payload 3.89.0-internal.95c9cba → 3.90.0

package/dist/uploads/getExternalFile.js

@@ -1,28 +1,73 @@
 import { APIError } from '../errors/index.js';
+import { getRequestOrigin } from '../utilities/getRequestOrigin.js';
 import { isURLAllowed } from '../utilities/isURLAllowed.js';
 import { safeFetch } from './safeFetch.js';
+const hasProtocol = (url)=>/^[a-z][a-z\d+.-]*:/i.test(url);
+const validateFileURL = (url)=>{
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new APIError('External file URLs must use HTTP or HTTPS.', 400);
+    }
+    return url;
+};
+const parseFileURL = (url, base)=>{
+    try {
+        return validateFileURL(new URL(url, base));
+    } catch (error) {
+        if (error instanceof APIError) {
+            throw error;
+        }
+        throw new APIError('Invalid external file URL.', 400);
+    }
+};
+const getRequestBaseURL = (req)=>{
+    try {
+        const requestURL = validateFileURL(new URL(req.url));
+        const host = req.headers.get('host') || requestURL.host;
+        return validateFileURL(new URL(`${requestURL.protocol}//${host}`));
+    } catch  {
+        return undefined;
+    }
+};
 export const getExternalFile = async ({ data, req, uploadConfig })=>{
     const { filename, url } = data;
-    let trimAuthCookies = true;
     if (typeof url === 'string') {
-        let fileURL = url;
-        if (!url.startsWith('http')) {
-            // URL points to the same server - we can send any cookies safely to our server.
-            trimAuthCookies = false;
-            const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`;
-            fileURL = `${baseUrl}${url}`;
-        }
-        let cookies = (req.headers.get('cookie') ?? '').split(';');
-        if (trimAuthCookies) {
-            cookies = cookies.filter((cookie)=>!cookie.trim().startsWith(req.payload.config.cookiePrefix));
+        let baseOrigin;
+        let parsedFileURL;
+        if (hasProtocol(url)) {
+            parsedFileURL = parseFileURL(url);
+        } else {
+            const requestOrigin = getRequestOrigin({
+                config: req.payload.config,
+                req
+            });
+            let requestBaseURL;
+            if (requestOrigin) {
+                requestBaseURL = parseFileURL(requestOrigin);
+                baseOrigin = requestBaseURL.origin;
+            } else {
+                requestBaseURL = getRequestBaseURL(req);
+            }
+            if (!requestBaseURL) {
+                throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400);
+            }
+            parsedFileURL = parseFileURL(url, requestBaseURL);
         }
-        const headers = uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers))) : {
-            cookie: cookies.join(';')
-        };
+        let fileURL = parsedFileURL.toString();
+        const requestHeaders = Object.fromEntries(new Headers(req.headers));
+        const cookies = (req.headers.get('cookie') ?? '').split(';');
         let res;
         let redirectCount = 0;
         const maxRedirects = 3;
         while(redirectCount <= maxRedirects){
+            const isSameOrigin = Boolean(baseOrigin && new URL(fileURL).origin === baseOrigin);
+            const headers = uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter({
+                ...requestHeaders
+            }, {
+                isSameOrigin,
+                url: fileURL
+            }) : {
+                cookie: cookies.filter((cookie)=>isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix)).join(';')
+            };
             const skipSafeFetch = uploadConfig.skipSafeFetch === true ? uploadConfig.skipSafeFetch : Array.isArray(uploadConfig.skipSafeFetch) && isURLAllowed(fileURL, uploadConfig.skipSafeFetch);
             const isAllowedPasteUrl = uploadConfig.pasteURL && uploadConfig.pasteURL.allowList && isURLAllowed(fileURL, uploadConfig.pasteURL.allowList);
             if (skipSafeFetch || isAllowedPasteUrl) {
@@ -47,7 +92,7 @@ export const getExternalFile = async ({ data, req, uploadConfig })=>{
                 }
                 const location = res.headers.get('location');
                 if (location) {
-                    fileURL = new URL(location, fileURL).toString();
+                    fileURL = parseFileURL(location, new URL(fileURL)).toString();
                     if (uploadConfig.pasteURL && uploadConfig.pasteURL.allowList && !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)) {
                         throw new APIError('Redirect target is not allowed.', 400);
                     }

package/dist/uploads/getExternalFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getExternalFile.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { isURLAllowed } from '../utilities/isURLAllowed.js'\nimport { safeFetch } from './safeFetch.js'\n\ntype Args = {\n  data: FileData\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\nexport const getExternalFile = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  let trimAuthCookies = true\n  if (typeof url === 'string') {\n    let fileURL = url\n    if (!url.startsWith('http')) {\n      // URL points to the same server - we can send any cookies safely to our server.\n      trimAuthCookies = false\n      const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`\n      fileURL = `${baseUrl}${url}`\n    }\n\n    let cookies = (req.headers.get('cookie') ?? '').split(';')\n\n    if (trimAuthCookies) {\n      cookies = cookies.filter(\n        (cookie) => !cookie.trim().startsWith(req.payload.config.cookiePrefix),\n      )\n    }\n\n    const headers = uploadConfig.externalFileHeaderFilter\n      ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers)))\n      : {\n          cookie: cookies.join(';'),\n        }\n\n    let res\n    let redirectCount = 0\n    const maxRedirects = 3\n\n    while (redirectCount <= maxRedirects) {\n      const skipSafeFetch: boolean =\n        uploadConfig.skipSafeFetch === true\n          ? uploadConfig.skipSafeFetch\n          : Array.isArray(uploadConfig.skipSafeFetch) &&\n            isURLAllowed(fileURL, uploadConfig.skipSafeFetch)\n\n      const isAllowedPasteUrl: boolean | undefined =\n        uploadConfig.pasteURL &&\n        uploadConfig.pasteURL.allowList &&\n        isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n\n      if (skipSafeFetch || isAllowedPasteUrl) {\n        res = await fetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n          redirect: 'manual',\n        })\n      } else {\n        // Default\n        res = await safeFetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n        })\n      }\n\n      if (res.status >= 300 && res.status < 400) {\n        redirectCount++\n        if (redirectCount > maxRedirects) {\n          throw new APIError(`Too many redirects (max ${maxRedirects})`, 403)\n        }\n        const location = res.headers.get('location')\n        if (location) {\n          fileURL = new URL(location, fileURL).toString()\n          if (\n            uploadConfig.pasteURL &&\n            uploadConfig.pasteURL.allowList &&\n            !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n          ) {\n            throw new APIError('Redirect target is not allowed.', 400)\n          }\n          continue\n        }\n      }\n\n      break\n    }\n\n    if (!res || !res.ok) {\n      throw new APIError(`Failed to fetch file from ${fileURL}`, res?.status)\n    }\n\n    const data = await res.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: res.headers.get('content-type') || undefined!,\n      size: Number(res.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","isURLAllowed","safeFetch","getExternalFile","data","req","uploadConfig","filename","url","trimAuthCookies","fileURL","startsWith","baseUrl","headers","get","protocol","cookies","split","filter","cookie","trim","payload","config","cookiePrefix","externalFileHeaderFilter","Object","fromEntries","Headers","join","res","redirectCount","maxRedirects","skipSafeFetch","Array","isArray","isAllowedPasteUrl","pasteURL","allowList","fetch","credentials","method","redirect","status","location","URL","toString","ok","arrayBuffer","name","Buffer","from","mimetype","undefined","size","Number"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,SAAS,QAAQ,iBAAgB;AAO1C,OAAO,MAAMC,kBAAkB,OAAO,EAAEC,IAAI,EAAEC,GAAG,EAAEC,YAAY,EAAQ;IACrE,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAE,GAAGJ;IAE1B,IAAIK,kBAAkB;IACtB,IAAI,OAAOD,QAAQ,UAAU;QAC3B,IAAIE,UAAUF;QACd,IAAI,CAACA,IAAIG,UAAU,CAAC,SAAS;YAC3B,gFAAgF;YAChFF,kBAAkB;YAClB,MAAMG,UAAUP,IAAIQ,OAAO,CAACC,GAAG,CAAC,aAAa,GAAGT,IAAIU,QAAQ,CAAC,GAAG,EAAEV,IAAIQ,OAAO,CAACC,GAAG,CAAC,SAAS;YAC3FJ,UAAU,GAAGE,UAAUJ,KAAK;QAC9B;QAEA,IAAIQ,UAAU,AAACX,CAAAA,IAAIQ,OAAO,CAACC,GAAG,CAAC,aAAa,EAAC,EAAGG,KAAK,CAAC;QAEtD,IAAIR,iBAAiB;YACnBO,UAAUA,QAAQE,MAAM,CACtB,CAACC,SAAW,CAACA,OAAOC,IAAI,GAAGT,UAAU,CAACN,IAAIgB,OAAO,CAACC,MAAM,CAACC,YAAY;QAEzE;QAEA,MAAMV,UAAUP,aAAakB,wBAAwB,GACjDlB,aAAakB,wBAAwB,CAACC,OAAOC,WAAW,CAAC,IAAIC,QAAQtB,IAAIQ,OAAO,MAChF;YACEM,QAAQH,QAAQY,IAAI,CAAC;QACvB;QAEJ,IAAIC;QACJ,IAAIC,gBAAgB;QACpB,MAAMC,eAAe;QAErB,MAAOD,iBAAiBC,aAAc;YACpC,MAAMC,gBACJ1B,aAAa0B,aAAa,KAAK,OAC3B1B,aAAa0B,aAAa,GAC1BC,MAAMC,OAAO,CAAC5B,aAAa0B,aAAa,KACxC/B,aAAaS,SAASJ,aAAa0B,aAAa;YAEtD,MAAMG,oBACJ7B,aAAa8B,QAAQ,IACrB9B,aAAa8B,QAAQ,CAACC,SAAS,IAC/BpC,aAAaS,SAASJ,aAAa8B,QAAQ,CAACC,SAAS;YAEvD,IAAIL,iBAAiBG,mBAAmB;gBACtCN,MAAM,MAAMS,MAAM5B,SAAS;oBACzB6B,aAAa;oBACb1B;oBACA2B,QAAQ;oBACRC,UAAU;gBACZ;YACF,OAAO;gBACL,UAAU;gBACVZ,MAAM,MAAM3B,UAAUQ,SAAS;oBAC7B6B,aAAa;oBACb1B;oBACA2B,QAAQ;gBACV;YACF;YAEA,IAAIX,IAAIa,MAAM,IAAI,OAAOb,IAAIa,MAAM,GAAG,KAAK;gBACzCZ;gBACA,IAAIA,gBAAgBC,cAAc;oBAChC,MAAM,IAAI/B,SAAS,CAAC,wBAAwB,EAAE+B,aAAa,CAAC,CAAC,EAAE;gBACjE;gBACA,MAAMY,WAAWd,IAAIhB,OAAO,CAACC,GAAG,CAAC;gBACjC,IAAI6B,UAAU;oBACZjC,UAAU,IAAIkC,IAAID,UAAUjC,SAASmC,QAAQ;oBAC7C,IACEvC,aAAa8B,QAAQ,IACrB9B,aAAa8B,QAAQ,CAACC,SAAS,IAC/B,CAACpC,aAAaS,SAASJ,aAAa8B,QAAQ,CAACC,SAAS,GACtD;wBACA,MAAM,IAAIrC,SAAS,mCAAmC;oBACxD;oBACA;gBACF;YACF;YAEA;QACF;QAEA,IAAI,CAAC6B,OAAO,CAACA,IAAIiB,EAAE,EAAE;YACnB,MAAM,IAAI9C,SAAS,CAAC,0BAA0B,EAAEU,SAAS,EAAEmB,KAAKa;QAClE;QAEA,MAAMtC,OAAO,MAAMyB,IAAIkB,WAAW;QAElC,OAAO;YACLC,MAAMzC;YACNH,MAAM6C,OAAOC,IAAI,CAAC9C;YAClB+C,UAAUtB,IAAIhB,OAAO,CAACC,GAAG,CAAC,mBAAmBsC;YAC7CC,MAAMC,OAAOzB,IAAIhB,OAAO,CAACC,GAAG,CAAC,sBAAsB;QACrD;IACF;IAEA,MAAM,IAAId,SAAS,oBAAoB;AACzC,EAAC"}
+{"version":3,"sources":["../../src/uploads/getExternalFile.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { getRequestOrigin } from '../utilities/getRequestOrigin.js'\nimport { isURLAllowed } from '../utilities/isURLAllowed.js'\nimport { safeFetch } from './safeFetch.js'\n\ntype Args = {\n  data: Pick<FileData, 'filename' | 'url'>\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\n\nconst hasProtocol = (url: string): boolean => /^[a-z][a-z\\d+.-]*:/i.test(url)\n\nconst validateFileURL = (url: URL): URL => {\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    throw new APIError('External file URLs must use HTTP or HTTPS.', 400)\n  }\n\n  return url\n}\n\nconst parseFileURL = (url: string, base?: URL): URL => {\n  try {\n    return validateFileURL(new URL(url, base))\n  } catch (error) {\n    if (error instanceof APIError) {\n      throw error\n    }\n\n    throw new APIError('Invalid external file URL.', 400)\n  }\n}\n\nconst getRequestBaseURL = (req: PayloadRequest): undefined | URL => {\n  try {\n    const requestURL = validateFileURL(new URL(req.url!))\n    const host = req.headers.get('host') || requestURL.host\n\n    return validateFileURL(new URL(`${requestURL.protocol}//${host}`))\n  } catch {\n    return undefined\n  }\n}\n\nexport const getExternalFile = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  if (typeof url === 'string') {\n    let baseOrigin: string | undefined\n    let parsedFileURL: URL\n\n    if (hasProtocol(url)) {\n      parsedFileURL = parseFileURL(url)\n    } else {\n      const requestOrigin = getRequestOrigin({ config: req.payload.config, req })\n      let requestBaseURL: undefined | URL\n\n      if (requestOrigin) {\n        requestBaseURL = parseFileURL(requestOrigin)\n        baseOrigin = requestBaseURL.origin\n      } else {\n        requestBaseURL = getRequestBaseURL(req)\n      }\n\n      if (!requestBaseURL) {\n        throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400)\n      }\n\n      parsedFileURL = parseFileURL(url, requestBaseURL)\n    }\n\n    let fileURL = parsedFileURL.toString()\n    const requestHeaders = Object.fromEntries(new Headers(req.headers))\n    const cookies = (req.headers.get('cookie') ?? '').split(';')\n\n    let res\n    let redirectCount = 0\n    const maxRedirects = 3\n\n    while (redirectCount <= maxRedirects) {\n      const isSameOrigin = Boolean(baseOrigin && new URL(fileURL).origin === baseOrigin)\n      const headers = uploadConfig.externalFileHeaderFilter\n        ? uploadConfig.externalFileHeaderFilter(\n            { ...requestHeaders },\n            { isSameOrigin, url: fileURL },\n          )\n        : {\n            cookie: cookies\n              .filter(\n                (cookie) =>\n                  isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix),\n              )\n              .join(';'),\n          }\n\n      const skipSafeFetch: boolean =\n        uploadConfig.skipSafeFetch === true\n          ? uploadConfig.skipSafeFetch\n          : Array.isArray(uploadConfig.skipSafeFetch) &&\n            isURLAllowed(fileURL, uploadConfig.skipSafeFetch)\n\n      const isAllowedPasteUrl: boolean | undefined =\n        uploadConfig.pasteURL &&\n        uploadConfig.pasteURL.allowList &&\n        isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n\n      if (skipSafeFetch || isAllowedPasteUrl) {\n        res = await fetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n          redirect: 'manual',\n        })\n      } else {\n        // Default\n        res = await safeFetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n        })\n      }\n\n      if (res.status >= 300 && res.status < 400) {\n        redirectCount++\n        if (redirectCount > maxRedirects) {\n          throw new APIError(`Too many redirects (max ${maxRedirects})`, 403)\n        }\n        const location = res.headers.get('location')\n        if (location) {\n          fileURL = parseFileURL(location, new URL(fileURL)).toString()\n          if (\n            uploadConfig.pasteURL &&\n            uploadConfig.pasteURL.allowList &&\n            !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n          ) {\n            throw new APIError('Redirect target is not allowed.', 400)\n          }\n          continue\n        }\n      }\n\n      break\n    }\n\n    if (!res || !res.ok) {\n      throw new APIError(`Failed to fetch file from ${fileURL}`, res?.status)\n    }\n\n    const data = await res.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: res.headers.get('content-type') || undefined!,\n      size: Number(res.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","getRequestOrigin","isURLAllowed","safeFetch","hasProtocol","url","test","validateFileURL","protocol","parseFileURL","base","URL","error","getRequestBaseURL","req","requestURL","host","headers","get","undefined","getExternalFile","data","uploadConfig","filename","baseOrigin","parsedFileURL","requestOrigin","config","payload","requestBaseURL","origin","fileURL","toString","requestHeaders","Object","fromEntries","Headers","cookies","split","res","redirectCount","maxRedirects","isSameOrigin","Boolean","externalFileHeaderFilter","cookie","filter","trim","startsWith","cookiePrefix","join","skipSafeFetch","Array","isArray","isAllowedPasteUrl","pasteURL","allowList","fetch","credentials","method","redirect","status","location","ok","arrayBuffer","name","Buffer","from","mimetype","size","Number"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,SAAS,QAAQ,iBAAgB;AAQ1C,MAAMC,cAAc,CAACC,MAAyB,sBAAsBC,IAAI,CAACD;AAEzE,MAAME,kBAAkB,CAACF;IACvB,IAAIA,IAAIG,QAAQ,KAAK,WAAWH,IAAIG,QAAQ,KAAK,UAAU;QACzD,MAAM,IAAIR,SAAS,8CAA8C;IACnE;IAEA,OAAOK;AACT;AAEA,MAAMI,eAAe,CAACJ,KAAaK;IACjC,IAAI;QACF,OAAOH,gBAAgB,IAAII,IAAIN,KAAKK;IACtC,EAAE,OAAOE,OAAO;QACd,IAAIA,iBAAiBZ,UAAU;YAC7B,MAAMY;QACR;QAEA,MAAM,IAAIZ,SAAS,8BAA8B;IACnD;AACF;AAEA,MAAMa,oBAAoB,CAACC;IACzB,IAAI;QACF,MAAMC,aAAaR,gBAAgB,IAAII,IAAIG,IAAIT,GAAG;QAClD,MAAMW,OAAOF,IAAIG,OAAO,CAACC,GAAG,CAAC,WAAWH,WAAWC,IAAI;QAEvD,OAAOT,gBAAgB,IAAII,IAAI,GAAGI,WAAWP,QAAQ,CAAC,EAAE,EAAEQ,MAAM;IAClE,EAAE,OAAM;QACN,OAAOG;IACT;AACF;AAEA,OAAO,MAAMC,kBAAkB,OAAO,EAAEC,IAAI,EAAEP,GAAG,EAAEQ,YAAY,EAAQ;IACrE,MAAM,EAAEC,QAAQ,EAAElB,GAAG,EAAE,GAAGgB;IAE1B,IAAI,OAAOhB,QAAQ,UAAU;QAC3B,IAAImB;QACJ,IAAIC;QAEJ,IAAIrB,YAAYC,MAAM;YACpBoB,gBAAgBhB,aAAaJ;QAC/B,OAAO;YACL,MAAMqB,gBAAgBzB,iBAAiB;gBAAE0B,QAAQb,IAAIc,OAAO,CAACD,MAAM;gBAAEb;YAAI;YACzE,IAAIe;YAEJ,IAAIH,eAAe;gBACjBG,iBAAiBpB,aAAaiB;gBAC9BF,aAAaK,eAAeC,MAAM;YACpC,OAAO;gBACLD,iBAAiBhB,kBAAkBC;YACrC;YAEA,IAAI,CAACe,gBAAgB;gBACnB,MAAM,IAAI7B,SAAS,kEAAkE;YACvF;YAEAyB,gBAAgBhB,aAAaJ,KAAKwB;QACpC;QAEA,IAAIE,UAAUN,cAAcO,QAAQ;QACpC,MAAMC,iBAAiBC,OAAOC,WAAW,CAAC,IAAIC,QAAQtB,IAAIG,OAAO;QACjE,MAAMoB,UAAU,AAACvB,CAAAA,IAAIG,OAAO,CAACC,GAAG,CAAC,aAAa,EAAC,EAAGoB,KAAK,CAAC;QAExD,IAAIC;QACJ,IAAIC,gBAAgB;QACpB,MAAMC,eAAe;QAErB,MAAOD,iBAAiBC,aAAc;YACpC,MAAMC,eAAeC,QAAQnB,cAAc,IAAIb,IAAIoB,SAASD,MAAM,KAAKN;YACvE,MAAMP,UAAUK,aAAasB,wBAAwB,GACjDtB,aAAasB,wBAAwB,CACnC;gBAAE,GAAGX,cAAc;YAAC,GACpB;gBAAES;gBAAcrC,KAAK0B;YAAQ,KAE/B;gBACEc,QAAQR,QACLS,MAAM,CACL,CAACD,SACCH,gBAAgB,CAACG,OAAOE,IAAI,GAAGC,UAAU,CAAClC,IAAIc,OAAO,CAACD,MAAM,CAACsB,YAAY,GAE5EC,IAAI,CAAC;YACV;YAEJ,MAAMC,gBACJ7B,aAAa6B,aAAa,KAAK,OAC3B7B,aAAa6B,aAAa,GAC1BC,MAAMC,OAAO,CAAC/B,aAAa6B,aAAa,KACxCjD,aAAa6B,SAAST,aAAa6B,aAAa;YAEtD,MAAMG,oBACJhC,aAAaiC,QAAQ,IACrBjC,aAAaiC,QAAQ,CAACC,SAAS,IAC/BtD,aAAa6B,SAAST,aAAaiC,QAAQ,CAACC,SAAS;YAEvD,IAAIL,iBAAiBG,mBAAmB;gBACtCf,MAAM,MAAMkB,MAAM1B,SAAS;oBACzB2B,aAAa;oBACbzC;oBACA0C,QAAQ;oBACRC,UAAU;gBACZ;YACF,OAAO;gBACL,UAAU;gBACVrB,MAAM,MAAMpC,UAAU4B,SAAS;oBAC7B2B,aAAa;oBACbzC;oBACA0C,QAAQ;gBACV;YACF;YAEA,IAAIpB,IAAIsB,MAAM,IAAI,OAAOtB,IAAIsB,MAAM,GAAG,KAAK;gBACzCrB;gBACA,IAAIA,gBAAgBC,cAAc;oBAChC,MAAM,IAAIzC,SAAS,CAAC,wBAAwB,EAAEyC,aAAa,CAAC,CAAC,EAAE;gBACjE;gBACA,MAAMqB,WAAWvB,IAAItB,OAAO,CAACC,GAAG,CAAC;gBACjC,IAAI4C,UAAU;oBACZ/B,UAAUtB,aAAaqD,UAAU,IAAInD,IAAIoB,UAAUC,QAAQ;oBAC3D,IACEV,aAAaiC,QAAQ,IACrBjC,aAAaiC,QAAQ,CAACC,SAAS,IAC/B,CAACtD,aAAa6B,SAAST,aAAaiC,QAAQ,CAACC,SAAS,GACtD;wBACA,MAAM,IAAIxD,SAAS,mCAAmC;oBACxD;oBACA;gBACF;YACF;YAEA;QACF;QAEA,IAAI,CAACuC,OAAO,CAACA,IAAIwB,EAAE,EAAE;YACnB,MAAM,IAAI/D,SAAS,CAAC,0BAA0B,EAAE+B,SAAS,EAAEQ,KAAKsB;QAClE;QAEA,MAAMxC,OAAO,MAAMkB,IAAIyB,WAAW;QAElC,OAAO;YACLC,MAAM1C;YACNF,MAAM6C,OAAOC,IAAI,CAAC9C;YAClB+C,UAAU7B,IAAItB,OAAO,CAACC,GAAG,CAAC,mBAAmBC;YAC7CkD,MAAMC,OAAO/B,IAAItB,OAAO,CAACC,GAAG,CAAC,sBAAsB;QACrD;IACF;IAEA,MAAM,IAAIlB,SAAS,oBAAoB;AACzC,EAAC"}

package/dist/uploads/getFileFromClientUpload.d.ts

@@ -7,8 +7,8 @@ export type ClientUploadData = {
     size: number;
 };
 /**
- * `req.context` key `unlinkTempFiles` reads to find a materializer-created temp file once
- * `req.file` is gone - plugin-cloud-storage's afterChange hook clears `req.file` after
+ * `req.context` key `unlinkClientUploadTempFile` reads to find a materializer-created temp file
+ * once `req.file` is gone - plugin-cloud-storage's afterChange hook clears `req.file` after
  * uploading generated image sizes, before cleanup runs, so tracking it only on `req.file`
  * would leak the temp file.
  */

package/dist/uploads/getFileFromClientUpload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFileFromClientUpload.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileFromClientUpload.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAQvD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,oCAAoC,CAAA;AAEzF,wBAAsB,uBAAuB,CAAC,EAC5C,IAAI,EACJ,GAAG,GACJ,EAAE;IACD,IAAI,EAAE,gBAAgB,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CA8C/C"}
+{"version":3,"file":"getFileFromClientUpload.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileFromClientUpload.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAQvD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,oCAAoC,CAAA;AAEzF,wBAAsB,uBAAuB,CAAC,EAC5C,IAAI,EACJ,GAAG,GACJ,EAAE;IACD,IAAI,EAAE,gBAAgB,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAgD/C"}

package/dist/uploads/getFileFromClientUpload.js

@@ -10,8 +10,8 @@ import { isolateObjectProperty } from '../utilities/isolateObjectProperty.js';
 import { getFileContentRequirement, HEADER_PROBE_BYTE_LENGTH } from './getFileContentRequirement.js';
 import { getImageSize } from './getImageSize.js';
 /**
- * `req.context` key `unlinkTempFiles` reads to find a materializer-created temp file once
- * `req.file` is gone - plugin-cloud-storage's afterChange hook clears `req.file` after
+ * `req.context` key `unlinkClientUploadTempFile` reads to find a materializer-created temp file
+ * once `req.file` is gone - plugin-cloud-storage's afterChange hook clears `req.file` after
  * uploading generated image sizes, before cleanup runs, so tracking it only on `req.file`
  * would leak the temp file.
  */ export const CLIENT_UPLOAD_TEMP_FILE_PATH_CONTEXT_KEY = 'payloadClientUploadTempFilePath';
@@ -20,11 +20,11 @@ export async function getFileFromClientUpload({ file, req }) {
     if (!uploadConfig || !uploadConfig.handlers) {
         throw new APIError(`uploadConfig.handlers is not present for ${file.collectionSlug}`);
     }
-    const contentRequirement = getFileContentRequirement({
+    const contentRequirement = file.clientUploadContext ? getFileContentRequirement({
         hasSizeEdits: requestHasSizeEdits(req),
         mimeType: file.mimeType,
         uploadConfig
-    });
+    }) : 'full';
     if (contentRequirement === 'none') {
         return {
             name: file.filename,

package/dist/uploads/getFileFromClientUpload.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getFileFromClientUpload.ts"],"sourcesContent":["import { randomUUID } from 'crypto'\nimport fs from 'fs'\nimport { mkdir, rm, writeFile } from 'fs/promises'\nimport os from 'os'\nimport path from 'path'\nimport { Readable } from 'stream'\nimport { pipeline } from 'stream/promises'\n\nimport type { PayloadRequest } from '../types/index.js'\nimport type { SanitizedUploadConfig, UploadEdits } from './types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { isolateObjectProperty } from '../utilities/isolateObjectProperty.js'\nimport { getFileContentRequirement, HEADER_PROBE_BYTE_LENGTH } from './getFileContentRequirement.js'\nimport { getImageSize } from './getImageSize.js'\n\nexport type ClientUploadData = {\n  clientUploadContext?: unknown\n  collectionSlug: string\n  filename: string\n  mimeType: string\n  size: number\n}\n\n/**\n * `req.context` key `unlinkTempFiles` reads to find a materializer-created temp file once\n * `req.file` is gone - plugin-cloud-storage's afterChange hook clears `req.file` after\n * uploading generated image sizes, before cleanup runs, so tracking it only on `req.file`\n * would leak the temp file.\n */\nexport const CLIENT_UPLOAD_TEMP_FILE_PATH_CONTEXT_KEY = 'payloadClientUploadTempFilePath'\n\nexport async function getFileFromClientUpload({\n  file,\n  req,\n}: {\n  file: ClientUploadData\n  req: PayloadRequest\n}): Promise<NonNullable<PayloadRequest['file']>> {\n  const uploadConfig = req.payload.collections[file.collectionSlug]?.config.upload\n\n  if (!uploadConfig || !uploadConfig.handlers) {\n    throw new APIError(`uploadConfig.handlers is not present for ${file.collectionSlug}`)\n  }\n\n  const contentRequirement = getFileContentRequirement({\n    hasSizeEdits: requestHasSizeEdits(req),\n    mimeType: file.mimeType,\n    uploadConfig,\n  })\n\n  if (contentRequirement === 'none') {\n    return {\n      name: file.filename,\n      clientUploadContext: file.clientUploadContext,\n      data: Buffer.alloc(0),\n      mimetype: file.mimeType,\n      size: file.size,\n    }\n  }\n\n  if (contentRequirement === 'header') {\n    const headerFile = await fetchHeaderOnly({ file, req, uploadConfig })\n    if (headerFile) {\n      return headerFile\n    }\n  }\n\n  const response = await fetchUploadResponse({ file, req, uploadConfig })\n  const tempFilePath = await streamResponseToTempFile({ req, response })\n\n  if (!req.context) {\n    req.context = {}\n  }\n  req.context[CLIENT_UPLOAD_TEMP_FILE_PATH_CONTEXT_KEY] = tempFilePath\n\n  return {\n    name: file.filename,\n    clientUploadContext: file.clientUploadContext,\n    data: Buffer.alloc(0),\n    mimetype: response.headers.get('Content-Type') || file.mimeType,\n    size: file.size,\n    tempFilePath,\n  }\n}\n\n/**\n * Only crop and explicit pixel edits require the original bytes - a focal-point-only\n * change re-derives from data already on the document, not the incoming upload.\n */\nfunction requestHasSizeEdits(req: PayloadRequest): boolean {\n  const uploadEdits =\n    req.query?.uploadEdits && typeof req.query.uploadEdits === 'object'\n      ? (req.query.uploadEdits as UploadEdits)\n      : undefined\n\n  return Boolean(uploadEdits?.crop || uploadEdits?.heightInPixels || uploadEdits?.widthInPixels)\n}\n\n/**\n * Runs every configured handler and returns the last one that responds, following a single\n * redirect if that response is one - matching the pre-existing v3 handler contract exactly\n * (v3 always ran every handler; only v4 stops at the first response, via an unrelated PR).\n */\nasync function fetchUploadResponse({\n  file,\n  req,\n  uploadConfig,\n}: {\n  file: ClientUploadData\n  req: PayloadRequest\n  uploadConfig: SanitizedUploadConfig\n}): Promise<Response> {\n  let response: null | Response = null\n  let error: unknown\n\n  for (const handler of uploadConfig.handlers!) {\n    try {\n      const result = await handler(req, {\n        doc: null!,\n        params: {\n          clientUploadContext: file.clientUploadContext,\n          collection: file.collectionSlug,\n          filename: file.filename,\n        },\n      })\n\n      if (result) {\n        response = result\n      }\n      // If we couldn't get the file from that handler, save the error and try other.\n    } catch (err) {\n      error = err\n    }\n  }\n\n  if (!response) {\n    if (error) {\n      req.payload.logger.error(error)\n    }\n\n    throw new APIError('Expected response from the upload handler.')\n  }\n\n  if (response.status >= 300 && response.status < 400) {\n    const redirectUrl = response.headers.get('Location')\n    if (redirectUrl) {\n      // Forward the Range header (if any) so a redirect from the header-probe path still\n      // fetches only the bounded slice, instead of the whole object, from the redirect target.\n      const rangeHeader = req.headers.get('Range')\n      response = rangeHeader\n        ? await fetch(redirectUrl, { headers: { Range: rangeHeader } })\n        : await fetch(redirectUrl)\n    }\n  }\n\n  return response\n}\n\n/**\n * Requests a bounded byte range from the handlers and probes it for image dimensions, without\n * ever reading past `HEADER_PROBE_BYTE_LENGTH`. Returns `null` when the bounded bytes cannot be\n * probed, so the caller falls back to a full streamed fetch.\n */\nasync function fetchHeaderOnly({\n  file,\n  req,\n  uploadConfig,\n}: {\n  file: ClientUploadData\n  req: PayloadRequest\n  uploadConfig: SanitizedUploadConfig\n}): Promise<NonNullable<PayloadRequest['file']> | null> {\n  const rangedHeaders = new Headers(req.headers)\n  rangedHeaders.set('Range', `bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}`)\n\n  const scopedReq = isolateObjectProperty(req, 'headers')\n  scopedReq.headers = rangedHeaders\n\n  const response = await fetchUploadResponse({ file, req: scopedReq, uploadConfig })\n\n  if (!response.body) {\n    return null\n  }\n\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let bytesRead = 0\n\n  try {\n    while (bytesRead < HEADER_PROBE_BYTE_LENGTH) {\n      const { done, value } = await reader.read()\n      if (done || !value) {\n        break\n      }\n\n      const remaining = HEADER_PROBE_BYTE_LENGTH - bytesRead\n      const chunk = value.length > remaining ? value.slice(0, remaining) : value\n\n      chunks.push(chunk)\n      bytesRead += chunk.length\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined)\n  }\n\n  const probedFile = {\n    name: file.filename,\n    clientUploadContext: file.clientUploadContext,\n    data: Buffer.concat(chunks),\n    mimetype: response.headers.get('Content-Type') || file.mimeType,\n    size: file.size,\n  }\n\n  try {\n    await getImageSize({ file: probedFile, sharp: req.payload.config.sharp })\n  } catch {\n    return null\n  }\n\n  return probedFile\n}\n\n/**\n * Streams the full response body straight to disk so a cloud object of unbounded size never\n * becomes a single in-memory Buffer.\n */\nasync function streamResponseToTempFile({\n  req,\n  response,\n}: {\n  req: PayloadRequest\n  response: Response\n}): Promise<string> {\n  const tempFileDir = req.payload.config.upload?.tempFileDir || os.tmpdir()\n  await mkdir(tempFileDir, { recursive: true })\n  const tempFilePath = path.join(tempFileDir, `payload-client-upload-${randomUUID()}`)\n\n  // A null body is a legitimate zero-byte file (the Fetch API allows a Response to omit a\n  // body entirely), not a failure - `response.arrayBuffer()` tolerated this the same way.\n  if (!response.body) {\n    await writeFile(tempFilePath, Buffer.alloc(0))\n    return tempFilePath\n  }\n\n  try {\n    await pipeline(\n      Readable.fromWeb(response.body as ReadableStream<Uint8Array>),\n      fs.createWriteStream(tempFilePath),\n    )\n  } catch (error) {\n    await rm(tempFilePath, { force: true })\n    throw error\n  }\n\n  return tempFilePath\n}\n"],"names":["randomUUID","fs","mkdir","rm","writeFile","os","path","Readable","pipeline","APIError","isolateObjectProperty","getFileContentRequirement","HEADER_PROBE_BYTE_LENGTH","getImageSize","CLIENT_UPLOAD_TEMP_FILE_PATH_CONTEXT_KEY","getFileFromClientUpload","file","req","uploadConfig","payload","collections","collectionSlug","config","upload","handlers","contentRequirement","hasSizeEdits","requestHasSizeEdits","mimeType","name","filename","clientUploadContext","data","Buffer","alloc","mimetype","size","headerFile","fetchHeaderOnly","response","fetchUploadResponse","tempFilePath","streamResponseToTempFile","context","headers","get","uploadEdits","query","undefined","Boolean","crop","heightInPixels","widthInPixels","error","handler","result","doc","params","collection","err","logger","status","redirectUrl","rangeHeader","fetch","Range","rangedHeaders","Headers","set","scopedReq","body","reader","getReader","chunks","bytesRead","done","value","read","remaining","chunk","length","slice","push","cancel","catch","probedFile","concat","sharp","tempFileDir","tmpdir","recursive","join","fromWeb","createWriteStream","force"],"mappings":"AAAA,SAASA,UAAU,QAAQ,SAAQ;AACnC,OAAOC,QAAQ,KAAI;AACnB,SAASC,KAAK,EAAEC,EAAE,EAAEC,SAAS,QAAQ,cAAa;AAClD,OAAOC,QAAQ,KAAI;AACnB,OAAOC,UAAU,OAAM;AACvB,SAASC,QAAQ,QAAQ,SAAQ;AACjC,SAASC,QAAQ,QAAQ,kBAAiB;AAK1C,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,yBAAyB,EAAEC,wBAAwB,QAAQ,iCAAgC;AACpG,SAASC,YAAY,QAAQ,oBAAmB;AAUhD;;;;;CAKC,GACD,OAAO,MAAMC,2CAA2C,kCAAiC;AAEzF,OAAO,eAAeC,wBAAwB,EAC5CC,IAAI,EACJC,GAAG,EAIJ;IACC,MAAMC,eAAeD,IAAIE,OAAO,CAACC,WAAW,CAACJ,KAAKK,cAAc,CAAC,EAAEC,OAAOC;IAE1E,IAAI,CAACL,gBAAgB,CAACA,aAAaM,QAAQ,EAAE;QAC3C,MAAM,IAAIf,SAAS,CAAC,yCAAyC,EAAEO,KAAKK,cAAc,EAAE;IACtF;IAEA,MAAMI,qBAAqBd,0BAA0B;QACnDe,cAAcC,oBAAoBV;QAClCW,UAAUZ,KAAKY,QAAQ;QACvBV;IACF;IAEA,IAAIO,uBAAuB,QAAQ;QACjC,OAAO;YACLI,MAAMb,KAAKc,QAAQ;YACnBC,qBAAqBf,KAAKe,mBAAmB;YAC7CC,MAAMC,OAAOC,KAAK,CAAC;YACnBC,UAAUnB,KAAKY,QAAQ;YACvBQ,MAAMpB,KAAKoB,IAAI;QACjB;IACF;IAEA,IAAIX,uBAAuB,UAAU;QACnC,MAAMY,aAAa,MAAMC,gBAAgB;YAAEtB;YAAMC;YAAKC;QAAa;QACnE,IAAImB,YAAY;YACd,OAAOA;QACT;IACF;IAEA,MAAME,WAAW,MAAMC,oBAAoB;QAAExB;QAAMC;QAAKC;IAAa;IACrE,MAAMuB,eAAe,MAAMC,yBAAyB;QAAEzB;QAAKsB;IAAS;IAEpE,IAAI,CAACtB,IAAI0B,OAAO,EAAE;QAChB1B,IAAI0B,OAAO,GAAG,CAAC;IACjB;IACA1B,IAAI0B,OAAO,CAAC7B,yCAAyC,GAAG2B;IAExD,OAAO;QACLZ,MAAMb,KAAKc,QAAQ;QACnBC,qBAAqBf,KAAKe,mBAAmB;QAC7CC,MAAMC,OAAOC,KAAK,CAAC;QACnBC,UAAUI,SAASK,OAAO,CAACC,GAAG,CAAC,mBAAmB7B,KAAKY,QAAQ;QAC/DQ,MAAMpB,KAAKoB,IAAI;QACfK;IACF;AACF;AAEA;;;CAGC,GACD,SAASd,oBAAoBV,GAAmB;IAC9C,MAAM6B,cACJ7B,IAAI8B,KAAK,EAAED,eAAe,OAAO7B,IAAI8B,KAAK,CAACD,WAAW,KAAK,WACtD7B,IAAI8B,KAAK,CAACD,WAAW,GACtBE;IAEN,OAAOC,QAAQH,aAAaI,QAAQJ,aAAaK,kBAAkBL,aAAaM;AAClF;AAEA;;;;CAIC,GACD,eAAeZ,oBAAoB,EACjCxB,IAAI,EACJC,GAAG,EACHC,YAAY,EAKb;IACC,IAAIqB,WAA4B;IAChC,IAAIc;IAEJ,KAAK,MAAMC,WAAWpC,aAAaM,QAAQ,CAAG;QAC5C,IAAI;YACF,MAAM+B,SAAS,MAAMD,QAAQrC,KAAK;gBAChCuC,KAAK;gBACLC,QAAQ;oBACN1B,qBAAqBf,KAAKe,mBAAmB;oBAC7C2B,YAAY1C,KAAKK,cAAc;oBAC/BS,UAAUd,KAAKc,QAAQ;gBACzB;YACF;YAEA,IAAIyB,QAAQ;gBACVhB,WAAWgB;YACb;QACA,+EAA+E;QACjF,EAAE,OAAOI,KAAK;YACZN,QAAQM;QACV;IACF;IAEA,IAAI,CAACpB,UAAU;QACb,IAAIc,OAAO;YACTpC,IAAIE,OAAO,CAACyC,MAAM,CAACP,KAAK,CAACA;QAC3B;QAEA,MAAM,IAAI5C,SAAS;IACrB;IAEA,IAAI8B,SAASsB,MAAM,IAAI,OAAOtB,SAASsB,MAAM,GAAG,KAAK;QACnD,MAAMC,cAAcvB,SAASK,OAAO,CAACC,GAAG,CAAC;QACzC,IAAIiB,aAAa;YACf,mFAAmF;YACnF,yFAAyF;YACzF,MAAMC,cAAc9C,IAAI2B,OAAO,CAACC,GAAG,CAAC;YACpCN,WAAWwB,cACP,MAAMC,MAAMF,aAAa;gBAAElB,SAAS;oBAAEqB,OAAOF;gBAAY;YAAE,KAC3D,MAAMC,MAAMF;QAClB;IACF;IAEA,OAAOvB;AACT;AAEA;;;;CAIC,GACD,eAAeD,gBAAgB,EAC7BtB,IAAI,EACJC,GAAG,EACHC,YAAY,EAKb;IACC,MAAMgD,gBAAgB,IAAIC,QAAQlD,IAAI2B,OAAO;IAC7CsB,cAAcE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAExD,2BAA2B,GAAG;IAEpE,MAAMyD,YAAY3D,sBAAsBO,KAAK;IAC7CoD,UAAUzB,OAAO,GAAGsB;IAEpB,MAAM3B,WAAW,MAAMC,oBAAoB;QAAExB;QAAMC,KAAKoD;QAAWnD;IAAa;IAEhF,IAAI,CAACqB,SAAS+B,IAAI,EAAE;QAClB,OAAO;IACT;IAEA,MAAMC,SAAShC,SAAS+B,IAAI,CAACE,SAAS;IACtC,MAAMC,SAAuB,EAAE;IAC/B,IAAIC,YAAY;IAEhB,IAAI;QACF,MAAOA,YAAY9D,yBAA0B;YAC3C,MAAM,EAAE+D,IAAI,EAAEC,KAAK,EAAE,GAAG,MAAML,OAAOM,IAAI;YACzC,IAAIF,QAAQ,CAACC,OAAO;gBAClB;YACF;YAEA,MAAME,YAAYlE,2BAA2B8D;YAC7C,MAAMK,QAAQH,MAAMI,MAAM,GAAGF,YAAYF,MAAMK,KAAK,CAAC,GAAGH,aAAaF;YAErEH,OAAOS,IAAI,CAACH;YACZL,aAAaK,MAAMC,MAAM;QAC3B;IACF,SAAU;QACR,MAAMT,OAAOY,MAAM,GAAGC,KAAK,CAAC,IAAMpC;IACpC;IAEA,MAAMqC,aAAa;QACjBxD,MAAMb,KAAKc,QAAQ;QACnBC,qBAAqBf,KAAKe,mBAAmB;QAC7CC,MAAMC,OAAOqD,MAAM,CAACb;QACpBtC,UAAUI,SAASK,OAAO,CAACC,GAAG,CAAC,mBAAmB7B,KAAKY,QAAQ;QAC/DQ,MAAMpB,KAAKoB,IAAI;IACjB;IAEA,IAAI;QACF,MAAMvB,aAAa;YAAEG,MAAMqE;YAAYE,OAAOtE,IAAIE,OAAO,CAACG,MAAM,CAACiE,KAAK;QAAC;IACzE,EAAE,OAAM;QACN,OAAO;IACT;IAEA,OAAOF;AACT;AAEA;;;CAGC,GACD,eAAe3C,yBAAyB,EACtCzB,GAAG,EACHsB,QAAQ,EAIT;IACC,MAAMiD,cAAcvE,IAAIE,OAAO,CAACG,MAAM,CAACC,MAAM,EAAEiE,eAAenF,GAAGoF,MAAM;IACvE,MAAMvF,MAAMsF,aAAa;QAAEE,WAAW;IAAK;IAC3C,MAAMjD,eAAenC,KAAKqF,IAAI,CAACH,aAAa,CAAC,sBAAsB,EAAExF,cAAc;IAEnF,wFAAwF;IACxF,wFAAwF;IACxF,IAAI,CAACuC,SAAS+B,IAAI,EAAE;QAClB,MAAMlE,UAAUqC,cAAcR,OAAOC,KAAK,CAAC;QAC3C,OAAOO;IACT;IAEA,IAAI;QACF,MAAMjC,SACJD,SAASqF,OAAO,CAACrD,SAAS+B,IAAI,GAC9BrE,GAAG4F,iBAAiB,CAACpD;IAEzB,EAAE,OAAOY,OAAO;QACd,MAAMlD,GAAGsC,cAAc;YAAEqD,OAAO;QAAK;QACrC,MAAMzC;IACR;IAEA,OAAOZ;AACT"}
+{"version":3,"sources":["../../src/uploads/getFileFromClientUpload.ts"],"sourcesContent":["import { randomUUID } from 'crypto'\nimport fs from 'fs'\nimport { mkdir, rm, writeFile } from 'fs/promises'\nimport os from 'os'\nimport path from 'path'\nimport { Readable } from 'stream'\nimport { pipeline } from 'stream/promises'\n\nimport type { PayloadRequest } from '../types/index.js'\nimport type { SanitizedUploadConfig, UploadEdits } from './types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { isolateObjectProperty } from '../utilities/isolateObjectProperty.js'\nimport { getFileContentRequirement, HEADER_PROBE_BYTE_LENGTH } from './getFileContentRequirement.js'\nimport { getImageSize } from './getImageSize.js'\n\nexport type ClientUploadData = {\n  clientUploadContext?: unknown\n  collectionSlug: string\n  filename: string\n  mimeType: string\n  size: number\n}\n\n/**\n * `req.context` key `unlinkClientUploadTempFile` reads to find a materializer-created temp file\n * once `req.file` is gone - plugin-cloud-storage's afterChange hook clears `req.file` after\n * uploading generated image sizes, before cleanup runs, so tracking it only on `req.file`\n * would leak the temp file.\n */\nexport const CLIENT_UPLOAD_TEMP_FILE_PATH_CONTEXT_KEY = 'payloadClientUploadTempFilePath'\n\nexport async function getFileFromClientUpload({\n  file,\n  req,\n}: {\n  file: ClientUploadData\n  req: PayloadRequest\n}): Promise<NonNullable<PayloadRequest['file']>> {\n  const uploadConfig = req.payload.collections[file.collectionSlug]?.config.upload\n\n  if (!uploadConfig || !uploadConfig.handlers) {\n    throw new APIError(`uploadConfig.handlers is not present for ${file.collectionSlug}`)\n  }\n\n  const contentRequirement = file.clientUploadContext\n    ? getFileContentRequirement({\n        hasSizeEdits: requestHasSizeEdits(req),\n        mimeType: file.mimeType,\n        uploadConfig,\n      })\n    : 'full'\n\n  if (contentRequirement === 'none') {\n    return {\n      name: file.filename,\n      clientUploadContext: file.clientUploadContext,\n      data: Buffer.alloc(0),\n      mimetype: file.mimeType,\n      size: file.size,\n    }\n  }\n\n  if (contentRequirement === 'header') {\n    const headerFile = await fetchHeaderOnly({ file, req, uploadConfig })\n    if (headerFile) {\n      return headerFile\n    }\n  }\n\n  const response = await fetchUploadResponse({ file, req, uploadConfig })\n  const tempFilePath = await streamResponseToTempFile({ req, response })\n\n  if (!req.context) {\n    req.context = {}\n  }\n  req.context[CLIENT_UPLOAD_TEMP_FILE_PATH_CONTEXT_KEY] = tempFilePath\n\n  return {\n    name: file.filename,\n    clientUploadContext: file.clientUploadContext,\n    data: Buffer.alloc(0),\n    mimetype: response.headers.get('Content-Type') || file.mimeType,\n    size: file.size,\n    tempFilePath,\n  }\n}\n\n/**\n * Only crop and explicit pixel edits require the original bytes - a focal-point-only\n * change re-derives from data already on the document, not the incoming upload.\n */\nfunction requestHasSizeEdits(req: PayloadRequest): boolean {\n  const uploadEdits =\n    req.query?.uploadEdits && typeof req.query.uploadEdits === 'object'\n      ? (req.query.uploadEdits as UploadEdits)\n      : undefined\n\n  return Boolean(uploadEdits?.crop || uploadEdits?.heightInPixels || uploadEdits?.widthInPixels)\n}\n\n/**\n * Runs every configured handler and returns the last one that responds, following a single\n * redirect if that response is one - matching the pre-existing v3 handler contract exactly\n * (v3 always ran every handler; only v4 stops at the first response, via an unrelated PR).\n */\nasync function fetchUploadResponse({\n  file,\n  req,\n  uploadConfig,\n}: {\n  file: ClientUploadData\n  req: PayloadRequest\n  uploadConfig: SanitizedUploadConfig\n}): Promise<Response> {\n  let response: null | Response = null\n  let error: unknown\n\n  for (const handler of uploadConfig.handlers!) {\n    try {\n      const result = await handler(req, {\n        doc: null!,\n        params: {\n          clientUploadContext: file.clientUploadContext,\n          collection: file.collectionSlug,\n          filename: file.filename,\n        },\n      })\n\n      if (result) {\n        response = result\n      }\n      // If we couldn't get the file from that handler, save the error and try other.\n    } catch (err) {\n      error = err\n    }\n  }\n\n  if (!response) {\n    if (error) {\n      req.payload.logger.error(error)\n    }\n\n    throw new APIError('Expected response from the upload handler.')\n  }\n\n  if (response.status >= 300 && response.status < 400) {\n    const redirectUrl = response.headers.get('Location')\n    if (redirectUrl) {\n      // Forward the Range header (if any) so a redirect from the header-probe path still\n      // fetches only the bounded slice, instead of the whole object, from the redirect target.\n      const rangeHeader = req.headers.get('Range')\n      response = rangeHeader\n        ? await fetch(redirectUrl, { headers: { Range: rangeHeader } })\n        : await fetch(redirectUrl)\n    }\n  }\n\n  return response\n}\n\n/**\n * Requests a bounded byte range from the handlers and probes it for image dimensions, without\n * ever reading past `HEADER_PROBE_BYTE_LENGTH`. Returns `null` when the bounded bytes cannot be\n * probed, so the caller falls back to a full streamed fetch.\n */\nasync function fetchHeaderOnly({\n  file,\n  req,\n  uploadConfig,\n}: {\n  file: ClientUploadData\n  req: PayloadRequest\n  uploadConfig: SanitizedUploadConfig\n}): Promise<NonNullable<PayloadRequest['file']> | null> {\n  const rangedHeaders = new Headers(req.headers)\n  rangedHeaders.set('Range', `bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}`)\n\n  const scopedReq = isolateObjectProperty(req, 'headers')\n  scopedReq.headers = rangedHeaders\n\n  const response = await fetchUploadResponse({ file, req: scopedReq, uploadConfig })\n\n  if (!response.body) {\n    return null\n  }\n\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let bytesRead = 0\n\n  try {\n    while (bytesRead < HEADER_PROBE_BYTE_LENGTH) {\n      const { done, value } = await reader.read()\n      if (done || !value) {\n        break\n      }\n\n      const remaining = HEADER_PROBE_BYTE_LENGTH - bytesRead\n      const chunk = value.length > remaining ? value.slice(0, remaining) : value\n\n      chunks.push(chunk)\n      bytesRead += chunk.length\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined)\n  }\n\n  const probedFile = {\n    name: file.filename,\n    clientUploadContext: file.clientUploadContext,\n    data: Buffer.concat(chunks),\n    mimetype: response.headers.get('Content-Type') || file.mimeType,\n    size: file.size,\n  }\n\n  try {\n    await getImageSize({ file: probedFile, sharp: req.payload.config.sharp })\n  } catch {\n    return null\n  }\n\n  return probedFile\n}\n\n/**\n * Streams the full response body straight to disk so a cloud object of unbounded size never\n * becomes a single in-memory Buffer.\n */\nasync function streamResponseToTempFile({\n  req,\n  response,\n}: {\n  req: PayloadRequest\n  response: Response\n}): Promise<string> {\n  const tempFileDir = req.payload.config.upload?.tempFileDir || os.tmpdir()\n  await mkdir(tempFileDir, { recursive: true })\n  const tempFilePath = path.join(tempFileDir, `payload-client-upload-${randomUUID()}`)\n\n  // A null body is a legitimate zero-byte file (the Fetch API allows a Response to omit a\n  // body entirely), not a failure - `response.arrayBuffer()` tolerated this the same way.\n  if (!response.body) {\n    await writeFile(tempFilePath, Buffer.alloc(0))\n    return tempFilePath\n  }\n\n  try {\n    await pipeline(\n      Readable.fromWeb(response.body as ReadableStream<Uint8Array>),\n      fs.createWriteStream(tempFilePath),\n    )\n  } catch (error) {\n    await rm(tempFilePath, { force: true })\n    throw error\n  }\n\n  return tempFilePath\n}\n"],"names":["randomUUID","fs","mkdir","rm","writeFile","os","path","Readable","pipeline","APIError","isolateObjectProperty","getFileContentRequirement","HEADER_PROBE_BYTE_LENGTH","getImageSize","CLIENT_UPLOAD_TEMP_FILE_PATH_CONTEXT_KEY","getFileFromClientUpload","file","req","uploadConfig","payload","collections","collectionSlug","config","upload","handlers","contentRequirement","clientUploadContext","hasSizeEdits","requestHasSizeEdits","mimeType","name","filename","data","Buffer","alloc","mimetype","size","headerFile","fetchHeaderOnly","response","fetchUploadResponse","tempFilePath","streamResponseToTempFile","context","headers","get","uploadEdits","query","undefined","Boolean","crop","heightInPixels","widthInPixels","error","handler","result","doc","params","collection","err","logger","status","redirectUrl","rangeHeader","fetch","Range","rangedHeaders","Headers","set","scopedReq","body","reader","getReader","chunks","bytesRead","done","value","read","remaining","chunk","length","slice","push","cancel","catch","probedFile","concat","sharp","tempFileDir","tmpdir","recursive","join","fromWeb","createWriteStream","force"],"mappings":"AAAA,SAASA,UAAU,QAAQ,SAAQ;AACnC,OAAOC,QAAQ,KAAI;AACnB,SAASC,KAAK,EAAEC,EAAE,EAAEC,SAAS,QAAQ,cAAa;AAClD,OAAOC,QAAQ,KAAI;AACnB,OAAOC,UAAU,OAAM;AACvB,SAASC,QAAQ,QAAQ,SAAQ;AACjC,SAASC,QAAQ,QAAQ,kBAAiB;AAK1C,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,yBAAyB,EAAEC,wBAAwB,QAAQ,iCAAgC;AACpG,SAASC,YAAY,QAAQ,oBAAmB;AAUhD;;;;;CAKC,GACD,OAAO,MAAMC,2CAA2C,kCAAiC;AAEzF,OAAO,eAAeC,wBAAwB,EAC5CC,IAAI,EACJC,GAAG,EAIJ;IACC,MAAMC,eAAeD,IAAIE,OAAO,CAACC,WAAW,CAACJ,KAAKK,cAAc,CAAC,EAAEC,OAAOC;IAE1E,IAAI,CAACL,gBAAgB,CAACA,aAAaM,QAAQ,EAAE;QAC3C,MAAM,IAAIf,SAAS,CAAC,yCAAyC,EAAEO,KAAKK,cAAc,EAAE;IACtF;IAEA,MAAMI,qBAAqBT,KAAKU,mBAAmB,GAC/Cf,0BAA0B;QACxBgB,cAAcC,oBAAoBX;QAClCY,UAAUb,KAAKa,QAAQ;QACvBX;IACF,KACA;IAEJ,IAAIO,uBAAuB,QAAQ;QACjC,OAAO;YACLK,MAAMd,KAAKe,QAAQ;YACnBL,qBAAqBV,KAAKU,mBAAmB;YAC7CM,MAAMC,OAAOC,KAAK,CAAC;YACnBC,UAAUnB,KAAKa,QAAQ;YACvBO,MAAMpB,KAAKoB,IAAI;QACjB;IACF;IAEA,IAAIX,uBAAuB,UAAU;QACnC,MAAMY,aAAa,MAAMC,gBAAgB;YAAEtB;YAAMC;YAAKC;QAAa;QACnE,IAAImB,YAAY;YACd,OAAOA;QACT;IACF;IAEA,MAAME,WAAW,MAAMC,oBAAoB;QAAExB;QAAMC;QAAKC;IAAa;IACrE,MAAMuB,eAAe,MAAMC,yBAAyB;QAAEzB;QAAKsB;IAAS;IAEpE,IAAI,CAACtB,IAAI0B,OAAO,EAAE;QAChB1B,IAAI0B,OAAO,GAAG,CAAC;IACjB;IACA1B,IAAI0B,OAAO,CAAC7B,yCAAyC,GAAG2B;IAExD,OAAO;QACLX,MAAMd,KAAKe,QAAQ;QACnBL,qBAAqBV,KAAKU,mBAAmB;QAC7CM,MAAMC,OAAOC,KAAK,CAAC;QACnBC,UAAUI,SAASK,OAAO,CAACC,GAAG,CAAC,mBAAmB7B,KAAKa,QAAQ;QAC/DO,MAAMpB,KAAKoB,IAAI;QACfK;IACF;AACF;AAEA;;;CAGC,GACD,SAASb,oBAAoBX,GAAmB;IAC9C,MAAM6B,cACJ7B,IAAI8B,KAAK,EAAED,eAAe,OAAO7B,IAAI8B,KAAK,CAACD,WAAW,KAAK,WACtD7B,IAAI8B,KAAK,CAACD,WAAW,GACtBE;IAEN,OAAOC,QAAQH,aAAaI,QAAQJ,aAAaK,kBAAkBL,aAAaM;AAClF;AAEA;;;;CAIC,GACD,eAAeZ,oBAAoB,EACjCxB,IAAI,EACJC,GAAG,EACHC,YAAY,EAKb;IACC,IAAIqB,WAA4B;IAChC,IAAIc;IAEJ,KAAK,MAAMC,WAAWpC,aAAaM,QAAQ,CAAG;QAC5C,IAAI;YACF,MAAM+B,SAAS,MAAMD,QAAQrC,KAAK;gBAChCuC,KAAK;gBACLC,QAAQ;oBACN/B,qBAAqBV,KAAKU,mBAAmB;oBAC7CgC,YAAY1C,KAAKK,cAAc;oBAC/BU,UAAUf,KAAKe,QAAQ;gBACzB;YACF;YAEA,IAAIwB,QAAQ;gBACVhB,WAAWgB;YACb;QACA,+EAA+E;QACjF,EAAE,OAAOI,KAAK;YACZN,QAAQM;QACV;IACF;IAEA,IAAI,CAACpB,UAAU;QACb,IAAIc,OAAO;YACTpC,IAAIE,OAAO,CAACyC,MAAM,CAACP,KAAK,CAACA;QAC3B;QAEA,MAAM,IAAI5C,SAAS;IACrB;IAEA,IAAI8B,SAASsB,MAAM,IAAI,OAAOtB,SAASsB,MAAM,GAAG,KAAK;QACnD,MAAMC,cAAcvB,SAASK,OAAO,CAACC,GAAG,CAAC;QACzC,IAAIiB,aAAa;YACf,mFAAmF;YACnF,yFAAyF;YACzF,MAAMC,cAAc9C,IAAI2B,OAAO,CAACC,GAAG,CAAC;YACpCN,WAAWwB,cACP,MAAMC,MAAMF,aAAa;gBAAElB,SAAS;oBAAEqB,OAAOF;gBAAY;YAAE,KAC3D,MAAMC,MAAMF;QAClB;IACF;IAEA,OAAOvB;AACT;AAEA;;;;CAIC,GACD,eAAeD,gBAAgB,EAC7BtB,IAAI,EACJC,GAAG,EACHC,YAAY,EAKb;IACC,MAAMgD,gBAAgB,IAAIC,QAAQlD,IAAI2B,OAAO;IAC7CsB,cAAcE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAExD,2BAA2B,GAAG;IAEpE,MAAMyD,YAAY3D,sBAAsBO,KAAK;IAC7CoD,UAAUzB,OAAO,GAAGsB;IAEpB,MAAM3B,WAAW,MAAMC,oBAAoB;QAAExB;QAAMC,KAAKoD;QAAWnD;IAAa;IAEhF,IAAI,CAACqB,SAAS+B,IAAI,EAAE;QAClB,OAAO;IACT;IAEA,MAAMC,SAAShC,SAAS+B,IAAI,CAACE,SAAS;IACtC,MAAMC,SAAuB,EAAE;IAC/B,IAAIC,YAAY;IAEhB,IAAI;QACF,MAAOA,YAAY9D,yBAA0B;YAC3C,MAAM,EAAE+D,IAAI,EAAEC,KAAK,EAAE,GAAG,MAAML,OAAOM,IAAI;YACzC,IAAIF,QAAQ,CAACC,OAAO;gBAClB;YACF;YAEA,MAAME,YAAYlE,2BAA2B8D;YAC7C,MAAMK,QAAQH,MAAMI,MAAM,GAAGF,YAAYF,MAAMK,KAAK,CAAC,GAAGH,aAAaF;YAErEH,OAAOS,IAAI,CAACH;YACZL,aAAaK,MAAMC,MAAM;QAC3B;IACF,SAAU;QACR,MAAMT,OAAOY,MAAM,GAAGC,KAAK,CAAC,IAAMpC;IACpC;IAEA,MAAMqC,aAAa;QACjBvD,MAAMd,KAAKe,QAAQ;QACnBL,qBAAqBV,KAAKU,mBAAmB;QAC7CM,MAAMC,OAAOqD,MAAM,CAACb;QACpBtC,UAAUI,SAASK,OAAO,CAACC,GAAG,CAAC,mBAAmB7B,KAAKa,QAAQ;QAC/DO,MAAMpB,KAAKoB,IAAI;IACjB;IAEA,IAAI;QACF,MAAMvB,aAAa;YAAEG,MAAMqE;YAAYE,OAAOtE,IAAIE,OAAO,CAACG,MAAM,CAACiE,KAAK;QAAC;IACzE,EAAE,OAAM;QACN,OAAO;IACT;IAEA,OAAOF;AACT;AAEA;;;CAGC,GACD,eAAe3C,yBAAyB,EACtCzB,GAAG,EACHsB,QAAQ,EAIT;IACC,MAAMiD,cAAcvE,IAAIE,OAAO,CAACG,MAAM,CAACC,MAAM,EAAEiE,eAAenF,GAAGoF,MAAM;IACvE,MAAMvF,MAAMsF,aAAa;QAAEE,WAAW;IAAK;IAC3C,MAAMjD,eAAenC,KAAKqF,IAAI,CAACH,aAAa,CAAC,sBAAsB,EAAExF,cAAc;IAEnF,wFAAwF;IACxF,wFAAwF;IACxF,IAAI,CAACuC,SAAS+B,IAAI,EAAE;QAClB,MAAMlE,UAAUqC,cAAcR,OAAOC,KAAK,CAAC;QAC3C,OAAOO;IACT;IAEA,IAAI;QACF,MAAMjC,SACJD,SAASqF,OAAO,CAACrD,SAAS+B,IAAI,GAC9BrE,GAAG4F,iBAAiB,CAACpD;IAEzB,EAAE,OAAOY,OAAO;QACd,MAAMlD,GAAGsC,cAAc;YAAEqD,OAAO;QAAK;QACrC,MAAMzC;IACR;IAEA,OAAOZ;AACT"}

package/dist/uploads/getFileFromClientUpload.spec.js

@@ -82,6 +82,9 @@ const videoFile = (overrides = {})=>({
         ...overrides
     });
 const imageFile = (overrides = {})=>({
+        clientUploadContext: {
+            prefix: 'abc'
+        },
         collectionSlug: 'media',
         filename: 'photo.png',
         mimeType: 'image/png',
@@ -523,6 +526,65 @@ describe('getFileFromClientUpload', ()=>{
         const written = await fs.readFile(result.tempFilePath);
         expect(written.length).toBe(0);
     });
+    it('streams the full file to disk when a non-image client upload carries no context', async ()=>{
+        const handler = vi.fn(async ()=>new Response(Buffer.from('full-video-bytes'), {
+                headers: {
+                    'Content-Type': 'video/mp4'
+                },
+                status: 200
+            }));
+        const req = createReq({
+            handlers: [
+                handler
+            ],
+            upload: {
+                disableLocalStorage: true
+            }
+        });
+        const file = videoFile({
+            clientUploadContext: undefined
+        });
+        const result = await getFileFromClientUpload({
+            file,
+            req
+        });
+        expect(handler).toHaveBeenCalledTimes(1);
+        expect(result.tempFilePath).toBeDefined();
+        tempFilesToRemove.push(result.tempFilePath);
+        const written = await fs.readFile(result.tempFilePath);
+        expect(written.toString()).toBe('full-video-bytes');
+    });
+    it('streams the full file to disk when an image client upload carries no context', async ()=>{
+        const handler = vi.fn(async (handlerReq)=>{
+            expect(handlerReq.headers.get('Range')).toBeNull();
+            return new Response(MINIMAL_PNG, {
+                headers: {
+                    'Content-Type': 'image/png'
+                },
+                status: 200
+            });
+        });
+        const req = createReq({
+            handlers: [
+                handler
+            ],
+            upload: {
+                disableLocalStorage: true
+            }
+        });
+        const file = imageFile({
+            clientUploadContext: undefined
+        });
+        const result = await getFileFromClientUpload({
+            file,
+            req
+        });
+        expect(handler).toHaveBeenCalledTimes(1);
+        expect(result.tempFilePath).toBeDefined();
+        tempFilesToRemove.push(result.tempFilePath);
+        const written = await fs.readFile(result.tempFilePath);
+        expect(written).toEqual(MINIMAL_PNG);
+    });
 });
 
 //# sourceMappingURL=getFileFromClientUpload.spec.js.map

package/dist/uploads/getFileFromClientUpload.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getFileFromClientUpload.spec.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { SanitizedUploadConfig } from './types.js'\n\nimport fs from 'fs/promises'\nimport os from 'os'\nimport { afterEach, describe, expect, it, vi } from 'vitest'\n\nimport { HEADER_PROBE_BYTE_LENGTH } from './getFileContentRequirement.js'\nimport { type ClientUploadData, getFileFromClientUpload } from './getFileFromClientUpload.js'\nimport { getImageSize } from './getImageSize.js'\n\nconst MINIMAL_PNG = (() => {\n  const signature = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])\n  const ihdrData = Buffer.alloc(13)\n  ihdrData.writeUInt32BE(400, 0) // width\n  ihdrData.writeUInt32BE(300, 4) // height\n  ihdrData[8] = 8 // bit depth\n  ihdrData[9] = 2 // color type: RGB\n  const ihdrChunk = Buffer.concat([\n    Buffer.from([0, 0, 0, 13]),\n    Buffer.from('IHDR'),\n    ihdrData,\n    Buffer.alloc(4), // crc (unchecked by dimension probing)\n  ])\n  return Buffer.concat([signature, ihdrChunk])\n})()\n\nconst tempFilesToRemove: string[] = []\n\nafterEach(async () => {\n  vi.unstubAllGlobals()\n  for (const tempFilePath of tempFilesToRemove) {\n    await fs.rm(tempFilePath, { force: true })\n  }\n  tempFilesToRemove.length = 0\n})\n\nconst createReq = ({\n  handlers,\n  upload,\n}: {\n  handlers: NonNullable<SanitizedUploadConfig['handlers']>\n  upload?: Partial<SanitizedUploadConfig>\n}): PayloadRequest => {\n  const request = new Request('http://localhost/api/media')\n  const req = request as unknown as PayloadRequest\n\n  req.query = {}\n  req.payload = {\n    collections: {\n      media: {\n        config: {\n          upload: {\n            disableLocalStorage: true,\n            handlers,\n            ...upload,\n          },\n        },\n      },\n    },\n    config: {\n      upload: {},\n    },\n    logger: { error: vi.fn() },\n  } as unknown as PayloadRequest['payload']\n\n  return req\n}\n\nconst videoFile = (overrides: Partial<ClientUploadData> = {}): ClientUploadData => ({\n  clientUploadContext: { prefix: 'abc' },\n  collectionSlug: 'media',\n  filename: 'clip.mp4',\n  mimeType: 'video/mp4',\n  size: 10,\n  ...overrides,\n})\n\nconst imageFile = (overrides: Partial<ClientUploadData> = {}): ClientUploadData => ({\n  collectionSlug: 'media',\n  filename: 'photo.png',\n  mimeType: 'image/png',\n  size: MINIMAL_PNG.length,\n  ...overrides,\n})\n\ndescribe('getFileFromClientUpload', () => {\n  it('does not call a handler and returns empty data with an own clientUploadContext property when no content is required', async () => {\n    const handler = vi.fn()\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(handler).not.toHaveBeenCalled()\n    expect(Object.prototype.hasOwnProperty.call(result, 'clientUploadContext')).toBe(true)\n    expect(result.clientUploadContext).toEqual({ prefix: 'abc' })\n    expect(result.data.length).toBe(0)\n    expect(result.tempFilePath).toBeUndefined()\n    expect(result.name).toBe('clip.mp4')\n    expect(result.size).toBe(10)\n  })\n\n  it('requests a bounded byte range and returns dimensions for a header-only image', async () => {\n    const handler = vi.fn(async (handlerReq: PayloadRequest) => {\n      expect(handlerReq.headers.get('Range')).toBe(`bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}`)\n      return new Response(MINIMAL_PNG, {\n        headers: { 'Content-Type': 'image/png' },\n        status: 206,\n      })\n    })\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(result.data.length).toBeLessThanOrEqual(HEADER_PROBE_BYTE_LENGTH)\n    expect(result.tempFilePath).toBeUndefined()\n    await expect(getImageSize({ file: result })).resolves.toEqual({ height: 300, width: 400 })\n  })\n\n  it('caps the header read at the boundary and cancels the stream without pulling past it', async () => {\n    let hasCancelled = false\n    let hasReadPastBoundary = false\n    const firstChunk = Buffer.concat([\n      MINIMAL_PNG,\n      Buffer.alloc(HEADER_PROBE_BYTE_LENGTH - MINIMAL_PNG.length),\n    ])\n    const stream = new ReadableStream(\n      {\n        cancel() {\n          hasCancelled = true\n        },\n        pull(controller) {\n          hasReadPastBoundary = true\n          controller.error(new Error('Read past header boundary'))\n        },\n        start(controller) {\n          controller.enqueue(firstChunk)\n        },\n      },\n      { highWaterMark: 0 },\n    )\n\n    const handler = vi.fn(\n      async () => new Response(stream, { headers: { 'Content-Type': 'image/png' }, status: 206 }),\n    )\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile({ size: HEADER_PROBE_BYTE_LENGTH })\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(result.data.length).toBe(HEADER_PROBE_BYTE_LENGTH)\n    expect(hasCancelled).toBe(true)\n    expect(hasReadPastBoundary).toBe(false)\n  })\n\n  it('lets a handler read native Request properties like signal through the Range-scoped proxy', async () => {\n    const handler = vi.fn(async (handlerReq: PayloadRequest) => {\n      expect(() => handlerReq.signal).not.toThrow()\n      expect(handlerReq.signal).toBeInstanceOf(AbortSignal)\n      return new Response(MINIMAL_PNG, {\n        headers: { 'Content-Type': 'image/png' },\n        status: 206,\n      })\n    })\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    await getFileFromClientUpload({ file, req })\n\n    expect(handler).toHaveBeenCalledTimes(1)\n  })\n\n  it('falls back to a full fetch when the bounded header cannot be probed for dimensions', async () => {\n    const handler = vi\n      .fn()\n      .mockResolvedValueOnce(\n        new Response(Buffer.from('not an image'), {\n          headers: { 'Content-Type': 'image/png' },\n          status: 206,\n        }),\n      )\n      .mockResolvedValueOnce(\n        new Response(MINIMAL_PNG, { headers: { 'Content-Type': 'image/png' }, status: 200 }),\n      )\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(handler).toHaveBeenCalledTimes(2)\n    expect(result.tempFilePath).toBeDefined()\n    expect(result.data.length).toBe(0)\n  })\n\n  it('streams a full-content response to a temp file without buffering the whole body', async () => {\n    const chunks = [\n      Buffer.from('chunk-one-'),\n      Buffer.from('chunk-two-'),\n      Buffer.from('chunk-three'),\n    ]\n    const stream = new ReadableStream({\n      start(controller) {\n        for (const chunk of chunks) {\n          controller.enqueue(chunk)\n        }\n        controller.close()\n      },\n    })\n\n    const response = new Response(stream, {\n      headers: { 'Content-Type': 'video/mp4' },\n      status: 200,\n    })\n    const arrayBufferTripwire = vi.fn(async () => {\n      throw new Error('Unexpected whole-body buffering')\n    })\n    Object.defineProperty(response, 'arrayBuffer', { value: arrayBufferTripwire })\n\n    const handler = vi.fn(async () => response)\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile({ size: 30 })\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(result.data).toEqual(Buffer.alloc(0))\n    expect(arrayBufferTripwire).not.toHaveBeenCalled()\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written.toString()).toBe(chunks.map((chunk) => chunk.toString()).join(''))\n  })\n\n  it('runs every handler and uses the last one that returns a response, matching v3', async () => {\n    const firstHandler = vi.fn(async () => new Response(Buffer.from('first-response')))\n    const secondHandler = vi.fn(async () => new Response(Buffer.from('second-response')))\n    const req = createReq({\n      handlers: [firstHandler, secondHandler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(firstHandler).toHaveBeenCalledTimes(1)\n    expect(secondHandler).toHaveBeenCalledTimes(1)\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written.toString()).toBe('second-response')\n  })\n\n  it('falls through to the next handler when the first returns nothing', async () => {\n    const firstHandler = vi.fn(async () => undefined)\n    const secondHandler = vi.fn(async () => new Response(Buffer.alloc(10), { status: 200 }))\n    const req = createReq({\n      handlers: [firstHandler, secondHandler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(firstHandler).toHaveBeenCalledTimes(1)\n    expect(secondHandler).toHaveBeenCalledTimes(1)\n  })\n\n  it('follows exactly one redirect from a handler response', async () => {\n    const redirectTarget = 'http://storage.example.com/file.mp4'\n    const handler = vi.fn(\n      async () => new Response(null, { headers: { Location: redirectTarget }, status: 302 }),\n    )\n    const fetchMock = vi.fn(\n      async () =>\n        new Response(Buffer.alloc(10), { headers: { 'Content-Type': 'video/mp4' }, status: 200 }),\n    )\n    vi.stubGlobal('fetch', fetchMock)\n\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(fetchMock).toHaveBeenCalledTimes(1)\n    expect(fetchMock).toHaveBeenCalledWith(redirectTarget)\n  })\n\n  it('forwards the Range header through a redirect during the bounded header probe', async () => {\n    const redirectTarget = 'http://storage.example.com/photo.png'\n    const handler = vi.fn(\n      async () => new Response(null, { headers: { Location: redirectTarget }, status: 302 }),\n    )\n    const fetchMock = vi.fn(\n      async () =>\n        new Response(MINIMAL_PNG, { headers: { 'Content-Type': 'image/png' }, status: 206 }),\n    )\n    vi.stubGlobal('fetch', fetchMock)\n\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(result.tempFilePath).toBeUndefined()\n    expect(fetchMock).toHaveBeenCalledTimes(1)\n    expect(fetchMock).toHaveBeenCalledWith(redirectTarget, {\n      headers: { Range: `bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}` },\n    })\n  })\n\n  it('removes the partial temp file when the stream fails before completion', async () => {\n    const stream = new ReadableStream({\n      pull(controller) {\n        controller.error(new Error('stream broke'))\n      },\n      start(controller) {\n        controller.enqueue(Buffer.from('partial-chunk'))\n      },\n    })\n    const handler = vi.fn(\n      async () => new Response(stream, { headers: { 'Content-Type': 'video/mp4' }, status: 200 }),\n    )\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const tempFileDir = os.tmpdir()\n    const filesBefore = new Set(await fs.readdir(tempFileDir))\n\n    await expect(getFileFromClientUpload({ file, req })).rejects.toThrow('stream broke')\n\n    const filesAfter = await fs.readdir(tempFileDir)\n    const leftoverTempFiles = filesAfter.filter(\n      (entry) => !filesBefore.has(entry) && entry.startsWith('payload-client-upload-'),\n    )\n    expect(leftoverTempFiles).toEqual([])\n  })\n\n  it('requires full content and skips the Range header when the request carries crop or size edits', async () => {\n    const handler = vi.fn(async (handlerReq: PayloadRequest) => {\n      expect(handlerReq.headers.get('Range')).toBeNull()\n      return new Response(MINIMAL_PNG, { headers: { 'Content-Type': 'image/png' }, status: 200 })\n    })\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    req.query = { uploadEdits: { heightInPixels: 100, widthInPixels: 100 } }\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(handler).toHaveBeenCalledTimes(1)\n    expect(result.tempFilePath).toBeDefined()\n    expect(result.data.length).toBe(0)\n  })\n\n  it('treats a null response body as a legitimate zero-byte file', async () => {\n    const handler = vi.fn(\n      async () => new Response(null, { headers: { 'Content-Type': 'video/mp4' }, status: 200 }),\n    )\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile({ size: 0 })\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(result.tempFilePath).toBeDefined()\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written.length).toBe(0)\n  })\n})\n"],"names":["fs","os","afterEach","describe","expect","it","vi","HEADER_PROBE_BYTE_LENGTH","getFileFromClientUpload","getImageSize","MINIMAL_PNG","signature","Buffer","from","ihdrData","alloc","writeUInt32BE","ihdrChunk","concat","tempFilesToRemove","unstubAllGlobals","tempFilePath","rm","force","length","createReq","handlers","upload","request","Request","req","query","payload","collections","media","config","disableLocalStorage","logger","error","fn","videoFile","overrides","clientUploadContext","prefix","collectionSlug","filename","mimeType","size","imageFile","handler","file","result","not","toHaveBeenCalled","Object","prototype","hasOwnProperty","call","toBe","toEqual","data","toBeUndefined","name","handlerReq","headers","get","Response","status","toBeLessThanOrEqual","resolves","height","width","hasCancelled","hasReadPastBoundary","firstChunk","stream","ReadableStream","cancel","pull","controller","Error","start","enqueue","highWaterMark","signal","toThrow","toBeInstanceOf","AbortSignal","toHaveBeenCalledTimes","mockResolvedValueOnce","push","toBeDefined","chunks","chunk","close","response","arrayBufferTripwire","defineProperty","value","mimeTypes","written","readFile","toString","map","join","firstHandler","secondHandler","undefined","redirectTarget","Location","fetchMock","stubGlobal","toHaveBeenCalledWith","Range","tempFileDir","tmpdir","filesBefore","Set","readdir","rejects","filesAfter","leftoverTempFiles","filter","entry","has","startsWith","toBeNull","uploadEdits","heightInPixels","widthInPixels"],"mappings":"AAGA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,QAAQ,KAAI;AACnB,SAASC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE5D,SAASC,wBAAwB,QAAQ,iCAAgC;AACzE,SAAgCC,uBAAuB,QAAQ,+BAA8B;AAC7F,SAASC,YAAY,QAAQ,oBAAmB;AAEhD,MAAMC,cAAc,AAAC,CAAA;IACnB,MAAMC,YAAYC,OAAOC,IAAI,CAAC;QAAC;QAAM;QAAM;QAAM;QAAM;QAAM;QAAM;QAAM;KAAK;IAC9E,MAAMC,WAAWF,OAAOG,KAAK,CAAC;IAC9BD,SAASE,aAAa,CAAC,KAAK,IAAG,QAAQ;IACvCF,SAASE,aAAa,CAAC,KAAK,IAAG,SAAS;IACxCF,QAAQ,CAAC,EAAE,GAAG,GAAE,YAAY;IAC5BA,QAAQ,CAAC,EAAE,GAAG,GAAE,kBAAkB;IAClC,MAAMG,YAAYL,OAAOM,MAAM,CAAC;QAC9BN,OAAOC,IAAI,CAAC;YAAC;YAAG;YAAG;YAAG;SAAG;QACzBD,OAAOC,IAAI,CAAC;QACZC;QACAF,OAAOG,KAAK,CAAC;KACd;IACD,OAAOH,OAAOM,MAAM,CAAC;QAACP;QAAWM;KAAU;AAC7C,CAAA;AAEA,MAAME,oBAA8B,EAAE;AAEtCjB,UAAU;IACRI,GAAGc,gBAAgB;IACnB,KAAK,MAAMC,gBAAgBF,kBAAmB;QAC5C,MAAMnB,GAAGsB,EAAE,CAACD,cAAc;YAAEE,OAAO;QAAK;IAC1C;IACAJ,kBAAkBK,MAAM,GAAG;AAC7B;AAEA,MAAMC,YAAY,CAAC,EACjBC,QAAQ,EACRC,MAAM,EAIP;IACC,MAAMC,UAAU,IAAIC,QAAQ;IAC5B,MAAMC,MAAMF;IAEZE,IAAIC,KAAK,GAAG,CAAC;IACbD,IAAIE,OAAO,GAAG;QACZC,aAAa;YACXC,OAAO;gBACLC,QAAQ;oBACNR,QAAQ;wBACNS,qBAAqB;wBACrBV;wBACA,GAAGC,MAAM;oBACX;gBACF;YACF;QACF;QACAQ,QAAQ;YACNR,QAAQ,CAAC;QACX;QACAU,QAAQ;YAAEC,OAAOhC,GAAGiC,EAAE;QAAG;IAC3B;IAEA,OAAOT;AACT;AAEA,MAAMU,YAAY,CAACC,YAAuC,CAAC,CAAC,GAAwB,CAAA;QAClFC,qBAAqB;YAAEC,QAAQ;QAAM;QACrCC,gBAAgB;QAChBC,UAAU;QACVC,UAAU;QACVC,MAAM;QACN,GAAGN,SAAS;IACd,CAAA;AAEA,MAAMO,YAAY,CAACP,YAAuC,CAAC,CAAC,GAAwB,CAAA;QAClFG,gBAAgB;QAChBC,UAAU;QACVC,UAAU;QACVC,MAAMrC,YAAYc,MAAM;QACxB,GAAGiB,SAAS;IACd,CAAA;AAEAtC,SAAS,2BAA2B;IAClCE,GAAG,uHAAuH;QACxH,MAAM4C,UAAU3C,GAAGiC,EAAE;QACrB,MAAMT,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO6C,SAASG,GAAG,CAACC,gBAAgB;QACpCjD,OAAOkD,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACN,QAAQ,wBAAwBO,IAAI,CAAC;QACjFtD,OAAO+C,OAAOT,mBAAmB,EAAEiB,OAAO,CAAC;YAAEhB,QAAQ;QAAM;QAC3DvC,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAAC;QAChCtD,OAAO+C,OAAO9B,YAAY,EAAEwC,aAAa;QACzCzD,OAAO+C,OAAOW,IAAI,EAAEJ,IAAI,CAAC;QACzBtD,OAAO+C,OAAOJ,IAAI,EAAEW,IAAI,CAAC;IAC3B;IAEArD,GAAG,gFAAgF;QACjF,MAAM4C,UAAU3C,GAAGiC,EAAE,CAAC,OAAOwB;YAC3B3D,OAAO2D,WAAWC,OAAO,CAACC,GAAG,CAAC,UAAUP,IAAI,CAAC,CAAC,QAAQ,EAAEnD,2BAA2B,GAAG;YACtF,OAAO,IAAI2D,SAASxD,aAAa;gBAC/BsD,SAAS;oBAAE,gBAAgB;gBAAY;gBACvCG,QAAQ;YACV;QACF;QACA,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAE4C,mBAAmB,CAAC7D;QAC/CH,OAAO+C,OAAO9B,YAAY,EAAEwC,aAAa;QACzC,MAAMzD,OAAOK,aAAa;YAAEyC,MAAMC;QAAO,IAAIkB,QAAQ,CAACV,OAAO,CAAC;YAAEW,QAAQ;YAAKC,OAAO;QAAI;IAC1F;IAEAlE,GAAG,uFAAuF;QACxF,IAAImE,eAAe;QACnB,IAAIC,sBAAsB;QAC1B,MAAMC,aAAa9D,OAAOM,MAAM,CAAC;YAC/BR;YACAE,OAAOG,KAAK,CAACR,2BAA2BG,YAAYc,MAAM;SAC3D;QACD,MAAMmD,SAAS,IAAIC,eACjB;YACEC;gBACEL,eAAe;YACjB;YACAM,MAAKC,UAAU;gBACbN,sBAAsB;gBACtBM,WAAWzC,KAAK,CAAC,IAAI0C,MAAM;YAC7B;YACAC,OAAMF,UAAU;gBACdA,WAAWG,OAAO,CAACR;YACrB;QACF,GACA;YAAES,eAAe;QAAE;QAGrB,MAAMlC,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAASS,QAAQ;gBAAEX,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAE3F,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF,UAAU;YAAED,MAAMxC;QAAyB;QAExD,MAAM4C,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAACnD;QAChCH,OAAOoE,cAAcd,IAAI,CAAC;QAC1BtD,OAAOqE,qBAAqBf,IAAI,CAAC;IACnC;IAEArD,GAAG,4FAA4F;QAC7F,MAAM4C,UAAU3C,GAAGiC,EAAE,CAAC,OAAOwB;YAC3B3D,OAAO,IAAM2D,WAAWqB,MAAM,EAAEhC,GAAG,CAACiC,OAAO;YAC3CjF,OAAO2D,WAAWqB,MAAM,EAAEE,cAAc,CAACC;YACzC,OAAO,IAAIrB,SAASxD,aAAa;gBAC/BsD,SAAS;oBAAE,gBAAgB;gBAAY;gBACvCG,QAAQ;YACV;QACF;QACA,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMxC,wBAAwB;YAAE0C;YAAMpB;QAAI;QAE1C1B,OAAO6C,SAASuC,qBAAqB,CAAC;IACxC;IAEAnF,GAAG,sFAAsF;QACvF,MAAM4C,UAAU3C,GACbiC,EAAE,GACFkD,qBAAqB,CACpB,IAAIvB,SAAStD,OAAOC,IAAI,CAAC,iBAAiB;YACxCmD,SAAS;gBAAE,gBAAgB;YAAY;YACvCG,QAAQ;QACV,IAEDsB,qBAAqB,CACpB,IAAIvB,SAASxD,aAAa;YAAEsD,SAAS;gBAAE,gBAAgB;YAAY;YAAGG,QAAQ;QAAI;QAEtF,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO6C,SAASuC,qBAAqB,CAAC;QACtCpF,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvCvF,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAAC;IAClC;IAEArD,GAAG,mFAAmF;QACpF,MAAMuF,SAAS;YACbhF,OAAOC,IAAI,CAAC;YACZD,OAAOC,IAAI,CAAC;YACZD,OAAOC,IAAI,CAAC;SACb;QACD,MAAM8D,SAAS,IAAIC,eAAe;YAChCK,OAAMF,UAAU;gBACd,KAAK,MAAMc,SAASD,OAAQ;oBAC1Bb,WAAWG,OAAO,CAACW;gBACrB;gBACAd,WAAWe,KAAK;YAClB;QACF;QAEA,MAAMC,WAAW,IAAI7B,SAASS,QAAQ;YACpCX,SAAS;gBAAE,gBAAgB;YAAY;YACvCG,QAAQ;QACV;QACA,MAAM6B,sBAAsB1F,GAAGiC,EAAE,CAAC;YAChC,MAAM,IAAIyC,MAAM;QAClB;QACA1B,OAAO2C,cAAc,CAACF,UAAU,eAAe;YAAEG,OAAOF;QAAoB;QAE5E,MAAM/C,UAAU3C,GAAGiC,EAAE,CAAC,UAAYwD;QAClC,MAAMjE,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV,UAAU;YAAEO,MAAM;QAAG;QAElC,MAAMI,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO+C,OAAOS,IAAI,EAAED,OAAO,CAAC/C,OAAOG,KAAK,CAAC;QACzCX,OAAO4F,qBAAqB5C,GAAG,CAACC,gBAAgB;QAChD,MAAM+C,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,QAAQE,QAAQ,IAAI5C,IAAI,CAACkC,OAAOW,GAAG,CAAC,CAACV,QAAUA,MAAMS,QAAQ,IAAIE,IAAI,CAAC;IAC/E;IAEAnG,GAAG,iFAAiF;QAClF,MAAMoG,eAAenG,GAAGiC,EAAE,CAAC,UAAY,IAAI2B,SAAStD,OAAOC,IAAI,CAAC;QAChE,MAAM6F,gBAAgBpG,GAAGiC,EAAE,CAAC,UAAY,IAAI2B,SAAStD,OAAOC,IAAI,CAAC;QACjE,MAAMiB,MAAML,UAAU;YACpBC,UAAU;gBAAC+E;gBAAcC;aAAc;YACvC/E,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAOqG,cAAcjB,qBAAqB,CAAC;QAC3CpF,OAAOsG,eAAelB,qBAAqB,CAAC;QAC5C,MAAMY,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,QAAQE,QAAQ,IAAI5C,IAAI,CAAC;IAClC;IAEArD,GAAG,oEAAoE;QACrE,MAAMoG,eAAenG,GAAGiC,EAAE,CAAC,UAAYoE;QACvC,MAAMD,gBAAgBpG,GAAGiC,EAAE,CAAC,UAAY,IAAI2B,SAAStD,OAAOG,KAAK,CAAC,KAAK;gBAAEoD,QAAQ;YAAI;QACrF,MAAMrC,MAAML,UAAU;YACpBC,UAAU;gBAAC+E;gBAAcC;aAAc;YACvC/E,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAOqG,cAAcjB,qBAAqB,CAAC;QAC3CpF,OAAOsG,eAAelB,qBAAqB,CAAC;IAC9C;IAEAnF,GAAG,wDAAwD;QACzD,MAAMuG,iBAAiB;QACvB,MAAM3D,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAAS,MAAM;gBAAEF,SAAS;oBAAE6C,UAAUD;gBAAe;gBAAGzC,QAAQ;YAAI;QAEtF,MAAM2C,YAAYxG,GAAGiC,EAAE,CACrB,UACE,IAAI2B,SAAStD,OAAOG,KAAK,CAAC,KAAK;gBAAEiD,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAE3F7D,GAAGyG,UAAU,CAAC,SAASD;QAEvB,MAAMhF,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO0G,WAAWtB,qBAAqB,CAAC;QACxCpF,OAAO0G,WAAWE,oBAAoB,CAACJ;IACzC;IAEAvG,GAAG,gFAAgF;QACjF,MAAMuG,iBAAiB;QACvB,MAAM3D,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAAS,MAAM;gBAAEF,SAAS;oBAAE6C,UAAUD;gBAAe;gBAAGzC,QAAQ;YAAI;QAEtF,MAAM2C,YAAYxG,GAAGiC,EAAE,CACrB,UACE,IAAI2B,SAASxD,aAAa;gBAAEsD,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAEtF7D,GAAGyG,UAAU,CAAC,SAASD;QAEvB,MAAMhF,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO+C,OAAO9B,YAAY,EAAEwC,aAAa;QACzCzD,OAAO0G,WAAWtB,qBAAqB,CAAC;QACxCpF,OAAO0G,WAAWE,oBAAoB,CAACJ,gBAAgB;YACrD5C,SAAS;gBAAEiD,OAAO,CAAC,QAAQ,EAAE1G,2BAA2B,GAAG;YAAC;QAC9D;IACF;IAEAF,GAAG,yEAAyE;QAC1E,MAAMsE,SAAS,IAAIC,eAAe;YAChCE,MAAKC,UAAU;gBACbA,WAAWzC,KAAK,CAAC,IAAI0C,MAAM;YAC7B;YACAC,OAAMF,UAAU;gBACdA,WAAWG,OAAO,CAACtE,OAAOC,IAAI,CAAC;YACjC;QACF;QACA,MAAMoC,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAASS,QAAQ;gBAAEX,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAE3F,MAAMrC,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAM0E,cAAcjH,GAAGkH,MAAM;QAC7B,MAAMC,cAAc,IAAIC,IAAI,MAAMrH,GAAGsH,OAAO,CAACJ;QAE7C,MAAM9G,OAAOI,wBAAwB;YAAE0C;YAAMpB;QAAI,IAAIyF,OAAO,CAAClC,OAAO,CAAC;QAErE,MAAMmC,aAAa,MAAMxH,GAAGsH,OAAO,CAACJ;QACpC,MAAMO,oBAAoBD,WAAWE,MAAM,CACzC,CAACC,QAAU,CAACP,YAAYQ,GAAG,CAACD,UAAUA,MAAME,UAAU,CAAC;QAEzDzH,OAAOqH,mBAAmB9D,OAAO,CAAC,EAAE;IACtC;IAEAtD,GAAG,gGAAgG;QACjG,MAAM4C,UAAU3C,GAAGiC,EAAE,CAAC,OAAOwB;YAC3B3D,OAAO2D,WAAWC,OAAO,CAACC,GAAG,CAAC,UAAU6D,QAAQ;YAChD,OAAO,IAAI5D,SAASxD,aAAa;gBAAEsD,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAC3F;QACA,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnFN,IAAIC,KAAK,GAAG;YAAEgG,aAAa;gBAAEC,gBAAgB;gBAAKC,eAAe;YAAI;QAAE;QACvE,MAAM/E,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO6C,SAASuC,qBAAqB,CAAC;QACtCpF,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvCvF,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAAC;IAClC;IAEArD,GAAG,8DAA8D;QAC/D,MAAM4C,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAAS,MAAM;gBAAEF,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAEzF,MAAMrC,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV,UAAU;YAAEO,MAAM;QAAE;QAEjC,MAAMI,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvC,MAAMS,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,QAAQ5E,MAAM,EAAEkC,IAAI,CAAC;IAC9B;AACF"}
+{"version":3,"sources":["../../src/uploads/getFileFromClientUpload.spec.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { SanitizedUploadConfig } from './types.js'\n\nimport fs from 'fs/promises'\nimport os from 'os'\nimport { afterEach, describe, expect, it, vi } from 'vitest'\n\nimport { HEADER_PROBE_BYTE_LENGTH } from './getFileContentRequirement.js'\nimport { type ClientUploadData, getFileFromClientUpload } from './getFileFromClientUpload.js'\nimport { getImageSize } from './getImageSize.js'\n\nconst MINIMAL_PNG = (() => {\n  const signature = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])\n  const ihdrData = Buffer.alloc(13)\n  ihdrData.writeUInt32BE(400, 0) // width\n  ihdrData.writeUInt32BE(300, 4) // height\n  ihdrData[8] = 8 // bit depth\n  ihdrData[9] = 2 // color type: RGB\n  const ihdrChunk = Buffer.concat([\n    Buffer.from([0, 0, 0, 13]),\n    Buffer.from('IHDR'),\n    ihdrData,\n    Buffer.alloc(4), // crc (unchecked by dimension probing)\n  ])\n  return Buffer.concat([signature, ihdrChunk])\n})()\n\nconst tempFilesToRemove: string[] = []\n\nafterEach(async () => {\n  vi.unstubAllGlobals()\n  for (const tempFilePath of tempFilesToRemove) {\n    await fs.rm(tempFilePath, { force: true })\n  }\n  tempFilesToRemove.length = 0\n})\n\nconst createReq = ({\n  handlers,\n  upload,\n}: {\n  handlers: NonNullable<SanitizedUploadConfig['handlers']>\n  upload?: Partial<SanitizedUploadConfig>\n}): PayloadRequest => {\n  const request = new Request('http://localhost/api/media')\n  const req = request as unknown as PayloadRequest\n\n  req.query = {}\n  req.payload = {\n    collections: {\n      media: {\n        config: {\n          upload: {\n            disableLocalStorage: true,\n            handlers,\n            ...upload,\n          },\n        },\n      },\n    },\n    config: {\n      upload: {},\n    },\n    logger: { error: vi.fn() },\n  } as unknown as PayloadRequest['payload']\n\n  return req\n}\n\nconst videoFile = (overrides: Partial<ClientUploadData> = {}): ClientUploadData => ({\n  clientUploadContext: { prefix: 'abc' },\n  collectionSlug: 'media',\n  filename: 'clip.mp4',\n  mimeType: 'video/mp4',\n  size: 10,\n  ...overrides,\n})\n\nconst imageFile = (overrides: Partial<ClientUploadData> = {}): ClientUploadData => ({\n  clientUploadContext: { prefix: 'abc' },\n  collectionSlug: 'media',\n  filename: 'photo.png',\n  mimeType: 'image/png',\n  size: MINIMAL_PNG.length,\n  ...overrides,\n})\n\ndescribe('getFileFromClientUpload', () => {\n  it('does not call a handler and returns empty data with an own clientUploadContext property when no content is required', async () => {\n    const handler = vi.fn()\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(handler).not.toHaveBeenCalled()\n    expect(Object.prototype.hasOwnProperty.call(result, 'clientUploadContext')).toBe(true)\n    expect(result.clientUploadContext).toEqual({ prefix: 'abc' })\n    expect(result.data.length).toBe(0)\n    expect(result.tempFilePath).toBeUndefined()\n    expect(result.name).toBe('clip.mp4')\n    expect(result.size).toBe(10)\n  })\n\n  it('requests a bounded byte range and returns dimensions for a header-only image', async () => {\n    const handler = vi.fn(async (handlerReq: PayloadRequest) => {\n      expect(handlerReq.headers.get('Range')).toBe(`bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}`)\n      return new Response(MINIMAL_PNG, {\n        headers: { 'Content-Type': 'image/png' },\n        status: 206,\n      })\n    })\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(result.data.length).toBeLessThanOrEqual(HEADER_PROBE_BYTE_LENGTH)\n    expect(result.tempFilePath).toBeUndefined()\n    await expect(getImageSize({ file: result })).resolves.toEqual({ height: 300, width: 400 })\n  })\n\n  it('caps the header read at the boundary and cancels the stream without pulling past it', async () => {\n    let hasCancelled = false\n    let hasReadPastBoundary = false\n    const firstChunk = Buffer.concat([\n      MINIMAL_PNG,\n      Buffer.alloc(HEADER_PROBE_BYTE_LENGTH - MINIMAL_PNG.length),\n    ])\n    const stream = new ReadableStream(\n      {\n        cancel() {\n          hasCancelled = true\n        },\n        pull(controller) {\n          hasReadPastBoundary = true\n          controller.error(new Error('Read past header boundary'))\n        },\n        start(controller) {\n          controller.enqueue(firstChunk)\n        },\n      },\n      { highWaterMark: 0 },\n    )\n\n    const handler = vi.fn(\n      async () => new Response(stream, { headers: { 'Content-Type': 'image/png' }, status: 206 }),\n    )\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile({ size: HEADER_PROBE_BYTE_LENGTH })\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(result.data.length).toBe(HEADER_PROBE_BYTE_LENGTH)\n    expect(hasCancelled).toBe(true)\n    expect(hasReadPastBoundary).toBe(false)\n  })\n\n  it('lets a handler read native Request properties like signal through the Range-scoped proxy', async () => {\n    const handler = vi.fn(async (handlerReq: PayloadRequest) => {\n      expect(() => handlerReq.signal).not.toThrow()\n      expect(handlerReq.signal).toBeInstanceOf(AbortSignal)\n      return new Response(MINIMAL_PNG, {\n        headers: { 'Content-Type': 'image/png' },\n        status: 206,\n      })\n    })\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    await getFileFromClientUpload({ file, req })\n\n    expect(handler).toHaveBeenCalledTimes(1)\n  })\n\n  it('falls back to a full fetch when the bounded header cannot be probed for dimensions', async () => {\n    const handler = vi\n      .fn()\n      .mockResolvedValueOnce(\n        new Response(Buffer.from('not an image'), {\n          headers: { 'Content-Type': 'image/png' },\n          status: 206,\n        }),\n      )\n      .mockResolvedValueOnce(\n        new Response(MINIMAL_PNG, { headers: { 'Content-Type': 'image/png' }, status: 200 }),\n      )\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(handler).toHaveBeenCalledTimes(2)\n    expect(result.tempFilePath).toBeDefined()\n    expect(result.data.length).toBe(0)\n  })\n\n  it('streams a full-content response to a temp file without buffering the whole body', async () => {\n    const chunks = [\n      Buffer.from('chunk-one-'),\n      Buffer.from('chunk-two-'),\n      Buffer.from('chunk-three'),\n    ]\n    const stream = new ReadableStream({\n      start(controller) {\n        for (const chunk of chunks) {\n          controller.enqueue(chunk)\n        }\n        controller.close()\n      },\n    })\n\n    const response = new Response(stream, {\n      headers: { 'Content-Type': 'video/mp4' },\n      status: 200,\n    })\n    const arrayBufferTripwire = vi.fn(async () => {\n      throw new Error('Unexpected whole-body buffering')\n    })\n    Object.defineProperty(response, 'arrayBuffer', { value: arrayBufferTripwire })\n\n    const handler = vi.fn(async () => response)\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile({ size: 30 })\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(result.data).toEqual(Buffer.alloc(0))\n    expect(arrayBufferTripwire).not.toHaveBeenCalled()\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written.toString()).toBe(chunks.map((chunk) => chunk.toString()).join(''))\n  })\n\n  it('runs every handler and uses the last one that returns a response, matching v3', async () => {\n    const firstHandler = vi.fn(async () => new Response(Buffer.from('first-response')))\n    const secondHandler = vi.fn(async () => new Response(Buffer.from('second-response')))\n    const req = createReq({\n      handlers: [firstHandler, secondHandler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(firstHandler).toHaveBeenCalledTimes(1)\n    expect(secondHandler).toHaveBeenCalledTimes(1)\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written.toString()).toBe('second-response')\n  })\n\n  it('falls through to the next handler when the first returns nothing', async () => {\n    const firstHandler = vi.fn(async () => undefined)\n    const secondHandler = vi.fn(async () => new Response(Buffer.alloc(10), { status: 200 }))\n    const req = createReq({\n      handlers: [firstHandler, secondHandler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(firstHandler).toHaveBeenCalledTimes(1)\n    expect(secondHandler).toHaveBeenCalledTimes(1)\n  })\n\n  it('follows exactly one redirect from a handler response', async () => {\n    const redirectTarget = 'http://storage.example.com/file.mp4'\n    const handler = vi.fn(\n      async () => new Response(null, { headers: { Location: redirectTarget }, status: 302 }),\n    )\n    const fetchMock = vi.fn(\n      async () =>\n        new Response(Buffer.alloc(10), { headers: { 'Content-Type': 'video/mp4' }, status: 200 }),\n    )\n    vi.stubGlobal('fetch', fetchMock)\n\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(fetchMock).toHaveBeenCalledTimes(1)\n    expect(fetchMock).toHaveBeenCalledWith(redirectTarget)\n  })\n\n  it('forwards the Range header through a redirect during the bounded header probe', async () => {\n    const redirectTarget = 'http://storage.example.com/photo.png'\n    const handler = vi.fn(\n      async () => new Response(null, { headers: { Location: redirectTarget }, status: 302 }),\n    )\n    const fetchMock = vi.fn(\n      async () =>\n        new Response(MINIMAL_PNG, { headers: { 'Content-Type': 'image/png' }, status: 206 }),\n    )\n    vi.stubGlobal('fetch', fetchMock)\n\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(result.tempFilePath).toBeUndefined()\n    expect(fetchMock).toHaveBeenCalledTimes(1)\n    expect(fetchMock).toHaveBeenCalledWith(redirectTarget, {\n      headers: { Range: `bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}` },\n    })\n  })\n\n  it('removes the partial temp file when the stream fails before completion', async () => {\n    const stream = new ReadableStream({\n      pull(controller) {\n        controller.error(new Error('stream broke'))\n      },\n      start(controller) {\n        controller.enqueue(Buffer.from('partial-chunk'))\n      },\n    })\n    const handler = vi.fn(\n      async () => new Response(stream, { headers: { 'Content-Type': 'video/mp4' }, status: 200 }),\n    )\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile()\n\n    const tempFileDir = os.tmpdir()\n    const filesBefore = new Set(await fs.readdir(tempFileDir))\n\n    await expect(getFileFromClientUpload({ file, req })).rejects.toThrow('stream broke')\n\n    const filesAfter = await fs.readdir(tempFileDir)\n    const leftoverTempFiles = filesAfter.filter(\n      (entry) => !filesBefore.has(entry) && entry.startsWith('payload-client-upload-'),\n    )\n    expect(leftoverTempFiles).toEqual([])\n  })\n\n  it('requires full content and skips the Range header when the request carries crop or size edits', async () => {\n    const handler = vi.fn(async (handlerReq: PayloadRequest) => {\n      expect(handlerReq.headers.get('Range')).toBeNull()\n      return new Response(MINIMAL_PNG, { headers: { 'Content-Type': 'image/png' }, status: 200 })\n    })\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    req.query = { uploadEdits: { heightInPixels: 100, widthInPixels: 100 } }\n    const file = imageFile()\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(handler).toHaveBeenCalledTimes(1)\n    expect(result.tempFilePath).toBeDefined()\n    expect(result.data.length).toBe(0)\n  })\n\n  it('treats a null response body as a legitimate zero-byte file', async () => {\n    const handler = vi.fn(\n      async () => new Response(null, { headers: { 'Content-Type': 'video/mp4' }, status: 200 }),\n    )\n    const req = createReq({\n      handlers: [handler],\n      upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n    })\n    const file = videoFile({ size: 0 })\n\n    const result = await getFileFromClientUpload({ file, req })\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    expect(result.tempFilePath).toBeDefined()\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written.length).toBe(0)\n  })\n\n  it('streams the full file to disk when a non-image client upload carries no context', async () => {\n    const handler = vi.fn(\n      async () =>\n        new Response(Buffer.from('full-video-bytes'), {\n          headers: { 'Content-Type': 'video/mp4' },\n          status: 200,\n        }),\n    )\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = videoFile({ clientUploadContext: undefined })\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(handler).toHaveBeenCalledTimes(1)\n    expect(result.tempFilePath).toBeDefined()\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written.toString()).toBe('full-video-bytes')\n  })\n\n  it('streams the full file to disk when an image client upload carries no context', async () => {\n    const handler = vi.fn(async (handlerReq: PayloadRequest) => {\n      expect(handlerReq.headers.get('Range')).toBeNull()\n      return new Response(MINIMAL_PNG, { headers: { 'Content-Type': 'image/png' }, status: 200 })\n    })\n    const req = createReq({ handlers: [handler], upload: { disableLocalStorage: true } })\n    const file = imageFile({ clientUploadContext: undefined })\n\n    const result = await getFileFromClientUpload({ file, req })\n\n    expect(handler).toHaveBeenCalledTimes(1)\n    expect(result.tempFilePath).toBeDefined()\n    tempFilesToRemove.push(result.tempFilePath!)\n\n    const written = await fs.readFile(result.tempFilePath!)\n    expect(written).toEqual(MINIMAL_PNG)\n  })\n})\n"],"names":["fs","os","afterEach","describe","expect","it","vi","HEADER_PROBE_BYTE_LENGTH","getFileFromClientUpload","getImageSize","MINIMAL_PNG","signature","Buffer","from","ihdrData","alloc","writeUInt32BE","ihdrChunk","concat","tempFilesToRemove","unstubAllGlobals","tempFilePath","rm","force","length","createReq","handlers","upload","request","Request","req","query","payload","collections","media","config","disableLocalStorage","logger","error","fn","videoFile","overrides","clientUploadContext","prefix","collectionSlug","filename","mimeType","size","imageFile","handler","file","result","not","toHaveBeenCalled","Object","prototype","hasOwnProperty","call","toBe","toEqual","data","toBeUndefined","name","handlerReq","headers","get","Response","status","toBeLessThanOrEqual","resolves","height","width","hasCancelled","hasReadPastBoundary","firstChunk","stream","ReadableStream","cancel","pull","controller","Error","start","enqueue","highWaterMark","signal","toThrow","toBeInstanceOf","AbortSignal","toHaveBeenCalledTimes","mockResolvedValueOnce","push","toBeDefined","chunks","chunk","close","response","arrayBufferTripwire","defineProperty","value","mimeTypes","written","readFile","toString","map","join","firstHandler","secondHandler","undefined","redirectTarget","Location","fetchMock","stubGlobal","toHaveBeenCalledWith","Range","tempFileDir","tmpdir","filesBefore","Set","readdir","rejects","filesAfter","leftoverTempFiles","filter","entry","has","startsWith","toBeNull","uploadEdits","heightInPixels","widthInPixels"],"mappings":"AAGA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,QAAQ,KAAI;AACnB,SAASC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE5D,SAASC,wBAAwB,QAAQ,iCAAgC;AACzE,SAAgCC,uBAAuB,QAAQ,+BAA8B;AAC7F,SAASC,YAAY,QAAQ,oBAAmB;AAEhD,MAAMC,cAAc,AAAC,CAAA;IACnB,MAAMC,YAAYC,OAAOC,IAAI,CAAC;QAAC;QAAM;QAAM;QAAM;QAAM;QAAM;QAAM;QAAM;KAAK;IAC9E,MAAMC,WAAWF,OAAOG,KAAK,CAAC;IAC9BD,SAASE,aAAa,CAAC,KAAK,IAAG,QAAQ;IACvCF,SAASE,aAAa,CAAC,KAAK,IAAG,SAAS;IACxCF,QAAQ,CAAC,EAAE,GAAG,GAAE,YAAY;IAC5BA,QAAQ,CAAC,EAAE,GAAG,GAAE,kBAAkB;IAClC,MAAMG,YAAYL,OAAOM,MAAM,CAAC;QAC9BN,OAAOC,IAAI,CAAC;YAAC;YAAG;YAAG;YAAG;SAAG;QACzBD,OAAOC,IAAI,CAAC;QACZC;QACAF,OAAOG,KAAK,CAAC;KACd;IACD,OAAOH,OAAOM,MAAM,CAAC;QAACP;QAAWM;KAAU;AAC7C,CAAA;AAEA,MAAME,oBAA8B,EAAE;AAEtCjB,UAAU;IACRI,GAAGc,gBAAgB;IACnB,KAAK,MAAMC,gBAAgBF,kBAAmB;QAC5C,MAAMnB,GAAGsB,EAAE,CAACD,cAAc;YAAEE,OAAO;QAAK;IAC1C;IACAJ,kBAAkBK,MAAM,GAAG;AAC7B;AAEA,MAAMC,YAAY,CAAC,EACjBC,QAAQ,EACRC,MAAM,EAIP;IACC,MAAMC,UAAU,IAAIC,QAAQ;IAC5B,MAAMC,MAAMF;IAEZE,IAAIC,KAAK,GAAG,CAAC;IACbD,IAAIE,OAAO,GAAG;QACZC,aAAa;YACXC,OAAO;gBACLC,QAAQ;oBACNR,QAAQ;wBACNS,qBAAqB;wBACrBV;wBACA,GAAGC,MAAM;oBACX;gBACF;YACF;QACF;QACAQ,QAAQ;YACNR,QAAQ,CAAC;QACX;QACAU,QAAQ;YAAEC,OAAOhC,GAAGiC,EAAE;QAAG;IAC3B;IAEA,OAAOT;AACT;AAEA,MAAMU,YAAY,CAACC,YAAuC,CAAC,CAAC,GAAwB,CAAA;QAClFC,qBAAqB;YAAEC,QAAQ;QAAM;QACrCC,gBAAgB;QAChBC,UAAU;QACVC,UAAU;QACVC,MAAM;QACN,GAAGN,SAAS;IACd,CAAA;AAEA,MAAMO,YAAY,CAACP,YAAuC,CAAC,CAAC,GAAwB,CAAA;QAClFC,qBAAqB;YAAEC,QAAQ;QAAM;QACrCC,gBAAgB;QAChBC,UAAU;QACVC,UAAU;QACVC,MAAMrC,YAAYc,MAAM;QACxB,GAAGiB,SAAS;IACd,CAAA;AAEAtC,SAAS,2BAA2B;IAClCE,GAAG,uHAAuH;QACxH,MAAM4C,UAAU3C,GAAGiC,EAAE;QACrB,MAAMT,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO6C,SAASG,GAAG,CAACC,gBAAgB;QACpCjD,OAAOkD,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACN,QAAQ,wBAAwBO,IAAI,CAAC;QACjFtD,OAAO+C,OAAOT,mBAAmB,EAAEiB,OAAO,CAAC;YAAEhB,QAAQ;QAAM;QAC3DvC,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAAC;QAChCtD,OAAO+C,OAAO9B,YAAY,EAAEwC,aAAa;QACzCzD,OAAO+C,OAAOW,IAAI,EAAEJ,IAAI,CAAC;QACzBtD,OAAO+C,OAAOJ,IAAI,EAAEW,IAAI,CAAC;IAC3B;IAEArD,GAAG,gFAAgF;QACjF,MAAM4C,UAAU3C,GAAGiC,EAAE,CAAC,OAAOwB;YAC3B3D,OAAO2D,WAAWC,OAAO,CAACC,GAAG,CAAC,UAAUP,IAAI,CAAC,CAAC,QAAQ,EAAEnD,2BAA2B,GAAG;YACtF,OAAO,IAAI2D,SAASxD,aAAa;gBAC/BsD,SAAS;oBAAE,gBAAgB;gBAAY;gBACvCG,QAAQ;YACV;QACF;QACA,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAE4C,mBAAmB,CAAC7D;QAC/CH,OAAO+C,OAAO9B,YAAY,EAAEwC,aAAa;QACzC,MAAMzD,OAAOK,aAAa;YAAEyC,MAAMC;QAAO,IAAIkB,QAAQ,CAACV,OAAO,CAAC;YAAEW,QAAQ;YAAKC,OAAO;QAAI;IAC1F;IAEAlE,GAAG,uFAAuF;QACxF,IAAImE,eAAe;QACnB,IAAIC,sBAAsB;QAC1B,MAAMC,aAAa9D,OAAOM,MAAM,CAAC;YAC/BR;YACAE,OAAOG,KAAK,CAACR,2BAA2BG,YAAYc,MAAM;SAC3D;QACD,MAAMmD,SAAS,IAAIC,eACjB;YACEC;gBACEL,eAAe;YACjB;YACAM,MAAKC,UAAU;gBACbN,sBAAsB;gBACtBM,WAAWzC,KAAK,CAAC,IAAI0C,MAAM;YAC7B;YACAC,OAAMF,UAAU;gBACdA,WAAWG,OAAO,CAACR;YACrB;QACF,GACA;YAAES,eAAe;QAAE;QAGrB,MAAMlC,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAASS,QAAQ;gBAAEX,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAE3F,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF,UAAU;YAAED,MAAMxC;QAAyB;QAExD,MAAM4C,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAACnD;QAChCH,OAAOoE,cAAcd,IAAI,CAAC;QAC1BtD,OAAOqE,qBAAqBf,IAAI,CAAC;IACnC;IAEArD,GAAG,4FAA4F;QAC7F,MAAM4C,UAAU3C,GAAGiC,EAAE,CAAC,OAAOwB;YAC3B3D,OAAO,IAAM2D,WAAWqB,MAAM,EAAEhC,GAAG,CAACiC,OAAO;YAC3CjF,OAAO2D,WAAWqB,MAAM,EAAEE,cAAc,CAACC;YACzC,OAAO,IAAIrB,SAASxD,aAAa;gBAC/BsD,SAAS;oBAAE,gBAAgB;gBAAY;gBACvCG,QAAQ;YACV;QACF;QACA,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMxC,wBAAwB;YAAE0C;YAAMpB;QAAI;QAE1C1B,OAAO6C,SAASuC,qBAAqB,CAAC;IACxC;IAEAnF,GAAG,sFAAsF;QACvF,MAAM4C,UAAU3C,GACbiC,EAAE,GACFkD,qBAAqB,CACpB,IAAIvB,SAAStD,OAAOC,IAAI,CAAC,iBAAiB;YACxCmD,SAAS;gBAAE,gBAAgB;YAAY;YACvCG,QAAQ;QACV,IAEDsB,qBAAqB,CACpB,IAAIvB,SAASxD,aAAa;YAAEsD,SAAS;gBAAE,gBAAgB;YAAY;YAAGG,QAAQ;QAAI;QAEtF,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO6C,SAASuC,qBAAqB,CAAC;QACtCpF,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvCvF,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAAC;IAClC;IAEArD,GAAG,mFAAmF;QACpF,MAAMuF,SAAS;YACbhF,OAAOC,IAAI,CAAC;YACZD,OAAOC,IAAI,CAAC;YACZD,OAAOC,IAAI,CAAC;SACb;QACD,MAAM8D,SAAS,IAAIC,eAAe;YAChCK,OAAMF,UAAU;gBACd,KAAK,MAAMc,SAASD,OAAQ;oBAC1Bb,WAAWG,OAAO,CAACW;gBACrB;gBACAd,WAAWe,KAAK;YAClB;QACF;QAEA,MAAMC,WAAW,IAAI7B,SAASS,QAAQ;YACpCX,SAAS;gBAAE,gBAAgB;YAAY;YACvCG,QAAQ;QACV;QACA,MAAM6B,sBAAsB1F,GAAGiC,EAAE,CAAC;YAChC,MAAM,IAAIyC,MAAM;QAClB;QACA1B,OAAO2C,cAAc,CAACF,UAAU,eAAe;YAAEG,OAAOF;QAAoB;QAE5E,MAAM/C,UAAU3C,GAAGiC,EAAE,CAAC,UAAYwD;QAClC,MAAMjE,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV,UAAU;YAAEO,MAAM;QAAG;QAElC,MAAMI,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO+C,OAAOS,IAAI,EAAED,OAAO,CAAC/C,OAAOG,KAAK,CAAC;QACzCX,OAAO4F,qBAAqB5C,GAAG,CAACC,gBAAgB;QAChD,MAAM+C,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,QAAQE,QAAQ,IAAI5C,IAAI,CAACkC,OAAOW,GAAG,CAAC,CAACV,QAAUA,MAAMS,QAAQ,IAAIE,IAAI,CAAC;IAC/E;IAEAnG,GAAG,iFAAiF;QAClF,MAAMoG,eAAenG,GAAGiC,EAAE,CAAC,UAAY,IAAI2B,SAAStD,OAAOC,IAAI,CAAC;QAChE,MAAM6F,gBAAgBpG,GAAGiC,EAAE,CAAC,UAAY,IAAI2B,SAAStD,OAAOC,IAAI,CAAC;QACjE,MAAMiB,MAAML,UAAU;YACpBC,UAAU;gBAAC+E;gBAAcC;aAAc;YACvC/E,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAOqG,cAAcjB,qBAAqB,CAAC;QAC3CpF,OAAOsG,eAAelB,qBAAqB,CAAC;QAC5C,MAAMY,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,QAAQE,QAAQ,IAAI5C,IAAI,CAAC;IAClC;IAEArD,GAAG,oEAAoE;QACrE,MAAMoG,eAAenG,GAAGiC,EAAE,CAAC,UAAYoE;QACvC,MAAMD,gBAAgBpG,GAAGiC,EAAE,CAAC,UAAY,IAAI2B,SAAStD,OAAOG,KAAK,CAAC,KAAK;gBAAEoD,QAAQ;YAAI;QACrF,MAAMrC,MAAML,UAAU;YACpBC,UAAU;gBAAC+E;gBAAcC;aAAc;YACvC/E,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAOqG,cAAcjB,qBAAqB,CAAC;QAC3CpF,OAAOsG,eAAelB,qBAAqB,CAAC;IAC9C;IAEAnF,GAAG,wDAAwD;QACzD,MAAMuG,iBAAiB;QACvB,MAAM3D,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAAS,MAAM;gBAAEF,SAAS;oBAAE6C,UAAUD;gBAAe;gBAAGzC,QAAQ;YAAI;QAEtF,MAAM2C,YAAYxG,GAAGiC,EAAE,CACrB,UACE,IAAI2B,SAAStD,OAAOG,KAAK,CAAC,KAAK;gBAAEiD,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAE3F7D,GAAGyG,UAAU,CAAC,SAASD;QAEvB,MAAMhF,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAMW,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO0G,WAAWtB,qBAAqB,CAAC;QACxCpF,OAAO0G,WAAWE,oBAAoB,CAACJ;IACzC;IAEAvG,GAAG,gFAAgF;QACjF,MAAMuG,iBAAiB;QACvB,MAAM3D,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAAS,MAAM;gBAAEF,SAAS;oBAAE6C,UAAUD;gBAAe;gBAAGzC,QAAQ;YAAI;QAEtF,MAAM2C,YAAYxG,GAAGiC,EAAE,CACrB,UACE,IAAI2B,SAASxD,aAAa;gBAAEsD,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAEtF7D,GAAGyG,UAAU,CAAC,SAASD;QAEvB,MAAMhF,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO+C,OAAO9B,YAAY,EAAEwC,aAAa;QACzCzD,OAAO0G,WAAWtB,qBAAqB,CAAC;QACxCpF,OAAO0G,WAAWE,oBAAoB,CAACJ,gBAAgB;YACrD5C,SAAS;gBAAEiD,OAAO,CAAC,QAAQ,EAAE1G,2BAA2B,GAAG;YAAC;QAC9D;IACF;IAEAF,GAAG,yEAAyE;QAC1E,MAAMsE,SAAS,IAAIC,eAAe;YAChCE,MAAKC,UAAU;gBACbA,WAAWzC,KAAK,CAAC,IAAI0C,MAAM;YAC7B;YACAC,OAAMF,UAAU;gBACdA,WAAWG,OAAO,CAACtE,OAAOC,IAAI,CAAC;YACjC;QACF;QACA,MAAMoC,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAASS,QAAQ;gBAAEX,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAE3F,MAAMrC,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV;QAEb,MAAM0E,cAAcjH,GAAGkH,MAAM;QAC7B,MAAMC,cAAc,IAAIC,IAAI,MAAMrH,GAAGsH,OAAO,CAACJ;QAE7C,MAAM9G,OAAOI,wBAAwB;YAAE0C;YAAMpB;QAAI,IAAIyF,OAAO,CAAClC,OAAO,CAAC;QAErE,MAAMmC,aAAa,MAAMxH,GAAGsH,OAAO,CAACJ;QACpC,MAAMO,oBAAoBD,WAAWE,MAAM,CACzC,CAACC,QAAU,CAACP,YAAYQ,GAAG,CAACD,UAAUA,MAAME,UAAU,CAAC;QAEzDzH,OAAOqH,mBAAmB9D,OAAO,CAAC,EAAE;IACtC;IAEAtD,GAAG,gGAAgG;QACjG,MAAM4C,UAAU3C,GAAGiC,EAAE,CAAC,OAAOwB;YAC3B3D,OAAO2D,WAAWC,OAAO,CAACC,GAAG,CAAC,UAAU6D,QAAQ;YAChD,OAAO,IAAI5D,SAASxD,aAAa;gBAAEsD,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAC3F;QACA,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnFN,IAAIC,KAAK,GAAG;YAAEgG,aAAa;gBAAEC,gBAAgB;gBAAKC,eAAe;YAAI;QAAE;QACvE,MAAM/E,OAAOF;QAEb,MAAMG,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO6C,SAASuC,qBAAqB,CAAC;QACtCpF,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvCvF,OAAO+C,OAAOS,IAAI,CAACpC,MAAM,EAAEkC,IAAI,CAAC;IAClC;IAEArD,GAAG,8DAA8D;QAC/D,MAAM4C,UAAU3C,GAAGiC,EAAE,CACnB,UAAY,IAAI2B,SAAS,MAAM;gBAAEF,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAEzF,MAAMrC,MAAML,UAAU;YACpBC,UAAU;gBAACuB;aAAQ;YACnBtB,QAAQ;gBAAES,qBAAqB;gBAAM+D,WAAW;oBAAC;iBAAU;YAAC;QAC9D;QACA,MAAMjD,OAAOV,UAAU;YAAEO,MAAM;QAAE;QAEjC,MAAMI,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QACzDX,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1CjB,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvC,MAAMS,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,QAAQ5E,MAAM,EAAEkC,IAAI,CAAC;IAC9B;IAEArD,GAAG,mFAAmF;QACpF,MAAM4C,UAAU3C,GAAGiC,EAAE,CACnB,UACE,IAAI2B,SAAStD,OAAOC,IAAI,CAAC,qBAAqB;gBAC5CmD,SAAS;oBAAE,gBAAgB;gBAAY;gBACvCG,QAAQ;YACV;QAEJ,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOV,UAAU;YAAEE,qBAAqBiE;QAAU;QAExD,MAAMxD,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO6C,SAASuC,qBAAqB,CAAC;QACtCpF,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvCxE,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1C,MAAM+E,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,QAAQE,QAAQ,IAAI5C,IAAI,CAAC;IAClC;IAEArD,GAAG,gFAAgF;QACjF,MAAM4C,UAAU3C,GAAGiC,EAAE,CAAC,OAAOwB;YAC3B3D,OAAO2D,WAAWC,OAAO,CAACC,GAAG,CAAC,UAAU6D,QAAQ;YAChD,OAAO,IAAI5D,SAASxD,aAAa;gBAAEsD,SAAS;oBAAE,gBAAgB;gBAAY;gBAAGG,QAAQ;YAAI;QAC3F;QACA,MAAMrC,MAAML,UAAU;YAAEC,UAAU;gBAACuB;aAAQ;YAAEtB,QAAQ;gBAAES,qBAAqB;YAAK;QAAE;QACnF,MAAMc,OAAOF,UAAU;YAAEN,qBAAqBiE;QAAU;QAExD,MAAMxD,SAAS,MAAM3C,wBAAwB;YAAE0C;YAAMpB;QAAI;QAEzD1B,OAAO6C,SAASuC,qBAAqB,CAAC;QACtCpF,OAAO+C,OAAO9B,YAAY,EAAEsE,WAAW;QACvCxE,kBAAkBuE,IAAI,CAACvC,OAAO9B,YAAY;QAE1C,MAAM+E,UAAU,MAAMpG,GAAGqG,QAAQ,CAAClD,OAAO9B,YAAY;QACrDjB,OAAOgG,SAASzC,OAAO,CAACjD;IAC1B;AACF"}

package/dist/uploads/getFileTypeFallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFileTypeFallback.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeFallback.ts"],"names":[],"mappings":"AAAA,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAiBD,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,UAOlD,CAAA"}
+{"version":3,"file":"getFileTypeFallback.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeFallback.ts"],"names":[],"mappings":"AAEA,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAkBD,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,UAOlD,CAAA"}

package/dist/uploads/getFileTypeFallback.js

@@ -1,3 +1,4 @@
+import { getFileExtension, getSanitizedUploadFilename } from './getFileTypeIdentity.js';
 const extensionMap = {
     css: 'text/css',
     csv: 'text/csv',
@@ -7,11 +8,12 @@ const extensionMap = {
     json: 'application/json',
     md: 'text/markdown',
     svg: 'image/svg+xml',
+    xhtml: 'application/xhtml+xml',
     xml: 'application/xml',
     yml: 'application/x-yaml'
 };
 export const getFileTypeFallback = (path)=>{
-    const ext = path.split('.').pop() || 'txt';
+    const ext = getFileExtension(getSanitizedUploadFilename(path)).toLowerCase() || 'txt';
     return {
         ext,
         mime: extensionMap[ext] || 'text/plain'

package/dist/uploads/getFileTypeFallback.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getFileTypeFallback.ts"],"sourcesContent":["type ReturnType = {\n  ext: string\n  mime: string\n}\n\nconst extensionMap: {\n  [ext: string]: string\n} = {\n  css: 'text/css',\n  csv: 'text/csv',\n  htm: 'text/html',\n  html: 'text/html',\n  js: 'application/javascript',\n  json: 'application/json',\n  md: 'text/markdown',\n  svg: 'image/svg+xml',\n  xml: 'application/xml',\n  yml: 'application/x-yaml',\n}\n\nexport const getFileTypeFallback = (path: string): ReturnType => {\n  const ext = path.split('.').pop() || 'txt'\n\n  return {\n    ext,\n    mime: extensionMap[ext] || 'text/plain',\n  }\n}\n"],"names":["extensionMap","css","csv","htm","html","js","json","md","svg","xml","yml","getFileTypeFallback","path","ext","split","pop","mime"],"mappings":"AAKA,MAAMA,eAEF;IACFC,KAAK;IACLC,KAAK;IACLC,KAAK;IACLC,MAAM;IACNC,IAAI;IACJC,MAAM;IACNC,IAAI;IACJC,KAAK;IACLC,KAAK;IACLC,KAAK;AACP;AAEA,OAAO,MAAMC,sBAAsB,CAACC;IAClC,MAAMC,MAAMD,KAAKE,KAAK,CAAC,KAAKC,GAAG,MAAM;IAErC,OAAO;QACLF;QACAG,MAAMhB,YAAY,CAACa,IAAI,IAAI;IAC7B;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/getFileTypeFallback.ts"],"sourcesContent":["import { getFileExtension, getSanitizedUploadFilename } from './getFileTypeIdentity.js'\n\ntype ReturnType = {\n  ext: string\n  mime: string\n}\n\nconst extensionMap: {\n  [ext: string]: string\n} = {\n  css: 'text/css',\n  csv: 'text/csv',\n  htm: 'text/html',\n  html: 'text/html',\n  js: 'application/javascript',\n  json: 'application/json',\n  md: 'text/markdown',\n  svg: 'image/svg+xml',\n  xhtml: 'application/xhtml+xml',\n  xml: 'application/xml',\n  yml: 'application/x-yaml',\n}\n\nexport const getFileTypeFallback = (path: string): ReturnType => {\n  const ext = getFileExtension(getSanitizedUploadFilename(path)).toLowerCase() || 'txt'\n\n  return {\n    ext,\n    mime: extensionMap[ext] || 'text/plain',\n  }\n}\n"],"names":["getFileExtension","getSanitizedUploadFilename","extensionMap","css","csv","htm","html","js","json","md","svg","xhtml","xml","yml","getFileTypeFallback","path","ext","toLowerCase","mime"],"mappings":"AAAA,SAASA,gBAAgB,EAAEC,0BAA0B,QAAQ,2BAA0B;AAOvF,MAAMC,eAEF;IACFC,KAAK;IACLC,KAAK;IACLC,KAAK;IACLC,MAAM;IACNC,IAAI;IACJC,MAAM;IACNC,IAAI;IACJC,KAAK;IACLC,OAAO;IACPC,KAAK;IACLC,KAAK;AACP;AAEA,OAAO,MAAMC,sBAAsB,CAACC;IAClC,MAAMC,MAAMhB,iBAAiBC,2BAA2Bc,OAAOE,WAAW,MAAM;IAEhF,OAAO;QACLD;QACAE,MAAMhB,YAAY,CAACc,IAAI,IAAI;IAC7B;AACF,EAAC"}

package/dist/uploads/getFileTypeIdentity.d.ts

@@ -0,0 +1,19 @@
+export declare const getFileExtension: (filename: string) => string;
+export declare const getSanitizedUploadFilename: (filename: string, outputExtension?: string) => string;
+export declare const getMimeTypeEssence: (mimeType?: null | string) => string;
+export declare const isSvgMimeType: (mimeType?: null | string) => boolean;
+export declare const isXmlMimeType: (mimeType?: null | string) => boolean;
+export declare const isSvgUpload: ({ filename, mimeType, }: {
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+export declare const isXmlUpload: ({ filename, mimeType, }: {
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+export declare const uploadRequiresServerValidation: (upload: {
+    allowRestrictedFileTypes?: boolean;
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+//# sourceMappingURL=getFileTypeIdentity.d.ts.map

package/dist/uploads/getFileTypeIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFileTypeIdentity.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeIdentity.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,gBAAgB,aAAc,MAAM,KAAG,MASnD,CAAA;AAED,eAAO,MAAM,0BAA0B,aAAc,MAAM,oBAAoB,MAAM,KAAG,MAOvF,CAAA;AAED,eAAO,MAAM,kBAAkB,cAAe,IAAI,GAAG,MAAM,KAAG,MAQ7D,CAAA;AAED,eAAO,MAAM,aAAa,cAAe,IAAI,GAAG,MAAM,KAAG,OACP,CAAA;AAElD,eAAO,MAAM,aAAa,cAAe,IAAI,GAAG,MAAM,KAAG,OAQxD,CAAA;AAED,eAAO,MAAM,WAAW,4BAGrB;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAEqB,CAAA;AAEzB,eAAO,MAAM,WAAW,4BAGrB;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAEqB,CAAA;AAEzB,eAAO,MAAM,8BAA8B,WAAY;IACrD,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAA2F,CAAA"}

package/dist/uploads/getFileTypeIdentity.js

@@ -0,0 +1,34 @@
+import sanitize from 'sanitize-filename';
+import { sanitizeFilename } from '../utilities/sanitizeFilename.js';
+export const getFileExtension = (filename)=>{
+    if (!filename.includes('.')) {
+        return '';
+    }
+    const extension = filename.split('.').pop() || '';
+    const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1);
+    return extensionWithoutSuffix;
+};
+export const getSanitizedUploadFilename = (filename, outputExtension)=>{
+    const basename = sanitizeFilename(filename);
+    const sourceExtension = getFileExtension(basename);
+    const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename);
+    const extension = outputExtension ?? sourceExtension;
+    return `${baseFilename}${extension ? `.${extension}` : ''}`;
+};
+export const getMimeTypeEssence = (mimeType)=>{
+    if (!mimeType) {
+        return '';
+    }
+    const [essence = ''] = mimeType.split(';', 1);
+    return essence.trim().toLowerCase();
+};
+export const isSvgMimeType = (mimeType)=>getMimeTypeEssence(mimeType) === 'image/svg+xml';
+export const isXmlMimeType = (mimeType)=>{
+    const mimeTypeEssence = getMimeTypeEssence(mimeType);
+    return mimeTypeEssence === 'application/xml' || mimeTypeEssence === 'text/xml' || mimeTypeEssence.endsWith('+xml');
+};
+export const isSvgUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' || isSvgMimeType(mimeType);
+export const isXmlUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' || isXmlMimeType(mimeType);
+export const uploadRequiresServerValidation = (upload)=>!upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload));
+
+//# sourceMappingURL=getFileTypeIdentity.js.map

package/dist/uploads/getFileTypeIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/getFileTypeIdentity.ts"],"sourcesContent":["import sanitize from 'sanitize-filename'\n\nimport { sanitizeFilename } from '../utilities/sanitizeFilename.js'\n\nexport const getFileExtension = (filename: string): string => {\n  if (!filename.includes('.')) {\n    return ''\n  }\n\n  const extension = filename.split('.').pop() || ''\n  const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1)\n\n  return extensionWithoutSuffix\n}\n\nexport const getSanitizedUploadFilename = (filename: string, outputExtension?: string): string => {\n  const basename = sanitizeFilename(filename)\n  const sourceExtension = getFileExtension(basename)\n  const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename)\n  const extension = outputExtension ?? sourceExtension\n\n  return `${baseFilename}${extension ? `.${extension}` : ''}`\n}\n\nexport const getMimeTypeEssence = (mimeType?: null | string): string => {\n  if (!mimeType) {\n    return ''\n  }\n\n  const [essence = ''] = mimeType.split(';', 1)\n\n  return essence.trim().toLowerCase()\n}\n\nexport const isSvgMimeType = (mimeType?: null | string): boolean =>\n  getMimeTypeEssence(mimeType) === 'image/svg+xml'\n\nexport const isXmlMimeType = (mimeType?: null | string): boolean => {\n  const mimeTypeEssence = getMimeTypeEssence(mimeType)\n\n  return (\n    mimeTypeEssence === 'application/xml' ||\n    mimeTypeEssence === 'text/xml' ||\n    mimeTypeEssence.endsWith('+xml')\n  )\n}\n\nexport const isSvgUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' ||\n  isSvgMimeType(mimeType)\n\nexport const isXmlUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' ||\n  isXmlMimeType(mimeType)\n\nexport const uploadRequiresServerValidation = (upload: {\n  allowRestrictedFileTypes?: boolean\n  filename: string\n  mimeType?: null | string\n}): boolean => !upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload))\n"],"names":["sanitize","sanitizeFilename","getFileExtension","filename","includes","extension","split","pop","extensionWithoutSuffix","getSanitizedUploadFilename","outputExtension","basename","sourceExtension","baseFilename","substring","lastIndexOf","getMimeTypeEssence","mimeType","essence","trim","toLowerCase","isSvgMimeType","isXmlMimeType","mimeTypeEssence","endsWith","isSvgUpload","isXmlUpload","uploadRequiresServerValidation","upload","allowRestrictedFileTypes"],"mappings":"AAAA,OAAOA,cAAc,oBAAmB;AAExC,SAASC,gBAAgB,QAAQ,mCAAkC;AAEnE,OAAO,MAAMC,mBAAmB,CAACC;IAC/B,IAAI,CAACA,SAASC,QAAQ,CAAC,MAAM;QAC3B,OAAO;IACT;IAEA,MAAMC,YAAYF,SAASG,KAAK,CAAC,KAAKC,GAAG,MAAM;IAC/C,MAAM,CAACC,yBAAyB,EAAE,CAAC,GAAGH,UAAUC,KAAK,CAAC,QAAQ;IAE9D,OAAOE;AACT,EAAC;AAED,OAAO,MAAMC,6BAA6B,CAACN,UAAkBO;IAC3D,MAAMC,WAAWV,iBAAiBE;IAClC,MAAMS,kBAAkBV,iBAAiBS;IACzC,MAAME,eAAeb,SAASW,SAASG,SAAS,CAAC,GAAGH,SAASI,WAAW,CAAC,SAASJ;IAClF,MAAMN,YAAYK,mBAAmBE;IAErC,OAAO,GAAGC,eAAeR,YAAY,CAAC,CAAC,EAAEA,WAAW,GAAG,IAAI;AAC7D,EAAC;AAED,OAAO,MAAMW,qBAAqB,CAACC;IACjC,IAAI,CAACA,UAAU;QACb,OAAO;IACT;IAEA,MAAM,CAACC,UAAU,EAAE,CAAC,GAAGD,SAASX,KAAK,CAAC,KAAK;IAE3C,OAAOY,QAAQC,IAAI,GAAGC,WAAW;AACnC,EAAC;AAED,OAAO,MAAMC,gBAAgB,CAACJ,WAC5BD,mBAAmBC,cAAc,gBAAe;AAElD,OAAO,MAAMK,gBAAgB,CAACL;IAC5B,MAAMM,kBAAkBP,mBAAmBC;IAE3C,OACEM,oBAAoB,qBACpBA,oBAAoB,cACpBA,gBAAgBC,QAAQ,CAAC;AAE7B,EAAC;AAED,OAAO,MAAMC,cAAc,CAAC,EAC1BtB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEC,cAAcJ,UAAS;AAEzB,OAAO,MAAMS,cAAc,CAAC,EAC1BvB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEE,cAAcL,UAAS;AAEzB,OAAO,MAAMU,iCAAiC,CAACC,SAIhC,CAACA,OAAOC,wBAAwB,IAAKJ,CAAAA,YAAYG,WAAWF,YAAYE,OAAM,EAAE"}