payload 3.89.0 → 3.90.1

package/dist/auth/baseFields/auth.d.ts

@@ -1,3 +1,4 @@
 import type { Field } from '../../fields/config/types.js';
 export declare const baseAuthFields: Field[];
+export declare const resetPasswordRequestedAtField: Field;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth/baseFields/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/baseFields/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD,eAAO,MAAM,cAAc,EAAE,KAAK,EAqCjC,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/baseFields/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD,eAAO,MAAM,cAAc,EAAE,KAAK,EAqCjC,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAE,KAQ3C,CAAA"}

package/dist/auth/baseFields/auth.js

@@ -36,5 +36,14 @@ export const baseAuthFields = [
         hidden: true
     }
 ];
+export const resetPasswordRequestedAtField = {
+    name: 'resetPasswordRequestedAt',
+    type: 'date',
+    access: {
+        create: ()=>false,
+        update: ()=>false
+    },
+    hidden: true
+};
 
 //# sourceMappingURL=auth.js.map

package/dist/auth/baseFields/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/baseFields/auth.ts"],"sourcesContent":["import type { Field } from '../../fields/config/types.js'\n\nexport const baseAuthFields: Field[] = [\n  {\n    name: 'resetPasswordToken',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'resetPasswordExpiration',\n    type: 'date',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'salt',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'hash',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n]\n"],"names":["baseAuthFields","name","type","access","create","update","hidden"],"mappings":"AAEA,OAAO,MAAMA,iBAA0B;IACrC;QACEC,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;CACD,CAAA"}
+{"version":3,"sources":["../../../src/auth/baseFields/auth.ts"],"sourcesContent":["import type { Field } from '../../fields/config/types.js'\n\nexport const baseAuthFields: Field[] = [\n  {\n    name: 'resetPasswordToken',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'resetPasswordExpiration',\n    type: 'date',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'salt',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'hash',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n]\n\nexport const resetPasswordRequestedAtField: Field = {\n  name: 'resetPasswordRequestedAt',\n  type: 'date',\n  access: {\n    create: () => false,\n    update: () => false,\n  },\n  hidden: true,\n}\n"],"names":["baseAuthFields","name","type","access","create","update","hidden","resetPasswordRequestedAtField"],"mappings":"AAEA,OAAO,MAAMA,iBAA0B;IACrC;QACEC,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;CACD,CAAA;AAED,OAAO,MAAMC,gCAAuC;IAClDN,MAAM;IACNC,MAAM;IACNC,QAAQ;QACNC,QAAQ,IAAM;QACdC,QAAQ,IAAM;IAChB;IACAC,QAAQ;AACV,EAAC"}

package/dist/auth/defaultUnlockAccess.d.ts

@@ -0,0 +1,3 @@
+import type { Access } from '../config/types.js';
+export declare const defaultUnlockAccess: Access;
+//# sourceMappingURL=defaultUnlockAccess.d.ts.map

package/dist/auth/defaultUnlockAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultUnlockAccess.d.ts","sourceRoot":"","sources":["../../src/auth/defaultUnlockAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,eAAO,MAAM,mBAAmB,EAAE,MAMjC,CAAA"}

package/dist/auth/defaultUnlockAccess.js

@@ -0,0 +1,8 @@
+export const defaultUnlockAccess = ({ req: { payload, user } })=>{
+    if (!user) {
+        return false;
+    }
+    return user.collection === payload.config.admin.user;
+};
+
+//# sourceMappingURL=defaultUnlockAccess.js.map

package/dist/auth/defaultUnlockAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/defaultUnlockAccess.ts"],"sourcesContent":["import type { Access } from '../config/types.js'\n\nexport const defaultUnlockAccess: Access = ({ req: { payload, user } }) => {\n  if (!user) {\n    return false\n  }\n\n  return user.collection === payload.config.admin.user\n}\n"],"names":["defaultUnlockAccess","req","payload","user","collection","config","admin"],"mappings":"AAEA,OAAO,MAAMA,sBAA8B,CAAC,EAAEC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE,EAAE;IACpE,IAAI,CAACA,MAAM;QACT,OAAO;IACT;IAEA,OAAOA,KAAKC,UAAU,KAAKF,QAAQG,MAAM,CAACC,KAAK,CAACH,IAAI;AACtD,EAAC"}

package/dist/auth/endpoints/index.d.ts

@@ -1,4 +1,5 @@
 import type { Endpoint } from '../../config/types.js';
 export declare const authRootEndpoints: Endpoint[];
+export declare const apiKeyRevealEndpoint: Endpoint;
 export declare const authCollectionEndpoints: Endpoint[];
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/endpoints/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAerD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,EAMtC,CAAA;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,EAmD5C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAgBrD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,EAMtC,CAAA;AAEF,eAAO,MAAM,oBAAoB,EAAE,QAM7B,CAAA;AAEN,eAAO,MAAM,uBAAuB,EAAE,QAAQ,EAmD5C,CAAA"}

package/dist/auth/endpoints/index.js

@@ -8,6 +8,7 @@ import { meHandler } from './me.js';
 import { refreshHandler } from './refresh.js';
 import { registerFirstUserHandler } from './registerFirstUser.js';
 import { resetPasswordHandler } from './resetPassword.js';
+import { revealAPIKeyHandler } from './revealAPIKey.js';
 import { unlockHandler } from './unlock.js';
 import { verifyEmailHandler } from './verifyEmail.js';
 export const authRootEndpoints = wrapInternalEndpoints([
@@ -17,6 +18,13 @@ export const authRootEndpoints = wrapInternalEndpoints([
         path: '/access'
     }
 ]);
+export const apiKeyRevealEndpoint = wrapInternalEndpoints([
+    {
+        handler: revealAPIKeyHandler,
+        method: 'post',
+        path: '/:id/api-key/reveal'
+    }
+])[0];
 export const authCollectionEndpoints = wrapInternalEndpoints([
     {
         handler: forgotPasswordHandler,

package/dist/auth/endpoints/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { accessHandler } from './access.js'\nimport { forgotPasswordHandler } from './forgotPassword.js'\nimport { initHandler } from './init.js'\nimport { loginHandler } from './login.js'\nimport { logoutHandler } from './logout.js'\nimport { meHandler } from './me.js'\nimport { refreshHandler } from './refresh.js'\nimport { registerFirstUserHandler } from './registerFirstUser.js'\nimport { resetPasswordHandler } from './resetPassword.js'\nimport { unlockHandler } from './unlock.js'\nimport { verifyEmailHandler } from './verifyEmail.js'\n\nexport const authRootEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: accessHandler,\n    method: 'get',\n    path: '/access',\n  },\n])\n\nexport const authCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: forgotPasswordHandler,\n    method: 'post',\n    path: '/forgot-password',\n  },\n  {\n    handler: initHandler,\n    method: 'get',\n    path: '/init',\n  },\n  {\n    handler: loginHandler,\n    method: 'post',\n    path: '/login',\n  },\n  {\n    handler: logoutHandler,\n    method: 'post',\n    path: '/logout',\n  },\n  {\n    handler: meHandler,\n    method: 'get',\n    path: '/me',\n  },\n  {\n    handler: refreshHandler,\n    method: 'post',\n    path: '/refresh-token',\n  },\n  {\n    handler: registerFirstUserHandler,\n    method: 'post',\n    path: '/first-register',\n  },\n  {\n    handler: resetPasswordHandler,\n    method: 'post',\n    path: '/reset-password',\n  },\n  {\n    handler: unlockHandler,\n    method: 'post',\n    path: '/unlock',\n  },\n  {\n    handler: verifyEmailHandler,\n    method: 'post',\n    path: '/verify/:id',\n  },\n])\n"],"names":["wrapInternalEndpoints","accessHandler","forgotPasswordHandler","initHandler","loginHandler","logoutHandler","meHandler","refreshHandler","registerFirstUserHandler","resetPasswordHandler","unlockHandler","verifyEmailHandler","authRootEndpoints","handler","method","path","authCollectionEndpoints"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,qBAAqB,QAAQ,sBAAqB;AAC3D,SAASC,WAAW,QAAQ,YAAW;AACvC,SAASC,YAAY,QAAQ,aAAY;AACzC,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,SAAS,QAAQ,UAAS;AACnC,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,wBAAwB,QAAQ,yBAAwB;AACjE,SAASC,oBAAoB,QAAQ,qBAAoB;AACzD,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,kBAAkB,QAAQ,mBAAkB;AAErD,OAAO,MAAMC,oBAAgCZ,sBAAsB;IACjE;QACEa,SAASZ;QACTa,QAAQ;QACRC,MAAM;IACR;CACD,EAAC;AAEF,OAAO,MAAMC,0BAAsChB,sBAAsB;IACvE;QACEa,SAASX;QACTY,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASV;QACTW,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAAST;QACTU,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASR;QACTS,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASP;QACTQ,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASN;QACTO,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASL;QACTM,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASJ;QACTK,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { accessHandler } from './access.js'\nimport { forgotPasswordHandler } from './forgotPassword.js'\nimport { initHandler } from './init.js'\nimport { loginHandler } from './login.js'\nimport { logoutHandler } from './logout.js'\nimport { meHandler } from './me.js'\nimport { refreshHandler } from './refresh.js'\nimport { registerFirstUserHandler } from './registerFirstUser.js'\nimport { resetPasswordHandler } from './resetPassword.js'\nimport { revealAPIKeyHandler } from './revealAPIKey.js'\nimport { unlockHandler } from './unlock.js'\nimport { verifyEmailHandler } from './verifyEmail.js'\n\nexport const authRootEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: accessHandler,\n    method: 'get',\n    path: '/access',\n  },\n])\n\nexport const apiKeyRevealEndpoint: Endpoint = wrapInternalEndpoints([\n  {\n    handler: revealAPIKeyHandler,\n    method: 'post',\n    path: '/:id/api-key/reveal',\n  },\n])[0]!\n\nexport const authCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: forgotPasswordHandler,\n    method: 'post',\n    path: '/forgot-password',\n  },\n  {\n    handler: initHandler,\n    method: 'get',\n    path: '/init',\n  },\n  {\n    handler: loginHandler,\n    method: 'post',\n    path: '/login',\n  },\n  {\n    handler: logoutHandler,\n    method: 'post',\n    path: '/logout',\n  },\n  {\n    handler: meHandler,\n    method: 'get',\n    path: '/me',\n  },\n  {\n    handler: refreshHandler,\n    method: 'post',\n    path: '/refresh-token',\n  },\n  {\n    handler: registerFirstUserHandler,\n    method: 'post',\n    path: '/first-register',\n  },\n  {\n    handler: resetPasswordHandler,\n    method: 'post',\n    path: '/reset-password',\n  },\n  {\n    handler: unlockHandler,\n    method: 'post',\n    path: '/unlock',\n  },\n  {\n    handler: verifyEmailHandler,\n    method: 'post',\n    path: '/verify/:id',\n  },\n])\n"],"names":["wrapInternalEndpoints","accessHandler","forgotPasswordHandler","initHandler","loginHandler","logoutHandler","meHandler","refreshHandler","registerFirstUserHandler","resetPasswordHandler","revealAPIKeyHandler","unlockHandler","verifyEmailHandler","authRootEndpoints","handler","method","path","apiKeyRevealEndpoint","authCollectionEndpoints"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,qBAAqB,QAAQ,sBAAqB;AAC3D,SAASC,WAAW,QAAQ,YAAW;AACvC,SAASC,YAAY,QAAQ,aAAY;AACzC,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,SAAS,QAAQ,UAAS;AACnC,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,wBAAwB,QAAQ,yBAAwB;AACjE,SAASC,oBAAoB,QAAQ,qBAAoB;AACzD,SAASC,mBAAmB,QAAQ,oBAAmB;AACvD,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,kBAAkB,QAAQ,mBAAkB;AAErD,OAAO,MAAMC,oBAAgCb,sBAAsB;IACjE;QACEc,SAASb;QACTc,QAAQ;QACRC,MAAM;IACR;CACD,EAAC;AAEF,OAAO,MAAMC,uBAAiCjB,sBAAsB;IAClE;QACEc,SAASJ;QACTK,QAAQ;QACRC,MAAM;IACR;CACD,CAAC,CAAC,EAAE,CAAC;AAEN,OAAO,MAAME,0BAAsClB,sBAAsB;IACvE;QACEc,SAASZ;QACTa,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASX;QACTY,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASV;QACTW,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAAST;QACTU,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASR;QACTS,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASP;QACTQ,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASN;QACTO,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASL;QACTM,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}

package/dist/auth/endpoints/revealAPIKey.d.ts

@@ -0,0 +1,7 @@
+import type { PayloadHandler } from '../../config/types.js';
+/**
+ * Reveals an encrypted API key when the collection explicitly enables reveal support.
+ * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.
+ */
+export declare const revealAPIKeyHandler: PayloadHandler;
+//# sourceMappingURL=revealAPIKey.d.ts.map

package/dist/auth/endpoints/revealAPIKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revealAPIKey.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/revealAPIKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAS3D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,cAkFjC,CAAA"}

package/dist/auth/endpoints/revealAPIKey.js

@@ -0,0 +1,120 @@
+import { combineQueries } from '../../database/combineQueries.js';
+import { UnauthorizedError } from '../../errors/UnauthorizedError.js';
+import { fieldAffectsData } from '../../fields/config/types.js';
+import { canAccessAdmin } from '../../utilities/canAccessAdmin.js';
+import { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js';
+import { executeAccess } from '../executeAccess.js';
+/**
+ * Reveals an encrypted API key when the collection explicitly enables reveal support.
+ * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.
+ */ export const revealAPIKeyHandler = async (req)=>{
+    const { id, collection } = getRequestCollectionWithID(req);
+    const useAPIKey = collection.config.auth.useAPIKey;
+    if (typeof useAPIKey !== 'object' || useAPIKey.reveal !== true || !req.user) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    try {
+        await canAccessAdmin({
+            req
+        });
+    } catch (error) {
+        if (error instanceof UnauthorizedError) {
+            return Response.json({
+                error: 'Forbidden'
+            }, {
+                status: 403
+            });
+        }
+        throw error;
+    }
+    const userWithReadAccess = await req.payload.findByID({
+        id,
+        collection: collection.config.slug,
+        depth: 0,
+        disableErrors: true,
+        overrideAccess: false,
+        req
+    });
+    if (!userWithReadAccess) {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    // Reveal is treated as a no-op update, so `data` reflects the current document.
+    const updateAccess = await executeAccess({
+        id,
+        data: userWithReadAccess,
+        disableErrors: true,
+        req
+    }, collection.config.access.update);
+    if (!updateAccess) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const user = await req.payload.db.findOne({
+        collection: collection.config.slug,
+        req,
+        select: {
+            apiKey: true
+        },
+        where: combineQueries({
+            id: {
+                equals: id
+            }
+        }, updateAccess)
+    });
+    if (!user) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const apiKeyField = collection.config.fields.find((field)=>fieldAffectsData(field) && field.name === 'apiKey');
+    if (!apiKeyField || !fieldAffectsData(apiKeyField) || !apiKeyField.access?.update) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const canUpdateAPIKey = await apiKeyField.access.update({
+        id,
+        data: {},
+        doc: userWithReadAccess,
+        req,
+        siblingData: {}
+    });
+    if (!canUpdateAPIKey) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    if (!('apiKey' in user) || typeof user.apiKey !== 'string') {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    return Response.json({
+        apiKey: req.payload.decrypt(user.apiKey)
+    }, {
+        headers: {
+            'Cache-Control': 'no-store'
+        }
+    });
+};
+
+//# sourceMappingURL=revealAPIKey.js.map

package/dist/auth/endpoints/revealAPIKey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/endpoints/revealAPIKey.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { combineQueries } from '../../database/combineQueries.js'\nimport { UnauthorizedError } from '../../errors/UnauthorizedError.js'\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { canAccessAdmin } from '../../utilities/canAccessAdmin.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { executeAccess } from '../executeAccess.js'\n\n/**\n * Reveals an encrypted API key when the collection explicitly enables reveal support.\n * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.\n */\nexport const revealAPIKeyHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req)\n  const useAPIKey = collection.config.auth.useAPIKey\n\n  if (typeof useAPIKey !== 'object' || useAPIKey.reveal !== true || !req.user) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  try {\n    await canAccessAdmin({ req })\n  } catch (error) {\n    if (error instanceof UnauthorizedError) {\n      return Response.json({ error: 'Forbidden' }, { status: 403 })\n    }\n\n    throw error\n  }\n\n  const userWithReadAccess = await req.payload.findByID({\n    id,\n    collection: collection.config.slug,\n    depth: 0,\n    disableErrors: true,\n    overrideAccess: false,\n    req,\n  })\n\n  if (!userWithReadAccess) {\n    return Response.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  // Reveal is treated as a no-op update, so `data` reflects the current document.\n  const updateAccess = await executeAccess(\n    { id, data: userWithReadAccess, disableErrors: true, req },\n    collection.config.access.update,\n  )\n\n  if (!updateAccess) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const user = await req.payload.db.findOne({\n    collection: collection.config.slug,\n    req,\n    select: {\n      apiKey: true,\n    },\n    where: combineQueries({ id: { equals: id } }, updateAccess),\n  })\n\n  if (!user) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const apiKeyField = collection.config.fields.find(\n    (field) => fieldAffectsData(field) && field.name === 'apiKey',\n  )\n\n  if (!apiKeyField || !fieldAffectsData(apiKeyField) || !apiKeyField.access?.update) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const canUpdateAPIKey = await apiKeyField.access.update({\n    id,\n    data: {},\n    doc: userWithReadAccess,\n    req,\n    siblingData: {},\n  })\n\n  if (!canUpdateAPIKey) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  if (!('apiKey' in user) || typeof user.apiKey !== 'string') {\n    return Response.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  return Response.json(\n    { apiKey: req.payload.decrypt(user.apiKey) },\n    { headers: { 'Cache-Control': 'no-store' } },\n  )\n}\n"],"names":["combineQueries","UnauthorizedError","fieldAffectsData","canAccessAdmin","getRequestCollectionWithID","executeAccess","revealAPIKeyHandler","req","id","collection","useAPIKey","config","auth","reveal","user","Response","json","error","status","userWithReadAccess","payload","findByID","slug","depth","disableErrors","overrideAccess","updateAccess","data","access","update","db","findOne","select","apiKey","where","equals","apiKeyField","fields","find","field","name","canUpdateAPIKey","doc","siblingData","decrypt","headers"],"mappings":"AAEA,SAASA,cAAc,QAAQ,mCAAkC;AACjE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,aAAa,QAAQ,sBAAqB;AAEnD;;;CAGC,GACD,OAAO,MAAMC,sBAAsC,OAAOC;IACxD,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGL,2BAA2BG;IACtD,MAAMG,YAAYD,WAAWE,MAAM,CAACC,IAAI,CAACF,SAAS;IAElD,IAAI,OAAOA,cAAc,YAAYA,UAAUG,MAAM,KAAK,QAAQ,CAACN,IAAIO,IAAI,EAAE;QAC3E,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,IAAI;QACF,MAAMf,eAAe;YAAEI;QAAI;IAC7B,EAAE,OAAOU,OAAO;QACd,IAAIA,iBAAiBhB,mBAAmB;YACtC,OAAOc,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAAY,GAAG;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMD;IACR;IAEA,MAAME,qBAAqB,MAAMZ,IAAIa,OAAO,CAACC,QAAQ,CAAC;QACpDb;QACAC,YAAYA,WAAWE,MAAM,CAACW,IAAI;QAClCC,OAAO;QACPC,eAAe;QACfC,gBAAgB;QAChBlB;IACF;IAEA,IAAI,CAACY,oBAAoB;QACvB,OAAOJ,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,gFAAgF;IAChF,MAAMQ,eAAe,MAAMrB,cACzB;QAAEG;QAAImB,MAAMR;QAAoBK,eAAe;QAAMjB;IAAI,GACzDE,WAAWE,MAAM,CAACiB,MAAM,CAACC,MAAM;IAGjC,IAAI,CAACH,cAAc;QACjB,OAAOX,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMJ,OAAO,MAAMP,IAAIa,OAAO,CAACU,EAAE,CAACC,OAAO,CAAC;QACxCtB,YAAYA,WAAWE,MAAM,CAACW,IAAI;QAClCf;QACAyB,QAAQ;YACNC,QAAQ;QACV;QACAC,OAAOlC,eAAe;YAAEQ,IAAI;gBAAE2B,QAAQ3B;YAAG;QAAE,GAAGkB;IAChD;IAEA,IAAI,CAACZ,MAAM;QACT,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMkB,cAAc3B,WAAWE,MAAM,CAAC0B,MAAM,CAACC,IAAI,CAC/C,CAACC,QAAUrC,iBAAiBqC,UAAUA,MAAMC,IAAI,KAAK;IAGvD,IAAI,CAACJ,eAAe,CAAClC,iBAAiBkC,gBAAgB,CAACA,YAAYR,MAAM,EAAEC,QAAQ;QACjF,OAAOd,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMuB,kBAAkB,MAAML,YAAYR,MAAM,CAACC,MAAM,CAAC;QACtDrB;QACAmB,MAAM,CAAC;QACPe,KAAKvB;QACLZ;QACAoC,aAAa,CAAC;IAChB;IAEA,IAAI,CAACF,iBAAiB;QACpB,OAAO1B,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,IAAI,CAAE,CAAA,YAAYJ,IAAG,KAAM,OAAOA,KAAKmB,MAAM,KAAK,UAAU;QAC1D,OAAOlB,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,OAAOH,SAASC,IAAI,CAClB;QAAEiB,QAAQ1B,IAAIa,OAAO,CAACwB,OAAO,CAAC9B,KAAKmB,MAAM;IAAE,GAC3C;QAAEY,SAAS;YAAE,iBAAiB;QAAW;IAAE;AAE/C,EAAC"}

package/dist/auth/executeAccess.d.ts

@@ -1,12 +1,14 @@
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
 import type { Access, AccessResult } from '../config/types.js';
 import type { PayloadRequest } from '../types/index.js';
 type OperationArgs = {
+    collectionConfig?: SanitizedCollectionConfig;
     data?: any;
     disableErrors?: boolean;
     id?: number | string;
     isReadingStaticFile?: boolean;
     req: PayloadRequest;
 };
-export declare const executeAccess: ({ id, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access: Access) => Promise<AccessResult>;
+export declare const executeAccess: ({ id, collectionConfig, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access: Access) => Promise<AccessResult>;
 export {};
 //# sourceMappingURL=executeAccess.d.ts.map

package/dist/auth/executeAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,eAAO,MAAM,aAAa,0DACuC,aAAa,UACpE,MAAM,KACb,OAAO,CAAC,YAAY,CA0BtB,CAAA"}
+{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IAC5C,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,eAAO,MAAM,aAAa,4EACyD,aAAa,UACtF,MAAM,KACb,OAAO,CAAC,YAAY,CA2BtB,CAAA"}

package/dist/auth/executeAccess.js

@@ -1,8 +1,9 @@
 import { Forbidden } from '../errors/index.js';
-export const executeAccess = async ({ id, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
+export const executeAccess = async ({ id, collectionConfig, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
     if (access) {
         const resolvedConstraint = await access({
             id,
+            collectionConfig,
             data,
             isReadingStaticFile,
             req

package/dist/auth/executeAccess.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/executeAccess.ts"],"sourcesContent":["import type { Access, AccessResult } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { Forbidden } from '../errors/index.js'\n\ntype OperationArgs = {\n  data?: any\n  disableErrors?: boolean\n  id?: number | string\n  isReadingStaticFile?: boolean\n  req: PayloadRequest\n}\nexport const executeAccess = async (\n  { id, data, disableErrors, isReadingStaticFile = false, req }: OperationArgs,\n  access: Access,\n): Promise<AccessResult> => {\n  if (access) {\n    const resolvedConstraint = await access({\n      id,\n      data,\n      isReadingStaticFile,\n      req,\n    })\n\n    if (!resolvedConstraint) {\n      if (!disableErrors) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    return resolvedConstraint\n  }\n\n  if (req.user) {\n    return true\n  }\n\n  if (!disableErrors) {\n    throw new Forbidden(req.t)\n  }\n  return false\n}\n"],"names":["Forbidden","executeAccess","id","data","disableErrors","isReadingStaticFile","req","access","resolvedConstraint","t","user"],"mappings":"AAGA,SAASA,SAAS,QAAQ,qBAAoB;AAS9C,OAAO,MAAMC,gBAAgB,OAC3B,EAAEC,EAAE,EAAEC,IAAI,EAAEC,aAAa,EAAEC,sBAAsB,KAAK,EAAEC,GAAG,EAAiB,EAC5EC;IAEA,IAAIA,QAAQ;QACV,MAAMC,qBAAqB,MAAMD,OAAO;YACtCL;YACAC;YACAE;YACAC;QACF;QAEA,IAAI,CAACE,oBAAoB;YACvB,IAAI,CAACJ,eAAe;gBAClB,MAAM,IAAIJ,UAAUM,IAAIG,CAAC;YAC3B;QACF;QAEA,OAAOD;IACT;IAEA,IAAIF,IAAII,IAAI,EAAE;QACZ,OAAO;IACT;IAEA,IAAI,CAACN,eAAe;QAClB,MAAM,IAAIJ,UAAUM,IAAIG,CAAC;IAC3B;IACA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/executeAccess.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { Access, AccessResult } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { Forbidden } from '../errors/index.js'\n\ntype OperationArgs = {\n  collectionConfig?: SanitizedCollectionConfig\n  data?: any\n  disableErrors?: boolean\n  id?: number | string\n  isReadingStaticFile?: boolean\n  req: PayloadRequest\n}\nexport const executeAccess = async (\n  { id, collectionConfig, data, disableErrors, isReadingStaticFile = false, req }: OperationArgs,\n  access: Access,\n): Promise<AccessResult> => {\n  if (access) {\n    const resolvedConstraint = await access({\n      id,\n      collectionConfig,\n      data,\n      isReadingStaticFile,\n      req,\n    })\n\n    if (!resolvedConstraint) {\n      if (!disableErrors) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    return resolvedConstraint\n  }\n\n  if (req.user) {\n    return true\n  }\n\n  if (!disableErrors) {\n    throw new Forbidden(req.t)\n  }\n  return false\n}\n"],"names":["Forbidden","executeAccess","id","collectionConfig","data","disableErrors","isReadingStaticFile","req","access","resolvedConstraint","t","user"],"mappings":"AAIA,SAASA,SAAS,QAAQ,qBAAoB;AAU9C,OAAO,MAAMC,gBAAgB,OAC3B,EAAEC,EAAE,EAAEC,gBAAgB,EAAEC,IAAI,EAAEC,aAAa,EAAEC,sBAAsB,KAAK,EAAEC,GAAG,EAAiB,EAC9FC;IAEA,IAAIA,QAAQ;QACV,MAAMC,qBAAqB,MAAMD,OAAO;YACtCN;YACAC;YACAC;YACAE;YACAC;QACF;QAEA,IAAI,CAACE,oBAAoB;YACvB,IAAI,CAACJ,eAAe;gBAClB,MAAM,IAAIL,UAAUO,IAAIG,CAAC;YAC3B;QACF;QAEA,OAAOD;IACT;IAEA,IAAIF,IAAII,IAAI,EAAE;QACZ,OAAO;IACT;IAEA,IAAI,CAACN,eAAe;QAClB,MAAM,IAAIL,UAAUO,IAAIG,CAAC;IAC3B;IACA,OAAO;AACT,EAAC"}

package/dist/auth/getAuthFields.d.ts

@@ -1,4 +1,4 @@
 import type { Field } from '../fields/config/types.js';
 import type { IncomingAuthType } from './types.js';
-export declare const getBaseAuthFields: (authConfig: IncomingAuthType) => Field[];
+export declare const getBaseAuthFields: (authConfig: IncomingAuthType, fields?: Field[]) => Field[];
 //# sourceMappingURL=getAuthFields.d.ts.map

package/dist/auth/getAuthFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getAuthFields.d.ts","sourceRoot":"","sources":["../../src/auth/getAuthFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAUlD,eAAO,MAAM,iBAAiB,eAAgB,gBAAgB,KAAG,KAAK,EAmDrE,CAAA"}
+{"version":3,"file":"getAuthFields.d.ts","sourceRoot":"","sources":["../../src/auth/getAuthFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAUlD,eAAO,MAAM,iBAAiB,eAAgB,gBAAgB,WAAU,KAAK,EAAE,KAAQ,KAAK,EA0D3F,CAAA"}

package/dist/auth/getAuthFields.js

@@ -1,14 +1,14 @@
 import { accountLockFields } from './baseFields/accountLock.js';
-import { apiKeyFields } from './baseFields/apiKey.js';
-import { baseAuthFields } from './baseFields/auth.js';
+import { getAPIKeyFields } from './baseFields/apiKey/index.js';
+import { baseAuthFields, resetPasswordRequestedAtField } from './baseFields/auth.js';
 import { emailFieldConfig } from './baseFields/email.js';
 import { sessionsFieldConfig } from './baseFields/sessions.js';
 import { usernameFieldConfig } from './baseFields/username.js';
 import { verificationFields } from './baseFields/verification.js';
-export const getBaseAuthFields = (authConfig)=>{
+export const getBaseAuthFields = (authConfig, fields = [])=>{
     const authFields = [];
     if (authConfig.useAPIKey) {
-        authFields.push(...apiKeyFields);
+        authFields.push(...getAPIKeyFields(fields));
     }
     if (!authConfig.disableLocalStrategy || typeof authConfig.disableLocalStrategy === 'object' && authConfig.disableLocalStrategy.enableFields) {
         const emailField = {
@@ -36,6 +36,9 @@ export const getBaseAuthFields = (authConfig)=>{
             authFields.push(usernameField);
         }
         authFields.push(...baseAuthFields);
+        if (authConfig.forgotPassword?.minRequestInterval && authConfig.forgotPassword.minRequestInterval > 0) {
+            authFields.push(resetPasswordRequestedAtField);
+        }
         if (authConfig.verify) {
             authFields.push(...verificationFields);
         }

package/dist/auth/getAuthFields.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getAuthFields.ts"],"sourcesContent":["import type { Field, TextField } from '../fields/config/types.js'\nimport type { IncomingAuthType } from './types.js'\n\nimport { accountLockFields } from './baseFields/accountLock.js'\nimport { apiKeyFields } from './baseFields/apiKey.js'\nimport { baseAuthFields } from './baseFields/auth.js'\nimport { emailFieldConfig } from './baseFields/email.js'\nimport { sessionsFieldConfig } from './baseFields/sessions.js'\nimport { usernameFieldConfig } from './baseFields/username.js'\nimport { verificationFields } from './baseFields/verification.js'\n\nexport const getBaseAuthFields = (authConfig: IncomingAuthType): Field[] => {\n  const authFields: Field[] = []\n\n  if (authConfig.useAPIKey) {\n    authFields.push(...apiKeyFields)\n  }\n\n  if (\n    !authConfig.disableLocalStrategy ||\n    (typeof authConfig.disableLocalStrategy === 'object' &&\n      authConfig.disableLocalStrategy.enableFields)\n  ) {\n    const emailField = { ...emailFieldConfig }\n    let usernameField: TextField | undefined\n\n    if (authConfig.loginWithUsername) {\n      usernameField = { ...usernameFieldConfig }\n      if (typeof authConfig.loginWithUsername === 'object') {\n        if (authConfig.loginWithUsername.requireEmail === false) {\n          emailField.required = false\n        }\n        if (authConfig.loginWithUsername.requireUsername === false) {\n          usernameField.required = false\n        }\n        if (authConfig.loginWithUsername.allowEmailLogin === false) {\n          emailField.unique = false\n        }\n      }\n    }\n\n    authFields.push(emailField)\n    if (usernameField) {\n      authFields.push(usernameField)\n    }\n\n    authFields.push(...baseAuthFields)\n\n    if (authConfig.verify) {\n      authFields.push(...verificationFields)\n    }\n\n    if (authConfig?.maxLoginAttempts && authConfig.maxLoginAttempts > 0) {\n      authFields.push(...accountLockFields)\n    }\n\n    if (authConfig.useSessions) {\n      authFields.push(sessionsFieldConfig)\n    }\n  }\n\n  return authFields\n}\n"],"names":["accountLockFields","apiKeyFields","baseAuthFields","emailFieldConfig","sessionsFieldConfig","usernameFieldConfig","verificationFields","getBaseAuthFields","authConfig","authFields","useAPIKey","push","disableLocalStrategy","enableFields","emailField","usernameField","loginWithUsername","requireEmail","required","requireUsername","allowEmailLogin","unique","verify","maxLoginAttempts","useSessions"],"mappings":"AAGA,SAASA,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,YAAY,QAAQ,yBAAwB;AACrD,SAASC,cAAc,QAAQ,uBAAsB;AACrD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,+BAA8B;AAEjE,OAAO,MAAMC,oBAAoB,CAACC;IAChC,MAAMC,aAAsB,EAAE;IAE9B,IAAID,WAAWE,SAAS,EAAE;QACxBD,WAAWE,IAAI,IAAIV;IACrB;IAEA,IACE,CAACO,WAAWI,oBAAoB,IAC/B,OAAOJ,WAAWI,oBAAoB,KAAK,YAC1CJ,WAAWI,oBAAoB,CAACC,YAAY,EAC9C;QACA,MAAMC,aAAa;YAAE,GAAGX,gBAAgB;QAAC;QACzC,IAAIY;QAEJ,IAAIP,WAAWQ,iBAAiB,EAAE;YAChCD,gBAAgB;gBAAE,GAAGV,mBAAmB;YAAC;YACzC,IAAI,OAAOG,WAAWQ,iBAAiB,KAAK,UAAU;gBACpD,IAAIR,WAAWQ,iBAAiB,CAACC,YAAY,KAAK,OAAO;oBACvDH,WAAWI,QAAQ,GAAG;gBACxB;gBACA,IAAIV,WAAWQ,iBAAiB,CAACG,eAAe,KAAK,OAAO;oBAC1DJ,cAAcG,QAAQ,GAAG;gBAC3B;gBACA,IAAIV,WAAWQ,iBAAiB,CAACI,eAAe,KAAK,OAAO;oBAC1DN,WAAWO,MAAM,GAAG;gBACtB;YACF;QACF;QAEAZ,WAAWE,IAAI,CAACG;QAChB,IAAIC,eAAe;YACjBN,WAAWE,IAAI,CAACI;QAClB;QAEAN,WAAWE,IAAI,IAAIT;QAEnB,IAAIM,WAAWc,MAAM,EAAE;YACrBb,WAAWE,IAAI,IAAIL;QACrB;QAEA,IAAIE,YAAYe,oBAAoBf,WAAWe,gBAAgB,GAAG,GAAG;YACnEd,WAAWE,IAAI,IAAIX;QACrB;QAEA,IAAIQ,WAAWgB,WAAW,EAAE;YAC1Bf,WAAWE,IAAI,CAACP;QAClB;IACF;IAEA,OAAOK;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/getAuthFields.ts"],"sourcesContent":["import type { Field, TextField } from '../fields/config/types.js'\nimport type { IncomingAuthType } from './types.js'\n\nimport { accountLockFields } from './baseFields/accountLock.js'\nimport { getAPIKeyFields } from './baseFields/apiKey/index.js'\nimport { baseAuthFields, resetPasswordRequestedAtField } from './baseFields/auth.js'\nimport { emailFieldConfig } from './baseFields/email.js'\nimport { sessionsFieldConfig } from './baseFields/sessions.js'\nimport { usernameFieldConfig } from './baseFields/username.js'\nimport { verificationFields } from './baseFields/verification.js'\n\nexport const getBaseAuthFields = (authConfig: IncomingAuthType, fields: Field[] = []): Field[] => {\n  const authFields: Field[] = []\n\n  if (authConfig.useAPIKey) {\n    authFields.push(...getAPIKeyFields(fields))\n  }\n\n  if (\n    !authConfig.disableLocalStrategy ||\n    (typeof authConfig.disableLocalStrategy === 'object' &&\n      authConfig.disableLocalStrategy.enableFields)\n  ) {\n    const emailField = { ...emailFieldConfig }\n    let usernameField: TextField | undefined\n\n    if (authConfig.loginWithUsername) {\n      usernameField = { ...usernameFieldConfig }\n      if (typeof authConfig.loginWithUsername === 'object') {\n        if (authConfig.loginWithUsername.requireEmail === false) {\n          emailField.required = false\n        }\n        if (authConfig.loginWithUsername.requireUsername === false) {\n          usernameField.required = false\n        }\n        if (authConfig.loginWithUsername.allowEmailLogin === false) {\n          emailField.unique = false\n        }\n      }\n    }\n\n    authFields.push(emailField)\n    if (usernameField) {\n      authFields.push(usernameField)\n    }\n\n    authFields.push(...baseAuthFields)\n\n    if (\n      authConfig.forgotPassword?.minRequestInterval &&\n      authConfig.forgotPassword.minRequestInterval > 0\n    ) {\n      authFields.push(resetPasswordRequestedAtField)\n    }\n\n    if (authConfig.verify) {\n      authFields.push(...verificationFields)\n    }\n\n    if (authConfig?.maxLoginAttempts && authConfig.maxLoginAttempts > 0) {\n      authFields.push(...accountLockFields)\n    }\n\n    if (authConfig.useSessions) {\n      authFields.push(sessionsFieldConfig)\n    }\n  }\n\n  return authFields\n}\n"],"names":["accountLockFields","getAPIKeyFields","baseAuthFields","resetPasswordRequestedAtField","emailFieldConfig","sessionsFieldConfig","usernameFieldConfig","verificationFields","getBaseAuthFields","authConfig","fields","authFields","useAPIKey","push","disableLocalStrategy","enableFields","emailField","usernameField","loginWithUsername","requireEmail","required","requireUsername","allowEmailLogin","unique","forgotPassword","minRequestInterval","verify","maxLoginAttempts","useSessions"],"mappings":"AAGA,SAASA,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,eAAe,QAAQ,+BAA8B;AAC9D,SAASC,cAAc,EAAEC,6BAA6B,QAAQ,uBAAsB;AACpF,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,+BAA8B;AAEjE,OAAO,MAAMC,oBAAoB,CAACC,YAA8BC,SAAkB,EAAE;IAClF,MAAMC,aAAsB,EAAE;IAE9B,IAAIF,WAAWG,SAAS,EAAE;QACxBD,WAAWE,IAAI,IAAIZ,gBAAgBS;IACrC;IAEA,IACE,CAACD,WAAWK,oBAAoB,IAC/B,OAAOL,WAAWK,oBAAoB,KAAK,YAC1CL,WAAWK,oBAAoB,CAACC,YAAY,EAC9C;QACA,MAAMC,aAAa;YAAE,GAAGZ,gBAAgB;QAAC;QACzC,IAAIa;QAEJ,IAAIR,WAAWS,iBAAiB,EAAE;YAChCD,gBAAgB;gBAAE,GAAGX,mBAAmB;YAAC;YACzC,IAAI,OAAOG,WAAWS,iBAAiB,KAAK,UAAU;gBACpD,IAAIT,WAAWS,iBAAiB,CAACC,YAAY,KAAK,OAAO;oBACvDH,WAAWI,QAAQ,GAAG;gBACxB;gBACA,IAAIX,WAAWS,iBAAiB,CAACG,eAAe,KAAK,OAAO;oBAC1DJ,cAAcG,QAAQ,GAAG;gBAC3B;gBACA,IAAIX,WAAWS,iBAAiB,CAACI,eAAe,KAAK,OAAO;oBAC1DN,WAAWO,MAAM,GAAG;gBACtB;YACF;QACF;QAEAZ,WAAWE,IAAI,CAACG;QAChB,IAAIC,eAAe;YACjBN,WAAWE,IAAI,CAACI;QAClB;QAEAN,WAAWE,IAAI,IAAIX;QAEnB,IACEO,WAAWe,cAAc,EAAEC,sBAC3BhB,WAAWe,cAAc,CAACC,kBAAkB,GAAG,GAC/C;YACAd,WAAWE,IAAI,CAACV;QAClB;QAEA,IAAIM,WAAWiB,MAAM,EAAE;YACrBf,WAAWE,IAAI,IAAIN;QACrB;QAEA,IAAIE,YAAYkB,oBAAoBlB,WAAWkB,gBAAgB,GAAG,GAAG;YACnEhB,WAAWE,IAAI,IAAIb;QACrB;QAEA,IAAIS,WAAWmB,WAAW,EAAE;YAC1BjB,WAAWE,IAAI,CAACR;QAClB;IACF;IAEA,OAAOM;AACT,EAAC"}

package/dist/auth/getFieldsToSign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAiHvD,eAAO,MAAM,eAAe,SAAU;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoBzB,CAAA"}
+{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAiHvD,eAAO,MAAM,eAAe,SAAU;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAyBzB,CAAA"}

package/dist/auth/getFieldsToSign.js

@@ -99,20 +99,27 @@ fields, result })=>{
 };
 export const getFieldsToSign = (args)=>{
     const { collectionConfig, email, sid, user } = args;
-    const result = {
-        id: user?.id,
-        collection: collectionConfig.slug,
-        email
-    };
-    if (sid) {
-        result.sid = sid;
-    }
+    const fieldsToSign = Object.create(null);
     traverseFields({
         data: user,
         fields: collectionConfig.fields,
-        result
+        result: fieldsToSign
     });
-    return result;
+    delete fieldsToSign.collection;
+    delete fieldsToSign.email;
+    delete fieldsToSign.exp;
+    delete fieldsToSign.iat;
+    delete fieldsToSign.id;
+    delete fieldsToSign.sid;
+    return {
+        ...fieldsToSign,
+        id: user?.id,
+        collection: collectionConfig.slug,
+        email,
+        ...sid ? {
+            sid
+        } : {}
+    };
 };
 
 //# sourceMappingURL=getFieldsToSign.js.map

package/dist/auth/getFieldsToSign.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getFieldsToSign.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { Field, TabAsField } from '../fields/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldAffectsData, tabHasName } from '../fields/config/types.js'\n\ntype TraverseFieldsArgs = {\n  data: Record<string, unknown>\n  fields: (Field | TabAsField)[]\n  result: Record<string, unknown>\n}\nconst traverseFields = ({\n  data,\n  // parent,\n  fields,\n  result,\n}: TraverseFieldsArgs) => {\n  fields.forEach((field) => {\n    switch (field.type) {\n      case 'collapsible':\n      case 'row': {\n        traverseFields({\n          data,\n          fields: field.fields,\n          result,\n        })\n        break\n      }\n      case 'group': {\n        if (fieldAffectsData(field)) {\n          const groupData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = groupData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = groupData\n          }\n          const groupResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: groupData,\n            fields: field.fields,\n            result: groupResult,\n          })\n          break\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n\n          break\n        }\n      }\n      case 'tab': {\n        if (tabHasName(field)) {\n          const tabData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = tabData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = tabData\n          }\n          const tabResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: tabData,\n            fields: field.fields,\n            result: tabResult,\n          })\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n        }\n        break\n      }\n      case 'tabs': {\n        traverseFields({\n          data,\n          fields: field.tabs.map((tab) => ({ ...tab, type: 'tab' })),\n          result,\n        })\n        break\n      }\n      default:\n        if (fieldAffectsData(field)) {\n          if (field.saveToJWT) {\n            if (typeof field.saveToJWT === 'string') {\n              result[field.saveToJWT] = data[field.name]\n              delete result[field.name]\n            } else {\n              result[field.name] = data[field.name] as Record<string, unknown>\n            }\n          } else if (field.saveToJWT === false) {\n            delete result[field.name]\n          }\n        }\n    }\n  })\n  return result\n}\nexport const getFieldsToSign = (args: {\n  collectionConfig: CollectionConfig\n  email: string\n  sid?: string\n  user: PayloadRequest['user']\n}): Record<string, unknown> => {\n  const { collectionConfig, email, sid, user } = args\n\n  const result: Record<string, unknown> = {\n    id: user?.id,\n    collection: collectionConfig.slug,\n    email,\n  }\n\n  if (sid) {\n    result.sid = sid\n  }\n\n  traverseFields({\n    data: user!,\n    fields: collectionConfig.fields,\n    result,\n  })\n\n  return result\n}\n"],"names":["fieldAffectsData","tabHasName","traverseFields","data","fields","result","forEach","field","type","groupData","name","targetResult","saveToJWT","groupResult","tabData","tabResult","tabs","map","tab","getFieldsToSign","args","collectionConfig","email","sid","user","id","collection","slug"],"mappings":"AAIA,SAASA,gBAAgB,EAAEC,UAAU,QAAQ,4BAA2B;AAOxE,MAAMC,iBAAiB,CAAC,EACtBC,IAAI,EACJ,UAAU;AACVC,MAAM,EACNC,MAAM,EACa;IACnBD,OAAOE,OAAO,CAAC,CAACC;QACd,OAAQA,MAAMC,IAAI;YAChB,KAAK;YACL,KAAK;gBAAO;oBACVN,eAAe;wBACbC;wBACAC,QAAQG,MAAMH,MAAM;wBACpBC;oBACF;oBACA;gBACF;YACA,KAAK;gBAAS;oBACZ,IAAIL,iBAAiBO,QAAQ;wBAC3B,MAAME,YACJ,AAACN,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGH;wBAC5B,OAAO,IAAIF,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGD;wBACvB;wBACA,MAAMI,cAAeF,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAI3DH,eAAe;4BACbC,MAAMM;4BACNL,QAAQG,MAAMH,MAAM;4BACpBC,QAAQQ;wBACV;wBACA;oBACF,OAAO;wBACLX,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;wBAEA;oBACF;gBACF;YACA,KAAK;gBAAO;oBACV,IAAIJ,WAAWM,QAAQ;wBACrB,MAAMO,UACJ,AAACX,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGE;wBAC5B,OAAO,IAAIP,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGI;wBACvB;wBACA,MAAMC,YAAaJ,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAIzDH,eAAe;4BACbC,MAAMW;4BACNV,QAAQG,MAAMH,MAAM;4BACpBC,QAAQU;wBACV;oBACF,OAAO;wBACLb,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;oBACF;oBACA;gBACF;YACA,KAAK;gBAAQ;oBACXH,eAAe;wBACbC;wBACAC,QAAQG,MAAMS,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gCAAE,GAAGA,GAAG;gCAAEV,MAAM;4BAAM,CAAA;wBACvDH;oBACF;oBACA;gBACF;YACA;gBACE,IAAIL,iBAAiBO,QAAQ;oBAC3B,IAAIA,MAAMK,SAAS,EAAE;wBACnB,IAAI,OAAOL,MAAMK,SAAS,KAAK,UAAU;4BACvCP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGT,IAAI,CAACI,MAAMG,IAAI,CAAC;4BAC1C,OAAOL,MAAM,CAACE,MAAMG,IAAI,CAAC;wBAC3B,OAAO;4BACLL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGP,IAAI,CAACI,MAAMG,IAAI,CAAC;wBACvC;oBACF,OAAO,IAAIH,MAAMK,SAAS,KAAK,OAAO;wBACpC,OAAOP,MAAM,CAACE,MAAMG,IAAI,CAAC;oBAC3B;gBACF;QACJ;IACF;IACA,OAAOL;AACT;AACA,OAAO,MAAMc,kBAAkB,CAACC;IAM9B,MAAM,EAAEC,gBAAgB,EAAEC,KAAK,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGJ;IAE/C,MAAMf,SAAkC;QACtCoB,IAAID,MAAMC;QACVC,YAAYL,iBAAiBM,IAAI;QACjCL;IACF;IAEA,IAAIC,KAAK;QACPlB,OAAOkB,GAAG,GAAGA;IACf;IAEArB,eAAe;QACbC,MAAMqB;QACNpB,QAAQiB,iBAAiBjB,MAAM;QAC/BC;IACF;IAEA,OAAOA;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/getFieldsToSign.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { Field, TabAsField } from '../fields/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldAffectsData, tabHasName } from '../fields/config/types.js'\n\ntype TraverseFieldsArgs = {\n  data: Record<string, unknown>\n  fields: (Field | TabAsField)[]\n  result: Record<string, unknown>\n}\nconst traverseFields = ({\n  data,\n  // parent,\n  fields,\n  result,\n}: TraverseFieldsArgs) => {\n  fields.forEach((field) => {\n    switch (field.type) {\n      case 'collapsible':\n      case 'row': {\n        traverseFields({\n          data,\n          fields: field.fields,\n          result,\n        })\n        break\n      }\n      case 'group': {\n        if (fieldAffectsData(field)) {\n          const groupData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = groupData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = groupData\n          }\n          const groupResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: groupData,\n            fields: field.fields,\n            result: groupResult,\n          })\n          break\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n\n          break\n        }\n      }\n      case 'tab': {\n        if (tabHasName(field)) {\n          const tabData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = tabData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = tabData\n          }\n          const tabResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: tabData,\n            fields: field.fields,\n            result: tabResult,\n          })\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n        }\n        break\n      }\n      case 'tabs': {\n        traverseFields({\n          data,\n          fields: field.tabs.map((tab) => ({ ...tab, type: 'tab' })),\n          result,\n        })\n        break\n      }\n      default:\n        if (fieldAffectsData(field)) {\n          if (field.saveToJWT) {\n            if (typeof field.saveToJWT === 'string') {\n              result[field.saveToJWT] = data[field.name]\n              delete result[field.name]\n            } else {\n              result[field.name] = data[field.name] as Record<string, unknown>\n            }\n          } else if (field.saveToJWT === false) {\n            delete result[field.name]\n          }\n        }\n    }\n  })\n  return result\n}\nexport const getFieldsToSign = (args: {\n  collectionConfig: CollectionConfig\n  email: string\n  sid?: string\n  user: PayloadRequest['user']\n}): Record<string, unknown> => {\n  const { collectionConfig, email, sid, user } = args\n\n  const fieldsToSign = Object.create(null) as Record<string, unknown>\n\n  traverseFields({\n    data: user!,\n    fields: collectionConfig.fields,\n    result: fieldsToSign,\n  })\n\n  delete fieldsToSign.collection\n  delete fieldsToSign.email\n  delete fieldsToSign.exp\n  delete fieldsToSign.iat\n  delete fieldsToSign.id\n  delete fieldsToSign.sid\n\n  return {\n    ...fieldsToSign,\n    id: user?.id,\n    collection: collectionConfig.slug,\n    email,\n    ...(sid ? { sid } : {}),\n  }\n}\n"],"names":["fieldAffectsData","tabHasName","traverseFields","data","fields","result","forEach","field","type","groupData","name","targetResult","saveToJWT","groupResult","tabData","tabResult","tabs","map","tab","getFieldsToSign","args","collectionConfig","email","sid","user","fieldsToSign","Object","create","collection","exp","iat","id","slug"],"mappings":"AAIA,SAASA,gBAAgB,EAAEC,UAAU,QAAQ,4BAA2B;AAOxE,MAAMC,iBAAiB,CAAC,EACtBC,IAAI,EACJ,UAAU;AACVC,MAAM,EACNC,MAAM,EACa;IACnBD,OAAOE,OAAO,CAAC,CAACC;QACd,OAAQA,MAAMC,IAAI;YAChB,KAAK;YACL,KAAK;gBAAO;oBACVN,eAAe;wBACbC;wBACAC,QAAQG,MAAMH,MAAM;wBACpBC;oBACF;oBACA;gBACF;YACA,KAAK;gBAAS;oBACZ,IAAIL,iBAAiBO,QAAQ;wBAC3B,MAAME,YACJ,AAACN,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGH;wBAC5B,OAAO,IAAIF,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGD;wBACvB;wBACA,MAAMI,cAAeF,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAI3DH,eAAe;4BACbC,MAAMM;4BACNL,QAAQG,MAAMH,MAAM;4BACpBC,QAAQQ;wBACV;wBACA;oBACF,OAAO;wBACLX,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;wBAEA;oBACF;gBACF;YACA,KAAK;gBAAO;oBACV,IAAIJ,WAAWM,QAAQ;wBACrB,MAAMO,UACJ,AAACX,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGE;wBAC5B,OAAO,IAAIP,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGI;wBACvB;wBACA,MAAMC,YAAaJ,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAIzDH,eAAe;4BACbC,MAAMW;4BACNV,QAAQG,MAAMH,MAAM;4BACpBC,QAAQU;wBACV;oBACF,OAAO;wBACLb,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;oBACF;oBACA;gBACF;YACA,KAAK;gBAAQ;oBACXH,eAAe;wBACbC;wBACAC,QAAQG,MAAMS,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gCAAE,GAAGA,GAAG;gCAAEV,MAAM;4BAAM,CAAA;wBACvDH;oBACF;oBACA;gBACF;YACA;gBACE,IAAIL,iBAAiBO,QAAQ;oBAC3B,IAAIA,MAAMK,SAAS,EAAE;wBACnB,IAAI,OAAOL,MAAMK,SAAS,KAAK,UAAU;4BACvCP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGT,IAAI,CAACI,MAAMG,IAAI,CAAC;4BAC1C,OAAOL,MAAM,CAACE,MAAMG,IAAI,CAAC;wBAC3B,OAAO;4BACLL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGP,IAAI,CAACI,MAAMG,IAAI,CAAC;wBACvC;oBACF,OAAO,IAAIH,MAAMK,SAAS,KAAK,OAAO;wBACpC,OAAOP,MAAM,CAACE,MAAMG,IAAI,CAAC;oBAC3B;gBACF;QACJ;IACF;IACA,OAAOL;AACT;AACA,OAAO,MAAMc,kBAAkB,CAACC;IAM9B,MAAM,EAAEC,gBAAgB,EAAEC,KAAK,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGJ;IAE/C,MAAMK,eAAeC,OAAOC,MAAM,CAAC;IAEnCzB,eAAe;QACbC,MAAMqB;QACNpB,QAAQiB,iBAAiBjB,MAAM;QAC/BC,QAAQoB;IACV;IAEA,OAAOA,aAAaG,UAAU;IAC9B,OAAOH,aAAaH,KAAK;IACzB,OAAOG,aAAaI,GAAG;IACvB,OAAOJ,aAAaK,GAAG;IACvB,OAAOL,aAAaM,EAAE;IACtB,OAAON,aAAaF,GAAG;IAEvB,OAAO;QACL,GAAGE,YAAY;QACfM,IAAIP,MAAMO;QACVH,YAAYP,iBAAiBW,IAAI;QACjCV;QACA,GAAIC,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;AACF,EAAC"}

package/dist/auth/getFieldsToSign.spec.js

@@ -0,0 +1,114 @@
+import { describe, expect, it } from 'vitest';
+import { getFieldsToSign } from './getFieldsToSign.js';
+describe('getFieldsToSign', ()=>{
+    it('should prevent fields configured with saveToJWT from replacing Payload-owned JWT values', ()=>{
+        const collectionConfig = {
+            fields: [
+                {
+                    name: 'impersonatedID',
+                    saveToJWT: 'id',
+                    type: 'text'
+                },
+                {
+                    name: 'impersonatedCollection',
+                    saveToJWT: 'collection',
+                    type: 'text'
+                },
+                {
+                    name: 'impersonatedEmail',
+                    saveToJWT: 'email',
+                    type: 'text'
+                },
+                {
+                    name: 'impersonatedSession',
+                    saveToJWT: 'sid',
+                    type: 'text'
+                },
+                {
+                    name: 'forgedIssuedAt',
+                    saveToJWT: 'iat',
+                    type: 'number'
+                },
+                {
+                    name: 'forgedExpiration',
+                    saveToJWT: 'exp',
+                    type: 'number'
+                },
+                {
+                    name: 'authVersionAlias',
+                    saveToJWT: 'authVersion',
+                    type: 'number'
+                },
+                {
+                    name: 'role',
+                    saveToJWT: true,
+                    type: 'text'
+                }
+            ],
+            slug: 'users'
+        };
+        const result = getFieldsToSign({
+            collectionConfig,
+            email: 'attacker@example.com',
+            sid: 'trusted-session',
+            user: {
+                forgedExpiration: 1,
+                forgedIssuedAt: 1,
+                id: 'attacker-id',
+                impersonatedCollection: 'posts',
+                impersonatedEmail: 'victim@example.com',
+                impersonatedID: 'victim-id',
+                impersonatedSession: 'victim-session',
+                authVersionAlias: 1,
+                role: 'admin'
+            }
+        });
+        expect(result).toEqual({
+            collection: 'users',
+            email: 'attacker@example.com',
+            id: 'attacker-id',
+            authVersion: 1,
+            role: 'admin',
+            sid: 'trusted-session'
+        });
+    });
+    it('should retain __proto__ and constructor aliases without mutating the result prototype', ()=>{
+        const collectionConfig = {
+            fields: [
+                {
+                    name: 'prototypeAlias',
+                    saveToJWT: '__proto__',
+                    type: 'text'
+                },
+                {
+                    name: 'constructorAlias',
+                    saveToJWT: 'constructor',
+                    type: 'text'
+                }
+            ],
+            slug: 'users'
+        };
+        const result = getFieldsToSign({
+            collectionConfig,
+            email: 'user@example.com',
+            user: {
+                constructorAlias: 'custom-constructor',
+                id: 'user-id',
+                prototypeAlias: 'custom-prototype'
+            }
+        });
+        const roundTrippedResult = JSON.parse(JSON.stringify(result));
+        expect(Object.getPrototypeOf(result)).toBe(Object.prototype);
+        expect(Object.hasOwn(result, '__proto__')).toBe(true);
+        expect(Object.hasOwn(result, 'constructor')).toBe(true);
+        expect(result.__proto__).toBe('custom-prototype');
+        expect(result.constructor).toBe('custom-constructor');
+        expect(Object.getPrototypeOf(roundTrippedResult)).toBe(Object.prototype);
+        expect(Object.hasOwn(roundTrippedResult, '__proto__')).toBe(true);
+        expect(Object.hasOwn(roundTrippedResult, 'constructor')).toBe(true);
+        expect(roundTrippedResult.__proto__).toBe('custom-prototype');
+        expect(roundTrippedResult.constructor).toBe('custom-constructor');
+    });
+});
+
+//# sourceMappingURL=getFieldsToSign.spec.js.map

package/dist/auth/getFieldsToSign.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/getFieldsToSign.spec.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { getFieldsToSign } from './getFieldsToSign.js'\n\ndescribe('getFieldsToSign', () => {\n  it('should prevent fields configured with saveToJWT from replacing Payload-owned JWT values', () => {\n    const collectionConfig = {\n      fields: [\n        {\n          name: 'impersonatedID',\n          saveToJWT: 'id',\n          type: 'text',\n        },\n        {\n          name: 'impersonatedCollection',\n          saveToJWT: 'collection',\n          type: 'text',\n        },\n        {\n          name: 'impersonatedEmail',\n          saveToJWT: 'email',\n          type: 'text',\n        },\n        {\n          name: 'impersonatedSession',\n          saveToJWT: 'sid',\n          type: 'text',\n        },\n        {\n          name: 'forgedIssuedAt',\n          saveToJWT: 'iat',\n          type: 'number',\n        },\n        {\n          name: 'forgedExpiration',\n          saveToJWT: 'exp',\n          type: 'number',\n        },\n        {\n          name: 'authVersionAlias',\n          saveToJWT: 'authVersion',\n          type: 'number',\n        },\n        {\n          name: 'role',\n          saveToJWT: true,\n          type: 'text',\n        },\n      ],\n      slug: 'users',\n    } as CollectionConfig\n\n    const result = getFieldsToSign({\n      collectionConfig,\n      email: 'attacker@example.com',\n      sid: 'trusted-session',\n      user: {\n        forgedExpiration: 1,\n        forgedIssuedAt: 1,\n        id: 'attacker-id',\n        impersonatedCollection: 'posts',\n        impersonatedEmail: 'victim@example.com',\n        impersonatedID: 'victim-id',\n        impersonatedSession: 'victim-session',\n        authVersionAlias: 1,\n        role: 'admin',\n      } as PayloadRequest['user'],\n    })\n\n    expect(result).toEqual({\n      collection: 'users',\n      email: 'attacker@example.com',\n      id: 'attacker-id',\n      authVersion: 1,\n      role: 'admin',\n      sid: 'trusted-session',\n    })\n  })\n\n  it('should retain __proto__ and constructor aliases without mutating the result prototype', () => {\n    const collectionConfig = {\n      fields: [\n        {\n          name: 'prototypeAlias',\n          saveToJWT: '__proto__',\n          type: 'text',\n        },\n        {\n          name: 'constructorAlias',\n          saveToJWT: 'constructor',\n          type: 'text',\n        },\n      ],\n      slug: 'users',\n    } as CollectionConfig\n\n    const result = getFieldsToSign({\n      collectionConfig,\n      email: 'user@example.com',\n      user: {\n        constructorAlias: 'custom-constructor',\n        id: 'user-id',\n        prototypeAlias: 'custom-prototype',\n      } as PayloadRequest['user'],\n    })\n    const roundTrippedResult = JSON.parse(JSON.stringify(result)) as Record<string, unknown>\n\n    expect(Object.getPrototypeOf(result)).toBe(Object.prototype)\n    expect(Object.hasOwn(result, '__proto__')).toBe(true)\n    expect(Object.hasOwn(result, 'constructor')).toBe(true)\n    expect(result.__proto__).toBe('custom-prototype')\n    expect(result.constructor).toBe('custom-constructor')\n    expect(Object.getPrototypeOf(roundTrippedResult)).toBe(Object.prototype)\n    expect(Object.hasOwn(roundTrippedResult, '__proto__')).toBe(true)\n    expect(Object.hasOwn(roundTrippedResult, 'constructor')).toBe(true)\n    expect(roundTrippedResult.__proto__).toBe('custom-prototype')\n    expect(roundTrippedResult.constructor).toBe('custom-constructor')\n  })\n})\n"],"names":["describe","expect","it","getFieldsToSign","collectionConfig","fields","name","saveToJWT","type","slug","result","email","sid","user","forgedExpiration","forgedIssuedAt","id","impersonatedCollection","impersonatedEmail","impersonatedID","impersonatedSession","authVersionAlias","role","toEqual","collection","authVersion","constructorAlias","prototypeAlias","roundTrippedResult","JSON","parse","stringify","Object","getPrototypeOf","toBe","prototype","hasOwn","__proto__"],"mappings":"AAGA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,eAAe,QAAQ,uBAAsB;AAEtDH,SAAS,mBAAmB;IAC1BE,GAAG,2FAA2F;QAC5F,MAAME,mBAAmB;YACvBC,QAAQ;gBACN;oBACEC,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;aACD;YACDC,MAAM;QACR;QAEA,MAAMC,SAASP,gBAAgB;YAC7BC;YACAO,OAAO;YACPC,KAAK;YACLC,MAAM;gBACJC,kBAAkB;gBAClBC,gBAAgB;gBAChBC,IAAI;gBACJC,wBAAwB;gBACxBC,mBAAmB;gBACnBC,gBAAgB;gBAChBC,qBAAqB;gBACrBC,kBAAkB;gBAClBC,MAAM;YACR;QACF;QAEArB,OAAOS,QAAQa,OAAO,CAAC;YACrBC,YAAY;YACZb,OAAO;YACPK,IAAI;YACJS,aAAa;YACbH,MAAM;YACNV,KAAK;QACP;IACF;IAEAV,GAAG,yFAAyF;QAC1F,MAAME,mBAAmB;YACvBC,QAAQ;gBACN;oBACEC,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;gBACA;oBACEF,MAAM;oBACNC,WAAW;oBACXC,MAAM;gBACR;aACD;YACDC,MAAM;QACR;QAEA,MAAMC,SAASP,gBAAgB;YAC7BC;YACAO,OAAO;YACPE,MAAM;gBACJa,kBAAkB;gBAClBV,IAAI;gBACJW,gBAAgB;YAClB;QACF;QACA,MAAMC,qBAAqBC,KAAKC,KAAK,CAACD,KAAKE,SAAS,CAACrB;QAErDT,OAAO+B,OAAOC,cAAc,CAACvB,SAASwB,IAAI,CAACF,OAAOG,SAAS;QAC3DlC,OAAO+B,OAAOI,MAAM,CAAC1B,QAAQ,cAAcwB,IAAI,CAAC;QAChDjC,OAAO+B,OAAOI,MAAM,CAAC1B,QAAQ,gBAAgBwB,IAAI,CAAC;QAClDjC,OAAOS,OAAO2B,SAAS,EAAEH,IAAI,CAAC;QAC9BjC,OAAOS,OAAO,WAAW,EAAEwB,IAAI,CAAC;QAChCjC,OAAO+B,OAAOC,cAAc,CAACL,qBAAqBM,IAAI,CAACF,OAAOG,SAAS;QACvElC,OAAO+B,OAAOI,MAAM,CAACR,oBAAoB,cAAcM,IAAI,CAAC;QAC5DjC,OAAO+B,OAAOI,MAAM,CAACR,oBAAoB,gBAAgBM,IAAI,CAAC;QAC9DjC,OAAO2B,mBAAmBS,SAAS,EAAEH,IAAI,CAAC;QAC1CjC,OAAO2B,mBAAmB,WAAW,EAAEM,IAAI,CAAC;IAC9C;AACF"}

package/dist/auth/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,+CAIjB;IACD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;;;EAUA,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,OAAO,+CAIjB;IACD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;;;EAUA,CAAA"}

package/dist/auth/jwt.js

@@ -1,10 +1,12 @@
 import { SignJWT } from 'jose';
+import { JWT_AUTH_VERSION } from './jwtAuth.js';
 export const jwtSign = async ({ fieldsToSign, secret, tokenExpiration })=>{
     const secretKey = new TextEncoder().encode(secret);
     const issuedAt = Math.floor(Date.now() / 1000);
     const exp = issuedAt + tokenExpiration;
     const token = await new SignJWT(fieldsToSign).setProtectedHeader({
         alg: 'HS256',
+        authVersion: JWT_AUTH_VERSION,
         typ: 'JWT'
     }).setIssuedAt(issuedAt).setExpirationTime(exp).sign(secretKey);
     return {