }) => {
+    if (!user)
+        return false;
+    // Allow admins to edit anything
+    if (user?.role === 'admin') {
+        return true;
+    }
+    // Allow users to edit their own record
+    const query = {
+        'members.user': {
+            equals: user.id,
+        },
+    };
+    return query;
+};
+/**
+ * User is in the member relationship of the item
+ */
+export const isMemberOrOwner = ({ req: { user } }) => {
+    if (!user)
+        return false;
+    // Allow admins to edit anything
+    if (user?.role === 'admin') {
+        return true;
+    }
+    // Allow users to edit their own record
+    const query = {
+        or: [
+            {
+                'members.user': {
+                    equals: user.id,
+                },
+            },
+            {
+                owner: {
+                    equals: user.id,
+                },
+            },
+        ],
+    };
+    return query;
+};
+//# sourceMappingURL=access.js.map

package/dist/payload-access/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/payload-access/access.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAsC,EAAE,EAAE;IACrF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC,CAAA;AAED;;GAEG;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAA6B,EAAE,EAAE;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC,CAAA;AAED;;GAEG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAA6B,EAAE,EAAE;IAC/E,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC,CAAA;AAED;;GAEG;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAA6B,EAAW,EAAE;IAC7E,sDAAsD;IACtD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC,CAAA;AAGD;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAA6B,EAAW,EAAE;IAE1F,gCAAgC;IAChC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,uCAAuC;IACvC,OAAO,IAAI,EAAE,EAAE,KAAM,IAAa,EAAE,EAAE,CAAA;AAC1C,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAA6B,EAAmB,EAAE;IACrF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,gCAAgC;IAChC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,uCAAuC;IACvC,MAAM,KAAK,GAAU;QACjB,KAAK,EAAE;YACH,MAAM,EAAE,IAAI,CAAC,EAAE;SAClB;KACJ,CAAA;IACD,OAAO,KAAK,CAAA;AAChB,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAA6B,EAAmB,EAAE;IACtF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,gCAAgC;IAChC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,uCAAuC;IACvC,MAAM,KAAK,GAAU;QAEjB,cAAc,EAAE;YACZ,MAAM,EAAE,IAAI,CAAC,EAAE;SAClB;KAEJ,CAAA;IACD,OAAO,KAAK,CAAA;AAChB,CAAC,CAAA;AAGD;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAA6B,EAAmB,EAAE;IAC7F,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,gCAAgC;IAChC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IACD,uCAAuC;IACvC,MAAM,KAAK,GAAU;QACjB,EAAE,EAAE;YACA;gBACI,cAAc,EAAE;oBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;iBAClB;aACJ;YACD;gBACI,KAAK,EAAE;oBACH,MAAM,EAAE,IAAI,CAAC,EAAE;iBAClB;aACJ;SACJ;KACJ,CAAA;IACD,OAAO,KAAK,CAAA;AAChB,CAAC,CAAA"}

package/dist/payload-access/index.d.ts

@@ -0,0 +1,2 @@
+export * from './access';
+//# sourceMappingURL=index.d.ts.map

package/dist/payload-access/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/payload-access/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA"}

package/dist/payload-access/index.js

@@ -0,0 +1,2 @@
+export * from './access';
+//# sourceMappingURL=index.js.map

package/dist/payload-access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/payload-access/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA"}

package/dist/payload-jwt/authenticateRequest.d.ts

@@ -1,5 +1,9 @@
 import { type Payload } from 'payload';
 import { NextAuthRequest } from "next-auth";
+interface AuthError extends Error {
+    statusCode: number;
+}
+export type { AuthError };
 export declare function authenticateRequest({ req, payload }: {
     req: NextAuthRequest;
     payload?: Payload;

package/dist/payload-jwt/authenticateRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateRequest.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/authenticateRequest.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA8C5C,wBAAsB,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE;;;;;;GA6EtG"}
+{"version":3,"file":"authenticateRequest.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/authenticateRequest.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,UAAU,SAAU,SAAQ,KAAK;IAC7B,UAAU,EAAE,MAAM,CAAC;CACtB;AAQD,YAAY,EAAE,SAAS,EAAE,CAAC;AAoC1B,wBAAsB,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE;;;;;;GA2EtG"}

package/dist/payload-jwt/authenticateRequest.js

@@ -5,7 +5,6 @@ function createAuthError(message, statusCode) {
     return error;
 }
 export async function authenticateRequest({ req, payload }) {
-    let type = 'cookie';
     if (req.auth) {
         const user = req.auth.user;
         return {
@@ -17,7 +16,6 @@ export async function authenticateRequest({ req, payload }) {
         };
     }
     else {
-        type = 'bearer';
         const session = await verifySession(req);
         if (!session || !session.sub || !session.extra)
             throw createAuthError("No valid session found", 401);

package/dist/payload-jwt/authenticateRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateRequest.js","sourceRoot":"","sources":["../../src/payload-jwt/authenticateRequest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAUvC,SAAS,eAAe,CAAC,OAAe,EAAE,UAAkB;IACxD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAc,CAAC;IAC9C,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,KAAK,CAAC;AACjB,CAAC;AAoCD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAA+C;IACnG,IAAI,IAAI,GAAG,QAAQ,CAAA;IACnB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAY,CAAA;QAClC,OAAO;YACH,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,QAAQ;SACnB,CAAA;IACL,CAAC;SAAM,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAA;QACf,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QAExC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,eAAe,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACrG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;QACrD,MAAM,WAAW,GAAI,OAAO,CAAC,eAAe,EAAE,CAAC,eAAe,CAAC,EAAE,KAA8B,CAAC;QAChG,IAAI,CAAC,WAAW;YAAE,MAAM,eAAe,CAAC,2DAA2D,EAAE,GAAG,CAAC,CAAC;QAE1G,IAAI,CAAC,OAAO;YAAE,MAAM,eAAe,CAAC,8DAA8D,EAAE,GAAG,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEpL,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAGhC,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;gBACjC,UAAU,EAAE,OAAO;gBACnB,IAAI,EAAE;oBACF,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;oBAC1B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;oBACxB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM;oBAC9B,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE;wBACN;4BACI,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM;yBACrE;qBACJ;iBACJ;gBACD,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,OAAO,CAAC,GAAG,CAAC,6CAA6C,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACrF,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,QAAQ;aACnB,CAAA;QACL,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACrB,8BAA8B;YAC9B,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,CAAC,MAAM,CAAC;oBACjB,UAAU,EAAE,OAAO;oBACnB,EAAE,EAAE,WAAW,CAAC,EAAE;oBAClB,IAAI,EAAE;wBACF,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM;qBACjC;oBACD,KAAK,EAAE,KAAK;oBACZ,cAAc,EAAE,IAAI;iBACvB,CAAC,CAAA;gBACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,WAAW,CAAC,KAAK,OAAO,WAAW,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,OAAO;gBACH,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM;gBAC9B,MAAM,EAAE,QAAQ;aACnB,CAAA;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,eAAe,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;AACL,CAAC"}
+{"version":3,"file":"authenticateRequest.js","sourceRoot":"","sources":["../../src/payload-jwt/authenticateRequest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAUvC,SAAS,eAAe,CAAC,OAAe,EAAE,UAAkB;IACxD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAc,CAAC;IAC9C,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,KAAK,CAAC;AACjB,CAAC;AAsCD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAA+C;IACnG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAY,CAAA;QAClC,OAAO;YACH,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,QAAQ;SACnB,CAAA;IACL,CAAC;SAAM,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QAExC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,eAAe,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACrG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;QACrD,MAAM,WAAW,GAAK,OAAO,CAAC,eAAwD,EAAE,CAAC,eAAe,CAAC,EAAE,KAA8B,CAAC;QAC1I,IAAI,CAAC,WAAW;YAAE,MAAM,eAAe,CAAC,2DAA2D,EAAE,GAAG,CAAC,CAAC;QAE1G,IAAI,CAAC,OAAO;YAAE,MAAM,eAAe,CAAC,8DAA8D,EAAE,GAAG,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEpL,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAGhC,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;gBACjC,UAAU,EAAE,OAAO;gBACnB,IAAI,EAAE;oBACF,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;oBAC1B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;oBACxB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM;oBAC9B,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE;wBACN;4BACI,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM;yBACrE;qBACJ;iBACJ;gBACD,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,OAAO,CAAC,GAAG,CAAC,6CAA6C,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACrF,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,QAAQ;aACnB,CAAA;QACL,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACrB,8BAA8B;YAC9B,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,CAAC,MAAM,CAAC;oBACjB,UAAU,EAAE,OAAO;oBACnB,EAAE,EAAE,WAAW,CAAC,EAAE;oBAClB,IAAI,EAAE;wBACF,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM;qBACjC;oBACD,KAAK,EAAE,KAAK;oBACZ,cAAc,EAAE,IAAI;iBACvB,CAAC,CAAA;gBACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,WAAW,CAAC,KAAK,OAAO,WAAW,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,OAAO;gBACH,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM;gBAC9B,MAAM,EAAE,QAAQ;aACnB,CAAA;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,eAAe,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/payload-jwt/configuration.d.ts

@@ -0,0 +1,6 @@
+import type { User } from '../types';
+import type { Payload } from 'payload';
+type AccountType = NonNullable<User['accounts']>[number];
+export declare function persistTokens(userId: string, account: AccountType, payload: Payload): Promise<void>;
+export {};
+//# sourceMappingURL=configuration.d.ts.map

package/dist/payload-jwt/configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAGtC,KAAK,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAkCxD,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,iBAsBzF"}

package/dist/payload-jwt/configuration.js

@@ -0,0 +1,48 @@
+import { decodeJwt } from 'jose';
+function upsertAccount(existing = [], account) {
+    const provider = account.provider;
+    const providerAccountId = account.providerAccountId;
+    const idx = existing.findIndex((a) => a.provider === provider && a.providerAccountId === providerAccountId);
+    const nextRow = {
+        ...(idx >= 0 ? existing[idx] : {}),
+        provider,
+        providerAccountId,
+        type: account.type,
+        // token fields (must match your Users.accounts[] schema)
+        access_token: account.access_token ?? null,
+        refresh_token: account.refresh_token ?? null,
+        expires_at: account.expires_at ?? null,
+        id_token: account.id_token ?? null,
+        token_type: account.token_type ?? null,
+        scope: account.scope ?? null,
+        session_state: account.session_state ?? null,
+    };
+    if (idx >= 0) {
+        const copy = [...existing];
+        copy[idx] = nextRow;
+        return copy;
+    }
+    return [...existing, nextRow];
+}
+export async function persistTokens(userId, account, payload) {
+    const fullUser = await payload.findByID({
+        collection: "users",
+        id: userId,
+        depth: 0,
+    });
+    const existing = fullUser.accounts ?? [];
+    const accounts = upsertAccount(existing, account);
+    let role = 'user'; // default role
+    if (account && account.access_token) {
+        const decodedJWT = decodeJwt(account.access_token);
+        const permissions = decodedJWT.resource_access?.[process.env.OAUTH_CLIENT_ID]?.roles;
+        role = permissions?.[0] || 'user';
+    }
+    await payload.update({
+        collection: "users",
+        id: userId,
+        data: { accounts, role },
+        overrideAccess: true,
+    });
+}
+//# sourceMappingURL=configuration.js.map

package/dist/payload-jwt/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/payload-jwt/configuration.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAIhC,SAAS,aAAa,CAAC,WAA0B,EAAE,EAAE,OAAoB;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAA;IAEnD,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAC5B,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,KAAK,iBAAiB,CACzF,CAAA;IAED,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,QAAQ;QACR,iBAAiB;QACjB,IAAI,EAAE,OAAO,CAAC,IAAI;QAElB,yDAAyD;QACzD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;QAC5C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;KAC7C,CAAA;IAED,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAoB,EAAE,OAAgB;IAExF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,OAAO;QACnB,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,CAAC;KACT,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAI,QAAiB,CAAC,QAAQ,IAAI,EAAE,CAAA;IAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACjD,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,eAAe;IAClC,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,WAAW,GAAK,UAAU,CAAC,eAAwD,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC,EAAE,KAA8B,CAAC;QAC1J,IAAI,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACpC,CAAC;IACD,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,OAAO;QACnB,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QACxB,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;AACJ,CAAC"}

package/dist/payload-jwt/getAccessToken.d.ts

@@ -0,0 +1,3 @@
+import type { Payload } from 'payload';
+export declare function getAccessToken(payload: Payload, userId: string): Promise<string | null>;
+//# sourceMappingURL=getAccessToken.d.ts.map

package/dist/payload-jwt/getAccessToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAccessToken.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/getAccessToken.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAItC,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,0BAkDpE"}

package/dist/payload-jwt/getAccessToken.js

@@ -0,0 +1,44 @@
+export async function getAccessToken(payload, userId) {
+    const user = await payload.findByID({ collection: "users", id: userId, depth: 0 });
+    const kc = user?.accounts?.find((a) => a.provider === "keycloak");
+    if (!kc?.access_token)
+        return null;
+    const expiresAt = kc.expires_at ?? 0;
+    const stillValid = expiresAt === 0 || Date.now() < expiresAt * 1000 - 30000; // 30s skew
+    if (stillValid)
+        return kc.access_token;
+    // Refresh if needed
+    if (!kc.refresh_token)
+        return null;
+    const resp = await fetch(`${process.env.OAUTH_ISSUER}/protocol/openid-connect/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            client_id: process.env.OAUTH_CLIENT_ID,
+            client_secret: process.env.OAUTH_CLIENT_SECRET,
+            grant_type: "refresh_token",
+            refresh_token: kc.refresh_token,
+        }),
+    });
+    if (!resp.ok)
+        return null;
+    const json = await resp.json();
+    const newExpiresAt = Math.floor(Date.now() / 1000 + json.expires_in);
+    // Persist back into users.accounts[] (update your matching row logic as needed)
+    const accounts = (user.accounts ?? []).map((a) => a?.provider === "keycloak"
+        ? {
+            ...a,
+            access_token: json.access_token,
+            expires_at: newExpiresAt,
+            refresh_token: json.refresh_token ?? a.refresh_token,
+        }
+        : a);
+    await payload.update({
+        collection: "users",
+        id: userId,
+        data: { accounts },
+        overrideAccess: true,
+    });
+    return json.access_token;
+}
+//# sourceMappingURL=getAccessToken.js.map

package/dist/payload-jwt/getAccessToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAccessToken.js","sourceRoot":"","sources":["../../src/payload-jwt/getAccessToken.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAc;IACnE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAEnF,MAAM,EAAE,GAAI,IAAsB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAA2B,CAAC;IAC3H,IAAI,CAAC,EAAE,EAAE,YAAY;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,SAAS,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,KAAM,CAAC,CAAC,WAAW;IACzF,IAAI,UAAU;QAAE,OAAO,EAAE,CAAC,YAAY,CAAC;IAEvC,oBAAoB;IACpB,IAAI,CAAC,EAAE,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,gCAAgC,EAAE;QACpF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,eAAgB;YACvC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAoB;YAC/C,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;SAChC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAA0E,CAAC;IAEvG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAErE,gFAAgF;IAChF,MAAM,QAAQ,GAAG,CAAE,IAAsB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAyB,EAAE,EAAE,CAC1F,CAAC,EAAE,QAAQ,KAAK,UAAU;QACxB,CAAC,CAAC;YACE,GAAG,CAAC;YACJ,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,YAAY;YACxB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa;SACrD;QACH,CAAC,CAAC,CAAC,CACN,CAAC;IAEF,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,OAAO;QACnB,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,EAAE,QAAQ,EAAE;QAClB,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC"}

package/dist/payload-jwt/index.d.ts

@@ -1,3 +1,5 @@
 export * from './user';
 export * from './authenticateRequest';
+export * from './configuration';
+export * from './getAccessToken';
 //# sourceMappingURL=index.d.ts.map

package/dist/payload-jwt/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAA;AACtB,cAAc,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAA;AACtB,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/payload-jwt/index.js

@@ -1,3 +1,5 @@
 export * from './user';
 export * from './authenticateRequest';
+export * from './configuration';
+export * from './getAccessToken';
 //# sourceMappingURL=index.js.map

package/dist/payload-jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/payload-jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAA;AACtB,cAAc,uBAAuB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/payload-jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAA;AACtB,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/payload-jwt/user.d.ts

@@ -3,8 +3,8 @@ export interface AuthInfo {
     sub: string;
     exp: number;
     scopes: string[];
-    resource_access?: Record<string, any>;
-    extra?: Record<string, any>;
+    resource_access?: Record<string, unknown>;
+    extra?: Record<string, unknown>;
 }
 export declare function verifySession(req: NextRequest): Promise<AuthInfo | undefined>;
 export declare function verifyToken(bearer: string): Promise<AuthInfo | undefined>;

package/dist/payload-jwt/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/user.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,QAAQ;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AA0CD,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAiCnF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA0B/E;AAGD;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMpE"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/user.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,QAAQ;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AA0CD,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA6BnF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA0B/E;AAGD;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMpE"}

package/dist/payload-jwt/user.js

@@ -1,4 +1,4 @@
-import { jwtVerify, createRemoteJWKSet, decodeJwt } from "jose";
+import { jwtVerify, createRemoteJWKSet } from "jose";
 const OIDC_ISSUER = process.env.OAUTH_ISSUER; // e.g. https://login.microsoftonline.com/<tenant>/v2.0
 const OAUTH_DISCOVERY_URL = `${OIDC_ISSUER}/.well-known/openid-configuration`;
 // Fetch JWKS URL from OAuth well-known configuration
@@ -38,12 +38,10 @@ function extractBearer(req) {
 export async function verifySession(req) {
     const bearer = extractBearer(req);
     if (bearer) {
-        // for development ONLY, use a dummy token
         try {
-            const decodedJWT = decodeJwt(bearer);
             // Get JWKS dynamically from well-known endpoint
             const jwks = await getJWKS();
-            const { payload, protectedHeader } = await jwtVerify(bearer, jwks, {
+            const { payload } = await jwtVerify(bearer, jwks, {
                 issuer: OIDC_ISSUER,
                 algorithms: ["RS256"],
             });
@@ -60,17 +58,15 @@ export async function verifySession(req) {
             return undefined;
         }
     }
-    // fallback: NextAuth session (optional)
     return undefined;
 }
 export async function verifyToken(bearer) {
     if (bearer) {
         // for development ONLY, use a dummy token
         try {
-            const decodedJWT = decodeJwt(bearer);
             // Get JWKS dynamically from well-known endpoint
             const jwks = await getJWKS();
-            const { payload, protectedHeader } = await jwtVerify(bearer, jwks, {
+            const { payload } = await jwtVerify(bearer, jwks, {
                 issuer: OIDC_ISSUER,
                 algorithms: ["RS256"],
             });
@@ -78,6 +74,7 @@ export async function verifyToken(bearer) {
                 sub: payload.sub ?? "unknown",
                 exp: payload.exp ?? 0,
                 scopes: typeof payload.scp === "string" ? payload.scp.split(" ") : [],
+                resource_access: payload.resource_access,
                 extra: { email: payload.email, name: payload.name },
             };
         }

package/dist/payload-jwt/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/payload-jwt/user.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAYhE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC,CAAC,uDAAuD;AACtG,MAAM,mBAAmB,GAAG,GAAG,WAAW,mCAAmC,CAAC;AAE9E,qDAAqD;AACrD,KAAK,UAAU,UAAU;IACrB,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC3D,iCAAiC;QACjC,MAAM,WAAW,GAAG,GAAG,mBAAmB,sBAAsB,CAAC;QACjE,OAAO,WAAW,CAAC;IACvB,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,IAAI,IAAI,GAAiD,IAAI,CAAC;AAE9D,KAAK,UAAU,OAAO;IAClB,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO;IAC9C,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,0CAA0C;AAE1C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAgB;IAEhD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,MAAM,EAAE,CAAC;QACT,0CAA0C;QAC1C,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAErC,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAE7B,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC/D,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;YAEH,OAAO;gBACH,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,SAAS;gBACzC,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,CAAC;gBACjC,MAAM,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACrE,eAAe,EAAE,OAAO,CAAC,eAAkD;gBAC3E,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aACtD,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED,wCAAwC;IAExC,OAAO,SAAS,CAAC;AACrB,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC5C,IAAI,MAAM,EAAE,CAAC;QACT,0CAA0C;QAC1C,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAErC,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAE7B,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC/D,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;YAEH,OAAO;gBACH,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,SAAS;gBACzC,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,CAAC;gBACjC,MAAM,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACrE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aACtD,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAGD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;AACnC,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/payload-jwt/user.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAYrD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC,CAAC,uDAAuD;AACtG,MAAM,mBAAmB,GAAG,GAAG,WAAW,mCAAmC,CAAC;AAE9E,qDAAqD;AACrD,KAAK,UAAU,UAAU;IACrB,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC3D,iCAAiC;QACjC,MAAM,WAAW,GAAG,GAAG,mBAAmB,sBAAsB,CAAC;QACjE,OAAO,WAAW,CAAC;IACvB,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,IAAI,IAAI,GAAiD,IAAI,CAAC;AAE9D,KAAK,UAAU,OAAO;IAClB,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO;IAC9C,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,0CAA0C;AAE1C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAgB;IAEhD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,MAAM,EAAE,CAAC;QACT,IAAI,CAAC;YAGD,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAE7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC9C,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;YAEH,OAAO;gBACH,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,SAAS;gBACzC,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,CAAC;gBACjC,MAAM,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACrE,eAAe,EAAE,OAAO,CAAC,eAAsD;gBAC/E,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aACtD,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC5C,IAAI,MAAM,EAAE,CAAC;QACT,0CAA0C;QAC1C,IAAI,CAAC;YAED,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAE7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC9C,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;YAEH,OAAO;gBACH,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,SAAS;gBACzC,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,CAAC;gBACjC,MAAM,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACrE,eAAe,EAAE,OAAO,CAAC,eAAsD;gBAC/E,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aACtD,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAGD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;AACnC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,36 @@
+export interface User {
+    id: string;
+    email: string;
+    emailVerified?: string | null;
+    name?: string | null;
+    image?: string | null;
+    /**
+     * The role of the user
+     */
+    role: 'user' | 'admin' | 'digital-colleague';
+    enabled?: boolean | null;
+    accounts?: {
+        provider: string;
+        providerAccountId: string;
+        type: 'oidc' | 'oauth' | 'email' | 'webauthn';
+        access_token?: string | null;
+        refresh_token?: string | null;
+        expires_at?: number | null;
+        id_token?: string | null;
+        token_type?: string | null;
+        scope?: string | null;
+        session_state?: string | null;
+        id?: string | null;
+    }[] | null;
+    sessions?: {
+        sessionToken: string;
+        expires: string;
+        id?: string | null;
+    }[] | null;
+    updatedAt: string;
+    createdAt: string;
+    enableAPIKey?: boolean | null;
+    apiKey?: string | null;
+    apiKeyIndex?: string | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,mBAAmB,CAAC;IAC7C,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EACL;QACE,QAAQ,EAAE,MAAM,CAAC;QACjB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;QAC9C,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACpB,EAAE,GACH,IAAI,CAAC;IACT,QAAQ,CAAC,EACL;QACE,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACpB,EAAE,GACH,IAAI,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortex-auth",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Shared authentication utilities for Node.js and Next.js applications",
   "main": "dist/index.js",
   "module": "dist/index.esm.js",
@@ -19,7 +19,7 @@
   },
   "scripts": {
     "dev": "tsc --watch",
-    "build": "tsc",
+    "build": "tsc && tsc-alias",
     "type-check": "tsc --noEmit",
     "lint": "eslint src/**/*.ts"
   },
@@ -53,9 +53,11 @@
     "@typescript-eslint/eslint-plugin": "^6.15.0",
     "@typescript-eslint/parser": "^6.15.0",
     "eslint": "^8.56.0",
+    "eslint-plugin-react": "^7.37.5",
     "next": "^15.0.0",
     "next-auth": "5.0.0-beta.30",
     "payload": "^3.70.0",
+    "tsc-alias": "^1.8.10",
     "typescript": "^5.3.3"
   }
 }