payload 3.89.0 → 3.90.0

package/dist/uploads/getExternalFile.js

@@ -1,28 +1,73 @@
 import { APIError } from '../errors/index.js';
+import { getRequestOrigin } from '../utilities/getRequestOrigin.js';
 import { isURLAllowed } from '../utilities/isURLAllowed.js';
 import { safeFetch } from './safeFetch.js';
+const hasProtocol = (url)=>/^[a-z][a-z\d+.-]*:/i.test(url);
+const validateFileURL = (url)=>{
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new APIError('External file URLs must use HTTP or HTTPS.', 400);
+    }
+    return url;
+};
+const parseFileURL = (url, base)=>{
+    try {
+        return validateFileURL(new URL(url, base));
+    } catch (error) {
+        if (error instanceof APIError) {
+            throw error;
+        }
+        throw new APIError('Invalid external file URL.', 400);
+    }
+};
+const getRequestBaseURL = (req)=>{
+    try {
+        const requestURL = validateFileURL(new URL(req.url));
+        const host = req.headers.get('host') || requestURL.host;
+        return validateFileURL(new URL(`${requestURL.protocol}//${host}`));
+    } catch  {
+        return undefined;
+    }
+};
 export const getExternalFile = async ({ data, req, uploadConfig })=>{
     const { filename, url } = data;
-    let trimAuthCookies = true;
     if (typeof url === 'string') {
-        let fileURL = url;
-        if (!url.startsWith('http')) {
-            // URL points to the same server - we can send any cookies safely to our server.
-            trimAuthCookies = false;
-            const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`;
-            fileURL = `${baseUrl}${url}`;
-        }
-        let cookies = (req.headers.get('cookie') ?? '').split(';');
-        if (trimAuthCookies) {
-            cookies = cookies.filter((cookie)=>!cookie.trim().startsWith(req.payload.config.cookiePrefix));
+        let baseOrigin;
+        let parsedFileURL;
+        if (hasProtocol(url)) {
+            parsedFileURL = parseFileURL(url);
+        } else {
+            const requestOrigin = getRequestOrigin({
+                config: req.payload.config,
+                req
+            });
+            let requestBaseURL;
+            if (requestOrigin) {
+                requestBaseURL = parseFileURL(requestOrigin);
+                baseOrigin = requestBaseURL.origin;
+            } else {
+                requestBaseURL = getRequestBaseURL(req);
+            }
+            if (!requestBaseURL) {
+                throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400);
+            }
+            parsedFileURL = parseFileURL(url, requestBaseURL);
         }
-        const headers = uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers))) : {
-            cookie: cookies.join(';')
-        };
+        let fileURL = parsedFileURL.toString();
+        const requestHeaders = Object.fromEntries(new Headers(req.headers));
+        const cookies = (req.headers.get('cookie') ?? '').split(';');
         let res;
         let redirectCount = 0;
         const maxRedirects = 3;
         while(redirectCount <= maxRedirects){
+            const isSameOrigin = Boolean(baseOrigin && new URL(fileURL).origin === baseOrigin);
+            const headers = uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter({
+                ...requestHeaders
+            }, {
+                isSameOrigin,
+                url: fileURL
+            }) : {
+                cookie: cookies.filter((cookie)=>isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix)).join(';')
+            };
             const skipSafeFetch = uploadConfig.skipSafeFetch === true ? uploadConfig.skipSafeFetch : Array.isArray(uploadConfig.skipSafeFetch) && isURLAllowed(fileURL, uploadConfig.skipSafeFetch);
             const isAllowedPasteUrl = uploadConfig.pasteURL && uploadConfig.pasteURL.allowList && isURLAllowed(fileURL, uploadConfig.pasteURL.allowList);
             if (skipSafeFetch || isAllowedPasteUrl) {
@@ -47,7 +92,7 @@ export const getExternalFile = async ({ data, req, uploadConfig })=>{
                 }
                 const location = res.headers.get('location');
                 if (location) {
-                    fileURL = new URL(location, fileURL).toString();
+                    fileURL = parseFileURL(location, new URL(fileURL)).toString();
                     if (uploadConfig.pasteURL && uploadConfig.pasteURL.allowList && !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)) {
                         throw new APIError('Redirect target is not allowed.', 400);
                     }

package/dist/uploads/getExternalFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getExternalFile.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { isURLAllowed } from '../utilities/isURLAllowed.js'\nimport { safeFetch } from './safeFetch.js'\n\ntype Args = {\n  data: FileData\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\nexport const getExternalFile = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  let trimAuthCookies = true\n  if (typeof url === 'string') {\n    let fileURL = url\n    if (!url.startsWith('http')) {\n      // URL points to the same server - we can send any cookies safely to our server.\n      trimAuthCookies = false\n      const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`\n      fileURL = `${baseUrl}${url}`\n    }\n\n    let cookies = (req.headers.get('cookie') ?? '').split(';')\n\n    if (trimAuthCookies) {\n      cookies = cookies.filter(\n        (cookie) => !cookie.trim().startsWith(req.payload.config.cookiePrefix),\n      )\n    }\n\n    const headers = uploadConfig.externalFileHeaderFilter\n      ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers)))\n      : {\n          cookie: cookies.join(';'),\n        }\n\n    let res\n    let redirectCount = 0\n    const maxRedirects = 3\n\n    while (redirectCount <= maxRedirects) {\n      const skipSafeFetch: boolean =\n        uploadConfig.skipSafeFetch === true\n          ? uploadConfig.skipSafeFetch\n          : Array.isArray(uploadConfig.skipSafeFetch) &&\n            isURLAllowed(fileURL, uploadConfig.skipSafeFetch)\n\n      const isAllowedPasteUrl: boolean | undefined =\n        uploadConfig.pasteURL &&\n        uploadConfig.pasteURL.allowList &&\n        isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n\n      if (skipSafeFetch || isAllowedPasteUrl) {\n        res = await fetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n          redirect: 'manual',\n        })\n      } else {\n        // Default\n        res = await safeFetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n        })\n      }\n\n      if (res.status >= 300 && res.status < 400) {\n        redirectCount++\n        if (redirectCount > maxRedirects) {\n          throw new APIError(`Too many redirects (max ${maxRedirects})`, 403)\n        }\n        const location = res.headers.get('location')\n        if (location) {\n          fileURL = new URL(location, fileURL).toString()\n          if (\n            uploadConfig.pasteURL &&\n            uploadConfig.pasteURL.allowList &&\n            !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n          ) {\n            throw new APIError('Redirect target is not allowed.', 400)\n          }\n          continue\n        }\n      }\n\n      break\n    }\n\n    if (!res || !res.ok) {\n      throw new APIError(`Failed to fetch file from ${fileURL}`, res?.status)\n    }\n\n    const data = await res.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: res.headers.get('content-type') || undefined!,\n      size: Number(res.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","isURLAllowed","safeFetch","getExternalFile","data","req","uploadConfig","filename","url","trimAuthCookies","fileURL","startsWith","baseUrl","headers","get","protocol","cookies","split","filter","cookie","trim","payload","config","cookiePrefix","externalFileHeaderFilter","Object","fromEntries","Headers","join","res","redirectCount","maxRedirects","skipSafeFetch","Array","isArray","isAllowedPasteUrl","pasteURL","allowList","fetch","credentials","method","redirect","status","location","URL","toString","ok","arrayBuffer","name","Buffer","from","mimetype","undefined","size","Number"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,SAAS,QAAQ,iBAAgB;AAO1C,OAAO,MAAMC,kBAAkB,OAAO,EAAEC,IAAI,EAAEC,GAAG,EAAEC,YAAY,EAAQ;IACrE,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAE,GAAGJ;IAE1B,IAAIK,kBAAkB;IACtB,IAAI,OAAOD,QAAQ,UAAU;QAC3B,IAAIE,UAAUF;QACd,IAAI,CAACA,IAAIG,UAAU,CAAC,SAAS;YAC3B,gFAAgF;YAChFF,kBAAkB;YAClB,MAAMG,UAAUP,IAAIQ,OAAO,CAACC,GAAG,CAAC,aAAa,GAAGT,IAAIU,QAAQ,CAAC,GAAG,EAAEV,IAAIQ,OAAO,CAACC,GAAG,CAAC,SAAS;YAC3FJ,UAAU,GAAGE,UAAUJ,KAAK;QAC9B;QAEA,IAAIQ,UAAU,AAACX,CAAAA,IAAIQ,OAAO,CAACC,GAAG,CAAC,aAAa,EAAC,EAAGG,KAAK,CAAC;QAEtD,IAAIR,iBAAiB;YACnBO,UAAUA,QAAQE,MAAM,CACtB,CAACC,SAAW,CAACA,OAAOC,IAAI,GAAGT,UAAU,CAACN,IAAIgB,OAAO,CAACC,MAAM,CAACC,YAAY;QAEzE;QAEA,MAAMV,UAAUP,aAAakB,wBAAwB,GACjDlB,aAAakB,wBAAwB,CAACC,OAAOC,WAAW,CAAC,IAAIC,QAAQtB,IAAIQ,OAAO,MAChF;YACEM,QAAQH,QAAQY,IAAI,CAAC;QACvB;QAEJ,IAAIC;QACJ,IAAIC,gBAAgB;QACpB,MAAMC,eAAe;QAErB,MAAOD,iBAAiBC,aAAc;YACpC,MAAMC,gBACJ1B,aAAa0B,aAAa,KAAK,OAC3B1B,aAAa0B,aAAa,GAC1BC,MAAMC,OAAO,CAAC5B,aAAa0B,aAAa,KACxC/B,aAAaS,SAASJ,aAAa0B,aAAa;YAEtD,MAAMG,oBACJ7B,aAAa8B,QAAQ,IACrB9B,aAAa8B,QAAQ,CAACC,SAAS,IAC/BpC,aAAaS,SAASJ,aAAa8B,QAAQ,CAACC,SAAS;YAEvD,IAAIL,iBAAiBG,mBAAmB;gBACtCN,MAAM,MAAMS,MAAM5B,SAAS;oBACzB6B,aAAa;oBACb1B;oBACA2B,QAAQ;oBACRC,UAAU;gBACZ;YACF,OAAO;gBACL,UAAU;gBACVZ,MAAM,MAAM3B,UAAUQ,SAAS;oBAC7B6B,aAAa;oBACb1B;oBACA2B,QAAQ;gBACV;YACF;YAEA,IAAIX,IAAIa,MAAM,IAAI,OAAOb,IAAIa,MAAM,GAAG,KAAK;gBACzCZ;gBACA,IAAIA,gBAAgBC,cAAc;oBAChC,MAAM,IAAI/B,SAAS,CAAC,wBAAwB,EAAE+B,aAAa,CAAC,CAAC,EAAE;gBACjE;gBACA,MAAMY,WAAWd,IAAIhB,OAAO,CAACC,GAAG,CAAC;gBACjC,IAAI6B,UAAU;oBACZjC,UAAU,IAAIkC,IAAID,UAAUjC,SAASmC,QAAQ;oBAC7C,IACEvC,aAAa8B,QAAQ,IACrB9B,aAAa8B,QAAQ,CAACC,SAAS,IAC/B,CAACpC,aAAaS,SAASJ,aAAa8B,QAAQ,CAACC,SAAS,GACtD;wBACA,MAAM,IAAIrC,SAAS,mCAAmC;oBACxD;oBACA;gBACF;YACF;YAEA;QACF;QAEA,IAAI,CAAC6B,OAAO,CAACA,IAAIiB,EAAE,EAAE;YACnB,MAAM,IAAI9C,SAAS,CAAC,0BAA0B,EAAEU,SAAS,EAAEmB,KAAKa;QAClE;QAEA,MAAMtC,OAAO,MAAMyB,IAAIkB,WAAW;QAElC,OAAO;YACLC,MAAMzC;YACNH,MAAM6C,OAAOC,IAAI,CAAC9C;YAClB+C,UAAUtB,IAAIhB,OAAO,CAACC,GAAG,CAAC,mBAAmBsC;YAC7CC,MAAMC,OAAOzB,IAAIhB,OAAO,CAACC,GAAG,CAAC,sBAAsB;QACrD;IACF;IAEA,MAAM,IAAId,SAAS,oBAAoB;AACzC,EAAC"}
+{"version":3,"sources":["../../src/uploads/getExternalFile.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { getRequestOrigin } from '../utilities/getRequestOrigin.js'\nimport { isURLAllowed } from '../utilities/isURLAllowed.js'\nimport { safeFetch } from './safeFetch.js'\n\ntype Args = {\n  data: Pick<FileData, 'filename' | 'url'>\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\n\nconst hasProtocol = (url: string): boolean => /^[a-z][a-z\\d+.-]*:/i.test(url)\n\nconst validateFileURL = (url: URL): URL => {\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    throw new APIError('External file URLs must use HTTP or HTTPS.', 400)\n  }\n\n  return url\n}\n\nconst parseFileURL = (url: string, base?: URL): URL => {\n  try {\n    return validateFileURL(new URL(url, base))\n  } catch (error) {\n    if (error instanceof APIError) {\n      throw error\n    }\n\n    throw new APIError('Invalid external file URL.', 400)\n  }\n}\n\nconst getRequestBaseURL = (req: PayloadRequest): undefined | URL => {\n  try {\n    const requestURL = validateFileURL(new URL(req.url!))\n    const host = req.headers.get('host') || requestURL.host\n\n    return validateFileURL(new URL(`${requestURL.protocol}//${host}`))\n  } catch {\n    return undefined\n  }\n}\n\nexport const getExternalFile = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  if (typeof url === 'string') {\n    let baseOrigin: string | undefined\n    let parsedFileURL: URL\n\n    if (hasProtocol(url)) {\n      parsedFileURL = parseFileURL(url)\n    } else {\n      const requestOrigin = getRequestOrigin({ config: req.payload.config, req })\n      let requestBaseURL: undefined | URL\n\n      if (requestOrigin) {\n        requestBaseURL = parseFileURL(requestOrigin)\n        baseOrigin = requestBaseURL.origin\n      } else {\n        requestBaseURL = getRequestBaseURL(req)\n      }\n\n      if (!requestBaseURL) {\n        throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400)\n      }\n\n      parsedFileURL = parseFileURL(url, requestBaseURL)\n    }\n\n    let fileURL = parsedFileURL.toString()\n    const requestHeaders = Object.fromEntries(new Headers(req.headers))\n    const cookies = (req.headers.get('cookie') ?? '').split(';')\n\n    let res\n    let redirectCount = 0\n    const maxRedirects = 3\n\n    while (redirectCount <= maxRedirects) {\n      const isSameOrigin = Boolean(baseOrigin && new URL(fileURL).origin === baseOrigin)\n      const headers = uploadConfig.externalFileHeaderFilter\n        ? uploadConfig.externalFileHeaderFilter(\n            { ...requestHeaders },\n            { isSameOrigin, url: fileURL },\n          )\n        : {\n            cookie: cookies\n              .filter(\n                (cookie) =>\n                  isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix),\n              )\n              .join(';'),\n          }\n\n      const skipSafeFetch: boolean =\n        uploadConfig.skipSafeFetch === true\n          ? uploadConfig.skipSafeFetch\n          : Array.isArray(uploadConfig.skipSafeFetch) &&\n            isURLAllowed(fileURL, uploadConfig.skipSafeFetch)\n\n      const isAllowedPasteUrl: boolean | undefined =\n        uploadConfig.pasteURL &&\n        uploadConfig.pasteURL.allowList &&\n        isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n\n      if (skipSafeFetch || isAllowedPasteUrl) {\n        res = await fetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n          redirect: 'manual',\n        })\n      } else {\n        // Default\n        res = await safeFetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n        })\n      }\n\n      if (res.status >= 300 && res.status < 400) {\n        redirectCount++\n        if (redirectCount > maxRedirects) {\n          throw new APIError(`Too many redirects (max ${maxRedirects})`, 403)\n        }\n        const location = res.headers.get('location')\n        if (location) {\n          fileURL = parseFileURL(location, new URL(fileURL)).toString()\n          if (\n            uploadConfig.pasteURL &&\n            uploadConfig.pasteURL.allowList &&\n            !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n          ) {\n            throw new APIError('Redirect target is not allowed.', 400)\n          }\n          continue\n        }\n      }\n\n      break\n    }\n\n    if (!res || !res.ok) {\n      throw new APIError(`Failed to fetch file from ${fileURL}`, res?.status)\n    }\n\n    const data = await res.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: res.headers.get('content-type') || undefined!,\n      size: Number(res.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","getRequestOrigin","isURLAllowed","safeFetch","hasProtocol","url","test","validateFileURL","protocol","parseFileURL","base","URL","error","getRequestBaseURL","req","requestURL","host","headers","get","undefined","getExternalFile","data","uploadConfig","filename","baseOrigin","parsedFileURL","requestOrigin","config","payload","requestBaseURL","origin","fileURL","toString","requestHeaders","Object","fromEntries","Headers","cookies","split","res","redirectCount","maxRedirects","isSameOrigin","Boolean","externalFileHeaderFilter","cookie","filter","trim","startsWith","cookiePrefix","join","skipSafeFetch","Array","isArray","isAllowedPasteUrl","pasteURL","allowList","fetch","credentials","method","redirect","status","location","ok","arrayBuffer","name","Buffer","from","mimetype","size","Number"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,SAAS,QAAQ,iBAAgB;AAQ1C,MAAMC,cAAc,CAACC,MAAyB,sBAAsBC,IAAI,CAACD;AAEzE,MAAME,kBAAkB,CAACF;IACvB,IAAIA,IAAIG,QAAQ,KAAK,WAAWH,IAAIG,QAAQ,KAAK,UAAU;QACzD,MAAM,IAAIR,SAAS,8CAA8C;IACnE;IAEA,OAAOK;AACT;AAEA,MAAMI,eAAe,CAACJ,KAAaK;IACjC,IAAI;QACF,OAAOH,gBAAgB,IAAII,IAAIN,KAAKK;IACtC,EAAE,OAAOE,OAAO;QACd,IAAIA,iBAAiBZ,UAAU;YAC7B,MAAMY;QACR;QAEA,MAAM,IAAIZ,SAAS,8BAA8B;IACnD;AACF;AAEA,MAAMa,oBAAoB,CAACC;IACzB,IAAI;QACF,MAAMC,aAAaR,gBAAgB,IAAII,IAAIG,IAAIT,GAAG;QAClD,MAAMW,OAAOF,IAAIG,OAAO,CAACC,GAAG,CAAC,WAAWH,WAAWC,IAAI;QAEvD,OAAOT,gBAAgB,IAAII,IAAI,GAAGI,WAAWP,QAAQ,CAAC,EAAE,EAAEQ,MAAM;IAClE,EAAE,OAAM;QACN,OAAOG;IACT;AACF;AAEA,OAAO,MAAMC,kBAAkB,OAAO,EAAEC,IAAI,EAAEP,GAAG,EAAEQ,YAAY,EAAQ;IACrE,MAAM,EAAEC,QAAQ,EAAElB,GAAG,EAAE,GAAGgB;IAE1B,IAAI,OAAOhB,QAAQ,UAAU;QAC3B,IAAImB;QACJ,IAAIC;QAEJ,IAAIrB,YAAYC,MAAM;YACpBoB,gBAAgBhB,aAAaJ;QAC/B,OAAO;YACL,MAAMqB,gBAAgBzB,iBAAiB;gBAAE0B,QAAQb,IAAIc,OAAO,CAACD,MAAM;gBAAEb;YAAI;YACzE,IAAIe;YAEJ,IAAIH,eAAe;gBACjBG,iBAAiBpB,aAAaiB;gBAC9BF,aAAaK,eAAeC,MAAM;YACpC,OAAO;gBACLD,iBAAiBhB,kBAAkBC;YACrC;YAEA,IAAI,CAACe,gBAAgB;gBACnB,MAAM,IAAI7B,SAAS,kEAAkE;YACvF;YAEAyB,gBAAgBhB,aAAaJ,KAAKwB;QACpC;QAEA,IAAIE,UAAUN,cAAcO,QAAQ;QACpC,MAAMC,iBAAiBC,OAAOC,WAAW,CAAC,IAAIC,QAAQtB,IAAIG,OAAO;QACjE,MAAMoB,UAAU,AAACvB,CAAAA,IAAIG,OAAO,CAACC,GAAG,CAAC,aAAa,EAAC,EAAGoB,KAAK,CAAC;QAExD,IAAIC;QACJ,IAAIC,gBAAgB;QACpB,MAAMC,eAAe;QAErB,MAAOD,iBAAiBC,aAAc;YACpC,MAAMC,eAAeC,QAAQnB,cAAc,IAAIb,IAAIoB,SAASD,MAAM,KAAKN;YACvE,MAAMP,UAAUK,aAAasB,wBAAwB,GACjDtB,aAAasB,wBAAwB,CACnC;gBAAE,GAAGX,cAAc;YAAC,GACpB;gBAAES;gBAAcrC,KAAK0B;YAAQ,KAE/B;gBACEc,QAAQR,QACLS,MAAM,CACL,CAACD,SACCH,gBAAgB,CAACG,OAAOE,IAAI,GAAGC,UAAU,CAAClC,IAAIc,OAAO,CAACD,MAAM,CAACsB,YAAY,GAE5EC,IAAI,CAAC;YACV;YAEJ,MAAMC,gBACJ7B,aAAa6B,aAAa,KAAK,OAC3B7B,aAAa6B,aAAa,GAC1BC,MAAMC,OAAO,CAAC/B,aAAa6B,aAAa,KACxCjD,aAAa6B,SAAST,aAAa6B,aAAa;YAEtD,MAAMG,oBACJhC,aAAaiC,QAAQ,IACrBjC,aAAaiC,QAAQ,CAACC,SAAS,IAC/BtD,aAAa6B,SAAST,aAAaiC,QAAQ,CAACC,SAAS;YAEvD,IAAIL,iBAAiBG,mBAAmB;gBACtCf,MAAM,MAAMkB,MAAM1B,SAAS;oBACzB2B,aAAa;oBACbzC;oBACA0C,QAAQ;oBACRC,UAAU;gBACZ;YACF,OAAO;gBACL,UAAU;gBACVrB,MAAM,MAAMpC,UAAU4B,SAAS;oBAC7B2B,aAAa;oBACbzC;oBACA0C,QAAQ;gBACV;YACF;YAEA,IAAIpB,IAAIsB,MAAM,IAAI,OAAOtB,IAAIsB,MAAM,GAAG,KAAK;gBACzCrB;gBACA,IAAIA,gBAAgBC,cAAc;oBAChC,MAAM,IAAIzC,SAAS,CAAC,wBAAwB,EAAEyC,aAAa,CAAC,CAAC,EAAE;gBACjE;gBACA,MAAMqB,WAAWvB,IAAItB,OAAO,CAACC,GAAG,CAAC;gBACjC,IAAI4C,UAAU;oBACZ/B,UAAUtB,aAAaqD,UAAU,IAAInD,IAAIoB,UAAUC,QAAQ;oBAC3D,IACEV,aAAaiC,QAAQ,IACrBjC,aAAaiC,QAAQ,CAACC,SAAS,IAC/B,CAACtD,aAAa6B,SAAST,aAAaiC,QAAQ,CAACC,SAAS,GACtD;wBACA,MAAM,IAAIxD,SAAS,mCAAmC;oBACxD;oBACA;gBACF;YACF;YAEA;QACF;QAEA,IAAI,CAACuC,OAAO,CAACA,IAAIwB,EAAE,EAAE;YACnB,MAAM,IAAI/D,SAAS,CAAC,0BAA0B,EAAE+B,SAAS,EAAEQ,KAAKsB;QAClE;QAEA,MAAMxC,OAAO,MAAMkB,IAAIyB,WAAW;QAElC,OAAO;YACLC,MAAM1C;YACNF,MAAM6C,OAAOC,IAAI,CAAC9C;YAClB+C,UAAU7B,IAAItB,OAAO,CAACC,GAAG,CAAC,mBAAmBC;YAC7CkD,MAAMC,OAAO/B,IAAItB,OAAO,CAACC,GAAG,CAAC,sBAAsB;QACrD;IACF;IAEA,MAAM,IAAIlB,SAAS,oBAAoB;AACzC,EAAC"}

package/dist/uploads/getFileTypeFallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFileTypeFallback.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeFallback.ts"],"names":[],"mappings":"AAAA,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAiBD,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,UAOlD,CAAA"}
+{"version":3,"file":"getFileTypeFallback.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeFallback.ts"],"names":[],"mappings":"AAEA,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAkBD,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,UAOlD,CAAA"}

package/dist/uploads/getFileTypeFallback.js

@@ -1,3 +1,4 @@
+import { getFileExtension, getSanitizedUploadFilename } from './getFileTypeIdentity.js';
 const extensionMap = {
     css: 'text/css',
     csv: 'text/csv',
@@ -7,11 +8,12 @@ const extensionMap = {
     json: 'application/json',
     md: 'text/markdown',
     svg: 'image/svg+xml',
+    xhtml: 'application/xhtml+xml',
     xml: 'application/xml',
     yml: 'application/x-yaml'
 };
 export const getFileTypeFallback = (path)=>{
-    const ext = path.split('.').pop() || 'txt';
+    const ext = getFileExtension(getSanitizedUploadFilename(path)).toLowerCase() || 'txt';
     return {
         ext,
         mime: extensionMap[ext] || 'text/plain'

package/dist/uploads/getFileTypeFallback.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getFileTypeFallback.ts"],"sourcesContent":["type ReturnType = {\n  ext: string\n  mime: string\n}\n\nconst extensionMap: {\n  [ext: string]: string\n} = {\n  css: 'text/css',\n  csv: 'text/csv',\n  htm: 'text/html',\n  html: 'text/html',\n  js: 'application/javascript',\n  json: 'application/json',\n  md: 'text/markdown',\n  svg: 'image/svg+xml',\n  xml: 'application/xml',\n  yml: 'application/x-yaml',\n}\n\nexport const getFileTypeFallback = (path: string): ReturnType => {\n  const ext = path.split('.').pop() || 'txt'\n\n  return {\n    ext,\n    mime: extensionMap[ext] || 'text/plain',\n  }\n}\n"],"names":["extensionMap","css","csv","htm","html","js","json","md","svg","xml","yml","getFileTypeFallback","path","ext","split","pop","mime"],"mappings":"AAKA,MAAMA,eAEF;IACFC,KAAK;IACLC,KAAK;IACLC,KAAK;IACLC,MAAM;IACNC,IAAI;IACJC,MAAM;IACNC,IAAI;IACJC,KAAK;IACLC,KAAK;IACLC,KAAK;AACP;AAEA,OAAO,MAAMC,sBAAsB,CAACC;IAClC,MAAMC,MAAMD,KAAKE,KAAK,CAAC,KAAKC,GAAG,MAAM;IAErC,OAAO;QACLF;QACAG,MAAMhB,YAAY,CAACa,IAAI,IAAI;IAC7B;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/getFileTypeFallback.ts"],"sourcesContent":["import { getFileExtension, getSanitizedUploadFilename } from './getFileTypeIdentity.js'\n\ntype ReturnType = {\n  ext: string\n  mime: string\n}\n\nconst extensionMap: {\n  [ext: string]: string\n} = {\n  css: 'text/css',\n  csv: 'text/csv',\n  htm: 'text/html',\n  html: 'text/html',\n  js: 'application/javascript',\n  json: 'application/json',\n  md: 'text/markdown',\n  svg: 'image/svg+xml',\n  xhtml: 'application/xhtml+xml',\n  xml: 'application/xml',\n  yml: 'application/x-yaml',\n}\n\nexport const getFileTypeFallback = (path: string): ReturnType => {\n  const ext = getFileExtension(getSanitizedUploadFilename(path)).toLowerCase() || 'txt'\n\n  return {\n    ext,\n    mime: extensionMap[ext] || 'text/plain',\n  }\n}\n"],"names":["getFileExtension","getSanitizedUploadFilename","extensionMap","css","csv","htm","html","js","json","md","svg","xhtml","xml","yml","getFileTypeFallback","path","ext","toLowerCase","mime"],"mappings":"AAAA,SAASA,gBAAgB,EAAEC,0BAA0B,QAAQ,2BAA0B;AAOvF,MAAMC,eAEF;IACFC,KAAK;IACLC,KAAK;IACLC,KAAK;IACLC,MAAM;IACNC,IAAI;IACJC,MAAM;IACNC,IAAI;IACJC,KAAK;IACLC,OAAO;IACPC,KAAK;IACLC,KAAK;AACP;AAEA,OAAO,MAAMC,sBAAsB,CAACC;IAClC,MAAMC,MAAMhB,iBAAiBC,2BAA2Bc,OAAOE,WAAW,MAAM;IAEhF,OAAO;QACLD;QACAE,MAAMhB,YAAY,CAACc,IAAI,IAAI;IAC7B;AACF,EAAC"}

package/dist/uploads/getFileTypeIdentity.d.ts

@@ -0,0 +1,19 @@
+export declare const getFileExtension: (filename: string) => string;
+export declare const getSanitizedUploadFilename: (filename: string, outputExtension?: string) => string;
+export declare const getMimeTypeEssence: (mimeType?: null | string) => string;
+export declare const isSvgMimeType: (mimeType?: null | string) => boolean;
+export declare const isXmlMimeType: (mimeType?: null | string) => boolean;
+export declare const isSvgUpload: ({ filename, mimeType, }: {
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+export declare const isXmlUpload: ({ filename, mimeType, }: {
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+export declare const uploadRequiresServerValidation: (upload: {
+    allowRestrictedFileTypes?: boolean;
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+//# sourceMappingURL=getFileTypeIdentity.d.ts.map

package/dist/uploads/getFileTypeIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFileTypeIdentity.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeIdentity.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,gBAAgB,aAAc,MAAM,KAAG,MASnD,CAAA;AAED,eAAO,MAAM,0BAA0B,aAAc,MAAM,oBAAoB,MAAM,KAAG,MAOvF,CAAA;AAED,eAAO,MAAM,kBAAkB,cAAe,IAAI,GAAG,MAAM,KAAG,MAQ7D,CAAA;AAED,eAAO,MAAM,aAAa,cAAe,IAAI,GAAG,MAAM,KAAG,OACP,CAAA;AAElD,eAAO,MAAM,aAAa,cAAe,IAAI,GAAG,MAAM,KAAG,OAQxD,CAAA;AAED,eAAO,MAAM,WAAW,4BAGrB;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAEqB,CAAA;AAEzB,eAAO,MAAM,WAAW,4BAGrB;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAEqB,CAAA;AAEzB,eAAO,MAAM,8BAA8B,WAAY;IACrD,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAA2F,CAAA"}

package/dist/uploads/getFileTypeIdentity.js

@@ -0,0 +1,34 @@
+import sanitize from 'sanitize-filename';
+import { sanitizeFilename } from '../utilities/sanitizeFilename.js';
+export const getFileExtension = (filename)=>{
+    if (!filename.includes('.')) {
+        return '';
+    }
+    const extension = filename.split('.').pop() || '';
+    const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1);
+    return extensionWithoutSuffix;
+};
+export const getSanitizedUploadFilename = (filename, outputExtension)=>{
+    const basename = sanitizeFilename(filename);
+    const sourceExtension = getFileExtension(basename);
+    const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename);
+    const extension = outputExtension ?? sourceExtension;
+    return `${baseFilename}${extension ? `.${extension}` : ''}`;
+};
+export const getMimeTypeEssence = (mimeType)=>{
+    if (!mimeType) {
+        return '';
+    }
+    const [essence = ''] = mimeType.split(';', 1);
+    return essence.trim().toLowerCase();
+};
+export const isSvgMimeType = (mimeType)=>getMimeTypeEssence(mimeType) === 'image/svg+xml';
+export const isXmlMimeType = (mimeType)=>{
+    const mimeTypeEssence = getMimeTypeEssence(mimeType);
+    return mimeTypeEssence === 'application/xml' || mimeTypeEssence === 'text/xml' || mimeTypeEssence.endsWith('+xml');
+};
+export const isSvgUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' || isSvgMimeType(mimeType);
+export const isXmlUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' || isXmlMimeType(mimeType);
+export const uploadRequiresServerValidation = (upload)=>!upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload));
+
+//# sourceMappingURL=getFileTypeIdentity.js.map

package/dist/uploads/getFileTypeIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/getFileTypeIdentity.ts"],"sourcesContent":["import sanitize from 'sanitize-filename'\n\nimport { sanitizeFilename } from '../utilities/sanitizeFilename.js'\n\nexport const getFileExtension = (filename: string): string => {\n  if (!filename.includes('.')) {\n    return ''\n  }\n\n  const extension = filename.split('.').pop() || ''\n  const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1)\n\n  return extensionWithoutSuffix\n}\n\nexport const getSanitizedUploadFilename = (filename: string, outputExtension?: string): string => {\n  const basename = sanitizeFilename(filename)\n  const sourceExtension = getFileExtension(basename)\n  const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename)\n  const extension = outputExtension ?? sourceExtension\n\n  return `${baseFilename}${extension ? `.${extension}` : ''}`\n}\n\nexport const getMimeTypeEssence = (mimeType?: null | string): string => {\n  if (!mimeType) {\n    return ''\n  }\n\n  const [essence = ''] = mimeType.split(';', 1)\n\n  return essence.trim().toLowerCase()\n}\n\nexport const isSvgMimeType = (mimeType?: null | string): boolean =>\n  getMimeTypeEssence(mimeType) === 'image/svg+xml'\n\nexport const isXmlMimeType = (mimeType?: null | string): boolean => {\n  const mimeTypeEssence = getMimeTypeEssence(mimeType)\n\n  return (\n    mimeTypeEssence === 'application/xml' ||\n    mimeTypeEssence === 'text/xml' ||\n    mimeTypeEssence.endsWith('+xml')\n  )\n}\n\nexport const isSvgUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' ||\n  isSvgMimeType(mimeType)\n\nexport const isXmlUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' ||\n  isXmlMimeType(mimeType)\n\nexport const uploadRequiresServerValidation = (upload: {\n  allowRestrictedFileTypes?: boolean\n  filename: string\n  mimeType?: null | string\n}): boolean => !upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload))\n"],"names":["sanitize","sanitizeFilename","getFileExtension","filename","includes","extension","split","pop","extensionWithoutSuffix","getSanitizedUploadFilename","outputExtension","basename","sourceExtension","baseFilename","substring","lastIndexOf","getMimeTypeEssence","mimeType","essence","trim","toLowerCase","isSvgMimeType","isXmlMimeType","mimeTypeEssence","endsWith","isSvgUpload","isXmlUpload","uploadRequiresServerValidation","upload","allowRestrictedFileTypes"],"mappings":"AAAA,OAAOA,cAAc,oBAAmB;AAExC,SAASC,gBAAgB,QAAQ,mCAAkC;AAEnE,OAAO,MAAMC,mBAAmB,CAACC;IAC/B,IAAI,CAACA,SAASC,QAAQ,CAAC,MAAM;QAC3B,OAAO;IACT;IAEA,MAAMC,YAAYF,SAASG,KAAK,CAAC,KAAKC,GAAG,MAAM;IAC/C,MAAM,CAACC,yBAAyB,EAAE,CAAC,GAAGH,UAAUC,KAAK,CAAC,QAAQ;IAE9D,OAAOE;AACT,EAAC;AAED,OAAO,MAAMC,6BAA6B,CAACN,UAAkBO;IAC3D,MAAMC,WAAWV,iBAAiBE;IAClC,MAAMS,kBAAkBV,iBAAiBS;IACzC,MAAME,eAAeb,SAASW,SAASG,SAAS,CAAC,GAAGH,SAASI,WAAW,CAAC,SAASJ;IAClF,MAAMN,YAAYK,mBAAmBE;IAErC,OAAO,GAAGC,eAAeR,YAAY,CAAC,CAAC,EAAEA,WAAW,GAAG,IAAI;AAC7D,EAAC;AAED,OAAO,MAAMW,qBAAqB,CAACC;IACjC,IAAI,CAACA,UAAU;QACb,OAAO;IACT;IAEA,MAAM,CAACC,UAAU,EAAE,CAAC,GAAGD,SAASX,KAAK,CAAC,KAAK;IAE3C,OAAOY,QAAQC,IAAI,GAAGC,WAAW;AACnC,EAAC;AAED,OAAO,MAAMC,gBAAgB,CAACJ,WAC5BD,mBAAmBC,cAAc,gBAAe;AAElD,OAAO,MAAMK,gBAAgB,CAACL;IAC5B,MAAMM,kBAAkBP,mBAAmBC;IAE3C,OACEM,oBAAoB,qBACpBA,oBAAoB,cACpBA,gBAAgBC,QAAQ,CAAC;AAE7B,EAAC;AAED,OAAO,MAAMC,cAAc,CAAC,EAC1BtB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEC,cAAcJ,UAAS;AAEzB,OAAO,MAAMS,cAAc,CAAC,EAC1BvB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEE,cAAcL,UAAS;AAEzB,OAAO,MAAMU,iCAAiC,CAACC,SAIhC,CAACA,OAAOC,wBAAwB,IAAKJ,CAAAA,YAAYG,WAAWF,YAAYE,OAAM,EAAE"}

package/dist/uploads/getFileTypeIdentity.spec.js

@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { getSanitizedUploadFilename, isXmlMimeType } from './getFileTypeIdentity.js';
+describe('getSanitizedUploadFilename', ()=>{
+    it('should use the output extension while preserving the sanitized source basename', ()=>{
+        expect(getSanitizedUploadFilename('incoming/image.jpg', 'png')).toBe('image.png');
+    });
+});
+describe('isXmlMimeType', ()=>{
+    it.each([
+        [
+            'application/xml',
+            true
+        ],
+        [
+            'text/xml',
+            true
+        ],
+        [
+            'application/atom+xml',
+            true
+        ],
+        [
+            'image/svg+xml',
+            true
+        ],
+        [
+            'APPLICATION/XML',
+            true
+        ],
+        [
+            ' Application/Atom+Xml; Charset=UTF-8 ',
+            true
+        ],
+        [
+            'text/plain',
+            false
+        ]
+    ])('should classify %s as %s', (mimeType, expected)=>{
+        expect(isXmlMimeType(mimeType)).toBe(expected);
+    });
+});
+
+//# sourceMappingURL=getFileTypeIdentity.spec.js.map

package/dist/uploads/getFileTypeIdentity.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/getFileTypeIdentity.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { getSanitizedUploadFilename, isXmlMimeType } from './getFileTypeIdentity.js'\n\ndescribe('getSanitizedUploadFilename', () => {\n  it('should use the output extension while preserving the sanitized source basename', () => {\n    expect(getSanitizedUploadFilename('incoming/image.jpg', 'png')).toBe('image.png')\n  })\n})\n\ndescribe('isXmlMimeType', () => {\n  it.each([\n    ['application/xml', true],\n    ['text/xml', true],\n    ['application/atom+xml', true],\n    ['image/svg+xml', true],\n    ['APPLICATION/XML', true],\n    [' Application/Atom+Xml; Charset=UTF-8 ', true],\n    ['text/plain', false],\n  ])('should classify %s as %s', (mimeType, expected) => {\n    expect(isXmlMimeType(mimeType)).toBe(expected)\n  })\n})\n"],"names":["describe","expect","it","getSanitizedUploadFilename","isXmlMimeType","toBe","each","mimeType","expected"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,0BAA0B,EAAEC,aAAa,QAAQ,2BAA0B;AAEpFJ,SAAS,8BAA8B;IACrCE,GAAG,kFAAkF;QACnFD,OAAOE,2BAA2B,sBAAsB,QAAQE,IAAI,CAAC;IACvE;AACF;AAEAL,SAAS,iBAAiB;IACxBE,GAAGI,IAAI,CAAC;QACN;YAAC;YAAmB;SAAK;QACzB;YAAC;YAAY;SAAK;QAClB;YAAC;YAAwB;SAAK;QAC9B;YAAC;YAAiB;SAAK;QACvB;YAAC;YAAmB;SAAK;QACzB;YAAC;YAAyC;SAAK;QAC/C;YAAC;YAAc;SAAM;KACtB,EAAE,4BAA4B,CAACC,UAAUC;QACxCP,OAAOG,cAAcG,WAAWF,IAAI,CAACG;IACvC;AACF"}

package/dist/uploads/isProcessableImage.d.ts

@@ -0,0 +1,2 @@
+export declare function isProcessableImage(mimeType: string): boolean;
+//# sourceMappingURL=isProcessableImage.d.ts.map

package/dist/uploads/isProcessableImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isProcessableImage.d.ts","sourceRoot":"","sources":["../../src/uploads/isProcessableImage.ts"],"names":[],"mappings":"AAGA,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/uploads/isProcessableImage.js

@@ -0,0 +1,7 @@
+import { canResizeImage } from './canResizeImage.js';
+import { isImage } from './isImage.js';
+export function isProcessableImage(mimeType) {
+    return isImage(mimeType) || canResizeImage(mimeType);
+}
+
+//# sourceMappingURL=isProcessableImage.js.map

package/dist/uploads/isProcessableImage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/isProcessableImage.ts"],"sourcesContent":["import { canResizeImage } from './canResizeImage.js'\nimport { isImage } from './isImage.js'\n\nexport function isProcessableImage(mimeType: string): boolean {\n  return isImage(mimeType) || canResizeImage(mimeType)\n}\n"],"names":["canResizeImage","isImage","isProcessableImage","mimeType"],"mappings":"AAAA,SAASA,cAAc,QAAQ,sBAAqB;AACpD,SAASC,OAAO,QAAQ,eAAc;AAEtC,OAAO,SAASC,mBAAmBC,QAAgB;IACjD,OAAOF,QAAQE,aAAaH,eAAeG;AAC7C"}

package/dist/uploads/safeFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safeFetch.d.ts","sourceRoot":"","sources":["../../src/uploads/safeFetch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEpD;;GAEG;AACH,eAAO,MAAM,yBAAyB;;CAErC,CAAA;AAgDD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,4FAAoD,OAAO,CAAC,QAAQ,CA4CzF,CAAA"}
+{"version":3,"file":"safeFetch.d.ts","sourceRoot":"","sources":["../../src/uploads/safeFetch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEpD;;GAEG;AACH,eAAO,MAAM,yBAAyB;;CAErC,CAAA;AAuDD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,4FAAoD,OAAO,CAAC,QAAQ,CA4CzF,CAAA"}

package/dist/uploads/safeFetch.js

@@ -6,6 +6,7 @@ import { Agent, fetch as undiciFetch } from 'undici';
  */ export const _internal_safeFetchGlobal = {
     lookup
 };
+const buildBlockedFetchError = (hostname)=>new Error(`Blocked unsafe attempt to ${hostname}. This host resolves to a private or internal address. ` + `If this is a trusted destination, allowlist it via the upload collection's "skipSafeFetch" option ` + `(https://payloadcms.com/docs/upload/overview#skip-safe-fetch).`);
 const isSafeIp = (ip)=>{
     try {
         if (!ip) {
@@ -39,7 +40,7 @@ const ssrfFilterInterceptor = (hostname, options, callback)=>{
                 ];
             }
             if (ips.some((ip)=>!isSafeIp(ip))) {
-                callback(new Error(`Blocked unsafe attempt to ${hostname}`), address, family);
+                callback(buildBlockedFetchError(hostname), address, family);
                 return;
             }
             callback(null, address, family);
@@ -68,7 +69,7 @@ const safeDispatcher = new Agent({
         }
         if (ipaddr.isValid(hostname)) {
             if (!isSafeIp(hostname)) {
-                throw new Error(`Blocked unsafe attempt to ${hostname}`);
+                throw buildBlockedFetchError(hostname);
             }
         }
         return await undiciFetch(url, {

package/dist/uploads/safeFetch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/safeFetch.ts"],"sourcesContent":["import type { LookupFunction } from 'net'\n\nimport { lookup } from 'dns'\nimport ipaddr from 'ipaddr.js'\nimport { Agent, fetch as undiciFetch } from 'undici'\n\n/**\n * @internal this is used to mock the IP `lookup` function in integration tests\n */\nexport const _internal_safeFetchGlobal = {\n  lookup,\n}\n\nconst isSafeIp = (ip: string) => {\n  try {\n    if (!ip) {\n      return false\n    }\n\n    if (!ipaddr.isValid(ip)) {\n      return false\n    }\n\n    const parsedIpAddress = ipaddr.parse(ip)\n    const range = parsedIpAddress.range()\n    if (range !== 'unicast') {\n      return false // Private IP Range\n    }\n  } catch (ignore) {\n    return false\n  }\n  return true\n}\n\nconst ssrfFilterInterceptor: LookupFunction = (hostname, options, callback) => {\n  _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      let ips = [] as string[]\n      if (Array.isArray(address)) {\n        ips = address.map((a) => a.address)\n      } else {\n        ips = [address]\n      }\n\n      if (ips.some((ip) => !isSafeIp(ip))) {\n        callback(new Error(`Blocked unsafe attempt to ${hostname}`), address, family)\n        return\n      }\n\n      callback(null, address, family)\n    }\n  })\n}\n\nconst safeDispatcher = new Agent({\n  connect: { lookup: ssrfFilterInterceptor },\n})\n/**\n * A \"safe\" version of undici's fetch that prevents SSRF attacks.\n *\n * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.\n * - Validates domain names by resolving them to IP addresses and checking if they're safe.\n * - Undici was used because it supported interceptors as well as \"credentials: include\". Native fetch\n */\nexport const safeFetch = async (...args: Parameters<typeof undiciFetch>): Promise<Response> => {\n  const [unverifiedUrl, options] = args\n\n  try {\n    const url = new URL(unverifiedUrl)\n\n    let hostname = url.hostname\n\n    // Strip brackets from IPv6 addresses (e.g., \"[::1]\" => \"::1\")\n    if (hostname.startsWith('[') && hostname.endsWith(']')) {\n      hostname = hostname.slice(1, -1)\n    }\n\n    if (ipaddr.isValid(hostname)) {\n      if (!isSafeIp(hostname)) {\n        throw new Error(`Blocked unsafe attempt to ${hostname}`)\n      }\n    }\n    return (await undiciFetch(url, {\n      ...options,\n      dispatcher: safeDispatcher,\n      redirect: 'manual', // Prevent automatic redirects\n    })) as unknown as Response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {\n        // Errors thrown from within interceptors always have 'fetch error' as the message\n        // The desired message we want to bubble up is in the cause\n        throw new Error(error.cause.message)\n      } else {\n        let stringifiedUrl: string | undefined = undefined\n        if (typeof unverifiedUrl === 'string') {\n          stringifiedUrl = unverifiedUrl\n        } else if (unverifiedUrl instanceof URL) {\n          stringifiedUrl = unverifiedUrl.toString()\n        } else if (unverifiedUrl instanceof Request) {\n          stringifiedUrl = unverifiedUrl.url\n        }\n\n        throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`)\n      }\n    }\n    throw error\n  }\n}\n"],"names":["lookup","ipaddr","Agent","fetch","undiciFetch","_internal_safeFetchGlobal","isSafeIp","ip","isValid","parsedIpAddress","parse","range","ignore","ssrfFilterInterceptor","hostname","options","callback","err","address","family","ips","Array","isArray","map","a","some","Error","safeDispatcher","connect","safeFetch","args","unverifiedUrl","url","URL","startsWith","endsWith","slice","dispatcher","redirect","error","cause","message","includes","stringifiedUrl","undefined","toString","Request"],"mappings":"AAEA,SAASA,MAAM,QAAQ,MAAK;AAC5B,OAAOC,YAAY,YAAW;AAC9B,SAASC,KAAK,EAAEC,SAASC,WAAW,QAAQ,SAAQ;AAEpD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IACvCL;AACF,EAAC;AAED,MAAMM,WAAW,CAACC;IAChB,IAAI;QACF,IAAI,CAACA,IAAI;YACP,OAAO;QACT;QAEA,IAAI,CAACN,OAAOO,OAAO,CAACD,KAAK;YACvB,OAAO;QACT;QAEA,MAAME,kBAAkBR,OAAOS,KAAK,CAACH;QACrC,MAAMI,QAAQF,gBAAgBE,KAAK;QACnC,IAAIA,UAAU,WAAW;YACvB,OAAO,MAAM,mBAAmB;;QAClC;IACF,EAAE,OAAOC,QAAQ;QACf,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAMC,wBAAwC,CAACC,UAAUC,SAASC;IAChEX,0BAA0BL,MAAM,CAACc,UAAUC,SAAS,CAACE,KAAKC,SAASC;QACjE,IAAIF,KAAK;YACPD,SAASC,KAAKC,SAASC;QACzB,OAAO;YACL,IAAIC,MAAM,EAAE;YACZ,IAAIC,MAAMC,OAAO,CAACJ,UAAU;gBAC1BE,MAAMF,QAAQK,GAAG,CAAC,CAACC,IAAMA,EAAEN,OAAO;YACpC,OAAO;gBACLE,MAAM;oBAACF;iBAAQ;YACjB;YAEA,IAAIE,IAAIK,IAAI,CAAC,CAAClB,KAAO,CAACD,SAASC,MAAM;gBACnCS,SAAS,IAAIU,MAAM,CAAC,0BAA0B,EAAEZ,UAAU,GAAGI,SAASC;gBACtE;YACF;YAEAH,SAAS,MAAME,SAASC;QAC1B;IACF;AACF;AAEA,MAAMQ,iBAAiB,IAAIzB,MAAM;IAC/B0B,SAAS;QAAE5B,QAAQa;IAAsB;AAC3C;AACA;;;;;;CAMC,GACD,OAAO,MAAMgB,YAAY,OAAO,GAAGC;IACjC,MAAM,CAACC,eAAehB,QAAQ,GAAGe;IAEjC,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIF;QAEpB,IAAIjB,WAAWkB,IAAIlB,QAAQ;QAE3B,8DAA8D;QAC9D,IAAIA,SAASoB,UAAU,CAAC,QAAQpB,SAASqB,QAAQ,CAAC,MAAM;YACtDrB,WAAWA,SAASsB,KAAK,CAAC,GAAG,CAAC;QAChC;QAEA,IAAInC,OAAOO,OAAO,CAACM,WAAW;YAC5B,IAAI,CAACR,SAASQ,WAAW;gBACvB,MAAM,IAAIY,MAAM,CAAC,0BAA0B,EAAEZ,UAAU;YACzD;QACF;QACA,OAAQ,MAAMV,YAAY4B,KAAK;YAC7B,GAAGjB,OAAO;YACVsB,YAAYV;YACZW,UAAU;QACZ;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBb,OAAO;YAC1B,IAAIa,MAAMC,KAAK,YAAYd,SAASa,MAAMC,KAAK,CAACC,OAAO,CAACC,QAAQ,CAAC,WAAW;gBAC1E,kFAAkF;gBAClF,2DAA2D;gBAC3D,MAAM,IAAIhB,MAAMa,MAAMC,KAAK,CAACC,OAAO;YACrC,OAAO;gBACL,IAAIE,iBAAqCC;gBACzC,IAAI,OAAOb,kBAAkB,UAAU;oBACrCY,iBAAiBZ;gBACnB,OAAO,IAAIA,yBAAyBE,KAAK;oBACvCU,iBAAiBZ,cAAcc,QAAQ;gBACzC,OAAO,IAAId,yBAAyBe,SAAS;oBAC3CH,iBAAiBZ,cAAcC,GAAG;gBACpC;gBAEA,MAAM,IAAIN,MAAM,CAAC,qBAAqB,EAAEiB,eAAe,EAAE,EAAEJ,MAAME,OAAO,EAAE;YAC5E;QACF;QACA,MAAMF;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/safeFetch.ts"],"sourcesContent":["import type { LookupFunction } from 'net'\n\nimport { lookup } from 'dns'\nimport ipaddr from 'ipaddr.js'\nimport { Agent, fetch as undiciFetch } from 'undici'\n\n/**\n * @internal this is used to mock the IP `lookup` function in integration tests\n */\nexport const _internal_safeFetchGlobal = {\n  lookup,\n}\n\nconst buildBlockedFetchError = (hostname: string): Error =>\n  new Error(\n    `Blocked unsafe attempt to ${hostname}. This host resolves to a private or internal address. ` +\n      `If this is a trusted destination, allowlist it via the upload collection's \"skipSafeFetch\" option ` +\n      `(https://payloadcms.com/docs/upload/overview#skip-safe-fetch).`,\n  )\n\nconst isSafeIp = (ip: string) => {\n  try {\n    if (!ip) {\n      return false\n    }\n\n    if (!ipaddr.isValid(ip)) {\n      return false\n    }\n\n    const parsedIpAddress = ipaddr.parse(ip)\n    const range = parsedIpAddress.range()\n    if (range !== 'unicast') {\n      return false // Private IP Range\n    }\n  } catch (ignore) {\n    return false\n  }\n  return true\n}\n\nconst ssrfFilterInterceptor: LookupFunction = (hostname, options, callback) => {\n  _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      let ips = [] as string[]\n      if (Array.isArray(address)) {\n        ips = address.map((a) => a.address)\n      } else {\n        ips = [address]\n      }\n\n      if (ips.some((ip) => !isSafeIp(ip))) {\n        callback(buildBlockedFetchError(hostname), address, family)\n        return\n      }\n\n      callback(null, address, family)\n    }\n  })\n}\n\nconst safeDispatcher = new Agent({\n  connect: { lookup: ssrfFilterInterceptor },\n})\n/**\n * A \"safe\" version of undici's fetch that prevents SSRF attacks.\n *\n * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.\n * - Validates domain names by resolving them to IP addresses and checking if they're safe.\n * - Undici was used because it supported interceptors as well as \"credentials: include\". Native fetch\n */\nexport const safeFetch = async (...args: Parameters<typeof undiciFetch>): Promise<Response> => {\n  const [unverifiedUrl, options] = args\n\n  try {\n    const url = new URL(unverifiedUrl)\n\n    let hostname = url.hostname\n\n    // Strip brackets from IPv6 addresses (e.g., \"[::1]\" => \"::1\")\n    if (hostname.startsWith('[') && hostname.endsWith(']')) {\n      hostname = hostname.slice(1, -1)\n    }\n\n    if (ipaddr.isValid(hostname)) {\n      if (!isSafeIp(hostname)) {\n        throw buildBlockedFetchError(hostname)\n      }\n    }\n    return (await undiciFetch(url, {\n      ...options,\n      dispatcher: safeDispatcher,\n      redirect: 'manual', // Prevent automatic redirects\n    })) as unknown as Response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {\n        // Errors thrown from within interceptors always have 'fetch error' as the message\n        // The desired message we want to bubble up is in the cause\n        throw new Error(error.cause.message)\n      } else {\n        let stringifiedUrl: string | undefined = undefined\n        if (typeof unverifiedUrl === 'string') {\n          stringifiedUrl = unverifiedUrl\n        } else if (unverifiedUrl instanceof URL) {\n          stringifiedUrl = unverifiedUrl.toString()\n        } else if (unverifiedUrl instanceof Request) {\n          stringifiedUrl = unverifiedUrl.url\n        }\n\n        throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`)\n      }\n    }\n    throw error\n  }\n}\n"],"names":["lookup","ipaddr","Agent","fetch","undiciFetch","_internal_safeFetchGlobal","buildBlockedFetchError","hostname","Error","isSafeIp","ip","isValid","parsedIpAddress","parse","range","ignore","ssrfFilterInterceptor","options","callback","err","address","family","ips","Array","isArray","map","a","some","safeDispatcher","connect","safeFetch","args","unverifiedUrl","url","URL","startsWith","endsWith","slice","dispatcher","redirect","error","cause","message","includes","stringifiedUrl","undefined","toString","Request"],"mappings":"AAEA,SAASA,MAAM,QAAQ,MAAK;AAC5B,OAAOC,YAAY,YAAW;AAC9B,SAASC,KAAK,EAAEC,SAASC,WAAW,QAAQ,SAAQ;AAEpD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IACvCL;AACF,EAAC;AAED,MAAMM,yBAAyB,CAACC,WAC9B,IAAIC,MACF,CAAC,0BAA0B,EAAED,SAAS,uDAAuD,CAAC,GAC5F,CAAC,kGAAkG,CAAC,GACpG,CAAC,8DAA8D,CAAC;AAGtE,MAAME,WAAW,CAACC;IAChB,IAAI;QACF,IAAI,CAACA,IAAI;YACP,OAAO;QACT;QAEA,IAAI,CAACT,OAAOU,OAAO,CAACD,KAAK;YACvB,OAAO;QACT;QAEA,MAAME,kBAAkBX,OAAOY,KAAK,CAACH;QACrC,MAAMI,QAAQF,gBAAgBE,KAAK;QACnC,IAAIA,UAAU,WAAW;YACvB,OAAO,MAAM,mBAAmB;;QAClC;IACF,EAAE,OAAOC,QAAQ;QACf,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAMC,wBAAwC,CAACT,UAAUU,SAASC;IAChEb,0BAA0BL,MAAM,CAACO,UAAUU,SAAS,CAACE,KAAKC,SAASC;QACjE,IAAIF,KAAK;YACPD,SAASC,KAAKC,SAASC;QACzB,OAAO;YACL,IAAIC,MAAM,EAAE;YACZ,IAAIC,MAAMC,OAAO,CAACJ,UAAU;gBAC1BE,MAAMF,QAAQK,GAAG,CAAC,CAACC,IAAMA,EAAEN,OAAO;YACpC,OAAO;gBACLE,MAAM;oBAACF;iBAAQ;YACjB;YAEA,IAAIE,IAAIK,IAAI,CAAC,CAACjB,KAAO,CAACD,SAASC,MAAM;gBACnCQ,SAASZ,uBAAuBC,WAAWa,SAASC;gBACpD;YACF;YAEAH,SAAS,MAAME,SAASC;QAC1B;IACF;AACF;AAEA,MAAMO,iBAAiB,IAAI1B,MAAM;IAC/B2B,SAAS;QAAE7B,QAAQgB;IAAsB;AAC3C;AACA;;;;;;CAMC,GACD,OAAO,MAAMc,YAAY,OAAO,GAAGC;IACjC,MAAM,CAACC,eAAef,QAAQ,GAAGc;IAEjC,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIF;QAEpB,IAAIzB,WAAW0B,IAAI1B,QAAQ;QAE3B,8DAA8D;QAC9D,IAAIA,SAAS4B,UAAU,CAAC,QAAQ5B,SAAS6B,QAAQ,CAAC,MAAM;YACtD7B,WAAWA,SAAS8B,KAAK,CAAC,GAAG,CAAC;QAChC;QAEA,IAAIpC,OAAOU,OAAO,CAACJ,WAAW;YAC5B,IAAI,CAACE,SAASF,WAAW;gBACvB,MAAMD,uBAAuBC;YAC/B;QACF;QACA,OAAQ,MAAMH,YAAY6B,KAAK;YAC7B,GAAGhB,OAAO;YACVqB,YAAYV;YACZW,UAAU;QACZ;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBhC,OAAO;YAC1B,IAAIgC,MAAMC,KAAK,YAAYjC,SAASgC,MAAMC,KAAK,CAACC,OAAO,CAACC,QAAQ,CAAC,WAAW;gBAC1E,kFAAkF;gBAClF,2DAA2D;gBAC3D,MAAM,IAAInC,MAAMgC,MAAMC,KAAK,CAACC,OAAO;YACrC,OAAO;gBACL,IAAIE,iBAAqCC;gBACzC,IAAI,OAAOb,kBAAkB,UAAU;oBACrCY,iBAAiBZ;gBACnB,OAAO,IAAIA,yBAAyBE,KAAK;oBACvCU,iBAAiBZ,cAAcc,QAAQ;gBACzC,OAAO,IAAId,yBAAyBe,SAAS;oBAC3CH,iBAAiBZ,cAAcC,GAAG;gBACpC;gBAEA,MAAM,IAAIzB,MAAM,CAAC,qBAAqB,EAAEoC,eAAe,EAAE,EAAEJ,MAAME,OAAO,EAAE;YAC5E;QACF;QACA,MAAMF;IACR;AACF,EAAC"}

package/dist/uploads/sanitizeUploadData.d.ts

@@ -0,0 +1,26 @@
+import type { FlattenedField } from '../fields/config/types.js';
+type Operation = 'create' | 'update';
+export type ExternalUploadSource = {
+    filename: string;
+    url: string;
+};
+type UploadDataOptions = {
+    locale?: string;
+    localizedProperties?: Set<string>;
+};
+export declare const getExternalUploadSource: (data: unknown) => ExternalUploadSource | undefined;
+export declare const getUploadDestination: ({ data, file, }: {
+    data: unknown;
+    file: {
+        clientUploadContext?: unknown;
+    } | null | undefined;
+}) => {
+    objectKey?: string;
+    prefix?: string;
+};
+export declare const getLocalizedUploadProperties: (fields: FlattenedField[]) => Set<string>;
+export declare const sanitizeUploadData: <T>(data: T, operation: Operation) => T;
+export declare const mergeUploadDataWithDocument: <T>(data: T, document: unknown, options?: UploadDataOptions) => T;
+export declare const restoreUploadDataFromDocument: <T>(data: T, document: unknown, options?: UploadDataOptions) => T;
+export {};
+//# sourceMappingURL=sanitizeUploadData.d.ts.map

package/dist/uploads/sanitizeUploadData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeUploadData.d.ts","sourceRoot":"","sources":["../../src/uploads/sanitizeUploadData.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI/D,KAAK,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEpC,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,KAAK,iBAAiB,GAAG;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAClC,CAAA;AAQD,eAAO,MAAM,uBAAuB,SAAU,OAAO,KAAG,oBAAoB,GAAG,SAS9E,CAAA;AAKD,eAAO,MAAM,oBAAoB,oBAG9B;IACD,IAAI,EAAE,OAAO,CAAA;IACb,IAAI,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAA;CAC3D,KAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAoBxC,CAAA;AAcD,eAAO,MAAM,4BAA4B,WAAY,cAAc,EAAE,KAAG,GAAG,CAAC,MAAM,CAUjF,CAAA;AAqBD,eAAO,MAAM,kBAAkB,GAAI,CAAC,QAAQ,CAAC,aAAa,SAAS,KAAG,CA4BrE,CAAA;AAQD,eAAO,MAAM,2BAA2B,GAAI,CAAC,QACrC,CAAC,YACG,OAAO,YACR,iBAAiB,KACzB,CA8BF,CAAA;AAiBD,eAAO,MAAM,6BAA6B,GAAI,CAAC,QACvC,CAAC,YACG,OAAO,YACR,iBAAiB,KACzB,CAeF,CAAA"}

package/dist/uploads/sanitizeUploadData.js

@@ -0,0 +1,159 @@
+import path from 'path';
+import { APIError } from '../errors/APIError.js';
+const hasOwnProperty = (value, key)=>Object.prototype.hasOwnProperty.call(value, key);
+const isRecord = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+export const getExternalUploadSource = (data)=>{
+    if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {
+        return undefined;
+    }
+    return {
+        filename: data.filename,
+        url: data.url
+    };
+};
+// Resolves the server-owned upload destination for a document write. For client uploads the prefix
+// and key segment come from the verified upload context; for server uploads the prefix falls back
+// to the submitted document data and there is no key segment.
+export const getUploadDestination = ({ data, file })=>{
+    if (!file) {
+        return {};
+    }
+    const submittedPrefix = isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined;
+    const { clientUploadContext } = file;
+    if (!isRecord(clientUploadContext)) {
+        return {
+            prefix: submittedPrefix
+        };
+    }
+    return {
+        objectKey: typeof clientUploadContext._objectKey === 'string' ? clientUploadContext._objectKey : undefined,
+        prefix: typeof clientUploadContext.prefix === 'string' ? clientUploadContext.prefix : undefined
+    };
+};
+const getDocumentProperty = (document, property, { locale, localizedProperties })=>{
+    const value = document[property];
+    return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value;
+};
+// Accepts flattened fields so localized identity fields declared inside presentational
+// containers (row/collapsible/unnamed tabs) are still detected — those live at the document
+// root data level but are nested in the config tree, so walking `fields` alone would miss them.
+export const getLocalizedUploadProperties = (fields)=>{
+    const localizedProperties = new Set();
+    for (const field of fields){
+        if ('name' in field && field.localized) {
+            localizedProperties.add(field.name);
+        }
+    }
+    return localizedProperties;
+};
+// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to
+// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string
+// values are ignored here because they are removed by the caller anyway.
+const validateFilename = (filename)=>{
+    if (typeof filename !== 'string') {
+        return;
+    }
+    const pathSegments = filename.replace(/\\/g, '/').split('/');
+    if (path.posix.isAbsolute(filename) || path.win32.isAbsolute(filename) || pathSegments.includes('..')) {
+        throw new APIError('Invalid filename.', 400);
+    }
+};
+export const sanitizeUploadData = (data, operation)=>{
+    if (!isRecord(data)) {
+        return data;
+    }
+    validateFilename(data.filename);
+    if (isRecord(data.sizes)) {
+        for (const sizeData of Object.values(data.sizes)){
+            if (isRecord(sizeData)) {
+                validateFilename(sizeData.filename);
+            }
+        }
+    }
+    const sanitizedData = {
+        ...data
+    };
+    delete sanitizedData.filename;
+    delete sanitizedData.sizes;
+    delete sanitizedData.url;
+    // Server-owned; never accepted from the caller.
+    delete sanitizedData._objectKey;
+    // On update, `prefix` is restored from the stored document (file identity); kept on create.
+    if (operation === 'update') {
+        delete sanitizedData.prefix;
+    }
+    return sanitizedData;
+};
+// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,
+// `url`, `sizes`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,
+// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`
+// are user-editable crop input, and the rest are regenerated by generateFileData when a file is
+// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full
+// tuple below.
+export const mergeUploadDataWithDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const mergedData = {
+        ...data
+    };
+    for (const property of [
+        '_objectKey',
+        'filename',
+        'prefix',
+        'url'
+    ]){
+        if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {
+            mergedData[property] = getDocumentProperty(document, property, options);
+        }
+    }
+    const documentSizes = getDocumentProperty(document, 'sizes', options);
+    if (!hasOwnProperty(data, 'sizes') && hasOwnProperty(document, 'sizes')) {
+        mergedData.sizes = documentSizes;
+    } else if (isRecord(data.sizes) && isRecord(documentSizes)) {
+        const mergedSizes = {
+            ...documentSizes
+        };
+        for (const [sizeName, sizeData] of Object.entries(data.sizes)){
+            const documentSize = documentSizes[sizeName];
+            mergedSizes[sizeName] = isRecord(sizeData) && isRecord(documentSize) ? {
+                ...documentSize,
+                ...sizeData
+            } : sizeData;
+        }
+        mergedData.sizes = mergedSizes;
+    }
+    return mergedData;
+};
+const uploadDerivedProperties = [
+    '_objectKey',
+    'filename',
+    'filesize',
+    'focalX',
+    'focalY',
+    'height',
+    'mimeType',
+    'prefix',
+    'sizes',
+    'thumbnailURL',
+    'url',
+    'width'
+];
+export const restoreUploadDataFromDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const restoredData = {
+        ...data
+    };
+    for (const property of uploadDerivedProperties){
+        if (hasOwnProperty(document, property)) {
+            restoredData[property] = getDocumentProperty(document, property, options);
+        } else {
+            delete restoredData[property];
+        }
+    }
+    return restoredData;
+};
+
+//# sourceMappingURL=sanitizeUploadData.js.map

package/dist/uploads/sanitizeUploadData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/sanitizeUploadData.ts"],"sourcesContent":["import path from 'path'\n\nimport type { FlattenedField } from '../fields/config/types.js'\n\nimport { APIError } from '../errors/APIError.js'\n\ntype Operation = 'create' | 'update'\n\nexport type ExternalUploadSource = {\n  filename: string\n  url: string\n}\n\ntype UploadDataOptions = {\n  locale?: string\n  localizedProperties?: Set<string>\n}\n\nconst hasOwnProperty = (value: Record<string, unknown>, key: string): boolean =>\n  Object.prototype.hasOwnProperty.call(value, key)\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\nexport const getExternalUploadSource = (data: unknown): ExternalUploadSource | undefined => {\n  if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {\n    return undefined\n  }\n\n  return {\n    filename: data.filename,\n    url: data.url,\n  }\n}\n\n// Resolves the server-owned upload destination for a document write. For client uploads the prefix\n// and key segment come from the verified upload context; for server uploads the prefix falls back\n// to the submitted document data and there is no key segment.\nexport const getUploadDestination = ({\n  data,\n  file,\n}: {\n  data: unknown\n  file: { clientUploadContext?: unknown } | null | undefined\n}): { objectKey?: string; prefix?: string } => {\n  if (!file) {\n    return {}\n  }\n\n  const submittedPrefix =\n    isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined\n  const { clientUploadContext } = file\n\n  if (!isRecord(clientUploadContext)) {\n    return { prefix: submittedPrefix }\n  }\n\n  return {\n    objectKey:\n      typeof clientUploadContext._objectKey === 'string'\n        ? clientUploadContext._objectKey\n        : undefined,\n    prefix: typeof clientUploadContext.prefix === 'string' ? clientUploadContext.prefix : undefined,\n  }\n}\n\nconst getDocumentProperty = (\n  document: Record<string, unknown>,\n  property: string,\n  { locale, localizedProperties }: UploadDataOptions,\n): unknown => {\n  const value = document[property]\n  return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value\n}\n\n// Accepts flattened fields so localized identity fields declared inside presentational\n// containers (row/collapsible/unnamed tabs) are still detected — those live at the document\n// root data level but are nested in the config tree, so walking `fields` alone would miss them.\nexport const getLocalizedUploadProperties = (fields: FlattenedField[]): Set<string> => {\n  const localizedProperties = new Set<string>()\n\n  for (const field of fields) {\n    if ('name' in field && (field as { localized?: boolean }).localized) {\n      localizedProperties.add(field.name)\n    }\n  }\n\n  return localizedProperties\n}\n\n// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to\n// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string\n// values are ignored here because they are removed by the caller anyway.\nconst validateFilename = (filename: unknown): void => {\n  if (typeof filename !== 'string') {\n    return\n  }\n\n  const pathSegments = filename.replace(/\\\\/g, '/').split('/')\n\n  if (\n    path.posix.isAbsolute(filename) ||\n    path.win32.isAbsolute(filename) ||\n    pathSegments.includes('..')\n  ) {\n    throw new APIError('Invalid filename.', 400)\n  }\n}\n\nexport const sanitizeUploadData = <T>(data: T, operation: Operation): T => {\n  if (!isRecord(data)) {\n    return data\n  }\n\n  validateFilename(data.filename)\n\n  if (isRecord(data.sizes)) {\n    for (const sizeData of Object.values(data.sizes)) {\n      if (isRecord(sizeData)) {\n        validateFilename(sizeData.filename)\n      }\n    }\n  }\n\n  const sanitizedData: Record<string, unknown> = { ...data }\n  delete sanitizedData.filename\n  delete sanitizedData.sizes\n  delete sanitizedData.url\n  // Server-owned; never accepted from the caller.\n  delete sanitizedData._objectKey\n\n  // On update, `prefix` is restored from the stored document (file identity); kept on create.\n  if (operation === 'update') {\n    delete sanitizedData.prefix\n  }\n\n  return sanitizedData as T\n}\n\n// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,\n// `url`, `sizes`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,\n// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`\n// are user-editable crop input, and the rest are regenerated by generateFileData when a file is\n// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full\n// tuple below.\nexport const mergeUploadDataWithDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const mergedData: Record<string, unknown> = { ...data }\n\n  for (const property of ['_objectKey', 'filename', 'prefix', 'url']) {\n    if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {\n      mergedData[property] = getDocumentProperty(document, property, options)\n    }\n  }\n\n  const documentSizes = getDocumentProperty(document, 'sizes', options)\n  if (!hasOwnProperty(data, 'sizes') && hasOwnProperty(document, 'sizes')) {\n    mergedData.sizes = documentSizes\n  } else if (isRecord(data.sizes) && isRecord(documentSizes)) {\n    const mergedSizes: Record<string, unknown> = { ...documentSizes }\n\n    for (const [sizeName, sizeData] of Object.entries(data.sizes)) {\n      const documentSize = documentSizes[sizeName]\n\n      mergedSizes[sizeName] =\n        isRecord(sizeData) && isRecord(documentSize) ? { ...documentSize, ...sizeData } : sizeData\n    }\n\n    mergedData.sizes = mergedSizes\n  }\n\n  return mergedData as T\n}\n\nconst uploadDerivedProperties = [\n  '_objectKey',\n  'filename',\n  'filesize',\n  'focalX',\n  'focalY',\n  'height',\n  'mimeType',\n  'prefix',\n  'sizes',\n  'thumbnailURL',\n  'url',\n  'width',\n] as const\n\nexport const restoreUploadDataFromDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const restoredData: Record<string, unknown> = { ...data }\n  for (const property of uploadDerivedProperties) {\n    if (hasOwnProperty(document, property)) {\n      restoredData[property] = getDocumentProperty(document, property, options)\n    } else {\n      delete restoredData[property]\n    }\n  }\n\n  return restoredData as T\n}\n"],"names":["path","APIError","hasOwnProperty","value","key","Object","prototype","call","isRecord","Array","isArray","getExternalUploadSource","data","filename","url","undefined","getUploadDestination","file","submittedPrefix","prefix","clientUploadContext","objectKey","_objectKey","getDocumentProperty","document","property","locale","localizedProperties","has","getLocalizedUploadProperties","fields","Set","field","localized","add","name","validateFilename","pathSegments","replace","split","posix","isAbsolute","win32","includes","sanitizeUploadData","operation","sizes","sizeData","values","sanitizedData","mergeUploadDataWithDocument","options","mergedData","documentSizes","mergedSizes","sizeName","entries","documentSize","uploadDerivedProperties","restoreUploadDataFromDocument","restoredData"],"mappings":"AAAA,OAAOA,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,wBAAuB;AAchD,MAAMC,iBAAiB,CAACC,OAAgCC,MACtDC,OAAOC,SAAS,CAACJ,cAAc,CAACK,IAAI,CAACJ,OAAOC;AAE9C,MAAMI,WAAW,CAACL,QAChB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACM,MAAMC,OAAO,CAACP;AAEhE,OAAO,MAAMQ,0BAA0B,CAACC;IACtC,IAAI,CAACJ,SAASI,SAAS,OAAOA,KAAKC,QAAQ,KAAK,YAAY,OAAOD,KAAKE,GAAG,KAAK,UAAU;QACxF,OAAOC;IACT;IAEA,OAAO;QACLF,UAAUD,KAAKC,QAAQ;QACvBC,KAAKF,KAAKE,GAAG;IACf;AACF,EAAC;AAED,mGAAmG;AACnG,kGAAkG;AAClG,8DAA8D;AAC9D,OAAO,MAAME,uBAAuB,CAAC,EACnCJ,IAAI,EACJK,IAAI,EAIL;IACC,IAAI,CAACA,MAAM;QACT,OAAO,CAAC;IACV;IAEA,MAAMC,kBACJV,SAASI,SAAS,OAAOA,KAAKO,MAAM,KAAK,WAAWP,KAAKO,MAAM,GAAGJ;IACpE,MAAM,EAAEK,mBAAmB,EAAE,GAAGH;IAEhC,IAAI,CAACT,SAASY,sBAAsB;QAClC,OAAO;YAAED,QAAQD;QAAgB;IACnC;IAEA,OAAO;QACLG,WACE,OAAOD,oBAAoBE,UAAU,KAAK,WACtCF,oBAAoBE,UAAU,GAC9BP;QACNI,QAAQ,OAAOC,oBAAoBD,MAAM,KAAK,WAAWC,oBAAoBD,MAAM,GAAGJ;IACxF;AACF,EAAC;AAED,MAAMQ,sBAAsB,CAC1BC,UACAC,UACA,EAAEC,MAAM,EAAEC,mBAAmB,EAAqB;IAElD,MAAMxB,QAAQqB,QAAQ,CAACC,SAAS;IAChC,OAAOC,UAAUC,qBAAqBC,IAAIH,aAAajB,SAASL,SAASA,KAAK,CAACuB,OAAO,GAAGvB;AAC3F;AAEA,uFAAuF;AACvF,4FAA4F;AAC5F,gGAAgG;AAChG,OAAO,MAAM0B,+BAA+B,CAACC;IAC3C,MAAMH,sBAAsB,IAAII;IAEhC,KAAK,MAAMC,SAASF,OAAQ;QAC1B,IAAI,UAAUE,SAAS,AAACA,MAAkCC,SAAS,EAAE;YACnEN,oBAAoBO,GAAG,CAACF,MAAMG,IAAI;QACpC;IACF;IAEA,OAAOR;AACT,EAAC;AAED,8FAA8F;AAC9F,4FAA4F;AAC5F,yEAAyE;AACzE,MAAMS,mBAAmB,CAACvB;IACxB,IAAI,OAAOA,aAAa,UAAU;QAChC;IACF;IAEA,MAAMwB,eAAexB,SAASyB,OAAO,CAAC,OAAO,KAAKC,KAAK,CAAC;IAExD,IACEvC,KAAKwC,KAAK,CAACC,UAAU,CAAC5B,aACtBb,KAAK0C,KAAK,CAACD,UAAU,CAAC5B,aACtBwB,aAAaM,QAAQ,CAAC,OACtB;QACA,MAAM,IAAI1C,SAAS,qBAAqB;IAC1C;AACF;AAEA,OAAO,MAAM2C,qBAAqB,CAAIhC,MAASiC;IAC7C,IAAI,CAACrC,SAASI,OAAO;QACnB,OAAOA;IACT;IAEAwB,iBAAiBxB,KAAKC,QAAQ;IAE9B,IAAIL,SAASI,KAAKkC,KAAK,GAAG;QACxB,KAAK,MAAMC,YAAY1C,OAAO2C,MAAM,CAACpC,KAAKkC,KAAK,EAAG;YAChD,IAAItC,SAASuC,WAAW;gBACtBX,iBAAiBW,SAASlC,QAAQ;YACpC;QACF;IACF;IAEA,MAAMoC,gBAAyC;QAAE,GAAGrC,IAAI;IAAC;IACzD,OAAOqC,cAAcpC,QAAQ;IAC7B,OAAOoC,cAAcH,KAAK;IAC1B,OAAOG,cAAcnC,GAAG;IACxB,gDAAgD;IAChD,OAAOmC,cAAc3B,UAAU;IAE/B,4FAA4F;IAC5F,IAAIuB,cAAc,UAAU;QAC1B,OAAOI,cAAc9B,MAAM;IAC7B;IAEA,OAAO8B;AACT,EAAC;AAED,6FAA6F;AAC7F,6FAA6F;AAC7F,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,eAAe;AACf,OAAO,MAAMC,8BAA8B,CACzCtC,MACAY,UACA2B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC3C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMwC,aAAsC;QAAE,GAAGxC,IAAI;IAAC;IAEtD,KAAK,MAAMa,YAAY;QAAC;QAAc;QAAY;QAAU;KAAM,CAAE;QAClE,IAAI,CAACvB,eAAeU,MAAMa,aAAavB,eAAesB,UAAUC,WAAW;YACzE2B,UAAU,CAAC3B,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU0B;QACjE;IACF;IAEA,MAAME,gBAAgB9B,oBAAoBC,UAAU,SAAS2B;IAC7D,IAAI,CAACjD,eAAeU,MAAM,YAAYV,eAAesB,UAAU,UAAU;QACvE4B,WAAWN,KAAK,GAAGO;IACrB,OAAO,IAAI7C,SAASI,KAAKkC,KAAK,KAAKtC,SAAS6C,gBAAgB;QAC1D,MAAMC,cAAuC;YAAE,GAAGD,aAAa;QAAC;QAEhE,KAAK,MAAM,CAACE,UAAUR,SAAS,IAAI1C,OAAOmD,OAAO,CAAC5C,KAAKkC,KAAK,EAAG;YAC7D,MAAMW,eAAeJ,aAAa,CAACE,SAAS;YAE5CD,WAAW,CAACC,SAAS,GACnB/C,SAASuC,aAAavC,SAASiD,gBAAgB;gBAAE,GAAGA,YAAY;gBAAE,GAAGV,QAAQ;YAAC,IAAIA;QACtF;QAEAK,WAAWN,KAAK,GAAGQ;IACrB;IAEA,OAAOF;AACT,EAAC;AAED,MAAMM,0BAA0B;IAC9B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,MAAMC,gCAAgC,CAC3C/C,MACAY,UACA2B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC3C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMgD,eAAwC;QAAE,GAAGhD,IAAI;IAAC;IACxD,KAAK,MAAMa,YAAYiC,wBAAyB;QAC9C,IAAIxD,eAAesB,UAAUC,WAAW;YACtCmC,YAAY,CAACnC,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU0B;QACnE,OAAO;YACL,OAAOS,YAAY,CAACnC,SAAS;QAC/B;IACF;IAEA,OAAOmC;AACT,EAAC"}