payload 3.89.0 → 3.90.0

package/dist/auth/strategies/jwt.js

@@ -1,6 +1,20 @@
 import { jwtVerify } from 'jose';
 import { extractJWT } from '../extractJWT.js';
-async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
+import { JWT_AUTH_VERSION } from '../jwtAuth.js';
+const getJWTAuthenticationReference = (token)=>{
+    const { id, collection, sid } = token;
+    if (typeof collection !== 'string' || typeof id !== 'number' && typeof id !== 'string' || typeof sid !== 'undefined' && typeof sid !== 'string') {
+        return null;
+    }
+    return {
+        id,
+        collection,
+        ...sid ? {
+            sid
+        } : {}
+    };
+};
+async function autoLogin({ fallbackLocale, isGraphQL, locale, payload, req, strategyName = 'local-jwt' }) {
     if (typeof payload?.config?.admin?.autoLogin !== 'object' || payload.config.admin?.autoLogin.prefillOnly || !payload?.config?.admin?.autoLogin || !payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username) {
         return {
             user: null
@@ -26,8 +40,11 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
     const user = (await payload.find({
         collection: collection.config.slug,
         depth: isGraphQL ? 0 : collection.config.auth.depth,
+        fallbackLocale,
         limit: 1,
+        locale,
         pagination: false,
+        req,
         where
     })).docs[0];
     if (!user) {
@@ -43,7 +60,10 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
 }
 /**
  * Authentication strategy function for JWT tokens
- */ export const JWTAuthentication = async ({ headers, isGraphQL = false, payload, strategyName = 'local-jwt' })=>{
+ */ export const JWTAuthentication = async ({ headers, isGraphQL = false, payload, req, strategyName = 'local-jwt' })=>{
+    const requestFallbackLocale = req?.fallbackLocale;
+    const requestLocale = req?.locale;
+    const requestDepth = req?.query?.depth;
     try {
         const token = extractJWT({
             headers,
@@ -52,8 +72,11 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
         if (!token) {
             if (headers.get('DisableAutologin') !== 'true') {
                 return await autoLogin({
+                    fallbackLocale: requestFallbackLocale,
                     isGraphQL,
+                    locale: requestLocale,
                     payload,
+                    req,
                     strategyName
                 });
             }
@@ -62,22 +85,36 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
             };
         }
         const secretKey = new TextEncoder().encode(payload.secret);
-        const { payload: decodedPayload } = await jwtVerify(token, secretKey);
-        const collection = payload.collections[decodedPayload.collection];
+        const { payload: decodedPayload, protectedHeader } = await jwtVerify(token, secretKey);
+        if (protectedHeader.authVersion !== JWT_AUTH_VERSION) {
+            throw new Error('Invalid JWT protected header');
+        }
+        const authenticationReference = getJWTAuthenticationReference(decodedPayload);
+        if (!authenticationReference) {
+            throw new Error('Invalid JWT authentication reference');
+        }
+        const collection = Object.prototype.hasOwnProperty.call(payload.collections, authenticationReference.collection) ? payload.collections[authenticationReference.collection] : undefined;
+        if (!collection?.config.auth || collection.config.auth.disableLocalStrategy) {
+            throw new Error('JWT authentication requires an auth-enabled local collection');
+        }
         const user = await payload.findByID({
-            id: decodedPayload.id,
-            collection: decodedPayload.collection,
-            depth: isGraphQL ? 0 : collection.config.auth.depth
+            id: authenticationReference.id,
+            collection: authenticationReference.collection,
+            depth: isGraphQL ? 0 : collection.config.auth.depth,
+            fallbackLocale: requestFallbackLocale,
+            locale: requestLocale,
+            overrideAccess: true,
+            req
         });
         if (user && (!collection.config.auth.verify || user._verified)) {
             if (collection.config.auth.useSessions) {
-                const existingSession = (user.sessions || []).find(({ id })=>id === decodedPayload.sid);
-                if (!existingSession || !decodedPayload.sid) {
+                const existingSession = (user.sessions || []).find(({ id })=>id === authenticationReference.sid);
+                if (!existingSession || !authenticationReference.sid) {
                     return {
                         user: null
                     };
                 }
-                user._sid = decodedPayload.sid;
+                user._sid = authenticationReference.sid;
             }
             user.collection = collection.config.slug;
             user._strategy = strategyName;
@@ -87,8 +124,11 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
         } else {
             if (headers.get('DisableAutologin') !== 'true') {
                 return await autoLogin({
+                    fallbackLocale: requestFallbackLocale,
                     isGraphQL,
+                    locale: requestLocale,
                     payload,
+                    req,
                     strategyName
                 });
             }
@@ -99,14 +139,25 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
     } catch (ignore) {
         if (headers.get('DisableAutologin') !== 'true') {
             return await autoLogin({
+                fallbackLocale: requestFallbackLocale,
                 isGraphQL,
+                locale: requestLocale,
                 payload,
+                req,
                 strategyName
             });
         }
         return {
             user: null
         };
+    } finally{
+        if (req) {
+            req.fallbackLocale = requestFallbackLocale;
+            req.locale = requestLocale;
+            if (req.query) {
+                req.query.depth = requestDepth;
+            }
+        }
     }
 };
 

package/dist/auth/strategies/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\n\ntype JWTToken = {\n  collection: string\n  id: string\n  sid?: string\n}\n\nasync function autoLogin({\n  isGraphQL,\n  payload,\n  strategyName = 'local-jwt',\n}: {\n  isGraphQL: boolean\n  payload: Payload\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      limit: 1,\n      pagination: false,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  strategyName = 'local-jwt',\n}) => {\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n\n    const secretKey = new TextEncoder().encode(payload.secret)\n    const { payload: decodedPayload } = await jwtVerify<JWTToken>(token, secretKey)\n    const collection = payload.collections[decodedPayload.collection]\n\n    const user = (await payload.findByID({\n      id: decodedPayload.id,\n      collection: decodedPayload.collection,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection!.config.auth.verify || user._verified)) {\n      if (collection!.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(({ id }) => id === decodedPayload.sid)\n\n        if (!existingSession || !decodedPayload.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = decodedPayload.sid\n      }\n\n      user.collection = collection!.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({ isGraphQL, payload, strategyName })\n    }\n    return { user: null }\n  }\n}\n"],"names":["jwtVerify","extractJWT","autoLogin","isGraphQL","payload","strategyName","config","admin","prefillOnly","email","username","user","collection","collections","where","or","push","equals","find","slug","depth","auth","limit","pagination","docs","_strategy","JWTAuthentication","headers","token","get","secretKey","TextEncoder","encode","secret","decodedPayload","findByID","id","verify","_verified","useSessions","existingSession","sessions","sid","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAQ7C,eAAeC,UAAU,EACvBC,SAAS,EACTC,OAAO,EACPC,eAAe,WAAW,EAK3B;IAGC,IACE,OAAOD,SAASE,QAAQC,OAAOL,cAAc,YAC7CE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUM,eAChC,CAACJ,SAASE,QAAQC,OAAOL,aACxB,CAACE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,SAAS,CAACL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMC,aAAaR,QAAQS,WAAW,CAACT,QAAQE,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAMG,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIX,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,OAAO;QACzCK,MAAMC,EAAE,EAAEC,KAAK;YACbP,OAAO;gBACLQ,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO;YAC1C;QACF;IACF,OAAO,IAAIL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAAU;QACnDI,MAAMC,EAAE,EAAEC,KAAK;YACbN,UAAU;gBACRO,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMP,QAAQc,IAAI,CAAC;QACjBN,YAAYA,WAAYN,MAAM,CAACa,IAAI;QACnCC,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACpDE,OAAO;QACPC,YAAY;QACZT;IACF,EAAC,EACDU,IAAI,CAAC,EAAE;IAET,IAAI,CAACb,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;IACzCR,KAAKc,SAAS,GAAGpB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMe,oBAA0C,OAAO,EAC5DC,OAAO,EACPxB,YAAY,KAAK,EACjBC,OAAO,EACPC,eAAe,WAAW,EAC3B;IACC,IAAI;QACF,MAAMuB,QAAQ3B,WAAW;YAAE0B;YAASvB;QAAQ;QAE5C,IAAI,CAACwB,OAAO;YACV,IAAID,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,MAAMmB,YAAY,IAAIC,cAAcC,MAAM,CAAC5B,QAAQ6B,MAAM;QACzD,MAAM,EAAE7B,SAAS8B,cAAc,EAAE,GAAG,MAAMlC,UAAoB4B,OAAOE;QACrE,MAAMlB,aAAaR,QAAQS,WAAW,CAACqB,eAAetB,UAAU,CAAC;QAEjE,MAAMD,OAAQ,MAAMP,QAAQ+B,QAAQ,CAAC;YACnCC,IAAIF,eAAeE,EAAE;YACrBxB,YAAYsB,eAAetB,UAAU;YACrCQ,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACtD;QAEA,IAAIT,QAAS,CAAA,CAACC,WAAYN,MAAM,CAACe,IAAI,CAACgB,MAAM,IAAI1B,KAAK2B,SAAS,AAAD,GAAI;YAC/D,IAAI1B,WAAYN,MAAM,CAACe,IAAI,CAACkB,WAAW,EAAE;gBACvC,MAAMC,kBAAkB,AAAC7B,CAAAA,KAAK8B,QAAQ,IAAI,EAAE,AAAD,EAAGvB,IAAI,CAAC,CAAC,EAAEkB,EAAE,EAAE,GAAKA,OAAOF,eAAeQ,GAAG;gBAExF,IAAI,CAACF,mBAAmB,CAACN,eAAeQ,GAAG,EAAE;oBAC3C,OAAO;wBACL/B,MAAM;oBACR;gBACF;gBAEAA,KAAKgC,IAAI,GAAGT,eAAeQ,GAAG;YAChC;YAEA/B,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;YACzCR,KAAKc,SAAS,GAAGpB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIgB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAOiC,QAAQ;QACf,IAAIjB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAM3B,UAAU;gBAAEC;gBAAWC;gBAASC;YAAa;QAC5D;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, PayloadRequest, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\nimport { JWT_AUTH_VERSION } from '../jwtAuth.js'\n\ntype DecodedJWTPayload = Record<string, unknown>\n\ntype JWTAuthenticationReference = {\n  collection: string\n  id: number | string\n  sid?: string\n}\n\nconst getJWTAuthenticationReference = (\n  token: DecodedJWTPayload,\n): JWTAuthenticationReference | null => {\n  const { id, collection, sid } = token\n\n  if (\n    typeof collection !== 'string' ||\n    (typeof id !== 'number' && typeof id !== 'string') ||\n    (typeof sid !== 'undefined' && typeof sid !== 'string')\n  ) {\n    return null\n  }\n\n  return {\n    id,\n    collection,\n    ...(sid ? { sid } : {}),\n  }\n}\n\nasync function autoLogin({\n  fallbackLocale,\n  isGraphQL,\n  locale,\n  payload,\n  req,\n  strategyName = 'local-jwt',\n}: {\n  fallbackLocale?: PayloadRequest['fallbackLocale']\n  isGraphQL: boolean\n  locale?: PayloadRequest['locale']\n  payload: Payload\n  req?: PayloadRequest\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      fallbackLocale,\n      limit: 1,\n      locale,\n      pagination: false,\n      req,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  req,\n  strategyName = 'local-jwt',\n}) => {\n  const requestFallbackLocale = req?.fallbackLocale\n  const requestLocale = req?.locale\n  const requestDepth = req?.query?.depth\n\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({\n          fallbackLocale: requestFallbackLocale,\n          isGraphQL,\n          locale: requestLocale,\n          payload,\n          req,\n          strategyName,\n        })\n      }\n      return { user: null }\n    }\n\n    const secretKey = new TextEncoder().encode(payload.secret)\n    const { payload: decodedPayload, protectedHeader } = await jwtVerify<DecodedJWTPayload>(\n      token,\n      secretKey,\n    )\n\n    if (protectedHeader.authVersion !== JWT_AUTH_VERSION) {\n      throw new Error('Invalid JWT protected header')\n    }\n\n    const authenticationReference = getJWTAuthenticationReference(decodedPayload)\n\n    if (!authenticationReference) {\n      throw new Error('Invalid JWT authentication reference')\n    }\n\n    const collection = Object.prototype.hasOwnProperty.call(\n      payload.collections,\n      authenticationReference.collection,\n    )\n      ? payload.collections[authenticationReference.collection]\n      : undefined\n\n    if (!collection?.config.auth || collection.config.auth.disableLocalStrategy) {\n      throw new Error('JWT authentication requires an auth-enabled local collection')\n    }\n\n    const user = (await payload.findByID({\n      id: authenticationReference.id,\n      collection: authenticationReference.collection,\n      depth: isGraphQL ? 0 : collection.config.auth.depth,\n      fallbackLocale: requestFallbackLocale,\n      locale: requestLocale,\n      overrideAccess: true,\n      req,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection.config.auth.verify || user._verified)) {\n      if (collection.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(\n          ({ id }) => id === authenticationReference.sid,\n        )\n\n        if (!existingSession || !authenticationReference.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = authenticationReference.sid\n      }\n\n      user.collection = collection.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({\n          fallbackLocale: requestFallbackLocale,\n          isGraphQL,\n          locale: requestLocale,\n          payload,\n          req,\n          strategyName,\n        })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({\n        fallbackLocale: requestFallbackLocale,\n        isGraphQL,\n        locale: requestLocale,\n        payload,\n        req,\n        strategyName,\n      })\n    }\n    return { user: null }\n  } finally {\n    if (req) {\n      req.fallbackLocale = requestFallbackLocale!\n      req.locale = requestLocale!\n\n      if (req.query) {\n        req.query.depth = requestDepth\n      }\n    }\n  }\n}\n"],"names":["jwtVerify","extractJWT","JWT_AUTH_VERSION","getJWTAuthenticationReference","token","id","collection","sid","autoLogin","fallbackLocale","isGraphQL","locale","payload","req","strategyName","config","admin","prefillOnly","email","username","user","collections","where","or","push","equals","find","slug","depth","auth","limit","pagination","docs","_strategy","JWTAuthentication","headers","requestFallbackLocale","requestLocale","requestDepth","query","get","secretKey","TextEncoder","encode","secret","decodedPayload","protectedHeader","authVersion","Error","authenticationReference","Object","prototype","hasOwnProperty","call","undefined","disableLocalStrategy","findByID","overrideAccess","verify","_verified","useSessions","existingSession","sessions","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAC7C,SAASC,gBAAgB,QAAQ,gBAAe;AAUhD,MAAMC,gCAAgC,CACpCC;IAEA,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAEC,GAAG,EAAE,GAAGH;IAEhC,IACE,OAAOE,eAAe,YACrB,OAAOD,OAAO,YAAY,OAAOA,OAAO,YACxC,OAAOE,QAAQ,eAAe,OAAOA,QAAQ,UAC9C;QACA,OAAO;IACT;IAEA,OAAO;QACLF;QACAC;QACA,GAAIC,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;AACF;AAEA,eAAeC,UAAU,EACvBC,cAAc,EACdC,SAAS,EACTC,MAAM,EACNC,OAAO,EACPC,GAAG,EACHC,eAAe,WAAW,EAQ3B;IAGC,IACE,OAAOF,SAASG,QAAQC,OAAOR,cAAc,YAC7CI,QAAQG,MAAM,CAACC,KAAK,EAAER,UAAUS,eAChC,CAACL,SAASG,QAAQC,OAAOR,aACxB,CAACI,QAAQG,MAAM,CAACC,KAAK,EAAER,UAAUU,SAAS,CAACN,QAAQG,MAAM,CAACC,KAAK,EAAER,UAAUW,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMd,aAAaM,QAAQS,WAAW,CAACT,QAAQG,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAME,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIX,QAAQG,MAAM,CAACC,KAAK,EAAER,UAAUU,OAAO;QACzCI,MAAMC,EAAE,EAAEC,KAAK;YACbN,OAAO;gBACLO,QAAQb,QAAQG,MAAM,CAACC,KAAK,EAAER,UAAUU;YAC1C;QACF;IACF,OAAO,IAAIN,QAAQG,MAAM,CAACC,KAAK,EAAER,UAAUW,UAAU;QACnDG,MAAMC,EAAE,EAAEC,KAAK;YACbL,UAAU;gBACRM,QAAQb,QAAQG,MAAM,CAACC,KAAK,EAAER,UAAUW;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMR,QAAQc,IAAI,CAAC;QACjBpB,YAAYA,WAAYS,MAAM,CAACY,IAAI;QACnCC,OAAOlB,YAAY,IAAIJ,WAAYS,MAAM,CAACc,IAAI,CAACD,KAAK;QACpDnB;QACAqB,OAAO;QACPnB;QACAoB,YAAY;QACZlB;QACAS;IACF,EAAC,EACDU,IAAI,CAAC,EAAE;IAET,IAAI,CAACZ,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKd,UAAU,GAAGA,WAAYS,MAAM,CAACY,IAAI;IACzCP,KAAKa,SAAS,GAAGnB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMc,oBAA0C,OAAO,EAC5DC,OAAO,EACPzB,YAAY,KAAK,EACjBE,OAAO,EACPC,GAAG,EACHC,eAAe,WAAW,EAC3B;IACC,MAAMsB,wBAAwBvB,KAAKJ;IACnC,MAAM4B,gBAAgBxB,KAAKF;IAC3B,MAAM2B,eAAezB,KAAK0B,OAAOX;IAEjC,IAAI;QACF,MAAMxB,QAAQH,WAAW;YAAEkC;YAASvB;QAAQ;QAE5C,IAAI,CAACR,OAAO;YACV,IAAI+B,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMhC,UAAU;oBACrBC,gBAAgB2B;oBAChB1B;oBACAC,QAAQ0B;oBACRzB;oBACAC;oBACAC;gBACF;YACF;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,MAAMqB,YAAY,IAAIC,cAAcC,MAAM,CAAC/B,QAAQgC,MAAM;QACzD,MAAM,EAAEhC,SAASiC,cAAc,EAAEC,eAAe,EAAE,GAAG,MAAM9C,UACzDI,OACAqC;QAGF,IAAIK,gBAAgBC,WAAW,KAAK7C,kBAAkB;YACpD,MAAM,IAAI8C,MAAM;QAClB;QAEA,MAAMC,0BAA0B9C,8BAA8B0C;QAE9D,IAAI,CAACI,yBAAyB;YAC5B,MAAM,IAAID,MAAM;QAClB;QAEA,MAAM1C,aAAa4C,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CACrDzC,QAAQS,WAAW,EACnB4B,wBAAwB3C,UAAU,IAEhCM,QAAQS,WAAW,CAAC4B,wBAAwB3C,UAAU,CAAC,GACvDgD;QAEJ,IAAI,CAAChD,YAAYS,OAAOc,QAAQvB,WAAWS,MAAM,CAACc,IAAI,CAAC0B,oBAAoB,EAAE;YAC3E,MAAM,IAAIP,MAAM;QAClB;QAEA,MAAM5B,OAAQ,MAAMR,QAAQ4C,QAAQ,CAAC;YACnCnD,IAAI4C,wBAAwB5C,EAAE;YAC9BC,YAAY2C,wBAAwB3C,UAAU;YAC9CsB,OAAOlB,YAAY,IAAIJ,WAAWS,MAAM,CAACc,IAAI,CAACD,KAAK;YACnDnB,gBAAgB2B;YAChBzB,QAAQ0B;YACRoB,gBAAgB;YAChB5C;QACF;QAEA,IAAIO,QAAS,CAAA,CAACd,WAAWS,MAAM,CAACc,IAAI,CAAC6B,MAAM,IAAItC,KAAKuC,SAAS,AAAD,GAAI;YAC9D,IAAIrD,WAAWS,MAAM,CAACc,IAAI,CAAC+B,WAAW,EAAE;gBACtC,MAAMC,kBAAkB,AAACzC,CAAAA,KAAK0C,QAAQ,IAAI,EAAE,AAAD,EAAGpC,IAAI,CAChD,CAAC,EAAErB,EAAE,EAAE,GAAKA,OAAO4C,wBAAwB1C,GAAG;gBAGhD,IAAI,CAACsD,mBAAmB,CAACZ,wBAAwB1C,GAAG,EAAE;oBACpD,OAAO;wBACLa,MAAM;oBACR;gBACF;gBAEAA,KAAK2C,IAAI,GAAGd,wBAAwB1C,GAAG;YACzC;YAEAa,KAAKd,UAAU,GAAGA,WAAWS,MAAM,CAACY,IAAI;YACxCP,KAAKa,SAAS,GAAGnB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIe,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMhC,UAAU;oBACrBC,gBAAgB2B;oBAChB1B;oBACAC,QAAQ0B;oBACRzB;oBACAC;oBACAC;gBACF;YACF;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAO4C,QAAQ;QACf,IAAI7B,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAMhC,UAAU;gBACrBC,gBAAgB2B;gBAChB1B;gBACAC,QAAQ0B;gBACRzB;gBACAC;gBACAC;YACF;QACF;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB,SAAU;QACR,IAAIP,KAAK;YACPA,IAAIJ,cAAc,GAAG2B;YACrBvB,IAAIF,MAAM,GAAG0B;YAEb,IAAIxB,IAAI0B,KAAK,EAAE;gBACb1B,IAAI0B,KAAK,CAACX,KAAK,GAAGU;YACpB;QACF;IACF;AACF,EAAC"}

package/dist/auth/strategies/jwt.spec.js

@@ -0,0 +1,281 @@
+import { SignJWT } from 'jose';
+import { describe, expect, it, vi } from 'vitest';
+import { getFieldsToSign } from '../getFieldsToSign.js';
+import { jwtSign } from '../jwt.js';
+import { JWT_AUTH_VERSION } from '../jwtAuth.js';
+import { JWTAuthentication } from './jwt.js';
+const secret = '01234567890123456789012345678901';
+const signToken = async (tokenData, protectedHeader = {
+    authVersion: JWT_AUTH_VERSION
+})=>new SignJWT(tokenData).setProtectedHeader({
+        alg: 'HS256',
+        typ: 'JWT',
+        ...protectedHeader
+    }).sign(new TextEncoder().encode(secret));
+const createPayload = ()=>({
+        collections: {
+            admins: {
+                config: {
+                    auth: {
+                        depth: 0,
+                        useSessions: false,
+                        verify: false
+                    },
+                    slug: 'admins'
+                }
+            },
+            disabledUsers: {
+                config: {
+                    auth: {
+                        depth: 0,
+                        disableLocalStrategy: true,
+                        useSessions: false,
+                        verify: false
+                    },
+                    slug: 'disabledUsers'
+                }
+            },
+            posts: {
+                config: {
+                    auth: false,
+                    slug: 'posts'
+                }
+            },
+            users: {
+                config: {
+                    auth: {
+                        depth: 0,
+                        useSessions: false,
+                        verify: false
+                    },
+                    slug: 'users'
+                }
+            }
+        },
+        config: {
+            admin: {
+                autoLogin: {
+                    email: 'dev@example.com'
+                },
+                user: 'users'
+            },
+            auth: {
+                jwtOrder: [
+                    'Bearer'
+                ]
+            },
+            cookiePrefix: 'payload',
+            csrf: []
+        },
+        find: vi.fn(async ({ depth, req })=>{
+            if (req?.query) {
+                req.query.depth = depth;
+            }
+            return {
+                docs: [
+                    {
+                        id: 'auto-login-user'
+                    }
+                ]
+            };
+        }),
+        findByID: async ({ collection, id })=>({
+                id,
+                role: collection === 'posts' ? 'admin' : 'user'
+            }),
+        secret
+    });
+const authenticate = async (token, payload = createPayload())=>{
+    return JWTAuthentication({
+        headers: new Headers({
+            Authorization: `Bearer ${token}`,
+            DisableAutologin: 'true'
+        }),
+        payload
+    });
+};
+describe('JWTAuthentication', ()=>{
+    it.each([
+        {
+            expectedDepth: 2,
+            isGraphQL: false,
+            label: 'REST'
+        },
+        {
+            expectedDepth: 0,
+            isGraphQL: true,
+            label: 'GraphQL'
+        }
+    ])('should use the expected auth depth for $label auto-login', async ({ expectedDepth, isGraphQL })=>{
+        const payload = createPayload();
+        const req = {
+            fallbackLocale: false,
+            locale: 'en',
+            query: {
+                depth: 9
+            }
+        };
+        payload.collections.users.config.auth.depth = 2;
+        const result = await JWTAuthentication({
+            headers: new Headers(),
+            isGraphQL,
+            payload,
+            req
+        });
+        expect(payload.find).toHaveBeenCalledWith(expect.objectContaining({
+            depth: expectedDepth,
+            fallbackLocale: false,
+            locale: 'en',
+            req
+        }));
+        expect(req.query.depth).toBe(9);
+        expect(result.user).toMatchObject({
+            _strategy: 'local-jwt',
+            collection: 'users',
+            id: 'auto-login-user'
+        });
+    });
+    it('should authenticate flat v3 token data with a protected-header version marker', async ()=>{
+        const { token } = await jwtSign({
+            fieldsToSign: {
+                collection: 'users',
+                id: 'user-id',
+                role: 'user'
+            },
+            secret,
+            tokenExpiration: 3600
+        });
+        await expect(authenticate(token)).resolves.toMatchObject({
+            user: {
+                _strategy: 'local-jwt',
+                collection: 'users',
+                id: 'user-id'
+            }
+        });
+    });
+    it('should reject existing tokens without a protected-header version marker', async ()=>{
+        await expect(authenticate(await signToken({
+            collection: 'users',
+            id: 'user-id',
+            role: 'user'
+        }, {}))).resolves.toEqual({
+            user: null
+        });
+    });
+    it('should reject tokens with a payload version value but no protected-header marker', async ()=>{
+        await expect(authenticate(await signToken({
+            collection: 'users',
+            id: 'user-id',
+            authVersion: JWT_AUTH_VERSION,
+            role: 'user'
+        }, {}))).resolves.toEqual({
+            user: null
+        });
+    });
+    it('should reject tokens with an invalid protected-header version', async ()=>{
+        await expect(authenticate(await signToken({
+            collection: 'users',
+            id: 'user-id'
+        }, {
+            authVersion: JWT_AUTH_VERSION + 1
+        }))).resolves.toEqual({
+            user: null
+        });
+        await expect(authenticate(await signToken({
+            collection: 'users',
+            id: 'user-id'
+        }, {
+            authVersion: '1'
+        }))).resolves.toEqual({
+            user: null
+        });
+    });
+    it('should reject inherited collection names', async ()=>{
+        const payload = createPayload();
+        Object.setPrototypeOf(payload.collections, {
+            toString: payload.collections.users
+        });
+        await expect(authenticate(await signToken({
+            collection: 'toString',
+            id: 'user-id'
+        }), payload)).resolves.toEqual({
+            user: null
+        });
+    });
+    it('should accept numeric identifier zero', async ()=>{
+        await expect(authenticate(await signToken({
+            collection: 'users',
+            id: 0
+        }))).resolves.toMatchObject({
+            user: {
+                id: 0
+            }
+        });
+    });
+    it('should reject tokens targeting a non-auth collection', async ()=>{
+        await expect(authenticate(await signToken({
+            collection: 'posts',
+            id: 'post-id'
+        }))).resolves.toEqual({
+            user: null
+        });
+    });
+    it('should reject tokens targeting a collection with local auth disabled', async ()=>{
+        await expect(authenticate(await signToken({
+            collection: 'disabledUsers',
+            id: 'user-id'
+        }))).resolves.toEqual({
+            user: null
+        });
+    });
+    it('should reject malformed identity fields', async ()=>{
+        await expect(authenticate(await signToken({
+            collection: 'users',
+            id: {
+                value: 'user-id'
+            }
+        }))).resolves.toEqual({
+            user: null
+        });
+    });
+    it('should ignore saveToJWT aliases that target Payload-owned fields end to end', async ()=>{
+        const collectionConfig = {
+            fields: [
+                {
+                    name: 'impersonatedID',
+                    saveToJWT: 'id',
+                    type: 'text'
+                },
+                {
+                    name: 'impersonatedCollection',
+                    saveToJWT: 'collection',
+                    type: 'text'
+                }
+            ],
+            slug: 'users'
+        };
+        const fieldsToSign = getFieldsToSign({
+            collectionConfig,
+            email: 'attacker@example.com',
+            user: {
+                id: 'attacker-id',
+                impersonatedCollection: 'admins',
+                impersonatedID: 'victim-id'
+            }
+        });
+        const { token } = await jwtSign({
+            fieldsToSign,
+            secret,
+            tokenExpiration: 3600
+        });
+        const result = await authenticate(token);
+        expect(result.user).toMatchObject({
+            collection: 'users',
+            id: 'attacker-id'
+        });
+        expect(result.user?.collection).not.toBe('admins');
+        expect(result.user?.id).not.toBe('victim-id');
+    });
+});
+
+//# sourceMappingURL=jwt.spec.js.map

package/dist/auth/strategies/jwt.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/strategies/jwt.spec.ts"],"sourcesContent":["import type { CollectionConfig } from '../../collections/config/types.js'\nimport type { Payload, PayloadRequest } from '../../types/index.js'\n\nimport { SignJWT } from 'jose'\nimport { describe, expect, it, vi } from 'vitest'\n\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { JWT_AUTH_VERSION } from '../jwtAuth.js'\nimport { JWTAuthentication } from './jwt.js'\n\nconst secret = '01234567890123456789012345678901'\n\nconst signToken = async (\n  tokenData: Record<string, unknown>,\n  protectedHeader: { authVersion?: number | string } = {\n    authVersion: JWT_AUTH_VERSION,\n  },\n): Promise<string> =>\n  new SignJWT(tokenData)\n    .setProtectedHeader({ alg: 'HS256', typ: 'JWT', ...protectedHeader })\n    .sign(new TextEncoder().encode(secret))\n\nconst createPayload = (): Payload =>\n  ({\n    collections: {\n      admins: {\n        config: {\n          auth: {\n            depth: 0,\n            useSessions: false,\n            verify: false,\n          },\n          slug: 'admins',\n        },\n      },\n      disabledUsers: {\n        config: {\n          auth: {\n            depth: 0,\n            disableLocalStrategy: true,\n            useSessions: false,\n            verify: false,\n          },\n          slug: 'disabledUsers',\n        },\n      },\n      posts: {\n        config: {\n          auth: false,\n          slug: 'posts',\n        },\n      },\n      users: {\n        config: {\n          auth: {\n            depth: 0,\n            useSessions: false,\n            verify: false,\n          },\n          slug: 'users',\n        },\n      },\n    },\n    config: {\n      admin: {\n        autoLogin: {\n          email: 'dev@example.com',\n        },\n        user: 'users',\n      },\n      auth: {\n        jwtOrder: ['Bearer'],\n      },\n      cookiePrefix: 'payload',\n      csrf: [],\n    },\n    find: vi.fn(async ({ depth, req }: { depth: number; req?: PayloadRequest }) => {\n      if (req?.query) {\n        req.query.depth = depth\n      }\n\n      return {\n        docs: [{ id: 'auto-login-user' }],\n      }\n    }),\n    findByID: async ({ collection, id }) => ({\n      id,\n      role: collection === 'posts' ? 'admin' : 'user',\n    }),\n    secret,\n  }) as unknown as Payload\n\nconst authenticate = async (token: string, payload = createPayload()) => {\n  return JWTAuthentication({\n    headers: new Headers({\n      Authorization: `Bearer ${token}`,\n      DisableAutologin: 'true',\n    }),\n    payload,\n  })\n}\n\ndescribe('JWTAuthentication', () => {\n  it.each([\n    { expectedDepth: 2, isGraphQL: false, label: 'REST' },\n    { expectedDepth: 0, isGraphQL: true, label: 'GraphQL' },\n  ])(\n    'should use the expected auth depth for $label auto-login',\n    async ({ expectedDepth, isGraphQL }) => {\n      const payload = createPayload()\n      const req = {\n        fallbackLocale: false,\n        locale: 'en',\n        query: { depth: 9 },\n      } as PayloadRequest\n      payload.collections.users.config.auth.depth = 2\n\n      const result = await JWTAuthentication({\n        headers: new Headers(),\n        isGraphQL,\n        payload,\n        req,\n      })\n\n      expect(payload.find).toHaveBeenCalledWith(\n        expect.objectContaining({\n          depth: expectedDepth,\n          fallbackLocale: false,\n          locale: 'en',\n          req,\n        }),\n      )\n      expect(req.query.depth).toBe(9)\n      expect(result.user).toMatchObject({\n        _strategy: 'local-jwt',\n        collection: 'users',\n        id: 'auto-login-user',\n      })\n    },\n  )\n\n  it('should authenticate flat v3 token data with a protected-header version marker', async () => {\n    const { token } = await jwtSign({\n      fieldsToSign: {\n        collection: 'users',\n        id: 'user-id',\n        role: 'user',\n      },\n      secret,\n      tokenExpiration: 3600,\n    })\n\n    await expect(authenticate(token)).resolves.toMatchObject({\n      user: {\n        _strategy: 'local-jwt',\n        collection: 'users',\n        id: 'user-id',\n      },\n    })\n  })\n\n  it('should reject existing tokens without a protected-header version marker', async () => {\n    await expect(\n      authenticate(\n        await signToken(\n          {\n            collection: 'users',\n            id: 'user-id',\n            role: 'user',\n          },\n          {},\n        ),\n      ),\n    ).resolves.toEqual({ user: null })\n  })\n\n  it('should reject tokens with a payload version value but no protected-header marker', async () => {\n    await expect(\n      authenticate(\n        await signToken(\n          {\n            collection: 'users',\n            id: 'user-id',\n            authVersion: JWT_AUTH_VERSION,\n            role: 'user',\n          },\n          {},\n        ),\n      ),\n    ).resolves.toEqual({ user: null })\n  })\n\n  it('should reject tokens with an invalid protected-header version', async () => {\n    await expect(\n      authenticate(\n        await signToken(\n          {\n            collection: 'users',\n            id: 'user-id',\n          },\n          { authVersion: JWT_AUTH_VERSION + 1 },\n        ),\n      ),\n    ).resolves.toEqual({ user: null })\n\n    await expect(\n      authenticate(\n        await signToken(\n          {\n            collection: 'users',\n            id: 'user-id',\n          },\n          { authVersion: '1' },\n        ),\n      ),\n    ).resolves.toEqual({ user: null })\n  })\n\n  it('should reject inherited collection names', async () => {\n    const payload = createPayload()\n    Object.setPrototypeOf(payload.collections, { toString: payload.collections.users })\n\n    await expect(\n      authenticate(\n        await signToken({\n          collection: 'toString',\n          id: 'user-id',\n        }),\n        payload,\n      ),\n    ).resolves.toEqual({ user: null })\n  })\n\n  it('should accept numeric identifier zero', async () => {\n    await expect(\n      authenticate(\n        await signToken({\n          collection: 'users',\n          id: 0,\n        }),\n      ),\n    ).resolves.toMatchObject({ user: { id: 0 } })\n  })\n\n  it('should reject tokens targeting a non-auth collection', async () => {\n    await expect(\n      authenticate(\n        await signToken({\n          collection: 'posts',\n          id: 'post-id',\n        }),\n      ),\n    ).resolves.toEqual({ user: null })\n  })\n\n  it('should reject tokens targeting a collection with local auth disabled', async () => {\n    await expect(\n      authenticate(\n        await signToken({\n          collection: 'disabledUsers',\n          id: 'user-id',\n        }),\n      ),\n    ).resolves.toEqual({ user: null })\n  })\n\n  it('should reject malformed identity fields', async () => {\n    await expect(\n      authenticate(\n        await signToken({\n          collection: 'users',\n          id: { value: 'user-id' },\n        }),\n      ),\n    ).resolves.toEqual({ user: null })\n  })\n\n  it('should ignore saveToJWT aliases that target Payload-owned fields end to end', async () => {\n    const collectionConfig = {\n      fields: [\n        {\n          name: 'impersonatedID',\n          saveToJWT: 'id',\n          type: 'text',\n        },\n        {\n          name: 'impersonatedCollection',\n          saveToJWT: 'collection',\n          type: 'text',\n        },\n      ],\n      slug: 'users',\n    } as CollectionConfig\n\n    const fieldsToSign = getFieldsToSign({\n      collectionConfig,\n      email: 'attacker@example.com',\n      user: {\n        id: 'attacker-id',\n        impersonatedCollection: 'admins',\n        impersonatedID: 'victim-id',\n      } as PayloadRequest['user'],\n    })\n    const { token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: 3600,\n    })\n    const result = await authenticate(token)\n\n    expect(result.user).toMatchObject({\n      collection: 'users',\n      id: 'attacker-id',\n    })\n    expect(result.user?.collection).not.toBe('admins')\n    expect(result.user?.id).not.toBe('victim-id')\n  })\n})\n"],"names":["SignJWT","describe","expect","it","vi","getFieldsToSign","jwtSign","JWT_AUTH_VERSION","JWTAuthentication","secret","signToken","tokenData","protectedHeader","authVersion","setProtectedHeader","alg","typ","sign","TextEncoder","encode","createPayload","collections","admins","config","auth","depth","useSessions","verify","slug","disabledUsers","disableLocalStrategy","posts","users","admin","autoLogin","email","user","jwtOrder","cookiePrefix","csrf","find","fn","req","query","docs","id","findByID","collection","role","authenticate","token","payload","headers","Headers","Authorization","DisableAutologin","each","expectedDepth","isGraphQL","label","fallbackLocale","locale","result","toHaveBeenCalledWith","objectContaining","toBe","toMatchObject","_strategy","fieldsToSign","tokenExpiration","resolves","toEqual","Object","setPrototypeOf","toString","value","collectionConfig","fields","name","saveToJWT","type","impersonatedCollection","impersonatedID","not"],"mappings":"AAGA,SAASA,OAAO,QAAQ,OAAM;AAC9B,SAASC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,QAAQ,gBAAe;AAChD,SAASC,iBAAiB,QAAQ,WAAU;AAE5C,MAAMC,SAAS;AAEf,MAAMC,YAAY,OAChBC,WACAC,kBAAqD;IACnDC,aAAaN;AACf,CAAC,GAED,IAAIP,QAAQW,WACTG,kBAAkB,CAAC;QAAEC,KAAK;QAASC,KAAK;QAAO,GAAGJ,eAAe;IAAC,GAClEK,IAAI,CAAC,IAAIC,cAAcC,MAAM,CAACV;AAEnC,MAAMW,gBAAgB,IACnB,CAAA;QACCC,aAAa;YACXC,QAAQ;gBACNC,QAAQ;oBACNC,MAAM;wBACJC,OAAO;wBACPC,aAAa;wBACbC,QAAQ;oBACV;oBACAC,MAAM;gBACR;YACF;YACAC,eAAe;gBACbN,QAAQ;oBACNC,MAAM;wBACJC,OAAO;wBACPK,sBAAsB;wBACtBJ,aAAa;wBACbC,QAAQ;oBACV;oBACAC,MAAM;gBACR;YACF;YACAG,OAAO;gBACLR,QAAQ;oBACNC,MAAM;oBACNI,MAAM;gBACR;YACF;YACAI,OAAO;gBACLT,QAAQ;oBACNC,MAAM;wBACJC,OAAO;wBACPC,aAAa;wBACbC,QAAQ;oBACV;oBACAC,MAAM;gBACR;YACF;QACF;QACAL,QAAQ;YACNU,OAAO;gBACLC,WAAW;oBACTC,OAAO;gBACT;gBACAC,MAAM;YACR;YACAZ,MAAM;gBACJa,UAAU;oBAAC;iBAAS;YACtB;YACAC,cAAc;YACdC,MAAM,EAAE;QACV;QACAC,MAAMpC,GAAGqC,EAAE,CAAC,OAAO,EAAEhB,KAAK,EAAEiB,GAAG,EAA2C;YACxE,IAAIA,KAAKC,OAAO;gBACdD,IAAIC,KAAK,CAAClB,KAAK,GAAGA;YACpB;YAEA,OAAO;gBACLmB,MAAM;oBAAC;wBAAEC,IAAI;oBAAkB;iBAAE;YACnC;QACF;QACAC,UAAU,OAAO,EAAEC,UAAU,EAAEF,EAAE,EAAE,GAAM,CAAA;gBACvCA;gBACAG,MAAMD,eAAe,UAAU,UAAU;YAC3C,CAAA;QACAtC;IACF,CAAA;AAEF,MAAMwC,eAAe,OAAOC,OAAeC,UAAU/B,eAAe;IAClE,OAAOZ,kBAAkB;QACvB4C,SAAS,IAAIC,QAAQ;YACnBC,eAAe,CAAC,OAAO,EAAEJ,OAAO;YAChCK,kBAAkB;QACpB;QACAJ;IACF;AACF;AAEAlD,SAAS,qBAAqB;IAC5BE,GAAGqD,IAAI,CAAC;QACN;YAAEC,eAAe;YAAGC,WAAW;YAAOC,OAAO;QAAO;QACpD;YAAEF,eAAe;YAAGC,WAAW;YAAMC,OAAO;QAAU;KACvD,EACC,4DACA,OAAO,EAAEF,aAAa,EAAEC,SAAS,EAAE;QACjC,MAAMP,UAAU/B;QAChB,MAAMsB,MAAM;YACVkB,gBAAgB;YAChBC,QAAQ;YACRlB,OAAO;gBAAElB,OAAO;YAAE;QACpB;QACA0B,QAAQ9B,WAAW,CAACW,KAAK,CAACT,MAAM,CAACC,IAAI,CAACC,KAAK,GAAG;QAE9C,MAAMqC,SAAS,MAAMtD,kBAAkB;YACrC4C,SAAS,IAAIC;YACbK;YACAP;YACAT;QACF;QAEAxC,OAAOiD,QAAQX,IAAI,EAAEuB,oBAAoB,CACvC7D,OAAO8D,gBAAgB,CAAC;YACtBvC,OAAOgC;YACPG,gBAAgB;YAChBC,QAAQ;YACRnB;QACF;QAEFxC,OAAOwC,IAAIC,KAAK,CAAClB,KAAK,EAAEwC,IAAI,CAAC;QAC7B/D,OAAO4D,OAAO1B,IAAI,EAAE8B,aAAa,CAAC;YAChCC,WAAW;YACXpB,YAAY;YACZF,IAAI;QACN;IACF;IAGF1C,GAAG,iFAAiF;QAClF,MAAM,EAAE+C,KAAK,EAAE,GAAG,MAAM5C,QAAQ;YAC9B8D,cAAc;gBACZrB,YAAY;gBACZF,IAAI;gBACJG,MAAM;YACR;YACAvC;YACA4D,iBAAiB;QACnB;QAEA,MAAMnE,OAAO+C,aAAaC,QAAQoB,QAAQ,CAACJ,aAAa,CAAC;YACvD9B,MAAM;gBACJ+B,WAAW;gBACXpB,YAAY;gBACZF,IAAI;YACN;QACF;IACF;IAEA1C,GAAG,2EAA2E;QAC5E,MAAMD,OACJ+C,aACE,MAAMvC,UACJ;YACEqC,YAAY;YACZF,IAAI;YACJG,MAAM;QACR,GACA,CAAC,KAGLsB,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;IAClC;IAEAjC,GAAG,oFAAoF;QACrF,MAAMD,OACJ+C,aACE,MAAMvC,UACJ;YACEqC,YAAY;YACZF,IAAI;YACJhC,aAAaN;YACbyC,MAAM;QACR,GACA,CAAC,KAGLsB,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;IAClC;IAEAjC,GAAG,iEAAiE;QAClE,MAAMD,OACJ+C,aACE,MAAMvC,UACJ;YACEqC,YAAY;YACZF,IAAI;QACN,GACA;YAAEhC,aAAaN,mBAAmB;QAAE,KAGxC+D,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;QAEhC,MAAMlC,OACJ+C,aACE,MAAMvC,UACJ;YACEqC,YAAY;YACZF,IAAI;QACN,GACA;YAAEhC,aAAa;QAAI,KAGvByD,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;IAClC;IAEAjC,GAAG,4CAA4C;QAC7C,MAAMgD,UAAU/B;QAChBoD,OAAOC,cAAc,CAACtB,QAAQ9B,WAAW,EAAE;YAAEqD,UAAUvB,QAAQ9B,WAAW,CAACW,KAAK;QAAC;QAEjF,MAAM9B,OACJ+C,aACE,MAAMvC,UAAU;YACdqC,YAAY;YACZF,IAAI;QACN,IACAM,UAEFmB,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;IAClC;IAEAjC,GAAG,yCAAyC;QAC1C,MAAMD,OACJ+C,aACE,MAAMvC,UAAU;YACdqC,YAAY;YACZF,IAAI;QACN,KAEFyB,QAAQ,CAACJ,aAAa,CAAC;YAAE9B,MAAM;gBAAES,IAAI;YAAE;QAAE;IAC7C;IAEA1C,GAAG,wDAAwD;QACzD,MAAMD,OACJ+C,aACE,MAAMvC,UAAU;YACdqC,YAAY;YACZF,IAAI;QACN,KAEFyB,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;IAClC;IAEAjC,GAAG,wEAAwE;QACzE,MAAMD,OACJ+C,aACE,MAAMvC,UAAU;YACdqC,YAAY;YACZF,IAAI;QACN,KAEFyB,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;IAClC;IAEAjC,GAAG,2CAA2C;QAC5C,MAAMD,OACJ+C,aACE,MAAMvC,UAAU;YACdqC,YAAY;YACZF,IAAI;gBAAE8B,OAAO;YAAU;QACzB,KAEFL,QAAQ,CAACC,OAAO,CAAC;YAAEnC,MAAM;QAAK;IAClC;IAEAjC,GAAG,+EAA+E;QAChF,MAAMyE,mBAAmB;YACvBC,QAAQ;gBACN;oBACEC,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;aACD;YACDpD,MAAM;QACR;QAEA,MAAMwC,eAAe/D,gBAAgB;YACnCuE;YACAzC,OAAO;YACPC,MAAM;gBACJS,IAAI;gBACJoC,wBAAwB;gBACxBC,gBAAgB;YAClB;QACF;QACA,MAAM,EAAEhC,KAAK,EAAE,GAAG,MAAM5C,QAAQ;YAC9B8D;YACA3D;YACA4D,iBAAiB;QACnB;QACA,MAAMP,SAAS,MAAMb,aAAaC;QAElChD,OAAO4D,OAAO1B,IAAI,EAAE8B,aAAa,CAAC;YAChCnB,YAAY;YACZF,IAAI;QACN;QACA3C,OAAO4D,OAAO1B,IAAI,EAAEW,YAAYoC,GAAG,CAAClB,IAAI,CAAC;QACzC/D,OAAO4D,OAAO1B,IAAI,EAAES,IAAIsC,GAAG,CAAClB,IAAI,CAAC;IACnC;AACF"}

package/dist/auth/strategies/local/authenticate.d.ts

@@ -1,9 +1,13 @@
 import type { TypeWithID } from '../../../collections/config/types.js';
 type Doc = Record<string, unknown> & TypeWithID;
+type AuthenticationResult = {
+    doc: Doc;
+    shouldUpdatePasswordHash: boolean;
+};
 type Args = {
     doc: Doc;
     password: string;
 };
-export declare const authenticateLocalStrategy: ({ doc, password }: Args) => Promise<Doc | null>;
+export declare const authenticateLocalStrategy: ({ doc, password, }: Args) => Promise<AuthenticationResult | null>;
 export {};
 //# sourceMappingURL=authenticate.d.ts.map

package/dist/auth/strategies/local/authenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/authenticate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEtE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;AAE/C,KAAK,IAAI,GAAG;IACV,GAAG,EAAE,GAAG,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,yBAAyB,sBAA6B,IAAI,KAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CA+B3F,CAAA"}
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/authenticate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAItE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;AAE/C,KAAK,oBAAoB,GAAG;IAC1B,GAAG,EAAE,GAAG,CAAA;IACR,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,KAAK,IAAI,GAAG;IACV,GAAG,EAAE,GAAG,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,yBAAyB,uBAGnC,IAAI,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAmC5C,CAAA"}

package/dist/auth/strategies/local/authenticate.js

@@ -1,17 +1,22 @@
 // @ts-strict-ignore
 import crypto from 'crypto';
+import { getPasswordHashParameters, isCurrentPasswordHash } from './generatePasswordSaltHash.js';
 export const authenticateLocalStrategy = async ({ doc, password })=>{
     try {
         const { hash, salt } = doc;
         if (typeof salt === 'string' && typeof hash === 'string') {
+            const { hash: storedHash, iterations, keyLength } = getPasswordHashParameters(hash);
             const res = await new Promise((resolve, reject)=>{
-                crypto.pbkdf2(password, salt, 25000, 512, 'sha256', (e, hashBuffer)=>{
+                crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (e, hashBuffer)=>{
                     if (e) {
                         reject(e);
                     }
-                    const storedHashBuffer = Buffer.from(hash, 'hex');
+                    const storedHashBuffer = Buffer.from(storedHash, 'hex');
                     if (hashBuffer.length === storedHashBuffer.length && crypto.timingSafeEqual(hashBuffer, storedHashBuffer)) {
-                        resolve(doc);
+                        resolve({
+                            doc,
+                            shouldUpdatePasswordHash: !isCurrentPasswordHash(hash)
+                        });
                     } else {
                         reject(new Error('Invalid password'));
                     }

package/dist/auth/strategies/local/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/authenticate.ts"],"sourcesContent":["// @ts-strict-ignore\nimport crypto from 'crypto'\n\nimport type { TypeWithID } from '../../../collections/config/types.js'\n\ntype Doc = Record<string, unknown> & TypeWithID\n\ntype Args = {\n  doc: Doc\n  password: string\n}\n\nexport const authenticateLocalStrategy = async ({ doc, password }: Args): Promise<Doc | null> => {\n  try {\n    const { hash, salt } = doc\n\n    if (typeof salt === 'string' && typeof hash === 'string') {\n      const res = await new Promise<Doc | null>((resolve, reject) => {\n        crypto.pbkdf2(password, salt, 25000, 512, 'sha256', (e, hashBuffer) => {\n          if (e) {\n            reject(e)\n          }\n\n          const storedHashBuffer = Buffer.from(hash, 'hex')\n\n          if (\n            hashBuffer.length === storedHashBuffer.length &&\n            crypto.timingSafeEqual(hashBuffer, storedHashBuffer)\n          ) {\n            resolve(doc)\n          } else {\n            reject(new Error('Invalid password'))\n          }\n        })\n      })\n\n      return res\n    }\n\n    return null\n  } catch (ignore) {\n    return null\n  }\n}\n"],"names":["crypto","authenticateLocalStrategy","doc","password","hash","salt","res","Promise","resolve","reject","pbkdf2","e","hashBuffer","storedHashBuffer","Buffer","from","length","timingSafeEqual","Error","ignore"],"mappings":"AAAA,oBAAoB;AACpB,OAAOA,YAAY,SAAQ;AAW3B,OAAO,MAAMC,4BAA4B,OAAO,EAAEC,GAAG,EAAEC,QAAQ,EAAQ;IACrE,IAAI;QACF,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGH;QAEvB,IAAI,OAAOG,SAAS,YAAY,OAAOD,SAAS,UAAU;YACxD,MAAME,MAAM,MAAM,IAAIC,QAAoB,CAACC,SAASC;gBAClDT,OAAOU,MAAM,CAACP,UAAUE,MAAM,OAAO,KAAK,UAAU,CAACM,GAAGC;oBACtD,IAAID,GAAG;wBACLF,OAAOE;oBACT;oBAEA,MAAME,mBAAmBC,OAAOC,IAAI,CAACX,MAAM;oBAE3C,IACEQ,WAAWI,MAAM,KAAKH,iBAAiBG,MAAM,IAC7ChB,OAAOiB,eAAe,CAACL,YAAYC,mBACnC;wBACAL,QAAQN;oBACV,OAAO;wBACLO,OAAO,IAAIS,MAAM;oBACnB;gBACF;YACF;YAEA,OAAOZ;QACT;QAEA,OAAO;IACT,EAAE,OAAOa,QAAQ;QACf,OAAO;IACT;AACF,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/authenticate.ts"],"sourcesContent":["// @ts-strict-ignore\nimport crypto from 'crypto'\n\nimport type { TypeWithID } from '../../../collections/config/types.js'\n\nimport { getPasswordHashParameters, isCurrentPasswordHash } from './generatePasswordSaltHash.js'\n\ntype Doc = Record<string, unknown> & TypeWithID\n\ntype AuthenticationResult = {\n  doc: Doc\n  shouldUpdatePasswordHash: boolean\n}\n\ntype Args = {\n  doc: Doc\n  password: string\n}\n\nexport const authenticateLocalStrategy = async ({\n  doc,\n  password,\n}: Args): Promise<AuthenticationResult | null> => {\n  try {\n    const { hash, salt } = doc\n\n    if (typeof salt === 'string' && typeof hash === 'string') {\n      const { hash: storedHash, iterations, keyLength } = getPasswordHashParameters(hash)\n      const res = await new Promise<AuthenticationResult | null>((resolve, reject) => {\n        crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (e, hashBuffer) => {\n          if (e) {\n            reject(e)\n          }\n\n          const storedHashBuffer = Buffer.from(storedHash, 'hex')\n\n          if (\n            hashBuffer.length === storedHashBuffer.length &&\n            crypto.timingSafeEqual(hashBuffer, storedHashBuffer)\n          ) {\n            resolve({\n              doc,\n              shouldUpdatePasswordHash: !isCurrentPasswordHash(hash),\n            })\n          } else {\n            reject(new Error('Invalid password'))\n          }\n        })\n      })\n\n      return res\n    }\n\n    return null\n  } catch (ignore) {\n    return null\n  }\n}\n"],"names":["crypto","getPasswordHashParameters","isCurrentPasswordHash","authenticateLocalStrategy","doc","password","hash","salt","storedHash","iterations","keyLength","res","Promise","resolve","reject","pbkdf2","e","hashBuffer","storedHashBuffer","Buffer","from","length","timingSafeEqual","shouldUpdatePasswordHash","Error","ignore"],"mappings":"AAAA,oBAAoB;AACpB,OAAOA,YAAY,SAAQ;AAI3B,SAASC,yBAAyB,EAAEC,qBAAqB,QAAQ,gCAA+B;AAchG,OAAO,MAAMC,4BAA4B,OAAO,EAC9CC,GAAG,EACHC,QAAQ,EACH;IACL,IAAI;QACF,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGH;QAEvB,IAAI,OAAOG,SAAS,YAAY,OAAOD,SAAS,UAAU;YACxD,MAAM,EAAEA,MAAME,UAAU,EAAEC,UAAU,EAAEC,SAAS,EAAE,GAAGT,0BAA0BK;YAC9E,MAAMK,MAAM,MAAM,IAAIC,QAAqC,CAACC,SAASC;gBACnEd,OAAOe,MAAM,CAACV,UAAUE,MAAME,YAAYC,WAAW,UAAU,CAACM,GAAGC;oBACjE,IAAID,GAAG;wBACLF,OAAOE;oBACT;oBAEA,MAAME,mBAAmBC,OAAOC,IAAI,CAACZ,YAAY;oBAEjD,IACES,WAAWI,MAAM,KAAKH,iBAAiBG,MAAM,IAC7CrB,OAAOsB,eAAe,CAACL,YAAYC,mBACnC;wBACAL,QAAQ;4BACNT;4BACAmB,0BAA0B,CAACrB,sBAAsBI;wBACnD;oBACF,OAAO;wBACLQ,OAAO,IAAIU,MAAM;oBACnB;gBACF;YACF;YAEA,OAAOb;QACT;QAEA,OAAO;IACT,EAAE,OAAOc,QAAQ;QACf,OAAO;IACT;AACF,EAAC"}

package/dist/auth/strategies/local/authenticate.spec.js

@@ -1,8 +1,7 @@
 import crypto from 'crypto';
 import { describe, expect, it } from 'vitest';
 import { authenticateLocalStrategy } from './authenticate.js';
-// Helper to generate hash/salt like Payload does
-const generateHashAndSalt = (password)=>{
+const generateExistingHashAndSalt = (password)=>{
     const salt = crypto.randomBytes(32).toString('hex');
     const hash = crypto.pbkdf2Sync(password, salt, 25000, 512, 'sha256').toString('hex');
     return {
@@ -10,10 +9,35 @@ const generateHashAndSalt = (password)=>{
         salt
     };
 };
+const generateCurrentHashAndSalt = (password)=>{
+    const salt = crypto.randomBytes(32).toString('hex');
+    const hash = crypto.pbkdf2Sync(password, salt, 600000, 32, 'sha256').toString('hex');
+    return {
+        hash: `pbkdf2-sha256-v1:${hash}`,
+        salt
+    };
+};
 describe('authenticateLocalStrategy', ()=>{
-    it('should return doc when password is valid', async ()=>{
+    it('should return doc for an existing password hash', async ()=>{
+        const password = 'test-password';
+        const { hash, salt } = generateExistingHashAndSalt(password);
+        const doc = {
+            id: 1,
+            hash,
+            salt
+        };
+        const result = await authenticateLocalStrategy({
+            doc,
+            password
+        });
+        expect(result).toEqual({
+            doc,
+            shouldUpdatePasswordHash: true
+        });
+    });
+    it('should return doc for a current password hash', async ()=>{
         const password = 'test-password';
-        const { hash, salt } = generateHashAndSalt(password);
+        const { hash, salt } = generateCurrentHashAndSalt(password);
         const doc = {
             id: 1,
             hash,
@@ -23,10 +47,13 @@ describe('authenticateLocalStrategy', ()=>{
             doc,
             password
         });
-        expect(result).toEqual(doc);
+        expect(result).toEqual({
+            doc,
+            shouldUpdatePasswordHash: false
+        });
     });
     it('should return null when password is invalid', async ()=>{
-        const { hash, salt } = generateHashAndSalt('correct-password');
+        const { hash, salt } = generateExistingHashAndSalt('correct-password');
         const doc = {
             id: 1,
             hash,
@@ -39,7 +66,7 @@ describe('authenticateLocalStrategy', ()=>{
         expect(result).toBeNull();
     });
     it('should return null when salt is missing', async ()=>{
-        const { hash } = generateHashAndSalt('test-password');
+        const { hash } = generateExistingHashAndSalt('test-password');
         const doc = {
             id: 1,
             hash
@@ -51,7 +78,7 @@ describe('authenticateLocalStrategy', ()=>{
         expect(result).toBeNull();
     });
     it('should return null when hash is missing', async ()=>{
-        const { salt } = generateHashAndSalt('test-password');
+        const { salt } = generateExistingHashAndSalt('test-password');
         const doc = {
             id: 1,
             salt
@@ -64,8 +91,8 @@ describe('authenticateLocalStrategy', ()=>{
     });
     it('should return null when hash has different length (tampered)', async ()=>{
         const password = 'test-password';
-        const { salt } = generateHashAndSalt(password);
-        // Truncated hash - different length than expected 512 bytes
+        const { salt } = generateExistingHashAndSalt(password);
+        // Truncated hash - different length than an existing hash derives
         const shortHash = 'abcd1234';
         const doc = {
             id: 1,