payload 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee

package/dist/utilities/getFieldPermissions.spec.js

@@ -1,78 +0,0 @@
-import { getFieldPermissions } from './getFieldPermissions.js';
-import { describe, expect, it } from 'vitest';
-describe('getFieldPermissions with collection fallback', ()=>{
-    const mockField = {
-        name: 'testField',
-        type: 'text'
-    };
-    describe('fallback to collection permissions', ()=>{
-        it('should enable read-only mode when field permissions are missing but collection has read access', ()=>{
-            const fieldPermissions = {} // Empty/sanitized field permissions
-            ;
-            const collectionPermissions = {
-                read: true,
-                fields: {}
-            };
-            const result = getFieldPermissions({
-                field: mockField,
-                operation: 'update',
-                parentName: '',
-                permissions: fieldPermissions,
-                collectionPermissions
-            });
-            expect(result.read).toBe(true);
-            expect(result.operation).toBe(false); // Should be read-only
-            expect(result.permissions).toEqual({
-                read: true
-            });
-        });
-        it('should respect existing field permissions when they exist', ()=>{
-            const fieldPermissions = true // All permissions are true
-            ;
-            const collectionPermissions = {
-                read: true,
-                fields: {}
-            };
-            const result = getFieldPermissions({
-                field: mockField,
-                operation: 'update',
-                parentName: '',
-                permissions: fieldPermissions
-            });
-            expect(result.read).toBe(true);
-            expect(result.operation).toBe(true); // Should have operation permission
-            expect(result.permissions).toBe(true);
-        });
-        it('should not provide access when neither field nor collection has read permission', ()=>{
-            const fieldPermissions = {};
-            const collectionPermissions = {
-                // No read permission at collection level
-                fields: {}
-            };
-            const result = getFieldPermissions({
-                field: mockField,
-                operation: 'update',
-                parentName: '',
-                permissions: fieldPermissions,
-                collectionPermissions
-            });
-            expect(result.read).toBe(false);
-            expect(result.operation).toBe(false);
-        });
-        it('should work without collection permissions (backward compatibility)', ()=>{
-            const fieldPermissions = true // All permissions
-            ;
-            const result = getFieldPermissions({
-                field: mockField,
-                operation: 'update',
-                parentName: '',
-                permissions: fieldPermissions
-            });
-            expect(result.read).toBe(true);
-            expect(result.operation).toBe(true);
-            expect(result.permissions).toBe(true);
-        });
-    });
-});
-
-//# sourceMappingURL=getFieldPermissions.spec.js.map

package/dist/utilities/getFieldPermissions.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utilities/getFieldPermissions.spec.ts"],"sourcesContent":["import type { SanitizedDocumentPermissions } from '../auth/types.js'\n\nimport { getFieldPermissions } from './getFieldPermissions.js'\nimport { describe, expect, it } from 'vitest'\n\ndescribe('getFieldPermissions with collection fallback', () => {\n  const mockField = {\n    name: 'testField',\n    type: 'text' as const,\n  }\n\n  describe('fallback to collection permissions', () => {\n    it('should enable read-only mode when field permissions are missing but collection has read access', () => {\n      const fieldPermissions = {} // Empty/sanitized field permissions\n      const collectionPermissions: SanitizedDocumentPermissions = {\n        read: true,\n        fields: {},\n      }\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n        collectionPermissions,\n      })\n\n      expect(result.read).toBe(true)\n      expect(result.operation).toBe(false) // Should be read-only\n      expect(result.permissions).toEqual({ read: true })\n    })\n\n    it('should respect existing field permissions when they exist', () => {\n      const fieldPermissions = true // All permissions are true\n      const collectionPermissions: SanitizedDocumentPermissions = {\n        read: true,\n        fields: {},\n      }\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n      })\n\n      expect(result.read).toBe(true)\n      expect(result.operation).toBe(true) // Should have operation permission\n      expect(result.permissions).toBe(true)\n    })\n\n    it('should not provide access when neither field nor collection has read permission', () => {\n      const fieldPermissions = {}\n      const collectionPermissions: SanitizedDocumentPermissions = {\n        // No read permission at collection level\n        fields: {},\n      }\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n        collectionPermissions,\n      })\n\n      expect(result.read).toBe(false)\n      expect(result.operation).toBe(false)\n    })\n\n    it('should work without collection permissions (backward compatibility)', () => {\n      const fieldPermissions = true // All permissions\n\n      const result = getFieldPermissions({\n        field: mockField,\n        operation: 'update',\n        parentName: '',\n        permissions: fieldPermissions,\n        // No collectionPermissions provided\n      })\n\n      expect(result.read).toBe(true)\n      expect(result.operation).toBe(true)\n      expect(result.permissions).toBe(true)\n    })\n  })\n})\n"],"names":["getFieldPermissions","describe","expect","it","mockField","name","type","fieldPermissions","collectionPermissions","read","fields","result","field","operation","parentName","permissions","toBe","toEqual"],"mappings":"AAEA,SAASA,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7CF,SAAS,gDAAgD;IACvD,MAAMG,YAAY;QAChBC,MAAM;QACNC,MAAM;IACR;IAEAL,SAAS,sCAAsC;QAC7CE,GAAG,kGAAkG;YACnG,MAAMI,mBAAmB,CAAC,EAAE,oCAAoC;;YAChE,MAAMC,wBAAsD;gBAC1DC,MAAM;gBACNC,QAAQ,CAAC;YACX;YAEA,MAAMC,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;gBACbC;YACF;YAEAN,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC,QAAO,sBAAsB;YAC3Dd,OAAOS,OAAOI,WAAW,EAAEE,OAAO,CAAC;gBAAER,MAAM;YAAK;QAClD;QAEAN,GAAG,6DAA6D;YAC9D,MAAMI,mBAAmB,KAAK,2BAA2B;;YACzD,MAAMC,wBAAsD;gBAC1DC,MAAM;gBACNC,QAAQ,CAAC;YACX;YAEA,MAAMC,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;YACf;YAEAL,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC,OAAM,mCAAmC;YACvEd,OAAOS,OAAOI,WAAW,EAAEC,IAAI,CAAC;QAClC;QAEAb,GAAG,mFAAmF;YACpF,MAAMI,mBAAmB,CAAC;YAC1B,MAAMC,wBAAsD;gBAC1D,yCAAyC;gBACzCE,QAAQ,CAAC;YACX;YAEA,MAAMC,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;gBACbC;YACF;YAEAN,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC;QAChC;QAEAb,GAAG,uEAAuE;YACxE,MAAMI,mBAAmB,KAAK,kBAAkB;;YAEhD,MAAMI,SAASX,oBAAoB;gBACjCY,OAAOR;gBACPS,WAAW;gBACXC,YAAY;gBACZC,aAAaR;YAEf;YAEAL,OAAOS,OAAOF,IAAI,EAAEO,IAAI,CAAC;YACzBd,OAAOS,OAAOE,SAAS,EAAEG,IAAI,CAAC;YAC9Bd,OAAOS,OAAOI,WAAW,EAAEC,IAAI,CAAC;QAClC;IACF;AACF"}

package/dist/utilities/getRequestOrigin.spec.js

@@ -1,151 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { getRequestOrigin } from './getRequestOrigin';
-const makeReq = (url, hostOverride)=>{
-    let host = hostOverride;
-    if (host === undefined) {
-        try {
-            host = new URL(url).host;
-        } catch  {
-            host = undefined;
-        }
-    }
-    return {
-        url,
-        headers: new Headers(host !== undefined ? {
-            host
-        } : {}),
-        payload: {
-            logger: {
-                warn: ()=>{}
-            }
-        }
-    };
-};
-describe('getRequestOrigin', ()=>{
-    describe('when config.serverURL is set', ()=>{
-        it('should return serverURL regardless of Host header', ()=>{
-            const req = makeReq('https://ignored.com/api/forgot-password', 'attacker.com');
-            const result = getRequestOrigin({
-                config: {
-                    serverURL: 'https://myapp.com',
-                    cors: '*',
-                    csrf: []
-                },
-                req
-            });
-            expect(result).toBe('https://myapp.com');
-        });
-    });
-    describe('when config.serverURL is not set', ()=>{
-        describe('CORS allowlist validation', ()=>{
-            it('should return origin when Host header matches a CORS string array entry', ()=>{
-                const req = makeReq('https://myapp.com/api/forgot-password');
-                const result = getRequestOrigin({
-                    config: {
-                        serverURL: '',
-                        cors: [
-                            'https://myapp.com',
-                            'https://other.com'
-                        ],
-                        csrf: []
-                    },
-                    req
-                });
-                expect(result).toBe('https://myapp.com');
-            });
-            it('should return origin when Host header matches a CORSConfig origins entry', ()=>{
-                const req = makeReq('https://myapp.com/api/verify');
-                const result = getRequestOrigin({
-                    config: {
-                        serverURL: '',
-                        cors: {
-                            headers: [],
-                            origins: [
-                                'https://myapp.com'
-                            ]
-                        },
-                        csrf: []
-                    },
-                    req
-                });
-                expect(result).toBe('https://myapp.com');
-            });
-            it('should return empty string when Host header is forged and not in CORS allowlist', ()=>{
-                const req = makeReq('https://myapp.com/api/forgot-password', 'attacker.com');
-                const result = getRequestOrigin({
-                    config: {
-                        serverURL: '',
-                        cors: [
-                            'https://myapp.com'
-                        ],
-                        csrf: []
-                    },
-                    req
-                });
-                expect(result).toBe('');
-            });
-        });
-        describe('CSRF allowlist validation', ()=>{
-            it('should return origin when Host header matches a CSRF entry', ()=>{
-                const req = makeReq('https://myapp.com/api/verify');
-                const result = getRequestOrigin({
-                    config: {
-                        serverURL: '',
-                        cors: [],
-                        csrf: [
-                            'https://myapp.com'
-                        ]
-                    },
-                    req
-                });
-                expect(result).toBe('https://myapp.com');
-            });
-            it('should return origin when Host header is in CSRF but not in CORS', ()=>{
-                const req = makeReq('https://myapp.com/api/verify');
-                const result = getRequestOrigin({
-                    config: {
-                        serverURL: '',
-                        cors: [
-                            'https://other.com'
-                        ],
-                        csrf: [
-                            'https://myapp.com'
-                        ]
-                    },
-                    req
-                });
-                expect(result).toBe('https://myapp.com');
-            });
-        });
-        describe('malformed or missing Host header', ()=>{
-            it('should return empty string when req.url is not a valid URL', ()=>{
-                const req = makeReq('not-a-url');
-                const result = getRequestOrigin({
-                    config: {
-                        serverURL: '',
-                        cors: [],
-                        csrf: []
-                    },
-                    req
-                });
-                expect(result).toBe('');
-            });
-            it('should return empty string when Host header is absent', ()=>{
-                const req = makeReq('https://myapp.com/api/forgot-password', '');
-                const result = getRequestOrigin({
-                    config: {
-                        serverURL: '',
-                        cors: [
-                            'https://myapp.com'
-                        ],
-                        csrf: []
-                    },
-                    req
-                });
-                expect(result).toBe('');
-            });
-        });
-    });
-});
-
-//# sourceMappingURL=getRequestOrigin.spec.js.map

package/dist/utilities/getRequestOrigin.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utilities/getRequestOrigin.spec.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { getRequestOrigin } from './getRequestOrigin'\n\ntype MinimalReq = Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n\nconst makeReq = (url: string, hostOverride?: string): MinimalReq => {\n  let host = hostOverride\n  if (host === undefined) {\n    try {\n      host = new URL(url).host\n    } catch {\n      host = undefined\n    }\n  }\n  return {\n    url,\n    headers: new Headers(host !== undefined ? { host } : {}),\n    payload: {\n      logger: {\n        warn: () => {},\n      },\n    },\n  } as unknown as MinimalReq\n}\n\ndescribe('getRequestOrigin', () => {\n  describe('when config.serverURL is set', () => {\n    it('should return serverURL regardless of Host header', () => {\n      const req = makeReq('https://ignored.com/api/forgot-password', 'attacker.com')\n      const result = getRequestOrigin({\n        config: { serverURL: 'https://myapp.com', cors: '*', csrf: [] },\n        req,\n      })\n      expect(result).toBe('https://myapp.com')\n    })\n  })\n\n  describe('when config.serverURL is not set', () => {\n    describe('CORS allowlist validation', () => {\n      it('should return origin when Host header matches a CORS string array entry', () => {\n        const req = makeReq('https://myapp.com/api/forgot-password')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: ['https://myapp.com', 'https://other.com'], csrf: [] },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n\n      it('should return origin when Host header matches a CORSConfig origins entry', () => {\n        const req = makeReq('https://myapp.com/api/verify')\n        const result = getRequestOrigin({\n          config: {\n            serverURL: '',\n            cors: { headers: [], origins: ['https://myapp.com'] },\n            csrf: [],\n          },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n\n      it('should return empty string when Host header is forged and not in CORS allowlist', () => {\n        const req = makeReq('https://myapp.com/api/forgot-password', 'attacker.com')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: ['https://myapp.com'], csrf: [] },\n          req,\n        })\n        expect(result).toBe('')\n      })\n    })\n\n    describe('CSRF allowlist validation', () => {\n      it('should return origin when Host header matches a CSRF entry', () => {\n        const req = makeReq('https://myapp.com/api/verify')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: [], csrf: ['https://myapp.com'] },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n\n      it('should return origin when Host header is in CSRF but not in CORS', () => {\n        const req = makeReq('https://myapp.com/api/verify')\n        const result = getRequestOrigin({\n          config: {\n            serverURL: '',\n            cors: ['https://other.com'],\n            csrf: ['https://myapp.com'],\n          },\n          req,\n        })\n        expect(result).toBe('https://myapp.com')\n      })\n    })\n\n    describe('malformed or missing Host header', () => {\n      it('should return empty string when req.url is not a valid URL', () => {\n        const req = makeReq('not-a-url')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: [], csrf: [] },\n          req,\n        })\n        expect(result).toBe('')\n      })\n\n      it('should return empty string when Host header is absent', () => {\n        const req = makeReq('https://myapp.com/api/forgot-password', '')\n        const result = getRequestOrigin({\n          config: { serverURL: '', cors: ['https://myapp.com'], csrf: [] },\n          req,\n        })\n        expect(result).toBe('')\n      })\n    })\n  })\n})\n"],"names":["describe","expect","it","getRequestOrigin","makeReq","url","hostOverride","host","undefined","URL","headers","Headers","payload","logger","warn","req","result","config","serverURL","cors","csrf","toBe","origins"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,gBAAgB,QAAQ,qBAAoB;AAIrD,MAAMC,UAAU,CAACC,KAAaC;IAC5B,IAAIC,OAAOD;IACX,IAAIC,SAASC,WAAW;QACtB,IAAI;YACFD,OAAO,IAAIE,IAAIJ,KAAKE,IAAI;QAC1B,EAAE,OAAM;YACNA,OAAOC;QACT;IACF;IACA,OAAO;QACLH;QACAK,SAAS,IAAIC,QAAQJ,SAASC,YAAY;YAAED;QAAK,IAAI,CAAC;QACtDK,SAAS;YACPC,QAAQ;gBACNC,MAAM,KAAO;YACf;QACF;IACF;AACF;AAEAd,SAAS,oBAAoB;IAC3BA,SAAS,gCAAgC;QACvCE,GAAG,qDAAqD;YACtD,MAAMa,MAAMX,QAAQ,2CAA2C;YAC/D,MAAMY,SAASb,iBAAiB;gBAC9Bc,QAAQ;oBAAEC,WAAW;oBAAqBC,MAAM;oBAAKC,MAAM,EAAE;gBAAC;gBAC9DL;YACF;YACAd,OAAOe,QAAQK,IAAI,CAAC;QACtB;IACF;IAEArB,SAAS,oCAAoC;QAC3CA,SAAS,6BAA6B;YACpCE,GAAG,2EAA2E;gBAC5E,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM;4BAAC;4BAAqB;yBAAoB;wBAAEC,MAAM,EAAE;oBAAC;oBACpFL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,4EAA4E;gBAC7E,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBACNC,WAAW;wBACXC,MAAM;4BAAET,SAAS,EAAE;4BAAEY,SAAS;gCAAC;6BAAoB;wBAAC;wBACpDF,MAAM,EAAE;oBACV;oBACAL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,mFAAmF;gBACpF,MAAMa,MAAMX,QAAQ,yCAAyC;gBAC7D,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM;4BAAC;yBAAoB;wBAAEC,MAAM,EAAE;oBAAC;oBAC/DL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;QACF;QAEArB,SAAS,6BAA6B;YACpCE,GAAG,8DAA8D;gBAC/D,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM,EAAE;wBAAEC,MAAM;4BAAC;yBAAoB;oBAAC;oBAC/DL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,oEAAoE;gBACrE,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBACNC,WAAW;wBACXC,MAAM;4BAAC;yBAAoB;wBAC3BC,MAAM;4BAAC;yBAAoB;oBAC7B;oBACAL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;QACF;QAEArB,SAAS,oCAAoC;YAC3CE,GAAG,8DAA8D;gBAC/D,MAAMa,MAAMX,QAAQ;gBACpB,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM,EAAE;wBAAEC,MAAM,EAAE;oBAAC;oBAC5CL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;YAEAnB,GAAG,yDAAyD;gBAC1D,MAAMa,MAAMX,QAAQ,yCAAyC;gBAC7D,MAAMY,SAASb,iBAAiB;oBAC9Bc,QAAQ;wBAAEC,WAAW;wBAAIC,MAAM;4BAAC;yBAAoB;wBAAEC,MAAM,EAAE;oBAAC;oBAC/DL;gBACF;gBACAd,OAAOe,QAAQK,IAAI,CAAC;YACtB;QACF;IACF;AACF"}

package/dist/utilities/getSafeRedirect.spec.js

@@ -1,84 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { getSafeRedirect } from './getSafeRedirect';
-const fallback = '/admin' // default fallback if the input is unsafe or invalid
-;
-describe('getSafeRedirect', ()=>{
-    // Valid - safe redirect paths
-    it.each([
-        [
-            '/dashboard'
-        ],
-        [
-            '/admin/settings'
-        ],
-        [
-            '/projects?id=123'
-        ],
-        [
-            '/hello-world'
-        ]
-    ])('should allow safe relative path: %s', (input)=>{
-        // If the input is a clean relative path, it should be returned as-is
-        expect(getSafeRedirect({
-            redirectTo: input,
-            fallbackTo: fallback
-        })).toBe(input);
-    });
-    // Invalid types or empty inputs
-    it.each([
-        '',
-        null,
-        undefined,
-        123,
-        {},
-        []
-    ])('should fallback on invalid or non-string input: %s', (input)=>{
-        // If the input is not a valid string, it should return the fallback
-        expect(getSafeRedirect({
-            redirectTo: input,
-            fallbackTo: fallback
-        })).toBe(fallback);
-    });
-    // Unsafe redirect patterns
-    it.each([
-        '//example.com',
-        '/javascript:alert(1)',
-        '/JavaScript:alert(1)',
-        '/http://unknown.com',
-        '/https://unknown.com',
-        '/%2Funknown.com',
-        '/\\/unknown.com',
-        '/\\\\unknown.com',
-        '/\\unknown.com',
-        '%2F%2Funknown.com',
-        '%2Fjavascript:alert(1)'
-    ])('should block unsafe redirect: %s', (input)=>{
-        // All of these should return the fallback because they’re unsafe
-        expect(getSafeRedirect({
-            redirectTo: input,
-            fallbackTo: fallback
-        })).toBe(fallback);
-    });
-    // Input with extra spaces should still be properly handled
-    it('should trim whitespace before evaluating', ()=>{
-        // A valid path with surrounding spaces should still be accepted
-        expect(getSafeRedirect({
-            redirectTo: '   /dashboard   ',
-            fallbackTo: fallback
-        })).toBe('/dashboard');
-        // An unsafe path with spaces should still be rejected
-        expect(getSafeRedirect({
-            redirectTo: '   //example.com   ',
-            fallbackTo: fallback
-        })).toBe(fallback);
-    });
-    // If decoding the input fails (e.g., invalid percent encoding), it should not crash
-    it('should return fallback on invalid encoding', ()=>{
-        expect(getSafeRedirect({
-            redirectTo: '%E0%A4%A',
-            fallbackTo: fallback
-        })).toBe(fallback);
-    });
-});
-
-//# sourceMappingURL=getSafeRedirect.spec.js.map

package/dist/utilities/getSafeRedirect.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { getSafeRedirect } from './getSafeRedirect'\n\nconst fallback = '/admin' // default fallback if the input is unsafe or invalid\n\ndescribe('getSafeRedirect', () => {\n  // Valid - safe redirect paths\n  it.each([['/dashboard'], ['/admin/settings'], ['/projects?id=123'], ['/hello-world']])(\n    'should allow safe relative path: %s',\n    (input) => {\n      // If the input is a clean relative path, it should be returned as-is\n      expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(input)\n    },\n  )\n\n  // Invalid types or empty inputs\n  it.each(['', null, undefined, 123, {}, []])(\n    'should fallback on invalid or non-string input: %s',\n    (input) => {\n      // If the input is not a valid string, it should return the fallback\n      expect(getSafeRedirect({ redirectTo: input as any, fallbackTo: fallback })).toBe(fallback)\n    },\n  )\n\n  // Unsafe redirect patterns\n  it.each([\n    '//example.com', // protocol-relative URL\n    '/javascript:alert(1)', // JavaScript scheme\n    '/JavaScript:alert(1)', // case-insensitive JavaScript\n    '/http://unknown.com', // disguised external redirect\n    '/https://unknown.com', // disguised external redirect\n    '/%2Funknown.com', // encoded slash — could resolve to //\n    '/\\\\/unknown.com', // escaped slash\n    '/\\\\\\\\unknown.com', // double escaped slashes\n    '/\\\\unknown.com', // single escaped slash\n    '%2F%2Funknown.com', // fully encoded protocol-relative path\n    '%2Fjavascript:alert(1)', // encoded JavaScript scheme\n  ])('should block unsafe redirect: %s', (input) => {\n    // All of these should return the fallback because they’re unsafe\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Input with extra spaces should still be properly handled\n  it('should trim whitespace before evaluating', () => {\n    // A valid path with surrounding spaces should still be accepted\n    expect(getSafeRedirect({ redirectTo: '   /dashboard   ', fallbackTo: fallback })).toBe(\n      '/dashboard',\n    )\n\n    // An unsafe path with spaces should still be rejected\n    expect(getSafeRedirect({ redirectTo: '   //example.com   ', fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  // If decoding the input fails (e.g., invalid percent encoding), it should not crash\n  it('should return fallback on invalid encoding', () => {\n    expect(getSafeRedirect({ redirectTo: '%E0%A4%A', fallbackTo: fallback })).toBe(fallback)\n  })\n})\n"],"names":["describe","it","expect","getSafeRedirect","fallback","each","input","redirectTo","fallbackTo","toBe","undefined"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,eAAe,QAAQ,oBAAmB;AAEnD,MAAMC,WAAW,SAAS,qDAAqD;;AAE/EJ,SAAS,mBAAmB;IAC1B,8BAA8B;IAC9BC,GAAGI,IAAI,CAAC;QAAC;YAAC;SAAa;QAAE;YAAC;SAAkB;QAAE;YAAC;SAAmB;QAAE;YAAC;SAAe;KAAC,EACnF,uCACA,CAACC;QACC,qEAAqE;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACH;IAC5E;IAGF,gCAAgC;IAChCL,GAAGI,IAAI,CAAC;QAAC;QAAI;QAAMK;QAAW;QAAK,CAAC;QAAG,EAAE;KAAC,EACxC,sDACA,CAACJ;QACC,oEAAoE;QACpEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAcE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACnF;IAGF,2BAA2B;IAC3BH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,oCAAoC,CAACC;QACtC,iEAAiE;QACjEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2DAA2D;IAC3DH,GAAG,4CAA4C;QAC7C,gEAAgE;QAChEC,OAAOC,gBAAgB;YAAEI,YAAY;YAAoBC,YAAYJ;QAAS,IAAIK,IAAI,CACpF;QAGF,sDAAsD;QACtDP,OAAOC,gBAAgB;YAAEI,YAAY;YAAuBC,YAAYJ;QAAS,IAAIK,IAAI,CACvFL;IAEJ;IAEA,oFAAoF;IACpFH,GAAG,8CAA8C;QAC/CC,OAAOC,gBAAgB;YAAEI,YAAY;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACjF;AACF"}

package/dist/utilities/isRSCEnabled.d.ts

@@ -1,12 +0,0 @@
-/**
- * Whether React Server Components are supported in the current environment.
- * Controlled by the `PAYLOAD_FRAMEWORK_RSC_ENABLED` environment variable.
- *
- * - `PAYLOAD_FRAMEWORK_RSC_ENABLED=true` → RSC is available (set by Next.js `withPayload` and
- *   TanStack Start's `payloadPlugin` via `@vitejs/plugin-rsc`)
- * - `PAYLOAD_FRAMEWORK_RSC_ENABLED=false` → RSC is NOT available
- *
- * Defaults to `true` when the variable is not set.
- */
-export declare function isRSCEnabled(): boolean;
-//# sourceMappingURL=isRSCEnabled.d.ts.map

package/dist/utilities/isRSCEnabled.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"isRSCEnabled.d.ts","sourceRoot":"","sources":["../../src/utilities/isRSCEnabled.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/dist/utilities/isRSCEnabled.js

@@ -1,14 +0,0 @@
-/**
- * Whether React Server Components are supported in the current environment.
- * Controlled by the `PAYLOAD_FRAMEWORK_RSC_ENABLED` environment variable.
- *
- * - `PAYLOAD_FRAMEWORK_RSC_ENABLED=true` → RSC is available (set by Next.js `withPayload` and
- *   TanStack Start's `payloadPlugin` via `@vitejs/plugin-rsc`)
- * - `PAYLOAD_FRAMEWORK_RSC_ENABLED=false` → RSC is NOT available
- *
- * Defaults to `true` when the variable is not set.
- */ export function isRSCEnabled() {
-    return process.env.PAYLOAD_FRAMEWORK_RSC_ENABLED !== 'false';
-}
-
-//# sourceMappingURL=isRSCEnabled.js.map

package/dist/utilities/isRSCEnabled.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utilities/isRSCEnabled.ts"],"sourcesContent":["/**\n * Whether React Server Components are supported in the current environment.\n * Controlled by the `PAYLOAD_FRAMEWORK_RSC_ENABLED` environment variable.\n *\n * - `PAYLOAD_FRAMEWORK_RSC_ENABLED=true` → RSC is available (set by Next.js `withPayload` and\n *   TanStack Start's `payloadPlugin` via `@vitejs/plugin-rsc`)\n * - `PAYLOAD_FRAMEWORK_RSC_ENABLED=false` → RSC is NOT available\n *\n * Defaults to `true` when the variable is not set.\n */\nexport function isRSCEnabled(): boolean {\n  return process.env.PAYLOAD_FRAMEWORK_RSC_ENABLED !== 'false'\n}\n"],"names":["isRSCEnabled","process","env","PAYLOAD_FRAMEWORK_RSC_ENABLED"],"mappings":"AAAA;;;;;;;;;CASC,GACD,OAAO,SAASA;IACd,OAAOC,QAAQC,GAAG,CAACC,6BAA6B,KAAK;AACvD"}

package/dist/utilities/isolateObjectProperty.spec.js

@@ -1,120 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { isolateObjectProperty } from './isolateObjectProperty.js';
-describe('isolateObjectProperty', ()=>{
-    describe('basic isolation behavior', ()=>{
-        it('should isolate specified property from the original object', ()=>{
-            const original = {
-                a: 1,
-                b: 2
-            };
-            const proxy = isolateObjectProperty(original, 'a');
-            proxy.a = 100;
-            expect(proxy.a).toBe(100);
-            expect(original.a).toBe(1); // Original unchanged
-        });
-        it('should share non-isolated properties with the original object', ()=>{
-            const original = {
-                a: 1,
-                b: 2
-            };
-            const proxy = isolateObjectProperty(original, 'a');
-            proxy.b = 200;
-            expect(proxy.b).toBe(200);
-            expect(original.b).toBe(200); // Original also changed
-        });
-        it('should support isolating multiple properties', ()=>{
-            const original = {
-                a: 1,
-                b: 2,
-                c: 3
-            };
-            const proxy = isolateObjectProperty(original, [
-                'a',
-                'b'
-            ]);
-            proxy.a = 100;
-            proxy.b = 200;
-            expect(proxy.a).toBe(100);
-            expect(proxy.b).toBe(200);
-            expect(original.a).toBe(1);
-            expect(original.b).toBe(2);
-        });
-        it('should support deleting isolated properties', ()=>{
-            const original = {
-                a: 1,
-                b: 2
-            };
-            const proxy = isolateObjectProperty(original, 'a');
-            delete proxy.a;
-            expect('a' in proxy).toBe(false);
-            expect('a' in original).toBe(true); // Original still has it
-        });
-        it('should support "in" operator for isolated properties', ()=>{
-            const original = {
-                a: 1,
-                b: 2
-            };
-            const proxy = isolateObjectProperty(original, 'a');
-            expect('a' in proxy).toBe(true);
-            expect('b' in proxy).toBe(true);
-            delete proxy.a;
-            expect('a' in proxy).toBe(false);
-        });
-    });
-    describe('private field access (Node 24+ compatibility)', ()=>{
-        /**
-     * Class with private fields to test that the proxy correctly handles
-     * getters/setters that access private fields (Node 24+ compatibility).
-     */ class ObjectWithPrivateFields {
-            #privateValue;
-            constructor(value){
-                this.#privateValue = value;
-            }
-            get value() {
-                return this.#privateValue;
-            }
-            set value(newValue) {
-                this.#privateValue = newValue;
-            }
-        }
-        it('should allow reading properties via getters that access private fields when not isolated', ()=>{
-            const original = new ObjectWithPrivateFields('secret');
-            expect(original.value).toBe('secret');
-        });
-        it('should allow reading properties via getters that access private fields', ()=>{
-            const original = new ObjectWithPrivateFields('secret');
-            const proxy = isolateObjectProperty(original, 'nonExistentKey');
-            // This would throw "Cannot read private member" if receiver is wrong
-            expect(proxy.value).toBe('secret');
-        });
-        it('should allow writing properties via setters that access private fields', ()=>{
-            const original = new ObjectWithPrivateFields('secret');
-            const proxy = isolateObjectProperty(original, 'nonExistentKey');
-            // This would throw "Cannot write private member" if receiver is wrong
-            proxy.value = 'updated';
-            expect(proxy.value).toBe('updated');
-            expect(original.value).toBe('updated');
-        });
-        it('should work with Headers-like objects (simulating Request.headers)', ()=>{
-            // Simulate a Request-like object with headers
-            class MockRequest {
-                #headers;
-                constructor(){
-                    this.#headers = new Headers({
-                        'content-type': 'application/json'
-                    });
-                }
-                get headers() {
-                    return this.#headers;
-                }
-            }
-            const request = new MockRequest();
-            const proxy = isolateObjectProperty(request, 'nonExistentKey');
-            // This simulates what happens in createLocalReq when checking req.headers
-            expect(proxy.headers).toBeInstanceOf(Headers);
-            expect(proxy.headers.get('content-type')).toBe('application/json');
-        });
-    });
-});
-
-//# sourceMappingURL=isolateObjectProperty.spec.js.map

package/dist/utilities/isolateObjectProperty.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utilities/isolateObjectProperty.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { isolateObjectProperty } from './isolateObjectProperty.js'\n\ndescribe('isolateObjectProperty', () => {\n  describe('basic isolation behavior', () => {\n    it('should isolate specified property from the original object', () => {\n      const original = { a: 1, b: 2 }\n      const proxy = isolateObjectProperty(original, 'a')\n\n      proxy.a = 100\n\n      expect(proxy.a).toBe(100)\n      expect(original.a).toBe(1) // Original unchanged\n    })\n\n    it('should share non-isolated properties with the original object', () => {\n      const original = { a: 1, b: 2 }\n      const proxy = isolateObjectProperty(original, 'a')\n\n      proxy.b = 200\n\n      expect(proxy.b).toBe(200)\n      expect(original.b).toBe(200) // Original also changed\n    })\n\n    it('should support isolating multiple properties', () => {\n      const original = { a: 1, b: 2, c: 3 }\n      const proxy = isolateObjectProperty(original, ['a', 'b'])\n\n      proxy.a = 100\n      proxy.b = 200\n\n      expect(proxy.a).toBe(100)\n      expect(proxy.b).toBe(200)\n      expect(original.a).toBe(1)\n      expect(original.b).toBe(2)\n    })\n\n    it('should support deleting isolated properties', () => {\n      const original: Record<string, any> = { a: 1, b: 2 }\n      const proxy = isolateObjectProperty(original, 'a')\n\n      delete proxy.a\n\n      expect('a' in proxy).toBe(false)\n      expect('a' in original).toBe(true) // Original still has it\n    })\n\n    it('should support \"in\" operator for isolated properties', () => {\n      const original: Record<string, any> = { a: 1, b: 2 }\n      const proxy = isolateObjectProperty(original, 'a')\n\n      expect('a' in proxy).toBe(true)\n      expect('b' in proxy).toBe(true)\n\n      delete proxy.a\n      expect('a' in proxy).toBe(false)\n    })\n  })\n\n  describe('private field access (Node 24+ compatibility)', () => {\n    /**\n     * Class with private fields to test that the proxy correctly handles\n     * getters/setters that access private fields (Node 24+ compatibility).\n     */\n    class ObjectWithPrivateFields {\n      #privateValue: string\n\n      constructor(value: string) {\n        this.#privateValue = value\n      }\n\n      get value(): string {\n        return this.#privateValue\n      }\n\n      set value(newValue: string) {\n        this.#privateValue = newValue\n      }\n    }\n\n    it('should allow reading properties via getters that access private fields when not isolated', () => {\n      const original = new ObjectWithPrivateFields('secret')\n\n      expect(original.value).toBe('secret')\n    })\n\n    it('should allow reading properties via getters that access private fields', () => {\n      const original = new ObjectWithPrivateFields('secret')\n      const proxy = isolateObjectProperty(original, 'nonExistentKey' as keyof typeof original)\n\n      // This would throw \"Cannot read private member\" if receiver is wrong\n      expect(proxy.value).toBe('secret')\n    })\n\n    it('should allow writing properties via setters that access private fields', () => {\n      const original = new ObjectWithPrivateFields('secret')\n      const proxy = isolateObjectProperty(original, 'nonExistentKey' as keyof typeof original)\n\n      // This would throw \"Cannot write private member\" if receiver is wrong\n      proxy.value = 'updated'\n\n      expect(proxy.value).toBe('updated')\n      expect(original.value).toBe('updated')\n    })\n\n    it('should work with Headers-like objects (simulating Request.headers)', () => {\n      // Simulate a Request-like object with headers\n      class MockRequest {\n        #headers: Headers\n\n        constructor() {\n          this.#headers = new Headers({ 'content-type': 'application/json' })\n        }\n\n        get headers(): Headers {\n          return this.#headers\n        }\n      }\n\n      const request = new MockRequest()\n      const proxy = isolateObjectProperty(request, 'nonExistentKey' as keyof typeof request)\n\n      // This simulates what happens in createLocalReq when checking req.headers\n      expect(proxy.headers).toBeInstanceOf(Headers)\n      expect(proxy.headers.get('content-type')).toBe('application/json')\n    })\n  })\n})\n"],"names":["describe","expect","it","isolateObjectProperty","original","a","b","proxy","toBe","c","ObjectWithPrivateFields","value","newValue","MockRequest","Headers","headers","request","toBeInstanceOf","get"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,qBAAqB,QAAQ,6BAA4B;AAElEH,SAAS,yBAAyB;IAChCA,SAAS,4BAA4B;QACnCE,GAAG,8DAA8D;YAC/D,MAAME,WAAW;gBAAEC,GAAG;gBAAGC,GAAG;YAAE;YAC9B,MAAMC,QAAQJ,sBAAsBC,UAAU;YAE9CG,MAAMF,CAAC,GAAG;YAEVJ,OAAOM,MAAMF,CAAC,EAAEG,IAAI,CAAC;YACrBP,OAAOG,SAASC,CAAC,EAAEG,IAAI,CAAC,IAAG,qBAAqB;QAClD;QAEAN,GAAG,iEAAiE;YAClE,MAAME,WAAW;gBAAEC,GAAG;gBAAGC,GAAG;YAAE;YAC9B,MAAMC,QAAQJ,sBAAsBC,UAAU;YAE9CG,MAAMD,CAAC,GAAG;YAEVL,OAAOM,MAAMD,CAAC,EAAEE,IAAI,CAAC;YACrBP,OAAOG,SAASE,CAAC,EAAEE,IAAI,CAAC,MAAK,wBAAwB;QACvD;QAEAN,GAAG,gDAAgD;YACjD,MAAME,WAAW;gBAAEC,GAAG;gBAAGC,GAAG;gBAAGG,GAAG;YAAE;YACpC,MAAMF,QAAQJ,sBAAsBC,UAAU;gBAAC;gBAAK;aAAI;YAExDG,MAAMF,CAAC,GAAG;YACVE,MAAMD,CAAC,GAAG;YAEVL,OAAOM,MAAMF,CAAC,EAAEG,IAAI,CAAC;YACrBP,OAAOM,MAAMD,CAAC,EAAEE,IAAI,CAAC;YACrBP,OAAOG,SAASC,CAAC,EAAEG,IAAI,CAAC;YACxBP,OAAOG,SAASE,CAAC,EAAEE,IAAI,CAAC;QAC1B;QAEAN,GAAG,+CAA+C;YAChD,MAAME,WAAgC;gBAAEC,GAAG;gBAAGC,GAAG;YAAE;YACnD,MAAMC,QAAQJ,sBAAsBC,UAAU;YAE9C,OAAOG,MAAMF,CAAC;YAEdJ,OAAO,OAAOM,OAAOC,IAAI,CAAC;YAC1BP,OAAO,OAAOG,UAAUI,IAAI,CAAC,OAAM,wBAAwB;QAC7D;QAEAN,GAAG,wDAAwD;YACzD,MAAME,WAAgC;gBAAEC,GAAG;gBAAGC,GAAG;YAAE;YACnD,MAAMC,QAAQJ,sBAAsBC,UAAU;YAE9CH,OAAO,OAAOM,OAAOC,IAAI,CAAC;YAC1BP,OAAO,OAAOM,OAAOC,IAAI,CAAC;YAE1B,OAAOD,MAAMF,CAAC;YACdJ,OAAO,OAAOM,OAAOC,IAAI,CAAC;QAC5B;IACF;IAEAR,SAAS,iDAAiD;QACxD;;;KAGC,GACD,MAAMU;YACJ,CAAA,YAAa,CAAQ;YAErB,YAAYC,KAAa,CAAE;gBACzB,IAAI,CAAC,CAAA,YAAa,GAAGA;YACvB;YAEA,IAAIA,QAAgB;gBAClB,OAAO,IAAI,CAAC,CAAA,YAAa;YAC3B;YAEA,IAAIA,MAAMC,QAAgB,EAAE;gBAC1B,IAAI,CAAC,CAAA,YAAa,GAAGA;YACvB;QACF;QAEAV,GAAG,4FAA4F;YAC7F,MAAME,WAAW,IAAIM,wBAAwB;YAE7CT,OAAOG,SAASO,KAAK,EAAEH,IAAI,CAAC;QAC9B;QAEAN,GAAG,0EAA0E;YAC3E,MAAME,WAAW,IAAIM,wBAAwB;YAC7C,MAAMH,QAAQJ,sBAAsBC,UAAU;YAE9C,qEAAqE;YACrEH,OAAOM,MAAMI,KAAK,EAAEH,IAAI,CAAC;QAC3B;QAEAN,GAAG,0EAA0E;YAC3E,MAAME,WAAW,IAAIM,wBAAwB;YAC7C,MAAMH,QAAQJ,sBAAsBC,UAAU;YAE9C,sEAAsE;YACtEG,MAAMI,KAAK,GAAG;YAEdV,OAAOM,MAAMI,KAAK,EAAEH,IAAI,CAAC;YACzBP,OAAOG,SAASO,KAAK,EAAEH,IAAI,CAAC;QAC9B;QAEAN,GAAG,sEAAsE;YACvE,8CAA8C;YAC9C,MAAMW;gBACJ,CAAA,OAAQ,CAAS;gBAEjB,aAAc;oBACZ,IAAI,CAAC,CAAA,OAAQ,GAAG,IAAIC,QAAQ;wBAAE,gBAAgB;oBAAmB;gBACnE;gBAEA,IAAIC,UAAmB;oBACrB,OAAO,IAAI,CAAC,CAAA,OAAQ;gBACtB;YACF;YAEA,MAAMC,UAAU,IAAIH;YACpB,MAAMN,QAAQJ,sBAAsBa,SAAS;YAE7C,0EAA0E;YAC1Ef,OAAOM,MAAMQ,OAAO,EAAEE,cAAc,CAACH;YACrCb,OAAOM,MAAMQ,OAAO,CAACG,GAAG,CAAC,iBAAiBV,IAAI,CAAC;QACjD;IACF;AACF"}