payload 3.87.1 → 3.88.0

package/dist/database/queryValidation/validateSortQuery.d.ts

@@ -0,0 +1,23 @@
+import type { SanitizedCollectionConfig } from '../../collections/config/types.js';
+import type { FlattenedField } from '../../fields/config/types.js';
+import type { SanitizedGlobalConfig } from '../../globals/config/types.js';
+import type { PayloadRequest, Sort } from '../../types/index.js';
+type Args = {
+    overrideAccess: boolean;
+    req: PayloadRequest;
+    sort?: Sort;
+    versionFields?: FlattenedField[];
+} & ({
+    collectionConfig: SanitizedCollectionConfig;
+    globalConfig?: undefined;
+} | {
+    collectionConfig?: undefined;
+    globalConfig: SanitizedGlobalConfig;
+});
+/**
+ * Ensures sort paths are subject to the same field-read access checks as query `where` paths,
+ * since database sorting happens before response-time field redaction.
+ */
+export declare const validateSortQuery: ({ collectionConfig, globalConfig, overrideAccess, req, sort, versionFields, }: Args) => Promise<void>;
+export {};
+//# sourceMappingURL=validateSortQuery.d.ts.map

package/dist/database/queryValidation/validateSortQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateSortQuery.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateSortQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAS,MAAM,sBAAsB,CAAA;AAKvE,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;CACjC,GAAG,CACA;IACE,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,YAAY,CAAC,EAAE,SAAS,CAAA;CACzB,GACD;IACE,gBAAgB,CAAC,EAAE,SAAS,CAAA;IAC5B,YAAY,EAAE,qBAAqB,CAAA;CACpC,CACJ,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,kFAO3B,IAAI,KAAG,OAAO,CAAC,IAAI,CA+CrB,CAAA"}

package/dist/database/queryValidation/validateSortQuery.js

@@ -0,0 +1,54 @@
+import { getLocalizedPaths } from '../getLocalizedPaths.js';
+import { validateQueryPaths } from './validateQueryPaths.js';
+/**
+ * Ensures sort paths are subject to the same field-read access checks as query `where` paths,
+ * since database sorting happens before response-time field redaction.
+ */ export const validateSortQuery = async ({ collectionConfig, globalConfig, overrideAccess, req, sort, versionFields })=>{
+    if (overrideAccess || !sort) {
+        return;
+    }
+    const fields = versionFields || (globalConfig || collectionConfig).flattenedFields;
+    const sortFields = Array.isArray(sort) ? sort : [
+        sort
+    ];
+    const where = {};
+    for (const sortField of sortFields){
+        const path = sortField.replace(/^-/, '').replace(/__/g, '.');
+        const paths = getLocalizedPaths({
+            collectionSlug: collectionConfig?.slug,
+            fields,
+            globalSlug: globalConfig?.slug,
+            incomingPath: path,
+            locale: req.locale,
+            overrideAccess: true,
+            payload: req.payload
+        });
+        if (path !== 'id' && path !== '_id' && paths.every(({ invalid })=>!invalid)) {
+            where[path] = {
+                exists: true
+            };
+        }
+    }
+    if (Object.keys(where).length === 0) {
+        return;
+    }
+    if (collectionConfig) {
+        await validateQueryPaths({
+            collectionConfig,
+            overrideAccess,
+            req,
+            versionFields,
+            where
+        });
+    } else {
+        await validateQueryPaths({
+            globalConfig,
+            overrideAccess,
+            req,
+            versionFields,
+            where
+        });
+    }
+};
+
+//# sourceMappingURL=validateSortQuery.js.map

package/dist/database/queryValidation/validateSortQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/database/queryValidation/validateSortQuery.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { PayloadRequest, Sort, Where } from '../../types/index.js'\n\nimport { getLocalizedPaths } from '../getLocalizedPaths.js'\nimport { validateQueryPaths } from './validateQueryPaths.js'\n\ntype Args = {\n  overrideAccess: boolean\n  req: PayloadRequest\n  sort?: Sort\n  versionFields?: FlattenedField[]\n} & (\n  | {\n      collectionConfig: SanitizedCollectionConfig\n      globalConfig?: undefined\n    }\n  | {\n      collectionConfig?: undefined\n      globalConfig: SanitizedGlobalConfig\n    }\n)\n\n/**\n * Ensures sort paths are subject to the same field-read access checks as query `where` paths,\n * since database sorting happens before response-time field redaction.\n */\nexport const validateSortQuery = async ({\n  collectionConfig,\n  globalConfig,\n  overrideAccess,\n  req,\n  sort,\n  versionFields,\n}: Args): Promise<void> => {\n  if (overrideAccess || !sort) {\n    return\n  }\n\n  const fields = versionFields || (globalConfig || collectionConfig).flattenedFields\n  const sortFields = Array.isArray(sort) ? sort : [sort]\n  const where: Where = {}\n\n  for (const sortField of sortFields) {\n    const path = sortField.replace(/^-/, '').replace(/__/g, '.')\n    const paths = getLocalizedPaths({\n      collectionSlug: collectionConfig?.slug,\n      fields,\n      globalSlug: globalConfig?.slug,\n      incomingPath: path,\n      locale: req.locale!,\n      overrideAccess: true,\n      payload: req.payload,\n    })\n\n    if (path !== 'id' && path !== '_id' && paths.every(({ invalid }) => !invalid)) {\n      where[path] = { exists: true }\n    }\n  }\n\n  if (Object.keys(where).length === 0) {\n    return\n  }\n\n  if (collectionConfig) {\n    await validateQueryPaths({\n      collectionConfig,\n      overrideAccess,\n      req,\n      versionFields,\n      where,\n    })\n  } else {\n    await validateQueryPaths({\n      globalConfig,\n      overrideAccess,\n      req,\n      versionFields,\n      where,\n    })\n  }\n}\n"],"names":["getLocalizedPaths","validateQueryPaths","validateSortQuery","collectionConfig","globalConfig","overrideAccess","req","sort","versionFields","fields","flattenedFields","sortFields","Array","isArray","where","sortField","path","replace","paths","collectionSlug","slug","globalSlug","incomingPath","locale","payload","every","invalid","exists","Object","keys","length"],"mappings":"AAKA,SAASA,iBAAiB,QAAQ,0BAAyB;AAC3D,SAASC,kBAAkB,QAAQ,0BAAyB;AAkB5D;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,OAAO,EACtCC,gBAAgB,EAChBC,YAAY,EACZC,cAAc,EACdC,GAAG,EACHC,IAAI,EACJC,aAAa,EACR;IACL,IAAIH,kBAAkB,CAACE,MAAM;QAC3B;IACF;IAEA,MAAME,SAASD,iBAAiB,AAACJ,CAAAA,gBAAgBD,gBAAe,EAAGO,eAAe;IAClF,MAAMC,aAAaC,MAAMC,OAAO,CAACN,QAAQA,OAAO;QAACA;KAAK;IACtD,MAAMO,QAAe,CAAC;IAEtB,KAAK,MAAMC,aAAaJ,WAAY;QAClC,MAAMK,OAAOD,UAAUE,OAAO,CAAC,MAAM,IAAIA,OAAO,CAAC,OAAO;QACxD,MAAMC,QAAQlB,kBAAkB;YAC9BmB,gBAAgBhB,kBAAkBiB;YAClCX;YACAY,YAAYjB,cAAcgB;YAC1BE,cAAcN;YACdO,QAAQjB,IAAIiB,MAAM;YAClBlB,gBAAgB;YAChBmB,SAASlB,IAAIkB,OAAO;QACtB;QAEA,IAAIR,SAAS,QAAQA,SAAS,SAASE,MAAMO,KAAK,CAAC,CAAC,EAAEC,OAAO,EAAE,GAAK,CAACA,UAAU;YAC7EZ,KAAK,CAACE,KAAK,GAAG;gBAAEW,QAAQ;YAAK;QAC/B;IACF;IAEA,IAAIC,OAAOC,IAAI,CAACf,OAAOgB,MAAM,KAAK,GAAG;QACnC;IACF;IAEA,IAAI3B,kBAAkB;QACpB,MAAMF,mBAAmB;YACvBE;YACAE;YACAC;YACAE;YACAM;QACF;IACF,OAAO;QACL,MAAMb,mBAAmB;YACvBG;YACAC;YACAC;YACAE;YACAM;QACF;IACF;AACF,EAAC"}

package/dist/database/sanitizeJoinQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeJoinQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeJoinQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAiB,MAAM,gCAAgC,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAQlE,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AA0ED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,kEAK3B,IAAI;;;;;;;;GA+CN,CAAA"}
+{"version":3,"file":"sanitizeJoinQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeJoinQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAiB,MAAM,gCAAgC,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AASlE,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAgFD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,kEAK3B,IAAI;;;;;;;;GA+CN,CAAA"}

package/dist/database/sanitizeJoinQuery.js

@@ -2,6 +2,7 @@ import { executeAccess } from '../auth/executeAccess.js';
 import { QueryError } from '../errors/QueryError.js';
 import { combineQueries } from './combineQueries.js';
 import { validateQueryPaths } from './queryValidation/validateQueryPaths.js';
+import { validateSortQuery } from './queryValidation/validateSortQuery.js';
 import { sanitizeWhereQuery } from './sanitizeWhereQuery.js';
 const sanitizeJoinFieldQuery = async ({ collectionSlug, errors, join, joinsQuery, overrideAccess, promises, req })=>{
     const { joinPath } = join;
@@ -38,6 +39,11 @@ const sanitizeJoinFieldQuery = async ({ collectionSlug, errors, join, joinsQuery
         req,
         // incoming where input, but we shouldn't validate generated from the access control.
         where: joinQuery.where
+    }), validateSortQuery({
+        collectionConfig: joinCollectionConfig,
+        overrideAccess,
+        req,
+        sort: joinQuery.sort || join.field.defaultSort || joinCollectionConfig.defaultSort
     }));
     if (typeof accessResult === 'object') {
         sanitizeWhereQuery({

package/dist/database/sanitizeJoinQuery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/database/sanitizeJoinQuery.ts"],"sourcesContent":["import type { SanitizedCollectionConfig, SanitizedJoin } from '../collections/config/types.js'\nimport type { JoinQuery, PayloadRequest } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { QueryError } from '../errors/QueryError.js'\nimport { combineQueries } from './combineQueries.js'\nimport { validateQueryPaths } from './queryValidation/validateQueryPaths.js'\nimport { sanitizeWhereQuery } from './sanitizeWhereQuery.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  joins?: JoinQuery\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\nconst sanitizeJoinFieldQuery = async ({\n  collectionSlug,\n  errors,\n  join,\n  joinsQuery,\n  overrideAccess,\n  promises,\n  req,\n}: {\n  collectionSlug: string\n  errors: { path: string }[]\n  join: SanitizedJoin\n  joinsQuery: JoinQuery\n  overrideAccess: boolean\n  promises: Promise<void>[]\n  req: PayloadRequest\n}) => {\n  const { joinPath } = join\n\n  // TODO: fix any's in joinsQuery[joinPath]\n\n  if ((joinsQuery as any)[joinPath] === false) {\n    return\n  }\n\n  const joinCollectionConfig = req.payload.collections[collectionSlug]!.config\n\n  const accessResult = !overrideAccess\n    ? await executeAccess({ disableErrors: true, req }, joinCollectionConfig.access.read)\n    : true\n\n  if (accessResult === false) {\n    ;(joinsQuery as any)[joinPath] = false\n    return\n  }\n\n  if (!(joinsQuery as any)[joinPath]) {\n    ;(joinsQuery as any)[joinPath] = {}\n  }\n\n  const joinQuery = (joinsQuery as any)[joinPath]\n\n  if (!joinQuery.where) {\n    joinQuery.where = {}\n  }\n\n  if (join.field.where) {\n    joinQuery.where = combineQueries(joinQuery.where, join.field.where)\n  }\n\n  promises.push(\n    validateQueryPaths({\n      collectionConfig: joinCollectionConfig,\n      errors,\n      overrideAccess,\n      polymorphicJoin: Array.isArray(join.field.collection),\n      req,\n      // incoming where input, but we shouldn't validate generated from the access control.\n      where: joinQuery.where,\n    }),\n  )\n\n  if (typeof accessResult === 'object') {\n    sanitizeWhereQuery({\n      fields: joinCollectionConfig.flattenedFields,\n      payload: req.payload,\n      where: accessResult,\n    })\n    joinQuery.where = combineQueries(joinQuery.where, accessResult)\n  }\n}\n\n/**\n * * Validates `where` for each join\n * * Combines the access result for joined collection\n * * Combines the default join's `where`\n */\nexport const sanitizeJoinQuery = async ({\n  collectionConfig,\n  joins: joinsQuery,\n  overrideAccess,\n  req,\n}: Args) => {\n  if (joinsQuery === false) {\n    return false\n  }\n\n  if (!joinsQuery) {\n    joinsQuery = {}\n  }\n\n  const errors: { path: string }[] = []\n  const promises: Promise<void>[] = []\n\n  for (const collectionSlug in collectionConfig.joins) {\n    for (const join of collectionConfig.joins[collectionSlug]!) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  for (const join of collectionConfig.polymorphicJoins) {\n    for (const collectionSlug of join.field.collection) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  await Promise.all(promises)\n\n  if (errors.length > 0) {\n    throw new QueryError(errors)\n  }\n\n  return joinsQuery\n}\n"],"names":["executeAccess","QueryError","combineQueries","validateQueryPaths","sanitizeWhereQuery","sanitizeJoinFieldQuery","collectionSlug","errors","join","joinsQuery","overrideAccess","promises","req","joinPath","joinCollectionConfig","payload","collections","config","accessResult","disableErrors","access","read","joinQuery","where","field","push","collectionConfig","polymorphicJoin","Array","isArray","collection","fields","flattenedFields","sanitizeJoinQuery","joins","polymorphicJoins","Promise","all","length"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,UAAU,QAAQ,0BAAyB;AACpD,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,kBAAkB,QAAQ,0CAAyC;AAC5E,SAASC,kBAAkB,QAAQ,0BAAyB;AAS5D,MAAMC,yBAAyB,OAAO,EACpCC,cAAc,EACdC,MAAM,EACNC,IAAI,EACJC,UAAU,EACVC,cAAc,EACdC,QAAQ,EACRC,GAAG,EASJ;IACC,MAAM,EAAEC,QAAQ,EAAE,GAAGL;IAErB,0CAA0C;IAE1C,IAAI,AAACC,UAAkB,CAACI,SAAS,KAAK,OAAO;QAC3C;IACF;IAEA,MAAMC,uBAAuBF,IAAIG,OAAO,CAACC,WAAW,CAACV,eAAe,CAAEW,MAAM;IAE5E,MAAMC,eAAe,CAACR,iBAClB,MAAMV,cAAc;QAAEmB,eAAe;QAAMP;IAAI,GAAGE,qBAAqBM,MAAM,CAACC,IAAI,IAClF;IAEJ,IAAIH,iBAAiB,OAAO;;QACxBT,UAAkB,CAACI,SAAS,GAAG;QACjC;IACF;IAEA,IAAI,CAAC,AAACJ,UAAkB,CAACI,SAAS,EAAE;;QAChCJ,UAAkB,CAACI,SAAS,GAAG,CAAC;IACpC;IAEA,MAAMS,YAAY,AAACb,UAAkB,CAACI,SAAS;IAE/C,IAAI,CAACS,UAAUC,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAG,CAAC;IACrB;IAEA,IAAIf,KAAKgB,KAAK,CAACD,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAGrB,eAAeoB,UAAUC,KAAK,EAAEf,KAAKgB,KAAK,CAACD,KAAK;IACpE;IAEAZ,SAASc,IAAI,CACXtB,mBAAmB;QACjBuB,kBAAkBZ;QAClBP;QACAG;QACAiB,iBAAiBC,MAAMC,OAAO,CAACrB,KAAKgB,KAAK,CAACM,UAAU;QACpDlB;QACA,qFAAqF;QACrFW,OAAOD,UAAUC,KAAK;IACxB;IAGF,IAAI,OAAOL,iBAAiB,UAAU;QACpCd,mBAAmB;YACjB2B,QAAQjB,qBAAqBkB,eAAe;YAC5CjB,SAASH,IAAIG,OAAO;YACpBQ,OAAOL;QACT;QACAI,UAAUC,KAAK,GAAGrB,eAAeoB,UAAUC,KAAK,EAAEL;IACpD;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMe,oBAAoB,OAAO,EACtCP,gBAAgB,EAChBQ,OAAOzB,UAAU,EACjBC,cAAc,EACdE,GAAG,EACE;IACL,IAAIH,eAAe,OAAO;QACxB,OAAO;IACT;IAEA,IAAI,CAACA,YAAY;QACfA,aAAa,CAAC;IAChB;IAEA,MAAMF,SAA6B,EAAE;IACrC,MAAMI,WAA4B,EAAE;IAEpC,IAAK,MAAML,kBAAkBoB,iBAAiBQ,KAAK,CAAE;QACnD,KAAK,MAAM1B,QAAQkB,iBAAiBQ,KAAK,CAAC5B,eAAe,CAAG;YAC1D,MAAMD,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,KAAK,MAAMJ,QAAQkB,iBAAiBS,gBAAgB,CAAE;QACpD,KAAK,MAAM7B,kBAAkBE,KAAKgB,KAAK,CAACM,UAAU,CAAE;YAClD,MAAMzB,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,MAAMwB,QAAQC,GAAG,CAAC1B;IAElB,IAAIJ,OAAO+B,MAAM,GAAG,GAAG;QACrB,MAAM,IAAIrC,WAAWM;IACvB;IAEA,OAAOE;AACT,EAAC"}
+{"version":3,"sources":["../../src/database/sanitizeJoinQuery.ts"],"sourcesContent":["import type { SanitizedCollectionConfig, SanitizedJoin } from '../collections/config/types.js'\nimport type { JoinQuery, PayloadRequest } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { QueryError } from '../errors/QueryError.js'\nimport { combineQueries } from './combineQueries.js'\nimport { validateQueryPaths } from './queryValidation/validateQueryPaths.js'\nimport { validateSortQuery } from './queryValidation/validateSortQuery.js'\nimport { sanitizeWhereQuery } from './sanitizeWhereQuery.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  joins?: JoinQuery\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\nconst sanitizeJoinFieldQuery = async ({\n  collectionSlug,\n  errors,\n  join,\n  joinsQuery,\n  overrideAccess,\n  promises,\n  req,\n}: {\n  collectionSlug: string\n  errors: { path: string }[]\n  join: SanitizedJoin\n  joinsQuery: JoinQuery\n  overrideAccess: boolean\n  promises: Promise<void>[]\n  req: PayloadRequest\n}) => {\n  const { joinPath } = join\n\n  // TODO: fix any's in joinsQuery[joinPath]\n\n  if ((joinsQuery as any)[joinPath] === false) {\n    return\n  }\n\n  const joinCollectionConfig = req.payload.collections[collectionSlug]!.config\n\n  const accessResult = !overrideAccess\n    ? await executeAccess({ disableErrors: true, req }, joinCollectionConfig.access.read)\n    : true\n\n  if (accessResult === false) {\n    ;(joinsQuery as any)[joinPath] = false\n    return\n  }\n\n  if (!(joinsQuery as any)[joinPath]) {\n    ;(joinsQuery as any)[joinPath] = {}\n  }\n\n  const joinQuery = (joinsQuery as any)[joinPath]\n\n  if (!joinQuery.where) {\n    joinQuery.where = {}\n  }\n\n  if (join.field.where) {\n    joinQuery.where = combineQueries(joinQuery.where, join.field.where)\n  }\n\n  promises.push(\n    validateQueryPaths({\n      collectionConfig: joinCollectionConfig,\n      errors,\n      overrideAccess,\n      polymorphicJoin: Array.isArray(join.field.collection),\n      req,\n      // incoming where input, but we shouldn't validate generated from the access control.\n      where: joinQuery.where,\n    }),\n    validateSortQuery({\n      collectionConfig: joinCollectionConfig,\n      overrideAccess,\n      req,\n      sort: joinQuery.sort || join.field.defaultSort || joinCollectionConfig.defaultSort,\n    }),\n  )\n\n  if (typeof accessResult === 'object') {\n    sanitizeWhereQuery({\n      fields: joinCollectionConfig.flattenedFields,\n      payload: req.payload,\n      where: accessResult,\n    })\n    joinQuery.where = combineQueries(joinQuery.where, accessResult)\n  }\n}\n\n/**\n * * Validates `where` for each join\n * * Combines the access result for joined collection\n * * Combines the default join's `where`\n */\nexport const sanitizeJoinQuery = async ({\n  collectionConfig,\n  joins: joinsQuery,\n  overrideAccess,\n  req,\n}: Args) => {\n  if (joinsQuery === false) {\n    return false\n  }\n\n  if (!joinsQuery) {\n    joinsQuery = {}\n  }\n\n  const errors: { path: string }[] = []\n  const promises: Promise<void>[] = []\n\n  for (const collectionSlug in collectionConfig.joins) {\n    for (const join of collectionConfig.joins[collectionSlug]!) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  for (const join of collectionConfig.polymorphicJoins) {\n    for (const collectionSlug of join.field.collection) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  await Promise.all(promises)\n\n  if (errors.length > 0) {\n    throw new QueryError(errors)\n  }\n\n  return joinsQuery\n}\n"],"names":["executeAccess","QueryError","combineQueries","validateQueryPaths","validateSortQuery","sanitizeWhereQuery","sanitizeJoinFieldQuery","collectionSlug","errors","join","joinsQuery","overrideAccess","promises","req","joinPath","joinCollectionConfig","payload","collections","config","accessResult","disableErrors","access","read","joinQuery","where","field","push","collectionConfig","polymorphicJoin","Array","isArray","collection","sort","defaultSort","fields","flattenedFields","sanitizeJoinQuery","joins","polymorphicJoins","Promise","all","length"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,UAAU,QAAQ,0BAAyB;AACpD,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,kBAAkB,QAAQ,0CAAyC;AAC5E,SAASC,iBAAiB,QAAQ,yCAAwC;AAC1E,SAASC,kBAAkB,QAAQ,0BAAyB;AAS5D,MAAMC,yBAAyB,OAAO,EACpCC,cAAc,EACdC,MAAM,EACNC,IAAI,EACJC,UAAU,EACVC,cAAc,EACdC,QAAQ,EACRC,GAAG,EASJ;IACC,MAAM,EAAEC,QAAQ,EAAE,GAAGL;IAErB,0CAA0C;IAE1C,IAAI,AAACC,UAAkB,CAACI,SAAS,KAAK,OAAO;QAC3C;IACF;IAEA,MAAMC,uBAAuBF,IAAIG,OAAO,CAACC,WAAW,CAACV,eAAe,CAAEW,MAAM;IAE5E,MAAMC,eAAe,CAACR,iBAClB,MAAMX,cAAc;QAAEoB,eAAe;QAAMP;IAAI,GAAGE,qBAAqBM,MAAM,CAACC,IAAI,IAClF;IAEJ,IAAIH,iBAAiB,OAAO;;QACxBT,UAAkB,CAACI,SAAS,GAAG;QACjC;IACF;IAEA,IAAI,CAAC,AAACJ,UAAkB,CAACI,SAAS,EAAE;;QAChCJ,UAAkB,CAACI,SAAS,GAAG,CAAC;IACpC;IAEA,MAAMS,YAAY,AAACb,UAAkB,CAACI,SAAS;IAE/C,IAAI,CAACS,UAAUC,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAG,CAAC;IACrB;IAEA,IAAIf,KAAKgB,KAAK,CAACD,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAGtB,eAAeqB,UAAUC,KAAK,EAAEf,KAAKgB,KAAK,CAACD,KAAK;IACpE;IAEAZ,SAASc,IAAI,CACXvB,mBAAmB;QACjBwB,kBAAkBZ;QAClBP;QACAG;QACAiB,iBAAiBC,MAAMC,OAAO,CAACrB,KAAKgB,KAAK,CAACM,UAAU;QACpDlB;QACA,qFAAqF;QACrFW,OAAOD,UAAUC,KAAK;IACxB,IACApB,kBAAkB;QAChBuB,kBAAkBZ;QAClBJ;QACAE;QACAmB,MAAMT,UAAUS,IAAI,IAAIvB,KAAKgB,KAAK,CAACQ,WAAW,IAAIlB,qBAAqBkB,WAAW;IACpF;IAGF,IAAI,OAAOd,iBAAiB,UAAU;QACpCd,mBAAmB;YACjB6B,QAAQnB,qBAAqBoB,eAAe;YAC5CnB,SAASH,IAAIG,OAAO;YACpBQ,OAAOL;QACT;QACAI,UAAUC,KAAK,GAAGtB,eAAeqB,UAAUC,KAAK,EAAEL;IACpD;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMiB,oBAAoB,OAAO,EACtCT,gBAAgB,EAChBU,OAAO3B,UAAU,EACjBC,cAAc,EACdE,GAAG,EACE;IACL,IAAIH,eAAe,OAAO;QACxB,OAAO;IACT;IAEA,IAAI,CAACA,YAAY;QACfA,aAAa,CAAC;IAChB;IAEA,MAAMF,SAA6B,EAAE;IACrC,MAAMI,WAA4B,EAAE;IAEpC,IAAK,MAAML,kBAAkBoB,iBAAiBU,KAAK,CAAE;QACnD,KAAK,MAAM5B,QAAQkB,iBAAiBU,KAAK,CAAC9B,eAAe,CAAG;YAC1D,MAAMD,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,KAAK,MAAMJ,QAAQkB,iBAAiBW,gBAAgB,CAAE;QACpD,KAAK,MAAM/B,kBAAkBE,KAAKgB,KAAK,CAACM,UAAU,CAAE;YAClD,MAAMzB,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,MAAM0B,QAAQC,GAAG,CAAC5B;IAElB,IAAIJ,OAAOiC,MAAM,GAAG,GAAG;QACrB,MAAM,IAAIxC,WAAWO;IACvB;IAEA,OAAOE;AACT,EAAC"}

package/dist/globals/operations/findVersions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findVersions.d.ts","sourceRoot":"","sources":["../../../src/globals/operations/findVersions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAA;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAY/D,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,qBAAqB,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAA;AAEnD,eAAO,MAAM,qBAAqB,GAAU,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,QAChE,SAAS,KACd,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAiJ1B,CAAA"}
+{"version":3,"file":"findVersions.d.ts","sourceRoot":"","sources":["../../../src/globals/operations/findVersions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAA;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAa/D,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,qBAAqB,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAA;AAEnD,eAAO,MAAM,qBAAqB,GAAU,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,QAChE,SAAS,KACd,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAyJ1B,CAAA"}

package/dist/globals/operations/findVersions.js

@@ -1,6 +1,7 @@
 import { executeAccess } from '../../auth/executeAccess.js';
 import { combineQueries } from '../../database/combineQueries.js';
 import { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js';
+import { validateSortQuery } from '../../database/queryValidation/validateSortQuery.js';
 import { afterRead } from '../../fields/hooks/afterRead/index.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 import { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js';
@@ -26,6 +27,13 @@ export const findVersionsOperation = async (args)=>{
             versionFields,
             where: where
         });
+        await validateSortQuery({
+            globalConfig,
+            overrideAccess: overrideAccess,
+            req,
+            sort,
+            versionFields
+        });
         const fullWhere = combineQueries(where, accessResults);
         const select = sanitizeSelect({
             fields: buildVersionGlobalFields(payload.config, globalConfig, true),

package/dist/globals/operations/findVersions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/globals/operations/findVersions.ts"],"sourcesContent":["import type { FindOptions } from '../../collections/operations/local/find.js'\nimport type { PaginatedDocs } from '../../database/types.js'\nimport type { PayloadRequest, PopulateType, SelectType, Sort, Where } from '../../types/index.js'\nimport type { TypeWithVersion } from '../../versions/types.js'\nimport type { SanitizedGlobalConfig } from '../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { combineQueries } from '../../database/combineQueries.js'\nimport { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'\nimport { afterRead } from '../../fields/hooks/afterRead/index.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js'\nimport { sanitizeSelect } from '../../utilities/sanitizeSelect.js'\nimport { buildVersionGlobalFields } from '../../versions/buildGlobalFields.js'\nimport { getQueryDraftsSelect } from '../../versions/drafts/getQueryDraftsSelect.js'\n\nexport type Arguments = {\n  depth?: number\n  globalConfig: SanitizedGlobalConfig\n  limit?: number\n  overrideAccess?: boolean\n  page?: number\n  pagination?: boolean\n  populate?: PopulateType\n  req?: PayloadRequest\n  showHiddenFields?: boolean\n  sort?: Sort\n  where?: Where\n} & Pick<FindOptions<string, SelectType>, 'select'>\n\nexport const findVersionsOperation = async <T extends TypeWithVersion<T>>(\n  args: Arguments,\n): Promise<PaginatedDocs<T>> => {\n  const {\n    depth,\n    globalConfig,\n    limit,\n    overrideAccess,\n    page,\n    pagination = true,\n    populate,\n    select: incomingSelect,\n    showHiddenFields,\n    sort,\n    where,\n  } = args\n  const req = args.req!\n  const { fallbackLocale, locale, payload } = req\n\n  const versionFields = buildVersionGlobalFields(payload.config, globalConfig, true)\n\n  try {\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    const accessResults = !overrideAccess\n      ? await executeAccess({ req }, globalConfig.access.readVersions)\n      : true\n\n    await validateQueryPaths({\n      globalConfig,\n      overrideAccess: overrideAccess!,\n      req,\n      versionFields,\n      where: where!,\n    })\n\n    const fullWhere = combineQueries(where!, accessResults)\n\n    const select = sanitizeSelect({\n      fields: buildVersionGlobalFields(payload.config, globalConfig, true),\n      forceSelect: getQueryDraftsSelect({ select: globalConfig.forceSelect }),\n      select: incomingSelect,\n      versions: true,\n    })\n\n    // /////////////////////////////////////\n    // Find\n    // /////////////////////////////////////\n\n    const usePagination = pagination && limit !== 0\n    const sanitizedLimit = limit ?? (usePagination ? 10 : 0)\n    const sanitizedPage = page || 1\n\n    const paginatedDocs = await payload.db.findGlobalVersions<T>({\n      global: globalConfig.slug,\n      limit: sanitizedLimit,\n      locale: locale!,\n      page: sanitizedPage,\n      pagination,\n      req,\n      select,\n      sort,\n      where: fullWhere,\n    })\n\n    // /////////////////////////////////////\n    // afterRead - Fields\n    // /////////////////////////////////////\n\n    let result = {\n      ...paginatedDocs,\n      docs: await Promise.all(\n        paginatedDocs.docs.map(async (data) => {\n          if (!data.version) {\n            // Fallback if not selected\n            ;(data as any).version = {}\n          }\n          return {\n            ...data,\n            version: await afterRead<T>({\n              collection: null,\n              context: req.context,\n              depth: depth!,\n              doc: {\n                ...data.version,\n                // Patch globalType onto version doc\n                globalType: globalConfig.slug,\n              },\n              draft: undefined!,\n              fallbackLocale: fallbackLocale!,\n              findMany: true,\n              global: globalConfig,\n              locale: locale!,\n              overrideAccess: overrideAccess!,\n              populate,\n              req,\n              select,\n              showHiddenFields: showHiddenFields!,\n            }),\n          }\n        }),\n      ),\n    } as PaginatedDocs<T>\n\n    // /////////////////////////////////////\n    // afterRead - Global\n    // /////////////////////////////////////\n\n    if (globalConfig.hooks?.afterRead?.length) {\n      result.docs = await Promise.all(\n        result.docs.map(async (doc) => {\n          const docRef = doc\n\n          for (const hook of globalConfig.hooks.afterRead) {\n            docRef.version =\n              (await hook({\n                context: req.context,\n                doc: doc.version,\n                findMany: true,\n                global: globalConfig,\n                overrideAccess,\n                query: fullWhere,\n                req,\n              })) || doc.version\n          }\n\n          return docRef\n        }),\n      )\n    }\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    result = {\n      ...result,\n      docs: result.docs.map((doc) => sanitizeInternalFields<T>(doc)),\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["executeAccess","combineQueries","validateQueryPaths","afterRead","killTransaction","sanitizeInternalFields","sanitizeSelect","buildVersionGlobalFields","getQueryDraftsSelect","findVersionsOperation","args","depth","globalConfig","limit","overrideAccess","page","pagination","populate","select","incomingSelect","showHiddenFields","sort","where","req","fallbackLocale","locale","payload","versionFields","config","accessResults","access","readVersions","fullWhere","fields","forceSelect","versions","usePagination","sanitizedLimit","sanitizedPage","paginatedDocs","db","findGlobalVersions","global","slug","result","docs","Promise","all","map","data","version","collection","context","doc","globalType","draft","undefined","findMany","hooks","length","docRef","hook","query","error"],"mappings":"AAMA,SAASA,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,cAAc,QAAQ,mCAAkC;AACjE,SAASC,kBAAkB,QAAQ,uDAAsD;AACzF,SAASC,SAAS,QAAQ,wCAAuC;AACjE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,wBAAwB,QAAQ,sCAAqC;AAC9E,SAASC,oBAAoB,QAAQ,gDAA+C;AAgBpF,OAAO,MAAMC,wBAAwB,OACnCC;IAEA,MAAM,EACJC,KAAK,EACLC,YAAY,EACZC,KAAK,EACLC,cAAc,EACdC,IAAI,EACJC,aAAa,IAAI,EACjBC,QAAQ,EACRC,QAAQC,cAAc,EACtBC,gBAAgB,EAChBC,IAAI,EACJC,KAAK,EACN,GAAGZ;IACJ,MAAMa,MAAMb,KAAKa,GAAG;IACpB,MAAM,EAAEC,cAAc,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGH;IAE5C,MAAMI,gBAAgBpB,yBAAyBmB,QAAQE,MAAM,EAAEhB,cAAc;IAE7E,IAAI;QACF,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,MAAMiB,gBAAgB,CAACf,iBACnB,MAAMd,cAAc;YAAEuB;QAAI,GAAGX,aAAakB,MAAM,CAACC,YAAY,IAC7D;QAEJ,MAAM7B,mBAAmB;YACvBU;YACAE,gBAAgBA;YAChBS;YACAI;YACAL,OAAOA;QACT;QAEA,MAAMU,YAAY/B,eAAeqB,OAAQO;QAEzC,MAAMX,SAASZ,eAAe;YAC5B2B,QAAQ1B,yBAAyBmB,QAAQE,MAAM,EAAEhB,cAAc;YAC/DsB,aAAa1B,qBAAqB;gBAAEU,QAAQN,aAAasB,WAAW;YAAC;YACrEhB,QAAQC;YACRgB,UAAU;QACZ;QAEA,wCAAwC;QACxC,OAAO;QACP,wCAAwC;QAExC,MAAMC,gBAAgBpB,cAAcH,UAAU;QAC9C,MAAMwB,iBAAiBxB,SAAUuB,CAAAA,gBAAgB,KAAK,CAAA;QACtD,MAAME,gBAAgBvB,QAAQ;QAE9B,MAAMwB,gBAAgB,MAAMb,QAAQc,EAAE,CAACC,kBAAkB,CAAI;YAC3DC,QAAQ9B,aAAa+B,IAAI;YACzB9B,OAAOwB;YACPZ,QAAQA;YACRV,MAAMuB;YACNtB;YACAO;YACAL;YACAG;YACAC,OAAOU;QACT;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,IAAIY,SAAS;YACX,GAAGL,aAAa;YAChBM,MAAM,MAAMC,QAAQC,GAAG,CACrBR,cAAcM,IAAI,CAACG,GAAG,CAAC,OAAOC;gBAC5B,IAAI,CAACA,KAAKC,OAAO,EAAE;oBACjB,2BAA2B;;oBACzBD,KAAaC,OAAO,GAAG,CAAC;gBAC5B;gBACA,OAAO;oBACL,GAAGD,IAAI;oBACPC,SAAS,MAAM/C,UAAa;wBAC1BgD,YAAY;wBACZC,SAAS7B,IAAI6B,OAAO;wBACpBzC,OAAOA;wBACP0C,KAAK;4BACH,GAAGJ,KAAKC,OAAO;4BACf,oCAAoC;4BACpCI,YAAY1C,aAAa+B,IAAI;wBAC/B;wBACAY,OAAOC;wBACPhC,gBAAgBA;wBAChBiC,UAAU;wBACVf,QAAQ9B;wBACRa,QAAQA;wBACRX,gBAAgBA;wBAChBG;wBACAM;wBACAL;wBACAE,kBAAkBA;oBACpB;gBACF;YACF;QAEJ;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,IAAIR,aAAa8C,KAAK,EAAEvD,WAAWwD,QAAQ;YACzCf,OAAOC,IAAI,GAAG,MAAMC,QAAQC,GAAG,CAC7BH,OAAOC,IAAI,CAACG,GAAG,CAAC,OAAOK;gBACrB,MAAMO,SAASP;gBAEf,KAAK,MAAMQ,QAAQjD,aAAa8C,KAAK,CAACvD,SAAS,CAAE;oBAC/CyD,OAAOV,OAAO,GACZ,AAAC,MAAMW,KAAK;wBACVT,SAAS7B,IAAI6B,OAAO;wBACpBC,KAAKA,IAAIH,OAAO;wBAChBO,UAAU;wBACVf,QAAQ9B;wBACRE;wBACAgD,OAAO9B;wBACPT;oBACF,MAAO8B,IAAIH,OAAO;gBACtB;gBAEA,OAAOU;YACT;QAEJ;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExChB,SAAS;YACP,GAAGA,MAAM;YACTC,MAAMD,OAAOC,IAAI,CAACG,GAAG,CAAC,CAACK,MAAQhD,uBAA0BgD;QAC3D;QAEA,OAAOT;IACT,EAAE,OAAOmB,OAAgB;QACvB,MAAM3D,gBAAgBmB;QACtB,MAAMwC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/globals/operations/findVersions.ts"],"sourcesContent":["import type { FindOptions } from '../../collections/operations/local/find.js'\nimport type { PaginatedDocs } from '../../database/types.js'\nimport type { PayloadRequest, PopulateType, SelectType, Sort, Where } from '../../types/index.js'\nimport type { TypeWithVersion } from '../../versions/types.js'\nimport type { SanitizedGlobalConfig } from '../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { combineQueries } from '../../database/combineQueries.js'\nimport { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'\nimport { validateSortQuery } from '../../database/queryValidation/validateSortQuery.js'\nimport { afterRead } from '../../fields/hooks/afterRead/index.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js'\nimport { sanitizeSelect } from '../../utilities/sanitizeSelect.js'\nimport { buildVersionGlobalFields } from '../../versions/buildGlobalFields.js'\nimport { getQueryDraftsSelect } from '../../versions/drafts/getQueryDraftsSelect.js'\n\nexport type Arguments = {\n  depth?: number\n  globalConfig: SanitizedGlobalConfig\n  limit?: number\n  overrideAccess?: boolean\n  page?: number\n  pagination?: boolean\n  populate?: PopulateType\n  req?: PayloadRequest\n  showHiddenFields?: boolean\n  sort?: Sort\n  where?: Where\n} & Pick<FindOptions<string, SelectType>, 'select'>\n\nexport const findVersionsOperation = async <T extends TypeWithVersion<T>>(\n  args: Arguments,\n): Promise<PaginatedDocs<T>> => {\n  const {\n    depth,\n    globalConfig,\n    limit,\n    overrideAccess,\n    page,\n    pagination = true,\n    populate,\n    select: incomingSelect,\n    showHiddenFields,\n    sort,\n    where,\n  } = args\n  const req = args.req!\n  const { fallbackLocale, locale, payload } = req\n\n  const versionFields = buildVersionGlobalFields(payload.config, globalConfig, true)\n\n  try {\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    const accessResults = !overrideAccess\n      ? await executeAccess({ req }, globalConfig.access.readVersions)\n      : true\n\n    await validateQueryPaths({\n      globalConfig,\n      overrideAccess: overrideAccess!,\n      req,\n      versionFields,\n      where: where!,\n    })\n\n    await validateSortQuery({\n      globalConfig,\n      overrideAccess: overrideAccess!,\n      req,\n      sort,\n      versionFields,\n    })\n\n    const fullWhere = combineQueries(where!, accessResults)\n\n    const select = sanitizeSelect({\n      fields: buildVersionGlobalFields(payload.config, globalConfig, true),\n      forceSelect: getQueryDraftsSelect({ select: globalConfig.forceSelect }),\n      select: incomingSelect,\n      versions: true,\n    })\n\n    // /////////////////////////////////////\n    // Find\n    // /////////////////////////////////////\n\n    const usePagination = pagination && limit !== 0\n    const sanitizedLimit = limit ?? (usePagination ? 10 : 0)\n    const sanitizedPage = page || 1\n\n    const paginatedDocs = await payload.db.findGlobalVersions<T>({\n      global: globalConfig.slug,\n      limit: sanitizedLimit,\n      locale: locale!,\n      page: sanitizedPage,\n      pagination,\n      req,\n      select,\n      sort,\n      where: fullWhere,\n    })\n\n    // /////////////////////////////////////\n    // afterRead - Fields\n    // /////////////////////////////////////\n\n    let result = {\n      ...paginatedDocs,\n      docs: await Promise.all(\n        paginatedDocs.docs.map(async (data) => {\n          if (!data.version) {\n            // Fallback if not selected\n            ;(data as any).version = {}\n          }\n          return {\n            ...data,\n            version: await afterRead<T>({\n              collection: null,\n              context: req.context,\n              depth: depth!,\n              doc: {\n                ...data.version,\n                // Patch globalType onto version doc\n                globalType: globalConfig.slug,\n              },\n              draft: undefined!,\n              fallbackLocale: fallbackLocale!,\n              findMany: true,\n              global: globalConfig,\n              locale: locale!,\n              overrideAccess: overrideAccess!,\n              populate,\n              req,\n              select,\n              showHiddenFields: showHiddenFields!,\n            }),\n          }\n        }),\n      ),\n    } as PaginatedDocs<T>\n\n    // /////////////////////////////////////\n    // afterRead - Global\n    // /////////////////////////////////////\n\n    if (globalConfig.hooks?.afterRead?.length) {\n      result.docs = await Promise.all(\n        result.docs.map(async (doc) => {\n          const docRef = doc\n\n          for (const hook of globalConfig.hooks.afterRead) {\n            docRef.version =\n              (await hook({\n                context: req.context,\n                doc: doc.version,\n                findMany: true,\n                global: globalConfig,\n                overrideAccess,\n                query: fullWhere,\n                req,\n              })) || doc.version\n          }\n\n          return docRef\n        }),\n      )\n    }\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    result = {\n      ...result,\n      docs: result.docs.map((doc) => sanitizeInternalFields<T>(doc)),\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["executeAccess","combineQueries","validateQueryPaths","validateSortQuery","afterRead","killTransaction","sanitizeInternalFields","sanitizeSelect","buildVersionGlobalFields","getQueryDraftsSelect","findVersionsOperation","args","depth","globalConfig","limit","overrideAccess","page","pagination","populate","select","incomingSelect","showHiddenFields","sort","where","req","fallbackLocale","locale","payload","versionFields","config","accessResults","access","readVersions","fullWhere","fields","forceSelect","versions","usePagination","sanitizedLimit","sanitizedPage","paginatedDocs","db","findGlobalVersions","global","slug","result","docs","Promise","all","map","data","version","collection","context","doc","globalType","draft","undefined","findMany","hooks","length","docRef","hook","query","error"],"mappings":"AAMA,SAASA,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,cAAc,QAAQ,mCAAkC;AACjE,SAASC,kBAAkB,QAAQ,uDAAsD;AACzF,SAASC,iBAAiB,QAAQ,sDAAqD;AACvF,SAASC,SAAS,QAAQ,wCAAuC;AACjE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,wBAAwB,QAAQ,sCAAqC;AAC9E,SAASC,oBAAoB,QAAQ,gDAA+C;AAgBpF,OAAO,MAAMC,wBAAwB,OACnCC;IAEA,MAAM,EACJC,KAAK,EACLC,YAAY,EACZC,KAAK,EACLC,cAAc,EACdC,IAAI,EACJC,aAAa,IAAI,EACjBC,QAAQ,EACRC,QAAQC,cAAc,EACtBC,gBAAgB,EAChBC,IAAI,EACJC,KAAK,EACN,GAAGZ;IACJ,MAAMa,MAAMb,KAAKa,GAAG;IACpB,MAAM,EAAEC,cAAc,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGH;IAE5C,MAAMI,gBAAgBpB,yBAAyBmB,QAAQE,MAAM,EAAEhB,cAAc;IAE7E,IAAI;QACF,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,MAAMiB,gBAAgB,CAACf,iBACnB,MAAMf,cAAc;YAAEwB;QAAI,GAAGX,aAAakB,MAAM,CAACC,YAAY,IAC7D;QAEJ,MAAM9B,mBAAmB;YACvBW;YACAE,gBAAgBA;YAChBS;YACAI;YACAL,OAAOA;QACT;QAEA,MAAMpB,kBAAkB;YACtBU;YACAE,gBAAgBA;YAChBS;YACAF;YACAM;QACF;QAEA,MAAMK,YAAYhC,eAAesB,OAAQO;QAEzC,MAAMX,SAASZ,eAAe;YAC5B2B,QAAQ1B,yBAAyBmB,QAAQE,MAAM,EAAEhB,cAAc;YAC/DsB,aAAa1B,qBAAqB;gBAAEU,QAAQN,aAAasB,WAAW;YAAC;YACrEhB,QAAQC;YACRgB,UAAU;QACZ;QAEA,wCAAwC;QACxC,OAAO;QACP,wCAAwC;QAExC,MAAMC,gBAAgBpB,cAAcH,UAAU;QAC9C,MAAMwB,iBAAiBxB,SAAUuB,CAAAA,gBAAgB,KAAK,CAAA;QACtD,MAAME,gBAAgBvB,QAAQ;QAE9B,MAAMwB,gBAAgB,MAAMb,QAAQc,EAAE,CAACC,kBAAkB,CAAI;YAC3DC,QAAQ9B,aAAa+B,IAAI;YACzB9B,OAAOwB;YACPZ,QAAQA;YACRV,MAAMuB;YACNtB;YACAO;YACAL;YACAG;YACAC,OAAOU;QACT;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,IAAIY,SAAS;YACX,GAAGL,aAAa;YAChBM,MAAM,MAAMC,QAAQC,GAAG,CACrBR,cAAcM,IAAI,CAACG,GAAG,CAAC,OAAOC;gBAC5B,IAAI,CAACA,KAAKC,OAAO,EAAE;oBACjB,2BAA2B;;oBACzBD,KAAaC,OAAO,GAAG,CAAC;gBAC5B;gBACA,OAAO;oBACL,GAAGD,IAAI;oBACPC,SAAS,MAAM/C,UAAa;wBAC1BgD,YAAY;wBACZC,SAAS7B,IAAI6B,OAAO;wBACpBzC,OAAOA;wBACP0C,KAAK;4BACH,GAAGJ,KAAKC,OAAO;4BACf,oCAAoC;4BACpCI,YAAY1C,aAAa+B,IAAI;wBAC/B;wBACAY,OAAOC;wBACPhC,gBAAgBA;wBAChBiC,UAAU;wBACVf,QAAQ9B;wBACRa,QAAQA;wBACRX,gBAAgBA;wBAChBG;wBACAM;wBACAL;wBACAE,kBAAkBA;oBACpB;gBACF;YACF;QAEJ;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,IAAIR,aAAa8C,KAAK,EAAEvD,WAAWwD,QAAQ;YACzCf,OAAOC,IAAI,GAAG,MAAMC,QAAQC,GAAG,CAC7BH,OAAOC,IAAI,CAACG,GAAG,CAAC,OAAOK;gBACrB,MAAMO,SAASP;gBAEf,KAAK,MAAMQ,QAAQjD,aAAa8C,KAAK,CAACvD,SAAS,CAAE;oBAC/CyD,OAAOV,OAAO,GACZ,AAAC,MAAMW,KAAK;wBACVT,SAAS7B,IAAI6B,OAAO;wBACpBC,KAAKA,IAAIH,OAAO;wBAChBO,UAAU;wBACVf,QAAQ9B;wBACRE;wBACAgD,OAAO9B;wBACPT;oBACF,MAAO8B,IAAIH,OAAO;gBACtB;gBAEA,OAAOU;YACT;QAEJ;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExChB,SAAS;YACP,GAAGA,MAAM;YACTC,MAAMD,OAAOC,IAAI,CAACG,GAAG,CAAC,CAACK,MAAQhD,uBAA0BgD;QAC3D;QAEA,OAAOT;IACT,EAAE,OAAOmB,OAAgB;QACvB,MAAM3D,gBAAgBmB;QACtB,MAAMwC;IACR;AACF,EAAC"}

package/dist/index.js

@@ -424,7 +424,7 @@ let checkedDependencies = false;
                     authStrategies.push(...collection.auth.strategies);
                 }
                 // 2. if api key enabled, push api key strategy into the array
-                if (collection.auth?.useAPIKey) {
+                if (collection.auth?.useAPIKey && collection.slug !== 'payload-mcp-api-keys') {
                     authStrategies.push({
                         name: `${collection.slug}-api-key`,
                         authenticate: APIKeyAuthentication(collection)