payload 3.89.0-internal.95c9cba → 3.90.0

package/dist/uploads/validateSvg.spec.js

@@ -0,0 +1,123 @@
+import { randomUUID } from 'crypto';
+import fs from 'fs/promises';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { inspectSvg, inspectSvgFile, validateSvg } from './validateSvg.js';
+const tempFiles = [];
+const writeTempFile = async (content)=>{
+    const filePath = path.join(os.tmpdir(), `payload-svg-${randomUUID()}`);
+    tempFiles.push(filePath);
+    await fs.writeFile(filePath, content);
+    return filePath;
+};
+afterEach(async ()=>{
+    await Promise.all(tempFiles.splice(0).map((filePath)=>fs.unlink(filePath)));
+});
+describe('SVG inspection', ()=>{
+    it.each([
+        [
+            'script elements',
+            '<script>reference()</script>'
+        ],
+        [
+            'event attributes',
+            '<g onload="reference()"/>'
+        ],
+        [
+            'embedded HTML',
+            '<foreignObject/>'
+        ],
+        [
+            'active links',
+            '<a href="javascript:reference()"/>'
+        ],
+        [
+            'nested SVG data',
+            '<image href="data:image/svg+xml,<svg/>"/>'
+        ],
+        [
+            'active style attributes',
+            '<g style="background:url(javascript:reference())"/>'
+        ],
+        [
+            'active style elements',
+            '<style>@import url("reference.css")</style>'
+        ],
+        [
+            'animated active links',
+            '<animate attributeName="href" values="https://example.com; javascript:reference()"/>'
+        ],
+        [
+            'assigned active links',
+            '<set attributeName="href" to="javascript:reference()"/>'
+        ]
+    ])('should reject %s', (_, content)=>{
+        expect(validateSvg(Buffer.from(`<svg xmlns="http://www.w3.org/2000/svg">${content}</svg>`))).toBe(false);
+    });
+    it('should reject XML-declared SVG event attributes', ()=>{
+        expect(validateSvg(Buffer.from('<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg" onload="reference()"/>'))).toBe(false);
+    });
+    it('should inspect complete style content across text and CDATA', ()=>{
+        expect(validateSvg(Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"><style>@im<![CDATA[port]]> url("reference.css")</style></svg>'))).toBe(false);
+    });
+    it('should inspect UTF-16 XML-declared SVG content', ()=>{
+        const content = Buffer.concat([
+            Buffer.from([
+                0xff,
+                0xfe
+            ]),
+            Buffer.from('<?xml version="1.0" encoding="UTF-16"?><svg xmlns="http://www.w3.org/2000/svg" onload="reference()"/>', 'utf16le')
+        ]);
+        expect(inspectSvg(content)).toMatchObject({
+            isSafe: false,
+            isSvg: true,
+            isValid: true
+        });
+    });
+    it('should accept ordinary SVG content and external resources', ()=>{
+        expect(validateSvg(Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"><text>javascript: reference</text><g aria-label="url(javascript: reference)"/><image href="https://example.com/reference.png"/><animate attributeName="fill" values="red;blue"/></svg>'))).toBe(true);
+    });
+    it('should accept large ordinary style content', ()=>{
+        expect(validateSvg(Buffer.from(`<svg xmlns="http://www.w3.org/2000/svg"><style>${'.reference { fill: blue; }'.repeat(50_000)}</style></svg>`))).toBe(true);
+    });
+    it('should stop buffer inspection after a valid non-SVG root is identified', ()=>{
+        expect(inspectSvg(Buffer.from('<feed xmlns="urn:example"><entry>'))).toMatchObject({
+            isSafe: false,
+            isSvg: false,
+            isValid: true
+        });
+    });
+    it('should stop streaming after a valid non-SVG root is identified', async ()=>{
+        const filePath = await writeTempFile('<feed xmlns="urn:example"><entry>');
+        await expect(inspectSvgFile(filePath, {
+            highWaterMark: 64
+        })).resolves.toMatchObject({
+            isSafe: false,
+            isSvg: false,
+            isValid: true
+        });
+    });
+    it('should inspect style content across temp-file chunks', async ()=>{
+        const filePath = await writeTempFile('<svg xmlns="http://www.w3.org/2000/svg"><style>@import url("reference.css")</style></svg>');
+        await expect(inspectSvgFile(filePath, {
+            highWaterMark: 3
+        })).resolves.toMatchObject({
+            isSafe: false,
+            isSvg: true,
+            isValid: true
+        });
+    });
+    it('should handle deeply nested namespace declarations', ()=>{
+        const depth = 10_000;
+        const elements = Array.from({
+            length: depth
+        }, (_, index)=>`<g xmlns:reference${index}="urn:reference:${index}">`).join('');
+        const source = Buffer.from(`<svg xmlns="http://www.w3.org/2000/svg">${elements}${'</g>'.repeat(depth)}</svg>`);
+        const startedAt = performance.now();
+        expect(validateSvg(source)).toBe(true);
+        expect(performance.now() - startedAt).toBeLessThan(5_000);
+    });
+});
+
+//# sourceMappingURL=validateSvg.spec.js.map

package/dist/uploads/validateSvg.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/validateSvg.spec.ts"],"sourcesContent":["import { randomUUID } from 'crypto'\nimport fs from 'fs/promises'\nimport os from 'os'\nimport path from 'path'\nimport { afterEach, describe, expect, it } from 'vitest'\n\nimport { inspectSvg, inspectSvgFile, validateSvg } from './validateSvg.js'\n\nconst tempFiles: string[] = []\n\nconst writeTempFile = async (content: Buffer | string): Promise<string> => {\n  const filePath = path.join(os.tmpdir(), `payload-svg-${randomUUID()}`)\n  tempFiles.push(filePath)\n  await fs.writeFile(filePath, content)\n  return filePath\n}\n\nafterEach(async () => {\n  await Promise.all(tempFiles.splice(0).map((filePath) => fs.unlink(filePath)))\n})\n\ndescribe('SVG inspection', () => {\n  it.each([\n    ['script elements', '<script>reference()</script>'],\n    ['event attributes', '<g onload=\"reference()\"/>'],\n    ['embedded HTML', '<foreignObject/>'],\n    ['active links', '<a href=\"javascript:reference()\"/>'],\n    ['nested SVG data', '<image href=\"data:image/svg+xml,<svg/>\"/>'],\n    ['active style attributes', '<g style=\"background:url(javascript:reference())\"/>'],\n    ['active style elements', '<style>@import url(\"reference.css\")</style>'],\n    [\n      'animated active links',\n      '<animate attributeName=\"href\" values=\"https://example.com; javascript:reference()\"/>',\n    ],\n    ['assigned active links', '<set attributeName=\"href\" to=\"javascript:reference()\"/>'],\n  ])('should reject %s', (_, content) => {\n    expect(\n      validateSvg(Buffer.from(`<svg xmlns=\"http://www.w3.org/2000/svg\">${content}</svg>`)),\n    ).toBe(false)\n  })\n\n  it('should reject XML-declared SVG event attributes', () => {\n    expect(\n      validateSvg(\n        Buffer.from(\n          '<?xml version=\"1.0\"?><svg xmlns=\"http://www.w3.org/2000/svg\" onload=\"reference()\"/>',\n        ),\n      ),\n    ).toBe(false)\n  })\n\n  it('should inspect complete style content across text and CDATA', () => {\n    expect(\n      validateSvg(\n        Buffer.from(\n          '<svg xmlns=\"http://www.w3.org/2000/svg\"><style>@im<![CDATA[port]]> url(\"reference.css\")</style></svg>',\n        ),\n      ),\n    ).toBe(false)\n  })\n\n  it('should inspect UTF-16 XML-declared SVG content', () => {\n    const content = Buffer.concat([\n      Buffer.from([0xff, 0xfe]),\n      Buffer.from(\n        '<?xml version=\"1.0\" encoding=\"UTF-16\"?><svg xmlns=\"http://www.w3.org/2000/svg\" onload=\"reference()\"/>',\n        'utf16le',\n      ),\n    ])\n\n    expect(inspectSvg(content)).toMatchObject({ isSafe: false, isSvg: true, isValid: true })\n  })\n\n  it('should accept ordinary SVG content and external resources', () => {\n    expect(\n      validateSvg(\n        Buffer.from(\n          '<svg xmlns=\"http://www.w3.org/2000/svg\"><text>javascript: reference</text><g aria-label=\"url(javascript: reference)\"/><image href=\"https://example.com/reference.png\"/><animate attributeName=\"fill\" values=\"red;blue\"/></svg>',\n        ),\n      ),\n    ).toBe(true)\n  })\n\n  it('should accept large ordinary style content', () => {\n    expect(\n      validateSvg(\n        Buffer.from(\n          `<svg xmlns=\"http://www.w3.org/2000/svg\"><style>${'.reference { fill: blue; }'.repeat(50_000)}</style></svg>`,\n        ),\n      ),\n    ).toBe(true)\n  })\n\n  it('should stop buffer inspection after a valid non-SVG root is identified', () => {\n    expect(inspectSvg(Buffer.from('<feed xmlns=\"urn:example\"><entry>'))).toMatchObject({\n      isSafe: false,\n      isSvg: false,\n      isValid: true,\n    })\n  })\n\n  it('should stop streaming after a valid non-SVG root is identified', async () => {\n    const filePath = await writeTempFile('<feed xmlns=\"urn:example\"><entry>')\n\n    await expect(inspectSvgFile(filePath, { highWaterMark: 64 })).resolves.toMatchObject({\n      isSafe: false,\n      isSvg: false,\n      isValid: true,\n    })\n  })\n\n  it('should inspect style content across temp-file chunks', async () => {\n    const filePath = await writeTempFile(\n      '<svg xmlns=\"http://www.w3.org/2000/svg\"><style>@import url(\"reference.css\")</style></svg>',\n    )\n\n    await expect(inspectSvgFile(filePath, { highWaterMark: 3 })).resolves.toMatchObject({\n      isSafe: false,\n      isSvg: true,\n      isValid: true,\n    })\n  })\n\n  it('should handle deeply nested namespace declarations', () => {\n    const depth = 10_000\n    const elements = Array.from(\n      { length: depth },\n      (_, index) => `<g xmlns:reference${index}=\"urn:reference:${index}\">`,\n    ).join('')\n    const source = Buffer.from(\n      `<svg xmlns=\"http://www.w3.org/2000/svg\">${elements}${'</g>'.repeat(depth)}</svg>`,\n    )\n    const startedAt = performance.now()\n\n    expect(validateSvg(source)).toBe(true)\n    expect(performance.now() - startedAt).toBeLessThan(5_000)\n  })\n})\n"],"names":["randomUUID","fs","os","path","afterEach","describe","expect","it","inspectSvg","inspectSvgFile","validateSvg","tempFiles","writeTempFile","content","filePath","join","tmpdir","push","writeFile","Promise","all","splice","map","unlink","each","_","Buffer","from","toBe","concat","toMatchObject","isSafe","isSvg","isValid","repeat","highWaterMark","resolves","depth","elements","Array","length","index","source","startedAt","performance","now","toBeLessThan"],"mappings":"AAAA,SAASA,UAAU,QAAQ,SAAQ;AACnC,OAAOC,QAAQ,cAAa;AAC5B,OAAOC,QAAQ,KAAI;AACnB,OAAOC,UAAU,OAAM;AACvB,SAASC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAExD,SAASC,UAAU,EAAEC,cAAc,EAAEC,WAAW,QAAQ,mBAAkB;AAE1E,MAAMC,YAAsB,EAAE;AAE9B,MAAMC,gBAAgB,OAAOC;IAC3B,MAAMC,WAAWX,KAAKY,IAAI,CAACb,GAAGc,MAAM,IAAI,CAAC,YAAY,EAAEhB,cAAc;IACrEW,UAAUM,IAAI,CAACH;IACf,MAAMb,GAAGiB,SAAS,CAACJ,UAAUD;IAC7B,OAAOC;AACT;AAEAV,UAAU;IACR,MAAMe,QAAQC,GAAG,CAACT,UAAUU,MAAM,CAAC,GAAGC,GAAG,CAAC,CAACR,WAAab,GAAGsB,MAAM,CAACT;AACpE;AAEAT,SAAS,kBAAkB;IACzBE,GAAGiB,IAAI,CAAC;QACN;YAAC;YAAmB;SAA+B;QACnD;YAAC;YAAoB;SAA4B;QACjD;YAAC;YAAiB;SAAmB;QACrC;YAAC;YAAgB;SAAqC;QACtD;YAAC;YAAmB;SAA4C;QAChE;YAAC;YAA2B;SAAsD;QAClF;YAAC;YAAyB;SAA8C;QACxE;YACE;YACA;SACD;QACD;YAAC;YAAyB;SAA0D;KACrF,EAAE,oBAAoB,CAACC,GAAGZ;QACzBP,OACEI,YAAYgB,OAAOC,IAAI,CAAC,CAAC,wCAAwC,EAAEd,QAAQ,MAAM,CAAC,IAClFe,IAAI,CAAC;IACT;IAEArB,GAAG,mDAAmD;QACpDD,OACEI,YACEgB,OAAOC,IAAI,CACT,yFAGJC,IAAI,CAAC;IACT;IAEArB,GAAG,+DAA+D;QAChED,OACEI,YACEgB,OAAOC,IAAI,CACT,2GAGJC,IAAI,CAAC;IACT;IAEArB,GAAG,kDAAkD;QACnD,MAAMM,UAAUa,OAAOG,MAAM,CAAC;YAC5BH,OAAOC,IAAI,CAAC;gBAAC;gBAAM;aAAK;YACxBD,OAAOC,IAAI,CACT,yGACA;SAEH;QAEDrB,OAAOE,WAAWK,UAAUiB,aAAa,CAAC;YAAEC,QAAQ;YAAOC,OAAO;YAAMC,SAAS;QAAK;IACxF;IAEA1B,GAAG,6DAA6D;QAC9DD,OACEI,YACEgB,OAAOC,IAAI,CACT,oOAGJC,IAAI,CAAC;IACT;IAEArB,GAAG,8CAA8C;QAC/CD,OACEI,YACEgB,OAAOC,IAAI,CACT,CAAC,+CAA+C,EAAE,6BAA6BO,MAAM,CAAC,QAAQ,cAAc,CAAC,IAGjHN,IAAI,CAAC;IACT;IAEArB,GAAG,0EAA0E;QAC3ED,OAAOE,WAAWkB,OAAOC,IAAI,CAAC,uCAAuCG,aAAa,CAAC;YACjFC,QAAQ;YACRC,OAAO;YACPC,SAAS;QACX;IACF;IAEA1B,GAAG,kEAAkE;QACnE,MAAMO,WAAW,MAAMF,cAAc;QAErC,MAAMN,OAAOG,eAAeK,UAAU;YAAEqB,eAAe;QAAG,IAAIC,QAAQ,CAACN,aAAa,CAAC;YACnFC,QAAQ;YACRC,OAAO;YACPC,SAAS;QACX;IACF;IAEA1B,GAAG,wDAAwD;QACzD,MAAMO,WAAW,MAAMF,cACrB;QAGF,MAAMN,OAAOG,eAAeK,UAAU;YAAEqB,eAAe;QAAE,IAAIC,QAAQ,CAACN,aAAa,CAAC;YAClFC,QAAQ;YACRC,OAAO;YACPC,SAAS;QACX;IACF;IAEA1B,GAAG,sDAAsD;QACvD,MAAM8B,QAAQ;QACd,MAAMC,WAAWC,MAAMZ,IAAI,CACzB;YAAEa,QAAQH;QAAM,GAChB,CAACZ,GAAGgB,QAAU,CAAC,kBAAkB,EAAEA,MAAM,gBAAgB,EAAEA,MAAM,EAAE,CAAC,EACpE1B,IAAI,CAAC;QACP,MAAM2B,SAAShB,OAAOC,IAAI,CACxB,CAAC,wCAAwC,EAAEW,WAAW,OAAOJ,MAAM,CAACG,OAAO,MAAM,CAAC;QAEpF,MAAMM,YAAYC,YAAYC,GAAG;QAEjCvC,OAAOI,YAAYgC,SAASd,IAAI,CAAC;QACjCtB,OAAOsC,YAAYC,GAAG,KAAKF,WAAWG,YAAY,CAAC;IACrD;AACF"}

package/dist/uploads/validateUploadFilename.d.ts

@@ -0,0 +1,3 @@
+import type { Validate } from '../fields/config/types.js';
+export declare const validateUploadFilename: Validate;
+//# sourceMappingURL=validateUploadFilename.d.ts.map

package/dist/uploads/validateUploadFilename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateUploadFilename.d.ts","sourceRoot":"","sources":["../../src/uploads/validateUploadFilename.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAEzD,eAAO,MAAM,sBAAsB,EAAE,QAgBpC,CAAA"}

package/dist/uploads/validateUploadFilename.js

@@ -0,0 +1,13 @@
+import path from 'path';
+export const validateUploadFilename = (value)=>{
+    if (!value) {
+        return true;
+    }
+    const normalizedFilename = value.replaceAll('\\', '/');
+    if (path.posix.isAbsolute(normalizedFilename) || path.win32.isAbsolute(value) || normalizedFilename.split('/').includes('..')) {
+        return 'Invalid filename';
+    }
+    return true;
+};
+
+//# sourceMappingURL=validateUploadFilename.js.map

package/dist/uploads/validateUploadFilename.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/validateUploadFilename.ts"],"sourcesContent":["import path from 'path'\n\nimport type { Validate } from '../fields/config/types.js'\n\nexport const validateUploadFilename: Validate = (value: null | string | undefined) => {\n  if (!value) {\n    return true\n  }\n\n  const normalizedFilename = value.replaceAll('\\\\', '/')\n\n  if (\n    path.posix.isAbsolute(normalizedFilename) ||\n    path.win32.isAbsolute(value) ||\n    normalizedFilename.split('/').includes('..')\n  ) {\n    return 'Invalid filename'\n  }\n\n  return true\n}\n"],"names":["path","validateUploadFilename","value","normalizedFilename","replaceAll","posix","isAbsolute","win32","split","includes"],"mappings":"AAAA,OAAOA,UAAU,OAAM;AAIvB,OAAO,MAAMC,yBAAmC,CAACC;IAC/C,IAAI,CAACA,OAAO;QACV,OAAO;IACT;IAEA,MAAMC,qBAAqBD,MAAME,UAAU,CAAC,MAAM;IAElD,IACEJ,KAAKK,KAAK,CAACC,UAAU,CAACH,uBACtBH,KAAKO,KAAK,CAACD,UAAU,CAACJ,UACtBC,mBAAmBK,KAAK,CAAC,KAAKC,QAAQ,CAAC,OACvC;QACA,OAAO;IACT;IAEA,OAAO;AACT,EAAC"}

package/dist/uploads/validateUploadFilename.spec.js

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { validateUploadFilename } from './validateUploadFilename.js';
+describe('validateUploadFilename', ()=>{
+    it.each([
+        '../document.pdf',
+        'archive/../document.pdf',
+        '..\\document.pdf',
+        'archive\\..\\document.pdf',
+        '/archive/document.pdf',
+        'C:\\archive\\document.pdf'
+    ])('rejects non-contained filename %s', (filename)=>{
+        expect(validateUploadFilename(filename, {})).toBe('Invalid filename');
+    });
+    it.each([
+        'document.pdf',
+        'tenant/document.pdf',
+        'tenant\\document.pdf',
+        'summary..pdf'
+    ])('accepts contained filename %s', (filename)=>{
+        expect(validateUploadFilename(filename, {})).toBe(true);
+    });
+});
+
+//# sourceMappingURL=validateUploadFilename.spec.js.map

package/dist/uploads/validateUploadFilename.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/validateUploadFilename.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { validateUploadFilename } from './validateUploadFilename.js'\n\ndescribe('validateUploadFilename', () => {\n  it.each([\n    '../document.pdf',\n    'archive/../document.pdf',\n    '..\\\\document.pdf',\n    'archive\\\\..\\\\document.pdf',\n    '/archive/document.pdf',\n    'C:\\\\archive\\\\document.pdf',\n  ])('rejects non-contained filename %s', (filename) => {\n    expect(validateUploadFilename(filename, {} as never)).toBe('Invalid filename')\n  })\n\n  it.each(['document.pdf', 'tenant/document.pdf', 'tenant\\\\document.pdf', 'summary..pdf'])(\n    'accepts contained filename %s',\n    (filename) => {\n      expect(validateUploadFilename(filename, {} as never)).toBe(true)\n    },\n  )\n})\n"],"names":["describe","expect","it","validateUploadFilename","each","filename","toBe"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,sBAAsB,QAAQ,8BAA6B;AAEpEH,SAAS,0BAA0B;IACjCE,GAAGE,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,qCAAqC,CAACC;QACvCJ,OAAOE,uBAAuBE,UAAU,CAAC,IAAaC,IAAI,CAAC;IAC7D;IAEAJ,GAAGE,IAAI,CAAC;QAAC;QAAgB;QAAuB;QAAwB;KAAe,EACrF,iCACA,CAACC;QACCJ,OAAOE,uBAAuBE,UAAU,CAAC,IAAaC,IAAI,CAAC;IAC7D;AAEJ"}

package/dist/utilities/addDataAndFileToRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"addDataAndFileToRequest.d.ts","sourceRoot":"","sources":["../../src/utilities/addDataAndFileToRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAOvD,KAAK,uBAAuB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,uBAiErC,CAAA"}
+{"version":3,"file":"addDataAndFileToRequest.d.ts","sourceRoot":"","sources":["../../src/utilities/addDataAndFileToRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAQvD,KAAK,uBAAuB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,uBAsGrC,CAAA"}

package/dist/utilities/addDataAndFileToRequest.js

@@ -1,4 +1,5 @@
 import { APIError } from '../errors/APIError.js';
+import { verifyClientUploadReceipt } from '../uploads/clientUploadReceipt.js';
 import { processMultipartFormdata } from '../uploads/fetchAPI-multipart/index.js';
 import { getFileFromClientUpload } from '../uploads/getFileFromClientUpload.js';
 /**
@@ -57,8 +58,34 @@ import { getFileFromClientUpload } from '../uploads/getFileFromClientUpload.js';
                 } catch  {
                     throw new APIError('A file name is required.', 400);
                 }
+                // The collection must come from the route, never from the request body: the body
+                // is client-controlled and would select another collection's upload handlers.
+                const collectionSlug = typeof req.routeParams?.collection === 'string' ? req.routeParams.collection : undefined;
+                const uploadConfig = collectionSlug ? req.payload.collections[collectionSlug]?.config.upload : undefined;
+                if (!collectionSlug || !uploadConfig) {
+                    throw new APIError('Invalid upload collection.', 400);
+                }
+                if (uploadConfig.requiresClientUploadReceipt) {
+                    const clientUploadContext = clientUploadFile.clientUploadContext;
+                    if (!clientUploadContext || typeof clientUploadContext !== 'object' || typeof clientUploadContext.signedReceipt !== 'string') {
+                        throw new APIError('A verified client upload reference is required.', 400);
+                    }
+                    const receipt = verifyClientUploadReceipt({
+                        collectionSlug,
+                        req,
+                        signedReceipt: clientUploadContext.signedReceipt
+                    });
+                    if (receipt.filename !== clientUploadFile.filename) {
+                        throw new APIError('Client upload reference does not match this request.', 400);
+                    }
+                    clientUploadFile.clientUploadContext = receipt.context;
+                }
+                // Pass the route-derived collection to the upload helper, never the body value.
                 req.file = await getFileFromClientUpload({
-                    file: clientUploadFile,
+                    file: {
+                        ...clientUploadFile,
+                        collectionSlug
+                    },
                     req
                 });
             }

package/dist/utilities/addDataAndFileToRequest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/addDataAndFileToRequest.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { ClientUploadData } from '../uploads/getFileFromClientUpload.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { processMultipartFormdata } from '../uploads/fetchAPI-multipart/index.js'\nimport { getFileFromClientUpload } from '../uploads/getFileFromClientUpload.js'\n\ntype AddDataAndFileToRequest = (req: PayloadRequest) => Promise<void>\n\n/**\n * Mutates the Request, appending 'data' and 'file' if found\n */\nexport const addDataAndFileToRequest: AddDataAndFileToRequest = async (req) => {\n  const { body, headers, method, payload } = req\n\n  if (method && ['PATCH', 'POST', 'PUT'].includes(method.toUpperCase()) && body) {\n    const [contentType] = (headers.get('Content-Type') || '').split(';', 1)\n    const bodyByteSize = parseInt(req.headers.get('Content-Length') || '0', 10)\n    const hasBodyStream = req.body !== null\n\n    if (contentType === 'application/json') {\n      try {\n        const text = await req.text?.()\n        const data = text ? JSON.parse(text) : {}\n        req.data = data\n        // @ts-expect-error attach json method to request\n        req.json = () => Promise.resolve(data)\n      } catch (error) {\n        if (error instanceof SyntaxError) {\n          throw new APIError('Invalid JSON', 400)\n        }\n        req.payload.logger.error(error)\n        throw error\n      }\n    } else if ((bodyByteSize || hasBodyStream) && contentType?.includes('multipart/')) {\n      const { error, fields, files } = await processMultipartFormdata({\n        options: {\n          ...(payload.config.bodyParser || {}),\n          ...(payload.config.upload || {}),\n        },\n        request: req as Request,\n      })\n\n      if (error) {\n        throw new APIError(error.message)\n      }\n\n      // Set all files on req.files for access by hooks\n      if (files) {\n        req.files = files\n        // Backwards compatibility: set req.file for standard upload collections\n        // Guard: if multiple files share the field name \"file\", files.file is an array — skip\n        if (files.file && !Array.isArray(files.file)) {\n          req.file = files.file\n        }\n      }\n\n      if (fields?._payload && typeof fields._payload === 'string') {\n        req.data = JSON.parse(fields._payload)\n      }\n\n      if (!req.file && fields?.file && typeof fields?.file === 'string') {\n        let clientUploadFile: ClientUploadData\n\n        try {\n          clientUploadFile = JSON.parse(fields.file) as ClientUploadData\n        } catch {\n          throw new APIError('A file name is required.', 400)\n        }\n\n        req.file = await getFileFromClientUpload({\n          file: clientUploadFile,\n          req,\n        })\n      }\n    }\n  }\n}\n"],"names":["APIError","processMultipartFormdata","getFileFromClientUpload","addDataAndFileToRequest","req","body","headers","method","payload","includes","toUpperCase","contentType","get","split","bodyByteSize","parseInt","hasBodyStream","text","data","JSON","parse","json","Promise","resolve","error","SyntaxError","logger","fields","files","options","config","bodyParser","upload","request","message","file","Array","isArray","_payload","clientUploadFile"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,wBAAwB,QAAQ,yCAAwC;AACjF,SAASC,uBAAuB,QAAQ,wCAAuC;AAI/E;;CAEC,GACD,OAAO,MAAMC,0BAAmD,OAAOC;IACrE,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGJ;IAE3C,IAAIG,UAAU;QAAC;QAAS;QAAQ;KAAM,CAACE,QAAQ,CAACF,OAAOG,WAAW,OAAOL,MAAM;QAC7E,MAAM,CAACM,YAAY,GAAG,AAACL,CAAAA,QAAQM,GAAG,CAAC,mBAAmB,EAAC,EAAGC,KAAK,CAAC,KAAK;QACrE,MAAMC,eAAeC,SAASX,IAAIE,OAAO,CAACM,GAAG,CAAC,qBAAqB,KAAK;QACxE,MAAMI,gBAAgBZ,IAAIC,IAAI,KAAK;QAEnC,IAAIM,gBAAgB,oBAAoB;YACtC,IAAI;gBACF,MAAMM,OAAO,MAAMb,IAAIa,IAAI;gBAC3B,MAAMC,OAAOD,OAAOE,KAAKC,KAAK,CAACH,QAAQ,CAAC;gBACxCb,IAAIc,IAAI,GAAGA;gBACX,iDAAiD;gBACjDd,IAAIiB,IAAI,GAAG,IAAMC,QAAQC,OAAO,CAACL;YACnC,EAAE,OAAOM,OAAO;gBACd,IAAIA,iBAAiBC,aAAa;oBAChC,MAAM,IAAIzB,SAAS,gBAAgB;gBACrC;gBACAI,IAAII,OAAO,CAACkB,MAAM,CAACF,KAAK,CAACA;gBACzB,MAAMA;YACR;QACF,OAAO,IAAI,AAACV,CAAAA,gBAAgBE,aAAY,KAAML,aAAaF,SAAS,eAAe;YACjF,MAAM,EAAEe,KAAK,EAAEG,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAM3B,yBAAyB;gBAC9D4B,SAAS;oBACP,GAAIrB,QAAQsB,MAAM,CAACC,UAAU,IAAI,CAAC,CAAC;oBACnC,GAAIvB,QAAQsB,MAAM,CAACE,MAAM,IAAI,CAAC,CAAC;gBACjC;gBACAC,SAAS7B;YACX;YAEA,IAAIoB,OAAO;gBACT,MAAM,IAAIxB,SAASwB,MAAMU,OAAO;YAClC;YAEA,iDAAiD;YACjD,IAAIN,OAAO;gBACTxB,IAAIwB,KAAK,GAAGA;gBACZ,wEAAwE;gBACxE,sFAAsF;gBACtF,IAAIA,MAAMO,IAAI,IAAI,CAACC,MAAMC,OAAO,CAACT,MAAMO,IAAI,GAAG;oBAC5C/B,IAAI+B,IAAI,GAAGP,MAAMO,IAAI;gBACvB;YACF;YAEA,IAAIR,QAAQW,YAAY,OAAOX,OAAOW,QAAQ,KAAK,UAAU;gBAC3DlC,IAAIc,IAAI,GAAGC,KAAKC,KAAK,CAACO,OAAOW,QAAQ;YACvC;YAEA,IAAI,CAAClC,IAAI+B,IAAI,IAAIR,QAAQQ,QAAQ,OAAOR,QAAQQ,SAAS,UAAU;gBACjE,IAAII;gBAEJ,IAAI;oBACFA,mBAAmBpB,KAAKC,KAAK,CAACO,OAAOQ,IAAI;gBAC3C,EAAE,OAAM;oBACN,MAAM,IAAInC,SAAS,4BAA4B;gBACjD;gBAEAI,IAAI+B,IAAI,GAAG,MAAMjC,wBAAwB;oBACvCiC,MAAMI;oBACNnC;gBACF;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/addDataAndFileToRequest.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { ClientUploadData } from '../uploads/getFileFromClientUpload.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { verifyClientUploadReceipt } from '../uploads/clientUploadReceipt.js'\nimport { processMultipartFormdata } from '../uploads/fetchAPI-multipart/index.js'\nimport { getFileFromClientUpload } from '../uploads/getFileFromClientUpload.js'\n\ntype AddDataAndFileToRequest = (req: PayloadRequest) => Promise<void>\n\n/**\n * Mutates the Request, appending 'data' and 'file' if found\n */\nexport const addDataAndFileToRequest: AddDataAndFileToRequest = async (req) => {\n  const { body, headers, method, payload } = req\n\n  if (method && ['PATCH', 'POST', 'PUT'].includes(method.toUpperCase()) && body) {\n    const [contentType] = (headers.get('Content-Type') || '').split(';', 1)\n    const bodyByteSize = parseInt(req.headers.get('Content-Length') || '0', 10)\n    const hasBodyStream = req.body !== null\n\n    if (contentType === 'application/json') {\n      try {\n        const text = await req.text?.()\n        const data = text ? JSON.parse(text) : {}\n        req.data = data\n        // @ts-expect-error attach json method to request\n        req.json = () => Promise.resolve(data)\n      } catch (error) {\n        if (error instanceof SyntaxError) {\n          throw new APIError('Invalid JSON', 400)\n        }\n        req.payload.logger.error(error)\n        throw error\n      }\n    } else if ((bodyByteSize || hasBodyStream) && contentType?.includes('multipart/')) {\n      const { error, fields, files } = await processMultipartFormdata({\n        options: {\n          ...(payload.config.bodyParser || {}),\n          ...(payload.config.upload || {}),\n        },\n        request: req as Request,\n      })\n\n      if (error) {\n        throw new APIError(error.message)\n      }\n\n      // Set all files on req.files for access by hooks\n      if (files) {\n        req.files = files\n        // Backwards compatibility: set req.file for standard upload collections\n        // Guard: if multiple files share the field name \"file\", files.file is an array — skip\n        if (files.file && !Array.isArray(files.file)) {\n          req.file = files.file\n        }\n      }\n\n      if (fields?._payload && typeof fields._payload === 'string') {\n        req.data = JSON.parse(fields._payload)\n      }\n\n      if (!req.file && fields?.file && typeof fields?.file === 'string') {\n        let clientUploadFile: ClientUploadData\n\n        try {\n          clientUploadFile = JSON.parse(fields.file) as ClientUploadData\n        } catch {\n          throw new APIError('A file name is required.', 400)\n        }\n\n        // The collection must come from the route, never from the request body: the body\n        // is client-controlled and would select another collection's upload handlers.\n        const collectionSlug =\n          typeof req.routeParams?.collection === 'string' ? req.routeParams.collection : undefined\n        const uploadConfig = collectionSlug\n          ? req.payload.collections[collectionSlug]?.config.upload\n          : undefined\n\n        if (!collectionSlug || !uploadConfig) {\n          throw new APIError('Invalid upload collection.', 400)\n        }\n\n        if (uploadConfig.requiresClientUploadReceipt) {\n          const clientUploadContext = clientUploadFile.clientUploadContext\n\n          if (\n            !clientUploadContext ||\n            typeof clientUploadContext !== 'object' ||\n            typeof (clientUploadContext as { signedReceipt?: unknown }).signedReceipt !== 'string'\n          ) {\n            throw new APIError('A verified client upload reference is required.', 400)\n          }\n\n          const receipt = verifyClientUploadReceipt({\n            collectionSlug,\n            req,\n            signedReceipt: (clientUploadContext as { signedReceipt: string }).signedReceipt,\n          })\n\n          if (receipt.filename !== clientUploadFile.filename) {\n            throw new APIError('Client upload reference does not match this request.', 400)\n          }\n\n          clientUploadFile.clientUploadContext = receipt.context\n        }\n\n        // Pass the route-derived collection to the upload helper, never the body value.\n        req.file = await getFileFromClientUpload({\n          file: { ...clientUploadFile, collectionSlug },\n          req,\n        })\n      }\n    }\n  }\n}\n"],"names":["APIError","verifyClientUploadReceipt","processMultipartFormdata","getFileFromClientUpload","addDataAndFileToRequest","req","body","headers","method","payload","includes","toUpperCase","contentType","get","split","bodyByteSize","parseInt","hasBodyStream","text","data","JSON","parse","json","Promise","resolve","error","SyntaxError","logger","fields","files","options","config","bodyParser","upload","request","message","file","Array","isArray","_payload","clientUploadFile","collectionSlug","routeParams","collection","undefined","uploadConfig","collections","requiresClientUploadReceipt","clientUploadContext","signedReceipt","receipt","filename","context"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,yBAAyB,QAAQ,oCAAmC;AAC7E,SAASC,wBAAwB,QAAQ,yCAAwC;AACjF,SAASC,uBAAuB,QAAQ,wCAAuC;AAI/E;;CAEC,GACD,OAAO,MAAMC,0BAAmD,OAAOC;IACrE,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGJ;IAE3C,IAAIG,UAAU;QAAC;QAAS;QAAQ;KAAM,CAACE,QAAQ,CAACF,OAAOG,WAAW,OAAOL,MAAM;QAC7E,MAAM,CAACM,YAAY,GAAG,AAACL,CAAAA,QAAQM,GAAG,CAAC,mBAAmB,EAAC,EAAGC,KAAK,CAAC,KAAK;QACrE,MAAMC,eAAeC,SAASX,IAAIE,OAAO,CAACM,GAAG,CAAC,qBAAqB,KAAK;QACxE,MAAMI,gBAAgBZ,IAAIC,IAAI,KAAK;QAEnC,IAAIM,gBAAgB,oBAAoB;YACtC,IAAI;gBACF,MAAMM,OAAO,MAAMb,IAAIa,IAAI;gBAC3B,MAAMC,OAAOD,OAAOE,KAAKC,KAAK,CAACH,QAAQ,CAAC;gBACxCb,IAAIc,IAAI,GAAGA;gBACX,iDAAiD;gBACjDd,IAAIiB,IAAI,GAAG,IAAMC,QAAQC,OAAO,CAACL;YACnC,EAAE,OAAOM,OAAO;gBACd,IAAIA,iBAAiBC,aAAa;oBAChC,MAAM,IAAI1B,SAAS,gBAAgB;gBACrC;gBACAK,IAAII,OAAO,CAACkB,MAAM,CAACF,KAAK,CAACA;gBACzB,MAAMA;YACR;QACF,OAAO,IAAI,AAACV,CAAAA,gBAAgBE,aAAY,KAAML,aAAaF,SAAS,eAAe;YACjF,MAAM,EAAEe,KAAK,EAAEG,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAM3B,yBAAyB;gBAC9D4B,SAAS;oBACP,GAAIrB,QAAQsB,MAAM,CAACC,UAAU,IAAI,CAAC,CAAC;oBACnC,GAAIvB,QAAQsB,MAAM,CAACE,MAAM,IAAI,CAAC,CAAC;gBACjC;gBACAC,SAAS7B;YACX;YAEA,IAAIoB,OAAO;gBACT,MAAM,IAAIzB,SAASyB,MAAMU,OAAO;YAClC;YAEA,iDAAiD;YACjD,IAAIN,OAAO;gBACTxB,IAAIwB,KAAK,GAAGA;gBACZ,wEAAwE;gBACxE,sFAAsF;gBACtF,IAAIA,MAAMO,IAAI,IAAI,CAACC,MAAMC,OAAO,CAACT,MAAMO,IAAI,GAAG;oBAC5C/B,IAAI+B,IAAI,GAAGP,MAAMO,IAAI;gBACvB;YACF;YAEA,IAAIR,QAAQW,YAAY,OAAOX,OAAOW,QAAQ,KAAK,UAAU;gBAC3DlC,IAAIc,IAAI,GAAGC,KAAKC,KAAK,CAACO,OAAOW,QAAQ;YACvC;YAEA,IAAI,CAAClC,IAAI+B,IAAI,IAAIR,QAAQQ,QAAQ,OAAOR,QAAQQ,SAAS,UAAU;gBACjE,IAAII;gBAEJ,IAAI;oBACFA,mBAAmBpB,KAAKC,KAAK,CAACO,OAAOQ,IAAI;gBAC3C,EAAE,OAAM;oBACN,MAAM,IAAIpC,SAAS,4BAA4B;gBACjD;gBAEA,iFAAiF;gBACjF,8EAA8E;gBAC9E,MAAMyC,iBACJ,OAAOpC,IAAIqC,WAAW,EAAEC,eAAe,WAAWtC,IAAIqC,WAAW,CAACC,UAAU,GAAGC;gBACjF,MAAMC,eAAeJ,iBACjBpC,IAAII,OAAO,CAACqC,WAAW,CAACL,eAAe,EAAEV,OAAOE,SAChDW;gBAEJ,IAAI,CAACH,kBAAkB,CAACI,cAAc;oBACpC,MAAM,IAAI7C,SAAS,8BAA8B;gBACnD;gBAEA,IAAI6C,aAAaE,2BAA2B,EAAE;oBAC5C,MAAMC,sBAAsBR,iBAAiBQ,mBAAmB;oBAEhE,IACE,CAACA,uBACD,OAAOA,wBAAwB,YAC/B,OAAO,AAACA,oBAAoDC,aAAa,KAAK,UAC9E;wBACA,MAAM,IAAIjD,SAAS,mDAAmD;oBACxE;oBAEA,MAAMkD,UAAUjD,0BAA0B;wBACxCwC;wBACApC;wBACA4C,eAAe,AAACD,oBAAkDC,aAAa;oBACjF;oBAEA,IAAIC,QAAQC,QAAQ,KAAKX,iBAAiBW,QAAQ,EAAE;wBAClD,MAAM,IAAInD,SAAS,wDAAwD;oBAC7E;oBAEAwC,iBAAiBQ,mBAAmB,GAAGE,QAAQE,OAAO;gBACxD;gBAEA,gFAAgF;gBAChF/C,IAAI+B,IAAI,GAAG,MAAMjC,wBAAwB;oBACvCiC,MAAM;wBAAE,GAAGI,gBAAgB;wBAAEC;oBAAe;oBAC5CpC;gBACF;YACF;QACF;IACF;AACF,EAAC"}

package/dist/utilities/addDataAndFileToRequest.spec.js

@@ -60,6 +60,9 @@ const createClientUploadReq = ({ file, handler, upload })=>{
             logger: {
                 error: ()=>{}
             }
+        },
+        routeParams: {
+            collection: 'media'
         }
     };
 };
@@ -72,6 +75,161 @@ describe('addDataAndFileToRequest', ()=>{
         expect(req.file?.name).toBe('hello.txt');
         expect(req.file?.mimetype).toBe('text/plain');
     });
+    it('should reject unsigned upload instructions before the route handler', async ()=>{
+        const formData = new FormData();
+        formData.append('file', JSON.stringify({
+            collectionSlug: 'private-media',
+            clientUploadContext: {
+                prefix: 'private'
+            },
+            filename: 'example.txt',
+            mimeType: 'text/plain',
+            size: 11
+        }));
+        const request = new Request('http://localhost/api/public-media', {
+            body: formData,
+            method: 'POST'
+        });
+        const privateHandler = vi.fn();
+        const publicHandler = vi.fn((_req, args)=>{
+            return new Response('hello world', {
+                headers: {
+                    'content-type': 'text/plain',
+                    'x-collection': args.params.collection
+                }
+            });
+        });
+        const req = {
+            body: request.body,
+            headers: request.headers,
+            method: request.method,
+            payload: {
+                collections: {
+                    'private-media': {
+                        config: {
+                            upload: {
+                                handlers: [
+                                    privateHandler
+                                ]
+                            }
+                        }
+                    },
+                    'public-media': {
+                        config: {
+                            upload: {
+                                handlers: [
+                                    publicHandler
+                                ],
+                                requiresClientUploadReceipt: true
+                            }
+                        }
+                    }
+                },
+                config: {
+                    bodyParser: {},
+                    upload: {}
+                },
+                logger: {
+                    error: ()=>{}
+                }
+            },
+            routeParams: {
+                collection: 'public-media'
+            }
+        };
+        await expect(addDataAndFileToRequest(req)).rejects.toThrow('A verified client upload reference is required.');
+        expect(privateHandler).not.toHaveBeenCalled();
+        expect(publicHandler).not.toHaveBeenCalled();
+        expect(req.file).toBeUndefined();
+    });
+    it('should require a route collection for upload instructions', async ()=>{
+        const formData = new FormData();
+        formData.append('file', JSON.stringify({
+            collectionSlug: 'media',
+            filename: 'example.txt',
+            mimeType: 'text/plain',
+            size: 11
+        }));
+        const request = new Request('http://localhost/api/graphql', {
+            body: formData,
+            method: 'POST'
+        });
+        const handler = vi.fn(()=>new Response('hello world'));
+        const req = {
+            body: request.body,
+            headers: request.headers,
+            method: request.method,
+            payload: {
+                collections: {
+                    media: {
+                        config: {
+                            upload: {
+                                handlers: [
+                                    handler
+                                ]
+                            }
+                        }
+                    }
+                },
+                config: {
+                    bodyParser: {},
+                    upload: {}
+                },
+                logger: {
+                    error: ()=>{}
+                }
+            }
+        };
+        await expect(addDataAndFileToRequest(req)).rejects.toThrow('Invalid upload collection.');
+        expect(handler).not.toHaveBeenCalled();
+    });
+    it('should require the route collection to support uploads', async ()=>{
+        const formData = new FormData();
+        formData.append('file', JSON.stringify({
+            collectionSlug: 'media',
+            filename: 'example.txt',
+            mimeType: 'text/plain',
+            size: 11
+        }));
+        const request = new Request('http://localhost/api/posts', {
+            body: formData,
+            method: 'POST'
+        });
+        const handler = vi.fn(()=>new Response('hello world'));
+        const req = {
+            body: request.body,
+            headers: request.headers,
+            method: request.method,
+            payload: {
+                collections: {
+                    media: {
+                        config: {
+                            upload: {
+                                handlers: [
+                                    handler
+                                ]
+                            }
+                        }
+                    },
+                    posts: {
+                        config: {}
+                    }
+                },
+                config: {
+                    bodyParser: {},
+                    upload: {}
+                },
+                logger: {
+                    error: ()=>{}
+                }
+            },
+            routeParams: {
+                collection: 'posts'
+            }
+        };
+        await expect(addDataAndFileToRequest(req)).rejects.toThrow('Invalid upload collection.');
+        expect(handler).not.toHaveBeenCalled();
+    });
     describe('client uploads', ()=>{
         const tempFilesToRemove = [];
         afterEach(async ()=>{

package/dist/utilities/addDataAndFileToRequest.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/addDataAndFileToRequest.spec.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { ClientUploadData } from '../uploads/getFileFromClientUpload.js'\nimport type { SanitizedUploadConfig } from '../uploads/types.js'\n\nimport fs from 'fs/promises'\nimport { afterEach, describe, expect, it, vi } from 'vitest'\n\nimport { addDataAndFileToRequest } from './addDataAndFileToRequest.js'\n\ntype MinimalReq = Pick<PayloadRequest, 'body' | 'headers' | 'method' | 'payload'> & {\n  file?: PayloadRequest['file']\n}\n\nconst createReqWithMultipartBody = (): MinimalReq => {\n  const formData = new FormData()\n  formData.append('file', new Blob(['hello world'], { type: 'text/plain' }), 'hello.txt')\n\n  const request = new Request('http://localhost/api/upload', {\n    body: formData,\n    method: 'POST',\n  })\n\n  return {\n    body: request.body,\n    headers: request.headers,\n    method: request.method,\n    payload: {\n      collections: {},\n      config: {\n        bodyParser: {},\n        upload: {},\n      },\n      logger: {\n        error: () => {},\n      },\n    } as unknown as PayloadRequest['payload'],\n  }\n}\n\nconst createClientUploadReq = ({\n  file,\n  handler,\n  upload,\n}: {\n  file: ClientUploadData\n  handler: NonNullable<SanitizedUploadConfig['handlers']>[number]\n  upload?: Partial<SanitizedUploadConfig>\n}): MinimalReq => {\n  const formData = new FormData()\n  formData.append('file', JSON.stringify(file))\n\n  const request = new Request('http://localhost/api/media', {\n    body: formData,\n    method: 'POST',\n  })\n\n  return {\n    body: request.body,\n    headers: request.headers,\n    method: request.method,\n    payload: {\n      collections: {\n        media: {\n          config: {\n            upload: {\n              disableLocalStorage: true,\n              handlers: [handler],\n              ...upload,\n            },\n          },\n        },\n      },\n      config: {\n        bodyParser: {},\n        upload: {},\n      },\n      logger: {\n        error: () => {},\n      },\n    } as unknown as PayloadRequest['payload'],\n  }\n}\n\ndescribe('addDataAndFileToRequest', () => {\n  it('should parse multipart form-data even when content-length is absent', async () => {\n    const req = createReqWithMultipartBody()\n\n    expect(req.headers.get('content-length')).toBeNull()\n\n    await addDataAndFileToRequest(req as PayloadRequest)\n\n    expect(req.file).toBeDefined()\n    expect(req.file?.name).toBe('hello.txt')\n    expect(req.file?.mimetype).toBe('text/plain')\n  })\n\n  describe('client uploads', () => {\n    const tempFilesToRemove: string[] = []\n\n    afterEach(async () => {\n      for (const tempFilePath of tempFilesToRemove) {\n        await fs.rm(tempFilePath, { force: true })\n      }\n      tempFilesToRemove.length = 0\n    })\n\n    it('materializes client-upload metadata without buffering an unused cloud file', async () => {\n      const handler = vi.fn(() => {\n        throw new Error('No-content handler was invoked')\n      })\n      const req = createClientUploadReq({\n        file: {\n          clientUploadContext: { prefix: '' },\n          collectionSlug: 'media',\n          filename: 'large.mp4',\n          mimeType: 'video/mp4',\n          size: 5_000_000_000,\n        },\n        handler,\n        upload: { disableLocalStorage: true },\n      })\n\n      await addDataAndFileToRequest(req as PayloadRequest)\n\n      expect(handler).not.toHaveBeenCalled()\n      expect(req.file).toMatchObject({\n        clientUploadContext: { prefix: '' },\n        mimetype: 'video/mp4',\n        name: 'large.mp4',\n        size: 5_000_000_000,\n      })\n      expect(req.file?.data.length).toBe(0)\n    })\n\n    it('streams a full-content client upload to a temp file without buffering the whole body', async () => {\n      const chunks = [Buffer.from('chunk-one-'), Buffer.from('chunk-two')]\n      const stream = new ReadableStream({\n        start(controller) {\n          for (const chunk of chunks) {\n            controller.enqueue(chunk)\n          }\n          controller.close()\n        },\n      })\n      const response = new Response(stream, {\n        headers: { 'Content-Type': 'video/mp4' },\n        status: 200,\n      })\n      const arrayBufferTripwire = vi.fn(async () => {\n        throw new Error('Unexpected whole-body buffering')\n      })\n      Object.defineProperty(response, 'arrayBuffer', { value: arrayBufferTripwire })\n\n      const handler = vi.fn(async () => response)\n      const req = createClientUploadReq({\n        file: {\n          clientUploadContext: { prefix: '' },\n          collectionSlug: 'media',\n          filename: 'clip.mp4',\n          mimeType: 'video/mp4',\n          size: 20,\n        },\n        handler,\n        upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n      })\n\n      await addDataAndFileToRequest(req as PayloadRequest)\n      tempFilesToRemove.push(req.file!.tempFilePath!)\n\n      expect(arrayBufferTripwire).not.toHaveBeenCalled()\n      expect(req.file?.data.length).toBe(0)\n      expect(req.file?.tempFilePath).toBeDefined()\n      const written = await fs.readFile(req.file!.tempFilePath!)\n      expect(written.toString()).toBe(chunks.map((chunk) => chunk.toString()).join(''))\n    })\n  })\n})\n"],"names":["fs","afterEach","describe","expect","it","vi","addDataAndFileToRequest","createReqWithMultipartBody","formData","FormData","append","Blob","type","request","Request","body","method","headers","payload","collections","config","bodyParser","upload","logger","error","createClientUploadReq","file","handler","JSON","stringify","media","disableLocalStorage","handlers","req","get","toBeNull","toBeDefined","name","toBe","mimetype","tempFilesToRemove","tempFilePath","rm","force","length","fn","Error","clientUploadContext","prefix","collectionSlug","filename","mimeType","size","not","toHaveBeenCalled","toMatchObject","data","chunks","Buffer","from","stream","ReadableStream","start","controller","chunk","enqueue","close","response","Response","status","arrayBufferTripwire","Object","defineProperty","value","mimeTypes","push","written","readFile","toString","map","join"],"mappings":"AAIA,OAAOA,QAAQ,cAAa;AAC5B,SAASC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE5D,SAASC,uBAAuB,QAAQ,+BAA8B;AAMtE,MAAMC,6BAA6B;IACjC,MAAMC,WAAW,IAAIC;IACrBD,SAASE,MAAM,CAAC,QAAQ,IAAIC,KAAK;QAAC;KAAc,EAAE;QAAEC,MAAM;IAAa,IAAI;IAE3E,MAAMC,UAAU,IAAIC,QAAQ,+BAA+B;QACzDC,MAAMP;QACNQ,QAAQ;IACV;IAEA,OAAO;QACLD,MAAMF,QAAQE,IAAI;QAClBE,SAASJ,QAAQI,OAAO;QACxBD,QAAQH,QAAQG,MAAM;QACtBE,SAAS;YACPC,aAAa,CAAC;YACdC,QAAQ;gBACNC,YAAY,CAAC;gBACbC,QAAQ,CAAC;YACX;YACAC,QAAQ;gBACNC,OAAO,KAAO;YAChB;QACF;IACF;AACF;AAEA,MAAMC,wBAAwB,CAAC,EAC7BC,IAAI,EACJC,OAAO,EACPL,MAAM,EAKP;IACC,MAAMd,WAAW,IAAIC;IACrBD,SAASE,MAAM,CAAC,QAAQkB,KAAKC,SAAS,CAACH;IAEvC,MAAMb,UAAU,IAAIC,QAAQ,8BAA8B;QACxDC,MAAMP;QACNQ,QAAQ;IACV;IAEA,OAAO;QACLD,MAAMF,QAAQE,IAAI;QAClBE,SAASJ,QAAQI,OAAO;QACxBD,QAAQH,QAAQG,MAAM;QACtBE,SAAS;YACPC,aAAa;gBACXW,OAAO;oBACLV,QAAQ;wBACNE,QAAQ;4BACNS,qBAAqB;4BACrBC,UAAU;gCAACL;6BAAQ;4BACnB,GAAGL,MAAM;wBACX;oBACF;gBACF;YACF;YACAF,QAAQ;gBACNC,YAAY,CAAC;gBACbC,QAAQ,CAAC;YACX;YACAC,QAAQ;gBACNC,OAAO,KAAO;YAChB;QACF;IACF;AACF;AAEAtB,SAAS,2BAA2B;IAClCE,GAAG,uEAAuE;QACxE,MAAM6B,MAAM1B;QAEZJ,OAAO8B,IAAIhB,OAAO,CAACiB,GAAG,CAAC,mBAAmBC,QAAQ;QAElD,MAAM7B,wBAAwB2B;QAE9B9B,OAAO8B,IAAIP,IAAI,EAAEU,WAAW;QAC5BjC,OAAO8B,IAAIP,IAAI,EAAEW,MAAMC,IAAI,CAAC;QAC5BnC,OAAO8B,IAAIP,IAAI,EAAEa,UAAUD,IAAI,CAAC;IAClC;IAEApC,SAAS,kBAAkB;QACzB,MAAMsC,oBAA8B,EAAE;QAEtCvC,UAAU;YACR,KAAK,MAAMwC,gBAAgBD,kBAAmB;gBAC5C,MAAMxC,GAAG0C,EAAE,CAACD,cAAc;oBAAEE,OAAO;gBAAK;YAC1C;YACAH,kBAAkBI,MAAM,GAAG;QAC7B;QAEAxC,GAAG,8EAA8E;YAC/E,MAAMuB,UAAUtB,GAAGwC,EAAE,CAAC;gBACpB,MAAM,IAAIC,MAAM;YAClB;YACA,MAAMb,MAAMR,sBAAsB;gBAChCC,MAAM;oBACJqB,qBAAqB;wBAAEC,QAAQ;oBAAG;oBAClCC,gBAAgB;oBAChBC,UAAU;oBACVC,UAAU;oBACVC,MAAM;gBACR;gBACAzB;gBACAL,QAAQ;oBAAES,qBAAqB;gBAAK;YACtC;YAEA,MAAMzB,wBAAwB2B;YAE9B9B,OAAOwB,SAAS0B,GAAG,CAACC,gBAAgB;YACpCnD,OAAO8B,IAAIP,IAAI,EAAE6B,aAAa,CAAC;gBAC7BR,qBAAqB;oBAAEC,QAAQ;gBAAG;gBAClCT,UAAU;gBACVF,MAAM;gBACNe,MAAM;YACR;YACAjD,OAAO8B,IAAIP,IAAI,EAAE8B,KAAKZ,QAAQN,IAAI,CAAC;QACrC;QAEAlC,GAAG,wFAAwF;YACzF,MAAMqD,SAAS;gBAACC,OAAOC,IAAI,CAAC;gBAAeD,OAAOC,IAAI,CAAC;aAAa;YACpE,MAAMC,SAAS,IAAIC,eAAe;gBAChCC,OAAMC,UAAU;oBACd,KAAK,MAAMC,SAASP,OAAQ;wBAC1BM,WAAWE,OAAO,CAACD;oBACrB;oBACAD,WAAWG,KAAK;gBAClB;YACF;YACA,MAAMC,WAAW,IAAIC,SAASR,QAAQ;gBACpC3C,SAAS;oBAAE,gBAAgB;gBAAY;gBACvCoD,QAAQ;YACV;YACA,MAAMC,sBAAsBjE,GAAGwC,EAAE,CAAC;gBAChC,MAAM,IAAIC,MAAM;YAClB;YACAyB,OAAOC,cAAc,CAACL,UAAU,eAAe;gBAAEM,OAAOH;YAAoB;YAE5E,MAAM3C,UAAUtB,GAAGwC,EAAE,CAAC,UAAYsB;YAClC,MAAMlC,MAAMR,sBAAsB;gBAChCC,MAAM;oBACJqB,qBAAqB;wBAAEC,QAAQ;oBAAG;oBAClCC,gBAAgB;oBAChBC,UAAU;oBACVC,UAAU;oBACVC,MAAM;gBACR;gBACAzB;gBACAL,QAAQ;oBAAES,qBAAqB;oBAAM2C,WAAW;wBAAC;qBAAU;gBAAC;YAC9D;YAEA,MAAMpE,wBAAwB2B;YAC9BO,kBAAkBmC,IAAI,CAAC1C,IAAIP,IAAI,CAAEe,YAAY;YAE7CtC,OAAOmE,qBAAqBjB,GAAG,CAACC,gBAAgB;YAChDnD,OAAO8B,IAAIP,IAAI,EAAE8B,KAAKZ,QAAQN,IAAI,CAAC;YACnCnC,OAAO8B,IAAIP,IAAI,EAAEe,cAAcL,WAAW;YAC1C,MAAMwC,UAAU,MAAM5E,GAAG6E,QAAQ,CAAC5C,IAAIP,IAAI,CAAEe,YAAY;YACxDtC,OAAOyE,QAAQE,QAAQ,IAAIxC,IAAI,CAACmB,OAAOsB,GAAG,CAAC,CAACf,QAAUA,MAAMc,QAAQ,IAAIE,IAAI,CAAC;QAC/E;IACF;AACF"}
+{"version":3,"sources":["../../src/utilities/addDataAndFileToRequest.spec.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { ClientUploadData } from '../uploads/getFileFromClientUpload.js'\nimport type { SanitizedUploadConfig } from '../uploads/types.js'\n\nimport fs from 'fs/promises'\nimport { afterEach, describe, expect, it, vi } from 'vitest'\n\nimport { addDataAndFileToRequest } from './addDataAndFileToRequest.js'\n\ntype MinimalReq = Pick<PayloadRequest, 'body' | 'headers' | 'method' | 'payload'> & {\n  file?: PayloadRequest['file']\n  routeParams?: PayloadRequest['routeParams']\n}\n\nconst createReqWithMultipartBody = (): MinimalReq => {\n  const formData = new FormData()\n  formData.append('file', new Blob(['hello world'], { type: 'text/plain' }), 'hello.txt')\n\n  const request = new Request('http://localhost/api/upload', {\n    body: formData,\n    method: 'POST',\n  })\n\n  return {\n    body: request.body,\n    headers: request.headers,\n    method: request.method,\n    payload: {\n      collections: {},\n      config: {\n        bodyParser: {},\n        upload: {},\n      },\n      logger: {\n        error: () => {},\n      },\n    } as unknown as PayloadRequest['payload'],\n  }\n}\n\nconst createClientUploadReq = ({\n  file,\n  handler,\n  upload,\n}: {\n  file: ClientUploadData\n  handler: NonNullable<SanitizedUploadConfig['handlers']>[number]\n  upload?: Partial<SanitizedUploadConfig>\n}): MinimalReq => {\n  const formData = new FormData()\n  formData.append('file', JSON.stringify(file))\n\n  const request = new Request('http://localhost/api/media', {\n    body: formData,\n    method: 'POST',\n  })\n\n  return {\n    body: request.body,\n    headers: request.headers,\n    method: request.method,\n    payload: {\n      collections: {\n        media: {\n          config: {\n            upload: {\n              disableLocalStorage: true,\n              handlers: [handler],\n              ...upload,\n            },\n          },\n        },\n      },\n      config: {\n        bodyParser: {},\n        upload: {},\n      },\n      logger: {\n        error: () => {},\n      },\n    } as unknown as PayloadRequest['payload'],\n    routeParams: {\n      collection: 'media',\n    },\n  }\n}\n\ndescribe('addDataAndFileToRequest', () => {\n  it('should parse multipart form-data even when content-length is absent', async () => {\n    const req = createReqWithMultipartBody()\n\n    expect(req.headers.get('content-length')).toBeNull()\n\n    await addDataAndFileToRequest(req as PayloadRequest)\n\n    expect(req.file).toBeDefined()\n    expect(req.file?.name).toBe('hello.txt')\n    expect(req.file?.mimetype).toBe('text/plain')\n  })\n\n  it('should reject unsigned upload instructions before the route handler', async () => {\n    const formData = new FormData()\n    formData.append(\n      'file',\n      JSON.stringify({\n        collectionSlug: 'private-media',\n        clientUploadContext: { prefix: 'private' },\n        filename: 'example.txt',\n        mimeType: 'text/plain',\n        size: 11,\n      }),\n    )\n\n    const request = new Request('http://localhost/api/public-media', {\n      body: formData,\n      method: 'POST',\n    })\n\n    const privateHandler = vi.fn()\n    const publicHandler = vi.fn((_req, args) => {\n      return new Response('hello world', {\n        headers: {\n          'content-type': 'text/plain',\n          'x-collection': args.params.collection,\n        },\n      })\n    })\n\n    const req: MinimalReq = {\n      body: request.body,\n      headers: request.headers,\n      method: request.method,\n      payload: {\n        collections: {\n          'private-media': {\n            config: {\n              upload: {\n                handlers: [privateHandler],\n              },\n            },\n          },\n          'public-media': {\n            config: {\n              upload: {\n                handlers: [publicHandler],\n                requiresClientUploadReceipt: true,\n              },\n            },\n          },\n        },\n        config: {\n          bodyParser: {},\n          upload: {},\n        },\n        logger: {\n          error: () => {},\n        },\n      } as unknown as PayloadRequest['payload'],\n      routeParams: {\n        collection: 'public-media',\n      },\n    }\n\n    await expect(addDataAndFileToRequest(req as PayloadRequest)).rejects.toThrow(\n      'A verified client upload reference is required.',\n    )\n\n    expect(privateHandler).not.toHaveBeenCalled()\n    expect(publicHandler).not.toHaveBeenCalled()\n    expect(req.file).toBeUndefined()\n  })\n\n  it('should require a route collection for upload instructions', async () => {\n    const formData = new FormData()\n    formData.append(\n      'file',\n      JSON.stringify({\n        collectionSlug: 'media',\n        filename: 'example.txt',\n        mimeType: 'text/plain',\n        size: 11,\n      }),\n    )\n\n    const request = new Request('http://localhost/api/graphql', {\n      body: formData,\n      method: 'POST',\n    })\n    const handler = vi.fn(() => new Response('hello world'))\n\n    const req: MinimalReq = {\n      body: request.body,\n      headers: request.headers,\n      method: request.method,\n      payload: {\n        collections: {\n          media: {\n            config: {\n              upload: {\n                handlers: [handler],\n              },\n            },\n          },\n        },\n        config: {\n          bodyParser: {},\n          upload: {},\n        },\n        logger: {\n          error: () => {},\n        },\n      } as unknown as PayloadRequest['payload'],\n    }\n\n    await expect(addDataAndFileToRequest(req as PayloadRequest)).rejects.toThrow(\n      'Invalid upload collection.',\n    )\n\n    expect(handler).not.toHaveBeenCalled()\n  })\n\n  it('should require the route collection to support uploads', async () => {\n    const formData = new FormData()\n    formData.append(\n      'file',\n      JSON.stringify({\n        collectionSlug: 'media',\n        filename: 'example.txt',\n        mimeType: 'text/plain',\n        size: 11,\n      }),\n    )\n\n    const request = new Request('http://localhost/api/posts', {\n      body: formData,\n      method: 'POST',\n    })\n    const handler = vi.fn(() => new Response('hello world'))\n\n    const req: MinimalReq = {\n      body: request.body,\n      headers: request.headers,\n      method: request.method,\n      payload: {\n        collections: {\n          media: {\n            config: {\n              upload: {\n                handlers: [handler],\n              },\n            },\n          },\n          posts: {\n            config: {},\n          },\n        },\n        config: {\n          bodyParser: {},\n          upload: {},\n        },\n        logger: {\n          error: () => {},\n        },\n      } as unknown as PayloadRequest['payload'],\n      routeParams: {\n        collection: 'posts',\n      },\n    }\n\n    await expect(addDataAndFileToRequest(req as PayloadRequest)).rejects.toThrow(\n      'Invalid upload collection.',\n    )\n\n    expect(handler).not.toHaveBeenCalled()\n  })\n\n  describe('client uploads', () => {\n    const tempFilesToRemove: string[] = []\n\n    afterEach(async () => {\n      for (const tempFilePath of tempFilesToRemove) {\n        await fs.rm(tempFilePath, { force: true })\n      }\n      tempFilesToRemove.length = 0\n    })\n\n    it('materializes client-upload metadata without buffering an unused cloud file', async () => {\n      const handler = vi.fn(() => {\n        throw new Error('No-content handler was invoked')\n      })\n      const req = createClientUploadReq({\n        file: {\n          clientUploadContext: { prefix: '' },\n          collectionSlug: 'media',\n          filename: 'large.mp4',\n          mimeType: 'video/mp4',\n          size: 5_000_000_000,\n        },\n        handler,\n        upload: { disableLocalStorage: true },\n      })\n\n      await addDataAndFileToRequest(req as PayloadRequest)\n\n      expect(handler).not.toHaveBeenCalled()\n      expect(req.file).toMatchObject({\n        clientUploadContext: { prefix: '' },\n        mimetype: 'video/mp4',\n        name: 'large.mp4',\n        size: 5_000_000_000,\n      })\n      expect(req.file?.data.length).toBe(0)\n    })\n\n    it('streams a full-content client upload to a temp file without buffering the whole body', async () => {\n      const chunks = [Buffer.from('chunk-one-'), Buffer.from('chunk-two')]\n      const stream = new ReadableStream({\n        start(controller) {\n          for (const chunk of chunks) {\n            controller.enqueue(chunk)\n          }\n          controller.close()\n        },\n      })\n      const response = new Response(stream, {\n        headers: { 'Content-Type': 'video/mp4' },\n        status: 200,\n      })\n      const arrayBufferTripwire = vi.fn(async () => {\n        throw new Error('Unexpected whole-body buffering')\n      })\n      Object.defineProperty(response, 'arrayBuffer', { value: arrayBufferTripwire })\n\n      const handler = vi.fn(async () => response)\n      const req = createClientUploadReq({\n        file: {\n          clientUploadContext: { prefix: '' },\n          collectionSlug: 'media',\n          filename: 'clip.mp4',\n          mimeType: 'video/mp4',\n          size: 20,\n        },\n        handler,\n        upload: { disableLocalStorage: true, mimeTypes: ['video/*'] },\n      })\n\n      await addDataAndFileToRequest(req as PayloadRequest)\n      tempFilesToRemove.push(req.file!.tempFilePath!)\n\n      expect(arrayBufferTripwire).not.toHaveBeenCalled()\n      expect(req.file?.data.length).toBe(0)\n      expect(req.file?.tempFilePath).toBeDefined()\n      const written = await fs.readFile(req.file!.tempFilePath!)\n      expect(written.toString()).toBe(chunks.map((chunk) => chunk.toString()).join(''))\n    })\n  })\n})\n"],"names":["fs","afterEach","describe","expect","it","vi","addDataAndFileToRequest","createReqWithMultipartBody","formData","FormData","append","Blob","type","request","Request","body","method","headers","payload","collections","config","bodyParser","upload","logger","error","createClientUploadReq","file","handler","JSON","stringify","media","disableLocalStorage","handlers","routeParams","collection","req","get","toBeNull","toBeDefined","name","toBe","mimetype","collectionSlug","clientUploadContext","prefix","filename","mimeType","size","privateHandler","fn","publicHandler","_req","args","Response","params","requiresClientUploadReceipt","rejects","toThrow","not","toHaveBeenCalled","toBeUndefined","posts","tempFilesToRemove","tempFilePath","rm","force","length","Error","toMatchObject","data","chunks","Buffer","from","stream","ReadableStream","start","controller","chunk","enqueue","close","response","status","arrayBufferTripwire","Object","defineProperty","value","mimeTypes","push","written","readFile","toString","map","join"],"mappings":"AAIA,OAAOA,QAAQ,cAAa;AAC5B,SAASC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE5D,SAASC,uBAAuB,QAAQ,+BAA8B;AAOtE,MAAMC,6BAA6B;IACjC,MAAMC,WAAW,IAAIC;IACrBD,SAASE,MAAM,CAAC,QAAQ,IAAIC,KAAK;QAAC;KAAc,EAAE;QAAEC,MAAM;IAAa,IAAI;IAE3E,MAAMC,UAAU,IAAIC,QAAQ,+BAA+B;QACzDC,MAAMP;QACNQ,QAAQ;IACV;IAEA,OAAO;QACLD,MAAMF,QAAQE,IAAI;QAClBE,SAASJ,QAAQI,OAAO;QACxBD,QAAQH,QAAQG,MAAM;QACtBE,SAAS;YACPC,aAAa,CAAC;YACdC,QAAQ;gBACNC,YAAY,CAAC;gBACbC,QAAQ,CAAC;YACX;YACAC,QAAQ;gBACNC,OAAO,KAAO;YAChB;QACF;IACF;AACF;AAEA,MAAMC,wBAAwB,CAAC,EAC7BC,IAAI,EACJC,OAAO,EACPL,MAAM,EAKP;IACC,MAAMd,WAAW,IAAIC;IACrBD,SAASE,MAAM,CAAC,QAAQkB,KAAKC,SAAS,CAACH;IAEvC,MAAMb,UAAU,IAAIC,QAAQ,8BAA8B;QACxDC,MAAMP;QACNQ,QAAQ;IACV;IAEA,OAAO;QACLD,MAAMF,QAAQE,IAAI;QAClBE,SAASJ,QAAQI,OAAO;QACxBD,QAAQH,QAAQG,MAAM;QACtBE,SAAS;YACPC,aAAa;gBACXW,OAAO;oBACLV,QAAQ;wBACNE,QAAQ;4BACNS,qBAAqB;4BACrBC,UAAU;gCAACL;6BAAQ;4BACnB,GAAGL,MAAM;wBACX;oBACF;gBACF;YACF;YACAF,QAAQ;gBACNC,YAAY,CAAC;gBACbC,QAAQ,CAAC;YACX;YACAC,QAAQ;gBACNC,OAAO,KAAO;YAChB;QACF;QACAS,aAAa;YACXC,YAAY;QACd;IACF;AACF;AAEAhC,SAAS,2BAA2B;IAClCE,GAAG,uEAAuE;QACxE,MAAM+B,MAAM5B;QAEZJ,OAAOgC,IAAIlB,OAAO,CAACmB,GAAG,CAAC,mBAAmBC,QAAQ;QAElD,MAAM/B,wBAAwB6B;QAE9BhC,OAAOgC,IAAIT,IAAI,EAAEY,WAAW;QAC5BnC,OAAOgC,IAAIT,IAAI,EAAEa,MAAMC,IAAI,CAAC;QAC5BrC,OAAOgC,IAAIT,IAAI,EAAEe,UAAUD,IAAI,CAAC;IAClC;IAEApC,GAAG,uEAAuE;QACxE,MAAMI,WAAW,IAAIC;QACrBD,SAASE,MAAM,CACb,QACAkB,KAAKC,SAAS,CAAC;YACba,gBAAgB;YAChBC,qBAAqB;gBAAEC,QAAQ;YAAU;YACzCC,UAAU;YACVC,UAAU;YACVC,MAAM;QACR;QAGF,MAAMlC,UAAU,IAAIC,QAAQ,qCAAqC;YAC/DC,MAAMP;YACNQ,QAAQ;QACV;QAEA,MAAMgC,iBAAiB3C,GAAG4C,EAAE;QAC5B,MAAMC,gBAAgB7C,GAAG4C,EAAE,CAAC,CAACE,MAAMC;YACjC,OAAO,IAAIC,SAAS,eAAe;gBACjCpC,SAAS;oBACP,gBAAgB;oBAChB,gBAAgBmC,KAAKE,MAAM,CAACpB,UAAU;gBACxC;YACF;QACF;QAEA,MAAMC,MAAkB;YACtBpB,MAAMF,QAAQE,IAAI;YAClBE,SAASJ,QAAQI,OAAO;YACxBD,QAAQH,QAAQG,MAAM;YACtBE,SAAS;gBACPC,aAAa;oBACX,iBAAiB;wBACfC,QAAQ;4BACNE,QAAQ;gCACNU,UAAU;oCAACgB;iCAAe;4BAC5B;wBACF;oBACF;oBACA,gBAAgB;wBACd5B,QAAQ;4BACNE,QAAQ;gCACNU,UAAU;oCAACkB;iCAAc;gCACzBK,6BAA6B;4BAC/B;wBACF;oBACF;gBACF;gBACAnC,QAAQ;oBACNC,YAAY,CAAC;oBACbC,QAAQ,CAAC;gBACX;gBACAC,QAAQ;oBACNC,OAAO,KAAO;gBAChB;YACF;YACAS,aAAa;gBACXC,YAAY;YACd;QACF;QAEA,MAAM/B,OAAOG,wBAAwB6B,MAAwBqB,OAAO,CAACC,OAAO,CAC1E;QAGFtD,OAAO6C,gBAAgBU,GAAG,CAACC,gBAAgB;QAC3CxD,OAAO+C,eAAeQ,GAAG,CAACC,gBAAgB;QAC1CxD,OAAOgC,IAAIT,IAAI,EAAEkC,aAAa;IAChC;IAEAxD,GAAG,6DAA6D;QAC9D,MAAMI,WAAW,IAAIC;QACrBD,SAASE,MAAM,CACb,QACAkB,KAAKC,SAAS,CAAC;YACba,gBAAgB;YAChBG,UAAU;YACVC,UAAU;YACVC,MAAM;QACR;QAGF,MAAMlC,UAAU,IAAIC,QAAQ,gCAAgC;YAC1DC,MAAMP;YACNQ,QAAQ;QACV;QACA,MAAMW,UAAUtB,GAAG4C,EAAE,CAAC,IAAM,IAAII,SAAS;QAEzC,MAAMlB,MAAkB;YACtBpB,MAAMF,QAAQE,IAAI;YAClBE,SAASJ,QAAQI,OAAO;YACxBD,QAAQH,QAAQG,MAAM;YACtBE,SAAS;gBACPC,aAAa;oBACXW,OAAO;wBACLV,QAAQ;4BACNE,QAAQ;gCACNU,UAAU;oCAACL;iCAAQ;4BACrB;wBACF;oBACF;gBACF;gBACAP,QAAQ;oBACNC,YAAY,CAAC;oBACbC,QAAQ,CAAC;gBACX;gBACAC,QAAQ;oBACNC,OAAO,KAAO;gBAChB;YACF;QACF;QAEA,MAAMrB,OAAOG,wBAAwB6B,MAAwBqB,OAAO,CAACC,OAAO,CAC1E;QAGFtD,OAAOwB,SAAS+B,GAAG,CAACC,gBAAgB;IACtC;IAEAvD,GAAG,0DAA0D;QAC3D,MAAMI,WAAW,IAAIC;QACrBD,SAASE,MAAM,CACb,QACAkB,KAAKC,SAAS,CAAC;YACba,gBAAgB;YAChBG,UAAU;YACVC,UAAU;YACVC,MAAM;QACR;QAGF,MAAMlC,UAAU,IAAIC,QAAQ,8BAA8B;YACxDC,MAAMP;YACNQ,QAAQ;QACV;QACA,MAAMW,UAAUtB,GAAG4C,EAAE,CAAC,IAAM,IAAII,SAAS;QAEzC,MAAMlB,MAAkB;YACtBpB,MAAMF,QAAQE,IAAI;YAClBE,SAASJ,QAAQI,OAAO;YACxBD,QAAQH,QAAQG,MAAM;YACtBE,SAAS;gBACPC,aAAa;oBACXW,OAAO;wBACLV,QAAQ;4BACNE,QAAQ;gCACNU,UAAU;oCAACL;iCAAQ;4BACrB;wBACF;oBACF;oBACAkC,OAAO;wBACLzC,QAAQ,CAAC;oBACX;gBACF;gBACAA,QAAQ;oBACNC,YAAY,CAAC;oBACbC,QAAQ,CAAC;gBACX;gBACAC,QAAQ;oBACNC,OAAO,KAAO;gBAChB;YACF;YACAS,aAAa;gBACXC,YAAY;YACd;QACF;QAEA,MAAM/B,OAAOG,wBAAwB6B,MAAwBqB,OAAO,CAACC,OAAO,CAC1E;QAGFtD,OAAOwB,SAAS+B,GAAG,CAACC,gBAAgB;IACtC;IAEAzD,SAAS,kBAAkB;QACzB,MAAM4D,oBAA8B,EAAE;QAEtC7D,UAAU;YACR,KAAK,MAAM8D,gBAAgBD,kBAAmB;gBAC5C,MAAM9D,GAAGgE,EAAE,CAACD,cAAc;oBAAEE,OAAO;gBAAK;YAC1C;YACAH,kBAAkBI,MAAM,GAAG;QAC7B;QAEA9D,GAAG,8EAA8E;YAC/E,MAAMuB,UAAUtB,GAAG4C,EAAE,CAAC;gBACpB,MAAM,IAAIkB,MAAM;YAClB;YACA,MAAMhC,MAAMV,sBAAsB;gBAChCC,MAAM;oBACJiB,qBAAqB;wBAAEC,QAAQ;oBAAG;oBAClCF,gBAAgB;oBAChBG,UAAU;oBACVC,UAAU;oBACVC,MAAM;gBACR;gBACApB;gBACAL,QAAQ;oBAAES,qBAAqB;gBAAK;YACtC;YAEA,MAAMzB,wBAAwB6B;YAE9BhC,OAAOwB,SAAS+B,GAAG,CAACC,gBAAgB;YACpCxD,OAAOgC,IAAIT,IAAI,EAAE0C,aAAa,CAAC;gBAC7BzB,qBAAqB;oBAAEC,QAAQ;gBAAG;gBAClCH,UAAU;gBACVF,MAAM;gBACNQ,MAAM;YACR;YACA5C,OAAOgC,IAAIT,IAAI,EAAE2C,KAAKH,QAAQ1B,IAAI,CAAC;QACrC;QAEApC,GAAG,wFAAwF;YACzF,MAAMkE,SAAS;gBAACC,OAAOC,IAAI,CAAC;gBAAeD,OAAOC,IAAI,CAAC;aAAa;YACpE,MAAMC,SAAS,IAAIC,eAAe;gBAChCC,OAAMC,UAAU;oBACd,KAAK,MAAMC,SAASP,OAAQ;wBAC1BM,WAAWE,OAAO,CAACD;oBACrB;oBACAD,WAAWG,KAAK;gBAClB;YACF;YACA,MAAMC,WAAW,IAAI3B,SAASoB,QAAQ;gBACpCxD,SAAS;oBAAE,gBAAgB;gBAAY;gBACvCgE,QAAQ;YACV;YACA,MAAMC,sBAAsB7E,GAAG4C,EAAE,CAAC;gBAChC,MAAM,IAAIkB,MAAM;YAClB;YACAgB,OAAOC,cAAc,CAACJ,UAAU,eAAe;gBAAEK,OAAOH;YAAoB;YAE5E,MAAMvD,UAAUtB,GAAG4C,EAAE,CAAC,UAAY+B;YAClC,MAAM7C,MAAMV,sBAAsB;gBAChCC,MAAM;oBACJiB,qBAAqB;wBAAEC,QAAQ;oBAAG;oBAClCF,gBAAgB;oBAChBG,UAAU;oBACVC,UAAU;oBACVC,MAAM;gBACR;gBACApB;gBACAL,QAAQ;oBAAES,qBAAqB;oBAAMuD,WAAW;wBAAC;qBAAU;gBAAC;YAC9D;YAEA,MAAMhF,wBAAwB6B;YAC9B2B,kBAAkByB,IAAI,CAACpD,IAAIT,IAAI,CAAEqC,YAAY;YAE7C5D,OAAO+E,qBAAqBxB,GAAG,CAACC,gBAAgB;YAChDxD,OAAOgC,IAAIT,IAAI,EAAE2C,KAAKH,QAAQ1B,IAAI,CAAC;YACnCrC,OAAOgC,IAAIT,IAAI,EAAEqC,cAAczB,WAAW;YAC1C,MAAMkD,UAAU,MAAMxF,GAAGyF,QAAQ,CAACtD,IAAIT,IAAI,CAAEqC,YAAY;YACxD5D,OAAOqF,QAAQE,QAAQ,IAAIlD,IAAI,CAAC8B,OAAOqB,GAAG,CAAC,CAACd,QAAUA,MAAMa,QAAQ,IAAIE,IAAI,CAAC;QAC/E;IACF;AACF"}

package/dist/utilities/createPayloadRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createPayloadRequest.d.ts","sourceRoot":"","sources":["../../src/utilities/createPayloadRequest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAkC,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAUvF,KAAK,IAAI,GAAG;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,oBAAoB,wFAM9B,IAAI,KAAG,OAAO,CAAC,cAAc,CA2G/B,CAAA"}
+{"version":3,"file":"createPayloadRequest.d.ts","sourceRoot":"","sources":["../../src/utilities/createPayloadRequest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAkC,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAUvF,KAAK,IAAI,GAAG;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,oBAAoB,wFAM9B,IAAI,KAAG,OAAO,CAAC,cAAc,CA4G/B,CAAA"}

package/dist/utilities/createPayloadRequest.js

@@ -81,7 +81,8 @@ export const createPayloadRequest = async ({ canSetHeaders, config: configPromis
         canSetHeaders,
         headers: req.headers,
         isGraphQL,
-        payload
+        payload,
+        req
     });
     req.user = user;
     if (responseHeaders) {

package/dist/utilities/createPayloadRequest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/createPayloadRequest.ts"],"sourcesContent":["import { initI18n } from '@payloadcms/translations'\nimport * as qs from 'qs-esm'\n\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { TypedFallbackLocale } from '../index.js'\nimport type { CustomPayloadRequestProperties, PayloadRequest } from '../types/index.js'\n\nimport { executeAuthStrategies } from '../auth/executeAuthStrategies.js'\nimport { getDataLoader } from '../collections/dataloader.js'\nimport { getPayload } from '../index.js'\nimport { sanitizeLocales } from './addLocalesToRequest.js'\nimport { formatAdminURL } from './formatAdminURL.js'\nimport { getRequestLanguage } from './getRequestLanguage.js'\nimport { parseCookies } from './parseCookies.js'\n\ntype Args = {\n  canSetHeaders?: boolean\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  params?: {\n    collection: string\n  }\n  payloadInstanceCacheKey?: string\n  request: Request\n}\n\nexport const createPayloadRequest = async ({\n  canSetHeaders,\n  config: configPromise,\n  params,\n  payloadInstanceCacheKey,\n  request,\n}: Args): Promise<PayloadRequest> => {\n  const cookies = parseCookies(request.headers)\n  const payload = await getPayload({\n    config: configPromise,\n    cron: true,\n    key: payloadInstanceCacheKey,\n  })\n\n  const { config } = payload\n  const localization = config.localization\n\n  const urlProperties = new URL(request.url)\n  const { pathname, searchParams } = urlProperties\n\n  const isGraphQL =\n    !config.graphQL.disable &&\n    pathname ===\n      formatAdminURL({\n        apiRoute: config.routes.api,\n        path: config.routes.graphQL as `/${string}`,\n      })\n\n  const language = getRequestLanguage({\n    config,\n    cookies,\n    headers: request.headers,\n  })\n\n  const i18n = await initI18n({\n    config: config.i18n,\n    context: 'api',\n    language,\n  })\n\n  let locale = searchParams.get('locale')\n\n  const { search: queryToParse } = urlProperties\n\n  const query = queryToParse\n    ? qs.parse(queryToParse, {\n        allowEmptyArrays: true,\n        arrayLimit: 1000,\n        depth: 10,\n        ignoreQueryPrefix: true,\n      })\n    : {}\n\n  const fallbackFromRequest = (query.fallbackLocale ||\n    searchParams.get('fallback-locale') ||\n    searchParams.get('fallbackLocale')) as TypedFallbackLocale\n\n  let fallbackLocale = fallbackFromRequest\n\n  if (localization) {\n    const locales = sanitizeLocales({\n      fallbackLocale: fallbackLocale!,\n      locale: locale!,\n      localization,\n    })\n\n    fallbackLocale = locales.fallbackLocale!\n    locale = locales.locale!\n  }\n\n  const customRequest: CustomPayloadRequestProperties = {\n    context: {},\n    fallbackLocale: fallbackLocale!,\n    hash: urlProperties.hash,\n    host: urlProperties.host,\n    href: urlProperties.href,\n    i18n,\n    locale,\n    origin: urlProperties.origin,\n    pathname: urlProperties.pathname,\n    payload,\n    payloadAPI: isGraphQL ? 'GraphQL' : 'REST',\n    payloadDataLoader: undefined!,\n    payloadUploadSizes: {},\n    port: urlProperties.port,\n    protocol: urlProperties.protocol,\n    query,\n    routeParams: params || {},\n    search: urlProperties.search,\n    searchParams: urlProperties.searchParams,\n    t: i18n.t,\n    transactionID: undefined,\n    user: null,\n  }\n\n  const req: PayloadRequest = Object.assign(request, customRequest)\n\n  req.payloadDataLoader = getDataLoader(req)\n\n  const { responseHeaders, user } = await executeAuthStrategies({\n    canSetHeaders,\n    headers: req.headers,\n    isGraphQL,\n    payload,\n  })\n\n  req.user = user\n\n  if (responseHeaders) {\n    req.responseHeaders = responseHeaders\n  }\n\n  return req\n}\n"],"names":["initI18n","qs","executeAuthStrategies","getDataLoader","getPayload","sanitizeLocales","formatAdminURL","getRequestLanguage","parseCookies","createPayloadRequest","canSetHeaders","config","configPromise","params","payloadInstanceCacheKey","request","cookies","headers","payload","cron","key","localization","urlProperties","URL","url","pathname","searchParams","isGraphQL","graphQL","disable","apiRoute","routes","api","path","language","i18n","context","locale","get","search","queryToParse","query","parse","allowEmptyArrays","arrayLimit","depth","ignoreQueryPrefix","fallbackFromRequest","fallbackLocale","locales","customRequest","hash","host","href","origin","payloadAPI","payloadDataLoader","undefined","payloadUploadSizes","port","protocol","routeParams","t","transactionID","user","req","Object","assign","responseHeaders"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,2BAA0B;AACnD,YAAYC,QAAQ,SAAQ;AAM5B,SAASC,qBAAqB,QAAQ,mCAAkC;AACxE,SAASC,aAAa,QAAQ,+BAA8B;AAC5D,SAASC,UAAU,QAAQ,cAAa;AACxC,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SAASC,YAAY,QAAQ,oBAAmB;AAYhD,OAAO,MAAMC,uBAAuB,OAAO,EACzCC,aAAa,EACbC,QAAQC,aAAa,EACrBC,MAAM,EACNC,uBAAuB,EACvBC,OAAO,EACF;IACL,MAAMC,UAAUR,aAAaO,QAAQE,OAAO;IAC5C,MAAMC,UAAU,MAAMd,WAAW;QAC/BO,QAAQC;QACRO,MAAM;QACNC,KAAKN;IACP;IAEA,MAAM,EAAEH,MAAM,EAAE,GAAGO;IACnB,MAAMG,eAAeV,OAAOU,YAAY;IAExC,MAAMC,gBAAgB,IAAIC,IAAIR,QAAQS,GAAG;IACzC,MAAM,EAAEC,QAAQ,EAAEC,YAAY,EAAE,GAAGJ;IAEnC,MAAMK,YACJ,CAAChB,OAAOiB,OAAO,CAACC,OAAO,IACvBJ,aACEnB,eAAe;QACbwB,UAAUnB,OAAOoB,MAAM,CAACC,GAAG;QAC3BC,MAAMtB,OAAOoB,MAAM,CAACH,OAAO;IAC7B;IAEJ,MAAMM,WAAW3B,mBAAmB;QAClCI;QACAK;QACAC,SAASF,QAAQE,OAAO;IAC1B;IAEA,MAAMkB,OAAO,MAAMnC,SAAS;QAC1BW,QAAQA,OAAOwB,IAAI;QACnBC,SAAS;QACTF;IACF;IAEA,IAAIG,SAASX,aAAaY,GAAG,CAAC;IAE9B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGlB;IAEjC,MAAMmB,QAAQD,eACVvC,GAAGyC,KAAK,CAACF,cAAc;QACrBG,kBAAkB;QAClBC,YAAY;QACZC,OAAO;QACPC,mBAAmB;IACrB,KACA,CAAC;IAEL,MAAMC,sBAAuBN,MAAMO,cAAc,IAC/CtB,aAAaY,GAAG,CAAC,sBACjBZ,aAAaY,GAAG,CAAC;IAEnB,IAAIU,iBAAiBD;IAErB,IAAI1B,cAAc;QAChB,MAAM4B,UAAU5C,gBAAgB;YAC9B2C,gBAAgBA;YAChBX,QAAQA;YACRhB;QACF;QAEA2B,iBAAiBC,QAAQD,cAAc;QACvCX,SAASY,QAAQZ,MAAM;IACzB;IAEA,MAAMa,gBAAgD;QACpDd,SAAS,CAAC;QACVY,gBAAgBA;QAChBG,MAAM7B,cAAc6B,IAAI;QACxBC,MAAM9B,cAAc8B,IAAI;QACxBC,MAAM/B,cAAc+B,IAAI;QACxBlB;QACAE;QACAiB,QAAQhC,cAAcgC,MAAM;QAC5B7B,UAAUH,cAAcG,QAAQ;QAChCP;QACAqC,YAAY5B,YAAY,YAAY;QACpC6B,mBAAmBC;QACnBC,oBAAoB,CAAC;QACrBC,MAAMrC,cAAcqC,IAAI;QACxBC,UAAUtC,cAAcsC,QAAQ;QAChCnB;QACAoB,aAAahD,UAAU,CAAC;QACxB0B,QAAQjB,cAAciB,MAAM;QAC5Bb,cAAcJ,cAAcI,YAAY;QACxCoC,GAAG3B,KAAK2B,CAAC;QACTC,eAAeN;QACfO,MAAM;IACR;IAEA,MAAMC,MAAsBC,OAAOC,MAAM,CAACpD,SAASmC;IAEnDe,IAAIT,iBAAiB,GAAGrD,cAAc8D;IAEtC,MAAM,EAAEG,eAAe,EAAEJ,IAAI,EAAE,GAAG,MAAM9D,sBAAsB;QAC5DQ;QACAO,SAASgD,IAAIhD,OAAO;QACpBU;QACAT;IACF;IAEA+C,IAAID,IAAI,GAAGA;IAEX,IAAII,iBAAiB;QACnBH,IAAIG,eAAe,GAAGA;IACxB;IAEA,OAAOH;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/createPayloadRequest.ts"],"sourcesContent":["import { initI18n } from '@payloadcms/translations'\nimport * as qs from 'qs-esm'\n\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { TypedFallbackLocale } from '../index.js'\nimport type { CustomPayloadRequestProperties, PayloadRequest } from '../types/index.js'\n\nimport { executeAuthStrategies } from '../auth/executeAuthStrategies.js'\nimport { getDataLoader } from '../collections/dataloader.js'\nimport { getPayload } from '../index.js'\nimport { sanitizeLocales } from './addLocalesToRequest.js'\nimport { formatAdminURL } from './formatAdminURL.js'\nimport { getRequestLanguage } from './getRequestLanguage.js'\nimport { parseCookies } from './parseCookies.js'\n\ntype Args = {\n  canSetHeaders?: boolean\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  params?: {\n    collection: string\n  }\n  payloadInstanceCacheKey?: string\n  request: Request\n}\n\nexport const createPayloadRequest = async ({\n  canSetHeaders,\n  config: configPromise,\n  params,\n  payloadInstanceCacheKey,\n  request,\n}: Args): Promise<PayloadRequest> => {\n  const cookies = parseCookies(request.headers)\n  const payload = await getPayload({\n    config: configPromise,\n    cron: true,\n    key: payloadInstanceCacheKey,\n  })\n\n  const { config } = payload\n  const localization = config.localization\n\n  const urlProperties = new URL(request.url)\n  const { pathname, searchParams } = urlProperties\n\n  const isGraphQL =\n    !config.graphQL.disable &&\n    pathname ===\n      formatAdminURL({\n        apiRoute: config.routes.api,\n        path: config.routes.graphQL as `/${string}`,\n      })\n\n  const language = getRequestLanguage({\n    config,\n    cookies,\n    headers: request.headers,\n  })\n\n  const i18n = await initI18n({\n    config: config.i18n,\n    context: 'api',\n    language,\n  })\n\n  let locale = searchParams.get('locale')\n\n  const { search: queryToParse } = urlProperties\n\n  const query = queryToParse\n    ? qs.parse(queryToParse, {\n        allowEmptyArrays: true,\n        arrayLimit: 1000,\n        depth: 10,\n        ignoreQueryPrefix: true,\n      })\n    : {}\n\n  const fallbackFromRequest = (query.fallbackLocale ||\n    searchParams.get('fallback-locale') ||\n    searchParams.get('fallbackLocale')) as TypedFallbackLocale\n\n  let fallbackLocale = fallbackFromRequest\n\n  if (localization) {\n    const locales = sanitizeLocales({\n      fallbackLocale: fallbackLocale!,\n      locale: locale!,\n      localization,\n    })\n\n    fallbackLocale = locales.fallbackLocale!\n    locale = locales.locale!\n  }\n\n  const customRequest: CustomPayloadRequestProperties = {\n    context: {},\n    fallbackLocale: fallbackLocale!,\n    hash: urlProperties.hash,\n    host: urlProperties.host,\n    href: urlProperties.href,\n    i18n,\n    locale,\n    origin: urlProperties.origin,\n    pathname: urlProperties.pathname,\n    payload,\n    payloadAPI: isGraphQL ? 'GraphQL' : 'REST',\n    payloadDataLoader: undefined!,\n    payloadUploadSizes: {},\n    port: urlProperties.port,\n    protocol: urlProperties.protocol,\n    query,\n    routeParams: params || {},\n    search: urlProperties.search,\n    searchParams: urlProperties.searchParams,\n    t: i18n.t,\n    transactionID: undefined,\n    user: null,\n  }\n\n  const req: PayloadRequest = Object.assign(request, customRequest)\n\n  req.payloadDataLoader = getDataLoader(req)\n\n  const { responseHeaders, user } = await executeAuthStrategies({\n    canSetHeaders,\n    headers: req.headers,\n    isGraphQL,\n    payload,\n    req,\n  })\n\n  req.user = user\n\n  if (responseHeaders) {\n    req.responseHeaders = responseHeaders\n  }\n\n  return req\n}\n"],"names":["initI18n","qs","executeAuthStrategies","getDataLoader","getPayload","sanitizeLocales","formatAdminURL","getRequestLanguage","parseCookies","createPayloadRequest","canSetHeaders","config","configPromise","params","payloadInstanceCacheKey","request","cookies","headers","payload","cron","key","localization","urlProperties","URL","url","pathname","searchParams","isGraphQL","graphQL","disable","apiRoute","routes","api","path","language","i18n","context","locale","get","search","queryToParse","query","parse","allowEmptyArrays","arrayLimit","depth","ignoreQueryPrefix","fallbackFromRequest","fallbackLocale","locales","customRequest","hash","host","href","origin","payloadAPI","payloadDataLoader","undefined","payloadUploadSizes","port","protocol","routeParams","t","transactionID","user","req","Object","assign","responseHeaders"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,2BAA0B;AACnD,YAAYC,QAAQ,SAAQ;AAM5B,SAASC,qBAAqB,QAAQ,mCAAkC;AACxE,SAASC,aAAa,QAAQ,+BAA8B;AAC5D,SAASC,UAAU,QAAQ,cAAa;AACxC,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SAASC,YAAY,QAAQ,oBAAmB;AAYhD,OAAO,MAAMC,uBAAuB,OAAO,EACzCC,aAAa,EACbC,QAAQC,aAAa,EACrBC,MAAM,EACNC,uBAAuB,EACvBC,OAAO,EACF;IACL,MAAMC,UAAUR,aAAaO,QAAQE,OAAO;IAC5C,MAAMC,UAAU,MAAMd,WAAW;QAC/BO,QAAQC;QACRO,MAAM;QACNC,KAAKN;IACP;IAEA,MAAM,EAAEH,MAAM,EAAE,GAAGO;IACnB,MAAMG,eAAeV,OAAOU,YAAY;IAExC,MAAMC,gBAAgB,IAAIC,IAAIR,QAAQS,GAAG;IACzC,MAAM,EAAEC,QAAQ,EAAEC,YAAY,EAAE,GAAGJ;IAEnC,MAAMK,YACJ,CAAChB,OAAOiB,OAAO,CAACC,OAAO,IACvBJ,aACEnB,eAAe;QACbwB,UAAUnB,OAAOoB,MAAM,CAACC,GAAG;QAC3BC,MAAMtB,OAAOoB,MAAM,CAACH,OAAO;IAC7B;IAEJ,MAAMM,WAAW3B,mBAAmB;QAClCI;QACAK;QACAC,SAASF,QAAQE,OAAO;IAC1B;IAEA,MAAMkB,OAAO,MAAMnC,SAAS;QAC1BW,QAAQA,OAAOwB,IAAI;QACnBC,SAAS;QACTF;IACF;IAEA,IAAIG,SAASX,aAAaY,GAAG,CAAC;IAE9B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGlB;IAEjC,MAAMmB,QAAQD,eACVvC,GAAGyC,KAAK,CAACF,cAAc;QACrBG,kBAAkB;QAClBC,YAAY;QACZC,OAAO;QACPC,mBAAmB;IACrB,KACA,CAAC;IAEL,MAAMC,sBAAuBN,MAAMO,cAAc,IAC/CtB,aAAaY,GAAG,CAAC,sBACjBZ,aAAaY,GAAG,CAAC;IAEnB,IAAIU,iBAAiBD;IAErB,IAAI1B,cAAc;QAChB,MAAM4B,UAAU5C,gBAAgB;YAC9B2C,gBAAgBA;YAChBX,QAAQA;YACRhB;QACF;QAEA2B,iBAAiBC,QAAQD,cAAc;QACvCX,SAASY,QAAQZ,MAAM;IACzB;IAEA,MAAMa,gBAAgD;QACpDd,SAAS,CAAC;QACVY,gBAAgBA;QAChBG,MAAM7B,cAAc6B,IAAI;QACxBC,MAAM9B,cAAc8B,IAAI;QACxBC,MAAM/B,cAAc+B,IAAI;QACxBlB;QACAE;QACAiB,QAAQhC,cAAcgC,MAAM;QAC5B7B,UAAUH,cAAcG,QAAQ;QAChCP;QACAqC,YAAY5B,YAAY,YAAY;QACpC6B,mBAAmBC;QACnBC,oBAAoB,CAAC;QACrBC,MAAMrC,cAAcqC,IAAI;QACxBC,UAAUtC,cAAcsC,QAAQ;QAChCnB;QACAoB,aAAahD,UAAU,CAAC;QACxB0B,QAAQjB,cAAciB,MAAM;QAC5Bb,cAAcJ,cAAcI,YAAY;QACxCoC,GAAG3B,KAAK2B,CAAC;QACTC,eAAeN;QACfO,MAAM;IACR;IAEA,MAAMC,MAAsBC,OAAOC,MAAM,CAACpD,SAASmC;IAEnDe,IAAIT,iBAAiB,GAAGrD,cAAc8D;IAEtC,MAAM,EAAEG,eAAe,EAAEJ,IAAI,EAAE,GAAG,MAAM9D,sBAAsB;QAC5DQ;QACAO,SAASgD,IAAIhD,OAAO;QACpBU;QACAT;QACA+C;IACF;IAEAA,IAAID,IAAI,GAAGA;IAEX,IAAII,iBAAiB;QACnBH,IAAIG,eAAe,GAAGA;IACxB;IAEA,OAAOH;AACT,EAAC"}

package/dist/utilities/deepCopyObject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deepCopyObject.d.ts","sourceRoot":"","sources":["../../src/utilities/deepCopyObject.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AA2DlD,eAAO,MAAM,cAAc,GAAI,CAAC,KAAK,CAAC,KAAG,CAiCxC,CAAA;AAQD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,UAAQ,GAAG,CAAC,CAwB9F;AAED,wBAAgB,0CAA0C,CAAC,CAAC,SAAS,SAAS,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE;IACJ,YAAY,CAAC,EAAE,OAAO,CAAA;CAClB,GACL,CAAC,CAoCH;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,GAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAiB,GAAG,CAAC,CAqE/F"}
+{"version":3,"file":"deepCopyObject.d.ts","sourceRoot":"","sources":["../../src/utilities/deepCopyObject.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AA2DlD,eAAO,MAAM,cAAc,GAAI,CAAC,KAAK,CAAC,KAAG,CAiDxC,CAAA;AAQD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,UAAQ,GAAG,CAAC,CA6C9F;AAED,wBAAgB,0CAA0C,CAAC,CAAC,SAAS,SAAS,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE;IACJ,YAAY,CAAC,EAAE,OAAO,CAAA;CAClB,GACL,CAAC,CAyDH;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,GAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAiB,GAAG,CAAC,CAyE/F"}