payload 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee

package/dist/auth/strategies/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { TypedUser } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey)\n        .digest('hex')\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                equals: sha256APIKeyIndex,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { equals: sha256APIKeyIndex }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as TypedUser,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","sha256APIKeyIndex","createHmac","secret","update","digest","where","auth","verify","and","apiKeyIndex","equals","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,MAAMG,oBAAoBZ,OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAIf,iBAAiBgB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,QAAQV;4BACV;wBACF;wBACA;4BACEW,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,QAAQV;oBAAkB;gBAClD;gBAEA,MAAMa,YAAY,MAAMpB,QAAQqB,IAAI,CAAC;oBACnCC,YAAYzB,iBAAiBO,IAAI;oBACjCmB,OAAOxB,YAAY,IAAIF,iBAAiBgB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAGzB,iBAAiBO,IAAI;oBACxCyB,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nimport { getAPIKeyLast4 } from '../baseFields/apiKey/getAPIKeyLast4.js'\nimport { legacyAPIKeyLast4 } from '../baseFields/apiKey/omitAPIKey.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload, req }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      // The stored index was written under whichever secret was active at the\n      // time, so match against the index computed under every keyring secret.\n      const apiKeyIndexes = payload.encryptionKeyring.all.map((key) =>\n        crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'),\n      )\n\n      const requestFallbackLocale = req?.fallbackLocale\n      const requestLocale = req?.locale\n      const requestDepth = req?.query?.depth\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                in: apiKeyIndexes,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { in: apiKeyIndexes }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          fallbackLocale: requestFallbackLocale,\n          limit: 1,\n          locale: requestLocale,\n          overrideAccess: true,\n          pagination: false,\n          req,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          const apiKeyLast4 = getAPIKeyLast4(apiKey)\n\n          if (user?.apiKeyLast4 === legacyAPIKeyLast4 && apiKeyLast4 !== legacyAPIKeyLast4) {\n            try {\n              await payload.db.updateOne({\n                id: user.id,\n                collection: collectionConfig.slug,\n                data: { apiKeyLast4 },\n                req,\n                returning: false,\n              })\n              user.apiKeyLast4 = apiKeyLast4\n            } catch (err) {\n              payload.logger.error({\n                err,\n                msg: `Failed to backfill API key last four for ${collectionConfig.slug} ${user.id}`,\n              })\n            }\n          }\n\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      } finally {\n        if (req) {\n          req.fallbackLocale = requestFallbackLocale!\n          req.locale = requestLocale!\n\n          if (req.query) {\n            req.query.depth = requestDepth\n          }\n        }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","getAPIKeyLast4","legacyAPIKeyLast4","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","req","authHeader","get","startsWith","slug","apiKey","replace","apiKeyIndexes","encryptionKeyring","all","map","key","createHmac","legacyKey","update","digest","requestFallbackLocale","fallbackLocale","requestLocale","locale","requestDepth","query","depth","where","auth","verify","and","apiKeyIndex","in","_verified","not_equals","userQuery","find","collection","limit","overrideAccess","pagination","docs","length","user","apiKeyLast4","db","updateOne","id","data","returning","err","logger","error","msg","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,SAASC,cAAc,QAAQ,yCAAwC;AACvE,SAASC,iBAAiB,QAAQ,qCAAoC;AAEtE,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAEC,GAAG,EAAE;QACjD,MAAMC,aAAaJ,QAAQK,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGP,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGV,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAMG,gBAAgBR,QAAQS,iBAAiB,CAACC,GAAG,CAACC,GAAG,CAAC,CAACC,MACvDnB,OAAOoB,UAAU,CAAC,UAAUD,IAAIE,SAAS,EAAEC,MAAM,CAACT,QAAQU,MAAM,CAAC;YAGnE,MAAMC,wBAAwBhB,KAAKiB;YACnC,MAAMC,gBAAgBlB,KAAKmB;YAC3B,MAAMC,eAAepB,KAAKqB,OAAOC;YAEjC,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAI3B,iBAAiB4B,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,IAAIrB;4BACN;wBACF;wBACA;4BACEsB,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,IAAIrB;oBAAc;gBAC1C;gBAEA,MAAMwB,YAAY,MAAMhC,QAAQiC,IAAI,CAAC;oBACnCC,YAAYrC,iBAAiBQ,IAAI;oBACjCkB,OAAOxB,YAAY,IAAIF,iBAAiB4B,IAAI,CAACF,KAAK;oBAClDL,gBAAgBD;oBAChBkB,OAAO;oBACPf,QAAQD;oBACRiB,gBAAgB;oBAChBC,YAAY;oBACZpC;oBACAuB;gBACF;gBAEA,IAAIQ,UAAUM,IAAI,IAAIN,UAAUM,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOR,UAAUM,IAAI,CAAC,EAAE;oBAC9B,MAAMG,cAAc/C,eAAeY;oBAEnC,IAAIkC,MAAMC,gBAAgB9C,qBAAqB8C,gBAAgB9C,mBAAmB;wBAChF,IAAI;4BACF,MAAMK,QAAQ0C,EAAE,CAACC,SAAS,CAAC;gCACzBC,IAAIJ,KAAKI,EAAE;gCACXV,YAAYrC,iBAAiBQ,IAAI;gCACjCwC,MAAM;oCAAEJ;gCAAY;gCACpBxC;gCACA6C,WAAW;4BACb;4BACAN,KAAKC,WAAW,GAAGA;wBACrB,EAAE,OAAOM,KAAK;4BACZ/C,QAAQgD,MAAM,CAACC,KAAK,CAAC;gCACnBF;gCACAG,KAAK,CAAC,yCAAyC,EAAErD,iBAAiBQ,IAAI,CAAC,CAAC,EAAEmC,KAAKI,EAAE,EAAE;4BACrF;wBACF;oBACF;oBAEAJ,KAAMN,UAAU,GAAGrC,iBAAiBQ,IAAI;oBACxCmC,KAAMW,SAAS,GAAG;oBAElB,OAAO;wBACLX,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOY,QAAQ;gBACf,OAAO;oBAAEZ,MAAM;gBAAK;YACtB,SAAU;gBACR,IAAIvC,KAAK;oBACPA,IAAIiB,cAAc,GAAGD;oBACrBhB,IAAImB,MAAM,GAAGD;oBAEb,IAAIlB,IAAIqB,KAAK,EAAE;wBACbrB,IAAIqB,KAAK,CAACC,KAAK,GAAGF;oBACpB;gBACF;YACF;QACF;QAEA,OAAO;YAAEmB,MAAM;QAAK;IACtB,EAAC"}

package/dist/auth/strategies/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAsE3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAwD/B,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAwH3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAuH/B,CAAA"}

package/dist/auth/strategies/jwt.js

@@ -1,6 +1,35 @@
 import { jwtVerify } from 'jose';
 import { extractJWT } from '../extractJWT.js';
-async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
+import { JWT_AUTH_VERSION } from '../jwtAuth.js';
+const getJWTAuthenticationReference = (token)=>{
+    const { id, collection, sid } = token;
+    if (typeof collection !== 'string' || typeof id !== 'number' && typeof id !== 'string' || typeof sid !== 'undefined' && typeof sid !== 'string') {
+        return null;
+    }
+    return {
+        id,
+        collection,
+        ...sid ? {
+            sid
+        } : {}
+    };
+};
+/**
+ * Verifies a token against every secret in the keyring (active first), so tokens
+ * signed under a previous secret still validate during a bounded rotation.
+ * Throws if no key verifies.
+ */ async function verifyWithKeyring({ payload, token }) {
+    let lastError;
+    for (const key of payload.encryptionKeyring.all){
+        try {
+            return await jwtVerify(token, new TextEncoder().encode(key.legacyKey));
+        } catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError;
+}
+async function autoLogin({ fallbackLocale, isGraphQL, locale, payload, req, strategyName = 'local-jwt' }) {
     if (typeof payload?.config?.admin?.autoLogin !== 'object' || payload.config.admin?.autoLogin.prefillOnly || !payload?.config?.admin?.autoLogin || !payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username) {
         return {
             user: null
@@ -26,8 +55,12 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
     const user = (await payload.find({
         collection: collection.config.slug,
         depth: isGraphQL ? 0 : collection.config.auth.depth,
+        fallbackLocale,
         limit: 1,
+        locale,
+        overrideAccess: true,
         pagination: false,
+        req,
         where
     })).docs[0];
     if (!user) {
@@ -43,7 +76,10 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
 }
 /**
  * Authentication strategy function for JWT tokens
- */ export const JWTAuthentication = async ({ headers, isGraphQL = false, payload, strategyName = 'local-jwt' })=>{
+ */ export const JWTAuthentication = async ({ headers, isGraphQL = false, payload, req, strategyName = 'local-jwt' })=>{
+    const requestFallbackLocale = req?.fallbackLocale;
+    const requestLocale = req?.locale;
+    const requestDepth = req?.query?.depth;
     try {
         const token = extractJWT({
             headers,
@@ -52,8 +88,11 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
         if (!token) {
             if (headers.get('DisableAutologin') !== 'true') {
                 return await autoLogin({
+                    fallbackLocale: requestFallbackLocale,
                     isGraphQL,
+                    locale: requestLocale,
                     payload,
+                    req,
                     strategyName
                 });
             }
@@ -61,23 +100,42 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
                 user: null
             };
         }
-        const secretKey = new TextEncoder().encode(payload.secret);
-        const { payload: decodedPayload } = await jwtVerify(token, secretKey);
-        const collection = payload.collections[decodedPayload.collection];
+        // Verify against every keyring secret so tokens signed under a previous
+        // secret still validate during a bounded rotation. New tokens are always
+        // signed with the active secret.
+        const { payload: decodedPayload, protectedHeader } = await verifyWithKeyring({
+            payload,
+            token
+        });
+        if (protectedHeader.authVersion !== JWT_AUTH_VERSION) {
+            throw new Error('Invalid JWT protected header');
+        }
+        const authenticationReference = getJWTAuthenticationReference(decodedPayload);
+        if (!authenticationReference) {
+            throw new Error('Invalid JWT authentication reference');
+        }
+        const collection = Object.prototype.hasOwnProperty.call(payload.collections, authenticationReference.collection) ? payload.collections[authenticationReference.collection] : undefined;
+        if (!collection?.config.auth || collection.config.auth.disableLocalStrategy) {
+            throw new Error('JWT authentication requires an auth-enabled local collection');
+        }
         const user = await payload.findByID({
-            id: decodedPayload.id,
-            collection: decodedPayload.collection,
-            depth: isGraphQL ? 0 : collection.config.auth.depth
+            id: authenticationReference.id,
+            collection: authenticationReference.collection,
+            depth: isGraphQL ? 0 : collection.config.auth.depth,
+            fallbackLocale: requestFallbackLocale,
+            locale: requestLocale,
+            overrideAccess: true,
+            req
         });
         if (user && (!collection.config.auth.verify || user._verified)) {
             if (collection.config.auth.useSessions) {
-                const existingSession = (user.sessions || []).find(({ id })=>id === decodedPayload.sid);
-                if (!existingSession || !decodedPayload.sid) {
+                const existingSession = (user.sessions || []).find(({ id })=>id === authenticationReference.sid);
+                if (!existingSession || !authenticationReference.sid) {
                     return {
                         user: null
                     };
                 }
-                user._sid = decodedPayload.sid;
+                user._sid = authenticationReference.sid;
             }
             user.collection = collection.config.slug;
             user._strategy = strategyName;
@@ -87,8 +145,11 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
         } else {
             if (headers.get('DisableAutologin') !== 'true') {
                 return await autoLogin({
+                    fallbackLocale: requestFallbackLocale,
                     isGraphQL,
+                    locale: requestLocale,
                     payload,
+                    req,
                     strategyName
                 });
             }
@@ -99,14 +160,25 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
     } catch (ignore) {
         if (headers.get('DisableAutologin') !== 'true') {
             return await autoLogin({
+                fallbackLocale: requestFallbackLocale,
                 isGraphQL,
+                locale: requestLocale,
                 payload,
+                req,
                 strategyName
             });
         }
         return {
             user: null
         };
+    } finally{
+        if (req) {
+            req.fallbackLocale = requestFallbackLocale;
+            req.locale = requestLocale;
+            if (req.query) {
+                req.query.depth = requestDepth;
+            }
+        }
     }
 };
 

package/dist/auth/strategies/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\n\ntype JWTToken = {\n  collection: string\n  id: string\n  sid?: string\n}\n\nasync function autoLogin({\n  isGraphQL,\n  payload,\n  strategyName = 'local-jwt',\n}: {\n  isGraphQL: boolean\n  payload: Payload\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      limit: 1,\n      pagination: false,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  strategyName = 'local-jwt',\n}) => {\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n\n    const secretKey = new TextEncoder().encode(payload.secret)\n    const { payload: decodedPayload } = await jwtVerify<JWTToken>(token, secretKey)\n    const collection = payload.collections[decodedPayload.collection]\n\n    const user = (await payload.findByID({\n      id: decodedPayload.id,\n      collection: decodedPayload.collection,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection!.config.auth.verify || user._verified)) {\n      if (collection!.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(({ id }) => id === decodedPayload.sid)\n\n        if (!existingSession || !decodedPayload.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = decodedPayload.sid\n      }\n\n      user.collection = collection!.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({ isGraphQL, payload, strategyName })\n    }\n    return { user: null }\n  }\n}\n"],"names":["jwtVerify","extractJWT","autoLogin","isGraphQL","payload","strategyName","config","admin","prefillOnly","email","username","user","collection","collections","where","or","push","equals","find","slug","depth","auth","limit","pagination","docs","_strategy","JWTAuthentication","headers","token","get","secretKey","TextEncoder","encode","secret","decodedPayload","findByID","id","verify","_verified","useSessions","existingSession","sessions","sid","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAQ7C,eAAeC,UAAU,EACvBC,SAAS,EACTC,OAAO,EACPC,eAAe,WAAW,EAK3B;IAGC,IACE,OAAOD,SAASE,QAAQC,OAAOL,cAAc,YAC7CE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUM,eAChC,CAACJ,SAASE,QAAQC,OAAOL,aACxB,CAACE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,SAAS,CAACL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMC,aAAaR,QAAQS,WAAW,CAACT,QAAQE,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAMG,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIX,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,OAAO;QACzCK,MAAMC,EAAE,EAAEC,KAAK;YACbP,OAAO;gBACLQ,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO;YAC1C;QACF;IACF,OAAO,IAAIL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAAU;QACnDI,MAAMC,EAAE,EAAEC,KAAK;YACbN,UAAU;gBACRO,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMP,QAAQc,IAAI,CAAC;QACjBN,YAAYA,WAAYN,MAAM,CAACa,IAAI;QACnCC,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACpDE,OAAO;QACPC,YAAY;QACZT;IACF,EAAC,EACDU,IAAI,CAAC,EAAE;IAET,IAAI,CAACb,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;IACzCR,KAAKc,SAAS,GAAGpB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMe,oBAA0C,OAAO,EAC5DC,OAAO,EACPxB,YAAY,KAAK,EACjBC,OAAO,EACPC,eAAe,WAAW,EAC3B;IACC,IAAI;QACF,MAAMuB,QAAQ3B,WAAW;YAAE0B;YAASvB;QAAQ;QAE5C,IAAI,CAACwB,OAAO;YACV,IAAID,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,MAAMmB,YAAY,IAAIC,cAAcC,MAAM,CAAC5B,QAAQ6B,MAAM;QACzD,MAAM,EAAE7B,SAAS8B,cAAc,EAAE,GAAG,MAAMlC,UAAoB4B,OAAOE;QACrE,MAAMlB,aAAaR,QAAQS,WAAW,CAACqB,eAAetB,UAAU,CAAC;QAEjE,MAAMD,OAAQ,MAAMP,QAAQ+B,QAAQ,CAAC;YACnCC,IAAIF,eAAeE,EAAE;YACrBxB,YAAYsB,eAAetB,UAAU;YACrCQ,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACtD;QAEA,IAAIT,QAAS,CAAA,CAACC,WAAYN,MAAM,CAACe,IAAI,CAACgB,MAAM,IAAI1B,KAAK2B,SAAS,AAAD,GAAI;YAC/D,IAAI1B,WAAYN,MAAM,CAACe,IAAI,CAACkB,WAAW,EAAE;gBACvC,MAAMC,kBAAkB,AAAC7B,CAAAA,KAAK8B,QAAQ,IAAI,EAAE,AAAD,EAAGvB,IAAI,CAAC,CAAC,EAAEkB,EAAE,EAAE,GAAKA,OAAOF,eAAeQ,GAAG;gBAExF,IAAI,CAACF,mBAAmB,CAACN,eAAeQ,GAAG,EAAE;oBAC3C,OAAO;wBACL/B,MAAM;oBACR;gBACF;gBAEAA,KAAKgC,IAAI,GAAGT,eAAeQ,GAAG;YAChC;YAEA/B,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;YACzCR,KAAKc,SAAS,GAAGpB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIgB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAOiC,QAAQ;QACf,IAAIjB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAM3B,UAAU;gBAAEC;gBAAWC;gBAASC;YAAa;QAC5D;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, PayloadRequest, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\nimport { JWT_AUTH_VERSION } from '../jwtAuth.js'\n\ntype DecodedJWTPayload = Record<string, unknown>\n\ntype JWTAuthenticationReference = {\n  collection: string\n  id: number | string\n  sid?: string\n}\n\nconst getJWTAuthenticationReference = (\n  token: DecodedJWTPayload,\n): JWTAuthenticationReference | null => {\n  const { id, collection, sid } = token\n\n  if (\n    typeof collection !== 'string' ||\n    (typeof id !== 'number' && typeof id !== 'string') ||\n    (typeof sid !== 'undefined' && typeof sid !== 'string')\n  ) {\n    return null\n  }\n\n  return {\n    id,\n    collection,\n    ...(sid ? { sid } : {}),\n  }\n}\n\n/**\n * Verifies a token against every secret in the keyring (active first), so tokens\n * signed under a previous secret still validate during a bounded rotation.\n * Throws if no key verifies.\n */\nasync function verifyWithKeyring({ payload, token }: { payload: Payload; token: string }) {\n  let lastError: unknown\n  for (const key of payload.encryptionKeyring.all) {\n    try {\n      return await jwtVerify<DecodedJWTPayload>(token, new TextEncoder().encode(key.legacyKey))\n    } catch (error) {\n      lastError = error\n    }\n  }\n  throw lastError\n}\n\nasync function autoLogin({\n  fallbackLocale,\n  isGraphQL,\n  locale,\n  payload,\n  req,\n  strategyName = 'local-jwt',\n}: {\n  fallbackLocale?: PayloadRequest['fallbackLocale']\n  isGraphQL: boolean\n  locale?: PayloadRequest['locale']\n  payload: Payload\n  req?: PayloadRequest\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      fallbackLocale,\n      limit: 1,\n      locale,\n      overrideAccess: true,\n      pagination: false,\n      req,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  req,\n  strategyName = 'local-jwt',\n}) => {\n  const requestFallbackLocale = req?.fallbackLocale\n  const requestLocale = req?.locale\n  const requestDepth = req?.query?.depth\n\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({\n          fallbackLocale: requestFallbackLocale,\n          isGraphQL,\n          locale: requestLocale,\n          payload,\n          req,\n          strategyName,\n        })\n      }\n      return { user: null }\n    }\n\n    // Verify against every keyring secret so tokens signed under a previous\n    // secret still validate during a bounded rotation. New tokens are always\n    // signed with the active secret.\n    const { payload: decodedPayload, protectedHeader } = await verifyWithKeyring({ payload, token })\n\n    if (protectedHeader.authVersion !== JWT_AUTH_VERSION) {\n      throw new Error('Invalid JWT protected header')\n    }\n\n    const authenticationReference = getJWTAuthenticationReference(decodedPayload)\n\n    if (!authenticationReference) {\n      throw new Error('Invalid JWT authentication reference')\n    }\n\n    const collection = Object.prototype.hasOwnProperty.call(\n      payload.collections,\n      authenticationReference.collection,\n    )\n      ? payload.collections[authenticationReference.collection]\n      : undefined\n\n    if (!collection?.config.auth || collection.config.auth.disableLocalStrategy) {\n      throw new Error('JWT authentication requires an auth-enabled local collection')\n    }\n\n    const user = (await payload.findByID({\n      id: authenticationReference.id,\n      collection: authenticationReference.collection,\n      depth: isGraphQL ? 0 : collection.config.auth.depth,\n      fallbackLocale: requestFallbackLocale,\n      locale: requestLocale,\n      overrideAccess: true,\n      req,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection.config.auth.verify || user._verified)) {\n      if (collection.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(\n          ({ id }) => id === authenticationReference.sid,\n        )\n\n        if (!existingSession || !authenticationReference.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = authenticationReference.sid\n      }\n\n      user.collection = collection.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({\n          fallbackLocale: requestFallbackLocale,\n          isGraphQL,\n          locale: requestLocale,\n          payload,\n          req,\n          strategyName,\n        })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({\n        fallbackLocale: requestFallbackLocale,\n        isGraphQL,\n        locale: requestLocale,\n        payload,\n        req,\n        strategyName,\n      })\n    }\n    return { user: null }\n  } finally {\n    if (req) {\n      req.fallbackLocale = requestFallbackLocale!\n      req.locale = requestLocale!\n\n      if (req.query) {\n        req.query.depth = requestDepth\n      }\n    }\n  }\n}\n"],"names":["jwtVerify","extractJWT","JWT_AUTH_VERSION","getJWTAuthenticationReference","token","id","collection","sid","verifyWithKeyring","payload","lastError","key","encryptionKeyring","all","TextEncoder","encode","legacyKey","error","autoLogin","fallbackLocale","isGraphQL","locale","req","strategyName","config","admin","prefillOnly","email","username","user","collections","where","or","push","equals","find","slug","depth","auth","limit","overrideAccess","pagination","docs","_strategy","JWTAuthentication","headers","requestFallbackLocale","requestLocale","requestDepth","query","get","decodedPayload","protectedHeader","authVersion","Error","authenticationReference","Object","prototype","hasOwnProperty","call","undefined","disableLocalStrategy","findByID","verify","_verified","useSessions","existingSession","sessions","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAC7C,SAASC,gBAAgB,QAAQ,gBAAe;AAUhD,MAAMC,gCAAgC,CACpCC;IAEA,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAEC,GAAG,EAAE,GAAGH;IAEhC,IACE,OAAOE,eAAe,YACrB,OAAOD,OAAO,YAAY,OAAOA,OAAO,YACxC,OAAOE,QAAQ,eAAe,OAAOA,QAAQ,UAC9C;QACA,OAAO;IACT;IAEA,OAAO;QACLF;QACAC;QACA,GAAIC,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;AACF;AAEA;;;;CAIC,GACD,eAAeC,kBAAkB,EAAEC,OAAO,EAAEL,KAAK,EAAuC;IACtF,IAAIM;IACJ,KAAK,MAAMC,OAAOF,QAAQG,iBAAiB,CAACC,GAAG,CAAE;QAC/C,IAAI;YACF,OAAO,MAAMb,UAA6BI,OAAO,IAAIU,cAAcC,MAAM,CAACJ,IAAIK,SAAS;QACzF,EAAE,OAAOC,OAAO;YACdP,YAAYO;QACd;IACF;IACA,MAAMP;AACR;AAEA,eAAeQ,UAAU,EACvBC,cAAc,EACdC,SAAS,EACTC,MAAM,EACNZ,OAAO,EACPa,GAAG,EACHC,eAAe,WAAW,EAQ3B;IAGC,IACE,OAAOd,SAASe,QAAQC,OAAOP,cAAc,YAC7CT,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUQ,eAChC,CAACjB,SAASe,QAAQC,OAAOP,aACxB,CAACT,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUS,SAAS,CAAClB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUU,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMvB,aAAaG,QAAQqB,WAAW,CAACrB,QAAQe,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAME,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIvB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUS,OAAO;QACzCI,MAAMC,EAAE,EAAEC,KAAK;YACbN,OAAO;gBACLO,QAAQzB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUS;YAC1C;QACF;IACF,OAAO,IAAIlB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUU,UAAU;QACnDG,MAAMC,EAAE,EAAEC,KAAK;YACbL,UAAU;gBACRM,QAAQzB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUU;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMpB,QAAQ0B,IAAI,CAAC;QACjB7B,YAAYA,WAAYkB,MAAM,CAACY,IAAI;QACnCC,OAAOjB,YAAY,IAAId,WAAYkB,MAAM,CAACc,IAAI,CAACD,KAAK;QACpDlB;QACAoB,OAAO;QACPlB;QACAmB,gBAAgB;QAChBC,YAAY;QACZnB;QACAS;IACF,EAAC,EACDW,IAAI,CAAC,EAAE;IAET,IAAI,CAACb,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKvB,UAAU,GAAGA,WAAYkB,MAAM,CAACY,IAAI;IACzCP,KAAKc,SAAS,GAAGpB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMe,oBAA0C,OAAO,EAC5DC,OAAO,EACPzB,YAAY,KAAK,EACjBX,OAAO,EACPa,GAAG,EACHC,eAAe,WAAW,EAC3B;IACC,MAAMuB,wBAAwBxB,KAAKH;IACnC,MAAM4B,gBAAgBzB,KAAKD;IAC3B,MAAM2B,eAAe1B,KAAK2B,OAAOZ;IAEjC,IAAI;QACF,MAAMjC,QAAQH,WAAW;YAAE4C;YAASpC;QAAQ;QAE5C,IAAI,CAACL,OAAO;YACV,IAAIyC,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMhC,UAAU;oBACrBC,gBAAgB2B;oBAChB1B;oBACAC,QAAQ0B;oBACRtC;oBACAa;oBACAC;gBACF;YACF;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,wEAAwE;QACxE,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,EAAEpB,SAAS0C,cAAc,EAAEC,eAAe,EAAE,GAAG,MAAM5C,kBAAkB;YAAEC;YAASL;QAAM;QAE9F,IAAIgD,gBAAgBC,WAAW,KAAKnD,kBAAkB;YACpD,MAAM,IAAIoD,MAAM;QAClB;QAEA,MAAMC,0BAA0BpD,8BAA8BgD;QAE9D,IAAI,CAACI,yBAAyB;YAC5B,MAAM,IAAID,MAAM;QAClB;QAEA,MAAMhD,aAAakD,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CACrDlD,QAAQqB,WAAW,EACnByB,wBAAwBjD,UAAU,IAEhCG,QAAQqB,WAAW,CAACyB,wBAAwBjD,UAAU,CAAC,GACvDsD;QAEJ,IAAI,CAACtD,YAAYkB,OAAOc,QAAQhC,WAAWkB,MAAM,CAACc,IAAI,CAACuB,oBAAoB,EAAE;YAC3E,MAAM,IAAIP,MAAM;QAClB;QAEA,MAAMzB,OAAQ,MAAMpB,QAAQqD,QAAQ,CAAC;YACnCzD,IAAIkD,wBAAwBlD,EAAE;YAC9BC,YAAYiD,wBAAwBjD,UAAU;YAC9C+B,OAAOjB,YAAY,IAAId,WAAWkB,MAAM,CAACc,IAAI,CAACD,KAAK;YACnDlB,gBAAgB2B;YAChBzB,QAAQ0B;YACRP,gBAAgB;YAChBlB;QACF;QAEA,IAAIO,QAAS,CAAA,CAACvB,WAAWkB,MAAM,CAACc,IAAI,CAACyB,MAAM,IAAIlC,KAAKmC,SAAS,AAAD,GAAI;YAC9D,IAAI1D,WAAWkB,MAAM,CAACc,IAAI,CAAC2B,WAAW,EAAE;gBACtC,MAAMC,kBAAkB,AAACrC,CAAAA,KAAKsC,QAAQ,IAAI,EAAE,AAAD,EAAGhC,IAAI,CAChD,CAAC,EAAE9B,EAAE,EAAE,GAAKA,OAAOkD,wBAAwBhD,GAAG;gBAGhD,IAAI,CAAC2D,mBAAmB,CAACX,wBAAwBhD,GAAG,EAAE;oBACpD,OAAO;wBACLsB,MAAM;oBACR;gBACF;gBAEAA,KAAKuC,IAAI,GAAGb,wBAAwBhD,GAAG;YACzC;YAEAsB,KAAKvB,UAAU,GAAGA,WAAWkB,MAAM,CAACY,IAAI;YACxCP,KAAKc,SAAS,GAAGpB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIgB,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMhC,UAAU;oBACrBC,gBAAgB2B;oBAChB1B;oBACAC,QAAQ0B;oBACRtC;oBACAa;oBACAC;gBACF;YACF;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAOwC,QAAQ;QACf,IAAIxB,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAMhC,UAAU;gBACrBC,gBAAgB2B;gBAChB1B;gBACAC,QAAQ0B;gBACRtC;gBACAa;gBACAC;YACF;QACF;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB,SAAU;QACR,IAAIP,KAAK;YACPA,IAAIH,cAAc,GAAG2B;YACrBxB,IAAID,MAAM,GAAG0B;YAEb,IAAIzB,IAAI2B,KAAK,EAAE;gBACb3B,IAAI2B,KAAK,CAACZ,KAAK,GAAGW;YACpB;QACF;IACF;AACF,EAAC"}

package/dist/auth/strategies/local/authenticate.d.ts

@@ -1,9 +1,13 @@
 import type { TypeWithID } from '../../../collections/config/types.js';
 type Doc = Record<string, unknown> & TypeWithID;
+type AuthenticationResult = {
+    doc: Doc;
+    shouldUpdatePasswordHash: boolean;
+};
 type Args = {
     doc: Doc;
     password: string;
 };
-export declare const authenticateLocalStrategy: ({ doc, password }: Args) => Promise<Doc | null>;
+export declare const authenticateLocalStrategy: ({ doc, password, }: Args) => Promise<AuthenticationResult | null>;
 export {};
 //# sourceMappingURL=authenticate.d.ts.map

package/dist/auth/strategies/local/authenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/authenticate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEtE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;AAE/C,KAAK,IAAI,GAAG;IACV,GAAG,EAAE,GAAG,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAU,mBAAmB,IAAI,KAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CA+B3F,CAAA"}
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/authenticate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAItE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;AAE/C,KAAK,oBAAoB,GAAG;IAC1B,GAAG,EAAE,GAAG,CAAA;IACR,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,KAAK,IAAI,GAAG;IACV,GAAG,EAAE,GAAG,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,yBAAyB,uBAGnC,IAAI,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAmC5C,CAAA"}

package/dist/auth/strategies/local/authenticate.js

@@ -1,17 +1,22 @@
 // @ts-strict-ignore
 import crypto from 'crypto';
+import { getPasswordHashParameters, isCurrentPasswordHash } from './generatePasswordSaltHash.js';
 export const authenticateLocalStrategy = async ({ doc, password })=>{
     try {
         const { hash, salt } = doc;
         if (typeof salt === 'string' && typeof hash === 'string') {
+            const { hash: storedHash, iterations, keyLength } = getPasswordHashParameters(hash);
             const res = await new Promise((resolve, reject)=>{
-                crypto.pbkdf2(password, salt, 25000, 512, 'sha256', (e, hashBuffer)=>{
+                crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (e, hashBuffer)=>{
                     if (e) {
                         reject(e);
                     }
-                    const storedHashBuffer = Buffer.from(hash, 'hex');
+                    const storedHashBuffer = Buffer.from(storedHash, 'hex');
                     if (hashBuffer.length === storedHashBuffer.length && crypto.timingSafeEqual(hashBuffer, storedHashBuffer)) {
-                        resolve(doc);
+                        resolve({
+                            doc,
+                            shouldUpdatePasswordHash: !isCurrentPasswordHash(hash)
+                        });
                     } else {
                         reject(new Error('Invalid password'));
                     }

package/dist/auth/strategies/local/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/authenticate.ts"],"sourcesContent":["// @ts-strict-ignore\nimport crypto from 'crypto'\n\nimport type { TypeWithID } from '../../../collections/config/types.js'\n\ntype Doc = Record<string, unknown> & TypeWithID\n\ntype Args = {\n  doc: Doc\n  password: string\n}\n\nexport const authenticateLocalStrategy = async ({ doc, password }: Args): Promise<Doc | null> => {\n  try {\n    const { hash, salt } = doc\n\n    if (typeof salt === 'string' && typeof hash === 'string') {\n      const res = await new Promise<Doc | null>((resolve, reject) => {\n        crypto.pbkdf2(password, salt, 25000, 512, 'sha256', (e, hashBuffer) => {\n          if (e) {\n            reject(e)\n          }\n\n          const storedHashBuffer = Buffer.from(hash, 'hex')\n\n          if (\n            hashBuffer.length === storedHashBuffer.length &&\n            crypto.timingSafeEqual(hashBuffer, storedHashBuffer)\n          ) {\n            resolve(doc)\n          } else {\n            reject(new Error('Invalid password'))\n          }\n        })\n      })\n\n      return res\n    }\n\n    return null\n  } catch (ignore) {\n    return null\n  }\n}\n"],"names":["crypto","authenticateLocalStrategy","doc","password","hash","salt","res","Promise","resolve","reject","pbkdf2","e","hashBuffer","storedHashBuffer","Buffer","from","length","timingSafeEqual","Error","ignore"],"mappings":"AAAA,oBAAoB;AACpB,OAAOA,YAAY,SAAQ;AAW3B,OAAO,MAAMC,4BAA4B,OAAO,EAAEC,GAAG,EAAEC,QAAQ,EAAQ;IACrE,IAAI;QACF,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGH;QAEvB,IAAI,OAAOG,SAAS,YAAY,OAAOD,SAAS,UAAU;YACxD,MAAME,MAAM,MAAM,IAAIC,QAAoB,CAACC,SAASC;gBAClDT,OAAOU,MAAM,CAACP,UAAUE,MAAM,OAAO,KAAK,UAAU,CAACM,GAAGC;oBACtD,IAAID,GAAG;wBACLF,OAAOE;oBACT;oBAEA,MAAME,mBAAmBC,OAAOC,IAAI,CAACX,MAAM;oBAE3C,IACEQ,WAAWI,MAAM,KAAKH,iBAAiBG,MAAM,IAC7ChB,OAAOiB,eAAe,CAACL,YAAYC,mBACnC;wBACAL,QAAQN;oBACV,OAAO;wBACLO,OAAO,IAAIS,MAAM;oBACnB;gBACF;YACF;YAEA,OAAOZ;QACT;QAEA,OAAO;IACT,EAAE,OAAOa,QAAQ;QACf,OAAO;IACT;AACF,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/authenticate.ts"],"sourcesContent":["// @ts-strict-ignore\nimport crypto from 'crypto'\n\nimport type { TypeWithID } from '../../../collections/config/types.js'\n\nimport { getPasswordHashParameters, isCurrentPasswordHash } from './generatePasswordSaltHash.js'\n\ntype Doc = Record<string, unknown> & TypeWithID\n\ntype AuthenticationResult = {\n  doc: Doc\n  shouldUpdatePasswordHash: boolean\n}\n\ntype Args = {\n  doc: Doc\n  password: string\n}\n\nexport const authenticateLocalStrategy = async ({\n  doc,\n  password,\n}: Args): Promise<AuthenticationResult | null> => {\n  try {\n    const { hash, salt } = doc\n\n    if (typeof salt === 'string' && typeof hash === 'string') {\n      const { hash: storedHash, iterations, keyLength } = getPasswordHashParameters(hash)\n      const res = await new Promise<AuthenticationResult | null>((resolve, reject) => {\n        crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (e, hashBuffer) => {\n          if (e) {\n            reject(e)\n          }\n\n          const storedHashBuffer = Buffer.from(storedHash, 'hex')\n\n          if (\n            hashBuffer.length === storedHashBuffer.length &&\n            crypto.timingSafeEqual(hashBuffer, storedHashBuffer)\n          ) {\n            resolve({\n              doc,\n              shouldUpdatePasswordHash: !isCurrentPasswordHash(hash),\n            })\n          } else {\n            reject(new Error('Invalid password'))\n          }\n        })\n      })\n\n      return res\n    }\n\n    return null\n  } catch (ignore) {\n    return null\n  }\n}\n"],"names":["crypto","getPasswordHashParameters","isCurrentPasswordHash","authenticateLocalStrategy","doc","password","hash","salt","storedHash","iterations","keyLength","res","Promise","resolve","reject","pbkdf2","e","hashBuffer","storedHashBuffer","Buffer","from","length","timingSafeEqual","shouldUpdatePasswordHash","Error","ignore"],"mappings":"AAAA,oBAAoB;AACpB,OAAOA,YAAY,SAAQ;AAI3B,SAASC,yBAAyB,EAAEC,qBAAqB,QAAQ,gCAA+B;AAchG,OAAO,MAAMC,4BAA4B,OAAO,EAC9CC,GAAG,EACHC,QAAQ,EACH;IACL,IAAI;QACF,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGH;QAEvB,IAAI,OAAOG,SAAS,YAAY,OAAOD,SAAS,UAAU;YACxD,MAAM,EAAEA,MAAME,UAAU,EAAEC,UAAU,EAAEC,SAAS,EAAE,GAAGT,0BAA0BK;YAC9E,MAAMK,MAAM,MAAM,IAAIC,QAAqC,CAACC,SAASC;gBACnEd,OAAOe,MAAM,CAACV,UAAUE,MAAME,YAAYC,WAAW,UAAU,CAACM,GAAGC;oBACjE,IAAID,GAAG;wBACLF,OAAOE;oBACT;oBAEA,MAAME,mBAAmBC,OAAOC,IAAI,CAACZ,YAAY;oBAEjD,IACES,WAAWI,MAAM,KAAKH,iBAAiBG,MAAM,IAC7CrB,OAAOsB,eAAe,CAACL,YAAYC,mBACnC;wBACAL,QAAQ;4BACNT;4BACAmB,0BAA0B,CAACrB,sBAAsBI;wBACnD;oBACF,OAAO;wBACLQ,OAAO,IAAIU,MAAM;oBACnB;gBACF;YACF;YAEA,OAAOb;QACT;QAEA,OAAO;IACT,EAAE,OAAOc,QAAQ;QACf,OAAO;IACT;AACF,EAAC"}

package/dist/auth/strategies/local/generatePasswordSaltHash.d.ts

@@ -1,13 +1,21 @@
 import type { SanitizedCollectionConfig } from '../../../collections/config/types.js';
 import type { PayloadRequest } from '../../../types/index.js';
+type PasswordHashParameters = {
+    hash: string;
+    iterations: number;
+    keyLength: number;
+};
 type Args = {
     collection: SanitizedCollectionConfig;
+    isPasswordAuthenticated?: boolean;
     password: string;
     req: PayloadRequest;
 };
-export declare const generatePasswordSaltHash: ({ collection, password: passwordToSet, req, }: Args) => Promise<{
+export declare const generatePasswordSaltHash: ({ collection, isPasswordAuthenticated, password: passwordToSet, req, }: Args) => Promise<{
     hash: string;
     salt: string;
 }>;
+export declare const getPasswordHashParameters: (hash: string) => PasswordHashParameters;
+export declare const isCurrentPasswordHash: (hash: unknown) => hash is string;
 export {};
 //# sourceMappingURL=generatePasswordSaltHash.d.ts.map

package/dist/auth/strategies/local/generatePasswordSaltHash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generatePasswordSaltHash.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAmB7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAU,+CAI5C,IAAI,KAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4B/C,CAAA"}
+{"version":3,"file":"generatePasswordSaltHash.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAK7D,KAAK,sBAAsB,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAQD,eAAO,MAAM,wBAAwB,2EAKlC,IAAI,KAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAmC/C,CAAA;AAED,eAAO,MAAM,yBAAyB,SAAU,MAAM,KAAG,sBAcxD,CAAA;AAED,eAAO,MAAM,qBAAqB,SAAU,OAAO,KAAG,IAAI,IAAI,MACU,CAAA"}

package/dist/auth/strategies/local/generatePasswordSaltHash.js

@@ -1,48 +1,75 @@
 import crypto from 'crypto';
 import { ValidationError } from '../../../errors/index.js';
 import { password } from '../../../fields/validations.js';
-function randomBytes() {
-    return new Promise((resolve, reject)=>crypto.randomBytes(32, (err, saltBuffer)=>err ? reject(err) : resolve(saltBuffer)));
-}
-function pbkdf2Promisified(password, salt) {
-    return new Promise((resolve, reject)=>crypto.pbkdf2(password, salt, 25000, 512, 'sha256', (err, hashRaw)=>err ? reject(err) : resolve(hashRaw)));
-}
-export const generatePasswordSaltHash = async ({ collection, password: passwordToSet, req })=>{
-    const validationResult = password(passwordToSet, {
-        name: 'password',
-        type: 'text',
-        blockData: {},
-        data: {},
-        event: 'submit',
-        path: [
-            'password'
-        ],
-        preferences: {
-            fields: {}
-        },
-        req,
-        required: true,
-        siblingData: {}
-    });
-    if (typeof validationResult === 'string') {
-        throw new ValidationError({
-            collection: collection?.slug,
-            errors: [
-                {
-                    message: validationResult,
-                    path: 'password'
-                }
-            ]
+const currentPasswordHashPrefix = 'pbkdf2-sha256-v1:';
+const currentPasswordHashIterations = 600000;
+const currentPasswordHashKeyLength = 32;
+const legacyPasswordHashIterations = 25000;
+const legacyPasswordHashKeyLength = 512;
+export const generatePasswordSaltHash = async ({ collection, isPasswordAuthenticated, password: passwordToSet, req })=>{
+    if (!isPasswordAuthenticated) {
+        const validationResult = password(passwordToSet, {
+            name: 'password',
+            type: 'text',
+            blockData: {},
+            data: {},
+            event: 'submit',
+            path: [
+                'password'
+            ],
+            preferences: {
+                fields: {}
+            },
+            req,
+            required: true,
+            siblingData: {}
         });
+        if (typeof validationResult === 'string') {
+            throw new ValidationError({
+                collection: collection?.slug,
+                errors: [
+                    {
+                        message: validationResult,
+                        path: 'password'
+                    }
+                ]
+            });
+        }
     }
     const saltBuffer = await randomBytes();
     const salt = saltBuffer.toString('hex');
-    const hashRaw = await pbkdf2Promisified(passwordToSet, salt);
-    const hash = hashRaw.toString('hex');
+    const hashRaw = await pbkdf2Promisified({
+        iterations: currentPasswordHashIterations,
+        keyLength: currentPasswordHashKeyLength,
+        password: passwordToSet,
+        salt
+    });
+    const hash = `${currentPasswordHashPrefix}${hashRaw.toString('hex')}`;
     return {
         hash,
         salt
     };
 };
+export const getPasswordHashParameters = (hash)=>{
+    if (isCurrentPasswordHash(hash)) {
+        return {
+            hash: hash.slice(currentPasswordHashPrefix.length),
+            iterations: currentPasswordHashIterations,
+            keyLength: currentPasswordHashKeyLength
+        };
+    }
+    return {
+        hash,
+        iterations: legacyPasswordHashIterations,
+        keyLength: legacyPasswordHashKeyLength
+    };
+};
+export const isCurrentPasswordHash = (hash)=>typeof hash === 'string' && hash.startsWith(currentPasswordHashPrefix);
+function randomBytes() {
+    return new Promise((resolve, reject)=>crypto.randomBytes(32, (err, saltBuffer)=>err ? reject(err) : resolve(saltBuffer)));
+}
+function pbkdf2Promisified({ iterations, keyLength, password, salt }) {
+    return new Promise((resolve, reject)=>crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (err, hashRaw)=>err ? reject(err) : resolve(hashRaw)));
+}
 
 //# sourceMappingURL=generatePasswordSaltHash.js.map

package/dist/auth/strategies/local/generatePasswordSaltHash.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { PayloadRequest } from '../../../types/index.js'\n\nimport { ValidationError } from '../../../errors/index.js'\nimport { password } from '../../../fields/validations.js'\n\nfunction randomBytes(): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.randomBytes(32, (err, saltBuffer) => (err ? reject(err) : resolve(saltBuffer))),\n  )\n}\n\nfunction pbkdf2Promisified(password: string, salt: string): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.pbkdf2(password, salt, 25000, 512, 'sha256', (err, hashRaw) =>\n      err ? reject(err) : resolve(hashRaw),\n    ),\n  )\n}\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  password: string\n  req: PayloadRequest\n}\n\nexport const generatePasswordSaltHash = async ({\n  collection,\n  password: passwordToSet,\n  req,\n}: Args): Promise<{ hash: string; salt: string }> => {\n  const validationResult = password(passwordToSet, {\n    name: 'password',\n    type: 'text',\n    blockData: {},\n    data: {},\n    event: 'submit',\n    path: ['password'],\n    preferences: { fields: {} },\n    req,\n    required: true,\n    siblingData: {},\n  })\n\n  if (typeof validationResult === 'string') {\n    throw new ValidationError({\n      collection: collection?.slug,\n      errors: [{ message: validationResult, path: 'password' }],\n    })\n  }\n\n  const saltBuffer = await randomBytes()\n  const salt = saltBuffer.toString('hex')\n\n  const hashRaw = await pbkdf2Promisified(passwordToSet, salt)\n  const hash = hashRaw.toString('hex')\n\n  return { hash, salt }\n}\n"],"names":["crypto","ValidationError","password","randomBytes","Promise","resolve","reject","err","saltBuffer","pbkdf2Promisified","salt","pbkdf2","hashRaw","generatePasswordSaltHash","collection","passwordToSet","req","validationResult","name","type","blockData","data","event","path","preferences","fields","required","siblingData","slug","errors","message","toString","hash"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAK3B,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,QAAQ,QAAQ,iCAAgC;AAEzD,SAASC;IACP,OAAO,IAAIC,QAAQ,CAACC,SAASC,SAC3BN,OAAOG,WAAW,CAAC,IAAI,CAACI,KAAKC,aAAgBD,MAAMD,OAAOC,OAAOF,QAAQG;AAE7E;AAEA,SAASC,kBAAkBP,QAAgB,EAAEQ,IAAY;IACvD,OAAO,IAAIN,QAAQ,CAACC,SAASC,SAC3BN,OAAOW,MAAM,CAACT,UAAUQ,MAAM,OAAO,KAAK,UAAU,CAACH,KAAKK,UACxDL,MAAMD,OAAOC,OAAOF,QAAQO;AAGlC;AAQA,OAAO,MAAMC,2BAA2B,OAAO,EAC7CC,UAAU,EACVZ,UAAUa,aAAa,EACvBC,GAAG,EACE;IACL,MAAMC,mBAAmBf,SAASa,eAAe;QAC/CG,MAAM;QACNC,MAAM;QACNC,WAAW,CAAC;QACZC,MAAM,CAAC;QACPC,OAAO;QACPC,MAAM;YAAC;SAAW;QAClBC,aAAa;YAAEC,QAAQ,CAAC;QAAE;QAC1BT;QACAU,UAAU;QACVC,aAAa,CAAC;IAChB;IAEA,IAAI,OAAOV,qBAAqB,UAAU;QACxC,MAAM,IAAIhB,gBAAgB;YACxBa,YAAYA,YAAYc;YACxBC,QAAQ;gBAAC;oBAAEC,SAASb;oBAAkBM,MAAM;gBAAW;aAAE;QAC3D;IACF;IAEA,MAAMf,aAAa,MAAML;IACzB,MAAMO,OAAOF,WAAWuB,QAAQ,CAAC;IAEjC,MAAMnB,UAAU,MAAMH,kBAAkBM,eAAeL;IACvD,MAAMsB,OAAOpB,QAAQmB,QAAQ,CAAC;IAE9B,OAAO;QAAEC;QAAMtB;IAAK;AACtB,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { PayloadRequest } from '../../../types/index.js'\n\nimport { ValidationError } from '../../../errors/index.js'\nimport { password } from '../../../fields/validations.js'\n\ntype PasswordHashParameters = {\n  hash: string\n  iterations: number\n  keyLength: number\n}\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  isPasswordAuthenticated?: boolean\n  password: string\n  req: PayloadRequest\n}\n\nconst currentPasswordHashPrefix = 'pbkdf2-sha256-v1:'\nconst currentPasswordHashIterations = 600000\nconst currentPasswordHashKeyLength = 32\nconst legacyPasswordHashIterations = 25000\nconst legacyPasswordHashKeyLength = 512\n\nexport const generatePasswordSaltHash = async ({\n  collection,\n  isPasswordAuthenticated,\n  password: passwordToSet,\n  req,\n}: Args): Promise<{ hash: string; salt: string }> => {\n  if (!isPasswordAuthenticated) {\n    const validationResult = password(passwordToSet, {\n      name: 'password',\n      type: 'text',\n      blockData: {},\n      data: {},\n      event: 'submit',\n      path: ['password'],\n      preferences: { fields: {} },\n      req,\n      required: true,\n      siblingData: {},\n    })\n\n    if (typeof validationResult === 'string') {\n      throw new ValidationError({\n        collection: collection?.slug,\n        errors: [{ message: validationResult, path: 'password' }],\n      })\n    }\n  }\n\n  const saltBuffer = await randomBytes()\n  const salt = saltBuffer.toString('hex')\n\n  const hashRaw = await pbkdf2Promisified({\n    iterations: currentPasswordHashIterations,\n    keyLength: currentPasswordHashKeyLength,\n    password: passwordToSet,\n    salt,\n  })\n  const hash = `${currentPasswordHashPrefix}${hashRaw.toString('hex')}`\n\n  return { hash, salt }\n}\n\nexport const getPasswordHashParameters = (hash: string): PasswordHashParameters => {\n  if (isCurrentPasswordHash(hash)) {\n    return {\n      hash: hash.slice(currentPasswordHashPrefix.length),\n      iterations: currentPasswordHashIterations,\n      keyLength: currentPasswordHashKeyLength,\n    }\n  }\n\n  return {\n    hash,\n    iterations: legacyPasswordHashIterations,\n    keyLength: legacyPasswordHashKeyLength,\n  }\n}\n\nexport const isCurrentPasswordHash = (hash: unknown): hash is string =>\n  typeof hash === 'string' && hash.startsWith(currentPasswordHashPrefix)\n\nfunction randomBytes(): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.randomBytes(32, (err, saltBuffer) => (err ? reject(err) : resolve(saltBuffer))),\n  )\n}\n\nfunction pbkdf2Promisified({\n  iterations,\n  keyLength,\n  password,\n  salt,\n}: {\n  iterations: number\n  keyLength: number\n  password: string\n  salt: string\n}): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (err, hashRaw) =>\n      err ? reject(err) : resolve(hashRaw),\n    ),\n  )\n}\n"],"names":["crypto","ValidationError","password","currentPasswordHashPrefix","currentPasswordHashIterations","currentPasswordHashKeyLength","legacyPasswordHashIterations","legacyPasswordHashKeyLength","generatePasswordSaltHash","collection","isPasswordAuthenticated","passwordToSet","req","validationResult","name","type","blockData","data","event","path","preferences","fields","required","siblingData","slug","errors","message","saltBuffer","randomBytes","salt","toString","hashRaw","pbkdf2Promisified","iterations","keyLength","hash","getPasswordHashParameters","isCurrentPasswordHash","slice","length","startsWith","Promise","resolve","reject","err","pbkdf2"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAK3B,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,QAAQ,QAAQ,iCAAgC;AAezD,MAAMC,4BAA4B;AAClC,MAAMC,gCAAgC;AACtC,MAAMC,+BAA+B;AACrC,MAAMC,+BAA+B;AACrC,MAAMC,8BAA8B;AAEpC,OAAO,MAAMC,2BAA2B,OAAO,EAC7CC,UAAU,EACVC,uBAAuB,EACvBR,UAAUS,aAAa,EACvBC,GAAG,EACE;IACL,IAAI,CAACF,yBAAyB;QAC5B,MAAMG,mBAAmBX,SAASS,eAAe;YAC/CG,MAAM;YACNC,MAAM;YACNC,WAAW,CAAC;YACZC,MAAM,CAAC;YACPC,OAAO;YACPC,MAAM;gBAAC;aAAW;YAClBC,aAAa;gBAAEC,QAAQ,CAAC;YAAE;YAC1BT;YACAU,UAAU;YACVC,aAAa,CAAC;QAChB;QAEA,IAAI,OAAOV,qBAAqB,UAAU;YACxC,MAAM,IAAIZ,gBAAgB;gBACxBQ,YAAYA,YAAYe;gBACxBC,QAAQ;oBAAC;wBAAEC,SAASb;wBAAkBM,MAAM;oBAAW;iBAAE;YAC3D;QACF;IACF;IAEA,MAAMQ,aAAa,MAAMC;IACzB,MAAMC,OAAOF,WAAWG,QAAQ,CAAC;IAEjC,MAAMC,UAAU,MAAMC,kBAAkB;QACtCC,YAAY7B;QACZ8B,WAAW7B;QACXH,UAAUS;QACVkB;IACF;IACA,MAAMM,OAAO,GAAGhC,4BAA4B4B,QAAQD,QAAQ,CAAC,QAAQ;IAErE,OAAO;QAAEK;QAAMN;IAAK;AACtB,EAAC;AAED,OAAO,MAAMO,4BAA4B,CAACD;IACxC,IAAIE,sBAAsBF,OAAO;QAC/B,OAAO;YACLA,MAAMA,KAAKG,KAAK,CAACnC,0BAA0BoC,MAAM;YACjDN,YAAY7B;YACZ8B,WAAW7B;QACb;IACF;IAEA,OAAO;QACL8B;QACAF,YAAY3B;QACZ4B,WAAW3B;IACb;AACF,EAAC;AAED,OAAO,MAAM8B,wBAAwB,CAACF,OACpC,OAAOA,SAAS,YAAYA,KAAKK,UAAU,CAACrC,2BAA0B;AAExE,SAASyB;IACP,OAAO,IAAIa,QAAQ,CAACC,SAASC,SAC3B3C,OAAO4B,WAAW,CAAC,IAAI,CAACgB,KAAKjB,aAAgBiB,MAAMD,OAAOC,OAAOF,QAAQf;AAE7E;AAEA,SAASK,kBAAkB,EACzBC,UAAU,EACVC,SAAS,EACThC,QAAQ,EACR2B,IAAI,EAML;IACC,OAAO,IAAIY,QAAQ,CAACC,SAASC,SAC3B3C,OAAO6C,MAAM,CAAC3C,UAAU2B,MAAMI,YAAYC,WAAW,UAAU,CAACU,KAAKb,UACnEa,MAAMD,OAAOC,OAAOF,QAAQX;AAGlC"}

package/dist/auth/strategies/local/incrementLoginAttempts.d.ts

@@ -1,9 +1,9 @@
 import type { SanitizedCollectionConfig } from '../../../collections/config/types.js';
-import { type Payload, type TypedUser } from '../../../index.js';
+import { type Payload, type User } from '../../../index.js';
 type Args = {
     collection: SanitizedCollectionConfig;
     payload: Payload;
-    user: TypedUser;
+    user: User;
 };
 export declare const incrementLoginAttempts: ({ collection, payload, user, }: Args) => Promise<void>;
 export {};

package/dist/auth/strategies/local/incrementLoginAttempts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAGjF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,SAAS,CAAA;CAChB,CAAA;AAID,eAAO,MAAM,sBAAsB,GAAU,gCAI1C,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}
+{"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG5E,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAID,eAAO,MAAM,sBAAsB,mCAIhC,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}

package/dist/auth/strategies/local/incrementLoginAttempts.js

@@ -92,7 +92,7 @@ export const incrementLoginAttempts = async ({ collection, payload, user })=>{
             if (currentUser?.sessions?.length) {
                 // Does not hurt also removing expired sessions
                 currentUser.sessions = currentUser.sessions.filter((session)=>{
-                    const sessionCreatedAt = new Date(session.createdAt);
+                    const sessionCreatedAt = new Date(session.createdAt ?? 0);
                     const twentySecondsAgo = new Date(currentTime - 20000);
                     // Remove sessions created within the last 20 seconds
                     return sessionCreatedAt <= twentySecondsAgo;

package/dist/auth/strategies/local/incrementLoginAttempts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\n\nimport { type JsonObject, type Payload, type TypedUser } from '../../../index.js'\nimport { isUserLocked } from '../../isUserLocked.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  payload: Payload\n  user: TypedUser\n}\n\n// Note: this function does not use req in its updates, as we want those to be visible in parallel requests that are on a different\n// transaction. At the same time, we want updates from parallel requests to be visible here.\nexport const incrementLoginAttempts = async ({\n  collection,\n  payload,\n  user,\n}: Args): Promise<void> => {\n  const {\n    auth: { lockTime, maxLoginAttempts },\n  } = collection\n\n  const currentTime = Date.now()\n\n  let updatedLockUntil: null | string = null\n  let updatedLoginAttempts: null | number = null\n\n  if (user.lockUntil && !isUserLocked(new Date(user.lockUntil))) {\n    // Expired lock, restart count at 1\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: null,\n        loginAttempts: 1,\n      },\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n    user.lockUntil = updatedLockUntil\n  } else {\n    const data: JsonObject = {\n      loginAttempts: {\n        $inc: 1,\n      },\n    }\n\n    const willReachMaxAttempts =\n      typeof user.loginAttempts === 'number' && user.loginAttempts + 1 >= maxLoginAttempts\n    // Lock the account if at max attempts and not already locked\n    if (willReachMaxAttempts) {\n      const lockUntil = new Date(currentTime + lockTime).toISOString()\n      data.lockUntil = lockUntil\n    }\n\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data,\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n  }\n\n  if (updatedLoginAttempts === null) {\n    throw new Error('Failed to update login attempts or lockUntil for user')\n  }\n\n  // Check updated latest lockUntil and loginAttempts in case there were parallel updates\n  const reachedMaxAttemptsForCurrentUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts - 1 >= maxLoginAttempts\n\n  const reachedMaxAttemptsForNextUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts >= maxLoginAttempts\n\n  if (reachedMaxAttemptsForCurrentUser) {\n    user.lockUntil = updatedLockUntil\n  }\n  user.loginAttempts = updatedLoginAttempts - 1 // -1, as the updated increment is applied for the *next* login attempt, not the current one\n\n  if (\n    reachedMaxAttemptsForNextUser &&\n    (!updatedLockUntil || !isUserLocked(new Date(updatedLockUntil)))\n  ) {\n    // If lockUntil reached max login attempts due to multiple parallel attempts but user was not locked yet,\n    const newLockUntil = new Date(currentTime + lockTime).toISOString()\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: newLockUntil,\n      },\n      returning: false,\n    })\n\n    if (reachedMaxAttemptsForCurrentUser) {\n      user.lockUntil = newLockUntil\n    }\n\n    if (collection.auth.useSessions) {\n      // Remove all active sessions that have been created in a 20 second window. This protects\n      // against brute force attacks - example: 99 incorrect, 1 correct parallel login attempts.\n      // The correct login attempt will be finished first, as it's faster due to not having to perform\n      // an additional db update here.\n      // However, this request (the incorrect login attempt request) can kill the successful login attempt here.\n\n      // Fetch user sessions separately (do not do this in the updateOne select in order to preserve the returning: true db call optimization)\n      const currentUser = await payload.db.findOne<TypedUser>({\n        collection: collection.slug,\n        select: {\n          sessions: true,\n        },\n        where: {\n          id: {\n            equals: user.id,\n          },\n        },\n      })\n      if (currentUser?.sessions?.length) {\n        // Does not hurt also removing expired sessions\n        currentUser.sessions = currentUser.sessions.filter((session) => {\n          const sessionCreatedAt = new Date(session.createdAt)\n          const twentySecondsAgo = new Date(currentTime - 20000)\n\n          // Remove sessions created within the last 20 seconds\n          return sessionCreatedAt <= twentySecondsAgo\n        })\n\n        user.sessions = currentUser.sessions\n\n        // Ensure updatedAt date is always updated\n        user.updatedAt = new Date().toISOString()\n\n        await payload.db.updateOne({\n          id: user.id,\n          collection: collection.slug,\n          data: user,\n          returning: false,\n        })\n      }\n    }\n  }\n}\n"],"names":["isUserLocked","incrementLoginAttempts","collection","payload","user","auth","lockTime","maxLoginAttempts","currentTime","Date","now","updatedLockUntil","updatedLoginAttempts","lockUntil","updatedUser","db","updateOne","id","slug","data","loginAttempts","select","$inc","willReachMaxAttempts","toISOString","Error","reachedMaxAttemptsForCurrentUser","reachedMaxAttemptsForNextUser","newLockUntil","returning","useSessions","currentUser","findOne","sessions","where","equals","length","filter","session","sessionCreatedAt","createdAt","twentySecondsAgo","updatedAt"],"mappings":"AAGA,SAASA,YAAY,QAAQ,wBAAuB;AAQpD,mIAAmI;AACnI,4FAA4F;AAC5F,OAAO,MAAMC,yBAAyB,OAAO,EAC3CC,UAAU,EACVC,OAAO,EACPC,IAAI,EACC;IACL,MAAM,EACJC,MAAM,EAAEC,QAAQ,EAAEC,gBAAgB,EAAE,EACrC,GAAGL;IAEJ,MAAMM,cAAcC,KAAKC,GAAG;IAE5B,IAAIC,mBAAkC;IACtC,IAAIC,uBAAsC;IAE1C,IAAIR,KAAKS,SAAS,IAAI,CAACb,aAAa,IAAIS,KAAKL,KAAKS,SAAS,IAAI;QAC7D,mCAAmC;QACnC,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAW;gBACXO,eAAe;YACjB;YACAC,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QACAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;QAChDhB,KAAKS,SAAS,GAAGF;IACnB,OAAO;QACL,MAAMQ,OAAmB;YACvBC,eAAe;gBACbE,MAAM;YACR;QACF;QAEA,MAAMC,uBACJ,OAAOnB,KAAKgB,aAAa,KAAK,YAAYhB,KAAKgB,aAAa,GAAG,KAAKb;QACtE,6DAA6D;QAC7D,IAAIgB,sBAAsB;YACxB,MAAMV,YAAY,IAAIJ,KAAKD,cAAcF,UAAUkB,WAAW;YAC9DL,KAAKN,SAAS,GAAGA;QACnB;QAEA,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC;YACAE,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QAEAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;IAClD;IAEA,IAAIR,yBAAyB,MAAM;QACjC,MAAM,IAAIa,MAAM;IAClB;IAEA,uFAAuF;IACvF,MAAMC,mCACJ,OAAOd,yBAAyB,YAAYA,uBAAuB,KAAKL;IAE1E,MAAMoB,gCACJ,OAAOf,yBAAyB,YAAYA,wBAAwBL;IAEtE,IAAImB,kCAAkC;QACpCtB,KAAKS,SAAS,GAAGF;IACnB;IACAP,KAAKgB,aAAa,GAAGR,uBAAuB,GAAE,4FAA4F;IAE1I,IACEe,iCACC,CAAA,CAAChB,oBAAoB,CAACX,aAAa,IAAIS,KAAKE,kBAAiB,GAC9D;QACA,yGAAyG;QACzG,MAAMiB,eAAe,IAAInB,KAAKD,cAAcF,UAAUkB,WAAW;QAEjE,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;YACzBC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAWe;YACb;YACAC,WAAW;QACb;QAEA,IAAIH,kCAAkC;YACpCtB,KAAKS,SAAS,GAAGe;QACnB;QAEA,IAAI1B,WAAWG,IAAI,CAACyB,WAAW,EAAE;YAC/B,yFAAyF;YACzF,0FAA0F;YAC1F,gGAAgG;YAChG,gCAAgC;YAChC,0GAA0G;YAE1G,wIAAwI;YACxI,MAAMC,cAAc,MAAM5B,QAAQY,EAAE,CAACiB,OAAO,CAAY;gBACtD9B,YAAYA,WAAWgB,IAAI;gBAC3BG,QAAQ;oBACNY,UAAU;gBACZ;gBACAC,OAAO;oBACLjB,IAAI;wBACFkB,QAAQ/B,KAAKa,EAAE;oBACjB;gBACF;YACF;YACA,IAAIc,aAAaE,UAAUG,QAAQ;gBACjC,+CAA+C;gBAC/CL,YAAYE,QAAQ,GAAGF,YAAYE,QAAQ,CAACI,MAAM,CAAC,CAACC;oBAClD,MAAMC,mBAAmB,IAAI9B,KAAK6B,QAAQE,SAAS;oBACnD,MAAMC,mBAAmB,IAAIhC,KAAKD,cAAc;oBAEhD,qDAAqD;oBACrD,OAAO+B,oBAAoBE;gBAC7B;gBAEArC,KAAK6B,QAAQ,GAAGF,YAAYE,QAAQ;gBAEpC,0CAA0C;gBAC1C7B,KAAKsC,SAAS,GAAG,IAAIjC,OAAOe,WAAW;gBAEvC,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;oBACzBC,IAAIb,KAAKa,EAAE;oBACXf,YAAYA,WAAWgB,IAAI;oBAC3BC,MAAMf;oBACNyB,WAAW;gBACb;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\n\nimport { type JsonObject, type Payload, type User } from '../../../index.js'\nimport { isUserLocked } from '../../isUserLocked.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  payload: Payload\n  user: User\n}\n\n// Note: this function does not use req in its updates, as we want those to be visible in parallel requests that are on a different\n// transaction. At the same time, we want updates from parallel requests to be visible here.\nexport const incrementLoginAttempts = async ({\n  collection,\n  payload,\n  user,\n}: Args): Promise<void> => {\n  const {\n    auth: { lockTime, maxLoginAttempts },\n  } = collection\n\n  const currentTime = Date.now()\n\n  let updatedLockUntil: null | string = null\n  let updatedLoginAttempts: null | number = null\n\n  if (user.lockUntil && !isUserLocked(new Date(user.lockUntil))) {\n    // Expired lock, restart count at 1\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: null,\n        loginAttempts: 1,\n      },\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n    user.lockUntil = updatedLockUntil\n  } else {\n    const data: JsonObject = {\n      loginAttempts: {\n        $inc: 1,\n      },\n    }\n\n    const willReachMaxAttempts =\n      typeof user.loginAttempts === 'number' && user.loginAttempts + 1 >= maxLoginAttempts\n    // Lock the account if at max attempts and not already locked\n    if (willReachMaxAttempts) {\n      const lockUntil = new Date(currentTime + lockTime).toISOString()\n      data.lockUntil = lockUntil\n    }\n\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data,\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n  }\n\n  if (updatedLoginAttempts === null) {\n    throw new Error('Failed to update login attempts or lockUntil for user')\n  }\n\n  // Check updated latest lockUntil and loginAttempts in case there were parallel updates\n  const reachedMaxAttemptsForCurrentUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts - 1 >= maxLoginAttempts\n\n  const reachedMaxAttemptsForNextUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts >= maxLoginAttempts\n\n  if (reachedMaxAttemptsForCurrentUser) {\n    user.lockUntil = updatedLockUntil\n  }\n  user.loginAttempts = updatedLoginAttempts - 1 // -1, as the updated increment is applied for the *next* login attempt, not the current one\n\n  if (\n    reachedMaxAttemptsForNextUser &&\n    (!updatedLockUntil || !isUserLocked(new Date(updatedLockUntil)))\n  ) {\n    // If lockUntil reached max login attempts due to multiple parallel attempts but user was not locked yet,\n    const newLockUntil = new Date(currentTime + lockTime).toISOString()\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: newLockUntil,\n      },\n      returning: false,\n    })\n\n    if (reachedMaxAttemptsForCurrentUser) {\n      user.lockUntil = newLockUntil\n    }\n\n    if (collection.auth.useSessions) {\n      // Remove all active sessions that have been created in a 20 second window. This protects\n      // against brute force attacks - example: 99 incorrect, 1 correct parallel login attempts.\n      // The correct login attempt will be finished first, as it's faster due to not having to perform\n      // an additional db update here.\n      // However, this request (the incorrect login attempt request) can kill the successful login attempt here.\n\n      // Fetch user sessions separately (do not do this in the updateOne select in order to preserve the returning: true db call optimization)\n      const currentUser = await payload.db.findOne<User>({\n        collection: collection.slug,\n        select: {\n          sessions: true,\n        },\n        where: {\n          id: {\n            equals: user.id,\n          },\n        },\n      })\n      if (currentUser?.sessions?.length) {\n        // Does not hurt also removing expired sessions\n        currentUser.sessions = currentUser.sessions.filter((session) => {\n          const sessionCreatedAt = new Date(session.createdAt ?? 0)\n          const twentySecondsAgo = new Date(currentTime - 20000)\n\n          // Remove sessions created within the last 20 seconds\n          return sessionCreatedAt <= twentySecondsAgo\n        })\n\n        user.sessions = currentUser.sessions\n\n        // Ensure updatedAt date is always updated\n        user.updatedAt = new Date().toISOString()\n\n        await payload.db.updateOne({\n          id: user.id,\n          collection: collection.slug,\n          data: user,\n          returning: false,\n        })\n      }\n    }\n  }\n}\n"],"names":["isUserLocked","incrementLoginAttempts","collection","payload","user","auth","lockTime","maxLoginAttempts","currentTime","Date","now","updatedLockUntil","updatedLoginAttempts","lockUntil","updatedUser","db","updateOne","id","slug","data","loginAttempts","select","$inc","willReachMaxAttempts","toISOString","Error","reachedMaxAttemptsForCurrentUser","reachedMaxAttemptsForNextUser","newLockUntil","returning","useSessions","currentUser","findOne","sessions","where","equals","length","filter","session","sessionCreatedAt","createdAt","twentySecondsAgo","updatedAt"],"mappings":"AAGA,SAASA,YAAY,QAAQ,wBAAuB;AAQpD,mIAAmI;AACnI,4FAA4F;AAC5F,OAAO,MAAMC,yBAAyB,OAAO,EAC3CC,UAAU,EACVC,OAAO,EACPC,IAAI,EACC;IACL,MAAM,EACJC,MAAM,EAAEC,QAAQ,EAAEC,gBAAgB,EAAE,EACrC,GAAGL;IAEJ,MAAMM,cAAcC,KAAKC,GAAG;IAE5B,IAAIC,mBAAkC;IACtC,IAAIC,uBAAsC;IAE1C,IAAIR,KAAKS,SAAS,IAAI,CAACb,aAAa,IAAIS,KAAKL,KAAKS,SAAS,IAAI;QAC7D,mCAAmC;QACnC,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAW;gBACXO,eAAe;YACjB;YACAC,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QACAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;QAChDhB,KAAKS,SAAS,GAAGF;IACnB,OAAO;QACL,MAAMQ,OAAmB;YACvBC,eAAe;gBACbE,MAAM;YACR;QACF;QAEA,MAAMC,uBACJ,OAAOnB,KAAKgB,aAAa,KAAK,YAAYhB,KAAKgB,aAAa,GAAG,KAAKb;QACtE,6DAA6D;QAC7D,IAAIgB,sBAAsB;YACxB,MAAMV,YAAY,IAAIJ,KAAKD,cAAcF,UAAUkB,WAAW;YAC9DL,KAAKN,SAAS,GAAGA;QACnB;QAEA,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC;YACAE,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QAEAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;IAClD;IAEA,IAAIR,yBAAyB,MAAM;QACjC,MAAM,IAAIa,MAAM;IAClB;IAEA,uFAAuF;IACvF,MAAMC,mCACJ,OAAOd,yBAAyB,YAAYA,uBAAuB,KAAKL;IAE1E,MAAMoB,gCACJ,OAAOf,yBAAyB,YAAYA,wBAAwBL;IAEtE,IAAImB,kCAAkC;QACpCtB,KAAKS,SAAS,GAAGF;IACnB;IACAP,KAAKgB,aAAa,GAAGR,uBAAuB,GAAE,4FAA4F;IAE1I,IACEe,iCACC,CAAA,CAAChB,oBAAoB,CAACX,aAAa,IAAIS,KAAKE,kBAAiB,GAC9D;QACA,yGAAyG;QACzG,MAAMiB,eAAe,IAAInB,KAAKD,cAAcF,UAAUkB,WAAW;QAEjE,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;YACzBC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAWe;YACb;YACAC,WAAW;QACb;QAEA,IAAIH,kCAAkC;YACpCtB,KAAKS,SAAS,GAAGe;QACnB;QAEA,IAAI1B,WAAWG,IAAI,CAACyB,WAAW,EAAE;YAC/B,yFAAyF;YACzF,0FAA0F;YAC1F,gGAAgG;YAChG,gCAAgC;YAChC,0GAA0G;YAE1G,wIAAwI;YACxI,MAAMC,cAAc,MAAM5B,QAAQY,EAAE,CAACiB,OAAO,CAAO;gBACjD9B,YAAYA,WAAWgB,IAAI;gBAC3BG,QAAQ;oBACNY,UAAU;gBACZ;gBACAC,OAAO;oBACLjB,IAAI;wBACFkB,QAAQ/B,KAAKa,EAAE;oBACjB;gBACF;YACF;YACA,IAAIc,aAAaE,UAAUG,QAAQ;gBACjC,+CAA+C;gBAC/CL,YAAYE,QAAQ,GAAGF,YAAYE,QAAQ,CAACI,MAAM,CAAC,CAACC;oBAClD,MAAMC,mBAAmB,IAAI9B,KAAK6B,QAAQE,SAAS,IAAI;oBACvD,MAAMC,mBAAmB,IAAIhC,KAAKD,cAAc;oBAEhD,qDAAqD;oBACrD,OAAO+B,oBAAoBE;gBAC7B;gBAEArC,KAAK6B,QAAQ,GAAGF,YAAYE,QAAQ;gBAEpC,0CAA0C;gBAC1C7B,KAAKsC,SAAS,GAAG,IAAIjC,OAAOe,WAAW;gBAEvC,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;oBACzBC,IAAIb,KAAKa,EAAE;oBACXf,YAAYA,WAAWgB,IAAI;oBAC3BC,MAAMf;oBACNyB,WAAW;gBACb;YACF;QACF;IACF;AACF,EAAC"}

package/dist/auth/strategies/local/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAMhF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,UAAU,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,8CAMzC,IAAI,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0ExC,CAAA"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAMhF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,UAAU,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,iDAM/B,IAAI,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2ExC,CAAA"}

package/dist/auth/strategies/local/register.js

@@ -34,6 +34,7 @@ export const registerLocalStrategy = async ({ collection, doc, password, payload
         collection: collection.slug,
         depth: 0,
         limit: 1,
+        overrideAccess: true,
         pagination: false,
         req,
         where: whereConstraint

package/dist/auth/strategies/local/register.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/register.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { JsonObject, Payload } from '../../../index.js'\nimport type { PayloadRequest, SelectType, Where } from '../../../types/index.js'\n\nimport { ValidationError } from '../../../errors/index.js'\nimport { getLoginOptions } from '../../getLoginOptions.js'\nimport { generatePasswordSaltHash } from './generatePasswordSaltHash.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  doc: JsonObject\n  password: string\n  payload: Payload\n  req: PayloadRequest\n}\n\nexport const registerLocalStrategy = async ({\n  collection,\n  doc,\n  password,\n  payload,\n  req,\n}: Args): Promise<Record<string, unknown>> => {\n  const loginWithUsername = collection?.auth?.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  let whereConstraint: Where\n\n  if (!canLoginWithUsername) {\n    whereConstraint = {\n      email: {\n        equals: doc.email,\n      },\n    }\n  } else {\n    whereConstraint = {\n      or: [],\n    }\n\n    if (canLoginWithEmail && doc.email) {\n      whereConstraint.or?.push({\n        email: {\n          equals: doc.email,\n        },\n      })\n    }\n\n    if (doc.username) {\n      whereConstraint.or?.push({\n        username: {\n          equals: doc.username,\n        },\n      })\n    }\n  }\n\n  const existingUser = await payload.find({\n    collection: collection.slug,\n    depth: 0,\n    limit: 1,\n    pagination: false,\n    req,\n    where: whereConstraint,\n  })\n\n  if (existingUser.docs.length > 0) {\n    throw new ValidationError({\n      collection: collection.slug,\n      errors: [\n        canLoginWithUsername\n          ? {\n              message: req.t('error:usernameAlreadyRegistered'),\n              path: 'username',\n            }\n          : { message: req.t('error:userEmailAlreadyRegistered'), path: 'email' },\n      ],\n    })\n  }\n\n  const { hash, salt } = await generatePasswordSaltHash({ collection, password, req })\n\n  const sanitizedDoc = { ...doc }\n  if (sanitizedDoc.password) {\n    delete sanitizedDoc.password\n  }\n\n  return payload.db.create({\n    collection: collection.slug,\n    data: {\n      ...sanitizedDoc,\n      hash,\n      salt,\n    },\n    req,\n  })\n}\n"],"names":["ValidationError","getLoginOptions","generatePasswordSaltHash","registerLocalStrategy","collection","doc","password","payload","req","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","whereConstraint","email","equals","or","push","username","existingUser","find","slug","depth","limit","pagination","where","docs","length","errors","message","t","path","hash","salt","sanitizedDoc","db","create","data"],"mappings":"AAIA,SAASA,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,wBAAwB,QAAQ,gCAA+B;AAUxE,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,GAAG,EACHC,QAAQ,EACRC,OAAO,EACPC,GAAG,EACE;IACL,MAAMC,oBAAoBL,YAAYM,MAAMD;IAE5C,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGX,gBAAgBQ;IAEpE,IAAII;IAEJ,IAAI,CAACD,sBAAsB;QACzBC,kBAAkB;YAChBC,OAAO;gBACLC,QAAQV,IAAIS,KAAK;YACnB;QACF;IACF,OAAO;QACLD,kBAAkB;YAChBG,IAAI,EAAE;QACR;QAEA,IAAIL,qBAAqBN,IAAIS,KAAK,EAAE;YAClCD,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBH,OAAO;oBACLC,QAAQV,IAAIS,KAAK;gBACnB;YACF;QACF;QAEA,IAAIT,IAAIa,QAAQ,EAAE;YAChBL,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBC,UAAU;oBACRH,QAAQV,IAAIa,QAAQ;gBACtB;YACF;QACF;IACF;IAEA,MAAMC,eAAe,MAAMZ,QAAQa,IAAI,CAAC;QACtChB,YAAYA,WAAWiB,IAAI;QAC3BC,OAAO;QACPC,OAAO;QACPC,YAAY;QACZhB;QACAiB,OAAOZ;IACT;IAEA,IAAIM,aAAaO,IAAI,CAACC,MAAM,GAAG,GAAG;QAChC,MAAM,IAAI3B,gBAAgB;YACxBI,YAAYA,WAAWiB,IAAI;YAC3BO,QAAQ;gBACNhB,uBACI;oBACEiB,SAASrB,IAAIsB,CAAC,CAAC;oBACfC,MAAM;gBACR,IACA;oBAAEF,SAASrB,IAAIsB,CAAC,CAAC;oBAAqCC,MAAM;gBAAQ;aACzE;QACH;IACF;IAEA,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAM/B,yBAAyB;QAAEE;QAAYE;QAAUE;IAAI;IAElF,MAAM0B,eAAe;QAAE,GAAG7B,GAAG;IAAC;IAC9B,IAAI6B,aAAa5B,QAAQ,EAAE;QACzB,OAAO4B,aAAa5B,QAAQ;IAC9B;IAEA,OAAOC,QAAQ4B,EAAE,CAACC,MAAM,CAAC;QACvBhC,YAAYA,WAAWiB,IAAI;QAC3BgB,MAAM;YACJ,GAAGH,YAAY;YACfF;YACAC;QACF;QACAzB;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/register.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { JsonObject, Payload } from '../../../index.js'\nimport type { PayloadRequest, SelectType, Where } from '../../../types/index.js'\n\nimport { ValidationError } from '../../../errors/index.js'\nimport { getLoginOptions } from '../../getLoginOptions.js'\nimport { generatePasswordSaltHash } from './generatePasswordSaltHash.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  doc: JsonObject\n  password: string\n  payload: Payload\n  req: PayloadRequest\n}\n\nexport const registerLocalStrategy = async ({\n  collection,\n  doc,\n  password,\n  payload,\n  req,\n}: Args): Promise<Record<string, unknown>> => {\n  const loginWithUsername = collection?.auth?.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  let whereConstraint: Where\n\n  if (!canLoginWithUsername) {\n    whereConstraint = {\n      email: {\n        equals: doc.email,\n      },\n    }\n  } else {\n    whereConstraint = {\n      or: [],\n    }\n\n    if (canLoginWithEmail && doc.email) {\n      whereConstraint.or?.push({\n        email: {\n          equals: doc.email,\n        },\n      })\n    }\n\n    if (doc.username) {\n      whereConstraint.or?.push({\n        username: {\n          equals: doc.username,\n        },\n      })\n    }\n  }\n\n  const existingUser = await payload.find({\n    collection: collection.slug,\n    depth: 0,\n    limit: 1,\n    overrideAccess: true,\n    pagination: false,\n    req,\n    where: whereConstraint,\n  })\n\n  if (existingUser.docs.length > 0) {\n    throw new ValidationError({\n      collection: collection.slug,\n      errors: [\n        canLoginWithUsername\n          ? {\n              message: req.t('error:usernameAlreadyRegistered'),\n              path: 'username',\n            }\n          : { message: req.t('error:userEmailAlreadyRegistered'), path: 'email' },\n      ],\n    })\n  }\n\n  const { hash, salt } = await generatePasswordSaltHash({ collection, password, req })\n\n  const sanitizedDoc = { ...doc }\n  if (sanitizedDoc.password) {\n    delete sanitizedDoc.password\n  }\n\n  return payload.db.create({\n    collection: collection.slug,\n    data: {\n      ...sanitizedDoc,\n      hash,\n      salt,\n    },\n    req,\n  })\n}\n"],"names":["ValidationError","getLoginOptions","generatePasswordSaltHash","registerLocalStrategy","collection","doc","password","payload","req","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","whereConstraint","email","equals","or","push","username","existingUser","find","slug","depth","limit","overrideAccess","pagination","where","docs","length","errors","message","t","path","hash","salt","sanitizedDoc","db","create","data"],"mappings":"AAIA,SAASA,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,wBAAwB,QAAQ,gCAA+B;AAUxE,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,GAAG,EACHC,QAAQ,EACRC,OAAO,EACPC,GAAG,EACE;IACL,MAAMC,oBAAoBL,YAAYM,MAAMD;IAE5C,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGX,gBAAgBQ;IAEpE,IAAII;IAEJ,IAAI,CAACD,sBAAsB;QACzBC,kBAAkB;YAChBC,OAAO;gBACLC,QAAQV,IAAIS,KAAK;YACnB;QACF;IACF,OAAO;QACLD,kBAAkB;YAChBG,IAAI,EAAE;QACR;QAEA,IAAIL,qBAAqBN,IAAIS,KAAK,EAAE;YAClCD,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBH,OAAO;oBACLC,QAAQV,IAAIS,KAAK;gBACnB;YACF;QACF;QAEA,IAAIT,IAAIa,QAAQ,EAAE;YAChBL,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBC,UAAU;oBACRH,QAAQV,IAAIa,QAAQ;gBACtB;YACF;QACF;IACF;IAEA,MAAMC,eAAe,MAAMZ,QAAQa,IAAI,CAAC;QACtChB,YAAYA,WAAWiB,IAAI;QAC3BC,OAAO;QACPC,OAAO;QACPC,gBAAgB;QAChBC,YAAY;QACZjB;QACAkB,OAAOb;IACT;IAEA,IAAIM,aAAaQ,IAAI,CAACC,MAAM,GAAG,GAAG;QAChC,MAAM,IAAI5B,gBAAgB;YACxBI,YAAYA,WAAWiB,IAAI;YAC3BQ,QAAQ;gBACNjB,uBACI;oBACEkB,SAAStB,IAAIuB,CAAC,CAAC;oBACfC,MAAM;gBACR,IACA;oBAAEF,SAAStB,IAAIuB,CAAC,CAAC;oBAAqCC,MAAM;gBAAQ;aACzE;QACH;IACF;IAEA,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMhC,yBAAyB;QAAEE;QAAYE;QAAUE;IAAI;IAElF,MAAM2B,eAAe;QAAE,GAAG9B,GAAG;IAAC;IAC9B,IAAI8B,aAAa7B,QAAQ,EAAE;QACzB,OAAO6B,aAAa7B,QAAQ;IAC9B;IAEA,OAAOC,QAAQ6B,EAAE,CAACC,MAAM,CAAC;QACvBjC,YAAYA,WAAWiB,IAAI;QAC3BiB,MAAM;YACJ,GAAGH,YAAY;YACfF;YACAC;QACF;QACA1B;IACF;AACF,EAAC"}

package/dist/auth/strategies/local/resetLoginAttempts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resetLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAU,oCAKtC,IAAI,KAAG,OAAO,CAAC,IAAI,CAiBrB,CAAA"}
+{"version":3,"file":"resetLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,kBAAkB,uCAK5B,IAAI,KAAG,OAAO,CAAC,IAAI,CAiBrB,CAAA"}