payload 3.89.0-internal.95c9cba → 3.90.0

package/dist/utilities/fieldPath.spec.js

@@ -0,0 +1,155 @@
+import { describe, expect, it } from 'vitest';
+import { expandOwnDottedKey, hasUnsupportedFieldPathSegment, setOwnProperty } from './fieldPath.js';
+describe('hasUnsupportedFieldPathSegment', ()=>{
+    it('should identify constrained field path segments', ()=>{
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                '__proto__',
+                'value'
+            ]
+        })).toBe(true);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'value',
+                '__proto__',
+                'child'
+            ]
+        })).toBe(true);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'value',
+                '__proto__'
+            ]
+        })).toBe(true);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'constructor',
+                'value'
+            ]
+        })).toBe(false);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'value',
+                'constructor',
+                'child'
+            ]
+        })).toBe(false);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'value',
+                'constructor'
+            ]
+        })).toBe(false);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'prototype',
+                'value'
+            ]
+        })).toBe(false);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'value',
+                'prototype',
+                'child'
+            ]
+        })).toBe(false);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'value',
+                'prototype'
+            ]
+        })).toBe(false);
+        expect(hasUnsupportedFieldPathSegment({
+            segments: [
+                'profile',
+                'preferences',
+                'color'
+            ]
+        })).toBe(false);
+    });
+});
+describe('expandOwnDottedKey', ()=>{
+    it('should expand owned dotted keys', ()=>{
+        const target = {
+            'profile.name': 'Ada'
+        };
+        expect(expandOwnDottedKey({
+            key: 'profile.name',
+            target
+        })).toBe(true);
+        expect(target).toEqual({
+            profile: {
+                name: 'Ada'
+            }
+        });
+    });
+});
+describe('setOwnProperty', ()=>{
+    it('should use descriptor writes only for inherited properties', ()=>{
+        const assignments = [];
+        const definitions = [];
+        const ordinaryTarget = new Proxy({}, {
+            defineProperty: (target, key, descriptor)=>{
+                definitions.push(key);
+                return Reflect.defineProperty(target, key, descriptor);
+            },
+            set: (target, key, value)=>{
+                assignments.push(key);
+                return Reflect.set(target, key, value, target);
+            }
+        });
+        setOwnProperty({
+            key: 'title',
+            target: ordinaryTarget,
+            value: 'value'
+        });
+        expect(assignments).toEqual([
+            'title'
+        ]);
+        expect(definitions).toEqual([]);
+        expect(ordinaryTarget).toEqual({
+            title: 'value'
+        });
+        let inheritedSetterCalls = 0;
+        const inheritedPrototype = Object.create(null);
+        Object.defineProperty(inheritedPrototype, 'managedValue', {
+            configurable: true,
+            set: ()=>{
+                inheritedSetterCalls += 1;
+            }
+        });
+        const inheritedTarget = Object.create(inheritedPrototype);
+        setOwnProperty({
+            key: 'managedValue',
+            target: inheritedTarget,
+            value: 'protected'
+        });
+        setOwnProperty({
+            key: '__proto__',
+            target: inheritedTarget,
+            value: {
+                protected: true
+            }
+        });
+        setOwnProperty({
+            key: 'constructor',
+            target: inheritedTarget,
+            value: 'constructor-value'
+        });
+        expect(inheritedSetterCalls).toBe(0);
+        expect(Object.getOwnPropertyDescriptor(inheritedTarget, 'managedValue')).toMatchObject({
+            configurable: true,
+            enumerable: true,
+            value: 'protected',
+            writable: true
+        });
+        expect(Object.hasOwn(inheritedTarget, '__proto__')).toBe(true);
+        expect(Reflect.get(inheritedTarget, '__proto__')).toEqual({
+            protected: true
+        });
+        expect(Object.hasOwn(inheritedTarget, 'constructor')).toBe(true);
+        expect(Reflect.get(inheritedTarget, 'constructor')).toBe('constructor-value');
+    });
+});
+
+//# sourceMappingURL=fieldPath.spec.js.map

package/dist/utilities/fieldPath.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/fieldPath.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { expandOwnDottedKey, hasUnsupportedFieldPathSegment, setOwnProperty } from './fieldPath.js'\n\ndescribe('hasUnsupportedFieldPathSegment', () => {\n  it('should identify constrained field path segments', () => {\n    expect(hasUnsupportedFieldPathSegment({ segments: ['__proto__', 'value'] })).toBe(true)\n    expect(hasUnsupportedFieldPathSegment({ segments: ['value', '__proto__', 'child'] })).toBe(true)\n    expect(hasUnsupportedFieldPathSegment({ segments: ['value', '__proto__'] })).toBe(true)\n    expect(hasUnsupportedFieldPathSegment({ segments: ['constructor', 'value'] })).toBe(false)\n    expect(hasUnsupportedFieldPathSegment({ segments: ['value', 'constructor', 'child'] })).toBe(\n      false,\n    )\n    expect(hasUnsupportedFieldPathSegment({ segments: ['value', 'constructor'] })).toBe(false)\n    expect(hasUnsupportedFieldPathSegment({ segments: ['prototype', 'value'] })).toBe(false)\n    expect(hasUnsupportedFieldPathSegment({ segments: ['value', 'prototype', 'child'] })).toBe(\n      false,\n    )\n    expect(hasUnsupportedFieldPathSegment({ segments: ['value', 'prototype'] })).toBe(false)\n    expect(hasUnsupportedFieldPathSegment({ segments: ['profile', 'preferences', 'color'] })).toBe(\n      false,\n    )\n  })\n})\n\ndescribe('expandOwnDottedKey', () => {\n  it('should expand owned dotted keys', () => {\n    const target = { 'profile.name': 'Ada' }\n\n    expect(expandOwnDottedKey({ key: 'profile.name', target })).toBe(true)\n    expect(target).toEqual({ profile: { name: 'Ada' } })\n  })\n})\n\ndescribe('setOwnProperty', () => {\n  it('should use descriptor writes only for inherited properties', () => {\n    const assignments: PropertyKey[] = []\n    const definitions: PropertyKey[] = []\n    const ordinaryTarget = new Proxy<Record<string, unknown>>(\n      {},\n      {\n        defineProperty: (target, key, descriptor) => {\n          definitions.push(key)\n          return Reflect.defineProperty(target, key, descriptor)\n        },\n        set: (target, key, value) => {\n          assignments.push(key)\n          return Reflect.set(target, key, value, target)\n        },\n      },\n    )\n\n    setOwnProperty({ key: 'title', target: ordinaryTarget, value: 'value' })\n\n    expect(assignments).toEqual(['title'])\n    expect(definitions).toEqual([])\n    expect(ordinaryTarget).toEqual({ title: 'value' })\n\n    let inheritedSetterCalls = 0\n    const inheritedPrototype = Object.create(null) as Record<string, unknown>\n    Object.defineProperty(inheritedPrototype, 'managedValue', {\n      configurable: true,\n      set: () => {\n        inheritedSetterCalls += 1\n      },\n    })\n    const inheritedTarget = Object.create(inheritedPrototype) as Record<string, unknown>\n\n    setOwnProperty({ key: 'managedValue', target: inheritedTarget, value: 'protected' })\n    setOwnProperty({ key: '__proto__', target: inheritedTarget, value: { protected: true } })\n    setOwnProperty({ key: 'constructor', target: inheritedTarget, value: 'constructor-value' })\n\n    expect(inheritedSetterCalls).toBe(0)\n    expect(Object.getOwnPropertyDescriptor(inheritedTarget, 'managedValue')).toMatchObject({\n      configurable: true,\n      enumerable: true,\n      value: 'protected',\n      writable: true,\n    })\n    expect(Object.hasOwn(inheritedTarget, '__proto__')).toBe(true)\n    expect(Reflect.get(inheritedTarget, '__proto__')).toEqual({ protected: true })\n    expect(Object.hasOwn(inheritedTarget, 'constructor')).toBe(true)\n    expect(Reflect.get(inheritedTarget, 'constructor')).toBe('constructor-value')\n  })\n})\n"],"names":["describe","expect","it","expandOwnDottedKey","hasUnsupportedFieldPathSegment","setOwnProperty","segments","toBe","target","key","toEqual","profile","name","assignments","definitions","ordinaryTarget","Proxy","defineProperty","descriptor","push","Reflect","set","value","title","inheritedSetterCalls","inheritedPrototype","Object","create","configurable","inheritedTarget","protected","getOwnPropertyDescriptor","toMatchObject","enumerable","writable","hasOwn","get"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,kBAAkB,EAAEC,8BAA8B,EAAEC,cAAc,QAAQ,iBAAgB;AAEnGL,SAAS,kCAAkC;IACzCE,GAAG,mDAAmD;QACpDD,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAa;aAAQ;QAAC,IAAIC,IAAI,CAAC;QAClFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAS;gBAAa;aAAQ;QAAC,IAAIC,IAAI,CAAC;QAC3FN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAS;aAAY;QAAC,IAAIC,IAAI,CAAC;QAClFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAe;aAAQ;QAAC,IAAIC,IAAI,CAAC;QACpFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAS;gBAAe;aAAQ;QAAC,IAAIC,IAAI,CAC1F;QAEFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAS;aAAc;QAAC,IAAIC,IAAI,CAAC;QACpFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAa;aAAQ;QAAC,IAAIC,IAAI,CAAC;QAClFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAS;gBAAa;aAAQ;QAAC,IAAIC,IAAI,CACxF;QAEFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAS;aAAY;QAAC,IAAIC,IAAI,CAAC;QAClFN,OAAOG,+BAA+B;YAAEE,UAAU;gBAAC;gBAAW;gBAAe;aAAQ;QAAC,IAAIC,IAAI,CAC5F;IAEJ;AACF;AAEAP,SAAS,sBAAsB;IAC7BE,GAAG,mCAAmC;QACpC,MAAMM,SAAS;YAAE,gBAAgB;QAAM;QAEvCP,OAAOE,mBAAmB;YAAEM,KAAK;YAAgBD;QAAO,IAAID,IAAI,CAAC;QACjEN,OAAOO,QAAQE,OAAO,CAAC;YAAEC,SAAS;gBAAEC,MAAM;YAAM;QAAE;IACpD;AACF;AAEAZ,SAAS,kBAAkB;IACzBE,GAAG,8DAA8D;QAC/D,MAAMW,cAA6B,EAAE;QACrC,MAAMC,cAA6B,EAAE;QACrC,MAAMC,iBAAiB,IAAIC,MACzB,CAAC,GACD;YACEC,gBAAgB,CAACT,QAAQC,KAAKS;gBAC5BJ,YAAYK,IAAI,CAACV;gBACjB,OAAOW,QAAQH,cAAc,CAACT,QAAQC,KAAKS;YAC7C;YACAG,KAAK,CAACb,QAAQC,KAAKa;gBACjBT,YAAYM,IAAI,CAACV;gBACjB,OAAOW,QAAQC,GAAG,CAACb,QAAQC,KAAKa,OAAOd;YACzC;QACF;QAGFH,eAAe;YAAEI,KAAK;YAASD,QAAQO;YAAgBO,OAAO;QAAQ;QAEtErB,OAAOY,aAAaH,OAAO,CAAC;YAAC;SAAQ;QACrCT,OAAOa,aAAaJ,OAAO,CAAC,EAAE;QAC9BT,OAAOc,gBAAgBL,OAAO,CAAC;YAAEa,OAAO;QAAQ;QAEhD,IAAIC,uBAAuB;QAC3B,MAAMC,qBAAqBC,OAAOC,MAAM,CAAC;QACzCD,OAAOT,cAAc,CAACQ,oBAAoB,gBAAgB;YACxDG,cAAc;YACdP,KAAK;gBACHG,wBAAwB;YAC1B;QACF;QACA,MAAMK,kBAAkBH,OAAOC,MAAM,CAACF;QAEtCpB,eAAe;YAAEI,KAAK;YAAgBD,QAAQqB;YAAiBP,OAAO;QAAY;QAClFjB,eAAe;YAAEI,KAAK;YAAaD,QAAQqB;YAAiBP,OAAO;gBAAEQ,WAAW;YAAK;QAAE;QACvFzB,eAAe;YAAEI,KAAK;YAAeD,QAAQqB;YAAiBP,OAAO;QAAoB;QAEzFrB,OAAOuB,sBAAsBjB,IAAI,CAAC;QAClCN,OAAOyB,OAAOK,wBAAwB,CAACF,iBAAiB,iBAAiBG,aAAa,CAAC;YACrFJ,cAAc;YACdK,YAAY;YACZX,OAAO;YACPY,UAAU;QACZ;QACAjC,OAAOyB,OAAOS,MAAM,CAACN,iBAAiB,cAActB,IAAI,CAAC;QACzDN,OAAOmB,QAAQgB,GAAG,CAACP,iBAAiB,cAAcnB,OAAO,CAAC;YAAEoB,WAAW;QAAK;QAC5E7B,OAAOyB,OAAOS,MAAM,CAACN,iBAAiB,gBAAgBtB,IAAI,CAAC;QAC3DN,OAAOmB,QAAQgB,GAAG,CAACP,iBAAiB,gBAAgBtB,IAAI,CAAC;IAC3D;AACF"}

package/dist/utilities/getEntityPermissions/getEntityPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getEntityPermissions.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EAEpB,gBAAgB,EAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAO5F,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAC7C,SAAS,EACT,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAC7C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAE/C,KAAK,UAAU,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI,WAAW,SAAS,QAAQ,GACvF,gBAAgB,GAChB,oBAAoB,CAAA;AAExB,KAAK,IAAI,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI;IACvD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,WAAW,SAAS,YAAY,GAAG,yBAAyB,GAAG,qBAAqB,CAAA;IAC5F,UAAU,EAAE,WAAW,CAAA;IACvB;;OAEG;IACH,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,KAAK,CAAA;IAChB,EAAE,CAAC,EAAE,KAAK,CAAA;CACX,GACD;IACE,SAAS,EAAE,IAAI,CAAA;IACf,EAAE,EAAE,WAAW,SAAS,YAAY,GAAG,qBAAqB,GAAG,SAAS,CAAA;CACzE,CACJ,CAAA;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,EACpF,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GACtB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAwJlC"}
+{"version":3,"file":"getEntityPermissions.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EAEpB,gBAAgB,EAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAO5F,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAC7C,SAAS,EACT,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAC7C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAE/C,KAAK,UAAU,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI,WAAW,SAAS,QAAQ,GACvF,gBAAgB,GAChB,oBAAoB,CAAA;AAExB,KAAK,IAAI,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI;IACvD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,WAAW,SAAS,YAAY,GAAG,yBAAyB,GAAG,qBAAqB,CAAA;IAC5F,UAAU,EAAE,WAAW,CAAA;IACvB;;OAEG;IACH,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,KAAK,CAAA;IAChB,EAAE,CAAC,EAAE,KAAK,CAAA;CACX,GACD;IACE,SAAS,EAAE,IAAI,CAAA;IACf,EAAE,EAAE,WAAW,SAAS,YAAY,GAAG,qBAAqB,GAAG,SAAS,CAAA;CACzE,CACJ,CAAA;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,EACpF,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GACtB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAiKlC"}

package/dist/utilities/getEntityPermissions/getEntityPermissions.js

@@ -67,6 +67,7 @@ const topLevelGlobalPermissions = [
         }
     })() : undefined;
     const isLoggedIn = !!user;
+    const collectionConfig = entityType === 'collection' ? entity : undefined;
     const fieldsPermissions = {};
     const entityPermissions = {
         fields: fieldsPermissions
@@ -83,6 +84,7 @@ const topLevelGlobalPermissions = [
                     operation,
                     result: Promise.resolve(accessFunction({
                         id,
+                        collectionConfig,
                         data,
                         req
                     }))

package/dist/utilities/getEntityPermissions/getEntityPermissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"sourcesContent":["import { isDeepStrictEqual } from 'util'\n\nimport type {\n  BlockPermissions,\n  CollectionPermission,\n  FieldsPermissions,\n  GlobalPermission,\n  Permission,\n} from '../../auth/types.js'\nimport type { SanitizedCollectionConfig, TypeWithID } from '../../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { BlockSlug, DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest, Where } from '../../types/index.js'\n\nimport { entityDocExists } from './entityDocExists.js'\nimport { populateFieldPermissions } from './populateFieldPermissions.js'\n\ntype WhereQueryCache = { result: Promise<boolean>; where: Where }[]\n\nexport type BlockReferencesPermissions = Record<\n  BlockSlug,\n  BlockPermissions | Promise<BlockPermissions>\n>\n\nexport type EntityDoc = JsonObject | TypeWithID\n\ntype ReturnType<TEntityType extends 'collection' | 'global'> = TEntityType extends 'global'\n  ? GlobalPermission\n  : CollectionPermission\n\ntype Args<TEntityType extends 'collection' | 'global'> = {\n  blockReferencesPermissions: BlockReferencesPermissions\n  /**\n   * If the document data is passed, it will be used to check access instead of fetching the document from the database.\n   */\n  data?: JsonObject\n  entity: TEntityType extends 'collection' ? SanitizedCollectionConfig : SanitizedGlobalConfig\n  entityType: TEntityType\n  /**\n   * Operations to check access for\n   */\n  operations: AllOperations[]\n  req: PayloadRequest\n} & (\n  | {\n      fetchData: false\n      id?: never\n    }\n  | {\n      fetchData: true\n      id: TEntityType extends 'collection' ? DefaultDocumentIDType : undefined\n    }\n)\n\nconst topLevelCollectionPermissions = [\n  'create',\n  'delete',\n  'read',\n  'readVersions',\n  'update',\n  'unlock',\n]\nconst topLevelGlobalPermissions = ['read', 'readVersions', 'update']\n\n/**\n * Build up permissions object for an entity (collection or global).\n * This is not run during any update and reflects the current state of the entity data => doc and data is the same.\n *\n * When `fetchData` is false:\n * - returned `Where` are not run and evaluated as \"does not have permission\".\n * - If req.data is passed: `data` and `doc` is passed to access functions.\n * - If req.data is not passed: `data` and `doc` is not passed to access functions.\n *\n * When `fetchData` is true:\n * - `Where` are run and evaluated as \"has permission\" or \"does not have permission\".\n * - `data` and `doc` are always passed to access functions.\n * - Error is thrown if `entityType` is 'collection' and `id` is not passed.\n *\n * In both cases:\n * We cannot include siblingData or blockData here, as we do not have siblingData available once we reach block or array\n * rows, as we're calculating schema permissions, which do not include individual rows.\n * For consistency, it's thus better to never include the siblingData and blockData\n *\n * @internal\n */\nexport async function getEntityPermissions<TEntityType extends 'collection' | 'global'>(\n  args: Args<TEntityType>,\n): Promise<ReturnType<TEntityType>> {\n  const {\n    id,\n    blockReferencesPermissions,\n    data: _data,\n    entity,\n    entityType,\n    fetchData,\n    operations,\n    req,\n  } = args\n  const { locale: _locale, user } = req\n\n  const locale = _locale ? _locale : undefined\n\n  if (fetchData && entityType === 'collection' && !id) {\n    throw new Error('ID is required when fetching data for a collection')\n  }\n\n  const hasData = _data && Object.keys(_data).length > 0\n  const data: JsonObject | undefined = hasData\n    ? _data\n    : fetchData\n      ? await (async () => {\n          if (entityType === 'global') {\n            return req.payload.findGlobal({\n              slug: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n            })\n          }\n\n          if (entityType === 'collection') {\n            return req.payload.findByID({\n              id: id!,\n              collection: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n              trash: true,\n            })\n          }\n        })()\n      : undefined\n\n  const isLoggedIn = !!user\n\n  const fieldsPermissions: FieldsPermissions = {}\n\n  const entityPermissions: ReturnType<TEntityType> = {\n    fields: fieldsPermissions,\n  } as ReturnType<TEntityType>\n\n  const promises: Promise<void>[] = []\n\n  // Phase 1: Resolve all access functions to get where queries\n  const accessResults: {\n    operation: keyof typeof entity.access\n    result: Promise<boolean | Where>\n  }[] = []\n\n  for (const _operation of operations) {\n    const operation = _operation as keyof typeof entity.access\n    const accessFunction = entity.access[operation]\n\n    if (\n      (entityType === 'collection' && topLevelCollectionPermissions.includes(operation)) ||\n      (entityType === 'global' && topLevelGlobalPermissions.includes(operation))\n    ) {\n      if (typeof accessFunction === 'function') {\n        accessResults.push({\n          operation,\n          result: Promise.resolve(accessFunction({ id, data, req })) as Promise<boolean | Where>,\n        })\n      } else {\n        entityPermissions[operation] = {\n          permission: isLoggedIn,\n        }\n      }\n    }\n  }\n\n  // Await all access functions in parallel\n  const resolvedAccessResults = await Promise.all(\n    accessResults.map(async (item) => ({\n      operation: item.operation,\n      result: await item.result,\n    })),\n  )\n\n  // Phase 2: Process where queries with cache and resolve in parallel\n  const whereQueryCache: WhereQueryCache = []\n  const wherePromises: Promise<void>[] = []\n\n  for (const { operation, result: accessResult } of resolvedAccessResults) {\n    if (typeof accessResult === 'object') {\n      processWhereQuery({\n        id,\n        slug: entity.slug,\n        accessResult,\n        entityPermissions,\n        entityType,\n        fetchData,\n        locale,\n        operation,\n        req,\n        wherePromises,\n        whereQueryCache,\n      })\n    } else if (entityPermissions[operation]?.permission !== false) {\n      entityPermissions[operation] = { permission: !!accessResult }\n    }\n  }\n\n  // Await all where query DB calls in parallel\n  await Promise.all(wherePromises)\n\n  populateFieldPermissions({\n    blockReferencesPermissions,\n    data,\n    fields: entity.fields,\n    operations,\n    parentPermissionsObject: entityPermissions,\n    permissionsObject: fieldsPermissions,\n    promises,\n    req,\n  })\n\n  /**\n   * Await all promises in parallel.\n   * A promise can add more promises to the promises array (group of fields calls populateFieldPermissions again in their own promise), which will not be\n   * awaited in the first run.\n   * This is why we need to loop again to process the new promises, until there are no more promises left.\n   */\n  let iterations = 0\n  while (promises.length > 0) {\n    const currentPromises = promises.splice(0, promises.length)\n\n    await Promise.all(currentPromises)\n\n    iterations++\n    if (iterations >= 100) {\n      throw new Error('Infinite getEntityPermissions promise loop detected.')\n    }\n  }\n\n  return entityPermissions\n}\n\nconst processWhereQuery = ({\n  id,\n  slug,\n  accessResult,\n  entityPermissions,\n  entityType,\n  fetchData,\n  locale,\n  operation,\n  req,\n  wherePromises,\n  whereQueryCache,\n}: {\n  accessResult: Where\n  entityPermissions: CollectionPermission | GlobalPermission\n  entityType: 'collection' | 'global'\n  fetchData: boolean\n  id?: DefaultDocumentIDType\n  locale?: string\n  operation: Extract<keyof (CollectionPermission | GlobalPermission), AllOperations>\n  req: PayloadRequest\n  slug: string\n  wherePromises: Promise<void>[]\n  whereQueryCache: WhereQueryCache\n}): void => {\n  if (fetchData) {\n    // Check cache for identical where query using deep comparison\n    let cached = whereQueryCache.find((entry) => isDeepStrictEqual(entry.where, accessResult))\n\n    if (!cached) {\n      // Cache miss - start DB query (don't await)\n      cached = {\n        result: entityDocExists({\n          id,\n          slug,\n          entityType,\n          locale,\n          operation,\n          req,\n          where: accessResult,\n        }),\n        where: accessResult,\n      }\n      whereQueryCache.push(cached)\n    }\n\n    // Defer resolution to Promise.all (cache hits reuse same promise)\n    wherePromises.push(\n      cached.result.then((hasPermission) => {\n        entityPermissions[operation] = {\n          permission: hasPermission,\n          where: accessResult,\n        } as Permission\n      }),\n    )\n  } else {\n    // TODO: 4.0: Investigate defaulting to `false` here, if where query is returned but ignored as we don't\n    // have the document data available. This seems more secure.\n    // Alternatively, we could set permission to a third state, like 'unknown'.\n    // Even after calling sanitizePermissions, the permissions will still be true if the where query is returned but ignored as we don't have the document data available.\n    entityPermissions[operation] = { permission: true, where: accessResult } as Permission\n  }\n}\n"],"names":["isDeepStrictEqual","entityDocExists","populateFieldPermissions","topLevelCollectionPermissions","topLevelGlobalPermissions","getEntityPermissions","args","id","blockReferencesPermissions","data","_data","entity","entityType","fetchData","operations","req","locale","_locale","user","undefined","Error","hasData","Object","keys","length","payload","findGlobal","slug","depth","fallbackLocale","overrideAccess","findByID","collection","trash","isLoggedIn","fieldsPermissions","entityPermissions","fields","promises","accessResults","_operation","operation","accessFunction","access","includes","push","result","Promise","resolve","permission","resolvedAccessResults","all","map","item","whereQueryCache","wherePromises","accessResult","processWhereQuery","parentPermissionsObject","permissionsObject","iterations","currentPromises","splice","cached","find","entry","where","then","hasPermission"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,OAAM;AAcxC,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,wBAAwB,QAAQ,gCAA+B;AAuCxE,MAAMC,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;CACD;AACD,MAAMC,4BAA4B;IAAC;IAAQ;IAAgB;CAAS;AAEpE;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,eAAeC,qBACpBC,IAAuB;IAEvB,MAAM,EACJC,EAAE,EACFC,0BAA0B,EAC1BC,MAAMC,KAAK,EACXC,MAAM,EACNC,UAAU,EACVC,SAAS,EACTC,UAAU,EACVC,GAAG,EACJ,GAAGT;IACJ,MAAM,EAAEU,QAAQC,OAAO,EAAEC,IAAI,EAAE,GAAGH;IAElC,MAAMC,SAASC,UAAUA,UAAUE;IAEnC,IAAIN,aAAaD,eAAe,gBAAgB,CAACL,IAAI;QACnD,MAAM,IAAIa,MAAM;IAClB;IAEA,MAAMC,UAAUX,SAASY,OAAOC,IAAI,CAACb,OAAOc,MAAM,GAAG;IACrD,MAAMf,OAA+BY,UACjCX,QACAG,YACE,MAAM,AAAC,CAAA;QACL,IAAID,eAAe,UAAU;YAC3B,OAAOG,IAAIU,OAAO,CAACC,UAAU,CAAC;gBAC5BC,MAAMhB,OAAOgB,IAAI;gBACjBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;YACF;QACF;QAEA,IAAIH,eAAe,cAAc;YAC/B,OAAOG,IAAIU,OAAO,CAACM,QAAQ,CAAC;gBAC1BxB,IAAIA;gBACJyB,YAAYrB,OAAOgB,IAAI;gBACvBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;gBACAkB,OAAO;YACT;QACF;IACF,CAAA,MACAd;IAEN,MAAMe,aAAa,CAAC,CAAChB;IAErB,MAAMiB,oBAAuC,CAAC;IAE9C,MAAMC,oBAA6C;QACjDC,QAAQF;IACV;IAEA,MAAMG,WAA4B,EAAE;IAEpC,6DAA6D;IAC7D,MAAMC,gBAGA,EAAE;IAER,KAAK,MAAMC,cAAc1B,WAAY;QACnC,MAAM2B,YAAYD;QAClB,MAAME,iBAAiB/B,OAAOgC,MAAM,CAACF,UAAU;QAE/C,IACE,AAAC7B,eAAe,gBAAgBT,8BAA8ByC,QAAQ,CAACH,cACtE7B,eAAe,YAAYR,0BAA0BwC,QAAQ,CAACH,YAC/D;YACA,IAAI,OAAOC,mBAAmB,YAAY;gBACxCH,cAAcM,IAAI,CAAC;oBACjBJ;oBACAK,QAAQC,QAAQC,OAAO,CAACN,eAAe;wBAAEnC;wBAAIE;wBAAMM;oBAAI;gBACzD;YACF,OAAO;gBACLqB,iBAAiB,CAACK,UAAU,GAAG;oBAC7BQ,YAAYf;gBACd;YACF;QACF;IACF;IAEA,yCAAyC;IACzC,MAAMgB,wBAAwB,MAAMH,QAAQI,GAAG,CAC7CZ,cAAca,GAAG,CAAC,OAAOC,OAAU,CAAA;YACjCZ,WAAWY,KAAKZ,SAAS;YACzBK,QAAQ,MAAMO,KAAKP,MAAM;QAC3B,CAAA;IAGF,oEAAoE;IACpE,MAAMQ,kBAAmC,EAAE;IAC3C,MAAMC,gBAAiC,EAAE;IAEzC,KAAK,MAAM,EAAEd,SAAS,EAAEK,QAAQU,YAAY,EAAE,IAAIN,sBAAuB;QACvE,IAAI,OAAOM,iBAAiB,UAAU;YACpCC,kBAAkB;gBAChBlD;gBACAoB,MAAMhB,OAAOgB,IAAI;gBACjB6B;gBACApB;gBACAxB;gBACAC;gBACAG;gBACAyB;gBACA1B;gBACAwC;gBACAD;YACF;QACF,OAAO,IAAIlB,iBAAiB,CAACK,UAAU,EAAEQ,eAAe,OAAO;YAC7Db,iBAAiB,CAACK,UAAU,GAAG;gBAAEQ,YAAY,CAAC,CAACO;YAAa;QAC9D;IACF;IAEA,6CAA6C;IAC7C,MAAMT,QAAQI,GAAG,CAACI;IAElBrD,yBAAyB;QACvBM;QACAC;QACA4B,QAAQ1B,OAAO0B,MAAM;QACrBvB;QACA4C,yBAAyBtB;QACzBuB,mBAAmBxB;QACnBG;QACAvB;IACF;IAEA;;;;;GAKC,GACD,IAAI6C,aAAa;IACjB,MAAOtB,SAASd,MAAM,GAAG,EAAG;QAC1B,MAAMqC,kBAAkBvB,SAASwB,MAAM,CAAC,GAAGxB,SAASd,MAAM;QAE1D,MAAMuB,QAAQI,GAAG,CAACU;QAElBD;QACA,IAAIA,cAAc,KAAK;YACrB,MAAM,IAAIxC,MAAM;QAClB;IACF;IAEA,OAAOgB;AACT;AAEA,MAAMqB,oBAAoB,CAAC,EACzBlD,EAAE,EACFoB,IAAI,EACJ6B,YAAY,EACZpB,iBAAiB,EACjBxB,UAAU,EACVC,SAAS,EACTG,MAAM,EACNyB,SAAS,EACT1B,GAAG,EACHwC,aAAa,EACbD,eAAe,EAahB;IACC,IAAIzC,WAAW;QACb,8DAA8D;QAC9D,IAAIkD,SAAST,gBAAgBU,IAAI,CAAC,CAACC,QAAUjE,kBAAkBiE,MAAMC,KAAK,EAAEV;QAE5E,IAAI,CAACO,QAAQ;YACX,4CAA4C;YAC5CA,SAAS;gBACPjB,QAAQ7C,gBAAgB;oBACtBM;oBACAoB;oBACAf;oBACAI;oBACAyB;oBACA1B;oBACAmD,OAAOV;gBACT;gBACAU,OAAOV;YACT;YACAF,gBAAgBT,IAAI,CAACkB;QACvB;QAEA,kEAAkE;QAClER,cAAcV,IAAI,CAChBkB,OAAOjB,MAAM,CAACqB,IAAI,CAAC,CAACC;YAClBhC,iBAAiB,CAACK,UAAU,GAAG;gBAC7BQ,YAAYmB;gBACZF,OAAOV;YACT;QACF;IAEJ,OAAO;QACL,wGAAwG;QACxG,4DAA4D;QAC5D,2EAA2E;QAC3E,sKAAsK;QACtKpB,iBAAiB,CAACK,UAAU,GAAG;YAAEQ,YAAY;YAAMiB,OAAOV;QAAa;IACzE;AACF"}
+{"version":3,"sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"sourcesContent":["import { isDeepStrictEqual } from 'util'\n\nimport type {\n  BlockPermissions,\n  CollectionPermission,\n  FieldsPermissions,\n  GlobalPermission,\n  Permission,\n} from '../../auth/types.js'\nimport type { SanitizedCollectionConfig, TypeWithID } from '../../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { BlockSlug, DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest, Where } from '../../types/index.js'\n\nimport { entityDocExists } from './entityDocExists.js'\nimport { populateFieldPermissions } from './populateFieldPermissions.js'\n\ntype WhereQueryCache = { result: Promise<boolean>; where: Where }[]\n\nexport type BlockReferencesPermissions = Record<\n  BlockSlug,\n  BlockPermissions | Promise<BlockPermissions>\n>\n\nexport type EntityDoc = JsonObject | TypeWithID\n\ntype ReturnType<TEntityType extends 'collection' | 'global'> = TEntityType extends 'global'\n  ? GlobalPermission\n  : CollectionPermission\n\ntype Args<TEntityType extends 'collection' | 'global'> = {\n  blockReferencesPermissions: BlockReferencesPermissions\n  /**\n   * If the document data is passed, it will be used to check access instead of fetching the document from the database.\n   */\n  data?: JsonObject\n  entity: TEntityType extends 'collection' ? SanitizedCollectionConfig : SanitizedGlobalConfig\n  entityType: TEntityType\n  /**\n   * Operations to check access for\n   */\n  operations: AllOperations[]\n  req: PayloadRequest\n} & (\n  | {\n      fetchData: false\n      id?: never\n    }\n  | {\n      fetchData: true\n      id: TEntityType extends 'collection' ? DefaultDocumentIDType : undefined\n    }\n)\n\nconst topLevelCollectionPermissions = [\n  'create',\n  'delete',\n  'read',\n  'readVersions',\n  'update',\n  'unlock',\n]\nconst topLevelGlobalPermissions = ['read', 'readVersions', 'update']\n\n/**\n * Build up permissions object for an entity (collection or global).\n * This is not run during any update and reflects the current state of the entity data => doc and data is the same.\n *\n * When `fetchData` is false:\n * - returned `Where` are not run and evaluated as \"does not have permission\".\n * - If req.data is passed: `data` and `doc` is passed to access functions.\n * - If req.data is not passed: `data` and `doc` is not passed to access functions.\n *\n * When `fetchData` is true:\n * - `Where` are run and evaluated as \"has permission\" or \"does not have permission\".\n * - `data` and `doc` are always passed to access functions.\n * - Error is thrown if `entityType` is 'collection' and `id` is not passed.\n *\n * In both cases:\n * We cannot include siblingData or blockData here, as we do not have siblingData available once we reach block or array\n * rows, as we're calculating schema permissions, which do not include individual rows.\n * For consistency, it's thus better to never include the siblingData and blockData\n *\n * @internal\n */\nexport async function getEntityPermissions<TEntityType extends 'collection' | 'global'>(\n  args: Args<TEntityType>,\n): Promise<ReturnType<TEntityType>> {\n  const {\n    id,\n    blockReferencesPermissions,\n    data: _data,\n    entity,\n    entityType,\n    fetchData,\n    operations,\n    req,\n  } = args\n  const { locale: _locale, user } = req\n\n  const locale = _locale ? _locale : undefined\n\n  if (fetchData && entityType === 'collection' && !id) {\n    throw new Error('ID is required when fetching data for a collection')\n  }\n\n  const hasData = _data && Object.keys(_data).length > 0\n  const data: JsonObject | undefined = hasData\n    ? _data\n    : fetchData\n      ? await (async () => {\n          if (entityType === 'global') {\n            return req.payload.findGlobal({\n              slug: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n            })\n          }\n\n          if (entityType === 'collection') {\n            return req.payload.findByID({\n              id: id!,\n              collection: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n              trash: true,\n            })\n          }\n        })()\n      : undefined\n\n  const isLoggedIn = !!user\n  const collectionConfig =\n    entityType === 'collection' ? (entity as SanitizedCollectionConfig) : undefined\n\n  const fieldsPermissions: FieldsPermissions = {}\n\n  const entityPermissions: ReturnType<TEntityType> = {\n    fields: fieldsPermissions,\n  } as ReturnType<TEntityType>\n\n  const promises: Promise<void>[] = []\n\n  // Phase 1: Resolve all access functions to get where queries\n  const accessResults: {\n    operation: keyof typeof entity.access\n    result: Promise<boolean | Where>\n  }[] = []\n\n  for (const _operation of operations) {\n    const operation = _operation as keyof typeof entity.access\n    const accessFunction = entity.access[operation]\n\n    if (\n      (entityType === 'collection' && topLevelCollectionPermissions.includes(operation)) ||\n      (entityType === 'global' && topLevelGlobalPermissions.includes(operation))\n    ) {\n      if (typeof accessFunction === 'function') {\n        accessResults.push({\n          operation,\n          result: Promise.resolve(\n            accessFunction({\n              id,\n              collectionConfig,\n              data,\n              req,\n            }),\n          ) as Promise<boolean | Where>,\n        })\n      } else {\n        entityPermissions[operation] = {\n          permission: isLoggedIn,\n        }\n      }\n    }\n  }\n\n  // Await all access functions in parallel\n  const resolvedAccessResults = await Promise.all(\n    accessResults.map(async (item) => ({\n      operation: item.operation,\n      result: await item.result,\n    })),\n  )\n\n  // Phase 2: Process where queries with cache and resolve in parallel\n  const whereQueryCache: WhereQueryCache = []\n  const wherePromises: Promise<void>[] = []\n\n  for (const { operation, result: accessResult } of resolvedAccessResults) {\n    if (typeof accessResult === 'object') {\n      processWhereQuery({\n        id,\n        slug: entity.slug,\n        accessResult,\n        entityPermissions,\n        entityType,\n        fetchData,\n        locale,\n        operation,\n        req,\n        wherePromises,\n        whereQueryCache,\n      })\n    } else if (entityPermissions[operation]?.permission !== false) {\n      entityPermissions[operation] = { permission: !!accessResult }\n    }\n  }\n\n  // Await all where query DB calls in parallel\n  await Promise.all(wherePromises)\n\n  populateFieldPermissions({\n    blockReferencesPermissions,\n    data,\n    fields: entity.fields,\n    operations,\n    parentPermissionsObject: entityPermissions,\n    permissionsObject: fieldsPermissions,\n    promises,\n    req,\n  })\n\n  /**\n   * Await all promises in parallel.\n   * A promise can add more promises to the promises array (group of fields calls populateFieldPermissions again in their own promise), which will not be\n   * awaited in the first run.\n   * This is why we need to loop again to process the new promises, until there are no more promises left.\n   */\n  let iterations = 0\n  while (promises.length > 0) {\n    const currentPromises = promises.splice(0, promises.length)\n\n    await Promise.all(currentPromises)\n\n    iterations++\n    if (iterations >= 100) {\n      throw new Error('Infinite getEntityPermissions promise loop detected.')\n    }\n  }\n\n  return entityPermissions\n}\n\nconst processWhereQuery = ({\n  id,\n  slug,\n  accessResult,\n  entityPermissions,\n  entityType,\n  fetchData,\n  locale,\n  operation,\n  req,\n  wherePromises,\n  whereQueryCache,\n}: {\n  accessResult: Where\n  entityPermissions: CollectionPermission | GlobalPermission\n  entityType: 'collection' | 'global'\n  fetchData: boolean\n  id?: DefaultDocumentIDType\n  locale?: string\n  operation: Extract<keyof (CollectionPermission | GlobalPermission), AllOperations>\n  req: PayloadRequest\n  slug: string\n  wherePromises: Promise<void>[]\n  whereQueryCache: WhereQueryCache\n}): void => {\n  if (fetchData) {\n    // Check cache for identical where query using deep comparison\n    let cached = whereQueryCache.find((entry) => isDeepStrictEqual(entry.where, accessResult))\n\n    if (!cached) {\n      // Cache miss - start DB query (don't await)\n      cached = {\n        result: entityDocExists({\n          id,\n          slug,\n          entityType,\n          locale,\n          operation,\n          req,\n          where: accessResult,\n        }),\n        where: accessResult,\n      }\n      whereQueryCache.push(cached)\n    }\n\n    // Defer resolution to Promise.all (cache hits reuse same promise)\n    wherePromises.push(\n      cached.result.then((hasPermission) => {\n        entityPermissions[operation] = {\n          permission: hasPermission,\n          where: accessResult,\n        } as Permission\n      }),\n    )\n  } else {\n    // TODO: 4.0: Investigate defaulting to `false` here, if where query is returned but ignored as we don't\n    // have the document data available. This seems more secure.\n    // Alternatively, we could set permission to a third state, like 'unknown'.\n    // Even after calling sanitizePermissions, the permissions will still be true if the where query is returned but ignored as we don't have the document data available.\n    entityPermissions[operation] = { permission: true, where: accessResult } as Permission\n  }\n}\n"],"names":["isDeepStrictEqual","entityDocExists","populateFieldPermissions","topLevelCollectionPermissions","topLevelGlobalPermissions","getEntityPermissions","args","id","blockReferencesPermissions","data","_data","entity","entityType","fetchData","operations","req","locale","_locale","user","undefined","Error","hasData","Object","keys","length","payload","findGlobal","slug","depth","fallbackLocale","overrideAccess","findByID","collection","trash","isLoggedIn","collectionConfig","fieldsPermissions","entityPermissions","fields","promises","accessResults","_operation","operation","accessFunction","access","includes","push","result","Promise","resolve","permission","resolvedAccessResults","all","map","item","whereQueryCache","wherePromises","accessResult","processWhereQuery","parentPermissionsObject","permissionsObject","iterations","currentPromises","splice","cached","find","entry","where","then","hasPermission"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,OAAM;AAcxC,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,wBAAwB,QAAQ,gCAA+B;AAuCxE,MAAMC,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;CACD;AACD,MAAMC,4BAA4B;IAAC;IAAQ;IAAgB;CAAS;AAEpE;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,eAAeC,qBACpBC,IAAuB;IAEvB,MAAM,EACJC,EAAE,EACFC,0BAA0B,EAC1BC,MAAMC,KAAK,EACXC,MAAM,EACNC,UAAU,EACVC,SAAS,EACTC,UAAU,EACVC,GAAG,EACJ,GAAGT;IACJ,MAAM,EAAEU,QAAQC,OAAO,EAAEC,IAAI,EAAE,GAAGH;IAElC,MAAMC,SAASC,UAAUA,UAAUE;IAEnC,IAAIN,aAAaD,eAAe,gBAAgB,CAACL,IAAI;QACnD,MAAM,IAAIa,MAAM;IAClB;IAEA,MAAMC,UAAUX,SAASY,OAAOC,IAAI,CAACb,OAAOc,MAAM,GAAG;IACrD,MAAMf,OAA+BY,UACjCX,QACAG,YACE,MAAM,AAAC,CAAA;QACL,IAAID,eAAe,UAAU;YAC3B,OAAOG,IAAIU,OAAO,CAACC,UAAU,CAAC;gBAC5BC,MAAMhB,OAAOgB,IAAI;gBACjBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;YACF;QACF;QAEA,IAAIH,eAAe,cAAc;YAC/B,OAAOG,IAAIU,OAAO,CAACM,QAAQ,CAAC;gBAC1BxB,IAAIA;gBACJyB,YAAYrB,OAAOgB,IAAI;gBACvBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;gBACAkB,OAAO;YACT;QACF;IACF,CAAA,MACAd;IAEN,MAAMe,aAAa,CAAC,CAAChB;IACrB,MAAMiB,mBACJvB,eAAe,eAAgBD,SAAuCQ;IAExE,MAAMiB,oBAAuC,CAAC;IAE9C,MAAMC,oBAA6C;QACjDC,QAAQF;IACV;IAEA,MAAMG,WAA4B,EAAE;IAEpC,6DAA6D;IAC7D,MAAMC,gBAGA,EAAE;IAER,KAAK,MAAMC,cAAc3B,WAAY;QACnC,MAAM4B,YAAYD;QAClB,MAAME,iBAAiBhC,OAAOiC,MAAM,CAACF,UAAU;QAE/C,IACE,AAAC9B,eAAe,gBAAgBT,8BAA8B0C,QAAQ,CAACH,cACtE9B,eAAe,YAAYR,0BAA0ByC,QAAQ,CAACH,YAC/D;YACA,IAAI,OAAOC,mBAAmB,YAAY;gBACxCH,cAAcM,IAAI,CAAC;oBACjBJ;oBACAK,QAAQC,QAAQC,OAAO,CACrBN,eAAe;wBACbpC;wBACA4B;wBACA1B;wBACAM;oBACF;gBAEJ;YACF,OAAO;gBACLsB,iBAAiB,CAACK,UAAU,GAAG;oBAC7BQ,YAAYhB;gBACd;YACF;QACF;IACF;IAEA,yCAAyC;IACzC,MAAMiB,wBAAwB,MAAMH,QAAQI,GAAG,CAC7CZ,cAAca,GAAG,CAAC,OAAOC,OAAU,CAAA;YACjCZ,WAAWY,KAAKZ,SAAS;YACzBK,QAAQ,MAAMO,KAAKP,MAAM;QAC3B,CAAA;IAGF,oEAAoE;IACpE,MAAMQ,kBAAmC,EAAE;IAC3C,MAAMC,gBAAiC,EAAE;IAEzC,KAAK,MAAM,EAAEd,SAAS,EAAEK,QAAQU,YAAY,EAAE,IAAIN,sBAAuB;QACvE,IAAI,OAAOM,iBAAiB,UAAU;YACpCC,kBAAkB;gBAChBnD;gBACAoB,MAAMhB,OAAOgB,IAAI;gBACjB8B;gBACApB;gBACAzB;gBACAC;gBACAG;gBACA0B;gBACA3B;gBACAyC;gBACAD;YACF;QACF,OAAO,IAAIlB,iBAAiB,CAACK,UAAU,EAAEQ,eAAe,OAAO;YAC7Db,iBAAiB,CAACK,UAAU,GAAG;gBAAEQ,YAAY,CAAC,CAACO;YAAa;QAC9D;IACF;IAEA,6CAA6C;IAC7C,MAAMT,QAAQI,GAAG,CAACI;IAElBtD,yBAAyB;QACvBM;QACAC;QACA6B,QAAQ3B,OAAO2B,MAAM;QACrBxB;QACA6C,yBAAyBtB;QACzBuB,mBAAmBxB;QACnBG;QACAxB;IACF;IAEA;;;;;GAKC,GACD,IAAI8C,aAAa;IACjB,MAAOtB,SAASf,MAAM,GAAG,EAAG;QAC1B,MAAMsC,kBAAkBvB,SAASwB,MAAM,CAAC,GAAGxB,SAASf,MAAM;QAE1D,MAAMwB,QAAQI,GAAG,CAACU;QAElBD;QACA,IAAIA,cAAc,KAAK;YACrB,MAAM,IAAIzC,MAAM;QAClB;IACF;IAEA,OAAOiB;AACT;AAEA,MAAMqB,oBAAoB,CAAC,EACzBnD,EAAE,EACFoB,IAAI,EACJ8B,YAAY,EACZpB,iBAAiB,EACjBzB,UAAU,EACVC,SAAS,EACTG,MAAM,EACN0B,SAAS,EACT3B,GAAG,EACHyC,aAAa,EACbD,eAAe,EAahB;IACC,IAAI1C,WAAW;QACb,8DAA8D;QAC9D,IAAImD,SAAST,gBAAgBU,IAAI,CAAC,CAACC,QAAUlE,kBAAkBkE,MAAMC,KAAK,EAAEV;QAE5E,IAAI,CAACO,QAAQ;YACX,4CAA4C;YAC5CA,SAAS;gBACPjB,QAAQ9C,gBAAgB;oBACtBM;oBACAoB;oBACAf;oBACAI;oBACA0B;oBACA3B;oBACAoD,OAAOV;gBACT;gBACAU,OAAOV;YACT;YACAF,gBAAgBT,IAAI,CAACkB;QACvB;QAEA,kEAAkE;QAClER,cAAcV,IAAI,CAChBkB,OAAOjB,MAAM,CAACqB,IAAI,CAAC,CAACC;YAClBhC,iBAAiB,CAACK,UAAU,GAAG;gBAC7BQ,YAAYmB;gBACZF,OAAOV;YACT;QACF;IAEJ,OAAO;QACL,wGAAwG;QACxG,4DAA4D;QAC5D,2EAA2E;QAC3E,sKAAsK;QACtKpB,iBAAiB,CAACK,UAAU,GAAG;YAAEQ,YAAY;YAAMiB,OAAOV;QAAa;IACzE;AACF"}

package/dist/utilities/getObjectDotNotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAMF,CAAA"}
+{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAeF,CAAA"}

package/dist/utilities/getObjectDotNotation.js

@@ -15,7 +15,13 @@
     if (!path || !obj) {
         return defaultValue;
     }
-    const result = path.split('.').reduce((o, i)=>o?.[i], obj);
+    let result = obj;
+    for (const segment of path.split('.')){
+        if (result === null || typeof result !== 'object' || !Object.hasOwn(result, segment)) {
+            return defaultValue;
+        }
+        result = result[segment];
+    }
     return result === undefined ? defaultValue : result;
 };
 

package/dist/utilities/getObjectDotNotation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/**\n *\n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n *\n * @example\n *\n * ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n *\n * const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n  obj: Record<string, unknown>,\n  path: string,\n  defaultValue?: T,\n): T => {\n  if (!path || !obj) {\n    return defaultValue!\n  }\n  const result = path.split('.').reduce((o, i) => o?.[i] as Record<string, unknown>, obj)\n  return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","split","reduce","o","i","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IACA,MAAMC,SAASF,KAAKG,KAAK,CAAC,KAAKC,MAAM,CAAC,CAACC,GAAGC,IAAMD,GAAG,CAACC,EAAE,EAA6BP;IACnF,OAAOG,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}
+{"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/**\n *\n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n *\n * @example\n *\n * ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n *\n * const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n  obj: Record<string, unknown>,\n  path: string,\n  defaultValue?: T,\n): T => {\n  if (!path || !obj) {\n    return defaultValue!\n  }\n  let result: unknown = obj\n\n  for (const segment of path.split('.')) {\n    if (result === null || typeof result !== 'object' || !Object.hasOwn(result, segment)) {\n      return defaultValue!\n    }\n\n    result = (result as Record<string, unknown>)[segment]\n  }\n\n  return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","segment","split","Object","hasOwn","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IACA,IAAIC,SAAkBH;IAEtB,KAAK,MAAMI,WAAWH,KAAKI,KAAK,CAAC,KAAM;QACrC,IAAIF,WAAW,QAAQ,OAAOA,WAAW,YAAY,CAACG,OAAOC,MAAM,CAACJ,QAAQC,UAAU;YACpF,OAAOF;QACT;QAEAC,SAAS,AAACA,MAAkC,CAACC,QAAQ;IACvD;IAEA,OAAOD,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}

package/dist/utilities/getObjectDotNotation.spec.js

@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest';
+import { getObjectDotNotation } from './getObjectDotNotation.js';
+describe('getObjectDotNotation', ()=>{
+    it('should read only owned object paths', ()=>{
+        let inheritedGetterCalls = 0;
+        const inheritedRoot = Object.create({
+            get nested () {
+                inheritedGetterCalls += 1;
+                return {
+                    value: 'inherited'
+                };
+            }
+        });
+        const inheritedLeaf = {
+            nested: Object.create({
+                get value () {
+                    inheritedGetterCalls += 1;
+                    return 'inherited';
+                }
+            })
+        };
+        expect(getObjectDotNotation(inheritedRoot, 'nested.value', 'fallback')).toBe('fallback');
+        expect(getObjectDotNotation(inheritedLeaf, 'nested.value', 'fallback')).toBe('fallback');
+        expect(getObjectDotNotation({
+            nested: {
+                value: 'owned'
+            }
+        }, 'nested.value', 'fallback')).toBe('owned');
+        expect(inheritedGetterCalls).toBe(0);
+    });
+});
+
+//# sourceMappingURL=getObjectDotNotation.spec.js.map

package/dist/utilities/getObjectDotNotation.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getObjectDotNotation.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { getObjectDotNotation } from './getObjectDotNotation.js'\n\ndescribe('getObjectDotNotation', () => {\n  it('should read only owned object paths', () => {\n    let inheritedGetterCalls = 0\n    const inheritedRoot = Object.create({\n      get nested() {\n        inheritedGetterCalls += 1\n        return { value: 'inherited' }\n      },\n    }) as Record<string, unknown>\n    const inheritedLeaf = {\n      nested: Object.create({\n        get value() {\n          inheritedGetterCalls += 1\n          return 'inherited'\n        },\n      }),\n    }\n\n    expect(getObjectDotNotation(inheritedRoot, 'nested.value', 'fallback')).toBe('fallback')\n    expect(getObjectDotNotation(inheritedLeaf, 'nested.value', 'fallback')).toBe('fallback')\n    expect(getObjectDotNotation({ nested: { value: 'owned' } }, 'nested.value', 'fallback')).toBe(\n      'owned',\n    )\n    expect(inheritedGetterCalls).toBe(0)\n  })\n})\n"],"names":["describe","expect","it","getObjectDotNotation","inheritedGetterCalls","inheritedRoot","Object","create","nested","value","inheritedLeaf","toBe"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhEH,SAAS,wBAAwB;IAC/BE,GAAG,uCAAuC;QACxC,IAAIE,uBAAuB;QAC3B,MAAMC,gBAAgBC,OAAOC,MAAM,CAAC;YAClC,IAAIC,UAAS;gBACXJ,wBAAwB;gBACxB,OAAO;oBAAEK,OAAO;gBAAY;YAC9B;QACF;QACA,MAAMC,gBAAgB;YACpBF,QAAQF,OAAOC,MAAM,CAAC;gBACpB,IAAIE,SAAQ;oBACVL,wBAAwB;oBACxB,OAAO;gBACT;YACF;QACF;QAEAH,OAAOE,qBAAqBE,eAAe,gBAAgB,aAAaM,IAAI,CAAC;QAC7EV,OAAOE,qBAAqBO,eAAe,gBAAgB,aAAaC,IAAI,CAAC;QAC7EV,OAAOE,qBAAqB;YAAEK,QAAQ;gBAAEC,OAAO;YAAQ;QAAE,GAAG,gBAAgB,aAAaE,IAAI,CAC3F;QAEFV,OAAOG,sBAAsBO,IAAI,CAAC;IACpC;AACF"}

package/dist/utilities/getSafeRedirect.spec.js

@@ -153,6 +153,20 @@ describe('getSafeRedirect', ()=>{
             fallbackTo: fallback
         })).toBe(fallback);
     });
+    it('should support an empty fallback for callers that branch on the result', ()=>{
+        expect(getSafeRedirect({
+            redirectTo: '//example.invalid',
+            fallbackTo: ''
+        })).toBe('');
+        expect(getSafeRedirect({
+            redirectTo: 'dashboard',
+            fallbackTo: ''
+        })).toBe('');
+        expect(getSafeRedirect({
+            redirectTo: '/dashboard',
+            fallbackTo: ''
+        })).toBe('/dashboard');
+    });
 });
 
 //# sourceMappingURL=getSafeRedirect.spec.js.map

package/dist/utilities/getSafeRedirect.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { getSafeRedirect } from './getSafeRedirect'\n\nconst fallback = '/admin' // default fallback if the input is unsafe or invalid\n\ndescribe('getSafeRedirect', () => {\n  // Valid - safe redirect paths\n  it.each([['/dashboard'], ['/admin/settings'], ['/projects?id=123'], ['/hello-world']])(\n    'should allow safe relative path: %s',\n    (input) => {\n      // If the input is a clean relative path, it should be returned as-is\n      expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(input)\n    },\n  )\n\n  // Invalid types or empty inputs\n  it.each(['', null, undefined, 123, {}, []])(\n    'should fallback on invalid or non-string input: %s',\n    (input) => {\n      // If the input is not a valid string, it should return the fallback\n      expect(getSafeRedirect({ redirectTo: input as any, fallbackTo: fallback })).toBe(fallback)\n    },\n  )\n\n  it.each([\n    'redirect=%2F%09%2Fexample.invalid',\n    'redirect=%2F%0D%2Fexample.invalid',\n    'redirect=%2F%0A%2Fexample.invalid',\n  ])('should use the fallback when a path resolves outside the current origin: %s', (query) => {\n    const redirectTo = new URLSearchParams(query).get('redirect')\n\n    expect(redirectTo).not.toBeNull()\n    expect(getSafeRedirect({ redirectTo: redirectTo!, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  it.each([\n    '/%2509/example.invalid',\n    '/%250D/example.invalid',\n    '/%250A/example.invalid',\n    '/%255Cexample.invalid',\n    '/%252fexample.invalid',\n  ])('should use the fallback for ambiguous encoded path prefixes: %s', (input) => {\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Unsafe redirect patterns\n  it.each([\n    '//example.com', // protocol-relative URL\n    '/javascript:alert(1)', // JavaScript scheme\n    '/JavaScript:alert(1)', // case-insensitive JavaScript\n    '/http://unknown.com', // disguised external redirect\n    '/https://unknown.com', // disguised external redirect\n    '/%2Funknown.com', // encoded slash — could resolve to //\n    '/\\\\/unknown.com', // escaped slash\n    '/\\\\\\\\unknown.com', // double escaped slashes\n    '/\\\\unknown.com', // single escaped slash\n    '%2F%2Funknown.com', // fully encoded protocol-relative path\n    '%2Fjavascript:alert(1)', // encoded JavaScript scheme\n  ])('should block unsafe redirect: %s', (input) => {\n    // All of these should return the fallback because they’re unsafe\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Input with extra spaces should still be properly handled\n  it('should trim whitespace before evaluating', () => {\n    // A valid path with surrounding spaces should still be accepted\n    expect(getSafeRedirect({ redirectTo: '   /dashboard   ', fallbackTo: fallback })).toBe(\n      '/dashboard',\n    )\n\n    // An unsafe path with spaces should still be rejected\n    expect(getSafeRedirect({ redirectTo: '   //example.com   ', fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  it('should return fallback when the input is not a path or URL', () => {\n    expect(getSafeRedirect({ redirectTo: '%E0%A4%A', fallbackTo: fallback })).toBe(fallback)\n  })\n\n  it('should preserve an accepted local redirect', () => {\n    const redirectTo = '/dashboard?tab=overview#details'\n\n    expect(getSafeRedirect({ redirectTo, fallbackTo: fallback })).toBe(redirectTo)\n  })\n\n  it('should preserve a parsed navigation target byte-for-byte', () => {\n    const redirectTo = new URLSearchParams(\n      'redirect=%2Foauth%2Fcallback%3Fcode%3DA%252FB%26state%3Dopaque%253D%23done',\n    ).get('redirect')\n\n    expect(redirectTo).toBe('/oauth/callback?code=A%2FB&state=opaque%3D#done')\n    expect(getSafeRedirect({ redirectTo: redirectTo!, fallbackTo: fallback })).toBe(\n      '/oauth/callback?code=A%2FB&state=opaque%3D#done',\n    )\n  })\n\n  it.each([\n    [\n      'https://example.invalid/path?code=A%252FB#done',\n      'https://example.invalid/path?code=A%252FB#done',\n    ],\n    ['http://example.invalid/dashboard', 'http://example.invalid/dashboard'],\n  ])('should preserve an HTTP absolute redirect when enabled: %s', (input, expected) => {\n    expect(\n      getSafeRedirect({\n        allowAbsoluteUrls: true,\n        redirectTo: input,\n        fallbackTo: fallback,\n      }),\n    ).toBe(expected)\n  })\n\n  it.each([\n    ['https://example.invalid/path', false],\n    ['mailto:user@example.invalid', true],\n    ['//example.invalid/path', true],\n  ])(\n    'should use the fallback without an explicitly enabled HTTP(S) URL: %s',\n    (input, allowAbsoluteUrls) => {\n      expect(getSafeRedirect({ allowAbsoluteUrls, redirectTo: input, fallbackTo: fallback })).toBe(\n        fallback,\n      )\n    },\n  )\n})\n"],"names":["describe","it","expect","getSafeRedirect","fallback","each","input","redirectTo","fallbackTo","toBe","undefined","query","URLSearchParams","get","not","toBeNull","expected","allowAbsoluteUrls"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,eAAe,QAAQ,oBAAmB;AAEnD,MAAMC,WAAW,SAAS,qDAAqD;;AAE/EJ,SAAS,mBAAmB;IAC1B,8BAA8B;IAC9BC,GAAGI,IAAI,CAAC;QAAC;YAAC;SAAa;QAAE;YAAC;SAAkB;QAAE;YAAC;SAAmB;QAAE;YAAC;SAAe;KAAC,EACnF,uCACA,CAACC;QACC,qEAAqE;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACH;IAC5E;IAGF,gCAAgC;IAChCL,GAAGI,IAAI,CAAC;QAAC;QAAI;QAAMK;QAAW;QAAK,CAAC;QAAG,EAAE;KAAC,EACxC,sDACA,CAACJ;QACC,oEAAoE;QACpEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAcE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACnF;IAGFH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;KACD,EAAE,+EAA+E,CAACM;QACjF,MAAMJ,aAAa,IAAIK,gBAAgBD,OAAOE,GAAG,CAAC;QAElDX,OAAOK,YAAYO,GAAG,CAACC,QAAQ;QAC/Bb,OAAOC,gBAAgB;YAAEI,YAAYA;YAAaC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAClF;IAEAH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;KACD,EAAE,mEAAmE,CAACC;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2BAA2B;IAC3BH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,oCAAoC,CAACC;QACtC,iEAAiE;QACjEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2DAA2D;IAC3DH,GAAG,4CAA4C;QAC7C,gEAAgE;QAChEC,OAAOC,gBAAgB;YAAEI,YAAY;YAAoBC,YAAYJ;QAAS,IAAIK,IAAI,CACpF;QAGF,sDAAsD;QACtDP,OAAOC,gBAAgB;YAAEI,YAAY;YAAuBC,YAAYJ;QAAS,IAAIK,IAAI,CACvFL;IAEJ;IAEAH,GAAG,8DAA8D;QAC/DC,OAAOC,gBAAgB;YAAEI,YAAY;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACjF;IAEAH,GAAG,8CAA8C;QAC/C,MAAMM,aAAa;QAEnBL,OAAOC,gBAAgB;YAAEI;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACF;IACrE;IAEAN,GAAG,4DAA4D;QAC7D,MAAMM,aAAa,IAAIK,gBACrB,8EACAC,GAAG,CAAC;QAENX,OAAOK,YAAYE,IAAI,CAAC;QACxBP,OAAOC,gBAAgB;YAAEI,YAAYA;YAAaC,YAAYJ;QAAS,IAAIK,IAAI,CAC7E;IAEJ;IAEAR,GAAGI,IAAI,CAAC;QACN;YACE;YACA;SACD;QACD;YAAC;YAAoC;SAAmC;KACzE,EAAE,8DAA8D,CAACC,OAAOU;QACvEd,OACEC,gBAAgB;YACdc,mBAAmB;YACnBV,YAAYD;YACZE,YAAYJ;QACd,IACAK,IAAI,CAACO;IACT;IAEAf,GAAGI,IAAI,CAAC;QACN;YAAC;YAAgC;SAAM;QACvC;YAAC;YAA+B;SAAK;QACrC;YAAC;YAA0B;SAAK;KACjC,EACC,yEACA,CAACC,OAAOW;QACNf,OAAOC,gBAAgB;YAAEc;YAAmBV,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAC1FL;IAEJ;AAEJ"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { getSafeRedirect } from './getSafeRedirect'\n\nconst fallback = '/admin' // default fallback if the input is unsafe or invalid\n\ndescribe('getSafeRedirect', () => {\n  // Valid - safe redirect paths\n  it.each([['/dashboard'], ['/admin/settings'], ['/projects?id=123'], ['/hello-world']])(\n    'should allow safe relative path: %s',\n    (input) => {\n      // If the input is a clean relative path, it should be returned as-is\n      expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(input)\n    },\n  )\n\n  // Invalid types or empty inputs\n  it.each(['', null, undefined, 123, {}, []])(\n    'should fallback on invalid or non-string input: %s',\n    (input) => {\n      // If the input is not a valid string, it should return the fallback\n      expect(getSafeRedirect({ redirectTo: input as any, fallbackTo: fallback })).toBe(fallback)\n    },\n  )\n\n  it.each([\n    'redirect=%2F%09%2Fexample.invalid',\n    'redirect=%2F%0D%2Fexample.invalid',\n    'redirect=%2F%0A%2Fexample.invalid',\n  ])('should use the fallback when a path resolves outside the current origin: %s', (query) => {\n    const redirectTo = new URLSearchParams(query).get('redirect')\n\n    expect(redirectTo).not.toBeNull()\n    expect(getSafeRedirect({ redirectTo: redirectTo!, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  it.each([\n    '/%2509/example.invalid',\n    '/%250D/example.invalid',\n    '/%250A/example.invalid',\n    '/%255Cexample.invalid',\n    '/%252fexample.invalid',\n  ])('should use the fallback for ambiguous encoded path prefixes: %s', (input) => {\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Unsafe redirect patterns\n  it.each([\n    '//example.com', // protocol-relative URL\n    '/javascript:alert(1)', // JavaScript scheme\n    '/JavaScript:alert(1)', // case-insensitive JavaScript\n    '/http://unknown.com', // disguised external redirect\n    '/https://unknown.com', // disguised external redirect\n    '/%2Funknown.com', // encoded slash — could resolve to //\n    '/\\\\/unknown.com', // escaped slash\n    '/\\\\\\\\unknown.com', // double escaped slashes\n    '/\\\\unknown.com', // single escaped slash\n    '%2F%2Funknown.com', // fully encoded protocol-relative path\n    '%2Fjavascript:alert(1)', // encoded JavaScript scheme\n  ])('should block unsafe redirect: %s', (input) => {\n    // All of these should return the fallback because they’re unsafe\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Input with extra spaces should still be properly handled\n  it('should trim whitespace before evaluating', () => {\n    // A valid path with surrounding spaces should still be accepted\n    expect(getSafeRedirect({ redirectTo: '   /dashboard   ', fallbackTo: fallback })).toBe(\n      '/dashboard',\n    )\n\n    // An unsafe path with spaces should still be rejected\n    expect(getSafeRedirect({ redirectTo: '   //example.com   ', fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  it('should return fallback when the input is not a path or URL', () => {\n    expect(getSafeRedirect({ redirectTo: '%E0%A4%A', fallbackTo: fallback })).toBe(fallback)\n  })\n\n  it('should preserve an accepted local redirect', () => {\n    const redirectTo = '/dashboard?tab=overview#details'\n\n    expect(getSafeRedirect({ redirectTo, fallbackTo: fallback })).toBe(redirectTo)\n  })\n\n  it('should preserve a parsed navigation target byte-for-byte', () => {\n    const redirectTo = new URLSearchParams(\n      'redirect=%2Foauth%2Fcallback%3Fcode%3DA%252FB%26state%3Dopaque%253D%23done',\n    ).get('redirect')\n\n    expect(redirectTo).toBe('/oauth/callback?code=A%2FB&state=opaque%3D#done')\n    expect(getSafeRedirect({ redirectTo: redirectTo!, fallbackTo: fallback })).toBe(\n      '/oauth/callback?code=A%2FB&state=opaque%3D#done',\n    )\n  })\n\n  it.each([\n    [\n      'https://example.invalid/path?code=A%252FB#done',\n      'https://example.invalid/path?code=A%252FB#done',\n    ],\n    ['http://example.invalid/dashboard', 'http://example.invalid/dashboard'],\n  ])('should preserve an HTTP absolute redirect when enabled: %s', (input, expected) => {\n    expect(\n      getSafeRedirect({\n        allowAbsoluteUrls: true,\n        redirectTo: input,\n        fallbackTo: fallback,\n      }),\n    ).toBe(expected)\n  })\n\n  it.each([\n    ['https://example.invalid/path', false],\n    ['mailto:user@example.invalid', true],\n    ['//example.invalid/path', true],\n  ])(\n    'should use the fallback without an explicitly enabled HTTP(S) URL: %s',\n    (input, allowAbsoluteUrls) => {\n      expect(getSafeRedirect({ allowAbsoluteUrls, redirectTo: input, fallbackTo: fallback })).toBe(\n        fallback,\n      )\n    },\n  )\n\n  it('should support an empty fallback for callers that branch on the result', () => {\n    expect(getSafeRedirect({ redirectTo: '//example.invalid', fallbackTo: '' })).toBe('')\n    expect(getSafeRedirect({ redirectTo: 'dashboard', fallbackTo: '' })).toBe('')\n    expect(getSafeRedirect({ redirectTo: '/dashboard', fallbackTo: '' })).toBe('/dashboard')\n  })\n})\n"],"names":["describe","it","expect","getSafeRedirect","fallback","each","input","redirectTo","fallbackTo","toBe","undefined","query","URLSearchParams","get","not","toBeNull","expected","allowAbsoluteUrls"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,eAAe,QAAQ,oBAAmB;AAEnD,MAAMC,WAAW,SAAS,qDAAqD;;AAE/EJ,SAAS,mBAAmB;IAC1B,8BAA8B;IAC9BC,GAAGI,IAAI,CAAC;QAAC;YAAC;SAAa;QAAE;YAAC;SAAkB;QAAE;YAAC;SAAmB;QAAE;YAAC;SAAe;KAAC,EACnF,uCACA,CAACC;QACC,qEAAqE;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACH;IAC5E;IAGF,gCAAgC;IAChCL,GAAGI,IAAI,CAAC;QAAC;QAAI;QAAMK;QAAW;QAAK,CAAC;QAAG,EAAE;KAAC,EACxC,sDACA,CAACJ;QACC,oEAAoE;QACpEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAcE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACnF;IAGFH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;KACD,EAAE,+EAA+E,CAACM;QACjF,MAAMJ,aAAa,IAAIK,gBAAgBD,OAAOE,GAAG,CAAC;QAElDX,OAAOK,YAAYO,GAAG,CAACC,QAAQ;QAC/Bb,OAAOC,gBAAgB;YAAEI,YAAYA;YAAaC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAClF;IAEAH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;KACD,EAAE,mEAAmE,CAACC;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2BAA2B;IAC3BH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,oCAAoC,CAACC;QACtC,iEAAiE;QACjEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2DAA2D;IAC3DH,GAAG,4CAA4C;QAC7C,gEAAgE;QAChEC,OAAOC,gBAAgB;YAAEI,YAAY;YAAoBC,YAAYJ;QAAS,IAAIK,IAAI,CACpF;QAGF,sDAAsD;QACtDP,OAAOC,gBAAgB;YAAEI,YAAY;YAAuBC,YAAYJ;QAAS,IAAIK,IAAI,CACvFL;IAEJ;IAEAH,GAAG,8DAA8D;QAC/DC,OAAOC,gBAAgB;YAAEI,YAAY;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACjF;IAEAH,GAAG,8CAA8C;QAC/C,MAAMM,aAAa;QAEnBL,OAAOC,gBAAgB;YAAEI;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACF;IACrE;IAEAN,GAAG,4DAA4D;QAC7D,MAAMM,aAAa,IAAIK,gBACrB,8EACAC,GAAG,CAAC;QAENX,OAAOK,YAAYE,IAAI,CAAC;QACxBP,OAAOC,gBAAgB;YAAEI,YAAYA;YAAaC,YAAYJ;QAAS,IAAIK,IAAI,CAC7E;IAEJ;IAEAR,GAAGI,IAAI,CAAC;QACN;YACE;YACA;SACD;QACD;YAAC;YAAoC;SAAmC;KACzE,EAAE,8DAA8D,CAACC,OAAOU;QACvEd,OACEC,gBAAgB;YACdc,mBAAmB;YACnBV,YAAYD;YACZE,YAAYJ;QACd,IACAK,IAAI,CAACO;IACT;IAEAf,GAAGI,IAAI,CAAC;QACN;YAAC;YAAgC;SAAM;QACvC;YAAC;YAA+B;SAAK;QACrC;YAAC;YAA0B;SAAK;KACjC,EACC,yEACA,CAACC,OAAOW;QACNf,OAAOC,gBAAgB;YAAEc;YAAmBV,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAC1FL;IAEJ;IAGFH,GAAG,0EAA0E;QAC3EC,OAAOC,gBAAgB;YAAEI,YAAY;YAAqBC,YAAY;QAAG,IAAIC,IAAI,CAAC;QAClFP,OAAOC,gBAAgB;YAAEI,YAAY;YAAaC,YAAY;QAAG,IAAIC,IAAI,CAAC;QAC1EP,OAAOC,gBAAgB;YAAEI,YAAY;YAAcC,YAAY;QAAG,IAAIC,IAAI,CAAC;IAC7E;AACF"}

package/dist/utilities/getTopLevelFieldNames.d.ts

@@ -0,0 +1,2 @@
+export declare const getTopLevelFieldNames: (data: object) => Set<string>;
+//# sourceMappingURL=getTopLevelFieldNames.d.ts.map

package/dist/utilities/getTopLevelFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getTopLevelFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getTopLevelFieldNames.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,GAAG,CAAC,MAAM,CACa,CAAA"}

package/dist/utilities/getTopLevelFieldNames.js

@@ -0,0 +1,3 @@
+export const getTopLevelFieldNames = (data)=>new Set(Object.keys(data).map((fieldPath)=>fieldPath.split('.', 1)[0]));
+
+//# sourceMappingURL=getTopLevelFieldNames.js.map

package/dist/utilities/getTopLevelFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getTopLevelFieldNames.ts"],"sourcesContent":["export const getTopLevelFieldNames = (data: object): Set<string> =>\n  new Set(Object.keys(data).map((fieldPath) => fieldPath.split('.', 1)[0]!))\n"],"names":["getTopLevelFieldNames","data","Set","Object","keys","map","fieldPath","split"],"mappings":"AAAA,OAAO,MAAMA,wBAAwB,CAACC,OACpC,IAAIC,IAAIC,OAAOC,IAAI,CAACH,MAAMI,GAAG,CAAC,CAACC,YAAcA,UAAUC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG"}

package/dist/utilities/getTopLevelFieldNames.spec.js

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest';
+import { getTopLevelFieldNames } from './getTopLevelFieldNames.js';
+describe('getTopLevelFieldNames', ()=>{
+    it('should return unique top-level names from direct and dotted field paths', ()=>{
+        expect(getTopLevelFieldNames({
+            'blocks.0.heading': 'Heading',
+            'group.description': 'Description',
+            'group.title': 'Title',
+            slug: 'example'
+        })).toEqual(new Set([
+            'blocks',
+            'group',
+            'slug'
+        ]));
+    });
+});
+
+//# sourceMappingURL=getTopLevelFieldNames.spec.js.map

package/dist/utilities/getTopLevelFieldNames.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getTopLevelFieldNames.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { getTopLevelFieldNames } from './getTopLevelFieldNames.js'\n\ndescribe('getTopLevelFieldNames', () => {\n  it('should return unique top-level names from direct and dotted field paths', () => {\n    expect(\n      getTopLevelFieldNames({\n        'blocks.0.heading': 'Heading',\n        'group.description': 'Description',\n        'group.title': 'Title',\n        slug: 'example',\n      }),\n    ).toEqual(new Set(['blocks', 'group', 'slug']))\n  })\n})\n"],"names":["describe","expect","it","getTopLevelFieldNames","slug","toEqual","Set"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,qBAAqB,QAAQ,6BAA4B;AAElEH,SAAS,yBAAyB;IAChCE,GAAG,2EAA2E;QAC5ED,OACEE,sBAAsB;YACpB,oBAAoB;YACpB,qBAAqB;YACrB,eAAe;YACfC,MAAM;QACR,IACAC,OAAO,CAAC,IAAIC,IAAI;YAAC;YAAU;YAAS;SAAO;IAC/C;AACF"}

package/dist/utilities/handleEndpoints.js

@@ -74,7 +74,7 @@ const notFoundResponse = (req, pathname)=>{
             }
         }
         const req = new Request(url, {
-            // @ts-expect-error // TODO: check if this is required
+            // @ts-expect-error RequestInit does not include cache in the type
             cache: request.cache,
             credentials: request.credentials,
             headers: request.headers,

package/dist/utilities/handleEndpoints.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\nimport { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { createPayloadRequest } from './createPayloadRequest.js'\nimport { formatAdminURL } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale\n      // => add to searchParams\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      // @ts-expect-error // TODO: check if this is required\n      cache: request.cache,\n      credentials: request.credentials,\n      headers: request.headers,\n      method: 'GET',\n      signal: request.signal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    const { payload } = req\n    const { config } = payload\n\n    const pathname = path ?? new URL(req.url!).pathname\n    const baseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["status","httpStatus","match","createPayloadRequest","formatAdminURL","headersWithCors","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","data","undefined","search","text","locale","fallbackLocale","depth","Request","cache","credentials","signal","response","canSetHeaders","payload","baseAPIPath","apiRoute","routes","api","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAClD,SAASC,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASX,gBAAgB;YACvBW,SAAS,IAAIC;YACbR;QACF;QACAT,QAAQC,WAAWiB,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIjB;IACJ,IAAIkB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQT,OAAO,CAACc,GAAG,CAAC,sCAAsC,SACzDL,QAAQT,OAAO,CAACc,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,IAAIf,MAAMU,QAAQV,GAAG;QACrB,IAAIgB,OAAYC;QAEhB,IAAIP,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMG,SAAS,MAAMR,QAAQS,IAAI;YACjCnB,MAAM,GAAGU,QAAQV,GAAG,CAAC,CAAC,EAAEkB,QAAQ;QAClC,OAAO,IAAIR,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCC,OAAO,MAAMN,QAAQb,IAAI;YAEzB,0GAA0G;YAC1G,yBAAyB;YACzB,IAAImB,MAAMI,QAAQ;gBAChBpB,OAAO,CAAC,QAAQ,EAAEgB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBrB,OAAO,CAAC,gBAAgB,EAAEgB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAM5B,MAAM,IAAI6B,QAAQvB,KAAK;YAC3B,sDAAsD;YACtDwB,OAAOd,QAAQc,KAAK;YACpBC,aAAaf,QAAQe,WAAW;YAChCxB,SAASS,QAAQT,OAAO;YACxBY,QAAQ;YACRa,QAAQhB,QAAQgB,MAAM;QACxB;QAEA,IAAIV,MAAM;YACR,gFAAgF;YAChFtB,IAAIsB,IAAI,GAAGA;QACb;QAEA,MAAMW,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAAShB;QACX;QAEA,OAAOiC;IACT;IAEA,IAAI;QACFjC,MAAM,MAAMN,qBAAqB;YAC/BwC,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,MAAM,EAAEmB,OAAO,EAAE,GAAGnC;QACpB,MAAM,EAAEY,MAAM,EAAE,GAAGuB;QAEnB,MAAMlC,WAAWa,QAAQ,IAAIT,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACnD,MAAMmC,cAAczC,eAAe;YACjC0C,UAAUzB,OAAO0B,MAAM,CAACC,GAAG;YAC3BzB,MAAM;QACR;QAEA,IAAI,CAACb,SAASuC,UAAU,CAACJ,cAAc;YACrC,OAAOrC,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAIwC,mBAAmBxC,SAASyC,OAAO,CAACN,aAAa;QAErD,IAAIO,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAeb,QAAQc,OAAO,CAACrC,MAAM,CAACsC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAIZ,QAAQkB,WAAW,CAACN,WAAW,EAAE;gBAC1C7B,aAAaiB,QAAQkB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC1C,OAAO0C,SAAS;QAEpD,IAAIpC,YAAY;YACdoC,YAAYpC,WAAWN,MAAM,CAAC0C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAExB,WAAWN,MAAM,CAACwC,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOpD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAImB,MAAM,EAAEoC,cAAc,CAAC,EAAEvD,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASX,gBAAgB;oBACvBW,SAAS,IAAIC;oBACbR;gBACF;gBACAT,QAAQC,WAAWgE,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAAStC,MAAM,KAAKnB,IAAImB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMsC,cAAcjE,MAAMgE,SAAS3C,IAAI,EAAE;gBAAE6C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEA7D,IAAI8D,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI7C,YAAY;gBACdlB,IAAI8D,WAAW,CAAC5C,UAAU,GAAGA,WAAWN,MAAM,CAACwC,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBhD,IAAI8D,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZxC,UAAUwC,SAASxC,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIjB,IAAImB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOlB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASX,gBAAgB;wBACvBW,SAAS,IAAIC;wBACbR;oBACF;oBACAT,QAAQ;gBACV;YAEJ;YAEA,OAAOQ,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMgC,WAAW,MAAMhB,QAAQjB;QAE/B,OAAO,IAAIE,SAAS+B,SAASgC,IAAI,EAAE;YACjC1D,SAASX,gBAAgB;gBACvBW,SAASV,aAAaG,IAAIkE,eAAe,IAAI,IAAI1D,WAAWyB,SAAS1B,OAAO;gBAC5EP;YACF;YACAT,QAAQ0C,SAAS1C,MAAM;YACvB4E,YAAYlC,SAASkC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOtE,WAAW;YAChBoB;YACAN,QAAQC;YACRwD;YACArE,KAAKA;QACP;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\nimport { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { createPayloadRequest } from './createPayloadRequest.js'\nimport { formatAdminURL } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale\n      // => add to searchParams\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      // @ts-expect-error RequestInit does not include cache in the type\n      cache: request.cache,\n      credentials: request.credentials,\n      headers: request.headers,\n      method: 'GET',\n      signal: request.signal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    const { payload } = req\n    const { config } = payload\n\n    const pathname = path ?? new URL(req.url!).pathname\n    const baseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["status","httpStatus","match","createPayloadRequest","formatAdminURL","headersWithCors","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","data","undefined","search","text","locale","fallbackLocale","depth","Request","cache","credentials","signal","response","canSetHeaders","payload","baseAPIPath","apiRoute","routes","api","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAClD,SAASC,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASX,gBAAgB;YACvBW,SAAS,IAAIC;YACbR;QACF;QACAT,QAAQC,WAAWiB,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIjB;IACJ,IAAIkB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQT,OAAO,CAACc,GAAG,CAAC,sCAAsC,SACzDL,QAAQT,OAAO,CAACc,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,IAAIf,MAAMU,QAAQV,GAAG;QACrB,IAAIgB,OAAYC;QAEhB,IAAIP,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMG,SAAS,MAAMR,QAAQS,IAAI;YACjCnB,MAAM,GAAGU,QAAQV,GAAG,CAAC,CAAC,EAAEkB,QAAQ;QAClC,OAAO,IAAIR,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCC,OAAO,MAAMN,QAAQb,IAAI;YAEzB,0GAA0G;YAC1G,yBAAyB;YACzB,IAAImB,MAAMI,QAAQ;gBAChBpB,OAAO,CAAC,QAAQ,EAAEgB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBrB,OAAO,CAAC,gBAAgB,EAAEgB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAM5B,MAAM,IAAI6B,QAAQvB,KAAK;YAC3B,kEAAkE;YAClEwB,OAAOd,QAAQc,KAAK;YACpBC,aAAaf,QAAQe,WAAW;YAChCxB,SAASS,QAAQT,OAAO;YACxBY,QAAQ;YACRa,QAAQhB,QAAQgB,MAAM;QACxB;QAEA,IAAIV,MAAM;YACR,gFAAgF;YAChFtB,IAAIsB,IAAI,GAAGA;QACb;QAEA,MAAMW,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAAShB;QACX;QAEA,OAAOiC;IACT;IAEA,IAAI;QACFjC,MAAM,MAAMN,qBAAqB;YAC/BwC,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,MAAM,EAAEmB,OAAO,EAAE,GAAGnC;QACpB,MAAM,EAAEY,MAAM,EAAE,GAAGuB;QAEnB,MAAMlC,WAAWa,QAAQ,IAAIT,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACnD,MAAMmC,cAAczC,eAAe;YACjC0C,UAAUzB,OAAO0B,MAAM,CAACC,GAAG;YAC3BzB,MAAM;QACR;QAEA,IAAI,CAACb,SAASuC,UAAU,CAACJ,cAAc;YACrC,OAAOrC,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAIwC,mBAAmBxC,SAASyC,OAAO,CAACN,aAAa;QAErD,IAAIO,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAeb,QAAQc,OAAO,CAACrC,MAAM,CAACsC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAIZ,QAAQkB,WAAW,CAACN,WAAW,EAAE;gBAC1C7B,aAAaiB,QAAQkB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC1C,OAAO0C,SAAS;QAEpD,IAAIpC,YAAY;YACdoC,YAAYpC,WAAWN,MAAM,CAAC0C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAExB,WAAWN,MAAM,CAACwC,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOpD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAImB,MAAM,EAAEoC,cAAc,CAAC,EAAEvD,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASX,gBAAgB;oBACvBW,SAAS,IAAIC;oBACbR;gBACF;gBACAT,QAAQC,WAAWgE,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAAStC,MAAM,KAAKnB,IAAImB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMsC,cAAcjE,MAAMgE,SAAS3C,IAAI,EAAE;gBAAE6C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEA7D,IAAI8D,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI7C,YAAY;gBACdlB,IAAI8D,WAAW,CAAC5C,UAAU,GAAGA,WAAWN,MAAM,CAACwC,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBhD,IAAI8D,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZxC,UAAUwC,SAASxC,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIjB,IAAImB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOlB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASX,gBAAgB;wBACvBW,SAAS,IAAIC;wBACbR;oBACF;oBACAT,QAAQ;gBACV;YAEJ;YAEA,OAAOQ,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMgC,WAAW,MAAMhB,QAAQjB;QAE/B,OAAO,IAAIE,SAAS+B,SAASgC,IAAI,EAAE;YACjC1D,SAASX,gBAAgB;gBACvBW,SAASV,aAAaG,IAAIkE,eAAe,IAAI,IAAI1D,WAAWyB,SAAS1B,OAAO;gBAC5EP;YACF;YACAT,QAAQ0C,SAAS1C,MAAM;YACvB4E,YAAYlC,SAASkC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOtE,WAAW;YAChBoB;YACAN,QAAQC;YACRwD;YACArE,KAAKA;QACP;IACF;AACF,EAAC"}

package/dist/utilities/parseParams/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/parseParams/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAS1D,MAAM,MAAM,SAAS,GAAG;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,eAAO,MAAM,aAAa,UAOzB,CAAA;AAED,eAAO,MAAM,YAAY,UAA6B,CAAA;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WAAY,SAAS,KAAG,YA2C/C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/parseParams/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAS1D,MAAM,MAAM,SAAS,GAAG;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,eAAO,MAAM,aAAa,UASzB,CAAA;AAED,eAAO,MAAM,YAAY,UAA6B,CAAA;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WAAY,SAAS,KAAG,YA2C/C,CAAA"}

package/dist/utilities/parseParams/index.js

@@ -10,7 +10,9 @@ export const booleanParams = [
     'trash',
     'overrideLock',
     'pagination',
-    'flattenLocales'
+    'flattenLocales',
+    'publishAllLocales',
+    'unpublishAllLocales'
 ];
 export const numberParams = [
     'depth',

package/dist/utilities/parseParams/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utilities/parseParams/index.ts"],"sourcesContent":["import type { JoinQuery, PopulateType, SelectType, Where } from '../../types/index.js'\nimport type { JoinParams } from '../sanitizeJoinParams.js'\n\nimport { isNumber } from '../isNumber.js'\nimport { parseBooleanString } from '../parseBooleanString.js'\nimport { sanitizeJoinParams } from '../sanitizeJoinParams.js'\nimport { sanitizePopulateParam } from '../sanitizePopulateParam.js'\nimport { sanitizeSelectParam } from '../sanitizeSelectParam.js'\nimport { sanitizeSortParams } from '../sanitizeSortParams.js'\n\nexport type RawParams = {\n  [key: string]: unknown\n  autosave?: string\n  data?: string\n  depth?: string\n  draft?: string\n  field?: string\n  flattenLocales?: string\n  joins?: JoinParams\n  limit?: string\n  overrideLock?: string\n  page?: string\n  pagination?: string\n  populate?: unknown\n  publishAllLocales?: string\n  publishSpecificLocale?: string\n  select?: unknown\n  selectedLocales?: string\n  sort?: string | string[]\n  trash?: string\n  unpublishAllLocales?: string\n  where?: string | Where\n}\n\nexport type ParsedParams = {\n  autosave?: boolean\n  data?: Record<string, unknown>\n  depth?: number\n  draft?: boolean\n  field?: string\n  flattenLocales?: boolean\n  joins?: JoinQuery\n  limit?: number\n  overrideLock?: boolean\n  page?: number\n  pagination?: boolean\n  populate?: PopulateType\n  publishAllLocales?: boolean\n  publishSpecificLocale?: string\n  select?: SelectType\n  selectedLocales?: string[]\n  sort?: string[]\n  trash?: boolean\n  unpublishAllLocales?: boolean\n  where?: Where\n} & Record<string, unknown>\n\nexport const booleanParams = [\n  'autosave',\n  'draft',\n  'trash',\n  'overrideLock',\n  'pagination',\n  'flattenLocales',\n]\n\nexport const numberParams = ['depth', 'limit', 'page']\n\n/**\n * Takes raw query parameters and parses them into the correct types that Payload expects.\n * Examples:\n *   a. `draft` provided as a string of \"true\" is converted to a boolean\n *   b. `depth` provided as a string of \"0\" is converted to a number\n *   c. `sort` provided as a comma-separated string or array is converted to an array of strings\n */\nexport const parseParams = (params: RawParams): ParsedParams => {\n  const parsedParams = (params || {}) as ParsedParams\n\n  // iterate through known params to make this very fast\n  for (const key of booleanParams) {\n    if (key in params) {\n      parsedParams[key] = parseBooleanString(params[key] as boolean | string)\n    }\n  }\n\n  for (const key of numberParams) {\n    if (key in params) {\n      if (isNumber(params[key])) {\n        parsedParams[key] = Number(params[key])\n      }\n    }\n  }\n\n  if ('populate' in params) {\n    parsedParams.populate = sanitizePopulateParam(params.populate)\n  }\n\n  if ('select' in params) {\n    parsedParams.select = sanitizeSelectParam(params.select)\n  }\n\n  if ('joins' in params) {\n    parsedParams.joins = sanitizeJoinParams(params.joins as JoinParams)\n  }\n\n  if ('sort' in params) {\n    parsedParams.sort = sanitizeSortParams(params.sort)\n  }\n\n  if ('data' in params && typeof params.data === 'string' && params.data.length > 0) {\n    parsedParams.data = JSON.parse(params.data)\n  }\n\n  if ('where' in params && typeof params.where === 'string' && params.where.length > 0) {\n    parsedParams.where = JSON.parse(params.where) as Where\n  }\n\n  return parsedParams\n}\n"],"names":["isNumber","parseBooleanString","sanitizeJoinParams","sanitizePopulateParam","sanitizeSelectParam","sanitizeSortParams","booleanParams","numberParams","parseParams","params","parsedParams","key","Number","populate","select","joins","sort","data","length","JSON","parse","where"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,iBAAgB;AACzC,SAASC,kBAAkB,QAAQ,2BAA0B;AAC7D,SAASC,kBAAkB,QAAQ,2BAA0B;AAC7D,SAASC,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,kBAAkB,QAAQ,2BAA0B;AAiD7D,OAAO,MAAMC,gBAAgB;IAC3B;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED,OAAO,MAAMC,eAAe;IAAC;IAAS;IAAS;CAAO,CAAA;AAEtD;;;;;;CAMC,GACD,OAAO,MAAMC,cAAc,CAACC;IAC1B,MAAMC,eAAgBD,UAAU,CAAC;IAEjC,sDAAsD;IACtD,KAAK,MAAME,OAAOL,cAAe;QAC/B,IAAIK,OAAOF,QAAQ;YACjBC,YAAY,CAACC,IAAI,GAAGV,mBAAmBQ,MAAM,CAACE,IAAI;QACpD;IACF;IAEA,KAAK,MAAMA,OAAOJ,aAAc;QAC9B,IAAII,OAAOF,QAAQ;YACjB,IAAIT,SAASS,MAAM,CAACE,IAAI,GAAG;gBACzBD,YAAY,CAACC,IAAI,GAAGC,OAAOH,MAAM,CAACE,IAAI;YACxC;QACF;IACF;IAEA,IAAI,cAAcF,QAAQ;QACxBC,aAAaG,QAAQ,GAAGV,sBAAsBM,OAAOI,QAAQ;IAC/D;IAEA,IAAI,YAAYJ,QAAQ;QACtBC,aAAaI,MAAM,GAAGV,oBAAoBK,OAAOK,MAAM;IACzD;IAEA,IAAI,WAAWL,QAAQ;QACrBC,aAAaK,KAAK,GAAGb,mBAAmBO,OAAOM,KAAK;IACtD;IAEA,IAAI,UAAUN,QAAQ;QACpBC,aAAaM,IAAI,GAAGX,mBAAmBI,OAAOO,IAAI;IACpD;IAEA,IAAI,UAAUP,UAAU,OAAOA,OAAOQ,IAAI,KAAK,YAAYR,OAAOQ,IAAI,CAACC,MAAM,GAAG,GAAG;QACjFR,aAAaO,IAAI,GAAGE,KAAKC,KAAK,CAACX,OAAOQ,IAAI;IAC5C;IAEA,IAAI,WAAWR,UAAU,OAAOA,OAAOY,KAAK,KAAK,YAAYZ,OAAOY,KAAK,CAACH,MAAM,GAAG,GAAG;QACpFR,aAAaW,KAAK,GAAGF,KAAKC,KAAK,CAACX,OAAOY,KAAK;IAC9C;IAEA,OAAOX;AACT,EAAC"}
+{"version":3,"sources":["../../../src/utilities/parseParams/index.ts"],"sourcesContent":["import type { JoinQuery, PopulateType, SelectType, Where } from '../../types/index.js'\nimport type { JoinParams } from '../sanitizeJoinParams.js'\n\nimport { isNumber } from '../isNumber.js'\nimport { parseBooleanString } from '../parseBooleanString.js'\nimport { sanitizeJoinParams } from '../sanitizeJoinParams.js'\nimport { sanitizePopulateParam } from '../sanitizePopulateParam.js'\nimport { sanitizeSelectParam } from '../sanitizeSelectParam.js'\nimport { sanitizeSortParams } from '../sanitizeSortParams.js'\n\nexport type RawParams = {\n  [key: string]: unknown\n  autosave?: string\n  data?: string\n  depth?: string\n  draft?: string\n  field?: string\n  flattenLocales?: string\n  joins?: JoinParams\n  limit?: string\n  overrideLock?: string\n  page?: string\n  pagination?: string\n  populate?: unknown\n  publishAllLocales?: string\n  publishSpecificLocale?: string\n  select?: unknown\n  selectedLocales?: string\n  sort?: string | string[]\n  trash?: string\n  unpublishAllLocales?: string\n  where?: string | Where\n}\n\nexport type ParsedParams = {\n  autosave?: boolean\n  data?: Record<string, unknown>\n  depth?: number\n  draft?: boolean\n  field?: string\n  flattenLocales?: boolean\n  joins?: JoinQuery\n  limit?: number\n  overrideLock?: boolean\n  page?: number\n  pagination?: boolean\n  populate?: PopulateType\n  publishAllLocales?: boolean\n  publishSpecificLocale?: string\n  select?: SelectType\n  selectedLocales?: string[]\n  sort?: string[]\n  trash?: boolean\n  unpublishAllLocales?: boolean\n  where?: Where\n} & Record<string, unknown>\n\nexport const booleanParams = [\n  'autosave',\n  'draft',\n  'trash',\n  'overrideLock',\n  'pagination',\n  'flattenLocales',\n  'publishAllLocales',\n  'unpublishAllLocales',\n]\n\nexport const numberParams = ['depth', 'limit', 'page']\n\n/**\n * Takes raw query parameters and parses them into the correct types that Payload expects.\n * Examples:\n *   a. `draft` provided as a string of \"true\" is converted to a boolean\n *   b. `depth` provided as a string of \"0\" is converted to a number\n *   c. `sort` provided as a comma-separated string or array is converted to an array of strings\n */\nexport const parseParams = (params: RawParams): ParsedParams => {\n  const parsedParams = (params || {}) as ParsedParams\n\n  // iterate through known params to make this very fast\n  for (const key of booleanParams) {\n    if (key in params) {\n      parsedParams[key] = parseBooleanString(params[key] as boolean | string)\n    }\n  }\n\n  for (const key of numberParams) {\n    if (key in params) {\n      if (isNumber(params[key])) {\n        parsedParams[key] = Number(params[key])\n      }\n    }\n  }\n\n  if ('populate' in params) {\n    parsedParams.populate = sanitizePopulateParam(params.populate)\n  }\n\n  if ('select' in params) {\n    parsedParams.select = sanitizeSelectParam(params.select)\n  }\n\n  if ('joins' in params) {\n    parsedParams.joins = sanitizeJoinParams(params.joins as JoinParams)\n  }\n\n  if ('sort' in params) {\n    parsedParams.sort = sanitizeSortParams(params.sort)\n  }\n\n  if ('data' in params && typeof params.data === 'string' && params.data.length > 0) {\n    parsedParams.data = JSON.parse(params.data)\n  }\n\n  if ('where' in params && typeof params.where === 'string' && params.where.length > 0) {\n    parsedParams.where = JSON.parse(params.where) as Where\n  }\n\n  return parsedParams\n}\n"],"names":["isNumber","parseBooleanString","sanitizeJoinParams","sanitizePopulateParam","sanitizeSelectParam","sanitizeSortParams","booleanParams","numberParams","parseParams","params","parsedParams","key","Number","populate","select","joins","sort","data","length","JSON","parse","where"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,iBAAgB;AACzC,SAASC,kBAAkB,QAAQ,2BAA0B;AAC7D,SAASC,kBAAkB,QAAQ,2BAA0B;AAC7D,SAASC,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,kBAAkB,QAAQ,2BAA0B;AAiD7D,OAAO,MAAMC,gBAAgB;IAC3B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED,OAAO,MAAMC,eAAe;IAAC;IAAS;IAAS;CAAO,CAAA;AAEtD;;;;;;CAMC,GACD,OAAO,MAAMC,cAAc,CAACC;IAC1B,MAAMC,eAAgBD,UAAU,CAAC;IAEjC,sDAAsD;IACtD,KAAK,MAAME,OAAOL,cAAe;QAC/B,IAAIK,OAAOF,QAAQ;YACjBC,YAAY,CAACC,IAAI,GAAGV,mBAAmBQ,MAAM,CAACE,IAAI;QACpD;IACF;IAEA,KAAK,MAAMA,OAAOJ,aAAc;QAC9B,IAAII,OAAOF,QAAQ;YACjB,IAAIT,SAASS,MAAM,CAACE,IAAI,GAAG;gBACzBD,YAAY,CAACC,IAAI,GAAGC,OAAOH,MAAM,CAACE,IAAI;YACxC;QACF;IACF;IAEA,IAAI,cAAcF,QAAQ;QACxBC,aAAaG,QAAQ,GAAGV,sBAAsBM,OAAOI,QAAQ;IAC/D;IAEA,IAAI,YAAYJ,QAAQ;QACtBC,aAAaI,MAAM,GAAGV,oBAAoBK,OAAOK,MAAM;IACzD;IAEA,IAAI,WAAWL,QAAQ;QACrBC,aAAaK,KAAK,GAAGb,mBAAmBO,OAAOM,KAAK;IACtD;IAEA,IAAI,UAAUN,QAAQ;QACpBC,aAAaM,IAAI,GAAGX,mBAAmBI,OAAOO,IAAI;IACpD;IAEA,IAAI,UAAUP,UAAU,OAAOA,OAAOQ,IAAI,KAAK,YAAYR,OAAOQ,IAAI,CAACC,MAAM,GAAG,GAAG;QACjFR,aAAaO,IAAI,GAAGE,KAAKC,KAAK,CAACX,OAAOQ,IAAI;IAC5C;IAEA,IAAI,WAAWR,UAAU,OAAOA,OAAOY,KAAK,KAAK,YAAYZ,OAAOY,KAAK,CAACH,MAAM,GAAG,GAAG;QACpFR,aAAaW,KAAK,GAAGF,KAAKC,KAAK,CAACX,OAAOY,KAAK;IAC9C;IAEA,OAAOX;AACT,EAAC"}

package/dist/utilities/parseParams/index.spec.js

@@ -3,6 +3,14 @@ import { describe, it, expect } from 'vitest';
 import { parseParams, booleanParams, numberParams } from './index.js';
 describe('parseParams', ()=>{
     describe('boolean parameters', ()=>{
+        it('should parse disabled all-locale publication flags as false', ()=>{
+            const result = parseParams({
+                publishAllLocales: 'false',
+                unpublishAllLocales: 'false'
+            });
+            expect(result.publishAllLocales).toBe(false);
+            expect(result.unpublishAllLocales).toBe(false);
+        });
         booleanParams.forEach((param)=>{
             describe(param, ()=>{
                 it('should parse string "true" to boolean true', ()=>{