payload 3.89.0-internal.95c9cba → 3.90.0

package/dist/auth/operations/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAYpE,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,iBAAwB,SAAS,KAAG,OAAO,CAAC,MAAM,CAyK9E,CAAA"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAcpE,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,iBAAwB,SAAS,KAAG,OAAO,CAAC,MAAM,CA2L9E,CAAA"}

package/dist/auth/operations/refresh.js

@@ -1,9 +1,12 @@
+import { status as httpStatus } from 'http-status';
 import { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js';
 import { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js';
-import { Forbidden } from '../../errors/index.js';
+import { APIError, Forbidden, NotFound } from '../../errors/index.js';
+import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js';
 import { commitTransaction } from '../../utilities/commitTransaction.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
+import { applyUserReadAccess } from '../applyUserReadAccess.js';
 import { getFieldsToSign } from '../getFieldsToSign.js';
 import { jwtSign } from '../jwt.js';
 import { removeExpiredSessions } from '../sessions.js';
@@ -27,6 +30,9 @@ export const refreshOperation = async (incomingArgs)=>{
         if (!args.req.user) {
             throw new Forbidden(args.req.t);
         }
+        if (args.req.user.collection !== collectionConfig.slug) {
+            throw new APIError('Incorrect collection', httpStatus.FORBIDDEN);
+        }
         const pathname = new URL(args.req.url).pathname;
         const isGraphQL = pathname === config.routes.graphQL;
         let user = await req.payload.db.findOne({
@@ -60,16 +66,25 @@ export const refreshOperation = async (incomingArgs)=>{
                 returning: false
             });
         }
-        user = await req.payload.findByID({
-            id: user.id,
+        user = await req.payload.db.findOne({
             collection: collectionConfig.slug,
-            depth: isGraphQL ? 0 : args.collection.config.auth.depth,
-            req: args.req
+            locale: req.locale ?? undefined,
+            req,
+            where: appendNonTrashedFilter({
+                enableTrash: Boolean(collectionConfig.trash),
+                trash: false,
+                where: {
+                    id: {
+                        equals: user.id
+                    }
+                }
+            })
         });
-        if (user) {
-            user.collection = args.req.user.collection;
-            user._strategy = args.req.user._strategy;
+        if (!user) {
+            throw new NotFound(req.t);
         }
+        user.collection = args.req.user.collection;
+        user._strategy = args.req.user._strategy;
         let result;
         // /////////////////////////////////////
         // refresh hook - Collection
@@ -89,7 +104,7 @@ export const refreshOperation = async (incomingArgs)=>{
                 collectionConfig,
                 email: user?.email,
                 sid,
-                user: args?.req?.user
+                user: args.req.user
             });
             const { exp, token: refreshedToken } = await jwtSign({
                 fieldsToSign,
@@ -109,6 +124,14 @@ export const refreshOperation = async (incomingArgs)=>{
                 user
             };
         }
+        result.user = await applyUserReadAccess({
+            collection: collectionConfig,
+            depth: isGraphQL ? 0 : collectionConfig.auth.depth,
+            overrideAccess: false,
+            req,
+            showHiddenFields: false,
+            user: result.user
+        });
         // /////////////////////////////////////
         // After Refresh - Collection
         // /////////////////////////////////////

package/dist/auth/operations/refresh.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { Forbidden } from '../../errors/index.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n  exp: number\n  refreshedToken: string\n  setCookie?: boolean\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  user: Document\n}\n\nexport type Arguments = {\n  collection: Collection\n  req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n  let args = incomingArgs\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'refresh',\n      overrideAccess: false,\n    })\n\n    // /////////////////////////////////////\n    // Refresh\n    // /////////////////////////////////////\n\n    const {\n      collection: { config: collectionConfig },\n      req,\n      req: {\n        payload: { config, secret },\n      },\n    } = args\n\n    if (!args.req.user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const pathname = new URL(args.req.url!).pathname\n\n    const isGraphQL = pathname === config.routes.graphQL\n\n    let user = await req.payload.db.findOne<any>({\n      collection: collectionConfig.slug,\n      req,\n      where: { id: { equals: args.req.user.id } },\n    })\n\n    const sid = args.req.user._sid\n\n    if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n      if (!Array.isArray(user.sessions) || !sid) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const existingSession = user.sessions.find(({ id }: { id: number }) => id === sid)\n\n      const now = new Date()\n      const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n      existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n      // Prevent updatedAt from being updated when only refreshing a session\n      user.updatedAt = null\n\n      await req.payload.db.updateOne({\n        id: user.id,\n        collection: collectionConfig.slug,\n        data: {\n          ...user,\n          sessions: removeExpiredSessions(user.sessions),\n        },\n        req,\n        returning: false,\n      })\n    }\n\n    user = await req.payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth: isGraphQL ? 0 : args.collection.config.auth.depth,\n      req: args.req,\n    })\n\n    if (user) {\n      user.collection = args.req.user.collection\n      user._strategy = args.req.user._strategy\n    }\n\n    let result!: Result\n\n    // /////////////////////////////////////\n    // refresh hook - Collection\n    // /////////////////////////////////////\n\n    for (const refreshHook of args.collection.config.hooks.refresh) {\n      const hookResult = await refreshHook({ args, user })\n\n      if (hookResult) {\n        result = hookResult\n        break\n      }\n    }\n\n    if (!result) {\n      const fieldsToSign = getFieldsToSign({\n        collectionConfig,\n        email: user?.email as string,\n        sid,\n        user: args?.req?.user,\n      })\n\n      const { exp, token: refreshedToken } = await jwtSign({\n        fieldsToSign,\n        secret,\n        tokenExpiration: collectionConfig.auth.tokenExpiration,\n      })\n\n      result = {\n        exp,\n        refreshedToken,\n        setCookie: true,\n        /** @deprecated\n         * use:\n         * ```ts\n         * user._strategy\n         * ```\n         */\n        strategy: args.req.user._strategy,\n        user,\n      }\n    }\n\n    // /////////////////////////////////////\n    // After Refresh - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRefresh?.length) {\n      for (const hook of collectionConfig.hooks.afterRefresh) {\n        result =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            exp: result.exp,\n            req: args.req,\n            token: result.refreshedToken,\n          })) || result\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'refresh',\n      overrideAccess: false,\n      result,\n    })\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","Forbidden","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","slug","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updatedAt","updateOne","data","returning","findByID","depth","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","strategy","afterRefresh","length","hook","context","error"],"mappings":"AAGA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AAqBtD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMR,gBAAgBO,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMV,qBAAqB;YAChCU;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMC,WAAW,IAAIC,IAAIb,KAAKE,GAAG,CAACY,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaR,OAAOY,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMR,IAAIM,OAAO,CAACU,EAAE,CAACC,OAAO,CAAM;YAC3ChB,YAAYI,iBAAiBa,IAAI;YACjClB;YACAmB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQvB,KAAKE,GAAG,CAACQ,IAAI,CAACY,EAAE;gBAAC;YAAE;QAC5C;QAEA,MAAME,MAAMxB,KAAKE,GAAG,CAACQ,IAAI,CAACe,IAAI;QAE9B,IAAIlB,iBAAiBmB,IAAI,CAACC,WAAW,IAAI,CAACpB,iBAAiBmB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACpB,KAAKqB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIjC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMqB,kBAAkBtB,KAAKqB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAkB,GAAKA,OAAOE;YAE9E,MAAMU,MAAM,IAAIC;YAChB,MAAMC,eAAe7B,iBAAiBmB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,sEAAsE;YACtE1B,KAAK8B,SAAS,GAAG;YAEjB,MAAMtC,IAAIM,OAAO,CAACU,EAAE,CAACuB,SAAS,CAAC;gBAC7BnB,IAAIZ,KAAKY,EAAE;gBACXnB,YAAYI,iBAAiBa,IAAI;gBACjCsB,MAAM;oBACJ,GAAGhC,IAAI;oBACPqB,UAAUlC,sBAAsBa,KAAKqB,QAAQ;gBAC/C;gBACA7B;gBACAyC,WAAW;YACb;QACF;QAEAjC,OAAO,MAAMR,IAAIM,OAAO,CAACoC,QAAQ,CAAC;YAChCtB,IAAIZ,KAAKY,EAAE;YACXnB,YAAYI,iBAAiBa,IAAI;YACjCyB,OAAO9B,YAAY,IAAIf,KAAKG,UAAU,CAACC,MAAM,CAACsB,IAAI,CAACmB,KAAK;YACxD3C,KAAKF,KAAKE,GAAG;QACf;QAEA,IAAIQ,MAAM;YACRA,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;YAC1CO,KAAKoC,SAAS,GAAG9C,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;QAC1C;QAEA,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAehD,KAAKG,UAAU,CAACC,MAAM,CAAC6C,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEhD;gBAAMU;YAAK;YAElD,IAAIyC,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAezD,gBAAgB;gBACnCY;gBACA8C,OAAO3C,MAAM2C;gBACb7B;gBACAd,MAAMV,MAAME,KAAKQ;YACnB;YAEA,MAAM,EAAE4C,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAM5D,QAAQ;gBACnDwD;gBACA3C;gBACA4B,iBAAiB9B,iBAAiBmB,IAAI,CAACW,eAAe;YACxD;YAEAU,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX;;;;;SAKC,GACDC,UAAU1D,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;gBACjCpC;YACF;QACF;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB0C,KAAK,EAAEU,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQtD,iBAAiB0C,KAAK,CAACU,YAAY,CAAE;gBACtDZ,SACE,AAAC,MAAMc,KAAK;oBACV1D,YAAYH,KAAKG,UAAU,EAAEC;oBAC7B0D,SAAS9D,KAAKE,GAAG,CAAC4D,OAAO;oBACzBR,KAAKP,OAAOO,GAAG;oBACfpD,KAAKF,KAAKE,GAAG;oBACbqD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAM1D,oBAAoB;YACjCW;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChByC;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAI9C,cAAc;YAChB,MAAMT,kBAAkBU;QAC1B;QAEA,OAAO6C;IACT,EAAE,OAAOgB,OAAgB;QACvB,MAAMrE,gBAAgBM,KAAKE,GAAG;QAC9B,MAAM6D;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden, NotFound } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n  exp: number\n  refreshedToken: string\n  setCookie?: boolean\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  user: Document\n}\n\nexport type Arguments = {\n  collection: Collection\n  req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n  let args = incomingArgs\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'refresh',\n      overrideAccess: false,\n    })\n\n    // /////////////////////////////////////\n    // Refresh\n    // /////////////////////////////////////\n\n    const {\n      collection: { config: collectionConfig },\n      req,\n      req: {\n        payload: { config, secret },\n      },\n    } = args\n\n    if (!args.req.user) {\n      throw new Forbidden(args.req.t)\n    }\n    if (args.req.user.collection !== collectionConfig.slug) {\n      throw new APIError('Incorrect collection', httpStatus.FORBIDDEN)\n    }\n\n    const pathname = new URL(args.req.url!).pathname\n\n    const isGraphQL = pathname === config.routes.graphQL\n\n    let user = await req.payload.db.findOne<any>({\n      collection: collectionConfig.slug,\n      req,\n      where: { id: { equals: args.req.user.id } },\n    })\n\n    const sid = args.req.user._sid\n\n    if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n      if (!Array.isArray(user.sessions) || !sid) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const existingSession = user.sessions.find(({ id }: { id: number }) => id === sid)\n\n      const now = new Date()\n      const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n      existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n      // Prevent updatedAt from being updated when only refreshing a session\n      user.updatedAt = null\n\n      await req.payload.db.updateOne({\n        id: user.id,\n        collection: collectionConfig.slug,\n        data: {\n          ...user,\n          sessions: removeExpiredSessions(user.sessions),\n        },\n        req,\n        returning: false,\n      })\n    }\n\n    user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: req.locale ?? undefined,\n      req,\n      where: appendNonTrashedFilter({\n        enableTrash: Boolean(collectionConfig.trash),\n        trash: false,\n        where: { id: { equals: user.id } },\n      }),\n    })\n\n    if (!user) {\n      throw new NotFound(req.t)\n    }\n\n    user.collection = args.req.user.collection\n    user._strategy = args.req.user._strategy\n\n    let result!: Result\n\n    // /////////////////////////////////////\n    // refresh hook - Collection\n    // /////////////////////////////////////\n\n    for (const refreshHook of args.collection.config.hooks.refresh) {\n      const hookResult = await refreshHook({ args, user })\n\n      if (hookResult) {\n        result = hookResult\n        break\n      }\n    }\n\n    if (!result) {\n      const fieldsToSign = getFieldsToSign({\n        collectionConfig,\n        email: user?.email as string,\n        sid,\n        user: args.req.user,\n      })\n\n      const { exp, token: refreshedToken } = await jwtSign({\n        fieldsToSign,\n        secret,\n        tokenExpiration: collectionConfig.auth.tokenExpiration,\n      })\n\n      result = {\n        exp,\n        refreshedToken,\n        setCookie: true,\n        /** @deprecated\n         * use:\n         * ```ts\n         * user._strategy\n         * ```\n         */\n        strategy: args.req.user._strategy,\n        user,\n      }\n    }\n\n    result.user = await applyUserReadAccess({\n      collection: collectionConfig,\n      depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n      overrideAccess: false,\n      req,\n      showHiddenFields: false,\n      user: result.user,\n    })\n\n    // /////////////////////////////////////\n    // After Refresh - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRefresh?.length) {\n      for (const hook of collectionConfig.hooks.afterRefresh) {\n        result =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            exp: result.exp,\n            req: args.req,\n            token: result.refreshedToken,\n          })) || result\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'refresh',\n      overrideAccess: false,\n      result,\n    })\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","NotFound","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","applyUserReadAccess","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","slug","FORBIDDEN","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updatedAt","updateOne","data","returning","locale","undefined","enableTrash","Boolean","trash","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","strategy","depth","showHiddenFields","afterRefresh","length","hook","context","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAKlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,EAAEC,QAAQ,QAAQ,wBAAuB;AACrE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AAqBtD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMT,gBAAgBQ,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMd,qBAAqB;YAChCc;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAItB,UAAUY,KAAKE,GAAG,CAACS,CAAC;QAChC;QACA,IAAIX,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU,KAAKI,iBAAiBK,IAAI,EAAE;YACtD,MAAM,IAAIzB,SAAS,wBAAwBH,WAAW6B,SAAS;QACjE;QAEA,MAAMC,WAAW,IAAIC,IAAIf,KAAKE,GAAG,CAACc,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaV,OAAOc,MAAM,CAACC,OAAO;QAEpD,IAAIT,OAAO,MAAMR,IAAIM,OAAO,CAACY,EAAE,CAACC,OAAO,CAAM;YAC3ClB,YAAYI,iBAAiBK,IAAI;YACjCV;YACAoB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQxB,KAAKE,GAAG,CAACQ,IAAI,CAACa,EAAE;gBAAC;YAAE;QAC5C;QAEA,MAAME,MAAMzB,KAAKE,GAAG,CAACQ,IAAI,CAACgB,IAAI;QAE9B,IAAInB,iBAAiBoB,IAAI,CAACC,WAAW,IAAI,CAACrB,iBAAiBoB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACrB,KAAKsB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIrC,UAAUY,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMsB,kBAAkBvB,KAAKsB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAkB,GAAKA,OAAOE;YAE9E,MAAMU,MAAM,IAAIC;YAChB,MAAMC,eAAe9B,iBAAiBoB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,sEAAsE;YACtE3B,KAAK+B,SAAS,GAAG;YAEjB,MAAMvC,IAAIM,OAAO,CAACY,EAAE,CAACsB,SAAS,CAAC;gBAC7BnB,IAAIb,KAAKa,EAAE;gBACXpB,YAAYI,iBAAiBK,IAAI;gBACjC+B,MAAM;oBACJ,GAAGjC,IAAI;oBACPsB,UAAUnC,sBAAsBa,KAAKsB,QAAQ;gBAC/C;gBACA9B;gBACA0C,WAAW;YACb;QACF;QAEAlC,OAAO,MAAMR,IAAIM,OAAO,CAACY,EAAE,CAACC,OAAO,CAAC;YAClClB,YAAYI,iBAAiBK,IAAI;YACjCiC,QAAQ3C,IAAI2C,MAAM,IAAIC;YACtB5C;YACAoB,OAAOhC,uBAAuB;gBAC5ByD,aAAaC,QAAQzC,iBAAiB0C,KAAK;gBAC3CA,OAAO;gBACP3B,OAAO;oBAAEC,IAAI;wBAAEC,QAAQd,KAAKa,EAAE;oBAAC;gBAAE;YACnC;QACF;QAEA,IAAI,CAACb,MAAM;YACT,MAAM,IAAIrB,SAASa,IAAIS,CAAC;QAC1B;QAEAD,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;QAC1CO,KAAKwC,SAAS,GAAGlD,KAAKE,GAAG,CAACQ,IAAI,CAACwC,SAAS;QAExC,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAepD,KAAKG,UAAU,CAACC,MAAM,CAACiD,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEpD;gBAAMU;YAAK;YAElD,IAAI6C,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAe7D,gBAAgB;gBACnCY;gBACAkD,OAAO/C,MAAM+C;gBACbhC;gBACAf,MAAMV,KAAKE,GAAG,CAACQ,IAAI;YACrB;YAEA,MAAM,EAAEgD,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAMhE,QAAQ;gBACnD4D;gBACA/C;gBACA6B,iBAAiB/B,iBAAiBoB,IAAI,CAACW,eAAe;YACxD;YAEAa,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX;;;;;SAKC,GACDC,UAAU9D,KAAKE,GAAG,CAACQ,IAAI,CAACwC,SAAS;gBACjCxC;YACF;QACF;QAEAyC,OAAOzC,IAAI,GAAG,MAAMhB,oBAAoB;YACtCS,YAAYI;YACZwD,OAAO9C,YAAY,IAAIV,iBAAiBoB,IAAI,CAACoC,KAAK;YAClDzD,gBAAgB;YAChBJ;YACA8D,kBAAkB;YAClBtD,MAAMyC,OAAOzC,IAAI;QACnB;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB8C,KAAK,EAAEY,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQ5D,iBAAiB8C,KAAK,CAACY,YAAY,CAAE;gBACtDd,SACE,AAAC,MAAMgB,KAAK;oBACVhE,YAAYH,KAAKG,UAAU,EAAEC;oBAC7BgE,SAASpE,KAAKE,GAAG,CAACkE,OAAO;oBACzBV,KAAKP,OAAOO,GAAG;oBACfxD,KAAKF,KAAKE,GAAG;oBACbyD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAMlE,oBAAoB;YACjCe;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChB6C;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAIlD,cAAc;YAChB,MAAMV,kBAAkBW;QAC1B;QAEA,OAAOiD;IACT,EAAE,OAAOkB,OAAgB;QACvB,MAAM5E,gBAAgBO,KAAKE,GAAG;QAC9B,MAAMmE;IACR;AACF,EAAC"}

package/dist/auth/operations/registerFirstUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registerFirstUser.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/registerFirstUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACV,sBAAsB,EACtB,8BAA8B,EAC/B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,sBAAsB,CAAA;AAStE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,GAChE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAU,KAAK,SAAS,kBAAkB,QACzE,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CA8F/C,CAAA"}
+{"version":3,"file":"registerFirstUser.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/registerFirstUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACV,sBAAsB,EACtB,8BAA8B,EAC/B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,sBAAsB,CAAA;AAStE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,GAChE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAU,KAAK,SAAS,kBAAkB,QACzE,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CA4F/C,CAAA"}

package/dist/auth/operations/registerFirstUser.js

@@ -54,20 +54,19 @@ export const registerFirstUserOperation = async (args)=>{
         // /////////////////////////////////////
         // Log in new user
         // /////////////////////////////////////
-        const { exp, token } = await payload.login({
+        const { exp, token, user } = await payload.login({
             ...args,
             collection: slug,
+            overrideAccess: false,
             req
         });
-        result.collection = slug;
-        result._strategy = 'local-jwt';
         if (shouldCommit) {
             await commitTransaction(req);
         }
         return {
             exp,
             token,
-            user: result
+            user
         };
     } catch (error) {
         await killTransaction(req);

package/dist/auth/operations/registerFirstUser.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/registerFirstUser.ts"],"sourcesContent":["import type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n  DataFromCollectionSlug,\n  RequiredDataFromCollectionSlug,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, SelectType } from '../../types/index.js'\n\nimport { Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { ensureUsernameOrEmail } from '../ensureUsernameOrEmail.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['registerFirstUser'] &\n    RequiredDataFromCollectionSlug<TSlug>\n  req: PayloadRequest\n}\n\nexport type Result<TData> = {\n  exp?: number\n  token?: string\n  user?: TData\n}\n\nexport const registerFirstUserOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<Result<DataFromCollectionSlug<TSlug>>> => {\n  const {\n    collection: {\n      config,\n      config: {\n        slug,\n        auth: { verify },\n      },\n    },\n    data,\n    req,\n    req: { payload },\n  } = args\n\n  if (config.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    ensureUsernameOrEmail<TSlug>({\n      authOptions: config.auth,\n      collectionSlug: slug,\n      data,\n      operation: 'create',\n      req,\n    })\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(config.trash),\n      trash: false,\n      where: {}, // no initial filter; just exclude trashed docs\n    })\n\n    const doc = await payload.db.findOne({\n      collection: config.slug,\n      req,\n      where,\n    })\n\n    if (doc) {\n      throw new Forbidden(req.t)\n    }\n\n    // /////////////////////////////////////\n    // Register first user\n    // /////////////////////////////////////\n\n    const result = await payload.create<TSlug, SelectType>({\n      collection: slug as TSlug,\n      data,\n      overrideAccess: true,\n      req,\n    })\n\n    // auto-verify (if applicable)\n    if (verify) {\n      await payload.update({\n        id: result.id,\n        collection: slug,\n        data: {\n          _verified: true,\n        },\n        req,\n      })\n    }\n\n    // /////////////////////////////////////\n    // Log in new user\n    // /////////////////////////////////////\n\n    const { exp, token } = await payload.login({\n      ...args,\n      collection: slug,\n      req,\n    })\n\n    result.collection = slug\n    result._strategy = 'local-jwt'\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return {\n      exp,\n      token,\n      user: result,\n    }\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","ensureUsernameOrEmail","registerFirstUserOperation","args","collection","config","slug","auth","verify","data","req","payload","disableLocalStrategy","t","shouldCommit","authOptions","collectionSlug","operation","where","enableTrash","Boolean","trash","doc","db","findOne","result","create","overrideAccess","update","id","_verified","exp","token","login","_strategy","user","error"],"mappings":"AASA,SAASA,SAAS,QAAQ,wBAAuB;AACjD,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,8BAA6B;AAenE,OAAO,MAAMC,6BAA6B,OACxCC;IAEA,MAAM,EACJC,YAAY,EACVC,MAAM,EACNA,QAAQ,EACNC,IAAI,EACJC,MAAM,EAAEC,MAAM,EAAE,EACjB,EACF,EACDC,IAAI,EACJC,GAAG,EACHA,KAAK,EAAEC,OAAO,EAAE,EACjB,GAAGR;IAEJ,IAAIE,OAAOE,IAAI,CAACK,oBAAoB,EAAE;QACpC,MAAM,IAAIhB,UAAUc,IAAIG,CAAC;IAC3B;IAEA,IAAI;QACF,MAAMC,eAAe,MAAMf,gBAAgBW;QAE3CT,sBAA6B;YAC3Bc,aAAaV,OAAOE,IAAI;YACxBS,gBAAgBV;YAChBG;YACAQ,WAAW;YACXP;QACF;QAEA,MAAMQ,QAAQrB,uBAAuB;YACnCsB,aAAaC,QAAQf,OAAOgB,KAAK;YACjCA,OAAO;YACPH,OAAO,CAAC;QACV;QAEA,MAAMI,MAAM,MAAMX,QAAQY,EAAE,CAACC,OAAO,CAAC;YACnCpB,YAAYC,OAAOC,IAAI;YACvBI;YACAQ;QACF;QAEA,IAAII,KAAK;YACP,MAAM,IAAI1B,UAAUc,IAAIG,CAAC;QAC3B;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,MAAMY,SAAS,MAAMd,QAAQe,MAAM,CAAoB;YACrDtB,YAAYE;YACZG;YACAkB,gBAAgB;YAChBjB;QACF;QAEA,8BAA8B;QAC9B,IAAIF,QAAQ;YACV,MAAMG,QAAQiB,MAAM,CAAC;gBACnBC,IAAIJ,OAAOI,EAAE;gBACbzB,YAAYE;gBACZG,MAAM;oBACJqB,WAAW;gBACb;gBACApB;YACF;QACF;QAEA,wCAAwC;QACxC,kBAAkB;QAClB,wCAAwC;QAExC,MAAM,EAAEqB,GAAG,EAAEC,KAAK,EAAE,GAAG,MAAMrB,QAAQsB,KAAK,CAAC;YACzC,GAAG9B,IAAI;YACPC,YAAYE;YACZI;QACF;QAEAe,OAAOrB,UAAU,GAAGE;QACpBmB,OAAOS,SAAS,GAAG;QAEnB,IAAIpB,cAAc;YAChB,MAAMhB,kBAAkBY;QAC1B;QAEA,OAAO;YACLqB;YACAC;YACAG,MAAMV;QACR;IACF,EAAE,OAAOW,OAAgB;QACvB,MAAMpC,gBAAgBU;QACtB,MAAM0B;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/registerFirstUser.ts"],"sourcesContent":["import type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n  DataFromCollectionSlug,\n  RequiredDataFromCollectionSlug,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, SelectType } from '../../types/index.js'\n\nimport { Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { ensureUsernameOrEmail } from '../ensureUsernameOrEmail.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['registerFirstUser'] &\n    RequiredDataFromCollectionSlug<TSlug>\n  req: PayloadRequest\n}\n\nexport type Result<TData> = {\n  exp?: number\n  token?: string\n  user?: TData\n}\n\nexport const registerFirstUserOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<Result<DataFromCollectionSlug<TSlug>>> => {\n  const {\n    collection: {\n      config,\n      config: {\n        slug,\n        auth: { verify },\n      },\n    },\n    data,\n    req,\n    req: { payload },\n  } = args\n\n  if (config.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    ensureUsernameOrEmail<TSlug>({\n      authOptions: config.auth,\n      collectionSlug: slug,\n      data,\n      operation: 'create',\n      req,\n    })\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(config.trash),\n      trash: false,\n      where: {}, // no initial filter; just exclude trashed docs\n    })\n\n    const doc = await payload.db.findOne({\n      collection: config.slug,\n      req,\n      where,\n    })\n\n    if (doc) {\n      throw new Forbidden(req.t)\n    }\n\n    // /////////////////////////////////////\n    // Register first user\n    // /////////////////////////////////////\n\n    const result = await payload.create<TSlug, SelectType>({\n      collection: slug as TSlug,\n      data,\n      overrideAccess: true,\n      req,\n    })\n\n    // auto-verify (if applicable)\n    if (verify) {\n      await payload.update({\n        id: result.id,\n        collection: slug,\n        data: {\n          _verified: true,\n        },\n        req,\n      })\n    }\n\n    // /////////////////////////////////////\n    // Log in new user\n    // /////////////////////////////////////\n\n    const { exp, token, user } = await payload.login({\n      ...args,\n      collection: slug,\n      overrideAccess: false,\n      req,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return {\n      exp,\n      token,\n      user,\n    }\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","ensureUsernameOrEmail","registerFirstUserOperation","args","collection","config","slug","auth","verify","data","req","payload","disableLocalStrategy","t","shouldCommit","authOptions","collectionSlug","operation","where","enableTrash","Boolean","trash","doc","db","findOne","result","create","overrideAccess","update","id","_verified","exp","token","user","login","error"],"mappings":"AASA,SAASA,SAAS,QAAQ,wBAAuB;AACjD,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,8BAA6B;AAenE,OAAO,MAAMC,6BAA6B,OACxCC;IAEA,MAAM,EACJC,YAAY,EACVC,MAAM,EACNA,QAAQ,EACNC,IAAI,EACJC,MAAM,EAAEC,MAAM,EAAE,EACjB,EACF,EACDC,IAAI,EACJC,GAAG,EACHA,KAAK,EAAEC,OAAO,EAAE,EACjB,GAAGR;IAEJ,IAAIE,OAAOE,IAAI,CAACK,oBAAoB,EAAE;QACpC,MAAM,IAAIhB,UAAUc,IAAIG,CAAC;IAC3B;IAEA,IAAI;QACF,MAAMC,eAAe,MAAMf,gBAAgBW;QAE3CT,sBAA6B;YAC3Bc,aAAaV,OAAOE,IAAI;YACxBS,gBAAgBV;YAChBG;YACAQ,WAAW;YACXP;QACF;QAEA,MAAMQ,QAAQrB,uBAAuB;YACnCsB,aAAaC,QAAQf,OAAOgB,KAAK;YACjCA,OAAO;YACPH,OAAO,CAAC;QACV;QAEA,MAAMI,MAAM,MAAMX,QAAQY,EAAE,CAACC,OAAO,CAAC;YACnCpB,YAAYC,OAAOC,IAAI;YACvBI;YACAQ;QACF;QAEA,IAAII,KAAK;YACP,MAAM,IAAI1B,UAAUc,IAAIG,CAAC;QAC3B;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,MAAMY,SAAS,MAAMd,QAAQe,MAAM,CAAoB;YACrDtB,YAAYE;YACZG;YACAkB,gBAAgB;YAChBjB;QACF;QAEA,8BAA8B;QAC9B,IAAIF,QAAQ;YACV,MAAMG,QAAQiB,MAAM,CAAC;gBACnBC,IAAIJ,OAAOI,EAAE;gBACbzB,YAAYE;gBACZG,MAAM;oBACJqB,WAAW;gBACb;gBACApB;YACF;QACF;QAEA,wCAAwC;QACxC,kBAAkB;QAClB,wCAAwC;QAExC,MAAM,EAAEqB,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAG,MAAMtB,QAAQuB,KAAK,CAAC;YAC/C,GAAG/B,IAAI;YACPC,YAAYE;YACZqB,gBAAgB;YAChBjB;QACF;QAEA,IAAII,cAAc;YAChB,MAAMhB,kBAAkBY;QAC1B;QAEA,OAAO;YACLqB;YACAC;YACAC;QACF;IACF,EAAE,OAAOE,OAAgB;QACvB,MAAMnC,gBAAgBU;QACtB,MAAMyB;IACR;AACF,EAAC"}

package/dist/auth/operations/resetPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,mCAAmC,CAAA;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAa,MAAM,gBAAgB,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAe1D,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,QACrE,SAAS,KACd,OAAO,CAAC,MAAM,CA4NhB,CAAA"}
+{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,mCAAmC,CAAA;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAa,MAAM,gBAAgB,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAgB1D,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,QACrE,SAAS,KACd,OAAO,CAAC,MAAM,CAqOhB,CAAA"}

package/dist/auth/operations/resetPassword.js

@@ -6,13 +6,14 @@ import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.j
 import { commitTransaction } from '../../utilities/commitTransaction.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
+import { applyUserReadAccess } from '../applyUserReadAccess.js';
 import { getFieldsToSign } from '../getFieldsToSign.js';
 import { jwtSign } from '../jwt.js';
 import { addSessionToUser, revokeSession } from '../sessions.js';
 import { authenticateLocalStrategy } from '../strategies/local/authenticate.js';
 import { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js';
 export const resetPasswordOperation = async (args)=>{
-    const { collection: { config: collectionConfig }, data, depth, overrideAccess, req: { payload: { secret }, payload }, req } = args;
+    const { collection: { config: collectionConfig }, data, depth, overrideAccess = false, req: { payload: { secret }, payload }, req } = args;
     if (!Object.prototype.hasOwnProperty.call(data, 'token') || !Object.prototype.hasOwnProperty.call(data, 'password')) {
         throw new APIError('Missing required data.', httpStatus.BAD_REQUEST);
     }
@@ -20,7 +21,7 @@ export const resetPasswordOperation = async (args)=>{
         throw new Forbidden(req.t);
     }
     let sid;
-    let user = null;
+    let sessionUser = null;
     try {
         const shouldCommit = await initTransaction(req);
         args = await buildBeforeOperation({
@@ -44,7 +45,7 @@ export const resetPasswordOperation = async (args)=>{
                 }
             }
         });
-        user = await payload.db.findOne({
+        let user = await payload.db.findOne({
             collection: collectionConfig.slug,
             req,
             where
@@ -61,6 +62,10 @@ export const resetPasswordOperation = async (args)=>{
         user.salt = salt;
         user.hash = hash;
         user.resetPasswordExpiration = new Date().toISOString();
+        if (collectionConfig.auth.maxLoginAttempts > 0) {
+            user.lockUntil = null;
+            user.loginAttempts = 0;
+        }
         if (collectionConfig.auth.verify) {
             user._verified = Boolean(user._verified);
         }
@@ -83,6 +88,9 @@ export const resetPasswordOperation = async (args)=>{
         // /////////////////////////////////////
         // Ensure updatedAt date is always updated
         user.updatedAt = new Date().toISOString();
+        if (collectionConfig.auth.useSessions) {
+            user.sessions = [];
+        }
         const doc = await payload.db.updateOne({
             id: user.id,
             collection: collectionConfig.slug,
@@ -93,6 +101,9 @@ export const resetPasswordOperation = async (args)=>{
             doc,
             password: data.password
         });
+        user = doc;
+        user.collection = collectionConfig.slug;
+        user._strategy = 'local-jwt';
         const fieldsToSignArgs = {
             collectionConfig,
             email: user.email,
@@ -104,6 +115,7 @@ export const resetPasswordOperation = async (args)=>{
             req,
             user
         });
+        sessionUser = user;
         sid = session.sid;
         if (sid) {
             fieldsToSignArgs.sid = sid;
@@ -112,15 +124,14 @@ export const resetPasswordOperation = async (args)=>{
         // /////////////////////////////////////
         // beforeLogin - Collection
         // /////////////////////////////////////
-        let userBeforeLogin = user;
         if (collectionConfig.hooks?.beforeLogin?.length) {
             for (const hook of collectionConfig.hooks.beforeLogin){
-                userBeforeLogin = await hook({
+                user = await hook({
                     collection: args.collection?.config,
                     context: args.req.context,
                     req: args.req,
-                    user: userBeforeLogin
-                }) || userBeforeLogin;
+                    user
+                }) || user;
             }
         }
         const { token } = await jwtSign({
@@ -128,39 +139,37 @@ export const resetPasswordOperation = async (args)=>{
             secret,
             tokenExpiration: collectionConfig.auth.tokenExpiration
         });
-        req.user = userBeforeLogin;
+        req.user = user;
         // /////////////////////////////////////
         // afterLogin - Collection
         // /////////////////////////////////////
         if (collectionConfig.hooks?.afterLogin?.length) {
             for (const hook of collectionConfig.hooks.afterLogin){
-                userBeforeLogin = await hook({
+                user = await hook({
                     collection: args.collection?.config,
                     context: args.req.context,
                     req: args.req,
                     token,
-                    user: userBeforeLogin
-                }) || userBeforeLogin;
+                    user
+                }) || user;
             }
         }
-        const fullUser = await payload.findByID({
-            id: user.id,
-            collection: collectionConfig.slug,
-            depth,
+        user.collection = collectionConfig.slug;
+        user._strategy = 'local-jwt';
+        const userWithReadAccess = await applyUserReadAccess({
+            collection: collectionConfig,
+            depth: depth,
             overrideAccess,
             req,
-            trash: false
+            showHiddenFields: false,
+            user
         });
         if (shouldCommit) {
             await commitTransaction(req);
         }
-        if (fullUser) {
-            fullUser.collection = collectionConfig.slug;
-            fullUser._strategy = 'local-jwt';
-        }
         let result = {
             token,
-            user: fullUser
+            user: userWithReadAccess
         };
         // /////////////////////////////////////
         // afterOperation - Collection
@@ -180,7 +189,7 @@ export const resetPasswordOperation = async (args)=>{
                 payload,
                 req,
                 sid,
-                user
+                user: sessionUser
             });
         }
         await killTransaction(req);

package/dist/auth/operations/resetPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, TypedUser } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n  token?: string\n  user: Record<string, unknown>\n}\n\nexport type Arguments = {\n  collection: Collection\n  data: {\n    password: string\n    token: string\n  }\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments,\n): Promise<Result> => {\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess,\n    req: {\n      payload: { secret },\n      payload,\n    },\n    req,\n  } = args\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let user: null | TypedUser = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })\n\n    // /////////////////////////////////////\n    // Reset Password\n    // /////////////////////////////////////\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: {\n        resetPasswordExpiration: { greater_than: new Date().toISOString() },\n        resetPasswordToken: { equals: data.token },\n      },\n    })\n\n    user = await payload.db.findOne<TypedUser>({\n      collection: collectionConfig.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n    }\n\n    // TODO: replace this method\n    const { hash, salt } = await generatePasswordSaltHash({\n      collection: collectionConfig,\n      password: data.password,\n      req,\n    })\n\n    user.salt = salt\n    user.hash = hash\n\n    user.resetPasswordExpiration = new Date().toISOString()\n\n    if (collectionConfig.auth.verify) {\n      user._verified = Boolean(user._verified)\n    }\n\n    // /////////////////////////////////////\n    // beforeValidate - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeValidate?.length) {\n      for (const hook of collectionConfig.hooks.beforeValidate) {\n        await hook({\n          collection: args.collection?.config,\n          context: req.context,\n          data: user,\n          operation: 'update',\n          req,\n        })\n      }\n    }\n\n    // /////////////////////////////////////\n    // Update new password\n    // /////////////////////////////////////\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    const doc = await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n    })\n\n    await authenticateLocalStrategy({ doc, password: data.password })\n\n    const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n      collectionConfig,\n      email: user.email!,\n      user,\n    }\n\n    const session = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req,\n      user,\n    })\n    sid = session.sid\n\n    if (sid) {\n      fieldsToSignArgs.sid = sid\n    }\n\n    const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    let userBeforeLogin = user\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const { token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: collectionConfig.auth.tokenExpiration,\n    })\n\n    req.user = userBeforeLogin\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            token,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const fullUser = await payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth,\n      overrideAccess,\n      req,\n      trash: false,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    if (fullUser) {\n      fullUser.collection = collectionConfig.slug\n      fullUser._strategy = 'local-jwt'\n    }\n\n    let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n      token,\n      user: fullUser,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'resetPassword',\n      overrideAccess,\n      result,\n    })\n\n    return result\n  } catch (error: unknown) {\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user,\n      })\n    }\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","user","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","db","findOne","slug","FORBIDDEN","hash","salt","password","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","doc","updateOne","id","fieldsToSignArgs","email","session","fieldsToSign","userBeforeLogin","beforeLogin","tokenExpiration","afterLogin","fullUser","findByID","_strategy","result","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAMlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJ,IACE,CAACU,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIjB,SAAS,0BAA0BH,WAAW8B,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI5B,UAAUmB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,OAAyB;IAE7B,IAAI;QACF,MAAMC,eAAe,MAAM7B,gBAAgBgB;QAE3CP,OAAO,MAAMd,qBAAqB;YAChCc;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEAb,OAAO,MAAMX,QAAQyB,EAAE,CAACC,OAAO,CAAY;YACzCjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAe;QACF;QAEA,IAAI,CAACH,MAAM;YACT,MAAM,IAAIhC,SAAS,2CAA2CH,WAAWoD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMxC,yBAAyB;YACpDG,YAAYE;YACZoC,UAAUnC,KAAKmC,QAAQ;YACvBhC;QACF;QAEAY,KAAKmB,IAAI,GAAGA;QACZnB,KAAKkB,IAAI,GAAGA;QAEZlB,KAAKO,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAACyB,MAAM,EAAE;YAChCrB,KAAKsB,SAAS,GAAGjB,QAAQL,KAAKsB,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAItC,iBAAiBuC,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACT5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAASvC,IAAIuC,OAAO;oBACpB1C,MAAMe;oBACNE,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CY,KAAK4B,SAAS,GAAG,IAAInB,OAAOC,WAAW;QAEvC,MAAMmB,MAAM,MAAMxC,QAAQyB,EAAE,CAACgB,SAAS,CAAC;YACrCC,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAMe;YACNZ;QACF;QAEA,MAAMV,0BAA0B;YAAEmD;YAAKT,UAAUnC,KAAKmC,QAAQ;QAAC;QAE/D,MAAMY,mBAA0D;YAC9DhD;YACAiD,OAAOjC,KAAKiC,KAAK;YACjBjC;QACF;QAEA,MAAMkC,UAAU,MAAM1D,iBAAiB;YACrCQ;YACAK;YACAD;YACAY;QACF;QACAD,MAAMmC,QAAQnC,GAAG;QAEjB,IAAIA,KAAK;YACPiC,iBAAiBjC,GAAG,GAAGA;QACzB;QAEA,MAAMoC,eAAe7D,gBAAgB0D;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAII,kBAAkBpC;QAEtB,IAAIhB,iBAAiBuC,KAAK,EAAEc,aAAaZ,QAAQ;YAC/C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACc,WAAW,CAAE;gBACrDD,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbY,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAM,EAAEvB,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9B4D;YACA7C;YACAgD,iBAAiBtD,iBAAiBY,IAAI,CAAC0C,eAAe;QACxD;QAEAlD,IAAIY,IAAI,GAAGoC;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIpD,iBAAiBuC,KAAK,EAAEgB,YAAYd,QAAQ;YAC9C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACgB,UAAU,CAAE;gBACpDH,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbyB;oBACAb,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAMI,WAAW,MAAMnD,QAAQoD,QAAQ,CAAC;YACtCV,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC9B;YACAC;YACAC;YACAkB,OAAO;QACT;QAEA,IAAIL,cAAc;YAChB,MAAM9B,kBAAkBiB;QAC1B;QAEA,IAAIoD,UAAU;YACZA,SAAS1D,UAAU,GAAGE,iBAAiBgC,IAAI;YAC3CwB,SAASE,SAAS,GAAG;QACvB;QAEA,IAAIC,SAA2D;YAC7D9B;YACAb,MAAMwC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCG,SAAS,MAAM7E,oBAAoB;YACjCe;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACAwD;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAI7C,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAC;YACF;QACF;QACA,MAAM3B,gBAAgBe;QACtB,MAAMwD;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, TypedUser } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n  token?: string\n  user: Record<string, unknown>\n}\n\nexport type Arguments = {\n  collection: Collection\n  data: {\n    password: string\n    token: string\n  }\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments,\n): Promise<Result> => {\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess = false,\n    req: {\n      payload: { secret },\n      payload,\n    },\n    req,\n  } = args\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let sessionUser: null | TypedUser = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })\n\n    // /////////////////////////////////////\n    // Reset Password\n    // /////////////////////////////////////\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: {\n        resetPasswordExpiration: { greater_than: new Date().toISOString() },\n        resetPasswordToken: { equals: data.token },\n      },\n    })\n\n    let user = await payload.db.findOne<TypedUser>({\n      collection: collectionConfig.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n    }\n\n    // TODO: replace this method\n    const { hash, salt } = await generatePasswordSaltHash({\n      collection: collectionConfig,\n      password: data.password,\n      req,\n    })\n\n    user.salt = salt\n    user.hash = hash\n\n    user.resetPasswordExpiration = new Date().toISOString()\n\n    if (collectionConfig.auth.maxLoginAttempts > 0) {\n      user.lockUntil = null\n      user.loginAttempts = 0\n    }\n\n    if (collectionConfig.auth.verify) {\n      user._verified = Boolean(user._verified)\n    }\n\n    // /////////////////////////////////////\n    // beforeValidate - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeValidate?.length) {\n      for (const hook of collectionConfig.hooks.beforeValidate) {\n        await hook({\n          collection: args.collection?.config,\n          context: req.context,\n          data: user,\n          operation: 'update',\n          req,\n        })\n      }\n    }\n\n    // /////////////////////////////////////\n    // Update new password\n    // /////////////////////////////////////\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    if (collectionConfig.auth.useSessions) {\n      user.sessions = []\n    }\n\n    const doc = await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n    })\n\n    await authenticateLocalStrategy({ doc, password: data.password })\n\n    user = doc as TypedUser\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n\n    const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n      collectionConfig,\n      email: user.email!,\n      user,\n    }\n\n    const session = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req,\n      user,\n    })\n\n    sessionUser = user\n    sid = session.sid\n\n    if (sid) {\n      fieldsToSignArgs.sid = sid\n    }\n\n    const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        user = ((await hook({\n          collection: args.collection?.config,\n          context: args.req.context,\n          req: args.req,\n          user,\n        })) || user) as NonNullable<TypedUser>\n      }\n    }\n\n    const { token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: collectionConfig.auth.tokenExpiration,\n    })\n\n    req.user = user\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        user = ((await hook({\n          collection: args.collection?.config,\n          context: args.req.context,\n          req: args.req,\n          token,\n          user,\n        })) || user) as NonNullable<TypedUser>\n      }\n    }\n\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n\n    const userWithReadAccess = await applyUserReadAccess({\n      collection: collectionConfig,\n      depth: depth!,\n      overrideAccess,\n      req,\n      showHiddenFields: false,\n      user,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n      token,\n      user: userWithReadAccess,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'resetPassword',\n      overrideAccess,\n      result,\n    })\n\n    return result\n  } catch (error: unknown) {\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user: sessionUser,\n      })\n    }\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","applyUserReadAccess","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","sessionUser","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","user","db","findOne","slug","FORBIDDEN","hash","salt","password","maxLoginAttempts","lockUntil","loginAttempts","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","useSessions","sessions","doc","updateOne","id","_strategy","fieldsToSignArgs","email","session","fieldsToSign","beforeLogin","tokenExpiration","afterLogin","userWithReadAccess","showHiddenFields","result","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAMlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,iBAAiB,KAAK,EACtBC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJ,IACE,CAACU,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIlB,SAAS,0BAA0BH,WAAW+B,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI7B,UAAUoB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,cAAgC;IAEpC,IAAI;QACF,MAAMC,eAAe,MAAM9B,gBAAgBiB;QAE3CP,OAAO,MAAMf,qBAAqB;YAChCe;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQlC,uBAAuB;YACnCmC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEA,IAAIC,OAAO,MAAMzB,QAAQ0B,EAAE,CAACC,OAAO,CAAY;YAC7ClC,YAAYE,iBAAiBiC,IAAI;YACjC7B;YACAe;QACF;QAEA,IAAI,CAACW,MAAM;YACT,MAAM,IAAI/C,SAAS,2CAA2CH,WAAWsD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMzC,yBAAyB;YACpDG,YAAYE;YACZqC,UAAUpC,KAAKoC,QAAQ;YACvBjC;QACF;QAEA0B,KAAKM,IAAI,GAAGA;QACZN,KAAKK,IAAI,GAAGA;QAEZL,KAAKP,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAAC0B,gBAAgB,GAAG,GAAG;YAC9CR,KAAKS,SAAS,GAAG;YACjBT,KAAKU,aAAa,GAAG;QACvB;QAEA,IAAIxC,iBAAiBY,IAAI,CAAC6B,MAAM,EAAE;YAChCX,KAAKY,SAAS,GAAGrB,QAAQS,KAAKY,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAI1C,iBAAiB2C,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACThD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAAS3C,IAAI2C,OAAO;oBACpB9C,MAAM6B;oBACNZ,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1C0B,KAAKkB,SAAS,GAAG,IAAIvB,OAAOC,WAAW;QAEvC,IAAI1B,iBAAiBY,IAAI,CAACqC,WAAW,EAAE;YACrCnB,KAAKoB,QAAQ,GAAG,EAAE;QACpB;QAEA,MAAMC,MAAM,MAAM9C,QAAQ0B,EAAE,CAACqB,SAAS,CAAC;YACrCC,IAAIvB,KAAKuB,EAAE;YACXvD,YAAYE,iBAAiBiC,IAAI;YACjChC,MAAM6B;YACN1B;QACF;QAEA,MAAMV,0BAA0B;YAAEyD;YAAKd,UAAUpC,KAAKoC,QAAQ;QAAC;QAE/DP,OAAOqB;QACPrB,KAAKhC,UAAU,GAAGE,iBAAiBiC,IAAI;QACvCH,KAAKwB,SAAS,GAAG;QAEjB,MAAMC,mBAA0D;YAC9DvD;YACAwD,OAAO1B,KAAK0B,KAAK;YACjB1B;QACF;QAEA,MAAM2B,UAAU,MAAMjE,iBAAiB;YACrCQ;YACAK;YACAD;YACA0B;QACF;QAEAd,cAAcc;QACdf,MAAM0C,QAAQ1C,GAAG;QAEjB,IAAIA,KAAK;YACPwC,iBAAiBxC,GAAG,GAAGA;QACzB;QAEA,MAAM2C,eAAepE,gBAAgBiE;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAIvD,iBAAiB2C,KAAK,EAAEgB,aAAad,QAAQ;YAC/C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACgB,WAAW,CAAE;gBACrD7B,OAAQ,AAAC,MAAMgB,KAAK;oBAClBhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACb0B;gBACF,MAAOA;YACT;QACF;QAEA,MAAM,EAAED,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9BmE;YACApD;YACAsD,iBAAiB5D,iBAAiBY,IAAI,CAACgD,eAAe;QACxD;QAEAxD,IAAI0B,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAI9B,iBAAiB2C,KAAK,EAAEkB,YAAYhB,QAAQ;YAC9C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACkB,UAAU,CAAE;gBACpD/B,OAAQ,AAAC,MAAMgB,KAAK;oBAClBhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACbyB;oBACAC;gBACF,MAAOA;YACT;QACF;QAEAA,KAAKhC,UAAU,GAAGE,iBAAiBiC,IAAI;QACvCH,KAAKwB,SAAS,GAAG;QAEjB,MAAMQ,qBAAqB,MAAMzE,oBAAoB;YACnDS,YAAYE;YACZE,OAAOA;YACPC;YACAC;YACA2D,kBAAkB;YAClBjC;QACF;QAEA,IAAIb,cAAc;YAChB,MAAM/B,kBAAkBkB;QAC1B;QAEA,IAAI4D,SAA2D;YAC7DnC;YACAC,MAAMgC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCE,SAAS,MAAMnF,oBAAoB;YACjCgB;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACA6D;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAIlD,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAe,MAAMd;YACR;QACF;QACA,MAAM5B,gBAAgBgB;QACtB,MAAM6D;IACR;AACF,EAAC"}

package/dist/auth/operations/unlock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,QAC9D,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAqHjB,CAAA"}
+{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,QAC9D,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAwHjB,CAAA"}

package/dist/auth/operations/unlock.js

@@ -36,6 +36,7 @@ export const unlockOperation = async (args)=>{
         // /////////////////////////////////////
         if (!overrideAccess) {
             const accessResult = await executeAccess({
+                collectionConfig,
                 req
             }, collectionConfig.access.unlock);
             if (accessResult && typeof accessResult === 'object') {

package/dist/auth/operations/unlock.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess({ req }, collectionConfig.access.unlock)\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","slug","result","doc","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI3B,UAAUc,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEc,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5ErB,WAAWkC,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMZ,qBAAqB;YAChCY;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cAAc;gBAAES;YAAI,GAAGF,iBAAiBsB,MAAM,CAACC,MAAM;YAEhF,IAAIF,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBjC,eAAeiC,iBAAiB;gBAChDV,OAAO;oBACLc,QAAQhB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBjC,eAAeiC,iBAAiB;gBAChDN,UAAU;oBACRU,QAAQX;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkB/B,uBAAuB;YACvCoC,aAAaC,QAAQ1B,iBAAiB2B,KAAK;YAC3CA,OAAO;YACPC,OAAOR;QACT;QAEA,MAAMS,OAAO,MAAM3B,IAAI4B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxClC,YAAYE,iBAAiBiC,IAAI;YACjC9B,QAAQA;YACRD;YACA0B,OAAOR;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIL,MAAM;YACR,MAAMlC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKN;gBACLC,SAAS5B,IAAI4B,OAAO;gBACpB5B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI9C,UAAUc,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM7B,kBAAkBY;QAC1B;QAEAgC,SAAS,MAAMlD,oBAAoB;YACjCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOR,QAAQQ;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess(\n        { collectionConfig, req },\n        collectionConfig.access.unlock,\n      )\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","slug","result","doc","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI3B,UAAUc,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEc,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5ErB,WAAWkC,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMZ,qBAAqB;YAChCY;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cACzB;gBAAEO;gBAAkBE;YAAI,GACxBF,iBAAiBsB,MAAM,CAACC,MAAM;YAGhC,IAAIF,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBjC,eAAeiC,iBAAiB;gBAChDV,OAAO;oBACLc,QAAQhB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBjC,eAAeiC,iBAAiB;gBAChDN,UAAU;oBACRU,QAAQX;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkB/B,uBAAuB;YACvCoC,aAAaC,QAAQ1B,iBAAiB2B,KAAK;YAC3CA,OAAO;YACPC,OAAOR;QACT;QAEA,MAAMS,OAAO,MAAM3B,IAAI4B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxClC,YAAYE,iBAAiBiC,IAAI;YACjC9B,QAAQA;YACRD;YACA0B,OAAOR;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIL,MAAM;YACR,MAAMlC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKN;gBACLC,SAAS5B,IAAI4B,OAAO;gBACpB5B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI9C,UAAUc,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM7B,kBAAkBY;QAC1B;QAEAgC,SAAS,MAAMlD,oBAAoB;YACjCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOR,QAAQQ;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}

package/dist/auth/strategies/apiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAqE9C,CAAA"}
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAsF9C,CAAA"}

package/dist/auth/strategies/apiKey.js

@@ -1,5 +1,5 @@
 import crypto from 'crypto';
-export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGraphQL = false, payload })=>{
+export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGraphQL = false, payload, req })=>{
         const authHeader = headers.get('Authorization');
         if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {
             const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '');
@@ -19,6 +19,9 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                     }
                 }
             ];
+            const requestFallbackLocale = req?.fallbackLocale;
+            const requestLocale = req?.locale;
+            const requestDepth = req?.query?.depth;
             try {
                 const where = {};
                 if (collectionConfig.auth?.verify) {
@@ -38,9 +41,12 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                 const userQuery = await payload.find({
                     collection: collectionConfig.slug,
                     depth: isGraphQL ? 0 : collectionConfig.auth.depth,
+                    fallbackLocale: requestFallbackLocale,
                     limit: 1,
+                    locale: requestLocale,
                     overrideAccess: true,
                     pagination: false,
+                    req,
                     where
                 });
                 if (userQuery.docs && userQuery.docs.length > 0) {
@@ -55,6 +61,14 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                 return {
                     user: null
                 };
+            } finally{
+                if (req) {
+                    req.fallbackLocale = requestFallbackLocale;
+                    req.locale = requestLocale;
+                    if (req.query) {
+                        req.query.depth = requestDepth;
+                    }
+                }
             }
         }
         return {

package/dist/auth/strategies/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { TypedUser } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      // TODO: V4 remove extra algorithm check\n      // api keys saved prior to v3.46.0 will have sha1\n      const sha1APIKeyIndex = crypto.createHmac('sha1', payload.secret).update(apiKey).digest('hex')\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey)\n        .digest('hex')\n\n      const apiKeyConstraints = [\n        {\n          apiKeyIndex: {\n            equals: sha1APIKeyIndex,\n          },\n        },\n        {\n          apiKeyIndex: {\n            equals: sha256APIKeyIndex,\n          },\n        },\n      ]\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              or: apiKeyConstraints,\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.or = apiKeyConstraints\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as TypedUser,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","sha1APIKeyIndex","createHmac","secret","update","digest","sha256APIKeyIndex","apiKeyConstraints","apiKeyIndex","equals","where","auth","verify","and","or","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,wCAAwC;YACxC,iDAAiD;YACjD,MAAMG,kBAAkBZ,OAAOa,UAAU,CAAC,QAAQR,QAAQS,MAAM,EAAEC,MAAM,CAACL,QAAQM,MAAM,CAAC;YACxF,MAAMC,oBAAoBjB,OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,MAAME,oBAAoB;gBACxB;oBACEC,aAAa;wBACXC,QAAQR;oBACV;gBACF;gBACA;oBACEO,aAAa;wBACXC,QAAQH;oBACV;gBACF;aACD;YAED,IAAI;gBACF,MAAMI,QAAe,CAAC;gBACtB,IAAInB,iBAAiBoB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,IAAIP;wBACN;wBACA;4BACEQ,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLN,MAAMI,EAAE,GAAGP;gBACb;gBAEA,MAAMU,YAAY,MAAMvB,QAAQwB,IAAI,CAAC;oBACnCC,YAAY5B,iBAAiBO,IAAI;oBACjCsB,OAAO3B,YAAY,IAAIF,iBAAiBoB,IAAI,CAACS,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZb;gBACF;gBAEA,IAAIO,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAG5B,iBAAiBO,IAAI;oBACxC4B,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { TypedUser } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload, req }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      // TODO: V4 remove extra algorithm check\n      // api keys saved prior to v3.46.0 will have sha1\n      const sha1APIKeyIndex = crypto.createHmac('sha1', payload.secret).update(apiKey).digest('hex')\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey)\n        .digest('hex')\n\n      const apiKeyConstraints = [\n        {\n          apiKeyIndex: {\n            equals: sha1APIKeyIndex,\n          },\n        },\n        {\n          apiKeyIndex: {\n            equals: sha256APIKeyIndex,\n          },\n        },\n      ]\n\n      const requestFallbackLocale = req?.fallbackLocale\n      const requestLocale = req?.locale\n      const requestDepth = req?.query?.depth\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              or: apiKeyConstraints,\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.or = apiKeyConstraints\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          fallbackLocale: requestFallbackLocale,\n          limit: 1,\n          locale: requestLocale,\n          overrideAccess: true,\n          pagination: false,\n          req,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as TypedUser,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      } finally {\n        if (req) {\n          req.fallbackLocale = requestFallbackLocale!\n          req.locale = requestLocale!\n\n          if (req.query) {\n            req.query.depth = requestDepth\n          }\n        }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","req","authHeader","get","startsWith","slug","apiKey","replace","sha1APIKeyIndex","createHmac","secret","update","digest","sha256APIKeyIndex","apiKeyConstraints","apiKeyIndex","equals","requestFallbackLocale","fallbackLocale","requestLocale","locale","requestDepth","query","depth","where","auth","verify","and","or","_verified","not_equals","userQuery","find","collection","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAEC,GAAG,EAAE;QACjD,MAAMC,aAAaJ,QAAQK,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGP,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGV,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,wCAAwC;YACxC,iDAAiD;YACjD,MAAMG,kBAAkBb,OAAOc,UAAU,CAAC,QAAQT,QAAQU,MAAM,EAAEC,MAAM,CAACL,QAAQM,MAAM,CAAC;YACxF,MAAMC,oBAAoBlB,OACvBc,UAAU,CAAC,UAAUT,QAAQU,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,MAAME,oBAAoB;gBACxB;oBACEC,aAAa;wBACXC,QAAQR;oBACV;gBACF;gBACA;oBACEO,aAAa;wBACXC,QAAQH;oBACV;gBACF;aACD;YAED,MAAMI,wBAAwBhB,KAAKiB;YACnC,MAAMC,gBAAgBlB,KAAKmB;YAC3B,MAAMC,eAAepB,KAAKqB,OAAOC;YAEjC,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAI3B,iBAAiB4B,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,IAAId;wBACN;wBACA;4BACEe,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLN,MAAMI,EAAE,GAAGd;gBACb;gBAEA,MAAMiB,YAAY,MAAM/B,QAAQgC,IAAI,CAAC;oBACnCC,YAAYpC,iBAAiBQ,IAAI;oBACjCkB,OAAOxB,YAAY,IAAIF,iBAAiB4B,IAAI,CAACF,KAAK;oBAClDL,gBAAgBD;oBAChBiB,OAAO;oBACPd,QAAQD;oBACRgB,gBAAgB;oBAChBC,YAAY;oBACZnC;oBACAuB;gBACF;gBAEA,IAAIO,UAAUM,IAAI,IAAIN,UAAUM,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOR,UAAUM,IAAI,CAAC,EAAE;oBAE9BE,KAAMN,UAAU,GAAGpC,iBAAiBQ,IAAI;oBACxCkC,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB,SAAU;gBACR,IAAItC,KAAK;oBACPA,IAAIiB,cAAc,GAAGD;oBACrBhB,IAAImB,MAAM,GAAGD;oBAEb,IAAIlB,IAAIqB,KAAK,EAAE;wBACbrB,IAAIqB,KAAK,CAACC,KAAK,GAAGF;oBACpB;gBACF;YACF;QACF;QAEA,OAAO;YAAEkB,MAAM;QAAK;IACtB,EAAC"}

package/dist/auth/strategies/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAsE3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAwD/B,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAsG3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAwH/B,CAAA"}