payload-reserve 2.4.0 → 3.0.1

package/dist/utilities/retryOnWriteConflict.js

@@ -0,0 +1,135 @@
+/**
+ * Retry a write that lost a transaction-level lock race.
+ *
+ * `acquireBookingLock` makes concurrent bookings for one resource contend on a
+ * single document so the database serializes them. On MongoDB the loser does
+ * not wait — it aborts immediately with a WriteConflict. That is correct for a
+ * `quantity: 1` resource (only one booking should win anyway) but wrong for a
+ * `quantity: 3` one, where two more bookings legitimately fit. Measured
+ * without retry: 8 simultaneous bookings against a `quantity: 3` resource
+ * persisted only 1.
+ *
+ * Retrying re-runs the whole operation on a fresh transaction. The retry takes
+ * the lock cleanly, re-reads availability — now seeing the winner's committed
+ * booking — and is admitted or rejected by `validateConflicts` on the merits.
+ */ /** MongoDB WriteConflict. */ const MONGO_WRITE_CONFLICT = 112;
+/** Postgres serialization_failure and deadlock_detected. */ const POSTGRES_SERIALIZATION_FAILURES = new Set([
+    '40P01',
+    '40001'
+]);
+/**
+ * SQLite/libsql busy-or-locked family. Only reachable when the adapter is
+ * given a truthy `transactionOptions` — otherwise `beginTransaction` is a
+ * no-op and nothing ever contends. `SQLITE_BUSY` and plain `SQLITE_LOCKED`
+ * are the same family as the qualified variant measured below; prefix match
+ * (not an exact-set lookup like the Postgres codes above) because
+ * SQLite/libsql qualify the base code with a reason suffix (`_SHAREDCACHE`,
+ * `_SNAPSHOT`, ...) — the prefix is still the driver's own structured
+ * signal, never message text.
+ *
+ * KNOWN GAP, confirmed by direct inspection, not assumption: for a loser
+ * that aborts at `beginTransaction` itself (SQLite's actual failure mode —
+ * a second write transaction cannot even open while one is held, rather
+ * than queuing for it), this check can never fire in practice. The real
+ * driver error — a `LibsqlError` with `code: 'SQLITE_LOCKED_SHAREDCACHE'` —
+ * is caught *inside* `@payloadcms/drizzle`'s own `beginTransaction.js` (a
+ * Payload-core dependency, not this plugin) and re-thrown as a bare
+ * `new Error('Error: cannot begin transaction: ...')`: no `code`, no
+ * `cause`, generic `name`. By the time it reaches this function the
+ * structured signal is already gone, so retry never engages for that path
+ * — measured: burst of 8 against a `quantity: 3` resource with retry
+ * recovers only 1 of 3, identical to no retry at all, and raising the
+ * retry budget from 5 to 30 attempts makes no difference. This match is
+ * kept because it is still correct for any SQLite/libsql error shape that
+ * *does* preserve `code` (a mid-transaction conflict would be a different
+ * code path), and matching on the wrapped error's message text to plug this
+ * specific gap is exactly what this project's structured-signal-only
+ * constraint forbids.
+ */ const SQLITE_BUSY_OR_LOCKED_PREFIXES = [
+    'SQLITE_BUSY',
+    'SQLITE_LOCKED'
+];
+/**
+ * Whether an error means "the database refused this transaction because
+ * another one touched the same rows; running it again may succeed."
+ *
+ * Detection is by the driver's own structured signals, never by message text.
+ * MongoDB tags exactly this class with the `TransientTransactionError` label,
+ * which is the retry contract its drivers document; Postgres uses SQLSTATE;
+ * SQLite/libsql use a `code` string in the `SQLITE_BUSY`/`SQLITE_LOCKED*`
+ * family.
+ */ export function isTransientWriteConflict(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const { code, errorLabels } = error;
+    if (Array.isArray(errorLabels) && errorLabels.includes('TransientTransactionError')) {
+        return true;
+    }
+    if (code === MONGO_WRITE_CONFLICT) {
+        return true;
+    }
+    if (typeof code !== 'string') {
+        return false;
+    }
+    return POSTGRES_SERIALIZATION_FAILURES.has(code) || SQLITE_BUSY_OR_LOCKED_PREFIXES.some((prefix)=>code.startsWith(prefix));
+}
+/**
+ * Run `operation`, retrying only transient write conflicts.
+ *
+ * Every other error — a genuine booking conflict, a validation failure, an
+ * access denial — propagates on the first attempt. Retrying those would turn a
+ * clean rejection into a slow one.
+ *
+ * Backoff is exponential with full jitter, so a burst of losers does not
+ * synchronise into a second stampede on the same document.
+ *
+ * Pass `req` whenever the operation writes through the Payload Local API. Every
+ * attempt re-invokes a closure over the SAME `req`, and Payload's
+ * `initTransaction` JOINS an existing `req.transactionID` rather than opening a
+ * fresh transaction — so a transaction id left behind by a failed attempt would
+ * make the next attempt re-enter a transaction the database already discarded.
+ * Payload's own operations normally clean up after themselves (`killTransaction`
+ * deletes the id from their catch), with one gap they cannot close: when
+ * `beginTransaction` ITSELF rejects, `initTransaction` has already stored the
+ * rejected promise on the req and `killTransaction`'s guard skips promises, so
+ * the req stays poisoned — every later `initTransaction` short-circuits on
+ * `instanceof Promise` and re-throws the first error without touching the
+ * database. Clearing a leftover here closes it. See dev/retryTransaction.spec.ts.
+ *
+ * Do NOT attribute SQLite's "raising the retry budget changes nothing"
+ * measurement to this. That has a different, independent cause: `@payloadcms/
+ * drizzle` rethrows the driver's error as a bare `Error`, so
+ * `isTransientWriteConflict` returns FALSE and this loop throws on attempt 1 —
+ * attempts 2..N never happen, and poisoning never gets a chance to matter. See
+ * README's "Concurrent booking: database adapter support". The shape this
+ * clearing actually protects is any caller that swallows a
+ * begin-transaction failure and then keeps using the same req (see the expiry
+ * sweep in HoldService.takeHold).
+ */ export async function retryOnWriteConflict(operation, { attempts = 5, baseDelayMs = 10, req } = {}) {
+    let lastError;
+    // Only leftovers from a failed attempt are ours to clear. A req that arrives
+    // already inside a transaction belongs to an enclosing caller: dropping that
+    // id would silently detach the retried write from their unit of work.
+    const callerOwnsTransaction = req ? req.transactionID !== undefined : false;
+    for(let attempt = 0; attempt < attempts; attempt++){
+        if (attempt > 0 && req && !callerOwnsTransaction && req.transactionID !== undefined) {
+            delete req.transactionID;
+        }
+        try {
+            return await operation();
+        } catch (error) {
+            if (!isTransientWriteConflict(error)) {
+                throw error;
+            }
+            lastError = error;
+            if (attempt < attempts - 1) {
+                const ceiling = baseDelayMs * 2 ** attempt;
+                await new Promise((resolve)=>setTimeout(resolve, Math.random() * ceiling));
+            }
+        }
+    }
+    throw lastError;
+}
+
+//# sourceMappingURL=retryOnWriteConflict.js.map

package/dist/utilities/retryOnWriteConflict.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/retryOnWriteConflict.ts"],"sourcesContent":["/**\n * Retry a write that lost a transaction-level lock race.\n *\n * `acquireBookingLock` makes concurrent bookings for one resource contend on a\n * single document so the database serializes them. On MongoDB the loser does\n * not wait — it aborts immediately with a WriteConflict. That is correct for a\n * `quantity: 1` resource (only one booking should win anyway) but wrong for a\n * `quantity: 3` one, where two more bookings legitimately fit. Measured\n * without retry: 8 simultaneous bookings against a `quantity: 3` resource\n * persisted only 1.\n *\n * Retrying re-runs the whole operation on a fresh transaction. The retry takes\n * the lock cleanly, re-reads availability — now seeing the winner's committed\n * booking — and is admitted or rejected by `validateConflicts` on the merits.\n */\n\n/** MongoDB WriteConflict. */\nconst MONGO_WRITE_CONFLICT = 112\n\n/** Postgres serialization_failure and deadlock_detected. */\nconst POSTGRES_SERIALIZATION_FAILURES = new Set(['40P01', '40001'])\n\n/**\n * SQLite/libsql busy-or-locked family. Only reachable when the adapter is\n * given a truthy `transactionOptions` — otherwise `beginTransaction` is a\n * no-op and nothing ever contends. `SQLITE_BUSY` and plain `SQLITE_LOCKED`\n * are the same family as the qualified variant measured below; prefix match\n * (not an exact-set lookup like the Postgres codes above) because\n * SQLite/libsql qualify the base code with a reason suffix (`_SHAREDCACHE`,\n * `_SNAPSHOT`, ...) — the prefix is still the driver's own structured\n * signal, never message text.\n *\n * KNOWN GAP, confirmed by direct inspection, not assumption: for a loser\n * that aborts at `beginTransaction` itself (SQLite's actual failure mode —\n * a second write transaction cannot even open while one is held, rather\n * than queuing for it), this check can never fire in practice. The real\n * driver error — a `LibsqlError` with `code: 'SQLITE_LOCKED_SHAREDCACHE'` —\n * is caught *inside* `@payloadcms/drizzle`'s own `beginTransaction.js` (a\n * Payload-core dependency, not this plugin) and re-thrown as a bare\n * `new Error('Error: cannot begin transaction: ...')`: no `code`, no\n * `cause`, generic `name`. By the time it reaches this function the\n * structured signal is already gone, so retry never engages for that path\n * — measured: burst of 8 against a `quantity: 3` resource with retry\n * recovers only 1 of 3, identical to no retry at all, and raising the\n * retry budget from 5 to 30 attempts makes no difference. This match is\n * kept because it is still correct for any SQLite/libsql error shape that\n * *does* preserve `code` (a mid-transaction conflict would be a different\n * code path), and matching on the wrapped error's message text to plug this\n * specific gap is exactly what this project's structured-signal-only\n * constraint forbids.\n */\nconst SQLITE_BUSY_OR_LOCKED_PREFIXES = ['SQLITE_BUSY', 'SQLITE_LOCKED']\n\n/**\n * Whether an error means \"the database refused this transaction because\n * another one touched the same rows; running it again may succeed.\"\n *\n * Detection is by the driver's own structured signals, never by message text.\n * MongoDB tags exactly this class with the `TransientTransactionError` label,\n * which is the retry contract its drivers document; Postgres uses SQLSTATE;\n * SQLite/libsql use a `code` string in the `SQLITE_BUSY`/`SQLITE_LOCKED*`\n * family.\n */\nexport function isTransientWriteConflict(error: unknown): boolean {\n  if (!error || typeof error !== 'object') {\n    return false\n  }\n\n  const { code, errorLabels } = error as { code?: unknown; errorLabels?: unknown }\n\n  if (Array.isArray(errorLabels) && errorLabels.includes('TransientTransactionError')) {\n    return true\n  }\n\n  if (code === MONGO_WRITE_CONFLICT) {\n    return true\n  }\n\n  if (typeof code !== 'string') {\n    return false\n  }\n\n  return (\n    POSTGRES_SERIALIZATION_FAILURES.has(code) ||\n    SQLITE_BUSY_OR_LOCKED_PREFIXES.some((prefix) => code.startsWith(prefix))\n  )\n}\n\n/**\n * Run `operation`, retrying only transient write conflicts.\n *\n * Every other error — a genuine booking conflict, a validation failure, an\n * access denial — propagates on the first attempt. Retrying those would turn a\n * clean rejection into a slow one.\n *\n * Backoff is exponential with full jitter, so a burst of losers does not\n * synchronise into a second stampede on the same document.\n *\n * Pass `req` whenever the operation writes through the Payload Local API. Every\n * attempt re-invokes a closure over the SAME `req`, and Payload's\n * `initTransaction` JOINS an existing `req.transactionID` rather than opening a\n * fresh transaction — so a transaction id left behind by a failed attempt would\n * make the next attempt re-enter a transaction the database already discarded.\n * Payload's own operations normally clean up after themselves (`killTransaction`\n * deletes the id from their catch), with one gap they cannot close: when\n * `beginTransaction` ITSELF rejects, `initTransaction` has already stored the\n * rejected promise on the req and `killTransaction`'s guard skips promises, so\n * the req stays poisoned — every later `initTransaction` short-circuits on\n * `instanceof Promise` and re-throws the first error without touching the\n * database. Clearing a leftover here closes it. See dev/retryTransaction.spec.ts.\n *\n * Do NOT attribute SQLite's \"raising the retry budget changes nothing\"\n * measurement to this. That has a different, independent cause: `@payloadcms/\n * drizzle` rethrows the driver's error as a bare `Error`, so\n * `isTransientWriteConflict` returns FALSE and this loop throws on attempt 1 —\n * attempts 2..N never happen, and poisoning never gets a chance to matter. See\n * README's \"Concurrent booking: database adapter support\". The shape this\n * clearing actually protects is any caller that swallows a\n * begin-transaction failure and then keeps using the same req (see the expiry\n * sweep in HoldService.takeHold).\n */\nexport async function retryOnWriteConflict<T>(\n  operation: () => Promise<T>,\n  {\n    attempts = 5,\n    baseDelayMs = 10,\n    req,\n  }: { attempts?: number; baseDelayMs?: number; req?: { transactionID?: unknown } } = {},\n): Promise<T> {\n  let lastError: unknown\n\n  // Only leftovers from a failed attempt are ours to clear. A req that arrives\n  // already inside a transaction belongs to an enclosing caller: dropping that\n  // id would silently detach the retried write from their unit of work.\n  const callerOwnsTransaction = req ? req.transactionID !== undefined : false\n\n  for (let attempt = 0; attempt < attempts; attempt++) {\n    if (attempt > 0 && req && !callerOwnsTransaction && req.transactionID !== undefined) {\n      delete req.transactionID\n    }\n\n    try {\n      return await operation()\n    } catch (error) {\n      if (!isTransientWriteConflict(error)) {\n        throw error\n      }\n\n      lastError = error\n\n      if (attempt < attempts - 1) {\n        const ceiling = baseDelayMs * 2 ** attempt\n        await new Promise((resolve) => setTimeout(resolve, Math.random() * ceiling))\n      }\n    }\n  }\n\n  throw lastError\n}\n"],"names":["MONGO_WRITE_CONFLICT","POSTGRES_SERIALIZATION_FAILURES","Set","SQLITE_BUSY_OR_LOCKED_PREFIXES","isTransientWriteConflict","error","code","errorLabels","Array","isArray","includes","has","some","prefix","startsWith","retryOnWriteConflict","operation","attempts","baseDelayMs","req","lastError","callerOwnsTransaction","transactionID","undefined","attempt","ceiling","Promise","resolve","setTimeout","Math","random"],"mappings":"AAAA;;;;;;;;;;;;;;CAcC,GAED,2BAA2B,GAC3B,MAAMA,uBAAuB;AAE7B,0DAA0D,GAC1D,MAAMC,kCAAkC,IAAIC,IAAI;IAAC;IAAS;CAAQ;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,MAAMC,iCAAiC;IAAC;IAAe;CAAgB;AAEvE;;;;;;;;;CASC,GACD,OAAO,SAASC,yBAAyBC,KAAc;IACrD,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;QACvC,OAAO;IACT;IAEA,MAAM,EAAEC,IAAI,EAAEC,WAAW,EAAE,GAAGF;IAE9B,IAAIG,MAAMC,OAAO,CAACF,gBAAgBA,YAAYG,QAAQ,CAAC,8BAA8B;QACnF,OAAO;IACT;IAEA,IAAIJ,SAASN,sBAAsB;QACjC,OAAO;IACT;IAEA,IAAI,OAAOM,SAAS,UAAU;QAC5B,OAAO;IACT;IAEA,OACEL,gCAAgCU,GAAG,CAACL,SACpCH,+BAA+BS,IAAI,CAAC,CAACC,SAAWP,KAAKQ,UAAU,CAACD;AAEpE;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCC,GACD,OAAO,eAAeE,qBACpBC,SAA2B,EAC3B,EACEC,WAAW,CAAC,EACZC,cAAc,EAAE,EAChBC,GAAG,EAC4E,GAAG,CAAC,CAAC;IAEtF,IAAIC;IAEJ,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAMC,wBAAwBF,MAAMA,IAAIG,aAAa,KAAKC,YAAY;IAEtE,IAAK,IAAIC,UAAU,GAAGA,UAAUP,UAAUO,UAAW;QACnD,IAAIA,UAAU,KAAKL,OAAO,CAACE,yBAAyBF,IAAIG,aAAa,KAAKC,WAAW;YACnF,OAAOJ,IAAIG,aAAa;QAC1B;QAEA,IAAI;YACF,OAAO,MAAMN;QACf,EAAE,OAAOX,OAAO;YACd,IAAI,CAACD,yBAAyBC,QAAQ;gBACpC,MAAMA;YACR;YAEAe,YAAYf;YAEZ,IAAImB,UAAUP,WAAW,GAAG;gBAC1B,MAAMQ,UAAUP,cAAc,KAAKM;gBACnC,MAAM,IAAIE,QAAQ,CAACC,UAAYC,WAAWD,SAASE,KAAKC,MAAM,KAAKL;YACrE;QACF;IACF;IAEA,MAAML;AACR"}

package/dist/utilities/tenantTimezone.d.ts

@@ -1,4 +1,5 @@
-import type { Payload } from 'payload';
+import type { Payload, PayloadRequest } from 'payload';
+import type { ResolvedReservationPluginConfig } from '../types.js';
 type CollectionLike = {
     fields?: unknown[];
 } | null | undefined;
@@ -33,9 +34,84 @@ export declare function tenantCollectionSlug(collection: CollectionLike, tenantF
 export declare function getEffectiveTenantTimezone(args: {
     globalTimezone: string;
     payload: Payload;
+    req?: PayloadRequest;
     scopedCollection: CollectionLike;
     tenantField: string;
     tenantId: null | string;
     timezoneField: string;
 }): Promise<string>;
+/**
+ * Normalizes a relationship-shaped value down to its id: a raw string/number
+ * id, or an object carrying one — `{ id }`, the shape both a populated
+ * relationship and a client sending `{ "tenant": { "id": "..." } }` produce.
+ * Returns null for anything else (including an object with no usable `id`),
+ * so callers can fail closed on a shape they don't recognize instead of
+ * silently skipping whatever check they were about to run.
+ */
+export declare function normalizeRelationshipId(value: unknown): null | number | string;
+/**
+ * Every tenant id a tenant-field value names, as a list.
+ *
+ * Exists because multi-tenant supports a `hasMany` tenant field, so the value
+ * can legitimately be an ARRAY of relationship-shaped entries.
+ * {@link normalizeRelationshipId} returns null for an array, and the caller
+ * fails closed on null — which turned a supported multi-tenant configuration
+ * into a blanket 403 on every authenticated booking that carried an explicit
+ * tenant (a total booking outage for that install, with no diagnostic).
+ *
+ * - `[]` -> `[]`: an empty array writes no tenant, so there is nothing to
+ *   authorize; the caller permits it, exactly as it does for an absent value.
+ * - a one-or-many array -> one id per entry, all of which the caller must be
+ *   authorized for (any single unrecognized entry poisons the whole value).
+ * - a scalar / `{ id }` -> a single-element list.
+ * - anything else -> null, so the caller can still fail closed, loudly.
+ */
+export declare function normalizeRelationshipIds(value: unknown): Array<number | string> | null;
+/**
+ * Whether an authenticated caller may write the tenant value present in
+ * `data[config.multiTenant.tenantField]` onto a new document in
+ * `config.slugs.reservations`.
+ *
+ * Exists because delegating `overrideAccess` is NOT sufficient on its own:
+ * multi-tenant's tenant-field `validate` only checks presence, and Payload's
+ * `create` operation (`executeAccess`) only checks the TRUTHINESS of a
+ * collection access result — unlike read/update/delete, which apply a
+ * returned `Where` via `combineQueries` against a real document. So MT's own
+ * tenant-scoped `create` access can't reject an explicit foreign tenant
+ * either; an authenticated caller can write one straight through regardless
+ * of `overrideAccess`. This closes that gap the same way
+ * {@link getEffectiveTenantTimezone} closes it for a client-supplied tenant
+ * *cookie*: an access-checked (`overrideAccess: false`) probe read against
+ * the tenants collection for the *submitted* tenant id — a lookup that finds
+ * nothing means the caller isn't a member (or a multi-tenant super-admin).
+ *
+ * PRECONDITION — this is a real membership check only when the caller
+ * authenticates against the SAME collection multi-tenant wraps as its
+ * admin/tenant-owning collection. `withTenantAccess` only applies its
+ * membership constraint when `req.user.collection === adminUsersSlug`;
+ * otherwise it falls back to the tenants collection's own (here: default,
+ * unrestricted) access function, which only requires `Boolean(req.user)`. In
+ * this plugin's STANDALONE mode (`userCollection` unset), a customer
+ * authenticates against `slugs.customers` — a collection multi-tenant never
+ * wraps — so this probe passes for ANY tenant id for a logged-in customer.
+ * `src/plugin.ts`'s boot diagnostic warns about that configuration. It is
+ * also a no-op if the host set multi-tenant's own
+ * `useTenantsCollectionAccess: false`, which is not detectable from here.
+ *
+ * Returns true — nothing to check — when the reservations collection isn't
+ * tenant-scoped at all, or `data` doesn't carry an explicit tenant value (MT's
+ * own access-checked `defaultValue` applies in that case; see
+ * `getEffectiveTenantTimezone`'s doc comment for why that path is already
+ * safe). Returns false — fail closed — for an unrecognized value shape (logged,
+ * since a shape this plugin cannot read refuses every such booking), a probe
+ * that finds no matching tenant, or any error while probing.
+ *
+ * A `hasMany` tenant field is supported: the value may be an array, and EVERY
+ * id in it is probed.
+ */
+export declare function callerMayUseTenant(args: {
+    config: Pick<ResolvedReservationPluginConfig, 'multiTenant' | 'slugs'>;
+    data: Record<string, unknown>;
+    req: PayloadRequest;
+}): Promise<boolean>;
 export {};

package/dist/utilities/tenantTimezone.js

@@ -1,3 +1,4 @@
+import { collectionHasTenantField } from './tenantFilter.js';
 import { isValidTimezone } from './timezoneUtils.js';
 /**
  * Pure precedence resolver for a tenant's effective timezone:
@@ -43,7 +44,7 @@ import { isValidTimezone } from './timezoneUtils.js';
  * selected, when the scoped collection lacks a tenant relationship, or when the
  * lookup fails. Never throws.
  */ export async function getEffectiveTenantTimezone(args) {
-    const { globalTimezone, payload, scopedCollection, tenantField, tenantId, timezoneField } = args;
+    const { globalTimezone, payload, req, scopedCollection, tenantField, tenantId, timezoneField } = args;
     if (!tenantId) {
         return resolveTenantTimezone({
             globalTimezone
@@ -57,11 +58,19 @@ import { isValidTimezone } from './timezoneUtils.js';
     }
     let tenantTimezone = null;
     try {
+        // The tenant id comes from a cookie, so the read must be access-checked —
+        // multi-tenant constrains its tenants collection by `id`, which turns this
+        // into a membership check. Without a req we cannot check, so stay privileged
+        // and let the caller's own gate apply.
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const tenant = await payload.findByID({
             id: tenantId,
             collection: tenantSlug,
-            depth: 0
+            depth: 0,
+            ...req ? {
+                overrideAccess: false,
+                req
+            } : {}
         });
         const raw = tenant?.[timezoneField];
         tenantTimezone = typeof raw === 'string' ? raw : null;
@@ -73,5 +82,157 @@ import { isValidTimezone } from './timezoneUtils.js';
         tenantTimezone
     });
 }
+/**
+ * Normalizes a relationship-shaped value down to its id: a raw string/number
+ * id, or an object carrying one — `{ id }`, the shape both a populated
+ * relationship and a client sending `{ "tenant": { "id": "..." } }` produce.
+ * Returns null for anything else (including an object with no usable `id`),
+ * so callers can fail closed on a shape they don't recognize instead of
+ * silently skipping whatever check they were about to run.
+ */ export function normalizeRelationshipId(value) {
+    if (typeof value === 'string' || typeof value === 'number') {
+        return value;
+    }
+    if (value && typeof value === 'object' && 'id' in value) {
+        const id = value.id;
+        if (typeof id === 'string' || typeof id === 'number') {
+            return id;
+        }
+    }
+    return null;
+}
+/**
+ * Every tenant id a tenant-field value names, as a list.
+ *
+ * Exists because multi-tenant supports a `hasMany` tenant field, so the value
+ * can legitimately be an ARRAY of relationship-shaped entries.
+ * {@link normalizeRelationshipId} returns null for an array, and the caller
+ * fails closed on null — which turned a supported multi-tenant configuration
+ * into a blanket 403 on every authenticated booking that carried an explicit
+ * tenant (a total booking outage for that install, with no diagnostic).
+ *
+ * - `[]` -> `[]`: an empty array writes no tenant, so there is nothing to
+ *   authorize; the caller permits it, exactly as it does for an absent value.
+ * - a one-or-many array -> one id per entry, all of which the caller must be
+ *   authorized for (any single unrecognized entry poisons the whole value).
+ * - a scalar / `{ id }` -> a single-element list.
+ * - anything else -> null, so the caller can still fail closed, loudly.
+ */ export function normalizeRelationshipIds(value) {
+    if (Array.isArray(value)) {
+        const ids = [];
+        for (const entry of value){
+            const id = normalizeRelationshipId(entry);
+            if (id === null) {
+                return null;
+            }
+            ids.push(id);
+        }
+        return ids;
+    }
+    const single = normalizeRelationshipId(value);
+    return single === null ? null : [
+        single
+    ];
+}
+/**
+ * Whether an authenticated caller may write the tenant value present in
+ * `data[config.multiTenant.tenantField]` onto a new document in
+ * `config.slugs.reservations`.
+ *
+ * Exists because delegating `overrideAccess` is NOT sufficient on its own:
+ * multi-tenant's tenant-field `validate` only checks presence, and Payload's
+ * `create` operation (`executeAccess`) only checks the TRUTHINESS of a
+ * collection access result — unlike read/update/delete, which apply a
+ * returned `Where` via `combineQueries` against a real document. So MT's own
+ * tenant-scoped `create` access can't reject an explicit foreign tenant
+ * either; an authenticated caller can write one straight through regardless
+ * of `overrideAccess`. This closes that gap the same way
+ * {@link getEffectiveTenantTimezone} closes it for a client-supplied tenant
+ * *cookie*: an access-checked (`overrideAccess: false`) probe read against
+ * the tenants collection for the *submitted* tenant id — a lookup that finds
+ * nothing means the caller isn't a member (or a multi-tenant super-admin).
+ *
+ * PRECONDITION — this is a real membership check only when the caller
+ * authenticates against the SAME collection multi-tenant wraps as its
+ * admin/tenant-owning collection. `withTenantAccess` only applies its
+ * membership constraint when `req.user.collection === adminUsersSlug`;
+ * otherwise it falls back to the tenants collection's own (here: default,
+ * unrestricted) access function, which only requires `Boolean(req.user)`. In
+ * this plugin's STANDALONE mode (`userCollection` unset), a customer
+ * authenticates against `slugs.customers` — a collection multi-tenant never
+ * wraps — so this probe passes for ANY tenant id for a logged-in customer.
+ * `src/plugin.ts`'s boot diagnostic warns about that configuration. It is
+ * also a no-op if the host set multi-tenant's own
+ * `useTenantsCollectionAccess: false`, which is not detectable from here.
+ *
+ * Returns true — nothing to check — when the reservations collection isn't
+ * tenant-scoped at all, or `data` doesn't carry an explicit tenant value (MT's
+ * own access-checked `defaultValue` applies in that case; see
+ * `getEffectiveTenantTimezone`'s doc comment for why that path is already
+ * safe). Returns false — fail closed — for an unrecognized value shape (logged,
+ * since a shape this plugin cannot read refuses every such booking), a probe
+ * that finds no matching tenant, or any error while probing.
+ *
+ * A `hasMany` tenant field is supported: the value may be an array, and EVERY
+ * id in it is probed.
+ */ export async function callerMayUseTenant(args) {
+    const { config, data, req } = args;
+    const tenantField = config.multiTenant.tenantField;
+    const rawTenant = data[tenantField];
+    if (rawTenant === undefined || rawTenant === null) {
+        return true;
+    }
+    const reservationsCollection = req.payload.config.collections?.find((c)=>c.slug === config.slugs.reservations);
+    if (!collectionHasTenantField(reservationsCollection, tenantField)) {
+        return true;
+    }
+    const tenantSlug = tenantCollectionSlug(reservationsCollection, tenantField);
+    if (!tenantSlug) {
+        return true;
+    }
+    // A `hasMany` tenant field is a supported multi-tenant configuration, so the
+    // value may be an array — every id in it must be authorized.
+    const tenantIds = normalizeRelationshipIds(rawTenant);
+    if (tenantIds === null) {
+        // Still fail closed, but say so: an unrecognized shape refuses the booking,
+        // and silently refusing every booking is indistinguishable from an outage.
+        // The value itself is caller-supplied and is deliberately NOT logged.
+        req.payload.logger.warn({
+            msg: `payload-reserve: refusing a booking because its "${tenantField}" value has an unrecognized shape. Expected an id, a { id } object, or an array of either (a "hasMany" tenant field). If your tenant field uses a shape this plugin does not recognize, every authenticated booking carrying an explicit tenant will be refused with a 403.`,
+            tenantValueShape: Array.isArray(rawTenant) ? 'array' : typeof rawTenant
+        });
+        return false;
+    }
+    for (const tenantId of tenantIds){
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const tenant = await req.payload.findByID({
+                id: tenantId,
+                collection: tenantSlug,
+                depth: 0,
+                overrideAccess: false,
+                req
+            });
+            if (!tenant) {
+                return false;
+            }
+        } catch (err) {
+            // Forbidden/NotFound is exactly the "not a member" outcome this probe
+            // exists to detect — expected, not worth logging. Anything else (a DB
+            // outage, a genuine bug) still fails closed but is worth surfacing.
+            const status = err?.status;
+            if (status !== 403 && status !== 404) {
+                req.payload.logger.warn({
+                    err,
+                    msg: 'payload-reserve: tenant membership probe failed'
+                });
+            }
+            return false;
+        }
+    }
+    // Includes the empty-array case: no tenant is being written, so there is
+    // nothing to authorize.
+    return true;
+}
 
 //# sourceMappingURL=tenantTimezone.js.map

package/dist/utilities/tenantTimezone.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/tenantTimezone.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport { isValidTimezone } from './timezoneUtils.js'\n\ntype CollectionLike = { fields?: unknown[] } | null | undefined\n\ntype FieldLike = { name?: string; relationTo?: string | string[]; type?: string }\n\n/**\n * Pure precedence resolver for a tenant's effective timezone:\n *\n *   selected tenant's zone  →  global default  →  'UTC'\n *\n * An absent or invalid zone at any step is skipped, never thrown — so a tenant\n * with a bad/empty timezone value transparently falls back to the global default.\n */\nexport function resolveTenantTimezone(args: {\n  globalTimezone: string\n  tenantTimezone?: null | string\n}): string {\n  const { globalTimezone, tenantTimezone } = args\n  if (isValidTimezone(tenantTimezone)) {\n    return tenantTimezone\n  }\n  if (isValidTimezone(globalTimezone)) {\n    return globalTimezone\n  }\n  return 'UTC'\n}\n\n/**\n * The tenant collection's slug, read off the scoped collection's tenant\n * relationship field (`relationTo`). Keeps the plugin tenant-agnostic — it never\n * hardcodes a tenants slug. Returns null for an absent, polymorphic, or\n * non-relationship tenant field.\n */\nexport function tenantCollectionSlug(collection: CollectionLike, tenantField: string): null | string {\n  const fields = collection?.fields\n  if (!Array.isArray(fields)) {\n    return null\n  }\n  for (const f of fields) {\n    if (typeof f === 'object' && f !== null && (f as FieldLike).name === tenantField) {\n      const rel = (f as FieldLike).relationTo\n      return typeof rel === 'string' ? rel : null\n    }\n  }\n  return null\n}\n\n/**\n * Resolve the effective timezone for the selected tenant in multiTenant mode.\n *\n * Loads the tenant document (slug derived from the scoped collection's tenant\n * relationship) and reads `timezoneField`, then applies {@link resolveTenantTimezone}\n * precedence. Returns the global default — without a DB read — when no tenant is\n * selected, when the scoped collection lacks a tenant relationship, or when the\n * lookup fails. Never throws.\n */\nexport async function getEffectiveTenantTimezone(args: {\n  globalTimezone: string\n  payload: Payload\n  scopedCollection: CollectionLike\n  tenantField: string\n  tenantId: null | string\n  timezoneField: string\n}): Promise<string> {\n  const { globalTimezone, payload, scopedCollection, tenantField, tenantId, timezoneField } = args\n  if (!tenantId) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  const tenantSlug = tenantCollectionSlug(scopedCollection, tenantField)\n  if (!tenantSlug) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  let tenantTimezone: null | string = null\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const tenant = await (payload.findByID as any)({\n      id: tenantId,\n      collection: tenantSlug,\n      depth: 0,\n    })\n    const raw = (tenant as null | Record<string, unknown>)?.[timezoneField]\n    tenantTimezone = typeof raw === 'string' ? raw : null\n  } catch {\n    tenantTimezone = null\n  }\n  return resolveTenantTimezone({ globalTimezone, tenantTimezone })\n}\n"],"names":["isValidTimezone","resolveTenantTimezone","args","globalTimezone","tenantTimezone","tenantCollectionSlug","collection","tenantField","fields","Array","isArray","f","name","rel","relationTo","getEffectiveTenantTimezone","payload","scopedCollection","tenantId","timezoneField","tenantSlug","tenant","findByID","id","depth","raw"],"mappings":"AAEA,SAASA,eAAe,QAAQ,qBAAoB;AAMpD;;;;;;;CAOC,GACD,OAAO,SAASC,sBAAsBC,IAGrC;IACC,MAAM,EAAEC,cAAc,EAAEC,cAAc,EAAE,GAAGF;IAC3C,IAAIF,gBAAgBI,iBAAiB;QACnC,OAAOA;IACT;IACA,IAAIJ,gBAAgBG,iBAAiB;QACnC,OAAOA;IACT;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASE,qBAAqBC,UAA0B,EAAEC,WAAmB;IAClF,MAAMC,SAASF,YAAYE;IAC3B,IAAI,CAACC,MAAMC,OAAO,CAACF,SAAS;QAC1B,OAAO;IACT;IACA,KAAK,MAAMG,KAAKH,OAAQ;QACtB,IAAI,OAAOG,MAAM,YAAYA,MAAM,QAAQ,AAACA,EAAgBC,IAAI,KAAKL,aAAa;YAChF,MAAMM,MAAM,AAACF,EAAgBG,UAAU;YACvC,OAAO,OAAOD,QAAQ,WAAWA,MAAM;QACzC;IACF;IACA,OAAO;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeE,2BAA2Bb,IAOhD;IACC,MAAM,EAAEC,cAAc,EAAEa,OAAO,EAAEC,gBAAgB,EAAEV,WAAW,EAAEW,QAAQ,EAAEC,aAAa,EAAE,GAAGjB;IAC5F,IAAI,CAACgB,UAAU;QACb,OAAOjB,sBAAsB;YAAEE;QAAe;IAChD;IACA,MAAMiB,aAAaf,qBAAqBY,kBAAkBV;IAC1D,IAAI,CAACa,YAAY;QACf,OAAOnB,sBAAsB;YAAEE;QAAe;IAChD;IACA,IAAIC,iBAAgC;IACpC,IAAI;QACF,8DAA8D;QAC9D,MAAMiB,SAAS,MAAM,AAACL,QAAQM,QAAQ,CAAS;YAC7CC,IAAIL;YACJZ,YAAYc;YACZI,OAAO;QACT;QACA,MAAMC,MAAOJ,QAA2C,CAACF,cAAc;QACvEf,iBAAiB,OAAOqB,QAAQ,WAAWA,MAAM;IACnD,EAAE,OAAM;QACNrB,iBAAiB;IACnB;IACA,OAAOH,sBAAsB;QAAEE;QAAgBC;IAAe;AAChE"}
+{"version":3,"sources":["../../src/utilities/tenantTimezone.ts"],"sourcesContent":["import type { Payload, PayloadRequest } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { collectionHasTenantField } from './tenantFilter.js'\nimport { isValidTimezone } from './timezoneUtils.js'\n\ntype CollectionLike = { fields?: unknown[] } | null | undefined\n\ntype FieldLike = { name?: string; relationTo?: string | string[]; type?: string }\n\n/**\n * Pure precedence resolver for a tenant's effective timezone:\n *\n *   selected tenant's zone  →  global default  →  'UTC'\n *\n * An absent or invalid zone at any step is skipped, never thrown — so a tenant\n * with a bad/empty timezone value transparently falls back to the global default.\n */\nexport function resolveTenantTimezone(args: {\n  globalTimezone: string\n  tenantTimezone?: null | string\n}): string {\n  const { globalTimezone, tenantTimezone } = args\n  if (isValidTimezone(tenantTimezone)) {\n    return tenantTimezone\n  }\n  if (isValidTimezone(globalTimezone)) {\n    return globalTimezone\n  }\n  return 'UTC'\n}\n\n/**\n * The tenant collection's slug, read off the scoped collection's tenant\n * relationship field (`relationTo`). Keeps the plugin tenant-agnostic — it never\n * hardcodes a tenants slug. Returns null for an absent, polymorphic, or\n * non-relationship tenant field.\n */\nexport function tenantCollectionSlug(collection: CollectionLike, tenantField: string): null | string {\n  const fields = collection?.fields\n  if (!Array.isArray(fields)) {\n    return null\n  }\n  for (const f of fields) {\n    if (typeof f === 'object' && f !== null && (f as FieldLike).name === tenantField) {\n      const rel = (f as FieldLike).relationTo\n      return typeof rel === 'string' ? rel : null\n    }\n  }\n  return null\n}\n\n/**\n * Resolve the effective timezone for the selected tenant in multiTenant mode.\n *\n * Loads the tenant document (slug derived from the scoped collection's tenant\n * relationship) and reads `timezoneField`, then applies {@link resolveTenantTimezone}\n * precedence. Returns the global default — without a DB read — when no tenant is\n * selected, when the scoped collection lacks a tenant relationship, or when the\n * lookup fails. Never throws.\n */\nexport async function getEffectiveTenantTimezone(args: {\n  globalTimezone: string\n  payload: Payload\n  req?: PayloadRequest\n  scopedCollection: CollectionLike\n  tenantField: string\n  tenantId: null | string\n  timezoneField: string\n}): Promise<string> {\n  const { globalTimezone, payload, req, scopedCollection, tenantField, tenantId, timezoneField } =\n    args\n  if (!tenantId) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  const tenantSlug = tenantCollectionSlug(scopedCollection, tenantField)\n  if (!tenantSlug) {\n    return resolveTenantTimezone({ globalTimezone })\n  }\n  let tenantTimezone: null | string = null\n  try {\n    // The tenant id comes from a cookie, so the read must be access-checked —\n    // multi-tenant constrains its tenants collection by `id`, which turns this\n    // into a membership check. Without a req we cannot check, so stay privileged\n    // and let the caller's own gate apply.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const tenant = await (payload.findByID as any)({\n      id: tenantId,\n      collection: tenantSlug,\n      depth: 0,\n      ...(req ? { overrideAccess: false, req } : {}),\n    })\n    const raw = (tenant as null | Record<string, unknown>)?.[timezoneField]\n    tenantTimezone = typeof raw === 'string' ? raw : null\n  } catch {\n    tenantTimezone = null\n  }\n  return resolveTenantTimezone({ globalTimezone, tenantTimezone })\n}\n\n/**\n * Normalizes a relationship-shaped value down to its id: a raw string/number\n * id, or an object carrying one — `{ id }`, the shape both a populated\n * relationship and a client sending `{ \"tenant\": { \"id\": \"...\" } }` produce.\n * Returns null for anything else (including an object with no usable `id`),\n * so callers can fail closed on a shape they don't recognize instead of\n * silently skipping whatever check they were about to run.\n */\nexport function normalizeRelationshipId(value: unknown): null | number | string {\n  if (typeof value === 'string' || typeof value === 'number') {\n    return value\n  }\n  if (value && typeof value === 'object' && 'id' in value) {\n    const id = (value as { id?: unknown }).id\n    if (typeof id === 'string' || typeof id === 'number') {\n      return id\n    }\n  }\n  return null\n}\n\n/**\n * Every tenant id a tenant-field value names, as a list.\n *\n * Exists because multi-tenant supports a `hasMany` tenant field, so the value\n * can legitimately be an ARRAY of relationship-shaped entries.\n * {@link normalizeRelationshipId} returns null for an array, and the caller\n * fails closed on null — which turned a supported multi-tenant configuration\n * into a blanket 403 on every authenticated booking that carried an explicit\n * tenant (a total booking outage for that install, with no diagnostic).\n *\n * - `[]` -> `[]`: an empty array writes no tenant, so there is nothing to\n *   authorize; the caller permits it, exactly as it does for an absent value.\n * - a one-or-many array -> one id per entry, all of which the caller must be\n *   authorized for (any single unrecognized entry poisons the whole value).\n * - a scalar / `{ id }` -> a single-element list.\n * - anything else -> null, so the caller can still fail closed, loudly.\n */\nexport function normalizeRelationshipIds(value: unknown): Array<number | string> | null {\n  if (Array.isArray(value)) {\n    const ids: Array<number | string> = []\n    for (const entry of value) {\n      const id = normalizeRelationshipId(entry)\n      if (id === null) {\n        return null\n      }\n      ids.push(id)\n    }\n    return ids\n  }\n  const single = normalizeRelationshipId(value)\n  return single === null ? null : [single]\n}\n\n/**\n * Whether an authenticated caller may write the tenant value present in\n * `data[config.multiTenant.tenantField]` onto a new document in\n * `config.slugs.reservations`.\n *\n * Exists because delegating `overrideAccess` is NOT sufficient on its own:\n * multi-tenant's tenant-field `validate` only checks presence, and Payload's\n * `create` operation (`executeAccess`) only checks the TRUTHINESS of a\n * collection access result — unlike read/update/delete, which apply a\n * returned `Where` via `combineQueries` against a real document. So MT's own\n * tenant-scoped `create` access can't reject an explicit foreign tenant\n * either; an authenticated caller can write one straight through regardless\n * of `overrideAccess`. This closes that gap the same way\n * {@link getEffectiveTenantTimezone} closes it for a client-supplied tenant\n * *cookie*: an access-checked (`overrideAccess: false`) probe read against\n * the tenants collection for the *submitted* tenant id — a lookup that finds\n * nothing means the caller isn't a member (or a multi-tenant super-admin).\n *\n * PRECONDITION — this is a real membership check only when the caller\n * authenticates against the SAME collection multi-tenant wraps as its\n * admin/tenant-owning collection. `withTenantAccess` only applies its\n * membership constraint when `req.user.collection === adminUsersSlug`;\n * otherwise it falls back to the tenants collection's own (here: default,\n * unrestricted) access function, which only requires `Boolean(req.user)`. In\n * this plugin's STANDALONE mode (`userCollection` unset), a customer\n * authenticates against `slugs.customers` — a collection multi-tenant never\n * wraps — so this probe passes for ANY tenant id for a logged-in customer.\n * `src/plugin.ts`'s boot diagnostic warns about that configuration. It is\n * also a no-op if the host set multi-tenant's own\n * `useTenantsCollectionAccess: false`, which is not detectable from here.\n *\n * Returns true — nothing to check — when the reservations collection isn't\n * tenant-scoped at all, or `data` doesn't carry an explicit tenant value (MT's\n * own access-checked `defaultValue` applies in that case; see\n * `getEffectiveTenantTimezone`'s doc comment for why that path is already\n * safe). Returns false — fail closed — for an unrecognized value shape (logged,\n * since a shape this plugin cannot read refuses every such booking), a probe\n * that finds no matching tenant, or any error while probing.\n *\n * A `hasMany` tenant field is supported: the value may be an array, and EVERY\n * id in it is probed.\n */\nexport async function callerMayUseTenant(args: {\n  config: Pick<ResolvedReservationPluginConfig, 'multiTenant' | 'slugs'>\n  data: Record<string, unknown>\n  req: PayloadRequest\n}): Promise<boolean> {\n  const { config, data, req } = args\n  const tenantField = config.multiTenant.tenantField\n  const rawTenant = data[tenantField]\n  if (rawTenant === undefined || rawTenant === null) {\n    return true\n  }\n\n  const reservationsCollection = req.payload.config.collections?.find(\n    (c) => c.slug === config.slugs.reservations,\n  ) as CollectionLike\n  if (!collectionHasTenantField(reservationsCollection, tenantField)) {\n    return true\n  }\n  const tenantSlug = tenantCollectionSlug(reservationsCollection, tenantField)\n  if (!tenantSlug) {\n    return true\n  }\n\n  // A `hasMany` tenant field is a supported multi-tenant configuration, so the\n  // value may be an array — every id in it must be authorized.\n  const tenantIds = normalizeRelationshipIds(rawTenant)\n  if (tenantIds === null) {\n    // Still fail closed, but say so: an unrecognized shape refuses the booking,\n    // and silently refusing every booking is indistinguishable from an outage.\n    // The value itself is caller-supplied and is deliberately NOT logged.\n    req.payload.logger.warn({\n      msg: `payload-reserve: refusing a booking because its \"${tenantField}\" value has an unrecognized shape. Expected an id, a { id } object, or an array of either (a \"hasMany\" tenant field). If your tenant field uses a shape this plugin does not recognize, every authenticated booking carrying an explicit tenant will be refused with a 403.`,\n      tenantValueShape: Array.isArray(rawTenant) ? 'array' : typeof rawTenant,\n    })\n    return false\n  }\n\n  for (const tenantId of tenantIds) {\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const tenant = await (req.payload.findByID as any)({\n        id: tenantId,\n        collection: tenantSlug,\n        depth: 0,\n        overrideAccess: false,\n        req,\n      })\n      if (!tenant) {\n        return false\n      }\n    } catch (err) {\n      // Forbidden/NotFound is exactly the \"not a member\" outcome this probe\n      // exists to detect — expected, not worth logging. Anything else (a DB\n      // outage, a genuine bug) still fails closed but is worth surfacing.\n      const status = (err as { status?: number } | undefined)?.status\n      if (status !== 403 && status !== 404) {\n        req.payload.logger.warn({ err, msg: 'payload-reserve: tenant membership probe failed' })\n      }\n      return false\n    }\n  }\n\n  // Includes the empty-array case: no tenant is being written, so there is\n  // nothing to authorize.\n  return true\n}\n"],"names":["collectionHasTenantField","isValidTimezone","resolveTenantTimezone","args","globalTimezone","tenantTimezone","tenantCollectionSlug","collection","tenantField","fields","Array","isArray","f","name","rel","relationTo","getEffectiveTenantTimezone","payload","req","scopedCollection","tenantId","timezoneField","tenantSlug","tenant","findByID","id","depth","overrideAccess","raw","normalizeRelationshipId","value","normalizeRelationshipIds","ids","entry","push","single","callerMayUseTenant","config","data","multiTenant","rawTenant","undefined","reservationsCollection","collections","find","c","slug","slugs","reservations","tenantIds","logger","warn","msg","tenantValueShape","err","status"],"mappings":"AAIA,SAASA,wBAAwB,QAAQ,oBAAmB;AAC5D,SAASC,eAAe,QAAQ,qBAAoB;AAMpD;;;;;;;CAOC,GACD,OAAO,SAASC,sBAAsBC,IAGrC;IACC,MAAM,EAAEC,cAAc,EAAEC,cAAc,EAAE,GAAGF;IAC3C,IAAIF,gBAAgBI,iBAAiB;QACnC,OAAOA;IACT;IACA,IAAIJ,gBAAgBG,iBAAiB;QACnC,OAAOA;IACT;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASE,qBAAqBC,UAA0B,EAAEC,WAAmB;IAClF,MAAMC,SAASF,YAAYE;IAC3B,IAAI,CAACC,MAAMC,OAAO,CAACF,SAAS;QAC1B,OAAO;IACT;IACA,KAAK,MAAMG,KAAKH,OAAQ;QACtB,IAAI,OAAOG,MAAM,YAAYA,MAAM,QAAQ,AAACA,EAAgBC,IAAI,KAAKL,aAAa;YAChF,MAAMM,MAAM,AAACF,EAAgBG,UAAU;YACvC,OAAO,OAAOD,QAAQ,WAAWA,MAAM;QACzC;IACF;IACA,OAAO;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeE,2BAA2Bb,IAQhD;IACC,MAAM,EAAEC,cAAc,EAAEa,OAAO,EAAEC,GAAG,EAAEC,gBAAgB,EAAEX,WAAW,EAAEY,QAAQ,EAAEC,aAAa,EAAE,GAC5FlB;IACF,IAAI,CAACiB,UAAU;QACb,OAAOlB,sBAAsB;YAAEE;QAAe;IAChD;IACA,MAAMkB,aAAahB,qBAAqBa,kBAAkBX;IAC1D,IAAI,CAACc,YAAY;QACf,OAAOpB,sBAAsB;YAAEE;QAAe;IAChD;IACA,IAAIC,iBAAgC;IACpC,IAAI;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,uCAAuC;QACvC,8DAA8D;QAC9D,MAAMkB,SAAS,MAAM,AAACN,QAAQO,QAAQ,CAAS;YAC7CC,IAAIL;YACJb,YAAYe;YACZI,OAAO;YACP,GAAIR,MAAM;gBAAES,gBAAgB;gBAAOT;YAAI,IAAI,CAAC,CAAC;QAC/C;QACA,MAAMU,MAAOL,QAA2C,CAACF,cAAc;QACvEhB,iBAAiB,OAAOuB,QAAQ,WAAWA,MAAM;IACnD,EAAE,OAAM;QACNvB,iBAAiB;IACnB;IACA,OAAOH,sBAAsB;QAAEE;QAAgBC;IAAe;AAChE;AAEA;;;;;;;CAOC,GACD,OAAO,SAASwB,wBAAwBC,KAAc;IACpD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,UAAU;QAC1D,OAAOA;IACT;IACA,IAAIA,SAAS,OAAOA,UAAU,YAAY,QAAQA,OAAO;QACvD,MAAML,KAAK,AAACK,MAA2BL,EAAE;QACzC,IAAI,OAAOA,OAAO,YAAY,OAAOA,OAAO,UAAU;YACpD,OAAOA;QACT;IACF;IACA,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASM,yBAAyBD,KAAc;IACrD,IAAIpB,MAAMC,OAAO,CAACmB,QAAQ;QACxB,MAAME,MAA8B,EAAE;QACtC,KAAK,MAAMC,SAASH,MAAO;YACzB,MAAML,KAAKI,wBAAwBI;YACnC,IAAIR,OAAO,MAAM;gBACf,OAAO;YACT;YACAO,IAAIE,IAAI,CAACT;QACX;QACA,OAAOO;IACT;IACA,MAAMG,SAASN,wBAAwBC;IACvC,OAAOK,WAAW,OAAO,OAAO;QAACA;KAAO;AAC1C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,eAAeC,mBAAmBjC,IAIxC;IACC,MAAM,EAAEkC,MAAM,EAAEC,IAAI,EAAEpB,GAAG,EAAE,GAAGf;IAC9B,MAAMK,cAAc6B,OAAOE,WAAW,CAAC/B,WAAW;IAClD,MAAMgC,YAAYF,IAAI,CAAC9B,YAAY;IACnC,IAAIgC,cAAcC,aAAaD,cAAc,MAAM;QACjD,OAAO;IACT;IAEA,MAAME,yBAAyBxB,IAAID,OAAO,CAACoB,MAAM,CAACM,WAAW,EAAEC,KAC7D,CAACC,IAAMA,EAAEC,IAAI,KAAKT,OAAOU,KAAK,CAACC,YAAY;IAE7C,IAAI,CAAChD,yBAAyB0C,wBAAwBlC,cAAc;QAClE,OAAO;IACT;IACA,MAAMc,aAAahB,qBAAqBoC,wBAAwBlC;IAChE,IAAI,CAACc,YAAY;QACf,OAAO;IACT;IAEA,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM2B,YAAYlB,yBAAyBS;IAC3C,IAAIS,cAAc,MAAM;QACtB,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE/B,IAAID,OAAO,CAACiC,MAAM,CAACC,IAAI,CAAC;YACtBC,KAAK,CAAC,iDAAiD,EAAE5C,YAAY,2QAA2Q,CAAC;YACjV6C,kBAAkB3C,MAAMC,OAAO,CAAC6B,aAAa,UAAU,OAAOA;QAChE;QACA,OAAO;IACT;IAEA,KAAK,MAAMpB,YAAY6B,UAAW;QAChC,IAAI;YACF,8DAA8D;YAC9D,MAAM1B,SAAS,MAAM,AAACL,IAAID,OAAO,CAACO,QAAQ,CAAS;gBACjDC,IAAIL;gBACJb,YAAYe;gBACZI,OAAO;gBACPC,gBAAgB;gBAChBT;YACF;YACA,IAAI,CAACK,QAAQ;gBACX,OAAO;YACT;QACF,EAAE,OAAO+B,KAAK;YACZ,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,MAAMC,SAAUD,KAAyCC;YACzD,IAAIA,WAAW,OAAOA,WAAW,KAAK;gBACpCrC,IAAID,OAAO,CAACiC,MAAM,CAACC,IAAI,CAAC;oBAAEG;oBAAKF,KAAK;gBAAkD;YACxF;YACA,OAAO;QACT;IACF;IAEA,yEAAyE;IACzE,wBAAwB;IACxB,OAAO;AACT"}

package/dist/utilities/transactionSupport.d.ts

@@ -0,0 +1,13 @@
+import type { Payload } from 'payload';
+/**
+ * Whether this database will actually give the plugin a transaction.
+ *
+ * It matters because `acquireBookingLock` is only meaningful inside one. Without
+ * a transaction the lock write still happens but serializes nothing, so
+ * concurrent bookings silently double-book exactly as they did before the lock
+ * existed — a failure that is open rather than closed, and invisible.
+ *
+ * Payload's mongoose adapter returns null from `beginTransaction` when the
+ * connection is not a replica set. Probing costs one no-op transaction at boot.
+ */
+export declare function supportsTransactions(payload: Payload): Promise<boolean>;

package/dist/utilities/transactionSupport.js

@@ -0,0 +1,30 @@
+/**
+ * Whether this database will actually give the plugin a transaction.
+ *
+ * It matters because `acquireBookingLock` is only meaningful inside one. Without
+ * a transaction the lock write still happens but serializes nothing, so
+ * concurrent bookings silently double-book exactly as they did before the lock
+ * existed — a failure that is open rather than closed, and invisible.
+ *
+ * Payload's mongoose adapter returns null from `beginTransaction` when the
+ * connection is not a replica set. Probing costs one no-op transaction at boot.
+ */ export async function supportsTransactions(payload) {
+    const db = payload.db;
+    if (typeof db?.beginTransaction !== 'function') {
+        return false;
+    }
+    try {
+        const id = await db.beginTransaction();
+        if (id === null || id === undefined) {
+            return false;
+        }
+        await db.rollbackTransaction?.(id);
+        return true;
+    } catch  {
+        // An adapter that throws here cannot give us a transaction, which is the
+        // only thing the caller needs to know.
+        return false;
+    }
+}
+
+//# sourceMappingURL=transactionSupport.js.map

package/dist/utilities/transactionSupport.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/transactionSupport.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\n/**\n * Whether this database will actually give the plugin a transaction.\n *\n * It matters because `acquireBookingLock` is only meaningful inside one. Without\n * a transaction the lock write still happens but serializes nothing, so\n * concurrent bookings silently double-book exactly as they did before the lock\n * existed — a failure that is open rather than closed, and invisible.\n *\n * Payload's mongoose adapter returns null from `beginTransaction` when the\n * connection is not a replica set. Probing costs one no-op transaction at boot.\n */\nexport async function supportsTransactions(payload: Payload): Promise<boolean> {\n  const db = payload.db as {\n    beginTransaction?: (options?: unknown) => Promise<null | number | string>\n    rollbackTransaction?: (id: unknown) => Promise<void>\n  }\n\n  if (typeof db?.beginTransaction !== 'function') {\n    return false\n  }\n\n  try {\n    const id = await db.beginTransaction()\n    if (id === null || id === undefined) {\n      return false\n    }\n    await db.rollbackTransaction?.(id)\n    return true\n  } catch {\n    // An adapter that throws here cannot give us a transaction, which is the\n    // only thing the caller needs to know.\n    return false\n  }\n}\n"],"names":["supportsTransactions","payload","db","beginTransaction","id","undefined","rollbackTransaction"],"mappings":"AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeA,qBAAqBC,OAAgB;IACzD,MAAMC,KAAKD,QAAQC,EAAE;IAKrB,IAAI,OAAOA,IAAIC,qBAAqB,YAAY;QAC9C,OAAO;IACT;IAEA,IAAI;QACF,MAAMC,KAAK,MAAMF,GAAGC,gBAAgB;QACpC,IAAIC,OAAO,QAAQA,OAAOC,WAAW;YACnC,OAAO;QACT;QACA,MAAMH,GAAGI,mBAAmB,GAAGF;QAC/B,OAAO;IACT,EAAE,OAAM;QACN,yEAAyE;QACzE,uCAAuC;QACvC,OAAO;IACT;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload-reserve",
-  "version": "2.4.0",
+  "version": "3.0.1",
   "description": "A Payload CMS 3.x plugin for reservation and booking management with conflict detection, status workflows, and calendar UI",
   "keywords": [
     "payload",
@@ -49,15 +49,15 @@
     "@changesets/cli": "^2.30.0",
     "@elghaied/payload-plugin-sms": "^0.3.0",
     "@eslint/eslintrc": "^3.2.0",
-    "@payloadcms/db-mongodb": "3.79.0",
-    "@payloadcms/db-postgres": "3.79.0",
-    "@payloadcms/db-sqlite": "3.79.0",
+    "@payloadcms/db-mongodb": "3.86.0",
+    "@payloadcms/db-postgres": "3.86.0",
+    "@payloadcms/db-sqlite": "3.86.0",
     "@payloadcms/eslint-config": "3.9.0",
-    "@payloadcms/next": "3.79.0",
-    "@payloadcms/plugin-multi-tenant": "3.79.0",
-    "@payloadcms/richtext-lexical": "3.79.0",
-    "@payloadcms/translations": "3.79.0",
-    "@payloadcms/ui": "3.79.0",
+    "@payloadcms/next": "3.86.0",
+    "@payloadcms/plugin-multi-tenant": "3.86.0",
+    "@payloadcms/richtext-lexical": "3.86.0",
+    "@payloadcms/translations": "3.86.0",
+    "@payloadcms/ui": "3.86.0",
     "@playwright/test": "1.56.1",
     "@swc-node/register": "1.10.9",
     "@swc/cli": "0.6.0",
@@ -72,7 +72,7 @@
     "mongodb-memory-server": "10.1.4",
     "next": "15.4.11",
     "open": "^10.1.0",
-    "payload": "3.79.0",
+    "payload": "3.86.0",
     "prettier": "^3.4.2",
     "qs-esm": "7.0.2",
     "react": "19.2.1",
@@ -85,9 +85,9 @@
     "vitest": "4.0.18"
   },
   "peerDependencies": {
-    "@payloadcms/translations": "^3.79.0",
-    "@payloadcms/ui": "^3.79.0",
-    "payload": "^3.79.0"
+    "@payloadcms/translations": "^3.86.0",
+    "@payloadcms/ui": "^3.86.0",
+    "payload": "^3.86.0"
   },
   "engines": {
     "node": "^18.20.2 || >=20.9.0",