payload 3.80.0-internal.cee0ccf → 3.80.0

package/dist/auth/endpoints/forgotPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/forgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,qBAAqB,EAAE,cAkCnC,CAAA"}
+{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/forgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,qBAAqB,EAAE,cAgCnC,CAAA"}

package/dist/auth/endpoints/forgotPassword.js

@@ -14,8 +14,6 @@ export const forgotPasswordHandler = async (req)=>{
     await forgotPasswordOperation({
         collection,
         data: authData,
-        disableEmail: Boolean(req.data?.disableEmail),
-        expiration: typeof req.data?.expiration === 'number' ? req.data.expiration : undefined,
         req
     });
     return Response.json({

package/dist/auth/endpoints/forgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/forgotPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { forgotPasswordOperation } from '../operations/forgotPassword.js'\n\nexport const forgotPasswordHandler: PayloadHandler = async (req) => {\n  const { t } = req\n\n  const collection = getRequestCollection(req)\n\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n      }\n\n  await forgotPasswordOperation({\n    collection,\n    data: authData,\n    disableEmail: Boolean(req.data?.disableEmail),\n    expiration: typeof req.data?.expiration === 'number' ? req.data.expiration : undefined,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('general:success'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","forgotPasswordOperation","forgotPasswordHandler","req","t","collection","authData","config","auth","loginWithUsername","email","data","username","disableEmail","Boolean","expiration","undefined","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,uBAAuB,QAAQ,kCAAiC;AAEzE,OAAO,MAAMC,wBAAwC,OAAOC;IAC1D,MAAM,EAAEC,CAAC,EAAE,GAAGD;IAEd,MAAME,aAAaN,qBAAqBI;IAExC,MAAMG,WAAWD,WAAWE,MAAM,CAACC,IAAI,EAAEC,oBACrC;QACEC,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOT,IAAIQ,IAAI,EAAEC,aAAa,WAAWT,IAAIQ,IAAI,CAACC,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;IAChE;IAEJ,MAAMT,wBAAwB;QAC5BI;QACAM,MAAML;QACNO,cAAcC,QAAQX,IAAIQ,IAAI,EAAEE;QAChCE,YAAY,OAAOZ,IAAIQ,IAAI,EAAEI,eAAe,WAAWZ,IAAIQ,IAAI,CAACI,UAAU,GAAGC;QAC7Eb;IACF;IAEA,OAAOc,SAASC,IAAI,CAClB;QACEC,SAASf,EAAE;IACb,GACA;QACEgB,SAASpB,gBAAgB;YACvBoB,SAAS,IAAIC;YACblB;QACF;QACAN,QAAQC,WAAWwB,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/forgotPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { forgotPasswordOperation } from '../operations/forgotPassword.js'\n\nexport const forgotPasswordHandler: PayloadHandler = async (req) => {\n  const { t } = req\n\n  const collection = getRequestCollection(req)\n\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n      }\n\n  await forgotPasswordOperation({\n    collection,\n    data: authData,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('general:success'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","forgotPasswordOperation","forgotPasswordHandler","req","t","collection","authData","config","auth","loginWithUsername","email","data","username","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,uBAAuB,QAAQ,kCAAiC;AAEzE,OAAO,MAAMC,wBAAwC,OAAOC;IAC1D,MAAM,EAAEC,CAAC,EAAE,GAAGD;IAEd,MAAME,aAAaN,qBAAqBI;IAExC,MAAMG,WAAWD,WAAWE,MAAM,CAACC,IAAI,EAAEC,oBACrC;QACEC,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOT,IAAIQ,IAAI,EAAEC,aAAa,WAAWT,IAAIQ,IAAI,CAACC,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;IAChE;IAEJ,MAAMT,wBAAwB;QAC5BI;QACAM,MAAML;QACNH;IACF;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASX,EAAE;IACb,GACA;QACEY,SAAShB,gBAAgB;YACvBgB,SAAS,IAAIC;YACbd;QACF;QACAN,QAAQC,WAAWoB,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/extractJWT.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractJWT.d.ts","sourceRoot":"","sources":["../../src/auth/extractJWT.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AA6C1D,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,wBAAwB,EAAE,cAAc,CAAC,KAAG,IAAI,GAAG,MAcxF,CAAA"}
+{"version":3,"file":"extractJWT.d.ts","sourceRoot":"","sources":["../../src/auth/extractJWT.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AA+D1D,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,wBAAwB,EAAE,cAAc,CAAC,KAAG,IAAI,GAAG,MAcxF,CAAA"}

package/dist/auth/extractJWT.js

@@ -2,24 +2,38 @@ import { parseCookies } from '../utilities/parseCookies.js';
 const extractionMethods = {
     Bearer: ({ headers })=>{
         const jwtFromHeader = headers.get('Authorization');
-        // allow RFC6750 OAuth 2.0 compliant Bearer tokens
-        // in addition to the payload default JWT format
+        // RFC6750 OAuth 2.0 Bearer token
         if (jwtFromHeader?.startsWith('Bearer ')) {
             return jwtFromHeader.replace('Bearer ', '');
         }
         return null;
     },
     cookie: ({ headers, payload })=>{
-        const origin = headers.get('Origin');
         const cookies = parseCookies(headers);
         const tokenCookieName = `${payload.config.cookiePrefix}-token`;
         const cookieToken = cookies.get(tokenCookieName);
         if (!cookieToken) {
             return null;
         }
-        if (!origin || payload.config.csrf.length === 0 || payload.config.csrf.indexOf(origin) > -1) {
+        const origin = headers.get('Origin');
+        // Origin present — validate against csrf allowlist
+        if (origin) {
+            if (payload.config.csrf.length === 0 || payload.config.csrf.includes(origin)) {
+                return cookieToken;
+            }
+            return null;
+        }
+        // No Origin and no csrf configured — no allowlist to enforce
+        if (payload.config.csrf.length === 0) {
+            return cookieToken;
+        }
+        // No Origin with csrf configured — fall back to Sec-Fetch-Site
+        const secFetchSite = headers.get('Sec-Fetch-Site');
+        // Allow same-origin, same-site, and direct navigations (none)
+        if (secFetchSite === 'same-origin' || secFetchSite === 'same-site' || secFetchSite === 'none') {
             return cookieToken;
         }
+        // Reject cross-site requests and missing header (non-browser clients)
         return null;
     },
     JWT: ({ headers })=>{

package/dist/auth/extractJWT.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/extractJWT.ts"],"sourcesContent":["import type { BasePayload } from '../index.js'\nimport type { AuthStrategyFunctionArgs } from './index.js'\n\nimport { parseCookies } from '../utilities/parseCookies.js'\n\ntype ExtractionMethod = (args: { headers: Headers; payload: BasePayload }) => null | string\n\nconst extractionMethods: Record<string, ExtractionMethod> = {\n  Bearer: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    // allow RFC6750 OAuth 2.0 compliant Bearer tokens\n    // in addition to the payload default JWT format\n    if (jwtFromHeader?.startsWith('Bearer ')) {\n      return jwtFromHeader.replace('Bearer ', '')\n    }\n\n    return null\n  },\n  cookie: ({ headers, payload }) => {\n    const origin = headers.get('Origin')\n    const cookies = parseCookies(headers)\n    const tokenCookieName = `${payload.config.cookiePrefix}-token`\n    const cookieToken = cookies.get(tokenCookieName)\n\n    if (!cookieToken) {\n      return null\n    }\n\n    if (!origin || payload.config.csrf.length === 0 || payload.config.csrf.indexOf(origin) > -1) {\n      return cookieToken\n    }\n\n    return null\n  },\n  JWT: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    if (jwtFromHeader?.startsWith('JWT ')) {\n      return jwtFromHeader.replace('JWT ', '')\n    }\n\n    return null\n  },\n}\n\nexport const extractJWT = (args: Omit<AuthStrategyFunctionArgs, 'strategyName'>): null | string => {\n  const { headers, payload } = args\n\n  const extractionOrder = payload.config.auth.jwtOrder\n\n  for (const extractionStrategy of extractionOrder) {\n    const result = extractionMethods[extractionStrategy]!({ headers, payload })\n\n    if (result) {\n      return result\n    }\n  }\n\n  return null\n}\n"],"names":["parseCookies","extractionMethods","Bearer","headers","jwtFromHeader","get","startsWith","replace","cookie","payload","origin","cookies","tokenCookieName","config","cookiePrefix","cookieToken","csrf","length","indexOf","JWT","extractJWT","args","extractionOrder","auth","jwtOrder","extractionStrategy","result"],"mappings":"AAGA,SAASA,YAAY,QAAQ,+BAA8B;AAI3D,MAAMC,oBAAsD;IAC1DC,QAAQ,CAAC,EAAEC,OAAO,EAAE;QAClB,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,kDAAkD;QAClD,gDAAgD;QAChD,IAAID,eAAeE,WAAW,YAAY;YACxC,OAAOF,cAAcG,OAAO,CAAC,WAAW;QAC1C;QAEA,OAAO;IACT;IACAC,QAAQ,CAAC,EAAEL,OAAO,EAAEM,OAAO,EAAE;QAC3B,MAAMC,SAASP,QAAQE,GAAG,CAAC;QAC3B,MAAMM,UAAUX,aAAaG;QAC7B,MAAMS,kBAAkB,GAAGH,QAAQI,MAAM,CAACC,YAAY,CAAC,MAAM,CAAC;QAC9D,MAAMC,cAAcJ,QAAQN,GAAG,CAACO;QAEhC,IAAI,CAACG,aAAa;YAChB,OAAO;QACT;QAEA,IAAI,CAACL,UAAUD,QAAQI,MAAM,CAACG,IAAI,CAACC,MAAM,KAAK,KAAKR,QAAQI,MAAM,CAACG,IAAI,CAACE,OAAO,CAACR,UAAU,CAAC,GAAG;YAC3F,OAAOK;QACT;QAEA,OAAO;IACT;IACAI,KAAK,CAAC,EAAEhB,OAAO,EAAE;QACf,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,IAAID,eAAeE,WAAW,SAAS;YACrC,OAAOF,cAAcG,OAAO,CAAC,QAAQ;QACvC;QAEA,OAAO;IACT;AACF;AAEA,OAAO,MAAMa,aAAa,CAACC;IACzB,MAAM,EAAElB,OAAO,EAAEM,OAAO,EAAE,GAAGY;IAE7B,MAAMC,kBAAkBb,QAAQI,MAAM,CAACU,IAAI,CAACC,QAAQ;IAEpD,KAAK,MAAMC,sBAAsBH,gBAAiB;QAChD,MAAMI,SAASzB,iBAAiB,CAACwB,mBAAmB,CAAE;YAAEtB;YAASM;QAAQ;QAEzE,IAAIiB,QAAQ;YACV,OAAOA;QACT;IACF;IAEA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/extractJWT.ts"],"sourcesContent":["import type { BasePayload } from '../index.js'\nimport type { AuthStrategyFunctionArgs } from './index.js'\n\nimport { parseCookies } from '../utilities/parseCookies.js'\n\ntype ExtractionMethod = (args: { headers: Headers; payload: BasePayload }) => null | string\n\nconst extractionMethods: Record<string, ExtractionMethod> = {\n  Bearer: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    // RFC6750 OAuth 2.0 Bearer token\n    if (jwtFromHeader?.startsWith('Bearer ')) {\n      return jwtFromHeader.replace('Bearer ', '')\n    }\n\n    return null\n  },\n  cookie: ({ headers, payload }) => {\n    const cookies = parseCookies(headers)\n    const tokenCookieName = `${payload.config.cookiePrefix}-token`\n    const cookieToken = cookies.get(tokenCookieName)\n\n    if (!cookieToken) {\n      return null\n    }\n\n    const origin = headers.get('Origin')\n\n    // Origin present — validate against csrf allowlist\n    if (origin) {\n      if (payload.config.csrf.length === 0 || payload.config.csrf.includes(origin)) {\n        return cookieToken\n      }\n      return null\n    }\n\n    // No Origin and no csrf configured — no allowlist to enforce\n    if (payload.config.csrf.length === 0) {\n      return cookieToken\n    }\n\n    // No Origin with csrf configured — fall back to Sec-Fetch-Site\n    const secFetchSite = headers.get('Sec-Fetch-Site')\n\n    // Allow same-origin, same-site, and direct navigations (none)\n    if (secFetchSite === 'same-origin' || secFetchSite === 'same-site' || secFetchSite === 'none') {\n      return cookieToken\n    }\n\n    // Reject cross-site requests and missing header (non-browser clients)\n    return null\n  },\n  JWT: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    if (jwtFromHeader?.startsWith('JWT ')) {\n      return jwtFromHeader.replace('JWT ', '')\n    }\n\n    return null\n  },\n}\n\nexport const extractJWT = (args: Omit<AuthStrategyFunctionArgs, 'strategyName'>): null | string => {\n  const { headers, payload } = args\n\n  const extractionOrder = payload.config.auth.jwtOrder\n\n  for (const extractionStrategy of extractionOrder) {\n    const result = extractionMethods[extractionStrategy]!({ headers, payload })\n\n    if (result) {\n      return result\n    }\n  }\n\n  return null\n}\n"],"names":["parseCookies","extractionMethods","Bearer","headers","jwtFromHeader","get","startsWith","replace","cookie","payload","cookies","tokenCookieName","config","cookiePrefix","cookieToken","origin","csrf","length","includes","secFetchSite","JWT","extractJWT","args","extractionOrder","auth","jwtOrder","extractionStrategy","result"],"mappings":"AAGA,SAASA,YAAY,QAAQ,+BAA8B;AAI3D,MAAMC,oBAAsD;IAC1DC,QAAQ,CAAC,EAAEC,OAAO,EAAE;QAClB,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,iCAAiC;QACjC,IAAID,eAAeE,WAAW,YAAY;YACxC,OAAOF,cAAcG,OAAO,CAAC,WAAW;QAC1C;QAEA,OAAO;IACT;IACAC,QAAQ,CAAC,EAAEL,OAAO,EAAEM,OAAO,EAAE;QAC3B,MAAMC,UAAUV,aAAaG;QAC7B,MAAMQ,kBAAkB,GAAGF,QAAQG,MAAM,CAACC,YAAY,CAAC,MAAM,CAAC;QAC9D,MAAMC,cAAcJ,QAAQL,GAAG,CAACM;QAEhC,IAAI,CAACG,aAAa;YAChB,OAAO;QACT;QAEA,MAAMC,SAASZ,QAAQE,GAAG,CAAC;QAE3B,mDAAmD;QACnD,IAAIU,QAAQ;YACV,IAAIN,QAAQG,MAAM,CAACI,IAAI,CAACC,MAAM,KAAK,KAAKR,QAAQG,MAAM,CAACI,IAAI,CAACE,QAAQ,CAACH,SAAS;gBAC5E,OAAOD;YACT;YACA,OAAO;QACT;QAEA,6DAA6D;QAC7D,IAAIL,QAAQG,MAAM,CAACI,IAAI,CAACC,MAAM,KAAK,GAAG;YACpC,OAAOH;QACT;QAEA,+DAA+D;QAC/D,MAAMK,eAAehB,QAAQE,GAAG,CAAC;QAEjC,8DAA8D;QAC9D,IAAIc,iBAAiB,iBAAiBA,iBAAiB,eAAeA,iBAAiB,QAAQ;YAC7F,OAAOL;QACT;QAEA,sEAAsE;QACtE,OAAO;IACT;IACAM,KAAK,CAAC,EAAEjB,OAAO,EAAE;QACf,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,IAAID,eAAeE,WAAW,SAAS;YACrC,OAAOF,cAAcG,OAAO,CAAC,QAAQ;QACvC;QAEA,OAAO;IACT;AACF;AAEA,OAAO,MAAMc,aAAa,CAACC;IACzB,MAAM,EAAEnB,OAAO,EAAEM,OAAO,EAAE,GAAGa;IAE7B,MAAMC,kBAAkBd,QAAQG,MAAM,CAACY,IAAI,CAACC,QAAQ;IAEpD,KAAK,MAAMC,sBAAsBH,gBAAiB;QAChD,MAAMI,SAAS1B,iBAAiB,CAACyB,mBAAmB,CAAE;YAAEvB;YAASM;QAAQ;QAEzE,IAAIkB,QAAQ;YACV,OAAOA;QACT;IACF;IAEA,OAAO;AACT,EAAC"}

package/dist/auth/operations/forgotPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/forgotPassword.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAajE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,eAAO,MAAM,uBAAuB,GAAU,KAAK,SAAS,kBAAkB,gBAC9D,SAAS,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,IAAI,GAAG,MAAM,CA+LvB,CAAA"}
+{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/forgotPassword.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,eAAO,MAAM,uBAAuB,GAAU,KAAK,SAAS,kBAAkB,gBAC9D,SAAS,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,IAAI,GAAG,MAAM,CA2LvB,CAAA"}

package/dist/auth/operations/forgotPassword.js

@@ -1,6 +1,5 @@
 import crypto from 'crypto';
 import { status as httpStatus } from 'http-status';
-import { URL } from 'url';
 import { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js';
 import { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js';
 import { APIError } from '../../errors/index.js';
@@ -8,6 +7,7 @@ import { Forbidden } from '../../index.js';
 import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js';
 import { commitTransaction } from '../../utilities/commitTransaction.js';
 import { formatAdminURL } from '../../utilities/formatAdminURL.js';
+import { getRequestOrigin } from '../../utilities/getRequestOrigin.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 import { getLoginOptions } from '../getLoginOptions.js';
@@ -86,9 +86,10 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
             req
         });
         if (!disableEmail && user.email) {
-            const protocol = new URL(req.url).protocol // includes the final :
-            ;
-            const serverURL = config.serverURL !== null && config.serverURL !== '' ? config.serverURL : `${protocol}//${req.headers.get('host')}`;
+            const serverURL = getRequestOrigin({
+                config,
+                req
+            });
             const forgotURL = formatAdminURL({
                 adminRoute: config.routes.admin,
                 path: `${config.admin.routes.reset}/${token}`,

package/dist/auth/operations/forgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/forgotPassword.ts"],"sourcesContent":["import crypto from 'crypto'\nimport { status as httpStatus } from 'http-status'\nimport { URL } from 'url'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { formatAdminURL } from '../../utilities/formatAdminURL.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: {\n    [key: string]: unknown\n  } & AuthOperationsFromCollectionSlug<TSlug>['forgotPassword']\n  disableEmail?: boolean\n  expiration?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport type Result = string\n\nexport const forgotPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<null | string> => {\n  const loginWithUsername = incomingArgs.collection.config.auth.loginWithUsername\n  const { data, overrideAccess } = incomingArgs\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail =\n    (canLoginWithEmail && (incomingArgs.data.email || '').toLowerCase().trim()) || null\n  const sanitizedUsername =\n    'username' in data && typeof data?.username === 'string'\n      ? data.username.toLowerCase().trim()\n      : null\n\n  let args = incomingArgs\n\n  if (incomingArgs.collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(incomingArgs.req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n    })\n\n    const {\n      collection: { config: collectionConfig },\n      disableEmail,\n      expiration,\n      req: {\n        payload: { config, email },\n        payload,\n      },\n      req,\n    } = args\n\n    // /////////////////////////////////////\n    // Forget password\n    // /////////////////////////////////////\n\n    let token: string = crypto.randomBytes(20).toString('hex')\n    type UserDoc = {\n      email?: string\n      id: number | string\n      resetPasswordExpiration?: string\n      resetPasswordToken?: string\n    }\n\n    if (!sanitizedEmail && !sanitizedUsername) {\n      throw new APIError(\n        `Missing ${loginWithUsername ? 'username' : 'email'}.`,\n        httpStatus.BAD_REQUEST,\n      )\n    }\n\n    let whereConstraint: Where = {}\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = {\n        email: {\n          equals: sanitizedEmail,\n        },\n      }\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = {\n        username: {\n          equals: sanitizedUsername,\n        },\n      }\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: collectionConfig.trash,\n      trash: false,\n      where: whereConstraint,\n    })\n\n    let user = await payload.db.findOne<UserDoc>({\n      collection: collectionConfig.slug,\n      req,\n      where: whereConstraint,\n    })\n\n    // We don't want to indicate specifically that an email was not found,\n    // as doing so could lead to the exposure of registered emails.\n    // Therefore, we prefer to fail silently.\n    if (!user) {\n      await commitTransaction(args.req)\n      return null\n    }\n\n    const resetPasswordExpiration = new Date(\n      Date.now() + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000),\n    ).toISOString()\n\n    user = await payload.update({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        resetPasswordExpiration,\n        resetPasswordToken: token,\n      },\n      req,\n    })\n\n    if (!disableEmail && user.email) {\n      const protocol = new URL(req.url!).protocol // includes the final :\n      const serverURL =\n        config.serverURL !== null && config.serverURL !== ''\n          ? config.serverURL\n          : `${protocol}//${req.headers.get('host')}`\n      const forgotURL = formatAdminURL({\n        adminRoute: config.routes.admin,\n        path: `${config.admin.routes.reset}/${token}`,\n        serverURL,\n      })\n      let html = `${req.t('authentication:youAreReceivingResetPassword')}\n    <a href=\"${forgotURL}\">${forgotURL}</a>\n    ${req.t('authentication:youDidNotRequestPassword')}`\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailHTML === 'function') {\n        html = await collectionConfig.auth.forgotPassword.generateEmailHTML({\n          req,\n          token,\n          user,\n        })\n      }\n\n      let subject = req.t('authentication:resetYourPassword')\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailSubject === 'function') {\n        subject = await collectionConfig.auth.forgotPassword.generateEmailSubject({\n          req,\n          token,\n          user,\n        })\n      }\n\n      await email.sendEmail({\n        from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n        html,\n        subject,\n        to: user.email,\n      })\n    }\n\n    // /////////////////////////////////////\n    // afterForgotPassword - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterForgotPassword?.length) {\n      for (const hook of collectionConfig.hooks.afterForgotPassword) {\n        await hook({ args, collection: args.collection?.config, context: req.context })\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    token = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n      result: token,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return token\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["crypto","status","httpStatus","URL","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","formatAdminURL","initTransaction","killTransaction","getLoginOptions","forgotPasswordOperation","incomingArgs","loginWithUsername","collection","config","auth","data","overrideAccess","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","email","toLowerCase","trim","sanitizedUsername","username","args","disableLocalStrategy","req","t","BAD_REQUEST","shouldCommit","operation","collectionConfig","disableEmail","expiration","payload","token","randomBytes","toString","whereConstraint","equals","enableTrash","trash","where","user","db","findOne","slug","resetPasswordExpiration","Date","now","forgotPassword","toISOString","update","id","resetPasswordToken","protocol","url","serverURL","headers","get","forgotURL","adminRoute","routes","admin","path","reset","html","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to","hooks","afterForgotPassword","length","hook","context","result","error"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAClD,SAASC,GAAG,QAAQ,MAAK;AASzB,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,SAAS,QAAQ,iBAAgB;AAC1C,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AAevD,OAAO,MAAMC,0BAA0B,OACrCC;IAEA,MAAMC,oBAAoBD,aAAaE,UAAU,CAACC,MAAM,CAACC,IAAI,CAACH,iBAAiB;IAC/E,MAAM,EAAEI,IAAI,EAAEC,cAAc,EAAE,GAAGN;IAEjC,MAAM,EAAEO,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGV,gBAAgBG;IAEpE,MAAMQ,iBACJ,AAACF,qBAAqB,AAACP,CAAAA,aAAaK,IAAI,CAACK,KAAK,IAAI,EAAC,EAAGC,WAAW,GAAGC,IAAI,MAAO;IACjF,MAAMC,oBACJ,cAAcR,QAAQ,OAAOA,MAAMS,aAAa,WAC5CT,KAAKS,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IAEN,IAAIG,OAAOf;IAEX,IAAIA,aAAaE,UAAU,CAACC,MAAM,CAACC,IAAI,CAACY,oBAAoB,EAAE;QAC5D,MAAM,IAAIxB,UAAUQ,aAAaiB,GAAG,CAACC,CAAC;IACxC;IACA,IAAI,CAACT,kBAAkB,CAACI,mBAAmB;QACzC,MAAM,IAAItB,SACR,CAAC,QAAQ,EAAEU,oBAAoB,aAAa,QAAQ,CAAC,CAAC,EACtDd,WAAWgC,WAAW;IAE1B;IAEA,IAAI;QACF,MAAMC,eAAe,MAAMxB,gBAAgBmB,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QACxCF,OAAO,MAAMzB,qBAAqB;YAChCyB;YACAb,YAAYa,KAAKb,UAAU,CAACC,MAAM;YAClCkB,WAAW;YACXf;QACF;QAEA,MAAM,EACJJ,YAAY,EAAEC,QAAQmB,gBAAgB,EAAE,EACxCC,YAAY,EACZC,UAAU,EACVP,KAAK,EACHQ,SAAS,EAAEtB,MAAM,EAAEO,KAAK,EAAE,EAC1Be,OAAO,EACR,EACDR,GAAG,EACJ,GAAGF;QAEJ,wCAAwC;QACxC,kBAAkB;QAClB,wCAAwC;QAExC,IAAIW,QAAgBzC,OAAO0C,WAAW,CAAC,IAAIC,QAAQ,CAAC;QAQpD,IAAI,CAACnB,kBAAkB,CAACI,mBAAmB;YACzC,MAAM,IAAItB,SACR,CAAC,QAAQ,EAAEU,oBAAoB,aAAa,QAAQ,CAAC,CAAC,EACtDd,WAAWgC,WAAW;QAE1B;QAEA,IAAIU,kBAAyB,CAAC;QAE9B,IAAItB,qBAAqBE,gBAAgB;YACvCoB,kBAAkB;gBAChBnB,OAAO;oBACLoB,QAAQrB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBK,mBAAmB;YACpDgB,kBAAkB;gBAChBf,UAAU;oBACRgB,QAAQjB;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CgB,kBAAkBpC,uBAAuB;YACvCsC,aAAaT,iBAAiBU,KAAK;YACnCA,OAAO;YACPC,OAAOJ;QACT;QAEA,IAAIK,OAAO,MAAMT,QAAQU,EAAE,CAACC,OAAO,CAAU;YAC3ClC,YAAYoB,iBAAiBe,IAAI;YACjCpB;YACAgB,OAAOJ;QACT;QAEA,sEAAsE;QACtE,+DAA+D;QAC/D,yCAAyC;QACzC,IAAI,CAACK,MAAM;YACT,MAAMxC,kBAAkBqB,KAAKE,GAAG;YAChC,OAAO;QACT;QAEA,MAAMqB,0BAA0B,IAAIC,KAClCA,KAAKC,GAAG,KAAMlB,CAAAA,iBAAiBlB,IAAI,EAAEqC,gBAAgBjB,cAAcA,cAAc,OAAM,GACvFkB,WAAW;QAEbR,OAAO,MAAMT,QAAQkB,MAAM,CAAC;YAC1BC,IAAIV,KAAKU,EAAE;YACX1C,YAAYoB,iBAAiBe,IAAI;YACjChC,MAAM;gBACJiC;gBACAO,oBAAoBnB;YACtB;YACAT;QACF;QAEA,IAAI,CAACM,gBAAgBW,KAAKxB,KAAK,EAAE;YAC/B,MAAMoC,WAAW,IAAI1D,IAAI6B,IAAI8B,GAAG,EAAGD,QAAQ,CAAC,uBAAuB;;YACnE,MAAME,YACJ7C,OAAO6C,SAAS,KAAK,QAAQ7C,OAAO6C,SAAS,KAAK,KAC9C7C,OAAO6C,SAAS,GAChB,GAAGF,SAAS,EAAE,EAAE7B,IAAIgC,OAAO,CAACC,GAAG,CAAC,SAAS;YAC/C,MAAMC,YAAYxD,eAAe;gBAC/ByD,YAAYjD,OAAOkD,MAAM,CAACC,KAAK;gBAC/BC,MAAM,GAAGpD,OAAOmD,KAAK,CAACD,MAAM,CAACG,KAAK,CAAC,CAAC,EAAE9B,OAAO;gBAC7CsB;YACF;YACA,IAAIS,OAAO,GAAGxC,IAAIC,CAAC,CAAC,+CAA+C;aAC5D,EAAEiC,UAAU,EAAE,EAAEA,UAAU;IACnC,EAAElC,IAAIC,CAAC,CAAC,4CAA4C;YAElD,IAAI,OAAOI,iBAAiBlB,IAAI,CAACqC,cAAc,EAAEiB,sBAAsB,YAAY;gBACjFD,OAAO,MAAMnC,iBAAiBlB,IAAI,CAACqC,cAAc,CAACiB,iBAAiB,CAAC;oBAClEzC;oBACAS;oBACAQ;gBACF;YACF;YAEA,IAAIyB,UAAU1C,IAAIC,CAAC,CAAC;YAEpB,IAAI,OAAOI,iBAAiBlB,IAAI,CAACqC,cAAc,EAAEmB,yBAAyB,YAAY;gBACpFD,UAAU,MAAMrC,iBAAiBlB,IAAI,CAACqC,cAAc,CAACmB,oBAAoB,CAAC;oBACxE3C;oBACAS;oBACAQ;gBACF;YACF;YAEA,MAAMxB,MAAMmD,SAAS,CAAC;gBACpBC,MAAM,CAAC,CAAC,EAAEpD,MAAMqD,eAAe,CAAC,GAAG,EAAErD,MAAMsD,kBAAkB,CAAC,CAAC,CAAC;gBAChEP;gBACAE;gBACAM,IAAI/B,KAAKxB,KAAK;YAChB;QACF;QAEA,wCAAwC;QACxC,mCAAmC;QACnC,wCAAwC;QAExC,IAAIY,iBAAiB4C,KAAK,EAAEC,qBAAqBC,QAAQ;YACvD,KAAK,MAAMC,QAAQ/C,iBAAiB4C,KAAK,CAACC,mBAAmB,CAAE;gBAC7D,MAAME,KAAK;oBAAEtD;oBAAMb,YAAYa,KAAKb,UAAU,EAAEC;oBAAQmE,SAASrD,IAAIqD,OAAO;gBAAC;YAC/E;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC5C,QAAQ,MAAMrC,oBAAoB;YAChC0B;YACAb,YAAYa,KAAKb,UAAU,EAAEC;YAC7BkB,WAAW;YACXf;YACAiE,QAAQ7C;QACV;QAEA,IAAIN,cAAc;YAChB,MAAM1B,kBAAkBuB;QAC1B;QAEA,OAAOS;IACT,EAAE,OAAO8C,OAAgB;QACvB,MAAM3E,gBAAgBkB,KAAKE,GAAG;QAC9B,MAAMuD;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/forgotPassword.ts"],"sourcesContent":["import crypto from 'crypto'\nimport { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { formatAdminURL } from '../../utilities/formatAdminURL.js'\nimport { getRequestOrigin } from '../../utilities/getRequestOrigin.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: {\n    [key: string]: unknown\n  } & AuthOperationsFromCollectionSlug<TSlug>['forgotPassword']\n  disableEmail?: boolean\n  expiration?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport type Result = string\n\nexport const forgotPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<null | string> => {\n  const loginWithUsername = incomingArgs.collection.config.auth.loginWithUsername\n  const { data, overrideAccess } = incomingArgs\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail =\n    (canLoginWithEmail && (incomingArgs.data.email || '').toLowerCase().trim()) || null\n  const sanitizedUsername =\n    'username' in data && typeof data?.username === 'string'\n      ? data.username.toLowerCase().trim()\n      : null\n\n  let args = incomingArgs\n\n  if (incomingArgs.collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(incomingArgs.req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n    })\n\n    const {\n      collection: { config: collectionConfig },\n      disableEmail,\n      expiration,\n      req: {\n        payload: { config, email },\n        payload,\n      },\n      req,\n    } = args\n\n    // /////////////////////////////////////\n    // Forget password\n    // /////////////////////////////////////\n\n    let token: string = crypto.randomBytes(20).toString('hex')\n    type UserDoc = {\n      email?: string\n      id: number | string\n      resetPasswordExpiration?: string\n      resetPasswordToken?: string\n    }\n\n    if (!sanitizedEmail && !sanitizedUsername) {\n      throw new APIError(\n        `Missing ${loginWithUsername ? 'username' : 'email'}.`,\n        httpStatus.BAD_REQUEST,\n      )\n    }\n\n    let whereConstraint: Where = {}\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = {\n        email: {\n          equals: sanitizedEmail,\n        },\n      }\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = {\n        username: {\n          equals: sanitizedUsername,\n        },\n      }\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: collectionConfig.trash,\n      trash: false,\n      where: whereConstraint,\n    })\n\n    let user = await payload.db.findOne<UserDoc>({\n      collection: collectionConfig.slug,\n      req,\n      where: whereConstraint,\n    })\n\n    // We don't want to indicate specifically that an email was not found,\n    // as doing so could lead to the exposure of registered emails.\n    // Therefore, we prefer to fail silently.\n    if (!user) {\n      await commitTransaction(args.req)\n      return null\n    }\n\n    const resetPasswordExpiration = new Date(\n      Date.now() + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000),\n    ).toISOString()\n\n    user = await payload.update({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        resetPasswordExpiration,\n        resetPasswordToken: token,\n      },\n      req,\n    })\n\n    if (!disableEmail && user.email) {\n      const serverURL = getRequestOrigin({ config, req })\n      const forgotURL = formatAdminURL({\n        adminRoute: config.routes.admin,\n        path: `${config.admin.routes.reset}/${token}`,\n        serverURL,\n      })\n      let html = `${req.t('authentication:youAreReceivingResetPassword')}\n    <a href=\"${forgotURL}\">${forgotURL}</a>\n    ${req.t('authentication:youDidNotRequestPassword')}`\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailHTML === 'function') {\n        html = await collectionConfig.auth.forgotPassword.generateEmailHTML({\n          req,\n          token,\n          user,\n        })\n      }\n\n      let subject = req.t('authentication:resetYourPassword')\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailSubject === 'function') {\n        subject = await collectionConfig.auth.forgotPassword.generateEmailSubject({\n          req,\n          token,\n          user,\n        })\n      }\n\n      await email.sendEmail({\n        from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n        html,\n        subject,\n        to: user.email,\n      })\n    }\n\n    // /////////////////////////////////////\n    // afterForgotPassword - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterForgotPassword?.length) {\n      for (const hook of collectionConfig.hooks.afterForgotPassword) {\n        await hook({ args, collection: args.collection?.config, context: req.context })\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    token = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n      result: token,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return token\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["crypto","status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","formatAdminURL","getRequestOrigin","initTransaction","killTransaction","getLoginOptions","forgotPasswordOperation","incomingArgs","loginWithUsername","collection","config","auth","data","overrideAccess","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","email","toLowerCase","trim","sanitizedUsername","username","args","disableLocalStrategy","req","t","BAD_REQUEST","shouldCommit","operation","collectionConfig","disableEmail","expiration","payload","token","randomBytes","toString","whereConstraint","equals","enableTrash","trash","where","user","db","findOne","slug","resetPasswordExpiration","Date","now","forgotPassword","toISOString","update","id","resetPasswordToken","serverURL","forgotURL","adminRoute","routes","admin","path","reset","html","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to","hooks","afterForgotPassword","length","hook","context","result","error"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,SAAS,QAAQ,iBAAgB;AAC1C,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AAevD,OAAO,MAAMC,0BAA0B,OACrCC;IAEA,MAAMC,oBAAoBD,aAAaE,UAAU,CAACC,MAAM,CAACC,IAAI,CAACH,iBAAiB;IAC/E,MAAM,EAAEI,IAAI,EAAEC,cAAc,EAAE,GAAGN;IAEjC,MAAM,EAAEO,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGV,gBAAgBG;IAEpE,MAAMQ,iBACJ,AAACF,qBAAqB,AAACP,CAAAA,aAAaK,IAAI,CAACK,KAAK,IAAI,EAAC,EAAGC,WAAW,GAAGC,IAAI,MAAO;IACjF,MAAMC,oBACJ,cAAcR,QAAQ,OAAOA,MAAMS,aAAa,WAC5CT,KAAKS,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IAEN,IAAIG,OAAOf;IAEX,IAAIA,aAAaE,UAAU,CAACC,MAAM,CAACC,IAAI,CAACY,oBAAoB,EAAE;QAC5D,MAAM,IAAIzB,UAAUS,aAAaiB,GAAG,CAACC,CAAC;IACxC;IACA,IAAI,CAACT,kBAAkB,CAACI,mBAAmB;QACzC,MAAM,IAAIvB,SACR,CAAC,QAAQ,EAAEW,oBAAoB,aAAa,QAAQ,CAAC,CAAC,EACtDd,WAAWgC,WAAW;IAE1B;IAEA,IAAI;QACF,MAAMC,eAAe,MAAMxB,gBAAgBmB,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QACxCF,OAAO,MAAM1B,qBAAqB;YAChC0B;YACAb,YAAYa,KAAKb,UAAU,CAACC,MAAM;YAClCkB,WAAW;YACXf;QACF;QAEA,MAAM,EACJJ,YAAY,EAAEC,QAAQmB,gBAAgB,EAAE,EACxCC,YAAY,EACZC,UAAU,EACVP,KAAK,EACHQ,SAAS,EAAEtB,MAAM,EAAEO,KAAK,EAAE,EAC1Be,OAAO,EACR,EACDR,GAAG,EACJ,GAAGF;QAEJ,wCAAwC;QACxC,kBAAkB;QAClB,wCAAwC;QAExC,IAAIW,QAAgBzC,OAAO0C,WAAW,CAAC,IAAIC,QAAQ,CAAC;QAQpD,IAAI,CAACnB,kBAAkB,CAACI,mBAAmB;YACzC,MAAM,IAAIvB,SACR,CAAC,QAAQ,EAAEW,oBAAoB,aAAa,QAAQ,CAAC,CAAC,EACtDd,WAAWgC,WAAW;QAE1B;QAEA,IAAIU,kBAAyB,CAAC;QAE9B,IAAItB,qBAAqBE,gBAAgB;YACvCoB,kBAAkB;gBAChBnB,OAAO;oBACLoB,QAAQrB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBK,mBAAmB;YACpDgB,kBAAkB;gBAChBf,UAAU;oBACRgB,QAAQjB;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CgB,kBAAkBrC,uBAAuB;YACvCuC,aAAaT,iBAAiBU,KAAK;YACnCA,OAAO;YACPC,OAAOJ;QACT;QAEA,IAAIK,OAAO,MAAMT,QAAQU,EAAE,CAACC,OAAO,CAAU;YAC3ClC,YAAYoB,iBAAiBe,IAAI;YACjCpB;YACAgB,OAAOJ;QACT;QAEA,sEAAsE;QACtE,+DAA+D;QAC/D,yCAAyC;QACzC,IAAI,CAACK,MAAM;YACT,MAAMzC,kBAAkBsB,KAAKE,GAAG;YAChC,OAAO;QACT;QAEA,MAAMqB,0BAA0B,IAAIC,KAClCA,KAAKC,GAAG,KAAMlB,CAAAA,iBAAiBlB,IAAI,EAAEqC,gBAAgBjB,cAAcA,cAAc,OAAM,GACvFkB,WAAW;QAEbR,OAAO,MAAMT,QAAQkB,MAAM,CAAC;YAC1BC,IAAIV,KAAKU,EAAE;YACX1C,YAAYoB,iBAAiBe,IAAI;YACjChC,MAAM;gBACJiC;gBACAO,oBAAoBnB;YACtB;YACAT;QACF;QAEA,IAAI,CAACM,gBAAgBW,KAAKxB,KAAK,EAAE;YAC/B,MAAMoC,YAAYnD,iBAAiB;gBAAEQ;gBAAQc;YAAI;YACjD,MAAM8B,YAAYrD,eAAe;gBAC/BsD,YAAY7C,OAAO8C,MAAM,CAACC,KAAK;gBAC/BC,MAAM,GAAGhD,OAAO+C,KAAK,CAACD,MAAM,CAACG,KAAK,CAAC,CAAC,EAAE1B,OAAO;gBAC7CoB;YACF;YACA,IAAIO,OAAO,GAAGpC,IAAIC,CAAC,CAAC,+CAA+C;aAC5D,EAAE6B,UAAU,EAAE,EAAEA,UAAU;IACnC,EAAE9B,IAAIC,CAAC,CAAC,4CAA4C;YAElD,IAAI,OAAOI,iBAAiBlB,IAAI,CAACqC,cAAc,EAAEa,sBAAsB,YAAY;gBACjFD,OAAO,MAAM/B,iBAAiBlB,IAAI,CAACqC,cAAc,CAACa,iBAAiB,CAAC;oBAClErC;oBACAS;oBACAQ;gBACF;YACF;YAEA,IAAIqB,UAAUtC,IAAIC,CAAC,CAAC;YAEpB,IAAI,OAAOI,iBAAiBlB,IAAI,CAACqC,cAAc,EAAEe,yBAAyB,YAAY;gBACpFD,UAAU,MAAMjC,iBAAiBlB,IAAI,CAACqC,cAAc,CAACe,oBAAoB,CAAC;oBACxEvC;oBACAS;oBACAQ;gBACF;YACF;YAEA,MAAMxB,MAAM+C,SAAS,CAAC;gBACpBC,MAAM,CAAC,CAAC,EAAEhD,MAAMiD,eAAe,CAAC,GAAG,EAAEjD,MAAMkD,kBAAkB,CAAC,CAAC,CAAC;gBAChEP;gBACAE;gBACAM,IAAI3B,KAAKxB,KAAK;YAChB;QACF;QAEA,wCAAwC;QACxC,mCAAmC;QACnC,wCAAwC;QAExC,IAAIY,iBAAiBwC,KAAK,EAAEC,qBAAqBC,QAAQ;YACvD,KAAK,MAAMC,QAAQ3C,iBAAiBwC,KAAK,CAACC,mBAAmB,CAAE;gBAC7D,MAAME,KAAK;oBAAElD;oBAAMb,YAAYa,KAAKb,UAAU,EAAEC;oBAAQ+D,SAASjD,IAAIiD,OAAO;gBAAC;YAC/E;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCxC,QAAQ,MAAMtC,oBAAoB;YAChC2B;YACAb,YAAYa,KAAKb,UAAU,EAAEC;YAC7BkB,WAAW;YACXf;YACA6D,QAAQzC;QACV;QAEA,IAAIN,cAAc;YAChB,MAAM3B,kBAAkBwB;QAC1B;QAEA,OAAOS;IACT,EAAE,OAAO0C,OAAgB;QACvB,MAAMvE,gBAAgBkB,KAAKE,GAAG;QAC9B,MAAMmD;IACR;AACF,EAAC"}

package/dist/auth/operations/me.js

@@ -5,6 +5,11 @@ export const meOperation = async (args)=>{
         user: null
     };
     if (req.user) {
+        if (req.user.collection !== collection.config.slug) {
+            return {
+                user: null
+            };
+        }
         const { pathname } = req;
         const isGraphQL = pathname === `/api${req.payload.config.routes.graphQL}`;
         const user = await req.payload.findByID({
@@ -23,11 +28,6 @@ export const meOperation = async (args)=>{
             user.collection = collection.config.slug;
             user._strategy = req.user._strategy;
         }
-        if (req.user.collection !== collection.config.slug) {
-            return {
-                user: null
-            };
-        }
         // /////////////////////////////////////
         // me hook - Collection
         // /////////////////////////////////////

package/dist/auth/operations/me.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/me.ts"],"sourcesContent":["import { decodeJwt } from 'jose'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { TypedUser } from '../../index.js'\nimport type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../types/index.js'\nimport type { ClientUser } from '../types.js'\n\nexport type MeOperationResult = {\n  collection?: string\n  exp?: number\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  token?: string\n  user?: ClientUser\n}\n\nexport type Arguments = {\n  collection: Collection\n  currentToken?: string\n  depth?: number\n  draft?: boolean\n  joins?: JoinQuery\n  populate?: PopulateType\n  req: PayloadRequest\n  select?: SelectType\n}\n\nexport const meOperation = async (args: Arguments): Promise<MeOperationResult> => {\n  const { collection, currentToken, depth, draft, joins, populate, req, select } = args\n\n  let result: MeOperationResult = {\n    user: null!,\n  }\n\n  if (req.user) {\n    const { pathname } = req\n    const isGraphQL = pathname === `/api${req.payload.config.routes.graphQL}`\n\n    const user = (await req.payload.findByID({\n      id: req.user.id,\n      collection: collection.config.slug,\n      depth: isGraphQL ? 0 : (depth ?? collection.config.auth.depth),\n      draft,\n      joins,\n      overrideAccess: false,\n      populate,\n      req,\n      select,\n      showHiddenFields: false,\n    })) as TypedUser\n\n    if (user) {\n      user.collection = collection.config.slug\n      user._strategy = req.user._strategy\n    }\n\n    if (req.user.collection !== collection.config.slug) {\n      return {\n        user: null!,\n      }\n    }\n\n    // /////////////////////////////////////\n    // me hook - Collection\n    // /////////////////////////////////////\n\n    for (const meHook of collection.config.hooks.me) {\n      const hookResult = await meHook({ args, user })\n\n      if (hookResult) {\n        result.user = hookResult.user\n        result.exp = hookResult.exp\n\n        break\n      }\n    }\n\n    result.collection = req.user.collection\n    /** @deprecated\n     * use:\n     * ```ts\n     * user._strategy\n     * ```\n     */\n    result.strategy = req.user._strategy\n\n    if (!result.user) {\n      result.user = user\n\n      if (currentToken) {\n        const decoded = decodeJwt(currentToken)\n        if (decoded) {\n          result.exp = decoded.exp\n        }\n        if (!collection.config.auth.removeTokenFromResponses) {\n          result.token = currentToken\n        }\n      }\n    }\n  }\n\n  // /////////////////////////////////////\n  // After Me - Collection\n  // /////////////////////////////////////\n\n  if (collection.config.hooks?.afterMe?.length) {\n    for (const hook of collection.config.hooks.afterMe) {\n      result =\n        (await hook({\n          collection: collection?.config,\n          context: req.context,\n          req,\n          response: result,\n        })) || result\n    }\n  }\n\n  return result\n}\n"],"names":["decodeJwt","meOperation","args","collection","currentToken","depth","draft","joins","populate","req","select","result","user","pathname","isGraphQL","payload","config","routes","graphQL","findByID","id","slug","auth","overrideAccess","showHiddenFields","_strategy","meHook","hooks","me","hookResult","exp","strategy","decoded","removeTokenFromResponses","token","afterMe","length","hook","context","response"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAgChC,OAAO,MAAMC,cAAc,OAAOC;IAChC,MAAM,EAAEC,UAAU,EAAEC,YAAY,EAAEC,KAAK,EAAEC,KAAK,EAAEC,KAAK,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,MAAM,EAAE,GAAGR;IAEjF,IAAIS,SAA4B;QAC9BC,MAAM;IACR;IAEA,IAAIH,IAAIG,IAAI,EAAE;QACZ,MAAM,EAAEC,QAAQ,EAAE,GAAGJ;QACrB,MAAMK,YAAYD,aAAa,CAAC,IAAI,EAAEJ,IAAIM,OAAO,CAACC,MAAM,CAACC,MAAM,CAACC,OAAO,EAAE;QAEzE,MAAMN,OAAQ,MAAMH,IAAIM,OAAO,CAACI,QAAQ,CAAC;YACvCC,IAAIX,IAAIG,IAAI,CAACQ,EAAE;YACfjB,YAAYA,WAAWa,MAAM,CAACK,IAAI;YAClChB,OAAOS,YAAY,IAAKT,SAASF,WAAWa,MAAM,CAACM,IAAI,CAACjB,KAAK;YAC7DC;YACAC;YACAgB,gBAAgB;YAChBf;YACAC;YACAC;YACAc,kBAAkB;QACpB;QAEA,IAAIZ,MAAM;YACRA,KAAKT,UAAU,GAAGA,WAAWa,MAAM,CAACK,IAAI;YACxCT,KAAKa,SAAS,GAAGhB,IAAIG,IAAI,CAACa,SAAS;QACrC;QAEA,IAAIhB,IAAIG,IAAI,CAACT,UAAU,KAAKA,WAAWa,MAAM,CAACK,IAAI,EAAE;YAClD,OAAO;gBACLT,MAAM;YACR;QACF;QAEA,wCAAwC;QACxC,uBAAuB;QACvB,wCAAwC;QAExC,KAAK,MAAMc,UAAUvB,WAAWa,MAAM,CAACW,KAAK,CAACC,EAAE,CAAE;YAC/C,MAAMC,aAAa,MAAMH,OAAO;gBAAExB;gBAAMU;YAAK;YAE7C,IAAIiB,YAAY;gBACdlB,OAAOC,IAAI,GAAGiB,WAAWjB,IAAI;gBAC7BD,OAAOmB,GAAG,GAAGD,WAAWC,GAAG;gBAE3B;YACF;QACF;QAEAnB,OAAOR,UAAU,GAAGM,IAAIG,IAAI,CAACT,UAAU;QACvC;;;;;KAKC,GACDQ,OAAOoB,QAAQ,GAAGtB,IAAIG,IAAI,CAACa,SAAS;QAEpC,IAAI,CAACd,OAAOC,IAAI,EAAE;YAChBD,OAAOC,IAAI,GAAGA;YAEd,IAAIR,cAAc;gBAChB,MAAM4B,UAAUhC,UAAUI;gBAC1B,IAAI4B,SAAS;oBACXrB,OAAOmB,GAAG,GAAGE,QAAQF,GAAG;gBAC1B;gBACA,IAAI,CAAC3B,WAAWa,MAAM,CAACM,IAAI,CAACW,wBAAwB,EAAE;oBACpDtB,OAAOuB,KAAK,GAAG9B;gBACjB;YACF;QACF;IACF;IAEA,wCAAwC;IACxC,wBAAwB;IACxB,wCAAwC;IAExC,IAAID,WAAWa,MAAM,CAACW,KAAK,EAAEQ,SAASC,QAAQ;QAC5C,KAAK,MAAMC,QAAQlC,WAAWa,MAAM,CAACW,KAAK,CAACQ,OAAO,CAAE;YAClDxB,SACE,AAAC,MAAM0B,KAAK;gBACVlC,YAAYA,YAAYa;gBACxBsB,SAAS7B,IAAI6B,OAAO;gBACpB7B;gBACA8B,UAAU5B;YACZ,MAAOA;QACX;IACF;IAEA,OAAOA;AACT,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/me.ts"],"sourcesContent":["import { decodeJwt } from 'jose'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { TypedUser } from '../../index.js'\nimport type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../types/index.js'\nimport type { ClientUser } from '../types.js'\n\nexport type MeOperationResult = {\n  collection?: string\n  exp?: number\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  token?: string\n  user?: ClientUser\n}\n\nexport type Arguments = {\n  collection: Collection\n  currentToken?: string\n  depth?: number\n  draft?: boolean\n  joins?: JoinQuery\n  populate?: PopulateType\n  req: PayloadRequest\n  select?: SelectType\n}\n\nexport const meOperation = async (args: Arguments): Promise<MeOperationResult> => {\n  const { collection, currentToken, depth, draft, joins, populate, req, select } = args\n\n  let result: MeOperationResult = {\n    user: null!,\n  }\n\n  if (req.user) {\n    if (req.user.collection !== collection.config.slug) {\n      return {\n        user: null!,\n      }\n    }\n\n    const { pathname } = req\n    const isGraphQL = pathname === `/api${req.payload.config.routes.graphQL}`\n\n    const user = (await req.payload.findByID({\n      id: req.user.id,\n      collection: collection.config.slug,\n      depth: isGraphQL ? 0 : (depth ?? collection.config.auth.depth),\n      draft,\n      joins,\n      overrideAccess: false,\n      populate,\n      req,\n      select,\n      showHiddenFields: false,\n    })) as TypedUser\n\n    if (user) {\n      user.collection = collection.config.slug\n      user._strategy = req.user._strategy\n    }\n\n    // /////////////////////////////////////\n    // me hook - Collection\n    // /////////////////////////////////////\n\n    for (const meHook of collection.config.hooks.me) {\n      const hookResult = await meHook({ args, user })\n\n      if (hookResult) {\n        result.user = hookResult.user\n        result.exp = hookResult.exp\n\n        break\n      }\n    }\n\n    result.collection = req.user.collection\n    /** @deprecated\n     * use:\n     * ```ts\n     * user._strategy\n     * ```\n     */\n    result.strategy = req.user._strategy\n\n    if (!result.user) {\n      result.user = user\n\n      if (currentToken) {\n        const decoded = decodeJwt(currentToken)\n        if (decoded) {\n          result.exp = decoded.exp\n        }\n        if (!collection.config.auth.removeTokenFromResponses) {\n          result.token = currentToken\n        }\n      }\n    }\n  }\n\n  // /////////////////////////////////////\n  // After Me - Collection\n  // /////////////////////////////////////\n\n  if (collection.config.hooks?.afterMe?.length) {\n    for (const hook of collection.config.hooks.afterMe) {\n      result =\n        (await hook({\n          collection: collection?.config,\n          context: req.context,\n          req,\n          response: result,\n        })) || result\n    }\n  }\n\n  return result\n}\n"],"names":["decodeJwt","meOperation","args","collection","currentToken","depth","draft","joins","populate","req","select","result","user","config","slug","pathname","isGraphQL","payload","routes","graphQL","findByID","id","auth","overrideAccess","showHiddenFields","_strategy","meHook","hooks","me","hookResult","exp","strategy","decoded","removeTokenFromResponses","token","afterMe","length","hook","context","response"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAgChC,OAAO,MAAMC,cAAc,OAAOC;IAChC,MAAM,EAAEC,UAAU,EAAEC,YAAY,EAAEC,KAAK,EAAEC,KAAK,EAAEC,KAAK,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,MAAM,EAAE,GAAGR;IAEjF,IAAIS,SAA4B;QAC9BC,MAAM;IACR;IAEA,IAAIH,IAAIG,IAAI,EAAE;QACZ,IAAIH,IAAIG,IAAI,CAACT,UAAU,KAAKA,WAAWU,MAAM,CAACC,IAAI,EAAE;YAClD,OAAO;gBACLF,MAAM;YACR;QACF;QAEA,MAAM,EAAEG,QAAQ,EAAE,GAAGN;QACrB,MAAMO,YAAYD,aAAa,CAAC,IAAI,EAAEN,IAAIQ,OAAO,CAACJ,MAAM,CAACK,MAAM,CAACC,OAAO,EAAE;QAEzE,MAAMP,OAAQ,MAAMH,IAAIQ,OAAO,CAACG,QAAQ,CAAC;YACvCC,IAAIZ,IAAIG,IAAI,CAACS,EAAE;YACflB,YAAYA,WAAWU,MAAM,CAACC,IAAI;YAClCT,OAAOW,YAAY,IAAKX,SAASF,WAAWU,MAAM,CAACS,IAAI,CAACjB,KAAK;YAC7DC;YACAC;YACAgB,gBAAgB;YAChBf;YACAC;YACAC;YACAc,kBAAkB;QACpB;QAEA,IAAIZ,MAAM;YACRA,KAAKT,UAAU,GAAGA,WAAWU,MAAM,CAACC,IAAI;YACxCF,KAAKa,SAAS,GAAGhB,IAAIG,IAAI,CAACa,SAAS;QACrC;QAEA,wCAAwC;QACxC,uBAAuB;QACvB,wCAAwC;QAExC,KAAK,MAAMC,UAAUvB,WAAWU,MAAM,CAACc,KAAK,CAACC,EAAE,CAAE;YAC/C,MAAMC,aAAa,MAAMH,OAAO;gBAAExB;gBAAMU;YAAK;YAE7C,IAAIiB,YAAY;gBACdlB,OAAOC,IAAI,GAAGiB,WAAWjB,IAAI;gBAC7BD,OAAOmB,GAAG,GAAGD,WAAWC,GAAG;gBAE3B;YACF;QACF;QAEAnB,OAAOR,UAAU,GAAGM,IAAIG,IAAI,CAACT,UAAU;QACvC;;;;;KAKC,GACDQ,OAAOoB,QAAQ,GAAGtB,IAAIG,IAAI,CAACa,SAAS;QAEpC,IAAI,CAACd,OAAOC,IAAI,EAAE;YAChBD,OAAOC,IAAI,GAAGA;YAEd,IAAIR,cAAc;gBAChB,MAAM4B,UAAUhC,UAAUI;gBAC1B,IAAI4B,SAAS;oBACXrB,OAAOmB,GAAG,GAAGE,QAAQF,GAAG;gBAC1B;gBACA,IAAI,CAAC3B,WAAWU,MAAM,CAACS,IAAI,CAACW,wBAAwB,EAAE;oBACpDtB,OAAOuB,KAAK,GAAG9B;gBACjB;YACF;QACF;IACF;IAEA,wCAAwC;IACxC,wBAAwB;IACxB,wCAAwC;IAExC,IAAID,WAAWU,MAAM,CAACc,KAAK,EAAEQ,SAASC,QAAQ;QAC5C,KAAK,MAAMC,QAAQlC,WAAWU,MAAM,CAACc,KAAK,CAACQ,OAAO,CAAE;YAClDxB,SACE,AAAC,MAAM0B,KAAK;gBACVlC,YAAYA,YAAYU;gBACxByB,SAAS7B,IAAI6B,OAAO;gBACpB7B;gBACA8B,UAAU5B;YACZ,MAAOA;QACX;IACF;IAEA,OAAOA;AACT,EAAC"}

package/dist/auth/sendVerificationEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sendVerificationEmail.d.ts","sourceRoot":"","sources":["../../src/auth/sendVerificationEmail.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAKvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,eAAe,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB,KAAK,EAAE,uBAAuB,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,SAAS,CAAA;CAChB,CAAA;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA2DrE"}
+{"version":3,"file":"sendVerificationEmail.d.ts","sourceRoot":"","sources":["../../src/auth/sendVerificationEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAMvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,eAAe,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB,KAAK,EAAE,uBAAuB,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,SAAS,CAAA;CAChB,CAAA;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDrE"}

package/dist/auth/sendVerificationEmail.js

@@ -1,12 +1,13 @@
-import { URL } from 'url';
 import { formatAdminURL } from '../utilities/formatAdminURL.js';
+import { getRequestOrigin } from '../utilities/getRequestOrigin.js';
 export async function sendVerificationEmail(args) {
     // Verify token from e-mail
     const { collection: { config: collectionConfig }, config, disableEmail, email, req, token, user } = args;
     if (!disableEmail) {
-        const protocol = new URL(req.url).protocol // includes the final :
-        ;
-        const serverURL = config.serverURL !== null && config.serverURL !== '' ? config.serverURL : `${protocol}//${req.headers.get('host')}`;
+        const serverURL = getRequestOrigin({
+            config,
+            req
+        });
         const verificationURL = formatAdminURL({
             adminRoute: config.routes.admin,
             path: `/${collectionConfig.slug}/verify/${token}`,

package/dist/auth/sendVerificationEmail.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/sendVerificationEmail.ts"],"sourcesContent":["import { URL } from 'url'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { InitializedEmailAdapter } from '../email/types.js'\nimport type { TypedUser } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { VerifyConfig } from './types.js'\n\nimport { formatAdminURL } from '../utilities/formatAdminURL.js'\n\ntype Args = {\n  collection: Collection\n  config: SanitizedConfig\n  disableEmail: boolean\n  email: InitializedEmailAdapter\n  req: PayloadRequest\n  token: string\n  user: TypedUser\n}\n\nexport async function sendVerificationEmail(args: Args): Promise<void> {\n  // Verify token from e-mail\n  const {\n    collection: { config: collectionConfig },\n    config,\n    disableEmail,\n    email,\n    req,\n    token,\n    user,\n  } = args\n\n  if (!disableEmail) {\n    const protocol = new URL(req.url!).protocol // includes the final :\n    const serverURL =\n      config.serverURL !== null && config.serverURL !== ''\n        ? config.serverURL\n        : `${protocol}//${req.headers.get('host')}`\n\n    const verificationURL = formatAdminURL({\n      adminRoute: config.routes.admin,\n      path: `/${collectionConfig.slug}/verify/${token}`,\n      serverURL,\n    })\n\n    let html = `${req.t('authentication:newAccountCreated', {\n      serverURL: config.serverURL,\n      verificationURL,\n    })}`\n\n    const verify = collectionConfig.auth.verify as VerifyConfig\n\n    // Allow config to override email content\n    if (typeof verify.generateEmailHTML === 'function') {\n      html = await verify.generateEmailHTML({\n        req,\n        token,\n        user,\n      })\n    }\n\n    let subject = req.t('authentication:verifyYourEmail')\n\n    // Allow config to override email subject\n    if (typeof verify.generateEmailSubject === 'function') {\n      subject = await verify.generateEmailSubject({\n        req,\n        token,\n        user,\n      })\n    }\n\n    await email.sendEmail({\n      from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n      html,\n      subject,\n      to: user.email,\n    })\n  }\n}\n"],"names":["URL","formatAdminURL","sendVerificationEmail","args","collection","config","collectionConfig","disableEmail","email","req","token","user","protocol","url","serverURL","headers","get","verificationURL","adminRoute","routes","admin","path","slug","html","t","verify","auth","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to"],"mappings":"AAAA,SAASA,GAAG,QAAQ,MAAK;AASzB,SAASC,cAAc,QAAQ,iCAAgC;AAY/D,OAAO,eAAeC,sBAAsBC,IAAU;IACpD,2BAA2B;IAC3B,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCD,MAAM,EACNE,YAAY,EACZC,KAAK,EACLC,GAAG,EACHC,KAAK,EACLC,IAAI,EACL,GAAGR;IAEJ,IAAI,CAACI,cAAc;QACjB,MAAMK,WAAW,IAAIZ,IAAIS,IAAII,GAAG,EAAGD,QAAQ,CAAC,uBAAuB;;QACnE,MAAME,YACJT,OAAOS,SAAS,KAAK,QAAQT,OAAOS,SAAS,KAAK,KAC9CT,OAAOS,SAAS,GAChB,GAAGF,SAAS,EAAE,EAAEH,IAAIM,OAAO,CAACC,GAAG,CAAC,SAAS;QAE/C,MAAMC,kBAAkBhB,eAAe;YACrCiB,YAAYb,OAAOc,MAAM,CAACC,KAAK;YAC/BC,MAAM,CAAC,CAAC,EAAEf,iBAAiBgB,IAAI,CAAC,QAAQ,EAAEZ,OAAO;YACjDI;QACF;QAEA,IAAIS,OAAO,GAAGd,IAAIe,CAAC,CAAC,oCAAoC;YACtDV,WAAWT,OAAOS,SAAS;YAC3BG;QACF,IAAI;QAEJ,MAAMQ,SAASnB,iBAAiBoB,IAAI,CAACD,MAAM;QAE3C,yCAAyC;QACzC,IAAI,OAAOA,OAAOE,iBAAiB,KAAK,YAAY;YAClDJ,OAAO,MAAME,OAAOE,iBAAiB,CAAC;gBACpClB;gBACAC;gBACAC;YACF;QACF;QAEA,IAAIiB,UAAUnB,IAAIe,CAAC,CAAC;QAEpB,yCAAyC;QACzC,IAAI,OAAOC,OAAOI,oBAAoB,KAAK,YAAY;YACrDD,UAAU,MAAMH,OAAOI,oBAAoB,CAAC;gBAC1CpB;gBACAC;gBACAC;YACF;QACF;QAEA,MAAMH,MAAMsB,SAAS,CAAC;YACpBC,MAAM,CAAC,CAAC,EAAEvB,MAAMwB,eAAe,CAAC,GAAG,EAAExB,MAAMyB,kBAAkB,CAAC,CAAC,CAAC;YAChEV;YACAK;YACAM,IAAIvB,KAAKH,KAAK;QAChB;IACF;AACF"}
+{"version":3,"sources":["../../src/auth/sendVerificationEmail.ts"],"sourcesContent":["import type { Collection } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { InitializedEmailAdapter } from '../email/types.js'\nimport type { TypedUser } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { VerifyConfig } from './types.js'\n\nimport { formatAdminURL } from '../utilities/formatAdminURL.js'\nimport { getRequestOrigin } from '../utilities/getRequestOrigin.js'\n\ntype Args = {\n  collection: Collection\n  config: SanitizedConfig\n  disableEmail: boolean\n  email: InitializedEmailAdapter\n  req: PayloadRequest\n  token: string\n  user: TypedUser\n}\n\nexport async function sendVerificationEmail(args: Args): Promise<void> {\n  // Verify token from e-mail\n  const {\n    collection: { config: collectionConfig },\n    config,\n    disableEmail,\n    email,\n    req,\n    token,\n    user,\n  } = args\n\n  if (!disableEmail) {\n    const serverURL = getRequestOrigin({ config, req })\n\n    const verificationURL = formatAdminURL({\n      adminRoute: config.routes.admin,\n      path: `/${collectionConfig.slug}/verify/${token}`,\n      serverURL,\n    })\n\n    let html = `${req.t('authentication:newAccountCreated', {\n      serverURL: config.serverURL,\n      verificationURL,\n    })}`\n\n    const verify = collectionConfig.auth.verify as VerifyConfig\n\n    // Allow config to override email content\n    if (typeof verify.generateEmailHTML === 'function') {\n      html = await verify.generateEmailHTML({\n        req,\n        token,\n        user,\n      })\n    }\n\n    let subject = req.t('authentication:verifyYourEmail')\n\n    // Allow config to override email subject\n    if (typeof verify.generateEmailSubject === 'function') {\n      subject = await verify.generateEmailSubject({\n        req,\n        token,\n        user,\n      })\n    }\n\n    await email.sendEmail({\n      from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n      html,\n      subject,\n      to: user.email,\n    })\n  }\n}\n"],"names":["formatAdminURL","getRequestOrigin","sendVerificationEmail","args","collection","config","collectionConfig","disableEmail","email","req","token","user","serverURL","verificationURL","adminRoute","routes","admin","path","slug","html","t","verify","auth","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to"],"mappings":"AAOA,SAASA,cAAc,QAAQ,iCAAgC;AAC/D,SAASC,gBAAgB,QAAQ,mCAAkC;AAYnE,OAAO,eAAeC,sBAAsBC,IAAU;IACpD,2BAA2B;IAC3B,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCD,MAAM,EACNE,YAAY,EACZC,KAAK,EACLC,GAAG,EACHC,KAAK,EACLC,IAAI,EACL,GAAGR;IAEJ,IAAI,CAACI,cAAc;QACjB,MAAMK,YAAYX,iBAAiB;YAAEI;YAAQI;QAAI;QAEjD,MAAMI,kBAAkBb,eAAe;YACrCc,YAAYT,OAAOU,MAAM,CAACC,KAAK;YAC/BC,MAAM,CAAC,CAAC,EAAEX,iBAAiBY,IAAI,CAAC,QAAQ,EAAER,OAAO;YACjDE;QACF;QAEA,IAAIO,OAAO,GAAGV,IAAIW,CAAC,CAAC,oCAAoC;YACtDR,WAAWP,OAAOO,SAAS;YAC3BC;QACF,IAAI;QAEJ,MAAMQ,SAASf,iBAAiBgB,IAAI,CAACD,MAAM;QAE3C,yCAAyC;QACzC,IAAI,OAAOA,OAAOE,iBAAiB,KAAK,YAAY;YAClDJ,OAAO,MAAME,OAAOE,iBAAiB,CAAC;gBACpCd;gBACAC;gBACAC;YACF;QACF;QAEA,IAAIa,UAAUf,IAAIW,CAAC,CAAC;QAEpB,yCAAyC;QACzC,IAAI,OAAOC,OAAOI,oBAAoB,KAAK,YAAY;YACrDD,UAAU,MAAMH,OAAOI,oBAAoB,CAAC;gBAC1ChB;gBACAC;gBACAC;YACF;QACF;QAEA,MAAMH,MAAMkB,SAAS,CAAC;YACpBC,MAAM,CAAC,CAAC,EAAEnB,MAAMoB,eAAe,CAAC,GAAG,EAAEpB,MAAMqB,kBAAkB,CAAC,CAAC,CAAC;YAChEV;YACAK;YACAM,IAAInB,KAAKH,KAAK;QAChB;IACF;AACF"}

package/dist/collections/operations/update.js

@@ -88,7 +88,7 @@ export const updateOperation = async (incomingArgs)=>{
             sort: incomingSort
         });
         let docs;
-        if (hasDraftsEnabled(collectionConfig) && shouldSaveDraft) {
+        if (hasDraftsEnabled(collectionConfig) && (shouldSaveDraft || isTrashAttempt)) {
             const versionsWhere = appendVersionToQueryKey(fullWhere);
             await validateQueryPaths({
                 collectionConfig: collection.config,

package/dist/collections/operations/update.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/collections/operations/update.ts"],"sourcesContent":["import type { DeepPartial } from 'ts-essentials'\n\nimport { status as httpStatus } from 'http-status'\n\nimport type { AccessResult } from '../../config/types.js'\nimport type { PayloadRequest, PopulateType, SelectType, Sort, Where } from '../../types/index.js'\nimport type {\n  BulkOperationResult,\n  Collection,\n  DataFromCollectionSlug,\n  RequiredDataFromCollectionSlug,\n  SelectFromCollectionSlug,\n} from '../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { combineQueries } from '../../database/combineQueries.js'\nimport { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'\nimport { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js'\nimport { APIError } from '../../errors/index.js'\nimport { type CollectionSlug, deepCopyObjectSimple, type FindOptions } from '../../index.js'\nimport { generateFileData } from '../../uploads/generateFileData.js'\nimport { unlinkTempFiles } from '../../uploads/unlinkTempFiles.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { hasDraftsEnabled } from '../../utilities/getVersionsConfig.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { isErrorPublic } from '../../utilities/isErrorPublic.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeSelect } from '../../utilities/sanitizeSelect.js'\nimport { buildVersionCollectionFields } from '../../versions/buildCollectionFields.js'\nimport { appendVersionToQueryKey } from '../../versions/drafts/appendVersionToQueryKey.js'\nimport { getQueryDraftsSort } from '../../versions/drafts/getQueryDraftsSort.js'\nimport { buildAfterOperation } from './utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from './utilities/buildBeforeOperation.js'\nimport { sanitizeSortQuery } from './utilities/sanitizeSortQuery.js'\nimport { updateDocument } from './utilities/update.js'\n\nexport type Arguments<TSlug extends CollectionSlug> = {\n  autosave?: boolean\n  collection: Collection\n  data: DeepPartial<RequiredDataFromCollectionSlug<TSlug>>\n  depth?: number\n  disableTransaction?: boolean\n  disableVerificationEmail?: boolean\n  draft?: boolean\n  limit?: number\n  overrideAccess?: boolean\n  overrideLock?: boolean\n  overwriteExistingFiles?: boolean\n  populate?: PopulateType\n  publishAllLocales?: boolean\n  publishSpecificLocale?: string\n  req: PayloadRequest\n  showHiddenFields?: boolean\n  /**\n   * Sort the documents, can be a string or an array of strings\n   * @example '-createdAt' // Sort DESC by createdAt\n   * @example ['group', '-createdAt'] // sort by 2 fields, ASC group and DESC createdAt\n   */\n  sort?: Sort\n  trash?: boolean\n  unpublishAllLocales?: boolean\n  where: Where\n} & Pick<FindOptions<TSlug, SelectType>, 'select'>\n\nexport const updateOperation = async <\n  TSlug extends CollectionSlug,\n  TSelect extends SelectFromCollectionSlug<TSlug>,\n>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<BulkOperationResult<TSlug, TSelect>> => {\n  let args = incomingArgs\n\n  if (args.collection.config.disableBulkEdit && !args.overrideAccess) {\n    throw new APIError(`Collection ${args.collection.config.slug} has disabled bulk edit`, 403)\n  }\n\n  try {\n    const shouldCommit = !args.disableTransaction && (await initTransaction(args.req))\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'update',\n      overrideAccess: args.overrideAccess!,\n    })\n\n    const {\n      autosave = false,\n      collection: { config: collectionConfig },\n      collection,\n      depth,\n      draft: draftArg = false,\n      limit = 0,\n      overrideAccess,\n      overrideLock,\n      overwriteExistingFiles = false,\n      populate,\n      publishAllLocales,\n      publishSpecificLocale,\n      req: {\n        fallbackLocale,\n        locale,\n        payload: { config },\n        payload,\n      },\n      req,\n      select: incomingSelect,\n      showHiddenFields,\n      sort: incomingSort,\n      trash = false,\n      unpublishAllLocales,\n      where,\n    } = args\n\n    if (!where) {\n      throw new APIError(\"Missing 'where' query of documents to update.\", httpStatus.BAD_REQUEST)\n    }\n\n    const { data: bulkUpdateData } = args\n    const shouldSaveDraft = Boolean(draftArg && hasDraftsEnabled(collectionConfig))\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    let accessResult: AccessResult\n    if (!overrideAccess) {\n      accessResult = await executeAccess({ req }, collectionConfig.access.update)\n    }\n\n    await validateQueryPaths({\n      collectionConfig,\n      overrideAccess: overrideAccess!,\n      req,\n      where,\n    })\n\n    // /////////////////////////////////////\n    // Retrieve documents\n    // /////////////////////////////////////\n\n    let fullWhere = combineQueries(where, accessResult!)\n\n    const isTrashAttempt =\n      collectionConfig.trash &&\n      typeof bulkUpdateData === 'object' &&\n      bulkUpdateData !== null &&\n      'deletedAt' in bulkUpdateData &&\n      bulkUpdateData.deletedAt != null\n\n    // Enforce delete access if performing a soft-delete (trash)\n    if (isTrashAttempt && !overrideAccess) {\n      // Pass data so access function can check data.deletedAt to know it's a trash attempt\n      const deleteAccessResult = await executeAccess(\n        { data: bulkUpdateData, req },\n        collectionConfig.access.delete,\n      )\n      fullWhere = combineQueries(fullWhere, deleteAccessResult)\n    }\n\n    // Exclude trashed documents when trash: false\n    fullWhere = appendNonTrashedFilter({\n      enableTrash: collectionConfig.trash,\n      trash,\n      where: fullWhere,\n    })\n\n    sanitizeWhereQuery({ fields: collectionConfig.flattenedFields, payload, where: fullWhere })\n\n    const sort = sanitizeSortQuery({\n      fields: collection.config.flattenedFields,\n      sort: incomingSort,\n    })\n\n    let docs\n\n    if (hasDraftsEnabled(collectionConfig) && shouldSaveDraft) {\n      const versionsWhere = appendVersionToQueryKey(fullWhere)\n\n      await validateQueryPaths({\n        collectionConfig: collection.config,\n        overrideAccess: overrideAccess!,\n        req,\n        versionFields: buildVersionCollectionFields(payload.config, collection.config, true),\n        where: appendVersionToQueryKey(where),\n      })\n\n      const query = await payload.db.queryDrafts<DataFromCollectionSlug<TSlug>>({\n        collection: collectionConfig.slug,\n        limit,\n        locale: locale!,\n        pagination: false,\n        req,\n        sort: getQueryDraftsSort({ collectionConfig, sort }),\n        where: versionsWhere,\n      })\n\n      docs = query.docs\n    } else {\n      const query = await payload.db.find({\n        collection: collectionConfig.slug,\n        limit,\n        locale: locale!,\n        pagination: false,\n        req,\n        sort,\n        where: fullWhere,\n      })\n\n      docs = query.docs\n    }\n\n    // /////////////////////////////////////\n    // Generate data for all files and sizes\n    // /////////////////////////////////////\n\n    const { data, files: filesToUpload } = await generateFileData({\n      collection,\n      config,\n      data: bulkUpdateData,\n      operation: 'update',\n      overwriteExistingFiles,\n      req,\n      throwOnMissingFile: false,\n    })\n\n    const errors: BulkOperationResult<TSlug, TSelect>['errors'] = []\n\n    const promises = docs.map(async (docWithLocales) => {\n      const { id } = docWithLocales\n\n      try {\n        // Each document gets its own transaction when singleTransaction is enabled\n        let docShouldCommit = false\n        if (req.payload.db.bulkOperationsSingleTransaction) {\n          docShouldCommit = await initTransaction(req)\n        }\n\n        const select = sanitizeSelect({\n          fields: collectionConfig.flattenedFields,\n          forceSelect: collectionConfig.forceSelect,\n          select: incomingSelect,\n        })\n\n        // ///////////////////////////////////////////////\n        // Update document, runs all document level hooks\n        // ///////////////////////////////////////////////\n        let updatedDoc = await updateDocument({\n          id,\n          autosave,\n          collectionConfig,\n          config,\n          data: deepCopyObjectSimple(data),\n          depth: depth!,\n          docWithLocales,\n          draftArg,\n          fallbackLocale: fallbackLocale!,\n          filesToUpload,\n          locale: locale!,\n          overrideAccess: overrideAccess!,\n          overrideLock: overrideLock!,\n          payload,\n          populate,\n          publishAllLocales,\n          publishSpecificLocale,\n          req,\n          select: select!,\n          showHiddenFields: showHiddenFields!,\n          unpublishAllLocales,\n        })\n\n        // /////////////////////////////////////\n        // Add collection property for auth collections\n        // /////////////////////////////////////\n\n        if (collectionConfig.auth) {\n          updatedDoc = { ...updatedDoc, collection: collectionConfig.slug }\n        }\n\n        if (docShouldCommit) {\n          await commitTransaction(req)\n        }\n\n        return updatedDoc\n      } catch (error) {\n        const isPublic = error instanceof Error ? isErrorPublic(error, config) : false\n\n        if (req.payload.db.bulkOperationsSingleTransaction) {\n          await killTransaction(req)\n        }\n        errors.push({\n          id,\n          isPublic,\n          message: error instanceof Error ? error.message : 'Unknown error',\n        })\n      }\n      return null\n    })\n\n    await unlinkTempFiles({\n      collectionConfig,\n      config,\n      req,\n    })\n\n    // Process sequentially when using single transaction mode to avoid shared state issues\n    // Process in parallel when using one transaction for better performance\n    let awaitedDocs: (DataFromCollectionSlug<TSlug> | null)[]\n    if (req.payload.db.bulkOperationsSingleTransaction) {\n      awaitedDocs = []\n      for (const promise of promises) {\n        awaitedDocs.push(await promise)\n      }\n    } else {\n      awaitedDocs = await Promise.all(promises)\n    }\n\n    let result = {\n      docs: awaitedDocs.filter(Boolean),\n      errors,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: collectionConfig,\n      operation: 'update',\n      overrideAccess,\n      // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n      result,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","executeAccess","combineQueries","validateQueryPaths","sanitizeWhereQuery","APIError","deepCopyObjectSimple","generateFileData","unlinkTempFiles","appendNonTrashedFilter","commitTransaction","hasDraftsEnabled","initTransaction","isErrorPublic","killTransaction","sanitizeSelect","buildVersionCollectionFields","appendVersionToQueryKey","getQueryDraftsSort","buildAfterOperation","buildBeforeOperation","sanitizeSortQuery","updateDocument","updateOperation","incomingArgs","args","collection","config","disableBulkEdit","overrideAccess","slug","shouldCommit","disableTransaction","req","operation","autosave","collectionConfig","depth","draft","draftArg","limit","overrideLock","overwriteExistingFiles","populate","publishAllLocales","publishSpecificLocale","fallbackLocale","locale","payload","select","incomingSelect","showHiddenFields","sort","incomingSort","trash","unpublishAllLocales","where","BAD_REQUEST","data","bulkUpdateData","shouldSaveDraft","Boolean","accessResult","access","update","fullWhere","isTrashAttempt","deletedAt","deleteAccessResult","delete","enableTrash","fields","flattenedFields","docs","versionsWhere","versionFields","query","db","queryDrafts","pagination","find","files","filesToUpload","throwOnMissingFile","errors","promises","map","docWithLocales","id","docShouldCommit","bulkOperationsSingleTransaction","forceSelect","updatedDoc","auth","error","isPublic","Error","push","message","awaitedDocs","promise","Promise","all","result","filter"],"mappings":"AAEA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAYlD,SAASC,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,cAAc,QAAQ,mCAAkC;AACjE,SAASC,kBAAkB,QAAQ,uDAAsD;AACzF,SAASC,kBAAkB,QAAQ,uCAAsC;AACzE,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAA8BC,oBAAoB,QAA0B,iBAAgB;AAC5F,SAASC,gBAAgB,QAAQ,oCAAmC;AACpE,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,gBAAgB,QAAQ,uCAAsC;AACvE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,mCAAkC;AAChE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,4BAA4B,QAAQ,0CAAyC;AACtF,SAASC,uBAAuB,QAAQ,mDAAkD;AAC1F,SAASC,kBAAkB,QAAQ,8CAA6C;AAChF,SAASC,mBAAmB,QAAQ,qCAAoC;AACxE,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,iBAAiB,QAAQ,mCAAkC;AACpE,SAASC,cAAc,QAAQ,wBAAuB;AA8BtD,OAAO,MAAMC,kBAAkB,OAI7BC;IAEA,IAAIC,OAAOD;IAEX,IAAIC,KAAKC,UAAU,CAACC,MAAM,CAACC,eAAe,IAAI,CAACH,KAAKI,cAAc,EAAE;QAClE,MAAM,IAAIxB,SAAS,CAAC,WAAW,EAAEoB,KAAKC,UAAU,CAACC,MAAM,CAACG,IAAI,CAAC,uBAAuB,CAAC,EAAE;IACzF;IAEA,IAAI;QACF,MAAMC,eAAe,CAACN,KAAKO,kBAAkB,IAAK,MAAMpB,gBAAgBa,KAAKQ,GAAG;QAEhF,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCR,OAAO,MAAML,qBAAqB;YAChCK;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCO,WAAW;YACXL,gBAAgBJ,KAAKI,cAAc;QACrC;QAEA,MAAM,EACJM,WAAW,KAAK,EAChBT,YAAY,EAAEC,QAAQS,gBAAgB,EAAE,EACxCV,UAAU,EACVW,KAAK,EACLC,OAAOC,WAAW,KAAK,EACvBC,QAAQ,CAAC,EACTX,cAAc,EACdY,YAAY,EACZC,yBAAyB,KAAK,EAC9BC,QAAQ,EACRC,iBAAiB,EACjBC,qBAAqB,EACrBZ,KAAK,EACHa,cAAc,EACdC,MAAM,EACNC,SAAS,EAAErB,MAAM,EAAE,EACnBqB,OAAO,EACR,EACDf,GAAG,EACHgB,QAAQC,cAAc,EACtBC,gBAAgB,EAChBC,MAAMC,YAAY,EAClBC,QAAQ,KAAK,EACbC,mBAAmB,EACnBC,KAAK,EACN,GAAG/B;QAEJ,IAAI,CAAC+B,OAAO;YACV,MAAM,IAAInD,SAAS,iDAAiDL,WAAWyD,WAAW;QAC5F;QAEA,MAAM,EAAEC,MAAMC,cAAc,EAAE,GAAGlC;QACjC,MAAMmC,kBAAkBC,QAAQtB,YAAY5B,iBAAiByB;QAE7D,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI0B;QACJ,IAAI,CAACjC,gBAAgB;YACnBiC,eAAe,MAAM7D,cAAc;gBAAEgC;YAAI,GAAGG,iBAAiB2B,MAAM,CAACC,MAAM;QAC5E;QAEA,MAAM7D,mBAAmB;YACvBiC;YACAP,gBAAgBA;YAChBI;YACAuB;QACF;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,IAAIS,YAAY/D,eAAesD,OAAOM;QAEtC,MAAMI,iBACJ9B,iBAAiBkB,KAAK,IACtB,OAAOK,mBAAmB,YAC1BA,mBAAmB,QACnB,eAAeA,kBACfA,eAAeQ,SAAS,IAAI;QAE9B,4DAA4D;QAC5D,IAAID,kBAAkB,CAACrC,gBAAgB;YACrC,qFAAqF;YACrF,MAAMuC,qBAAqB,MAAMnE,cAC/B;gBAAEyD,MAAMC;gBAAgB1B;YAAI,GAC5BG,iBAAiB2B,MAAM,CAACM,MAAM;YAEhCJ,YAAY/D,eAAe+D,WAAWG;QACxC;QAEA,8CAA8C;QAC9CH,YAAYxD,uBAAuB;YACjC6D,aAAalC,iBAAiBkB,KAAK;YACnCA;YACAE,OAAOS;QACT;QAEA7D,mBAAmB;YAAEmE,QAAQnC,iBAAiBoC,eAAe;YAAExB;YAASQ,OAAOS;QAAU;QAEzF,MAAMb,OAAO/B,kBAAkB;YAC7BkD,QAAQ7C,WAAWC,MAAM,CAAC6C,eAAe;YACzCpB,MAAMC;QACR;QAEA,IAAIoB;QAEJ,IAAI9D,iBAAiByB,qBAAqBwB,iBAAiB;YACzD,MAAMc,gBAAgBzD,wBAAwBgD;YAE9C,MAAM9D,mBAAmB;gBACvBiC,kBAAkBV,WAAWC,MAAM;gBACnCE,gBAAgBA;gBAChBI;gBACA0C,eAAe3D,6BAA6BgC,QAAQrB,MAAM,EAAED,WAAWC,MAAM,EAAE;gBAC/E6B,OAAOvC,wBAAwBuC;YACjC;YAEA,MAAMoB,QAAQ,MAAM5B,QAAQ6B,EAAE,CAACC,WAAW,CAAgC;gBACxEpD,YAAYU,iBAAiBN,IAAI;gBACjCU;gBACAO,QAAQA;gBACRgC,YAAY;gBACZ9C;gBACAmB,MAAMlC,mBAAmB;oBAAEkB;oBAAkBgB;gBAAK;gBAClDI,OAAOkB;YACT;YAEAD,OAAOG,MAAMH,IAAI;QACnB,OAAO;YACL,MAAMG,QAAQ,MAAM5B,QAAQ6B,EAAE,CAACG,IAAI,CAAC;gBAClCtD,YAAYU,iBAAiBN,IAAI;gBACjCU;gBACAO,QAAQA;gBACRgC,YAAY;gBACZ9C;gBACAmB;gBACAI,OAAOS;YACT;YAEAQ,OAAOG,MAAMH,IAAI;QACnB;QAEA,wCAAwC;QACxC,wCAAwC;QACxC,wCAAwC;QAExC,MAAM,EAAEf,IAAI,EAAEuB,OAAOC,aAAa,EAAE,GAAG,MAAM3E,iBAAiB;YAC5DmB;YACAC;YACA+B,MAAMC;YACNzB,WAAW;YACXQ;YACAT;YACAkD,oBAAoB;QACtB;QAEA,MAAMC,SAAwD,EAAE;QAEhE,MAAMC,WAAWZ,KAAKa,GAAG,CAAC,OAAOC;YAC/B,MAAM,EAAEC,EAAE,EAAE,GAAGD;YAEf,IAAI;gBACF,2EAA2E;gBAC3E,IAAIE,kBAAkB;gBACtB,IAAIxD,IAAIe,OAAO,CAAC6B,EAAE,CAACa,+BAA+B,EAAE;oBAClDD,kBAAkB,MAAM7E,gBAAgBqB;gBAC1C;gBAEA,MAAMgB,SAASlC,eAAe;oBAC5BwD,QAAQnC,iBAAiBoC,eAAe;oBACxCmB,aAAavD,iBAAiBuD,WAAW;oBACzC1C,QAAQC;gBACV;gBAEA,kDAAkD;gBAClD,iDAAiD;gBACjD,kDAAkD;gBAClD,IAAI0C,aAAa,MAAMtE,eAAe;oBACpCkE;oBACArD;oBACAC;oBACAT;oBACA+B,MAAMpD,qBAAqBoD;oBAC3BrB,OAAOA;oBACPkD;oBACAhD;oBACAO,gBAAgBA;oBAChBoC;oBACAnC,QAAQA;oBACRlB,gBAAgBA;oBAChBY,cAAcA;oBACdO;oBACAL;oBACAC;oBACAC;oBACAZ;oBACAgB,QAAQA;oBACRE,kBAAkBA;oBAClBI;gBACF;gBAEA,wCAAwC;gBACxC,+CAA+C;gBAC/C,wCAAwC;gBAExC,IAAInB,iBAAiByD,IAAI,EAAE;oBACzBD,aAAa;wBAAE,GAAGA,UAAU;wBAAElE,YAAYU,iBAAiBN,IAAI;oBAAC;gBAClE;gBAEA,IAAI2D,iBAAiB;oBACnB,MAAM/E,kBAAkBuB;gBAC1B;gBAEA,OAAO2D;YACT,EAAE,OAAOE,OAAO;gBACd,MAAMC,WAAWD,iBAAiBE,QAAQnF,cAAciF,OAAOnE,UAAU;gBAEzE,IAAIM,IAAIe,OAAO,CAAC6B,EAAE,CAACa,+BAA+B,EAAE;oBAClD,MAAM5E,gBAAgBmB;gBACxB;gBACAmD,OAAOa,IAAI,CAAC;oBACVT;oBACAO;oBACAG,SAASJ,iBAAiBE,QAAQF,MAAMI,OAAO,GAAG;gBACpD;YACF;YACA,OAAO;QACT;QAEA,MAAM1F,gBAAgB;YACpB4B;YACAT;YACAM;QACF;QAEA,uFAAuF;QACvF,wEAAwE;QACxE,IAAIkE;QACJ,IAAIlE,IAAIe,OAAO,CAAC6B,EAAE,CAACa,+BAA+B,EAAE;YAClDS,cAAc,EAAE;YAChB,KAAK,MAAMC,WAAWf,SAAU;gBAC9Bc,YAAYF,IAAI,CAAC,MAAMG;YACzB;QACF,OAAO;YACLD,cAAc,MAAME,QAAQC,GAAG,CAACjB;QAClC;QAEA,IAAIkB,SAAS;YACX9B,MAAM0B,YAAYK,MAAM,CAAC3C;YACzBuB;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCmB,SAAS,MAAMpF,oBAAoB;YACjCM;YACAC,YAAYU;YACZF,WAAW;YACXL;YACA,oFAAoF;YACpF0E;QACF;QAEA,IAAIxE,cAAc;YAChB,MAAMrB,kBAAkBuB;QAC1B;QAEA,oFAAoF;QACpF,OAAOsE;IACT,EAAE,OAAOT,OAAgB;QACvB,MAAMhF,gBAAgBW,KAAKQ,GAAG;QAC9B,MAAM6D;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/collections/operations/update.ts"],"sourcesContent":["import type { DeepPartial } from 'ts-essentials'\n\nimport { status as httpStatus } from 'http-status'\n\nimport type { AccessResult } from '../../config/types.js'\nimport type { PayloadRequest, PopulateType, SelectType, Sort, Where } from '../../types/index.js'\nimport type {\n  BulkOperationResult,\n  Collection,\n  DataFromCollectionSlug,\n  RequiredDataFromCollectionSlug,\n  SelectFromCollectionSlug,\n} from '../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { combineQueries } from '../../database/combineQueries.js'\nimport { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'\nimport { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js'\nimport { APIError } from '../../errors/index.js'\nimport { type CollectionSlug, deepCopyObjectSimple, type FindOptions } from '../../index.js'\nimport { generateFileData } from '../../uploads/generateFileData.js'\nimport { unlinkTempFiles } from '../../uploads/unlinkTempFiles.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { hasDraftsEnabled } from '../../utilities/getVersionsConfig.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { isErrorPublic } from '../../utilities/isErrorPublic.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeSelect } from '../../utilities/sanitizeSelect.js'\nimport { buildVersionCollectionFields } from '../../versions/buildCollectionFields.js'\nimport { appendVersionToQueryKey } from '../../versions/drafts/appendVersionToQueryKey.js'\nimport { getQueryDraftsSort } from '../../versions/drafts/getQueryDraftsSort.js'\nimport { buildAfterOperation } from './utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from './utilities/buildBeforeOperation.js'\nimport { sanitizeSortQuery } from './utilities/sanitizeSortQuery.js'\nimport { updateDocument } from './utilities/update.js'\n\nexport type Arguments<TSlug extends CollectionSlug> = {\n  autosave?: boolean\n  collection: Collection\n  data: DeepPartial<RequiredDataFromCollectionSlug<TSlug>>\n  depth?: number\n  disableTransaction?: boolean\n  disableVerificationEmail?: boolean\n  draft?: boolean\n  limit?: number\n  overrideAccess?: boolean\n  overrideLock?: boolean\n  overwriteExistingFiles?: boolean\n  populate?: PopulateType\n  publishAllLocales?: boolean\n  publishSpecificLocale?: string\n  req: PayloadRequest\n  showHiddenFields?: boolean\n  /**\n   * Sort the documents, can be a string or an array of strings\n   * @example '-createdAt' // Sort DESC by createdAt\n   * @example ['group', '-createdAt'] // sort by 2 fields, ASC group and DESC createdAt\n   */\n  sort?: Sort\n  trash?: boolean\n  unpublishAllLocales?: boolean\n  where: Where\n} & Pick<FindOptions<TSlug, SelectType>, 'select'>\n\nexport const updateOperation = async <\n  TSlug extends CollectionSlug,\n  TSelect extends SelectFromCollectionSlug<TSlug>,\n>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<BulkOperationResult<TSlug, TSelect>> => {\n  let args = incomingArgs\n\n  if (args.collection.config.disableBulkEdit && !args.overrideAccess) {\n    throw new APIError(`Collection ${args.collection.config.slug} has disabled bulk edit`, 403)\n  }\n\n  try {\n    const shouldCommit = !args.disableTransaction && (await initTransaction(args.req))\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'update',\n      overrideAccess: args.overrideAccess!,\n    })\n\n    const {\n      autosave = false,\n      collection: { config: collectionConfig },\n      collection,\n      depth,\n      draft: draftArg = false,\n      limit = 0,\n      overrideAccess,\n      overrideLock,\n      overwriteExistingFiles = false,\n      populate,\n      publishAllLocales,\n      publishSpecificLocale,\n      req: {\n        fallbackLocale,\n        locale,\n        payload: { config },\n        payload,\n      },\n      req,\n      select: incomingSelect,\n      showHiddenFields,\n      sort: incomingSort,\n      trash = false,\n      unpublishAllLocales,\n      where,\n    } = args\n\n    if (!where) {\n      throw new APIError(\"Missing 'where' query of documents to update.\", httpStatus.BAD_REQUEST)\n    }\n\n    const { data: bulkUpdateData } = args\n    const shouldSaveDraft = Boolean(draftArg && hasDraftsEnabled(collectionConfig))\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    let accessResult: AccessResult\n    if (!overrideAccess) {\n      accessResult = await executeAccess({ req }, collectionConfig.access.update)\n    }\n\n    await validateQueryPaths({\n      collectionConfig,\n      overrideAccess: overrideAccess!,\n      req,\n      where,\n    })\n\n    // /////////////////////////////////////\n    // Retrieve documents\n    // /////////////////////////////////////\n\n    let fullWhere = combineQueries(where, accessResult!)\n\n    const isTrashAttempt =\n      collectionConfig.trash &&\n      typeof bulkUpdateData === 'object' &&\n      bulkUpdateData !== null &&\n      'deletedAt' in bulkUpdateData &&\n      bulkUpdateData.deletedAt != null\n\n    // Enforce delete access if performing a soft-delete (trash)\n    if (isTrashAttempt && !overrideAccess) {\n      // Pass data so access function can check data.deletedAt to know it's a trash attempt\n      const deleteAccessResult = await executeAccess(\n        { data: bulkUpdateData, req },\n        collectionConfig.access.delete,\n      )\n      fullWhere = combineQueries(fullWhere, deleteAccessResult)\n    }\n\n    // Exclude trashed documents when trash: false\n    fullWhere = appendNonTrashedFilter({\n      enableTrash: collectionConfig.trash,\n      trash,\n      where: fullWhere,\n    })\n\n    sanitizeWhereQuery({ fields: collectionConfig.flattenedFields, payload, where: fullWhere })\n\n    const sort = sanitizeSortQuery({\n      fields: collection.config.flattenedFields,\n      sort: incomingSort,\n    })\n\n    let docs\n\n    if (hasDraftsEnabled(collectionConfig) && (shouldSaveDraft || isTrashAttempt)) {\n      const versionsWhere = appendVersionToQueryKey(fullWhere)\n\n      await validateQueryPaths({\n        collectionConfig: collection.config,\n        overrideAccess: overrideAccess!,\n        req,\n        versionFields: buildVersionCollectionFields(payload.config, collection.config, true),\n        where: appendVersionToQueryKey(where),\n      })\n\n      const query = await payload.db.queryDrafts<DataFromCollectionSlug<TSlug>>({\n        collection: collectionConfig.slug,\n        limit,\n        locale: locale!,\n        pagination: false,\n        req,\n        sort: getQueryDraftsSort({ collectionConfig, sort }),\n        where: versionsWhere,\n      })\n\n      docs = query.docs\n    } else {\n      const query = await payload.db.find({\n        collection: collectionConfig.slug,\n        limit,\n        locale: locale!,\n        pagination: false,\n        req,\n        sort,\n        where: fullWhere,\n      })\n\n      docs = query.docs\n    }\n\n    // /////////////////////////////////////\n    // Generate data for all files and sizes\n    // /////////////////////////////////////\n\n    const { data, files: filesToUpload } = await generateFileData({\n      collection,\n      config,\n      data: bulkUpdateData,\n      operation: 'update',\n      overwriteExistingFiles,\n      req,\n      throwOnMissingFile: false,\n    })\n\n    const errors: BulkOperationResult<TSlug, TSelect>['errors'] = []\n\n    const promises = docs.map(async (docWithLocales) => {\n      const { id } = docWithLocales\n\n      try {\n        // Each document gets its own transaction when singleTransaction is enabled\n        let docShouldCommit = false\n        if (req.payload.db.bulkOperationsSingleTransaction) {\n          docShouldCommit = await initTransaction(req)\n        }\n\n        const select = sanitizeSelect({\n          fields: collectionConfig.flattenedFields,\n          forceSelect: collectionConfig.forceSelect,\n          select: incomingSelect,\n        })\n\n        // ///////////////////////////////////////////////\n        // Update document, runs all document level hooks\n        // ///////////////////////////////////////////////\n        let updatedDoc = await updateDocument({\n          id,\n          autosave,\n          collectionConfig,\n          config,\n          data: deepCopyObjectSimple(data),\n          depth: depth!,\n          docWithLocales,\n          draftArg,\n          fallbackLocale: fallbackLocale!,\n          filesToUpload,\n          locale: locale!,\n          overrideAccess: overrideAccess!,\n          overrideLock: overrideLock!,\n          payload,\n          populate,\n          publishAllLocales,\n          publishSpecificLocale,\n          req,\n          select: select!,\n          showHiddenFields: showHiddenFields!,\n          unpublishAllLocales,\n        })\n\n        // /////////////////////////////////////\n        // Add collection property for auth collections\n        // /////////////////////////////////////\n\n        if (collectionConfig.auth) {\n          updatedDoc = { ...updatedDoc, collection: collectionConfig.slug }\n        }\n\n        if (docShouldCommit) {\n          await commitTransaction(req)\n        }\n\n        return updatedDoc\n      } catch (error) {\n        const isPublic = error instanceof Error ? isErrorPublic(error, config) : false\n\n        if (req.payload.db.bulkOperationsSingleTransaction) {\n          await killTransaction(req)\n        }\n        errors.push({\n          id,\n          isPublic,\n          message: error instanceof Error ? error.message : 'Unknown error',\n        })\n      }\n      return null\n    })\n\n    await unlinkTempFiles({\n      collectionConfig,\n      config,\n      req,\n    })\n\n    // Process sequentially when using single transaction mode to avoid shared state issues\n    // Process in parallel when using one transaction for better performance\n    let awaitedDocs: (DataFromCollectionSlug<TSlug> | null)[]\n    if (req.payload.db.bulkOperationsSingleTransaction) {\n      awaitedDocs = []\n      for (const promise of promises) {\n        awaitedDocs.push(await promise)\n      }\n    } else {\n      awaitedDocs = await Promise.all(promises)\n    }\n\n    let result = {\n      docs: awaitedDocs.filter(Boolean),\n      errors,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: collectionConfig,\n      operation: 'update',\n      overrideAccess,\n      // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n      result,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","executeAccess","combineQueries","validateQueryPaths","sanitizeWhereQuery","APIError","deepCopyObjectSimple","generateFileData","unlinkTempFiles","appendNonTrashedFilter","commitTransaction","hasDraftsEnabled","initTransaction","isErrorPublic","killTransaction","sanitizeSelect","buildVersionCollectionFields","appendVersionToQueryKey","getQueryDraftsSort","buildAfterOperation","buildBeforeOperation","sanitizeSortQuery","updateDocument","updateOperation","incomingArgs","args","collection","config","disableBulkEdit","overrideAccess","slug","shouldCommit","disableTransaction","req","operation","autosave","collectionConfig","depth","draft","draftArg","limit","overrideLock","overwriteExistingFiles","populate","publishAllLocales","publishSpecificLocale","fallbackLocale","locale","payload","select","incomingSelect","showHiddenFields","sort","incomingSort","trash","unpublishAllLocales","where","BAD_REQUEST","data","bulkUpdateData","shouldSaveDraft","Boolean","accessResult","access","update","fullWhere","isTrashAttempt","deletedAt","deleteAccessResult","delete","enableTrash","fields","flattenedFields","docs","versionsWhere","versionFields","query","db","queryDrafts","pagination","find","files","filesToUpload","throwOnMissingFile","errors","promises","map","docWithLocales","id","docShouldCommit","bulkOperationsSingleTransaction","forceSelect","updatedDoc","auth","error","isPublic","Error","push","message","awaitedDocs","promise","Promise","all","result","filter"],"mappings":"AAEA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAYlD,SAASC,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,cAAc,QAAQ,mCAAkC;AACjE,SAASC,kBAAkB,QAAQ,uDAAsD;AACzF,SAASC,kBAAkB,QAAQ,uCAAsC;AACzE,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAA8BC,oBAAoB,QAA0B,iBAAgB;AAC5F,SAASC,gBAAgB,QAAQ,oCAAmC;AACpE,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,gBAAgB,QAAQ,uCAAsC;AACvE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,mCAAkC;AAChE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,4BAA4B,QAAQ,0CAAyC;AACtF,SAASC,uBAAuB,QAAQ,mDAAkD;AAC1F,SAASC,kBAAkB,QAAQ,8CAA6C;AAChF,SAASC,mBAAmB,QAAQ,qCAAoC;AACxE,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,iBAAiB,QAAQ,mCAAkC;AACpE,SAASC,cAAc,QAAQ,wBAAuB;AA8BtD,OAAO,MAAMC,kBAAkB,OAI7BC;IAEA,IAAIC,OAAOD;IAEX,IAAIC,KAAKC,UAAU,CAACC,MAAM,CAACC,eAAe,IAAI,CAACH,KAAKI,cAAc,EAAE;QAClE,MAAM,IAAIxB,SAAS,CAAC,WAAW,EAAEoB,KAAKC,UAAU,CAACC,MAAM,CAACG,IAAI,CAAC,uBAAuB,CAAC,EAAE;IACzF;IAEA,IAAI;QACF,MAAMC,eAAe,CAACN,KAAKO,kBAAkB,IAAK,MAAMpB,gBAAgBa,KAAKQ,GAAG;QAEhF,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCR,OAAO,MAAML,qBAAqB;YAChCK;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCO,WAAW;YACXL,gBAAgBJ,KAAKI,cAAc;QACrC;QAEA,MAAM,EACJM,WAAW,KAAK,EAChBT,YAAY,EAAEC,QAAQS,gBAAgB,EAAE,EACxCV,UAAU,EACVW,KAAK,EACLC,OAAOC,WAAW,KAAK,EACvBC,QAAQ,CAAC,EACTX,cAAc,EACdY,YAAY,EACZC,yBAAyB,KAAK,EAC9BC,QAAQ,EACRC,iBAAiB,EACjBC,qBAAqB,EACrBZ,KAAK,EACHa,cAAc,EACdC,MAAM,EACNC,SAAS,EAAErB,MAAM,EAAE,EACnBqB,OAAO,EACR,EACDf,GAAG,EACHgB,QAAQC,cAAc,EACtBC,gBAAgB,EAChBC,MAAMC,YAAY,EAClBC,QAAQ,KAAK,EACbC,mBAAmB,EACnBC,KAAK,EACN,GAAG/B;QAEJ,IAAI,CAAC+B,OAAO;YACV,MAAM,IAAInD,SAAS,iDAAiDL,WAAWyD,WAAW;QAC5F;QAEA,MAAM,EAAEC,MAAMC,cAAc,EAAE,GAAGlC;QACjC,MAAMmC,kBAAkBC,QAAQtB,YAAY5B,iBAAiByB;QAE7D,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI0B;QACJ,IAAI,CAACjC,gBAAgB;YACnBiC,eAAe,MAAM7D,cAAc;gBAAEgC;YAAI,GAAGG,iBAAiB2B,MAAM,CAACC,MAAM;QAC5E;QAEA,MAAM7D,mBAAmB;YACvBiC;YACAP,gBAAgBA;YAChBI;YACAuB;QACF;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,IAAIS,YAAY/D,eAAesD,OAAOM;QAEtC,MAAMI,iBACJ9B,iBAAiBkB,KAAK,IACtB,OAAOK,mBAAmB,YAC1BA,mBAAmB,QACnB,eAAeA,kBACfA,eAAeQ,SAAS,IAAI;QAE9B,4DAA4D;QAC5D,IAAID,kBAAkB,CAACrC,gBAAgB;YACrC,qFAAqF;YACrF,MAAMuC,qBAAqB,MAAMnE,cAC/B;gBAAEyD,MAAMC;gBAAgB1B;YAAI,GAC5BG,iBAAiB2B,MAAM,CAACM,MAAM;YAEhCJ,YAAY/D,eAAe+D,WAAWG;QACxC;QAEA,8CAA8C;QAC9CH,YAAYxD,uBAAuB;YACjC6D,aAAalC,iBAAiBkB,KAAK;YACnCA;YACAE,OAAOS;QACT;QAEA7D,mBAAmB;YAAEmE,QAAQnC,iBAAiBoC,eAAe;YAAExB;YAASQ,OAAOS;QAAU;QAEzF,MAAMb,OAAO/B,kBAAkB;YAC7BkD,QAAQ7C,WAAWC,MAAM,CAAC6C,eAAe;YACzCpB,MAAMC;QACR;QAEA,IAAIoB;QAEJ,IAAI9D,iBAAiByB,qBAAsBwB,CAAAA,mBAAmBM,cAAa,GAAI;YAC7E,MAAMQ,gBAAgBzD,wBAAwBgD;YAE9C,MAAM9D,mBAAmB;gBACvBiC,kBAAkBV,WAAWC,MAAM;gBACnCE,gBAAgBA;gBAChBI;gBACA0C,eAAe3D,6BAA6BgC,QAAQrB,MAAM,EAAED,WAAWC,MAAM,EAAE;gBAC/E6B,OAAOvC,wBAAwBuC;YACjC;YAEA,MAAMoB,QAAQ,MAAM5B,QAAQ6B,EAAE,CAACC,WAAW,CAAgC;gBACxEpD,YAAYU,iBAAiBN,IAAI;gBACjCU;gBACAO,QAAQA;gBACRgC,YAAY;gBACZ9C;gBACAmB,MAAMlC,mBAAmB;oBAAEkB;oBAAkBgB;gBAAK;gBAClDI,OAAOkB;YACT;YAEAD,OAAOG,MAAMH,IAAI;QACnB,OAAO;YACL,MAAMG,QAAQ,MAAM5B,QAAQ6B,EAAE,CAACG,IAAI,CAAC;gBAClCtD,YAAYU,iBAAiBN,IAAI;gBACjCU;gBACAO,QAAQA;gBACRgC,YAAY;gBACZ9C;gBACAmB;gBACAI,OAAOS;YACT;YAEAQ,OAAOG,MAAMH,IAAI;QACnB;QAEA,wCAAwC;QACxC,wCAAwC;QACxC,wCAAwC;QAExC,MAAM,EAAEf,IAAI,EAAEuB,OAAOC,aAAa,EAAE,GAAG,MAAM3E,iBAAiB;YAC5DmB;YACAC;YACA+B,MAAMC;YACNzB,WAAW;YACXQ;YACAT;YACAkD,oBAAoB;QACtB;QAEA,MAAMC,SAAwD,EAAE;QAEhE,MAAMC,WAAWZ,KAAKa,GAAG,CAAC,OAAOC;YAC/B,MAAM,EAAEC,EAAE,EAAE,GAAGD;YAEf,IAAI;gBACF,2EAA2E;gBAC3E,IAAIE,kBAAkB;gBACtB,IAAIxD,IAAIe,OAAO,CAAC6B,EAAE,CAACa,+BAA+B,EAAE;oBAClDD,kBAAkB,MAAM7E,gBAAgBqB;gBAC1C;gBAEA,MAAMgB,SAASlC,eAAe;oBAC5BwD,QAAQnC,iBAAiBoC,eAAe;oBACxCmB,aAAavD,iBAAiBuD,WAAW;oBACzC1C,QAAQC;gBACV;gBAEA,kDAAkD;gBAClD,iDAAiD;gBACjD,kDAAkD;gBAClD,IAAI0C,aAAa,MAAMtE,eAAe;oBACpCkE;oBACArD;oBACAC;oBACAT;oBACA+B,MAAMpD,qBAAqBoD;oBAC3BrB,OAAOA;oBACPkD;oBACAhD;oBACAO,gBAAgBA;oBAChBoC;oBACAnC,QAAQA;oBACRlB,gBAAgBA;oBAChBY,cAAcA;oBACdO;oBACAL;oBACAC;oBACAC;oBACAZ;oBACAgB,QAAQA;oBACRE,kBAAkBA;oBAClBI;gBACF;gBAEA,wCAAwC;gBACxC,+CAA+C;gBAC/C,wCAAwC;gBAExC,IAAInB,iBAAiByD,IAAI,EAAE;oBACzBD,aAAa;wBAAE,GAAGA,UAAU;wBAAElE,YAAYU,iBAAiBN,IAAI;oBAAC;gBAClE;gBAEA,IAAI2D,iBAAiB;oBACnB,MAAM/E,kBAAkBuB;gBAC1B;gBAEA,OAAO2D;YACT,EAAE,OAAOE,OAAO;gBACd,MAAMC,WAAWD,iBAAiBE,QAAQnF,cAAciF,OAAOnE,UAAU;gBAEzE,IAAIM,IAAIe,OAAO,CAAC6B,EAAE,CAACa,+BAA+B,EAAE;oBAClD,MAAM5E,gBAAgBmB;gBACxB;gBACAmD,OAAOa,IAAI,CAAC;oBACVT;oBACAO;oBACAG,SAASJ,iBAAiBE,QAAQF,MAAMI,OAAO,GAAG;gBACpD;YACF;YACA,OAAO;QACT;QAEA,MAAM1F,gBAAgB;YACpB4B;YACAT;YACAM;QACF;QAEA,uFAAuF;QACvF,wEAAwE;QACxE,IAAIkE;QACJ,IAAIlE,IAAIe,OAAO,CAAC6B,EAAE,CAACa,+BAA+B,EAAE;YAClDS,cAAc,EAAE;YAChB,KAAK,MAAMC,WAAWf,SAAU;gBAC9Bc,YAAYF,IAAI,CAAC,MAAMG;YACzB;QACF,OAAO;YACLD,cAAc,MAAME,QAAQC,GAAG,CAACjB;QAClC;QAEA,IAAIkB,SAAS;YACX9B,MAAM0B,YAAYK,MAAM,CAAC3C;YACzBuB;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCmB,SAAS,MAAMpF,oBAAoB;YACjCM;YACAC,YAAYU;YACZF,WAAW;YACXL;YACA,oFAAoF;YACpF0E;QACF;QAEA,IAAIxE,cAAc;YAChB,MAAMrB,kBAAkBuB;QAC1B;QAEA,oFAAoF;QACpF,OAAOsE;IACT,EAAE,OAAOT,OAAgB;QACvB,MAAMhF,gBAAgBW,KAAKQ,GAAG;QAC9B,MAAM6D;IACR;AACF,EAAC"}

package/dist/collections/operations/utilities/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/collections/operations/utilities/update.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGhD,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,eAAe,EACf,mBAAmB,EACpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,UAAU,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,UAAU,EACV,6BAA6B,EAC9B,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,UAAU,EACX,MAAM,uBAAuB,CAAA;AAkB9B,MAAM,MAAM,wBAAwB,CAAC,KAAK,SAAS,cAAc,IAAI;IACnE,QAAQ,EAAE,OAAO,CAAA;IACjB,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,IAAI,EAAE,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,UAAU,GAAG,UAAU,CAAA;IACvC,QAAQ,EAAE,OAAO,CAAA;IACjB,cAAc,EAAE,mBAAmB,CAAA;IACnC,aAAa,EAAE,UAAU,EAAE,CAAA;IAC3B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,gBAAgB,EAAE,OAAO,CAAA;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,SAAS,cAAc,EAC5B,OAAO,SAAS,wBAAwB,CAAC,KAAK,CAAC,uUAuB9C,wBAAwB,CAAC,KAAK,CAAC,KAAG,OAAO,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAyWzF,CAAA"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/collections/operations/utilities/update.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGhD,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,eAAe,EACf,mBAAmB,EACpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,UAAU,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,UAAU,EACV,6BAA6B,EAC9B,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,UAAU,EACX,MAAM,uBAAuB,CAAA;AAkB9B,MAAM,MAAM,wBAAwB,CAAC,KAAK,SAAS,cAAc,IAAI;IACnE,QAAQ,EAAE,OAAO,CAAA;IACjB,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,IAAI,EAAE,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,UAAU,GAAG,UAAU,CAAA;IACvC,QAAQ,EAAE,OAAO,CAAA;IACjB,cAAc,EAAE,mBAAmB,CAAA;IACnC,aAAa,EAAE,UAAU,EAAE,CAAA;IAC3B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,gBAAgB,EAAE,OAAO,CAAA;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,SAAS,cAAc,EAC5B,OAAO,SAAS,wBAAwB,CAAC,KAAK,CAAC,uUAuB9C,wBAAwB,CAAC,KAAK,CAAC,KAAG,OAAO,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CA0WzF,CAAA"}

package/dist/collections/operations/utilities/update.js

@@ -266,7 +266,8 @@ import { mergeLocalizedData } from '../../../utilities/mergeLocalizedData.js';
             payload,
             publishSpecificLocale,
             req,
-            snapshot: snapshotToSave
+            snapshot: snapshotToSave,
+            unpublish: unpublishAllLocales
         });
     }
     // /////////////////////////////////////