payload 3.91.0-internal.c1569dc → 4.0.0-beta.0

package/dist/auth/baseFields/apiKey.js

@@ -0,0 +1,101 @@
+import { fieldAffectsData } from '../../fields/config/types.js';
+import { canCreateOrUpdateAPIKey } from './apiKey/canCreateOrUpdateAPIKey.js';
+import { encryptAPIKey } from './apiKey/encryptAPIKey.js';
+import { omitAPIKeyIndex } from './apiKey/omitAPIKeyIndex.js';
+import { omitEncryptedAPIKey } from './apiKey/omitEncryptedAPIKey.js';
+import { setAPIKeyIndex } from './apiKey/setAPIKeyIndex.js';
+import { setKeyLast4 } from './apiKey/setKeyLast4.js';
+export { omitAPIKey } from './apiKey/omitAPIKey.js';
+export const createAPIKeyFields = ({ apiKeyField, apiKeyIndexField, apiKeyLast4Field } = {})=>{
+    const customAccess = apiKeyField?.access;
+    return [
+        {
+            name: 'apiKey',
+            type: 'text',
+            ...apiKeyField,
+            access: {
+                create: canCreateOrUpdateAPIKey,
+                ...apiKeyField?.access,
+                read: ()=>false,
+                update: apiKeyField?.access?.update ?? canCreateOrUpdateAPIKey
+            },
+            admin: {
+                components: {
+                    Field: false
+                },
+                ...apiKeyField?.admin
+            },
+            hooks: {
+                ...apiKeyField?.hooks,
+                afterRead: [
+                    omitEncryptedAPIKey,
+                    ...apiKeyField?.hooks?.afterRead ?? []
+                ],
+                beforeChange: [
+                    encryptAPIKey,
+                    ...apiKeyField?.hooks?.beforeChange ?? []
+                ]
+            },
+            label: apiKeyField?.label ?? (({ t })=>t('authentication:apiKey'))
+        },
+        {
+            name: 'apiKeyLast4',
+            type: 'text',
+            ...apiKeyLast4Field,
+            access: {
+                ...apiKeyLast4Field?.access,
+                create: customAccess?.create ?? canCreateOrUpdateAPIKey,
+                read: customAccess?.update ?? canCreateOrUpdateAPIKey,
+                update: customAccess?.update ?? canCreateOrUpdateAPIKey
+            },
+            admin: {
+                components: {
+                    Field: false
+                },
+                ...apiKeyLast4Field?.admin
+            },
+            hooks: {
+                ...apiKeyLast4Field?.hooks,
+                beforeValidate: [
+                    setKeyLast4,
+                    ...apiKeyLast4Field?.hooks?.beforeValidate ?? []
+                ]
+            }
+        },
+        {
+            name: 'apiKeyIndex',
+            type: 'text',
+            ...apiKeyIndexField,
+            access: {
+                ...apiKeyIndexField?.access,
+                create: customAccess?.create ?? canCreateOrUpdateAPIKey,
+                read: ()=>false,
+                update: customAccess?.update ?? canCreateOrUpdateAPIKey
+            },
+            admin: {
+                disabled: true,
+                ...apiKeyIndexField?.admin
+            },
+            hidden: apiKeyIndexField?.hidden ?? true,
+            hooks: {
+                ...apiKeyIndexField?.hooks,
+                afterRead: [
+                    omitAPIKeyIndex,
+                    ...apiKeyIndexField?.hooks?.afterRead ?? []
+                ],
+                beforeValidate: [
+                    setAPIKeyIndex,
+                    ...apiKeyIndexField?.hooks?.beforeValidate ?? []
+                ]
+            }
+        }
+    ];
+};
+/** Builds API key fields and safely merges custom overrides. */ export const getAPIKeyFields = (fields)=>{
+    const customAPIKeyField = fields.find((field)=>fieldAffectsData(field) && field.name === 'apiKey' && field.type === 'text');
+    return createAPIKeyFields({
+        apiKeyField: customAPIKeyField
+    });
+};
+
+//# sourceMappingURL=apiKey.js.map

package/dist/auth/baseFields/apiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/baseFields/apiKey.ts"],"sourcesContent":["import type { Field, TextField } from '../../fields/config/types.js'\n\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { canCreateOrUpdateAPIKey } from './apiKey/canCreateOrUpdateAPIKey.js'\nimport { encryptAPIKey } from './apiKey/encryptAPIKey.js'\nimport { omitAPIKeyIndex } from './apiKey/omitAPIKeyIndex.js'\nimport { omitEncryptedAPIKey } from './apiKey/omitEncryptedAPIKey.js'\nimport { setAPIKeyIndex } from './apiKey/setAPIKeyIndex.js'\nimport { setKeyLast4 } from './apiKey/setKeyLast4.js'\n\nexport { omitAPIKey } from './apiKey/omitAPIKey.js'\n\ntype APIKeyTextFieldOverride = Omit<\n  Partial<TextField>,\n  'hasMany' | 'maxRows' | 'minRows' | 'name' | 'type' | 'validate'\n>\n\nexport const createAPIKeyFields = ({\n  apiKeyField,\n  apiKeyIndexField,\n  apiKeyLast4Field,\n}: {\n  apiKeyField?: APIKeyTextFieldOverride\n  apiKeyIndexField?: APIKeyTextFieldOverride\n  apiKeyLast4Field?: APIKeyTextFieldOverride\n} = {}): Field[] => {\n  const customAccess = apiKeyField?.access\n\n  return [\n    {\n      name: 'apiKey',\n      type: 'text',\n      ...apiKeyField,\n      access: {\n        create: canCreateOrUpdateAPIKey,\n        ...apiKeyField?.access,\n        read: () => false,\n        update: apiKeyField?.access?.update ?? canCreateOrUpdateAPIKey,\n      },\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...apiKeyField?.admin,\n      },\n      hooks: {\n        ...apiKeyField?.hooks,\n        afterRead: [omitEncryptedAPIKey, ...(apiKeyField?.hooks?.afterRead ?? [])],\n        beforeChange: [encryptAPIKey, ...(apiKeyField?.hooks?.beforeChange ?? [])],\n      },\n      label: apiKeyField?.label ?? (({ t }) => t('authentication:apiKey')),\n    },\n    {\n      name: 'apiKeyLast4',\n      type: 'text',\n      ...apiKeyLast4Field,\n      access: {\n        ...apiKeyLast4Field?.access,\n        create: customAccess?.create ?? canCreateOrUpdateAPIKey,\n        read: customAccess?.update ?? canCreateOrUpdateAPIKey,\n        update: customAccess?.update ?? canCreateOrUpdateAPIKey,\n      },\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...apiKeyLast4Field?.admin,\n      },\n      hooks: {\n        ...apiKeyLast4Field?.hooks,\n        beforeValidate: [setKeyLast4, ...(apiKeyLast4Field?.hooks?.beforeValidate ?? [])],\n      },\n    },\n    {\n      name: 'apiKeyIndex',\n      type: 'text',\n      ...apiKeyIndexField,\n      access: {\n        ...apiKeyIndexField?.access,\n        create: customAccess?.create ?? canCreateOrUpdateAPIKey,\n        read: () => false,\n        update: customAccess?.update ?? canCreateOrUpdateAPIKey,\n      },\n      admin: {\n        disabled: true,\n        ...apiKeyIndexField?.admin,\n      },\n      hidden: apiKeyIndexField?.hidden ?? true,\n      hooks: {\n        ...apiKeyIndexField?.hooks,\n        afterRead: [omitAPIKeyIndex, ...(apiKeyIndexField?.hooks?.afterRead ?? [])],\n        beforeValidate: [setAPIKeyIndex, ...(apiKeyIndexField?.hooks?.beforeValidate ?? [])],\n      },\n    },\n  ]\n}\n\n/** Builds API key fields and safely merges custom overrides. */\nexport const getAPIKeyFields = (fields: Field[]): Field[] => {\n  const customAPIKeyField = fields.find(\n    (field) => fieldAffectsData(field) && field.name === 'apiKey' && field.type === 'text',\n  )\n\n  return createAPIKeyFields({ apiKeyField: customAPIKeyField as TextField | undefined })\n}\n"],"names":["fieldAffectsData","canCreateOrUpdateAPIKey","encryptAPIKey","omitAPIKeyIndex","omitEncryptedAPIKey","setAPIKeyIndex","setKeyLast4","omitAPIKey","createAPIKeyFields","apiKeyField","apiKeyIndexField","apiKeyLast4Field","customAccess","access","name","type","create","read","update","admin","components","Field","hooks","afterRead","beforeChange","label","t","beforeValidate","disabled","hidden","getAPIKeyFields","fields","customAPIKeyField","find","field"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,uBAAuB,QAAQ,sCAAqC;AAC7E,SAASC,aAAa,QAAQ,4BAA2B;AACzD,SAASC,eAAe,QAAQ,8BAA6B;AAC7D,SAASC,mBAAmB,QAAQ,kCAAiC;AACrE,SAASC,cAAc,QAAQ,6BAA4B;AAC3D,SAASC,WAAW,QAAQ,0BAAyB;AAErD,SAASC,UAAU,QAAQ,yBAAwB;AAOnD,OAAO,MAAMC,qBAAqB,CAAC,EACjCC,WAAW,EACXC,gBAAgB,EAChBC,gBAAgB,EAKjB,GAAG,CAAC,CAAC;IACJ,MAAMC,eAAeH,aAAaI;IAElC,OAAO;QACL;YACEC,MAAM;YACNC,MAAM;YACN,GAAGN,WAAW;YACdI,QAAQ;gBACNG,QAAQf;gBACR,GAAGQ,aAAaI,MAAM;gBACtBI,MAAM,IAAM;gBACZC,QAAQT,aAAaI,QAAQK,UAAUjB;YACzC;YACAkB,OAAO;gBACLC,YAAY;oBACVC,OAAO;gBACT;gBACA,GAAGZ,aAAaU,KAAK;YACvB;YACAG,OAAO;gBACL,GAAGb,aAAaa,KAAK;gBACrBC,WAAW;oBAACnB;uBAAyBK,aAAaa,OAAOC,aAAa,EAAE;iBAAE;gBAC1EC,cAAc;oBAACtB;uBAAmBO,aAAaa,OAAOE,gBAAgB,EAAE;iBAAE;YAC5E;YACAC,OAAOhB,aAAagB,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,wBAAuB;QACpE;QACA;YACEZ,MAAM;YACNC,MAAM;YACN,GAAGJ,gBAAgB;YACnBE,QAAQ;gBACN,GAAGF,kBAAkBE,MAAM;gBAC3BG,QAAQJ,cAAcI,UAAUf;gBAChCgB,MAAML,cAAcM,UAAUjB;gBAC9BiB,QAAQN,cAAcM,UAAUjB;YAClC;YACAkB,OAAO;gBACLC,YAAY;oBACVC,OAAO;gBACT;gBACA,GAAGV,kBAAkBQ,KAAK;YAC5B;YACAG,OAAO;gBACL,GAAGX,kBAAkBW,KAAK;gBAC1BK,gBAAgB;oBAACrB;uBAAiBK,kBAAkBW,OAAOK,kBAAkB,EAAE;iBAAE;YACnF;QACF;QACA;YACEb,MAAM;YACNC,MAAM;YACN,GAAGL,gBAAgB;YACnBG,QAAQ;gBACN,GAAGH,kBAAkBG,MAAM;gBAC3BG,QAAQJ,cAAcI,UAAUf;gBAChCgB,MAAM,IAAM;gBACZC,QAAQN,cAAcM,UAAUjB;YAClC;YACAkB,OAAO;gBACLS,UAAU;gBACV,GAAGlB,kBAAkBS,KAAK;YAC5B;YACAU,QAAQnB,kBAAkBmB,UAAU;YACpCP,OAAO;gBACL,GAAGZ,kBAAkBY,KAAK;gBAC1BC,WAAW;oBAACpB;uBAAqBO,kBAAkBY,OAAOC,aAAa,EAAE;iBAAE;gBAC3EI,gBAAgB;oBAACtB;uBAAoBK,kBAAkBY,OAAOK,kBAAkB,EAAE;iBAAE;YACtF;QACF;KACD;AACH,EAAC;AAED,8DAA8D,GAC9D,OAAO,MAAMG,kBAAkB,CAACC;IAC9B,MAAMC,oBAAoBD,OAAOE,IAAI,CACnC,CAACC,QAAUlC,iBAAiBkC,UAAUA,MAAMpB,IAAI,KAAK,YAAYoB,MAAMnB,IAAI,KAAK;IAGlF,OAAOP,mBAAmB;QAAEC,aAAauB;IAA2C;AACtF,EAAC"}

package/dist/auth/cookies.d.ts

@@ -33,8 +33,8 @@ type GeneratePayloadCookieArgs = {
     returnCookieAsObject?: boolean;
     token: string;
 };
-export declare const generatePayloadCookie: <T extends GeneratePayloadCookieArgs>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, token, }: T) => T["returnCookieAsObject"] extends true ? CookieObject : string;
-export declare const generateExpiredPayloadCookie: <T extends Omit<GeneratePayloadCookieArgs, "token">>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, }: T) => T["returnCookieAsObject"] extends true ? CookieObject : string;
+export declare const generatePayloadCookie: <T extends GeneratePayloadCookieArgs>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, token, }: T) => T['returnCookieAsObject'] extends true ? CookieObject : string;
+export declare const generateExpiredPayloadCookie: <T extends Omit<GeneratePayloadCookieArgs, 'token'>>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, }: T) => T['returnCookieAsObject'] extends true ? CookieObject : string;
 export declare function parseCookies(headers: Request['headers']): Map<string, string>;
 export {};
 //# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAEjF,KAAK,aAAa,GAAG;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,KAAK,YAAY,GAAG;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,oBAAoB,kBAC3C,aAAa,KAClB,oBAAoB,SAAS,IAAI,GAAG,YAAY,GAAG,MAiFrD,CAAA;AACD,KAAK,uBAAuB,GAAG;IAK7B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,eAAO,MAAM,mBAAmB,gBAAwB,uBAAuB,SAI9E,CAAA;AAED,KAAK,yBAAyB,GAAG;IAE/B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAEvD,YAAY,EAAE,MAAM,CAAA;IAEpB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,yBAAyB,wEAKtE,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAmB9D,CAAA;AAED,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,iEAI5F,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAoB9D,CAAA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,uBA8CvD"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAEjF,KAAK,aAAa,GAAG;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,KAAK,YAAY,GAAG;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,oBAAoB,GAAG,OAAO,QACrD,aAAa,KAClB,oBAAoB,SAAS,IAAI,GAAG,YAAY,GAAG,MAiFrD,CAAA;AACD,KAAK,uBAAuB,GAAG;IAK7B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,eAAO,MAAM,mBAAmB,gBAAwB,uBAAuB,SAI9E,CAAA;AAED,KAAK,yBAAyB,GAAG;IAE/B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAEvD,YAAY,EAAE,MAAM,CAAA;IAEpB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,yBAAyB,wEAKtE,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAmB9D,CAAA;AAED,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,iEAI5F,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAoB9D,CAAA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,uBA8CvD"}

package/dist/auth/crypto.d.ts

@@ -1,3 +1,74 @@
-export declare function encrypt(text: string): string;
-export declare function decrypt(hash: string): string;
+/**
+ * A single secret in the keyring, with its derived keys precomputed.
+ */
+export type EncryptionKey = {
+    /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */
+    keyId: string;
+    /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */
+    legacyKey: string;
+    /** The raw `PAYLOAD_SECRET` string. */
+    secret: string;
+    /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */
+    v1Key: Buffer;
+};
+/**
+ * The set of secrets Payload accepts. `active` is used for all writes; every
+ * entry (active + `previousSecrets`) is accepted for reads.
+ */
+export type EncryptionKeyring = {
+    /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */
+    active: EncryptionKey;
+    all: EncryptionKey[];
+    /** keyId -> entry, for O(1) v1 key selection. */
+    byId: Record<string, EncryptionKey>;
+};
+type CryptoContext = {
+    encryptionKeyring: EncryptionKeyring;
+    secret: string;
+};
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */
+export declare const deriveSecretKey: (secret: string) => string;
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */
+export declare const deriveKeyV1: (secret: string) => Buffer;
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */
+export declare const keyIdFor: (v1Key: Buffer) => string;
+export declare const buildEncryptionKey: (secret: string) => EncryptionKey;
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */
+export declare const buildEncryptionKeyring: (secrets: string[]) => EncryptionKeyring;
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */
+export declare function encrypt(this: CryptoContext, text: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */
+export declare function decrypt(this: CryptoContext, hash: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */
+export declare function reencrypt(this: CryptoContext, hash: string, options: {
+    oldSecret: string;
+}): string;
+export {};
 //# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5C;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS5C"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oEAAoE;IACpE,MAAM,EAAE,aAAa,CAAA;IACrB,GAAG,EAAE,aAAa,EAAE,CAAA;IACpB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CACpC,CAAA;AAED,KAAK,aAAa,GAAG;IACnB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAMD;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,MACsB,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,MACgC,CAAA;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MAC6B,CAAA;AAEtE,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,aAQnD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,YAAa,MAAM,EAAE,KAAG,iBAU1D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAUhG;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAuChG;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7B,MAAM,CAGR"}

package/dist/auth/crypto.js

@@ -1,21 +1,98 @@
 import crypto from 'crypto';
-const algorithm = 'aes-256-ctr';
-export function encrypt(text) {
-    const iv = crypto.randomBytes(16);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const cipher = crypto.createCipheriv(algorithm, secret, iv);
-    const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
-    const ivString = iv.toString('hex');
-    return `${ivString}${encrypted}`;
+const legacyAlgorithm = 'aes-256-ctr';
+const v1Algorithm = 'aes-256-gcm';
+const v1Prefix = 'v1';
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */ export const deriveSecretKey = (secret)=>crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32);
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */ export const deriveKeyV1 = (secret)=>Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32));
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */ export const keyIdFor = (v1Key)=>crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16);
+export const buildEncryptionKey = (secret)=>{
+    const v1Key = deriveKeyV1(secret);
+    return {
+        keyId: keyIdFor(v1Key),
+        legacyKey: deriveSecretKey(secret),
+        secret,
+        v1Key
+    };
+};
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */ export const buildEncryptionKeyring = (secrets)=>{
+    const all = secrets.map(buildEncryptionKey);
+    const byId = {};
+    for (const key of all){
+        // First writer wins if two secrets somehow share a keyId.
+        if (!byId[key.keyId]) {
+            byId[key.keyId] = key;
+        }
+    }
+    return {
+        active: all[0],
+        all,
+        byId
+    };
+};
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */ export function encrypt(text, options) {
+    const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active;
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv);
+    const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`;
 }
-export function decrypt(hash) {
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */ export function decrypt(hash, options) {
+    if (hash.startsWith(`${v1Prefix}:`)) {
+        const parts = hash.split(':');
+        if (parts.length !== 5) {
+            throw new Error('decrypt: malformed v1 envelope, expected "v1:keyId:iv:authTag:ciphertext".');
+        }
+        const [, keyId, ivHex, authTagHex, ciphertext] = parts;
+        const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.byId[keyId];
+        if (!key) {
+            throw new Error(`decrypt: no secret in the keyring matches key id "${keyId}". Add the secret that encrypted this value to config.previousSecrets.`);
+        }
+        const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex, 'hex'));
+        decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
+        // final() throws on a wrong key or tampered ciphertext.
+        return decipher.update(ciphertext, 'hex', 'utf8') + decipher.final('utf8');
+    }
+    // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong
+    // key returns garbage instead of throwing. We therefore intentionally use only
+    // the explicit or active key here (never trial the keyring): a legacy value
+    // written under a previous secret decrypts to garbage until rotateSecret
+    // upgrades it to the authenticated v1 envelope. API key auth is unaffected
+    // (it matches the HMAC apiKeyIndex, which is keyring-aware).
+    const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret;
     const iv = hash.slice(0, 32);
     const content = hash.slice(32);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'));
+    const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'));
     return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8');
 }
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */ export function reencrypt(hash, options) {
+    const plaintext = decrypt.call(this, hash, {
+        secret: options.oldSecret
+    });
+    return encrypt.call(this, plaintext);
+}
 
 //# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\nconst algorithm = 'aes-256-ctr'\n\nexport function encrypt(text: string): string {\n  const iv = crypto.randomBytes(16)\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const cipher = crypto.createCipheriv(algorithm, secret, iv)\n\n  const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const ivString = iv.toString('hex')\n\n  return `${ivString}${encrypted}`\n}\n\nexport function decrypt(hash: string): string {\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n"],"names":["crypto","algorithm","encrypt","text","iv","randomBytes","secret","cipher","createCipheriv","encrypted","update","final","ivString","toString","decrypt","hash","slice","content","decipher","createDecipheriv","Buffer","from"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAE3B,MAAMC,YAAY;AAElB,OAAO,SAASC,QAAQC,IAAY;IAClC,MAAMC,KAAKJ,OAAOK,WAAW,CAAC;IAC9B,oFAAoF;IACpF,MAAMC,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMC,SAASP,OAAOQ,cAAc,CAACP,WAAWK,QAAQF;IAExD,MAAMK,YAAYF,OAAOG,MAAM,CAACP,MAAM,QAAQ,SAASI,OAAOI,KAAK,CAAC;IACpE,MAAMC,WAAWR,GAAGS,QAAQ,CAAC;IAE7B,OAAO,GAAGD,WAAWH,WAAW;AAClC;AAEA,OAAO,SAASK,QAAQC,IAAY;IAClC,MAAMX,KAAKW,KAAKC,KAAK,CAAC,GAAG;IACzB,MAAMC,UAAUF,KAAKC,KAAK,CAAC;IAE3B,oFAAoF;IACpF,MAAMV,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMY,WAAWlB,OAAOmB,gBAAgB,CAAClB,WAAWK,QAAQc,OAAOC,IAAI,CAACjB,IAAI;IAE5E,OAAOc,SAASR,MAAM,CAACO,SAAS,OAAO,UAAUC,SAASP,KAAK,CAAC;AAClE"}
+{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\n/**\n * A single secret in the keyring, with its derived keys precomputed.\n */\nexport type EncryptionKey = {\n  /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */\n  keyId: string\n  /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */\n  legacyKey: string\n  /** The raw `PAYLOAD_SECRET` string. */\n  secret: string\n  /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */\n  v1Key: Buffer\n}\n\n/**\n * The set of secrets Payload accepts. `active` is used for all writes; every\n * entry (active + `previousSecrets`) is accepted for reads.\n */\nexport type EncryptionKeyring = {\n  /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */\n  active: EncryptionKey\n  all: EncryptionKey[]\n  /** keyId -> entry, for O(1) v1 key selection. */\n  byId: Record<string, EncryptionKey>\n}\n\ntype CryptoContext = {\n  encryptionKeyring: EncryptionKeyring\n  secret: string\n}\n\nconst legacyAlgorithm = 'aes-256-ctr'\nconst v1Algorithm = 'aes-256-gcm'\nconst v1Prefix = 'v1'\n\n/**\n * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).\n * Kept in sync with `BasePayload.secret`.\n */\nexport const deriveSecretKey = (secret: string): string =>\n  crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32)\n\n/**\n * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced\n * effective entropy of the legacy derivation.\n */\nexport const deriveKeyV1 = (secret: string): Buffer =>\n  Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32))\n\n/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */\nexport const keyIdFor = (v1Key: Buffer): string =>\n  crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16)\n\nexport const buildEncryptionKey = (secret: string): EncryptionKey => {\n  const v1Key = deriveKeyV1(secret)\n  return {\n    keyId: keyIdFor(v1Key),\n    legacyKey: deriveSecretKey(secret),\n    secret,\n    v1Key,\n  }\n}\n\n/**\n * Builds the keyring from the active secret followed by any previous secrets.\n * The first entry is the active (writing) key.\n */\nexport const buildEncryptionKeyring = (secrets: string[]): EncryptionKeyring => {\n  const all = secrets.map(buildEncryptionKey)\n  const byId: Record<string, EncryptionKey> = {}\n  for (const key of all) {\n    // First writer wins if two secrets somehow share a keyId.\n    if (!byId[key.keyId]) {\n      byId[key.keyId] = key\n    }\n  }\n  return { active: all[0]!, all, byId }\n}\n\n/**\n * Encrypts `text` under the active secret using the versioned aes-256-gcm\n * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the\n * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.\n */\nexport function encrypt(this: CryptoContext, text: string, options?: { secret?: string }): string {\n  const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active\n\n  const iv = crypto.randomBytes(12)\n  const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv)\n\n  const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const authTag = cipher.getAuthTag().toString('hex')\n\n  return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`\n}\n\n/**\n * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1\n * envelopes are authenticated (aes-256-gcm) and select their key by keyId from\n * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to\n * decrypt under a specific secret (e.g. to read data encrypted under a previous\n * secret during a rotation).\n */\nexport function decrypt(this: CryptoContext, hash: string, options?: { secret?: string }): string {\n  if (hash.startsWith(`${v1Prefix}:`)) {\n    const parts = hash.split(':')\n\n    if (parts.length !== 5) {\n      throw new Error('decrypt: malformed v1 envelope, expected \"v1:keyId:iv:authTag:ciphertext\".')\n    }\n\n    const [, keyId, ivHex, authTagHex, ciphertext] = parts\n\n    const key = options?.secret\n      ? buildEncryptionKey(options.secret)\n      : this.encryptionKeyring.byId[keyId!]\n\n    if (!key) {\n      throw new Error(\n        `decrypt: no secret in the keyring matches key id \"${keyId}\". Add the secret that encrypted this value to config.previousSecrets.`,\n      )\n    }\n\n    const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex!, 'hex'))\n    decipher.setAuthTag(Buffer.from(authTagHex!, 'hex'))\n\n    // final() throws on a wrong key or tampered ciphertext.\n    return decipher.update(ciphertext!, 'hex', 'utf8') + decipher.final('utf8')\n  }\n\n  // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong\n  // key returns garbage instead of throwing. We therefore intentionally use only\n  // the explicit or active key here (never trial the keyring): a legacy value\n  // written under a previous secret decrypts to garbage until rotateSecret\n  // upgrades it to the authenticated v1 envelope. API key auth is unaffected\n  // (it matches the HMAC apiKeyIndex, which is keyring-aware).\n  const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n  const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n\n/**\n * Re-encrypts a value that was encrypted under a previous secret: decrypts it\n * with `options.oldSecret`, then re-encrypts it with the active secret. Also\n * upgrades a legacy aes-256-ctr value to the v1 envelope.\n */\nexport function reencrypt(\n  this: CryptoContext,\n  hash: string,\n  options: { oldSecret: string },\n): string {\n  const plaintext = decrypt.call(this, hash, { secret: options.oldSecret })\n  return encrypt.call(this, plaintext)\n}\n"],"names":["crypto","legacyAlgorithm","v1Algorithm","v1Prefix","deriveSecretKey","secret","createHash","update","digest","slice","deriveKeyV1","Buffer","from","hkdfSync","keyIdFor","v1Key","buildEncryptionKey","keyId","legacyKey","buildEncryptionKeyring","secrets","all","map","byId","key","active","encrypt","text","options","encryptionKeyring","iv","randomBytes","cipher","createCipheriv","ciphertext","final","authTag","getAuthTag","toString","decrypt","hash","startsWith","parts","split","length","Error","ivHex","authTagHex","decipher","createDecipheriv","setAuthTag","content","reencrypt","plaintext","call","oldSecret"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAiC3B,MAAMC,kBAAkB;AACxB,MAAMC,cAAc;AACpB,MAAMC,WAAW;AAEjB;;;CAGC,GACD,OAAO,MAAMC,kBAAkB,CAACC,SAC9BL,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACF,QAAQG,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEvE;;;CAGC,GACD,OAAO,MAAMC,cAAc,CAACL,SAC1BM,OAAOC,IAAI,CAACZ,OAAOa,QAAQ,CAAC,UAAUR,QAAQ,IAAI,qBAAqB,KAAI;AAE7E,2EAA2E,GAC3E,OAAO,MAAMS,WAAW,CAACC,QACvBf,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACQ,OAAOP,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEtE,OAAO,MAAMO,qBAAqB,CAACX;IACjC,MAAMU,QAAQL,YAAYL;IAC1B,OAAO;QACLY,OAAOH,SAASC;QAChBG,WAAWd,gBAAgBC;QAC3BA;QACAU;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMI,yBAAyB,CAACC;IACrC,MAAMC,MAAMD,QAAQE,GAAG,CAACN;IACxB,MAAMO,OAAsC,CAAC;IAC7C,KAAK,MAAMC,OAAOH,IAAK;QACrB,0DAA0D;QAC1D,IAAI,CAACE,IAAI,CAACC,IAAIP,KAAK,CAAC,EAAE;YACpBM,IAAI,CAACC,IAAIP,KAAK,CAAC,GAAGO;QACpB;IACF;IACA,OAAO;QAAEC,QAAQJ,GAAG,CAAC,EAAE;QAAGA;QAAKE;IAAK;AACtC,EAAC;AAED;;;;CAIC,GACD,OAAO,SAASG,QAA6BC,IAAY,EAAEC,OAA6B;IACtF,MAAMJ,MAAMI,SAASvB,SAASW,mBAAmBY,QAAQvB,MAAM,IAAI,IAAI,CAACwB,iBAAiB,CAACJ,MAAM;IAEhG,MAAMK,KAAK9B,OAAO+B,WAAW,CAAC;IAC9B,MAAMC,SAAShC,OAAOiC,cAAc,CAAC/B,aAAasB,IAAIT,KAAK,EAAEe;IAE7D,MAAMI,aAAaF,OAAOzB,MAAM,CAACoB,MAAM,QAAQ,SAASK,OAAOG,KAAK,CAAC;IACrE,MAAMC,UAAUJ,OAAOK,UAAU,GAAGC,QAAQ,CAAC;IAE7C,OAAO,GAAGnC,SAAS,CAAC,EAAEqB,IAAIP,KAAK,CAAC,CAAC,EAAEa,GAAGQ,QAAQ,CAAC,OAAO,CAAC,EAAEF,QAAQ,CAAC,EAAEF,YAAY;AAClF;AAEA;;;;;;CAMC,GACD,OAAO,SAASK,QAA6BC,IAAY,EAAEZ,OAA6B;IACtF,IAAIY,KAAKC,UAAU,CAAC,GAAGtC,SAAS,CAAC,CAAC,GAAG;QACnC,MAAMuC,QAAQF,KAAKG,KAAK,CAAC;QAEzB,IAAID,MAAME,MAAM,KAAK,GAAG;YACtB,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAM,GAAG5B,OAAO6B,OAAOC,YAAYb,WAAW,GAAGQ;QAEjD,MAAMlB,MAAMI,SAASvB,SACjBW,mBAAmBY,QAAQvB,MAAM,IACjC,IAAI,CAACwB,iBAAiB,CAACN,IAAI,CAACN,MAAO;QAEvC,IAAI,CAACO,KAAK;YACR,MAAM,IAAIqB,MACR,CAAC,kDAAkD,EAAE5B,MAAM,sEAAsE,CAAC;QAEtI;QAEA,MAAM+B,WAAWhD,OAAOiD,gBAAgB,CAAC/C,aAAasB,IAAIT,KAAK,EAAEJ,OAAOC,IAAI,CAACkC,OAAQ;QACrFE,SAASE,UAAU,CAACvC,OAAOC,IAAI,CAACmC,YAAa;QAE7C,wDAAwD;QACxD,OAAOC,SAASzC,MAAM,CAAC2B,YAAa,OAAO,UAAUc,SAASb,KAAK,CAAC;IACtE;IAEA,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMjB,YAAYU,SAASvB,SAASD,gBAAgBwB,QAAQvB,MAAM,IAAI,IAAI,CAACA,MAAM;IACjF,MAAMyB,KAAKU,KAAK/B,KAAK,CAAC,GAAG;IACzB,MAAM0C,UAAUX,KAAK/B,KAAK,CAAC;IAC3B,MAAMuC,WAAWhD,OAAOiD,gBAAgB,CAAChD,iBAAiBiB,WAAWP,OAAOC,IAAI,CAACkB,IAAI;IAErF,OAAOkB,SAASzC,MAAM,CAAC4C,SAAS,OAAO,UAAUH,SAASb,KAAK,CAAC;AAClE;AAEA;;;;CAIC,GACD,OAAO,SAASiB,UAEdZ,IAAY,EACZZ,OAA8B;IAE9B,MAAMyB,YAAYd,QAAQe,IAAI,CAAC,IAAI,EAAEd,MAAM;QAAEnC,QAAQuB,QAAQ2B,SAAS;IAAC;IACvE,OAAO7B,QAAQ4B,IAAI,CAAC,IAAI,EAAED;AAC5B"}

package/dist/auth/defaultAccess.d.ts

@@ -1,5 +1,5 @@
 import type { PayloadRequest } from '../types/index.js';
-export declare const defaultAccess: ({ req: { user } }: {
+export declare const defaultAccess: ({ req: { payload, user } }: {
     req: PayloadRequest;
 }) => boolean;
 //# sourceMappingURL=defaultAccess.d.ts.map

package/dist/auth/defaultAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultAccess.d.ts","sourceRoot":"","sources":["../../src/auth/defaultAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,eAAO,MAAM,aAAa,sBAAuB;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,KAAG,OAAwB,CAAA"}
+{"version":3,"file":"defaultAccess.d.ts","sourceRoot":"","sources":["../../src/auth/defaultAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,eAAO,MAAM,aAAa,+BAAgC;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,KAAG,OACnB,CAAA"}

package/dist/auth/defaultAccess.js

@@ -1,3 +1,3 @@
-export const defaultAccess = ({ req: { user } })=>Boolean(user);
+export const defaultAccess = ({ req: { payload, user } })=>Boolean(user) && user.collection === payload.config.admin.user;
 
 //# sourceMappingURL=defaultAccess.js.map

package/dist/auth/defaultAccess.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/defaultAccess.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nexport const defaultAccess = ({ req: { user } }: { req: PayloadRequest }): boolean => Boolean(user)\n"],"names":["defaultAccess","req","user","Boolean"],"mappings":"AAEA,OAAO,MAAMA,gBAAgB,CAAC,EAAEC,KAAK,EAAEC,IAAI,EAAE,EAA2B,GAAcC,QAAQD,MAAK"}
+{"version":3,"sources":["../../src/auth/defaultAccess.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nexport const defaultAccess = ({ req: { payload, user } }: { req: PayloadRequest }): boolean =>\n  Boolean(user) && user!.collection === payload.config.admin.user\n"],"names":["defaultAccess","req","payload","user","Boolean","collection","config","admin"],"mappings":"AAEA,OAAO,MAAMA,gBAAgB,CAAC,EAAEC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE,EAA2B,GAC/EC,QAAQD,SAASA,KAAME,UAAU,KAAKH,QAAQI,MAAM,CAACC,KAAK,CAACJ,IAAI,CAAA"}

package/dist/auth/defaultUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultUser.d.ts","sourceRoot":"","sources":["../../src/auth/defaultUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,eAAO,MAAM,qBAAqB,EAAE,gBAanC,CAAA"}
+{"version":3,"file":"defaultUser.d.ts","sourceRoot":"","sources":["../../src/auth/defaultUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,eAAO,MAAM,qBAAqB,EAAE,gBAcnC,CAAA"}

package/dist/auth/defaultUser.js

@@ -10,7 +10,8 @@ export const defaultUserCollection = {
     labels: {
         plural: ({ t })=>t('general:users'),
         singular: ({ t })=>t('general:user')
-    }
+    },
+    versions: false
 };
 
 //# sourceMappingURL=defaultUser.js.map

package/dist/auth/defaultUser.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/defaultUser.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\n\nexport const defaultUserCollection: CollectionConfig = {\n  slug: 'users',\n  admin: {\n    useAsTitle: 'email',\n  },\n  auth: {\n    tokenExpiration: 7200,\n  },\n  fields: [],\n  labels: {\n    plural: ({ t }) => t('general:users'),\n    singular: ({ t }) => t('general:user'),\n  },\n}\n"],"names":["defaultUserCollection","slug","admin","useAsTitle","auth","tokenExpiration","fields","labels","plural","t","singular"],"mappings":"AAEA,OAAO,MAAMA,wBAA0C;IACrDC,MAAM;IACNC,OAAO;QACLC,YAAY;IACd;IACAC,MAAM;QACJC,iBAAiB;IACnB;IACAC,QAAQ,EAAE;IACVC,QAAQ;QACNC,QAAQ,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;QACrBC,UAAU,CAAC,EAAED,CAAC,EAAE,GAAKA,EAAE;IACzB;AACF,EAAC"}
+{"version":3,"sources":["../../src/auth/defaultUser.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\n\nexport const defaultUserCollection: CollectionConfig = {\n  slug: 'users',\n  admin: {\n    useAsTitle: 'email',\n  },\n  auth: {\n    tokenExpiration: 7200,\n  },\n  fields: [],\n  labels: {\n    plural: ({ t }) => t('general:users'),\n    singular: ({ t }) => t('general:user'),\n  },\n  versions: false,\n}\n"],"names":["defaultUserCollection","slug","admin","useAsTitle","auth","tokenExpiration","fields","labels","plural","t","singular","versions"],"mappings":"AAEA,OAAO,MAAMA,wBAA0C;IACrDC,MAAM;IACNC,OAAO;QACLC,YAAY;IACd;IACAC,MAAM;QACJC,iBAAiB;IACnB;IACAC,QAAQ,EAAE;IACVC,QAAQ;QACNC,QAAQ,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;QACrBC,UAAU,CAAC,EAAED,CAAC,EAAE,GAAKA,EAAE;IACzB;IACAE,UAAU;AACZ,EAAC"}

package/dist/auth/endpoints/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAK3D,eAAO,MAAM,aAAa,EAAE,cA0B3B,CAAA"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,aAAa,EAAE,cA0B3B,CAAA"}

package/dist/auth/endpoints/access.js

@@ -1,5 +1,5 @@
-import { status as httpStatus } from 'http-status';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { accessOperation } from '../operations/access.js';
 export const accessHandler = async (req)=>{
     const headers = headersWithCors({

package/dist/auth/endpoints/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/access.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { accessOperation } from '../operations/access.js'\n\nexport const accessHandler: PayloadHandler = async (req) => {\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  try {\n    const results = await accessOperation({\n      req,\n    })\n\n    return Response.json(results, {\n      headers,\n      status: httpStatus.OK,\n    })\n  } catch (e: unknown) {\n    return Response.json(\n      {\n        error: e,\n      },\n      {\n        headers,\n        status: httpStatus.INTERNAL_SERVER_ERROR,\n      },\n    )\n  }\n}\n"],"names":["status","httpStatus","headersWithCors","accessOperation","accessHandler","req","headers","Headers","results","Response","json","OK","e","error","INTERNAL_SERVER_ERROR"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,UAAUJ,gBAAgB;QAC9BI,SAAS,IAAIC;QACbF;IACF;IAEA,IAAI;QACF,MAAMG,UAAU,MAAML,gBAAgB;YACpCE;QACF;QAEA,OAAOI,SAASC,IAAI,CAACF,SAAS;YAC5BF;YACAN,QAAQC,WAAWU,EAAE;QACvB;IACF,EAAE,OAAOC,GAAY;QACnB,OAAOH,SAASC,IAAI,CAClB;YACEG,OAAOD;QACT,GACA;YACEN;YACAN,QAAQC,WAAWa,qBAAqB;QAC1C;IAEJ;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/access.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { accessOperation } from '../operations/access.js'\n\nexport const accessHandler: PayloadHandler = async (req) => {\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  try {\n    const results = await accessOperation({\n      req,\n    })\n\n    return Response.json(results, {\n      headers,\n      status: httpStatus.OK,\n    })\n  } catch (e: unknown) {\n    return Response.json(\n      {\n        error: e,\n      },\n      {\n        headers,\n        status: httpStatus.INTERNAL_SERVER_ERROR,\n      },\n    )\n  }\n}\n"],"names":["headersWithCors","httpStatus","accessOperation","accessHandler","req","headers","Headers","results","Response","json","status","OK","e","error","INTERNAL_SERVER_ERROR"],"mappings":"AAEA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,UAAUL,gBAAgB;QAC9BK,SAAS,IAAIC;QACbF;IACF;IAEA,IAAI;QACF,MAAMG,UAAU,MAAML,gBAAgB;YACpCE;QACF;QAEA,OAAOI,SAASC,IAAI,CAACF,SAAS;YAC5BF;YACAK,QAAQT,WAAWU,EAAE;QACvB;IACF,EAAE,OAAOC,GAAY;QACnB,OAAOJ,SAASC,IAAI,CAClB;YACEI,OAAOD;QACT,GACA;YACEP;YACAK,QAAQT,WAAWa,qBAAqB;QAC1C;IAEJ;AACF,EAAC"}

package/dist/auth/endpoints/forgotPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/forgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,qBAAqB,EAAE,cAgCnC,CAAA"}
+{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/forgotPassword.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,qBAAqB,EAAE,cAgCnC,CAAA"}

package/dist/auth/endpoints/forgotPassword.js

@@ -1,6 +1,6 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { forgotPasswordOperation } from '../operations/forgotPassword.js';
 export const forgotPasswordHandler = async (req)=>{
     const { t } = req;

package/dist/auth/endpoints/forgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/forgotPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { forgotPasswordOperation } from '../operations/forgotPassword.js'\n\nexport const forgotPasswordHandler: PayloadHandler = async (req) => {\n  const { t } = req\n\n  const collection = getRequestCollection(req)\n\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n      }\n\n  await forgotPasswordOperation({\n    collection,\n    data: authData,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('general:success'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","forgotPasswordOperation","forgotPasswordHandler","req","t","collection","authData","config","auth","loginWithUsername","email","data","username","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,uBAAuB,QAAQ,kCAAiC;AAEzE,OAAO,MAAMC,wBAAwC,OAAOC;IAC1D,MAAM,EAAEC,CAAC,EAAE,GAAGD;IAEd,MAAME,aAAaN,qBAAqBI;IAExC,MAAMG,WAAWD,WAAWE,MAAM,CAACC,IAAI,EAAEC,oBACrC;QACEC,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOT,IAAIQ,IAAI,EAAEC,aAAa,WAAWT,IAAIQ,IAAI,CAACC,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;IAChE;IAEJ,MAAMT,wBAAwB;QAC5BI;QACAM,MAAML;QACNH;IACF;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASX,EAAE;IACb,GACA;QACEY,SAAShB,gBAAgB;YACvBgB,SAAS,IAAIC;YACbd;QACF;QACAN,QAAQC,WAAWoB,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/forgotPassword.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { forgotPasswordOperation } from '../operations/forgotPassword.js'\n\nexport const forgotPasswordHandler: PayloadHandler = async (req) => {\n  const { t } = req\n\n  const collection = getRequestCollection(req)\n\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n      }\n\n  await forgotPasswordOperation({\n    collection,\n    data: authData,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('general:success'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["getRequestCollection","headersWithCors","httpStatus","forgotPasswordOperation","forgotPasswordHandler","req","t","collection","authData","config","auth","loginWithUsername","email","data","username","Response","json","message","headers","Headers","status","OK"],"mappings":"AAEA,SAASA,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,uBAAuB,QAAQ,kCAAiC;AAEzE,OAAO,MAAMC,wBAAwC,OAAOC;IAC1D,MAAM,EAAEC,CAAC,EAAE,GAAGD;IAEd,MAAME,aAAaP,qBAAqBK;IAExC,MAAMG,WAAWD,WAAWE,MAAM,CAACC,IAAI,EAAEC,oBACrC;QACEC,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOT,IAAIQ,IAAI,EAAEC,aAAa,WAAWT,IAAIQ,IAAI,CAACC,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;IAChE;IAEJ,MAAMT,wBAAwB;QAC5BI;QACAM,MAAML;QACNH;IACF;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASX,EAAE;IACb,GACA;QACEY,SAASjB,gBAAgB;YACvBiB,SAAS,IAAIC;YACbd;QACF;QACAe,QAAQlB,WAAWmB,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D,eAAO,MAAM,YAAY,EAAE,cAgD1B,CAAA"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D,eAAO,MAAM,YAAY,EAAE,cAsC1B,CAAA"}

package/dist/auth/endpoints/login.js

@@ -1,9 +1,8 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { isNumber } from '../../utilities/isNumber.js';
-import { generatePayloadCookie } from '../cookies.js';
-import { loginOperation } from '../operations/login.js';
+import { loginWithCookie } from '../loginWithCookie.js';
 export const loginHandler = async (req)=>{
     const collection = getRequestCollection(req);
     const { searchParams, t } = req;
@@ -16,20 +15,12 @@ export const loginHandler = async (req)=>{
         email: typeof req.data?.email === 'string' ? req.data.email : '',
         password: typeof req.data?.password === 'string' ? req.data.password : ''
     };
-    const result = await loginOperation({
+    const { cookie, result } = await loginWithCookie({
         collection,
         data: authData,
         depth: isNumber(depth) ? Number(depth) : undefined,
         req
     });
-    const cookie = generatePayloadCookie({
-        collectionAuthConfig: collection.config.auth,
-        cookiePrefix: req.payload.config.cookiePrefix,
-        token: result.token
-    });
-    if (collection.config.auth.removeTokenFromResponses) {
-        delete result.token;
-    }
     return Response.json({
         message: t('authentication:passed'),
         ...result

package/dist/auth/endpoints/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/login.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { isNumber } from '../../utilities/isNumber.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { loginOperation } from '../operations/login.js'\n\nexport const loginHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const result = await loginOperation({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token!,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","isNumber","generatePayloadCookie","loginOperation","loginHandler","req","collection","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","result","Number","undefined","cookie","collectionAuthConfig","cookiePrefix","payload","token","removeTokenFromResponses","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,QAAQ,QAAQ,8BAA6B;AACtD,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,cAAc,QAAQ,yBAAwB;AAEvD,OAAO,MAAMC,eAA+B,OAAOC;IACjD,MAAMC,aAAaP,qBAAqBM;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAC/B,MAAMC,WACJL,WAAWM,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;QACvEC,UAAU,OAAOb,IAAIW,IAAI,EAAEE,aAAa,WAAWb,IAAIW,IAAI,CAACE,QAAQ,GAAG;IACzE,IACA;QACEH,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;IACzE;IAEN,MAAME,SAAS,MAAMhB,eAAe;QAClCG;QACAU,MAAML;QACNF,OAAOR,SAASQ,SAASW,OAAOX,SAASY;QACzChB;IACF;IAEA,MAAMiB,SAASpB,sBAAsB;QACnCqB,sBAAsBjB,WAAWM,MAAM,CAACC,IAAI;QAC5CW,cAAcnB,IAAIoB,OAAO,CAACb,MAAM,CAACY,YAAY;QAC7CE,OAAOP,OAAOO,KAAK;IACrB;IAEA,IAAIpB,WAAWM,MAAM,CAACC,IAAI,CAACc,wBAAwB,EAAE;QACnD,OAAOR,OAAOO,KAAK;IACrB;IAEA,OAAOE,SAASC,IAAI,CAClB;QACEC,SAAStB,EAAE;QACX,GAAGW,MAAM;IACX,GACA;QACEY,SAAS/B,gBAAgB;YACvB+B,SAAS,IAAIC,QAAQ;gBACnB,cAAcV;YAChB;YACAjB;QACF;QACAR,QAAQC,WAAWmC,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/login.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { isNumber } from '../../utilities/isNumber.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\n\nexport const loginHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const { cookie, result } = await loginWithCookie({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["getRequestCollection","headersWithCors","httpStatus","isNumber","loginWithCookie","loginHandler","req","collection","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","cookie","result","Number","undefined","Response","json","message","headers","Headers","status","OK"],"mappings":"AAEA,SAASA,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,QAAQ,QAAQ,8BAA6B;AACtD,SAASC,eAAe,QAAQ,wBAAuB;AAEvD,OAAO,MAAMC,eAA+B,OAAOC;IACjD,MAAMC,aAAaP,qBAAqBM;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAC/B,MAAMC,WACJL,WAAWM,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;QACvEC,UAAU,OAAOb,IAAIW,IAAI,EAAEE,aAAa,WAAWb,IAAIW,IAAI,CAACE,QAAQ,GAAG;IACzE,IACA;QACEH,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;IACzE;IAEN,MAAM,EAAEE,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMjB,gBAAgB;QAC/CG;QACAU,MAAML;QACNF,OAAOP,SAASO,SAASY,OAAOZ,SAASa;QACzCjB;IACF;IAEA,OAAOkB,SAASC,IAAI,CAClB;QACEC,SAASjB,EAAE;QACX,GAAGY,MAAM;IACX,GACA;QACEM,SAAS1B,gBAAgB;YACvB0B,SAAS,IAAIC,QAAQ;gBACnB,cAAcR;YAChB;YACAd;QACF;QACAuB,QAAQ3B,WAAW4B,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/logout.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,aAAa,EAAE,cA4C3B,CAAA"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D,eAAO,MAAM,aAAa,EAAE,cA4C3B,CAAA"}

package/dist/auth/endpoints/logout.js

@@ -1,6 +1,6 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { generateExpiredPayloadCookie } from '../cookies.js';
 import { logoutOperation } from '../operations/logout.js';
 export const logoutHandler = async (req)=>{

package/dist/auth/endpoints/logout.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/logout.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { generateExpiredPayloadCookie } from '../cookies.js'\nimport { logoutOperation } from '../operations/logout.js'\n\nexport const logoutHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n\n  const result = await logoutOperation({\n    allSessions: searchParams.get('allSessions') === 'true',\n    collection,\n    req,\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (!result) {\n    return Response.json(\n      {\n        message: t('error:logoutFailed'),\n      },\n      {\n        headers,\n        status: httpStatus.BAD_REQUEST,\n      },\n    )\n  }\n\n  const expiredCookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    config: req.payload.config,\n    cookiePrefix: req.payload.config.cookiePrefix,\n  })\n\n  headers.set('Set-Cookie', expiredCookie)\n\n  return Response.json(\n    {\n      message: t('authentication:logoutSuccessful'),\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","generateExpiredPayloadCookie","logoutOperation","logoutHandler","req","collection","searchParams","t","result","allSessions","get","headers","Headers","Response","json","message","BAD_REQUEST","expiredCookie","collectionAuthConfig","config","auth","payload","cookiePrefix","set","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,4BAA4B,QAAQ,gBAAe;AAC5D,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAE5B,MAAMI,SAAS,MAAMN,gBAAgB;QACnCO,aAAaH,aAAaI,GAAG,CAAC,mBAAmB;QACjDL;QACAD;IACF;IAEA,MAAMO,UAAUX,gBAAgB;QAC9BW,SAAS,IAAIC;QACbR;IACF;IAEA,IAAI,CAACI,QAAQ;QACX,OAAOK,SAASC,IAAI,CAClB;YACEC,SAASR,EAAE;QACb,GACA;YACEI;YACAd,QAAQC,WAAWkB,WAAW;QAChC;IAEJ;IAEA,MAAMC,gBAAgBhB,6BAA6B;QACjDiB,sBAAsBb,WAAWc,MAAM,CAACC,IAAI;QAC5CD,QAAQf,IAAIiB,OAAO,CAACF,MAAM;QAC1BG,cAAclB,IAAIiB,OAAO,CAACF,MAAM,CAACG,YAAY;IAC/C;IAEAX,QAAQY,GAAG,CAAC,cAAcN;IAE1B,OAAOJ,SAASC,IAAI,CAClB;QACEC,SAASR,EAAE;IACb,GACA;QACEI;QACAd,QAAQC,WAAW0B,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/logout.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { generateExpiredPayloadCookie } from '../cookies.js'\nimport { logoutOperation } from '../operations/logout.js'\n\nexport const logoutHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n\n  const result = await logoutOperation({\n    allSessions: searchParams.get('allSessions') === 'true',\n    collection,\n    req,\n  })\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  if (!result) {\n    return Response.json(\n      {\n        message: t('error:logoutFailed'),\n      },\n      {\n        headers,\n        status: httpStatus.BAD_REQUEST,\n      },\n    )\n  }\n\n  const expiredCookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    config: req.payload.config,\n    cookiePrefix: req.payload.config.cookiePrefix,\n  })\n\n  headers.set('Set-Cookie', expiredCookie)\n\n  return Response.json(\n    {\n      message: t('authentication:logoutSuccessful'),\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["getRequestCollection","headersWithCors","httpStatus","generateExpiredPayloadCookie","logoutOperation","logoutHandler","req","collection","searchParams","t","result","allSessions","get","headers","Headers","Response","json","message","status","BAD_REQUEST","expiredCookie","collectionAuthConfig","config","auth","payload","cookiePrefix","set","OK"],"mappings":"AAEA,SAASA,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,4BAA4B,QAAQ,gBAAe;AAC5D,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,aAAaP,qBAAqBM;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAE5B,MAAMI,SAAS,MAAMN,gBAAgB;QACnCO,aAAaH,aAAaI,GAAG,CAAC,mBAAmB;QACjDL;QACAD;IACF;IAEA,MAAMO,UAAUZ,gBAAgB;QAC9BY,SAAS,IAAIC;QACbR;IACF;IAEA,IAAI,CAACI,QAAQ;QACX,OAAOK,SAASC,IAAI,CAClB;YACEC,SAASR,EAAE;QACb,GACA;YACEI;YACAK,QAAQhB,WAAWiB,WAAW;QAChC;IAEJ;IAEA,MAAMC,gBAAgBjB,6BAA6B;QACjDkB,sBAAsBd,WAAWe,MAAM,CAACC,IAAI;QAC5CD,QAAQhB,IAAIkB,OAAO,CAACF,MAAM;QAC1BG,cAAcnB,IAAIkB,OAAO,CAACF,MAAM,CAACG,YAAY;IAC/C;IAEAZ,QAAQa,GAAG,CAAC,cAAcN;IAE1B,OAAOL,SAASC,IAAI,CAClB;QACEC,SAASR,EAAE;IACb,GACA;QACEI;QACAK,QAAQhB,WAAWyB,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/me.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAY3D,eAAO,MAAM,SAAS,EAAE,cAoDvB,CAAA"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/me.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAa3D,eAAO,MAAM,SAAS,EAAE,cAoDvB,CAAA"}

package/dist/auth/endpoints/me.js

@@ -1,6 +1,6 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { isNumber } from '../../utilities/isNumber.js';
 import { sanitizeJoinParams } from '../../utilities/sanitizeJoinParams.js';
 import { sanitizePopulateParam } from '../../utilities/sanitizePopulateParam.js';