payload-reserve 2.3.0 → 3.0.0

package/dist/utilities/tenantTimezone.js

@@ -1,3 +1,4 @@
+import { collectionHasTenantField } from './tenantFilter.js';
 import { isValidTimezone } from './timezoneUtils.js';
 /**
  * Pure precedence resolver for a tenant's effective timezone:
@@ -43,7 +44,7 @@ import { isValidTimezone } from './timezoneUtils.js';
  * selected, when the scoped collection lacks a tenant relationship, or when the
  * lookup fails. Never throws.
  */ export async function getEffectiveTenantTimezone(args) {
-    const { globalTimezone, payload, scopedCollection, tenantField, tenantId, timezoneField } = args;
+    const { globalTimezone, payload, req, scopedCollection, tenantField, tenantId, timezoneField } = args;
     if (!tenantId) {
         return resolveTenantTimezone({
             globalTimezone
@@ -57,11 +58,19 @@ import { isValidTimezone } from './timezoneUtils.js';
     }
     let tenantTimezone = null;
     try {
+        // The tenant id comes from a cookie, so the read must be access-checked —
+        // multi-tenant constrains its tenants collection by `id`, which turns this
+        // into a membership check. Without a req we cannot check, so stay privileged
+        // and let the caller's own gate apply.
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const tenant = await payload.findByID({
             id: tenantId,
             collection: tenantSlug,
-            depth: 0
+            depth: 0,
+            ...req ? {
+                overrideAccess: false,
+                req
+            } : {}
         });
         const raw = tenant?.[timezoneField];
         tenantTimezone = typeof raw === 'string' ? raw : null;
@@ -73,5 +82,157 @@ import { isValidTimezone } from './timezoneUtils.js';
         tenantTimezone
     });
 }
+/**
+ * Normalizes a relationship-shaped value down to its id: a raw string/number
+ * id, or an object carrying one — `{ id }`, the shape both a populated
+ * relationship and a client sending `{ "tenant": { "id": "..." } }` produce.
+ * Returns null for anything else (including an object with no usable `id`),
+ * so callers can fail closed on a shape they don't recognize instead of
+ * silently skipping whatever check they were about to run.
+ */ export function normalizeRelationshipId(value) {
+    if (typeof value === 'string' || typeof value === 'number') {
+        return value;
+    }
+    if (value && typeof value === 'object' && 'id' in value) {
+        const id = value.id;
+        if (typeof id === 'string' || typeof id === 'number') {
+            return id;
+        }
+    }
+    return null;
+}
+/**
+ * Every tenant id a tenant-field value names, as a list.
+ *
+ * Exists because multi-tenant supports a `hasMany` tenant field, so the value
+ * can legitimately be an ARRAY of relationship-shaped entries.
+ * {@link normalizeRelationshipId} returns null for an array, and the caller
+ * fails closed on null — which turned a supported multi-tenant configuration
+ * into a blanket 403 on every authenticated booking that carried an explicit
+ * tenant (a total booking outage for that install, with no diagnostic).
+ *
+ * - `[]` -> `[]`: an empty array writes no tenant, so there is nothing to
+ *   authorize; the caller permits it, exactly as it does for an absent value.
+ * - a one-or-many array -> one id per entry, all of which the caller must be
+ *   authorized for (any single unrecognized entry poisons the whole value).
+ * - a scalar / `{ id }` -> a single-element list.
+ * - anything else -> null, so the caller can still fail closed, loudly.
+ */ export function normalizeRelationshipIds(value) {
+    if (Array.isArray(value)) {
+        const ids = [];
+        for (const entry of value){
+            const id = normalizeRelationshipId(entry);
+            if (id === null) {
+                return null;
+            }
+            ids.push(id);
+        }
+        return ids;
+    }
+    const single = normalizeRelationshipId(value);
+    return single === null ? null : [
+        single
+    ];
+}
+/**
+ * Whether an authenticated caller may write the tenant value present in
+ * `data[config.multiTenant.tenantField]` onto a new document in
+ * `config.slugs.reservations`.
+ *
+ * Exists because delegating `overrideAccess` is NOT sufficient on its own:
+ * multi-tenant's tenant-field `validate` only checks presence, and Payload's
+ * `create` operation (`executeAccess`) only checks the TRUTHINESS of a
+ * collection access result — unlike read/update/delete, which apply a
+ * returned `Where` via `combineQueries` against a real document. So MT's own
+ * tenant-scoped `create` access can't reject an explicit foreign tenant
+ * either; an authenticated caller can write one straight through regardless
+ * of `overrideAccess`. This closes that gap the same way
+ * {@link getEffectiveTenantTimezone} closes it for a client-supplied tenant
+ * *cookie*: an access-checked (`overrideAccess: false`) probe read against
+ * the tenants collection for the *submitted* tenant id — a lookup that finds
+ * nothing means the caller isn't a member (or a multi-tenant super-admin).
+ *
+ * PRECONDITION — this is a real membership check only when the caller
+ * authenticates against the SAME collection multi-tenant wraps as its
+ * admin/tenant-owning collection. `withTenantAccess` only applies its
+ * membership constraint when `req.user.collection === adminUsersSlug`;
+ * otherwise it falls back to the tenants collection's own (here: default,
+ * unrestricted) access function, which only requires `Boolean(req.user)`. In
+ * this plugin's STANDALONE mode (`userCollection` unset), a customer
+ * authenticates against `slugs.customers` — a collection multi-tenant never
+ * wraps — so this probe passes for ANY tenant id for a logged-in customer.
+ * `src/plugin.ts`'s boot diagnostic warns about that configuration. It is
+ * also a no-op if the host set multi-tenant's own
+ * `useTenantsCollectionAccess: false`, which is not detectable from here.
+ *
+ * Returns true — nothing to check — when the reservations collection isn't
+ * tenant-scoped at all, or `data` doesn't carry an explicit tenant value (MT's
+ * own access-checked `defaultValue` applies in that case; see
+ * `getEffectiveTenantTimezone`'s doc comment for why that path is already
+ * safe). Returns false — fail closed — for an unrecognized value shape (logged,
+ * since a shape this plugin cannot read refuses every such booking), a probe
+ * that finds no matching tenant, or any error while probing.
+ *
+ * A `hasMany` tenant field is supported: the value may be an array, and EVERY
+ * id in it is probed.
+ */ export async function callerMayUseTenant(args) {
+    const { config, data, req } = args;
+    const tenantField = config.multiTenant.tenantField;
+    const rawTenant = data[tenantField];
+    if (rawTenant === undefined || rawTenant === null) {
+        return true;
+    }
+    const reservationsCollection = req.payload.config.collections?.find((c)=>c.slug === config.slugs.reservations);
+    if (!collectionHasTenantField(reservationsCollection, tenantField)) {
+        return true;
+    }
+    const tenantSlug = tenantCollectionSlug(reservationsCollection, tenantField);
+    if (!tenantSlug) {
+        return true;
+    }
+    // A `hasMany` tenant field is a supported multi-tenant configuration, so the
+    // value may be an array — every id in it must be authorized.
+    const tenantIds = normalizeRelationshipIds(rawTenant);
+    if (tenantIds === null) {
+        // Still fail closed, but say so: an unrecognized shape refuses the booking,
+        // and silently refusing every booking is indistinguishable from an outage.
+        // The value itself is caller-supplied and is deliberately NOT logged.
+        req.payload.logger.warn({
+            msg: `payload-reserve: refusing a booking because its "${tenantField}" value has an unrecognized shape. Expected an id, a { id } object, or an array of either (a "hasMany" tenant field). If your tenant field uses a shape this plugin does not recognize, every authenticated booking carrying an explicit tenant will be refused with a 403.`,
+            tenantValueShape: Array.isArray(rawTenant) ? 'array' : typeof rawTenant
+        });
+        return false;
+    }
+    for (const tenantId of tenantIds){
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const tenant = await req.payload.findByID({
+                id: tenantId,
+                collection: tenantSlug,
+                depth: 0,
+                overrideAccess: false,
+                req
+            });
+            if (!tenant) {
+                return false;
+            }
+        } catch (err) {
+            // Forbidden/NotFound is exactly the "not a member" outcome this probe
+            // exists to detect — expected, not worth logging. Anything else (a DB
+            // outage, a genuine bug) still fails closed but is worth surfacing.
+            const status = err?.status;
+            if (status !== 403 && status !== 404) {
+                req.payload.logger.warn({
+                    err,
+                    msg: 'payload-reserve: tenant membership probe failed'
+                });
+            }
+            return false;
+        }
+    }
+    // Includes the empty-array case: no tenant is being written, so there is
+    // nothing to authorize.
+    return true;
+}
 
 //# sourceMappingURL=tenantTimezone.js.map

package/dist/utilities/tenantTimezone.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/tenantTimezone.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport { isValidTimezone } from './timezoneUtils.js'\n\ntype CollectionLike = { fields?: unknown[] } | null | undefined\n\ntype FieldLike = { name?: string; relationTo?: string | string[]; type?: string }\n\n/**\n * Pure precedence resolver for a tenant's effective timezone:\n *\n *   selected tenant's zone  →  global default  →  'UTC'\n *\n * An absent or invalid zone at any step is skipped, never thrown — so a tenant\n * with a bad/empty timezone value transparently falls back to the global default.\n */\nexport function resolveTenantTimezone(args: {\n  globalTimezone: string\n  tenantTimezone?: null | string\n}): string {\n  const { globalTimezone, tenantTimezone } = args\n  if (isValidTimezone(tenantTimezone)) {\n    return tenantTimezone\n  }\n  if (isValidTimezone(globalTimezone)) {\n    return globalTimezone\n  }\n  return 'UTC'\n}\n\n/**\n * The tenant collection's slug, read off the scoped collection's tenant\n * relationship field (`relationTo`). Keeps the plugin tenant-agnostic — it never\n * hardcodes a tenants slug. Returns null for an absent, polymorphic, or\n * non-relationship tenant field.\n */\nexport function tenantCollectionSlug(collection: CollectionLike, tenantField: string): null | string {\n  const fields = collection?.fields\n  if (!Array.isArray(fields)) {\n    return null\n  }\n  for (const f of fields) {\n    if (typeof f === 'object' && f !== null && (f as FieldLike).name === tenantField) {\n      const rel = (f as FieldLike).relationTo\n      return typeof rel === 'string' ? rel : null\n    }\n  }\n  return null\n}\n\n/**\n * Resolve the effective timezone for the selected tenant in multiTenant mode.\n *\n * Loads the tenant document (slug derived from the scoped collection's tenant\n * relationship) and reads `timezoneField`, then applies {@link resolveTenantTimezone}\n * precedence. Returns the global default — without a DB read — when no tenant is\n * selected, when the scoped collection lacks a tenant relationship, or when the\n * lookup fails. Never throws.\n */\nexport async function getEffectiveTenantTimezone(args: {\n  globalTimezone: string\n  payload: Payload\n  scopedCollection: CollectionLike\n  tenantField: string\n  tenantId: null | string\n  timezoneField: string\n}): Promise<string> {\n  const { globalTimezone, payload, scopedCollection, tenantField, tenantId, timezoneField } = args\n  if (!tenantId) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  const tenantSlug = tenantCollectionSlug(scopedCollection, tenantField)\n  if (!tenantSlug) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  let tenantTimezone: null | string = null\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const tenant = await (payload.findByID as any)({\n      id: tenantId,\n      collection: tenantSlug,\n      depth: 0,\n    })\n    const raw = (tenant as null | Record<string, unknown>)?.[timezoneField]\n    tenantTimezone = typeof raw === 'string' ? raw : null\n  } catch {\n    tenantTimezone = null\n  }\n  return resolveTenantTimezone({ globalTimezone, tenantTimezone })\n}\n"],"names":["isValidTimezone","resolveTenantTimezone","args","globalTimezone","tenantTimezone","tenantCollectionSlug","collection","tenantField","fields","Array","isArray","f","name","rel","relationTo","getEffectiveTenantTimezone","payload","scopedCollection","tenantId","timezoneField","tenantSlug","tenant","findByID","id","depth","raw"],"mappings":"AAEA,SAASA,eAAe,QAAQ,qBAAoB;AAMpD;;;;;;;CAOC,GACD,OAAO,SAASC,sBAAsBC,IAGrC;IACC,MAAM,EAAEC,cAAc,EAAEC,cAAc,EAAE,GAAGF;IAC3C,IAAIF,gBAAgBI,iBAAiB;QACnC,OAAOA;IACT;IACA,IAAIJ,gBAAgBG,iBAAiB;QACnC,OAAOA;IACT;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASE,qBAAqBC,UAA0B,EAAEC,WAAmB;IAClF,MAAMC,SAASF,YAAYE;IAC3B,IAAI,CAACC,MAAMC,OAAO,CAACF,SAAS;QAC1B,OAAO;IACT;IACA,KAAK,MAAMG,KAAKH,OAAQ;QACtB,IAAI,OAAOG,MAAM,YAAYA,MAAM,QAAQ,AAACA,EAAgBC,IAAI,KAAKL,aAAa;YAChF,MAAMM,MAAM,AAACF,EAAgBG,UAAU;YACvC,OAAO,OAAOD,QAAQ,WAAWA,MAAM;QACzC;IACF;IACA,OAAO;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeE,2BAA2Bb,IAOhD;IACC,MAAM,EAAEC,cAAc,EAAEa,OAAO,EAAEC,gBAAgB,EAAEV,WAAW,EAAEW,QAAQ,EAAEC,aAAa,EAAE,GAAGjB;IAC5F,IAAI,CAACgB,UAAU;QACb,OAAOjB,sBAAsB;YAAEE;QAAe;IAChD;IACA,MAAMiB,aAAaf,qBAAqBY,kBAAkBV;IAC1D,IAAI,CAACa,YAAY;QACf,OAAOnB,sBAAsB;YAAEE;QAAe;IAChD;IACA,IAAIC,iBAAgC;IACpC,IAAI;QACF,8DAA8D;QAC9D,MAAMiB,SAAS,MAAM,AAACL,QAAQM,QAAQ,CAAS;YAC7CC,IAAIL;YACJZ,YAAYc;YACZI,OAAO;QACT;QACA,MAAMC,MAAOJ,QAA2C,CAACF,cAAc;QACvEf,iBAAiB,OAAOqB,QAAQ,WAAWA,MAAM;IACnD,EAAE,OAAM;QACNrB,iBAAiB;IACnB;IACA,OAAOH,sBAAsB;QAAEE;QAAgBC;IAAe;AAChE"}
+{"version":3,"sources":["../../src/utilities/tenantTimezone.ts"],"sourcesContent":["import type { Payload, PayloadRequest } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { collectionHasTenantField } from './tenantFilter.js'\nimport { isValidTimezone } from './timezoneUtils.js'\n\ntype CollectionLike = { fields?: unknown[] } | null | undefined\n\ntype FieldLike = { name?: string; relationTo?: string | string[]; type?: string }\n\n/**\n * Pure precedence resolver for a tenant's effective timezone:\n *\n *   selected tenant's zone  →  global default  →  'UTC'\n *\n * An absent or invalid zone at any step is skipped, never thrown — so a tenant\n * with a bad/empty timezone value transparently falls back to the global default.\n */\nexport function resolveTenantTimezone(args: {\n  globalTimezone: string\n  tenantTimezone?: null | string\n}): string {\n  const { globalTimezone, tenantTimezone } = args\n  if (isValidTimezone(tenantTimezone)) {\n    return tenantTimezone\n  }\n  if (isValidTimezone(globalTimezone)) {\n    return globalTimezone\n  }\n  return 'UTC'\n}\n\n/**\n * The tenant collection's slug, read off the scoped collection's tenant\n * relationship field (`relationTo`). Keeps the plugin tenant-agnostic — it never\n * hardcodes a tenants slug. Returns null for an absent, polymorphic, or\n * non-relationship tenant field.\n */\nexport function tenantCollectionSlug(collection: CollectionLike, tenantField: string): null | string {\n  const fields = collection?.fields\n  if (!Array.isArray(fields)) {\n    return null\n  }\n  for (const f of fields) {\n    if (typeof f === 'object' && f !== null && (f as FieldLike).name === tenantField) {\n      const rel = (f as FieldLike).relationTo\n      return typeof rel === 'string' ? rel : null\n    }\n  }\n  return null\n}\n\n/**\n * Resolve the effective timezone for the selected tenant in multiTenant mode.\n *\n * Loads the tenant document (slug derived from the scoped collection's tenant\n * relationship) and reads `timezoneField`, then applies {@link resolveTenantTimezone}\n * precedence. Returns the global default — without a DB read — when no tenant is\n * selected, when the scoped collection lacks a tenant relationship, or when the\n * lookup fails. Never throws.\n */\nexport async function getEffectiveTenantTimezone(args: {\n  globalTimezone: string\n  payload: Payload\n  req?: PayloadRequest\n  scopedCollection: CollectionLike\n  tenantField: string\n  tenantId: null | string\n  timezoneField: string\n}): Promise<string> {\n  const { globalTimezone, payload, req, scopedCollection, tenantField, tenantId, timezoneField } =\n    args\n  if (!tenantId) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  const tenantSlug = tenantCollectionSlug(scopedCollection, tenantField)\n  if (!tenantSlug) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  let tenantTimezone: null | string = null\n  try {\n    // The tenant id comes from a cookie, so the read must be access-checked —\n    // multi-tenant constrains its tenants collection by `id`, which turns this\n    // into a membership check. Without a req we cannot check, so stay privileged\n    // and let the caller's own gate apply.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const tenant = await (payload.findByID as any)({\n      id: tenantId,\n      collection: tenantSlug,\n      depth: 0,\n      ...(req ? { overrideAccess: false, req } : {}),\n    })\n    const raw = (tenant as null | Record<string, unknown>)?.[timezoneField]\n    tenantTimezone = typeof raw === 'string' ? raw : null\n  } catch {\n    tenantTimezone = null\n  }\n  return resolveTenantTimezone({ globalTimezone, tenantTimezone })\n}\n\n/**\n * Normalizes a relationship-shaped value down to its id: a raw string/number\n * id, or an object carrying one — `{ id }`, the shape both a populated\n * relationship and a client sending `{ \"tenant\": { \"id\": \"...\" } }` produce.\n * Returns null for anything else (including an object with no usable `id`),\n * so callers can fail closed on a shape they don't recognize instead of\n * silently skipping whatever check they were about to run.\n */\nexport function normalizeRelationshipId(value: unknown): null | number | string {\n  if (typeof value === 'string' || typeof value === 'number') {\n    return value\n  }\n  if (value && typeof value === 'object' && 'id' in value) {\n    const id = (value as { id?: unknown }).id\n    if (typeof id === 'string' || typeof id === 'number') {\n      return id\n    }\n  }\n  return null\n}\n\n/**\n * Every tenant id a tenant-field value names, as a list.\n *\n * Exists because multi-tenant supports a `hasMany` tenant field, so the value\n * can legitimately be an ARRAY of relationship-shaped entries.\n * {@link normalizeRelationshipId} returns null for an array, and the caller\n * fails closed on null — which turned a supported multi-tenant configuration\n * into a blanket 403 on every authenticated booking that carried an explicit\n * tenant (a total booking outage for that install, with no diagnostic).\n *\n * - `[]` -> `[]`: an empty array writes no tenant, so there is nothing to\n *   authorize; the caller permits it, exactly as it does for an absent value.\n * - a one-or-many array -> one id per entry, all of which the caller must be\n *   authorized for (any single unrecognized entry poisons the whole value).\n * - a scalar / `{ id }` -> a single-element list.\n * - anything else -> null, so the caller can still fail closed, loudly.\n */\nexport function normalizeRelationshipIds(value: unknown): Array<number | string> | null {\n  if (Array.isArray(value)) {\n    const ids: Array<number | string> = []\n    for (const entry of value) {\n      const id = normalizeRelationshipId(entry)\n      if (id === null) {\n        return null\n      }\n      ids.push(id)\n    }\n    return ids\n  }\n  const single = normalizeRelationshipId(value)\n  return single === null ? null : [single]\n}\n\n/**\n * Whether an authenticated caller may write the tenant value present in\n * `data[config.multiTenant.tenantField]` onto a new document in\n * `config.slugs.reservations`.\n *\n * Exists because delegating `overrideAccess` is NOT sufficient on its own:\n * multi-tenant's tenant-field `validate` only checks presence, and Payload's\n * `create` operation (`executeAccess`) only checks the TRUTHINESS of a\n * collection access result — unlike read/update/delete, which apply a\n * returned `Where` via `combineQueries` against a real document. So MT's own\n * tenant-scoped `create` access can't reject an explicit foreign tenant\n * either; an authenticated caller can write one straight through regardless\n * of `overrideAccess`. This closes that gap the same way\n * {@link getEffectiveTenantTimezone} closes it for a client-supplied tenant\n * *cookie*: an access-checked (`overrideAccess: false`) probe read against\n * the tenants collection for the *submitted* tenant id — a lookup that finds\n * nothing means the caller isn't a member (or a multi-tenant super-admin).\n *\n * PRECONDITION — this is a real membership check only when the caller\n * authenticates against the SAME collection multi-tenant wraps as its\n * admin/tenant-owning collection. `withTenantAccess` only applies its\n * membership constraint when `req.user.collection === adminUsersSlug`;\n * otherwise it falls back to the tenants collection's own (here: default,\n * unrestricted) access function, which only requires `Boolean(req.user)`. In\n * this plugin's STANDALONE mode (`userCollection` unset), a customer\n * authenticates against `slugs.customers` — a collection multi-tenant never\n * wraps — so this probe passes for ANY tenant id for a logged-in customer.\n * `src/plugin.ts`'s boot diagnostic warns about that configuration. It is\n * also a no-op if the host set multi-tenant's own\n * `useTenantsCollectionAccess: false`, which is not detectable from here.\n *\n * Returns true — nothing to check — when the reservations collection isn't\n * tenant-scoped at all, or `data` doesn't carry an explicit tenant value (MT's\n * own access-checked `defaultValue` applies in that case; see\n * `getEffectiveTenantTimezone`'s doc comment for why that path is already\n * safe). Returns false — fail closed — for an unrecognized value shape (logged,\n * since a shape this plugin cannot read refuses every such booking), a probe\n * that finds no matching tenant, or any error while probing.\n *\n * A `hasMany` tenant field is supported: the value may be an array, and EVERY\n * id in it is probed.\n */\nexport async function callerMayUseTenant(args: {\n  config: Pick<ResolvedReservationPluginConfig, 'multiTenant' | 'slugs'>\n  data: Record<string, unknown>\n  req: PayloadRequest\n}): Promise<boolean> {\n  const { config, data, req } = args\n  const tenantField = config.multiTenant.tenantField\n  const rawTenant = data[tenantField]\n  if (rawTenant === undefined || rawTenant === null) {\n    return true\n  }\n\n  const reservationsCollection = req.payload.config.collections?.find(\n    (c) => c.slug === config.slugs.reservations,\n  ) as CollectionLike\n  if (!collectionHasTenantField(reservationsCollection, tenantField)) {\n    return true\n  }\n  const tenantSlug = tenantCollectionSlug(reservationsCollection, tenantField)\n  if (!tenantSlug) {\n    return true\n  }\n\n  // A `hasMany` tenant field is a supported multi-tenant configuration, so the\n  // value may be an array — every id in it must be authorized.\n  const tenantIds = normalizeRelationshipIds(rawTenant)\n  if (tenantIds === null) {\n    // Still fail closed, but say so: an unrecognized shape refuses the booking,\n    // and silently refusing every booking is indistinguishable from an outage.\n    // The value itself is caller-supplied and is deliberately NOT logged.\n    req.payload.logger.warn({\n      msg: `payload-reserve: refusing a booking because its \"${tenantField}\" value has an unrecognized shape. Expected an id, a { id } object, or an array of either (a \"hasMany\" tenant field). If your tenant field uses a shape this plugin does not recognize, every authenticated booking carrying an explicit tenant will be refused with a 403.`,\n      tenantValueShape: Array.isArray(rawTenant) ? 'array' : typeof rawTenant,\n    })\n    return false\n  }\n\n  for (const tenantId of tenantIds) {\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const tenant = await (req.payload.findByID as any)({\n        id: tenantId,\n        collection: tenantSlug,\n        depth: 0,\n        overrideAccess: false,\n        req,\n      })\n      if (!tenant) {\n        return false\n      }\n    } catch (err) {\n      // Forbidden/NotFound is exactly the \"not a member\" outcome this probe\n      // exists to detect — expected, not worth logging. Anything else (a DB\n      // outage, a genuine bug) still fails closed but is worth surfacing.\n      const status = (err as { status?: number } | undefined)?.status\n      if (status !== 403 && status !== 404) {\n        req.payload.logger.warn({ err, msg: 'payload-reserve: tenant membership probe failed' })\n      }\n      return false\n    }\n  }\n\n  // Includes the empty-array case: no tenant is being written, so there is\n  // nothing to authorize.\n  return true\n}\n"],"names":["collectionHasTenantField","isValidTimezone","resolveTenantTimezone","args","globalTimezone","tenantTimezone","tenantCollectionSlug","collection","tenantField","fields","Array","isArray","f","name","rel","relationTo","getEffectiveTenantTimezone","payload","req","scopedCollection","tenantId","timezoneField","tenantSlug","tenant","findByID","id","depth","overrideAccess","raw","normalizeRelationshipId","value","normalizeRelationshipIds","ids","entry","push","single","callerMayUseTenant","config","data","multiTenant","rawTenant","undefined","reservationsCollection","collections","find","c","slug","slugs","reservations","tenantIds","logger","warn","msg","tenantValueShape","err","status"],"mappings":"AAIA,SAASA,wBAAwB,QAAQ,oBAAmB;AAC5D,SAASC,eAAe,QAAQ,qBAAoB;AAMpD;;;;;;;CAOC,GACD,OAAO,SAASC,sBAAsBC,IAGrC;IACC,MAAM,EAAEC,cAAc,EAAEC,cAAc,EAAE,GAAGF;IAC3C,IAAIF,gBAAgBI,iBAAiB;QACnC,OAAOA;IACT;IACA,IAAIJ,gBAAgBG,iBAAiB;QACnC,OAAOA;IACT;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASE,qBAAqBC,UAA0B,EAAEC,WAAmB;IAClF,MAAMC,SAASF,YAAYE;IAC3B,IAAI,CAACC,MAAMC,OAAO,CAACF,SAAS;QAC1B,OAAO;IACT;IACA,KAAK,MAAMG,KAAKH,OAAQ;QACtB,IAAI,OAAOG,MAAM,YAAYA,MAAM,QAAQ,AAACA,EAAgBC,IAAI,KAAKL,aAAa;YAChF,MAAMM,MAAM,AAACF,EAAgBG,UAAU;YACvC,OAAO,OAAOD,QAAQ,WAAWA,MAAM;QACzC;IACF;IACA,OAAO;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeE,2BAA2Bb,IAQhD;IACC,MAAM,EAAEC,cAAc,EAAEa,OAAO,EAAEC,GAAG,EAAEC,gBAAgB,EAAEX,WAAW,EAAEY,QAAQ,EAAEC,aAAa,EAAE,GAC5FlB;IACF,IAAI,CAACiB,UAAU;QACb,OAAOlB,sBAAsB;YAAEE;QAAe;IAChD;IACA,MAAMkB,aAAahB,qBAAqBa,kBAAkBX;IAC1D,IAAI,CAACc,YAAY;QACf,OAAOpB,sBAAsB;YAAEE;QAAe;IAChD;IACA,IAAIC,iBAAgC;IACpC,IAAI;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,uCAAuC;QACvC,8DAA8D;QAC9D,MAAMkB,SAAS,MAAM,AAACN,QAAQO,QAAQ,CAAS;YAC7CC,IAAIL;YACJb,YAAYe;YACZI,OAAO;YACP,GAAIR,MAAM;gBAAES,gBAAgB;gBAAOT;YAAI,IAAI,CAAC,CAAC;QAC/C;QACA,MAAMU,MAAOL,QAA2C,CAACF,cAAc;QACvEhB,iBAAiB,OAAOuB,QAAQ,WAAWA,MAAM;IACnD,EAAE,OAAM;QACNvB,iBAAiB;IACnB;IACA,OAAOH,sBAAsB;QAAEE;QAAgBC;IAAe;AAChE;AAEA;;;;;;;CAOC,GACD,OAAO,SAASwB,wBAAwBC,KAAc;IACpD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,UAAU;QAC1D,OAAOA;IACT;IACA,IAAIA,SAAS,OAAOA,UAAU,YAAY,QAAQA,OAAO;QACvD,MAAML,KAAK,AAACK,MAA2BL,EAAE;QACzC,IAAI,OAAOA,OAAO,YAAY,OAAOA,OAAO,UAAU;YACpD,OAAOA;QACT;IACF;IACA,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASM,yBAAyBD,KAAc;IACrD,IAAIpB,MAAMC,OAAO,CAACmB,QAAQ;QACxB,MAAME,MAA8B,EAAE;QACtC,KAAK,MAAMC,SAASH,MAAO;YACzB,MAAML,KAAKI,wBAAwBI;YACnC,IAAIR,OAAO,MAAM;gBACf,OAAO;YACT;YACAO,IAAIE,IAAI,CAACT;QACX;QACA,OAAOO;IACT;IACA,MAAMG,SAASN,wBAAwBC;IACvC,OAAOK,WAAW,OAAO,OAAO;QAACA;KAAO;AAC1C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,eAAeC,mBAAmBjC,IAIxC;IACC,MAAM,EAAEkC,MAAM,EAAEC,IAAI,EAAEpB,GAAG,EAAE,GAAGf;IAC9B,MAAMK,cAAc6B,OAAOE,WAAW,CAAC/B,WAAW;IAClD,MAAMgC,YAAYF,IAAI,CAAC9B,YAAY;IACnC,IAAIgC,cAAcC,aAAaD,cAAc,MAAM;QACjD,OAAO;IACT;IAEA,MAAME,yBAAyBxB,IAAID,OAAO,CAACoB,MAAM,CAACM,WAAW,EAAEC,KAC7D,CAACC,IAAMA,EAAEC,IAAI,KAAKT,OAAOU,KAAK,CAACC,YAAY;IAE7C,IAAI,CAAChD,yBAAyB0C,wBAAwBlC,cAAc;QAClE,OAAO;IACT;IACA,MAAMc,aAAahB,qBAAqBoC,wBAAwBlC;IAChE,IAAI,CAACc,YAAY;QACf,OAAO;IACT;IAEA,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM2B,YAAYlB,yBAAyBS;IAC3C,IAAIS,cAAc,MAAM;QACtB,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE/B,IAAID,OAAO,CAACiC,MAAM,CAACC,IAAI,CAAC;YACtBC,KAAK,CAAC,iDAAiD,EAAE5C,YAAY,2QAA2Q,CAAC;YACjV6C,kBAAkB3C,MAAMC,OAAO,CAAC6B,aAAa,UAAU,OAAOA;QAChE;QACA,OAAO;IACT;IAEA,KAAK,MAAMpB,YAAY6B,UAAW;QAChC,IAAI;YACF,8DAA8D;YAC9D,MAAM1B,SAAS,MAAM,AAACL,IAAID,OAAO,CAACO,QAAQ,CAAS;gBACjDC,IAAIL;gBACJb,YAAYe;gBACZI,OAAO;gBACPC,gBAAgB;gBAChBT;YACF;YACA,IAAI,CAACK,QAAQ;gBACX,OAAO;YACT;QACF,EAAE,OAAO+B,KAAK;YACZ,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,MAAMC,SAAUD,KAAyCC;YACzD,IAAIA,WAAW,OAAOA,WAAW,KAAK;gBACpCrC,IAAID,OAAO,CAACiC,MAAM,CAACC,IAAI,CAAC;oBAAEG;oBAAKF,KAAK;gBAAkD;YACxF;YACA,OAAO;QACT;IACF;IAEA,yEAAyE;IACzE,wBAAwB;IACxB,OAAO;AACT"}

package/dist/utilities/transactionSupport.d.ts

@@ -0,0 +1,13 @@
+import type { Payload } from 'payload';
+/**
+ * Whether this database will actually give the plugin a transaction.
+ *
+ * It matters because `acquireBookingLock` is only meaningful inside one. Without
+ * a transaction the lock write still happens but serializes nothing, so
+ * concurrent bookings silently double-book exactly as they did before the lock
+ * existed — a failure that is open rather than closed, and invisible.
+ *
+ * Payload's mongoose adapter returns null from `beginTransaction` when the
+ * connection is not a replica set. Probing costs one no-op transaction at boot.
+ */
+export declare function supportsTransactions(payload: Payload): Promise<boolean>;

package/dist/utilities/transactionSupport.js

@@ -0,0 +1,30 @@
+/**
+ * Whether this database will actually give the plugin a transaction.
+ *
+ * It matters because `acquireBookingLock` is only meaningful inside one. Without
+ * a transaction the lock write still happens but serializes nothing, so
+ * concurrent bookings silently double-book exactly as they did before the lock
+ * existed — a failure that is open rather than closed, and invisible.
+ *
+ * Payload's mongoose adapter returns null from `beginTransaction` when the
+ * connection is not a replica set. Probing costs one no-op transaction at boot.
+ */ export async function supportsTransactions(payload) {
+    const db = payload.db;
+    if (typeof db?.beginTransaction !== 'function') {
+        return false;
+    }
+    try {
+        const id = await db.beginTransaction();
+        if (id === null || id === undefined) {
+            return false;
+        }
+        await db.rollbackTransaction?.(id);
+        return true;
+    } catch  {
+        // An adapter that throws here cannot give us a transaction, which is the
+        // only thing the caller needs to know.
+        return false;
+    }
+}
+
+//# sourceMappingURL=transactionSupport.js.map

package/dist/utilities/transactionSupport.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/transactionSupport.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\n/**\n * Whether this database will actually give the plugin a transaction.\n *\n * It matters because `acquireBookingLock` is only meaningful inside one. Without\n * a transaction the lock write still happens but serializes nothing, so\n * concurrent bookings silently double-book exactly as they did before the lock\n * existed — a failure that is open rather than closed, and invisible.\n *\n * Payload's mongoose adapter returns null from `beginTransaction` when the\n * connection is not a replica set. Probing costs one no-op transaction at boot.\n */\nexport async function supportsTransactions(payload: Payload): Promise<boolean> {\n  const db = payload.db as {\n    beginTransaction?: (options?: unknown) => Promise<null | number | string>\n    rollbackTransaction?: (id: unknown) => Promise<void>\n  }\n\n  if (typeof db?.beginTransaction !== 'function') {\n    return false\n  }\n\n  try {\n    const id = await db.beginTransaction()\n    if (id === null || id === undefined) {\n      return false\n    }\n    await db.rollbackTransaction?.(id)\n    return true\n  } catch {\n    // An adapter that throws here cannot give us a transaction, which is the\n    // only thing the caller needs to know.\n    return false\n  }\n}\n"],"names":["supportsTransactions","payload","db","beginTransaction","id","undefined","rollbackTransaction"],"mappings":"AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeA,qBAAqBC,OAAgB;IACzD,MAAMC,KAAKD,QAAQC,EAAE;IAKrB,IAAI,OAAOA,IAAIC,qBAAqB,YAAY;QAC9C,OAAO;IACT;IAEA,IAAI;QACF,MAAMC,KAAK,MAAMF,GAAGC,gBAAgB;QACpC,IAAIC,OAAO,QAAQA,OAAOC,WAAW;YACnC,OAAO;QACT;QACA,MAAMH,GAAGI,mBAAmB,GAAGF;QAC/B,OAAO;IACT,EAAE,OAAM;QACN,yEAAyE;QACzE,uCAAuC;QACvC,OAAO;IACT;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload-reserve",
-  "version": "2.3.0",
+  "version": "3.0.0",
   "description": "A Payload CMS 3.x plugin for reservation and booking management with conflict detection, status workflows, and calendar UI",
   "keywords": [
     "payload",
@@ -49,15 +49,15 @@
     "@changesets/cli": "^2.30.0",
     "@elghaied/payload-plugin-sms": "^0.3.0",
     "@eslint/eslintrc": "^3.2.0",
-    "@payloadcms/db-mongodb": "3.79.0",
-    "@payloadcms/db-postgres": "3.79.0",
-    "@payloadcms/db-sqlite": "3.79.0",
+    "@payloadcms/db-mongodb": "3.86.0",
+    "@payloadcms/db-postgres": "3.86.0",
+    "@payloadcms/db-sqlite": "3.86.0",
     "@payloadcms/eslint-config": "3.9.0",
-    "@payloadcms/next": "3.79.0",
-    "@payloadcms/plugin-multi-tenant": "3.79.0",
-    "@payloadcms/richtext-lexical": "3.79.0",
-    "@payloadcms/translations": "3.79.0",
-    "@payloadcms/ui": "3.79.0",
+    "@payloadcms/next": "3.86.0",
+    "@payloadcms/plugin-multi-tenant": "3.86.0",
+    "@payloadcms/richtext-lexical": "3.86.0",
+    "@payloadcms/translations": "3.86.0",
+    "@payloadcms/ui": "3.86.0",
     "@playwright/test": "1.56.1",
     "@swc-node/register": "1.10.9",
     "@swc/cli": "0.6.0",
@@ -72,7 +72,7 @@
     "mongodb-memory-server": "10.1.4",
     "next": "15.4.11",
     "open": "^10.1.0",
-    "payload": "3.79.0",
+    "payload": "3.86.0",
     "prettier": "^3.4.2",
     "qs-esm": "7.0.2",
     "react": "19.2.1",
@@ -85,9 +85,9 @@
     "vitest": "4.0.18"
   },
   "peerDependencies": {
-    "@payloadcms/translations": "^3.79.0",
-    "@payloadcms/ui": "^3.79.0",
-    "payload": "^3.79.0"
+    "@payloadcms/translations": "^3.86.0",
+    "@payloadcms/ui": "^3.86.0",
+    "payload": "^3.86.0"
   },
   "engines": {
     "node": "^18.20.2 || >=20.9.0",