payload 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee

package/dist/database/migrations/migrateReset.js

@@ -1,5 +1,5 @@
 import { commitTransaction } from '../../utilities/commitTransaction.js';
-import { createLocalReq } from '../../utilities/createLocalReq.js';
+import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 import { getMigrations } from './getMigrations.js';
@@ -16,10 +16,16 @@ export async function migrateReset() {
         payload.logger.info({
             msg: 'No migrations to reset.'
         });
-        return;
+        return {
+            migrated: [],
+            rolledBack: []
+        };
     }
-    const req = await createLocalReq({}, payload);
+    const req = await createPayloadRequest({
+        payload
+    });
     migrationFiles.reverse();
+    const rolledBack = [];
     // Rollback all migrations in order
     for (const migration of migrationFiles){
         // Create or update migration in database
@@ -39,6 +45,7 @@ export async function migrateReset() {
                 });
                 await payload.delete({
                     collection: 'payload-migrations',
+                    overrideAccess: true,
                     req,
                     where: {
                         id: {
@@ -47,6 +54,7 @@ export async function migrateReset() {
                     }
                 });
                 await commitTransaction(req);
+                rolledBack.push(migration.name);
                 payload.logger.info({
                     msg: `Migrated down:  ${migration.name} (${Date.now() - start}ms)`
                 });
@@ -64,6 +72,7 @@ export async function migrateReset() {
     try {
         await payload.delete({
             collection: 'payload-migrations',
+            overrideAccess: true,
             where: {
                 batch: {
                     equals: -1
@@ -75,7 +84,12 @@ export async function migrateReset() {
             err,
             msg: 'Error deleting dev migration'
         });
+        throw err;
     }
+    return {
+        migrated: [],
+        rolledBack
+    };
 }
 
 //# sourceMappingURL=migrateReset.js.map

package/dist/database/migrations/migrateReset.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/database/migrations/migrateReset.ts"],"sourcesContent":["import type { BaseDatabaseAdapter } from '../types.js'\n\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { createLocalReq } from '../../utilities/createLocalReq.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getMigrations } from './getMigrations.js'\nimport { readMigrationFiles } from './readMigrationFiles.js'\n\nexport async function migrateReset(this: BaseDatabaseAdapter): Promise<void> {\n  const { payload } = this\n  const migrationFiles = await readMigrationFiles({ payload })\n\n  const { existingMigrations } = await getMigrations({ payload })\n\n  if (!existingMigrations?.length) {\n    payload.logger.info({ msg: 'No migrations to reset.' })\n    return\n  }\n\n  const req = await createLocalReq({}, payload)\n\n  migrationFiles.reverse()\n\n  // Rollback all migrations in order\n  for (const migration of migrationFiles) {\n    // Create or update migration in database\n    const existingMigration = existingMigrations.find(\n      (existing) => existing.name === migration.name,\n    )\n    if (existingMigration) {\n      payload.logger.info({ msg: `Migrating down: ${migration.name}` })\n      try {\n        const start = Date.now()\n        await initTransaction(req)\n        const session = payload.db.sessions?.[await req.transactionID!]\n        await migration.down({ payload, req, session })\n        await payload.delete({\n          collection: 'payload-migrations',\n          req,\n          where: {\n            id: {\n              equals: existingMigration.id,\n            },\n          },\n        })\n        await commitTransaction(req)\n        payload.logger.info({ msg: `Migrated down:  ${migration.name} (${Date.now() - start}ms)` })\n      } catch (err: unknown) {\n        await killTransaction(req)\n        payload.logger.error({ err, msg: `Error running migration ${migration.name}` })\n        throw err\n      }\n    }\n  }\n\n  // Delete dev migration\n  try {\n    await payload.delete({\n      collection: 'payload-migrations',\n      where: {\n        batch: {\n          equals: -1,\n        },\n      },\n    })\n  } catch (err: unknown) {\n    payload.logger.error({ err, msg: 'Error deleting dev migration' })\n  }\n}\n"],"names":["commitTransaction","createLocalReq","initTransaction","killTransaction","getMigrations","readMigrationFiles","migrateReset","payload","migrationFiles","existingMigrations","length","logger","info","msg","req","reverse","migration","existingMigration","find","existing","name","start","Date","now","session","db","sessions","transactionID","down","delete","collection","where","id","equals","err","error","batch"],"mappings":"AAEA,SAASA,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,qBAAoB;AAClD,SAASC,kBAAkB,QAAQ,0BAAyB;AAE5D,OAAO,eAAeC;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAG,IAAI;IACxB,MAAMC,iBAAiB,MAAMH,mBAAmB;QAAEE;IAAQ;IAE1D,MAAM,EAAEE,kBAAkB,EAAE,GAAG,MAAML,cAAc;QAAEG;IAAQ;IAE7D,IAAI,CAACE,oBAAoBC,QAAQ;QAC/BH,QAAQI,MAAM,CAACC,IAAI,CAAC;YAAEC,KAAK;QAA0B;QACrD;IACF;IAEA,MAAMC,MAAM,MAAMb,eAAe,CAAC,GAAGM;IAErCC,eAAeO,OAAO;IAEtB,mCAAmC;IACnC,KAAK,MAAMC,aAAaR,eAAgB;QACtC,yCAAyC;QACzC,MAAMS,oBAAoBR,mBAAmBS,IAAI,CAC/C,CAACC,WAAaA,SAASC,IAAI,KAAKJ,UAAUI,IAAI;QAEhD,IAAIH,mBAAmB;YACrBV,QAAQI,MAAM,CAACC,IAAI,CAAC;gBAAEC,KAAK,CAAC,gBAAgB,EAAEG,UAAUI,IAAI,EAAE;YAAC;YAC/D,IAAI;gBACF,MAAMC,QAAQC,KAAKC,GAAG;gBACtB,MAAMrB,gBAAgBY;gBACtB,MAAMU,UAAUjB,QAAQkB,EAAE,CAACC,QAAQ,EAAE,CAAC,MAAMZ,IAAIa,aAAa,CAAE;gBAC/D,MAAMX,UAAUY,IAAI,CAAC;oBAAErB;oBAASO;oBAAKU;gBAAQ;gBAC7C,MAAMjB,QAAQsB,MAAM,CAAC;oBACnBC,YAAY;oBACZhB;oBACAiB,OAAO;wBACLC,IAAI;4BACFC,QAAQhB,kBAAkBe,EAAE;wBAC9B;oBACF;gBACF;gBACA,MAAMhC,kBAAkBc;gBACxBP,QAAQI,MAAM,CAACC,IAAI,CAAC;oBAAEC,KAAK,CAAC,gBAAgB,EAAEG,UAAUI,IAAI,CAAC,EAAE,EAAEE,KAAKC,GAAG,KAAKF,MAAM,GAAG,CAAC;gBAAC;YAC3F,EAAE,OAAOa,KAAc;gBACrB,MAAM/B,gBAAgBW;gBACtBP,QAAQI,MAAM,CAACwB,KAAK,CAAC;oBAAED;oBAAKrB,KAAK,CAAC,wBAAwB,EAAEG,UAAUI,IAAI,EAAE;gBAAC;gBAC7E,MAAMc;YACR;QACF;IACF;IAEA,uBAAuB;IACvB,IAAI;QACF,MAAM3B,QAAQsB,MAAM,CAAC;YACnBC,YAAY;YACZC,OAAO;gBACLK,OAAO;oBACLH,QAAQ,CAAC;gBACX;YACF;QACF;IACF,EAAE,OAAOC,KAAc;QACrB3B,QAAQI,MAAM,CAACwB,KAAK,CAAC;YAAED;YAAKrB,KAAK;QAA+B;IAClE;AACF"}
+{"version":3,"sources":["../../../src/database/migrations/migrateReset.ts"],"sourcesContent":["import type { BaseDatabaseAdapter, MigrationResult } from '../types.js'\n\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getMigrations } from './getMigrations.js'\nimport { readMigrationFiles } from './readMigrationFiles.js'\n\nexport async function migrateReset(this: BaseDatabaseAdapter): Promise<MigrationResult> {\n  const { payload } = this\n  const migrationFiles = await readMigrationFiles({ payload })\n\n  const { existingMigrations } = await getMigrations({ payload })\n\n  if (!existingMigrations?.length) {\n    payload.logger.info({ msg: 'No migrations to reset.' })\n    return { migrated: [], rolledBack: [] }\n  }\n\n  const req = await createPayloadRequest({ payload })\n\n  migrationFiles.reverse()\n  const rolledBack: string[] = []\n\n  // Rollback all migrations in order\n  for (const migration of migrationFiles) {\n    // Create or update migration in database\n    const existingMigration = existingMigrations.find(\n      (existing) => existing.name === migration.name,\n    )\n    if (existingMigration) {\n      payload.logger.info({ msg: `Migrating down: ${migration.name}` })\n      try {\n        const start = Date.now()\n        await initTransaction(req)\n        const session = payload.db.sessions?.[await req.transactionID!]\n        await migration.down({ payload, req, session })\n        await payload.delete({\n          collection: 'payload-migrations',\n          overrideAccess: true,\n          req,\n          where: {\n            id: {\n              equals: existingMigration.id,\n            },\n          },\n        })\n        await commitTransaction(req)\n        rolledBack.push(migration.name)\n        payload.logger.info({ msg: `Migrated down:  ${migration.name} (${Date.now() - start}ms)` })\n      } catch (err: unknown) {\n        await killTransaction(req)\n        payload.logger.error({ err, msg: `Error running migration ${migration.name}` })\n        throw err\n      }\n    }\n  }\n\n  // Delete dev migration\n  try {\n    await payload.delete({\n      collection: 'payload-migrations',\n      overrideAccess: true,\n      where: {\n        batch: {\n          equals: -1,\n        },\n      },\n    })\n  } catch (err: unknown) {\n    payload.logger.error({ err, msg: 'Error deleting dev migration' })\n    throw err\n  }\n\n  return { migrated: [], rolledBack }\n}\n"],"names":["commitTransaction","createPayloadRequest","initTransaction","killTransaction","getMigrations","readMigrationFiles","migrateReset","payload","migrationFiles","existingMigrations","length","logger","info","msg","migrated","rolledBack","req","reverse","migration","existingMigration","find","existing","name","start","Date","now","session","db","sessions","transactionID","down","delete","collection","overrideAccess","where","id","equals","push","err","error","batch"],"mappings":"AAEA,SAASA,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,qBAAoB;AAClD,SAASC,kBAAkB,QAAQ,0BAAyB;AAE5D,OAAO,eAAeC;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAG,IAAI;IACxB,MAAMC,iBAAiB,MAAMH,mBAAmB;QAAEE;IAAQ;IAE1D,MAAM,EAAEE,kBAAkB,EAAE,GAAG,MAAML,cAAc;QAAEG;IAAQ;IAE7D,IAAI,CAACE,oBAAoBC,QAAQ;QAC/BH,QAAQI,MAAM,CAACC,IAAI,CAAC;YAAEC,KAAK;QAA0B;QACrD,OAAO;YAAEC,UAAU,EAAE;YAAEC,YAAY,EAAE;QAAC;IACxC;IAEA,MAAMC,MAAM,MAAMf,qBAAqB;QAAEM;IAAQ;IAEjDC,eAAeS,OAAO;IACtB,MAAMF,aAAuB,EAAE;IAE/B,mCAAmC;IACnC,KAAK,MAAMG,aAAaV,eAAgB;QACtC,yCAAyC;QACzC,MAAMW,oBAAoBV,mBAAmBW,IAAI,CAC/C,CAACC,WAAaA,SAASC,IAAI,KAAKJ,UAAUI,IAAI;QAEhD,IAAIH,mBAAmB;YACrBZ,QAAQI,MAAM,CAACC,IAAI,CAAC;gBAAEC,KAAK,CAAC,gBAAgB,EAAEK,UAAUI,IAAI,EAAE;YAAC;YAC/D,IAAI;gBACF,MAAMC,QAAQC,KAAKC,GAAG;gBACtB,MAAMvB,gBAAgBc;gBACtB,MAAMU,UAAUnB,QAAQoB,EAAE,CAACC,QAAQ,EAAE,CAAC,MAAMZ,IAAIa,aAAa,CAAE;gBAC/D,MAAMX,UAAUY,IAAI,CAAC;oBAAEvB;oBAASS;oBAAKU;gBAAQ;gBAC7C,MAAMnB,QAAQwB,MAAM,CAAC;oBACnBC,YAAY;oBACZC,gBAAgB;oBAChBjB;oBACAkB,OAAO;wBACLC,IAAI;4BACFC,QAAQjB,kBAAkBgB,EAAE;wBAC9B;oBACF;gBACF;gBACA,MAAMnC,kBAAkBgB;gBACxBD,WAAWsB,IAAI,CAACnB,UAAUI,IAAI;gBAC9Bf,QAAQI,MAAM,CAACC,IAAI,CAAC;oBAAEC,KAAK,CAAC,gBAAgB,EAAEK,UAAUI,IAAI,CAAC,EAAE,EAAEE,KAAKC,GAAG,KAAKF,MAAM,GAAG,CAAC;gBAAC;YAC3F,EAAE,OAAOe,KAAc;gBACrB,MAAMnC,gBAAgBa;gBACtBT,QAAQI,MAAM,CAAC4B,KAAK,CAAC;oBAAED;oBAAKzB,KAAK,CAAC,wBAAwB,EAAEK,UAAUI,IAAI,EAAE;gBAAC;gBAC7E,MAAMgB;YACR;QACF;IACF;IAEA,uBAAuB;IACvB,IAAI;QACF,MAAM/B,QAAQwB,MAAM,CAAC;YACnBC,YAAY;YACZC,gBAAgB;YAChBC,OAAO;gBACLM,OAAO;oBACLJ,QAAQ,CAAC;gBACX;YACF;QACF;IACF,EAAE,OAAOE,KAAc;QACrB/B,QAAQI,MAAM,CAAC4B,KAAK,CAAC;YAAED;YAAKzB,KAAK;QAA+B;QAChE,MAAMyB;IACR;IAEA,OAAO;QAAExB,UAAU,EAAE;QAAEC;IAAW;AACpC"}

package/dist/database/migrations/migrateStatus.d.ts

@@ -1,3 +1,3 @@
-import type { BaseDatabaseAdapter } from '../types.js';
-export declare function migrateStatus(this: BaseDatabaseAdapter): Promise<void>;
+import type { BaseDatabaseAdapter, MigrationStatus } from '../types.js';
+export declare function migrateStatus(this: BaseDatabaseAdapter): Promise<MigrationStatus[]>;
 //# sourceMappingURL=migrateStatus.d.ts.map

package/dist/database/migrations/migrateStatus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrateStatus.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/migrateStatus.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAKtD,wBAAsB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC5E"}
+{"version":3,"file":"migrateStatus.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/migrateStatus.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAKvE,wBAAsB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAsCzF"}

package/dist/database/migrations/migrateStatus.js

@@ -16,24 +16,29 @@ export async function migrateStatus() {
         payload.logger.info({
             msg: 'No migrations found.'
         });
-        return;
+        return [];
     }
     // Compare migration files to existing migrations
     const statuses = migrationFiles.map((migration)=>{
         const existingMigration = existingMigrations.find((m)=>m.name === migration.name);
         return {
-            Name: migration.name,
-            Batch: existingMigration?.batch,
-            Ran: existingMigration ? 'Yes' : 'No'
+            name: migration.name,
+            batch: existingMigration?.batch,
+            ran: Boolean(existingMigration)
         };
     });
     const p = new Table();
     statuses.forEach((s)=>{
-        p.addRow(s, {
-            color: s.Ran === 'Yes' ? 'green' : 'red'
+        p.addRow({
+            Batch: s.batch,
+            Name: s.name,
+            Ran: s.ran ? 'Yes' : 'No'
+        }, {
+            color: s.ran ? 'green' : 'red'
         });
     });
     p.printTable();
+    return statuses;
 }
 
 //# sourceMappingURL=migrateStatus.js.map

package/dist/database/migrations/migrateStatus.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/database/migrations/migrateStatus.ts"],"sourcesContent":["import { Table } from 'console-table-printer'\n\nimport type { BaseDatabaseAdapter } from '../types.js'\n\nimport { getMigrations } from './getMigrations.js'\nimport { readMigrationFiles } from './readMigrationFiles.js'\n\nexport async function migrateStatus(this: BaseDatabaseAdapter): Promise<void> {\n  const { payload } = this\n  const migrationFiles = await readMigrationFiles({ payload })\n\n  payload.logger.debug({\n    msg: `Found ${migrationFiles.length} migration files.`,\n  })\n\n  const { existingMigrations } = await getMigrations({ payload })\n\n  if (!migrationFiles.length) {\n    payload.logger.info({ msg: 'No migrations found.' })\n    return\n  }\n\n  // Compare migration files to existing migrations\n  const statuses = migrationFiles.map((migration) => {\n    const existingMigration = existingMigrations.find((m) => m.name === migration.name)\n    return {\n      Name: migration.name,\n\n      Batch: existingMigration?.batch,\n      Ran: existingMigration ? 'Yes' : 'No',\n    }\n  })\n\n  const p = new Table()\n\n  statuses.forEach((s) => {\n    p.addRow(s, {\n      color: s.Ran === 'Yes' ? 'green' : 'red',\n    })\n  })\n  p.printTable()\n}\n"],"names":["Table","getMigrations","readMigrationFiles","migrateStatus","payload","migrationFiles","logger","debug","msg","length","existingMigrations","info","statuses","map","migration","existingMigration","find","m","name","Name","Batch","batch","Ran","p","forEach","s","addRow","color","printTable"],"mappings":"AAAA,SAASA,KAAK,QAAQ,wBAAuB;AAI7C,SAASC,aAAa,QAAQ,qBAAoB;AAClD,SAASC,kBAAkB,QAAQ,0BAAyB;AAE5D,OAAO,eAAeC;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAG,IAAI;IACxB,MAAMC,iBAAiB,MAAMH,mBAAmB;QAAEE;IAAQ;IAE1DA,QAAQE,MAAM,CAACC,KAAK,CAAC;QACnBC,KAAK,CAAC,MAAM,EAAEH,eAAeI,MAAM,CAAC,iBAAiB,CAAC;IACxD;IAEA,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAMT,cAAc;QAAEG;IAAQ;IAE7D,IAAI,CAACC,eAAeI,MAAM,EAAE;QAC1BL,QAAQE,MAAM,CAACK,IAAI,CAAC;YAAEH,KAAK;QAAuB;QAClD;IACF;IAEA,iDAAiD;IACjD,MAAMI,WAAWP,eAAeQ,GAAG,CAAC,CAACC;QACnC,MAAMC,oBAAoBL,mBAAmBM,IAAI,CAAC,CAACC,IAAMA,EAAEC,IAAI,KAAKJ,UAAUI,IAAI;QAClF,OAAO;YACLC,MAAML,UAAUI,IAAI;YAEpBE,OAAOL,mBAAmBM;YAC1BC,KAAKP,oBAAoB,QAAQ;QACnC;IACF;IAEA,MAAMQ,IAAI,IAAIvB;IAEdY,SAASY,OAAO,CAAC,CAACC;QAChBF,EAAEG,MAAM,CAACD,GAAG;YACVE,OAAOF,EAAEH,GAAG,KAAK,QAAQ,UAAU;QACrC;IACF;IACAC,EAAEK,UAAU;AACd"}
+{"version":3,"sources":["../../../src/database/migrations/migrateStatus.ts"],"sourcesContent":["import { Table } from 'console-table-printer'\n\nimport type { BaseDatabaseAdapter, MigrationStatus } from '../types.js'\n\nimport { getMigrations } from './getMigrations.js'\nimport { readMigrationFiles } from './readMigrationFiles.js'\n\nexport async function migrateStatus(this: BaseDatabaseAdapter): Promise<MigrationStatus[]> {\n  const { payload } = this\n  const migrationFiles = await readMigrationFiles({ payload })\n\n  payload.logger.debug({\n    msg: `Found ${migrationFiles.length} migration files.`,\n  })\n\n  const { existingMigrations } = await getMigrations({ payload })\n\n  if (!migrationFiles.length) {\n    payload.logger.info({ msg: 'No migrations found.' })\n    return []\n  }\n\n  // Compare migration files to existing migrations\n  const statuses = migrationFiles.map((migration) => {\n    const existingMigration = existingMigrations.find((m) => m.name === migration.name)\n    return {\n      name: migration.name,\n      batch: existingMigration?.batch,\n      ran: Boolean(existingMigration),\n    }\n  })\n\n  const p = new Table()\n\n  statuses.forEach((s) => {\n    p.addRow(\n      { Batch: s.batch, Name: s.name, Ran: s.ran ? 'Yes' : 'No' },\n      {\n        color: s.ran ? 'green' : 'red',\n      },\n    )\n  })\n  p.printTable()\n\n  return statuses\n}\n"],"names":["Table","getMigrations","readMigrationFiles","migrateStatus","payload","migrationFiles","logger","debug","msg","length","existingMigrations","info","statuses","map","migration","existingMigration","find","m","name","batch","ran","Boolean","p","forEach","s","addRow","Batch","Name","Ran","color","printTable"],"mappings":"AAAA,SAASA,KAAK,QAAQ,wBAAuB;AAI7C,SAASC,aAAa,QAAQ,qBAAoB;AAClD,SAASC,kBAAkB,QAAQ,0BAAyB;AAE5D,OAAO,eAAeC;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAG,IAAI;IACxB,MAAMC,iBAAiB,MAAMH,mBAAmB;QAAEE;IAAQ;IAE1DA,QAAQE,MAAM,CAACC,KAAK,CAAC;QACnBC,KAAK,CAAC,MAAM,EAAEH,eAAeI,MAAM,CAAC,iBAAiB,CAAC;IACxD;IAEA,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAMT,cAAc;QAAEG;IAAQ;IAE7D,IAAI,CAACC,eAAeI,MAAM,EAAE;QAC1BL,QAAQE,MAAM,CAACK,IAAI,CAAC;YAAEH,KAAK;QAAuB;QAClD,OAAO,EAAE;IACX;IAEA,iDAAiD;IACjD,MAAMI,WAAWP,eAAeQ,GAAG,CAAC,CAACC;QACnC,MAAMC,oBAAoBL,mBAAmBM,IAAI,CAAC,CAACC,IAAMA,EAAEC,IAAI,KAAKJ,UAAUI,IAAI;QAClF,OAAO;YACLA,MAAMJ,UAAUI,IAAI;YACpBC,OAAOJ,mBAAmBI;YAC1BC,KAAKC,QAAQN;QACf;IACF;IAEA,MAAMO,IAAI,IAAItB;IAEdY,SAASW,OAAO,CAAC,CAACC;QAChBF,EAAEG,MAAM,CACN;YAAEC,OAAOF,EAAEL,KAAK;YAAEQ,MAAMH,EAAEN,IAAI;YAAEU,KAAKJ,EAAEJ,GAAG,GAAG,QAAQ;QAAK,GAC1D;YACES,OAAOL,EAAEJ,GAAG,GAAG,UAAU;QAC3B;IAEJ;IACAE,EAAEQ,UAAU;IAEZ,OAAOlB;AACT"}

package/dist/database/migrations/migrationsCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrationsCollection.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/migrationsCollection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AAEzE,eAAO,MAAM,oBAAoB,EAAE,gBAoBlC,CAAA"}
+{"version":3,"file":"migrationsCollection.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/migrationsCollection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AAEzE,eAAO,MAAM,oBAAoB,EAAE,gBAqBlC,CAAA"}

package/dist/database/migrations/migrationsCollection.js

@@ -3,6 +3,7 @@ export const migrationsCollection = {
     admin: {
         hidden: true
     },
+    authorship: false,
     endpoints: false,
     fields: [
         {

package/dist/database/migrations/migrationsCollection.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/database/migrations/migrationsCollection.ts"],"sourcesContent":["import type { CollectionConfig } from '../../collections/config/types.js'\n\nexport const migrationsCollection: CollectionConfig = {\n  slug: 'payload-migrations',\n  admin: {\n    hidden: true,\n  },\n  endpoints: false,\n  fields: [\n    {\n      name: 'name',\n      type: 'text',\n    },\n    {\n      name: 'batch',\n      type: 'number',\n      // NOTE: This value is -1 if it is a \"dev push\"\n    },\n  ],\n  graphQL: false,\n  lockDocuments: false,\n  versions: false,\n}\n"],"names":["migrationsCollection","slug","admin","hidden","endpoints","fields","name","type","graphQL","lockDocuments","versions"],"mappings":"AAEA,OAAO,MAAMA,uBAAyC;IACpDC,MAAM;IACNC,OAAO;QACLC,QAAQ;IACV;IACAC,WAAW;IACXC,QAAQ;QACN;YACEC,MAAM;YACNC,MAAM;QACR;QACA;YACED,MAAM;YACNC,MAAM;QAER;KACD;IACDC,SAAS;IACTC,eAAe;IACfC,UAAU;AACZ,EAAC"}
+{"version":3,"sources":["../../../src/database/migrations/migrationsCollection.ts"],"sourcesContent":["import type { CollectionConfig } from '../../collections/config/types.js'\n\nexport const migrationsCollection: CollectionConfig = {\n  slug: 'payload-migrations',\n  admin: {\n    hidden: true,\n  },\n  authorship: false,\n  endpoints: false,\n  fields: [\n    {\n      name: 'name',\n      type: 'text',\n    },\n    {\n      name: 'batch',\n      type: 'number',\n      // NOTE: This value is -1 if it is a \"dev push\"\n    },\n  ],\n  graphQL: false,\n  lockDocuments: false,\n  versions: false,\n}\n"],"names":["migrationsCollection","slug","admin","hidden","authorship","endpoints","fields","name","type","graphQL","lockDocuments","versions"],"mappings":"AAEA,OAAO,MAAMA,uBAAyC;IACpDC,MAAM;IACNC,OAAO;QACLC,QAAQ;IACV;IACAC,YAAY;IACZC,WAAW;IACXC,QAAQ;QACN;YACEC,MAAM;YACNC,MAAM;QACR;QACA;YACED,MAAM;YACNC,MAAM;QAER;KACD;IACDC,SAAS;IACTC,eAAe;IACfC,UAAU;AACZ,EAAC"}

package/dist/database/migrations/readMigrationFiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readMigrationFiles.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/readMigrationFiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAI5C;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAU,cAEtC;IACD,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,SAAS,EAAE,CAyCtB,CAAA"}
+{"version":3,"file":"readMigrationFiles.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/readMigrationFiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAI5C;;GAEG;AACH,eAAO,MAAM,kBAAkB,iBAE5B;IACD,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,SAAS,EAAE,CAyCtB,CAAA"}

package/dist/database/migrations/writeMigrationIndex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writeMigrationIndex.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/writeMigrationIndex.ts"],"names":[],"mappings":"AAuCA,eAAO,MAAM,mBAAmB,GAAI,MAAM;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,SAKlE,CAAA"}
+{"version":3,"file":"writeMigrationIndex.d.ts","sourceRoot":"","sources":["../../../src/database/migrations/writeMigrationIndex.ts"],"names":[],"mappings":"AAuCA,eAAO,MAAM,mBAAmB,SAAU;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,SAKlE,CAAA"}

package/dist/database/prefixWherePaths.d.ts

@@ -0,0 +1,6 @@
+import type { Where } from '../types/index.js';
+export declare const prefixWherePaths: ({ prefix, where }: {
+    prefix: string;
+    where: Where;
+}) => Where;
+//# sourceMappingURL=prefixWherePaths.d.ts.map

package/dist/database/prefixWherePaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefixWherePaths.d.ts","sourceRoot":"","sources":["../../src/database/prefixWherePaths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9C,eAAO,MAAM,gBAAgB,sBAAuB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KAAG,KActF,CAAA"}

package/dist/database/prefixWherePaths.js

@@ -0,0 +1,19 @@
+export const prefixWherePaths = ({ prefix, where })=>{
+    const prefixedWhere = {};
+    for (const [key, value] of Object.entries(where)){
+        if ([
+            'and',
+            'or'
+        ].includes(key.toLowerCase()) && Array.isArray(value)) {
+            prefixedWhere[key] = value.map((nestedWhere)=>prefixWherePaths({
+                    prefix,
+                    where: nestedWhere
+                }));
+        } else {
+            prefixedWhere[`${prefix}.${key}`] = value;
+        }
+    }
+    return prefixedWhere;
+};
+
+//# sourceMappingURL=prefixWherePaths.js.map

package/dist/database/prefixWherePaths.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/database/prefixWherePaths.ts"],"sourcesContent":["import type { Where } from '../types/index.js'\n\nexport const prefixWherePaths = ({ prefix, where }: { prefix: string; where: Where }): Where => {\n  const prefixedWhere: Where = {}\n\n  for (const [key, value] of Object.entries(where)) {\n    if (['and', 'or'].includes(key.toLowerCase()) && Array.isArray(value)) {\n      prefixedWhere[key] = value.map((nestedWhere) =>\n        prefixWherePaths({ prefix, where: nestedWhere }),\n      )\n    } else {\n      prefixedWhere[`${prefix}.${key}`] = value\n    }\n  }\n\n  return prefixedWhere\n}\n"],"names":["prefixWherePaths","prefix","where","prefixedWhere","key","value","Object","entries","includes","toLowerCase","Array","isArray","map","nestedWhere"],"mappings":"AAEA,OAAO,MAAMA,mBAAmB,CAAC,EAAEC,MAAM,EAAEC,KAAK,EAAoC;IAClF,MAAMC,gBAAuB,CAAC;IAE9B,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACL,OAAQ;QAChD,IAAI;YAAC;YAAO;SAAK,CAACM,QAAQ,CAACJ,IAAIK,WAAW,OAAOC,MAAMC,OAAO,CAACN,QAAQ;YACrEF,aAAa,CAACC,IAAI,GAAGC,MAAMO,GAAG,CAAC,CAACC,cAC9Bb,iBAAiB;oBAAEC;oBAAQC,OAAOW;gBAAY;QAElD,OAAO;YACLV,aAAa,CAAC,GAAGF,OAAO,CAAC,EAAEG,KAAK,CAAC,GAAGC;QACtC;IACF;IAEA,OAAOF;AACT,EAAC"}

package/dist/database/queryValidation/validateQueryPaths.d.ts

@@ -11,6 +11,7 @@ type Args = {
     policies?: EntityPolicies;
     polymorphicJoin?: boolean;
     req: PayloadRequest;
+    showHiddenFields?: boolean;
     versionFields?: FlattenedField[];
     where: Where;
 } & ({
@@ -20,6 +21,6 @@ type Args = {
     collectionConfig?: never | undefined;
     globalConfig: SanitizedGlobalConfig;
 });
-export declare function validateQueryPaths({ collectionConfig, errors, globalConfig, overrideAccess, policies, polymorphicJoin, req, versionFields, where, }: Args): Promise<void>;
+export declare function validateQueryPaths({ collectionConfig, errors, globalConfig, overrideAccess, policies, polymorphicJoin, req, showHiddenFields, versionFields, where, }: Args): Promise<void>;
 export {};
 //# sourceMappingURL=validateQueryPaths.d.ts.map

package/dist/database/queryValidation/validateQueryPaths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateQueryPaths.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateQueryPaths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAY,cAAc,EAAE,KAAK,EAAc,MAAM,sBAAsB,CAAA;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMhD,KAAK,IAAI,GAAG;IACV,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC3B,cAAc,EAAE,OAAO,CAAA;IAEvB,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;IAChC,KAAK,EAAE,KAAK,CAAA;CACb,GAAG,CACA;IACE,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,YAAY,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;CACjC,GACD;IACE,gBAAgB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;IACpC,YAAY,EAAE,qBAAqB,CAAA;CACpC,CACJ,CAAA;AAED,wBAAsB,kBAAkB,CAAC,EACvC,gBAAgB,EAChB,MAAW,EACX,YAAY,EACZ,cAAc,EACd,QAGC,EACD,eAAe,EACf,GAAG,EACH,aAAa,EACb,KAAK,GACN,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAwEtB"}
+{"version":3,"file":"validateQueryPaths.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateQueryPaths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAY,cAAc,EAAE,KAAK,EAAc,MAAM,sBAAsB,CAAA;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMhD,KAAK,IAAI,GAAG;IACV,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC3B,cAAc,EAAE,OAAO,CAAA;IAEvB,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;IAChC,KAAK,EAAE,KAAK,CAAA;CACb,GAAG,CACA;IACE,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,YAAY,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;CACjC,GACD;IACE,gBAAgB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;IACpC,YAAY,EAAE,qBAAqB,CAAA;CACpC,CACJ,CAAA;AAED,wBAAsB,kBAAkB,CAAC,EACvC,gBAAgB,EAChB,MAAW,EACX,YAAY,EACZ,cAAc,EACd,QAGC,EACD,eAAe,EACf,GAAG,EACH,gBAAgB,EAChB,aAAa,EACb,KAAK,GACN,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EtB"}

package/dist/database/queryValidation/validateQueryPaths.js

@@ -4,14 +4,17 @@ import { validateSearchParam } from './validateSearchParams.js';
 export async function validateQueryPaths({ collectionConfig, errors = [], globalConfig, overrideAccess, policies = {
     collections: {},
     globals: {}
-}, polymorphicJoin, req, versionFields, where }) {
+}, polymorphicJoin, req, showHiddenFields, versionFields, where }) {
     const fields = versionFields || (globalConfig || collectionConfig).flattenedFields;
     if (typeof where === 'object') {
         // We need to determine if the whereKey is an AND, OR, or a schema path
         const promises = [];
         for(const path in where){
             const constraint = where[path];
-            if ((path === 'and' || path === 'or') && Array.isArray(constraint)) {
+            if ([
+                'and',
+                'or'
+            ].includes(path.toLowerCase()) && Array.isArray(constraint)) {
                 for (const item of constraint){
                     if (collectionConfig) {
                         promises.push(validateQueryPaths({
@@ -21,6 +24,7 @@ export async function validateQueryPaths({ collectionConfig, errors = [], global
                             policies,
                             polymorphicJoin,
                             req,
+                            showHiddenFields,
                             versionFields,
                             where: item
                         }));
@@ -32,11 +36,16 @@ export async function validateQueryPaths({ collectionConfig, errors = [], global
                             policies,
                             polymorphicJoin,
                             req,
+                            showHiddenFields,
                             versionFields,
                             where: item
                         }));
                     }
                 }
+            } else if (Array.isArray(constraint)) {
+                errors.push({
+                    path
+                });
             } else if (!Array.isArray(constraint)) {
                 for(const operator in constraint){
                     const val = constraint[operator];
@@ -53,6 +62,7 @@ export async function validateQueryPaths({ collectionConfig, errors = [], global
                             policies,
                             polymorphicJoin,
                             req,
+                            showHiddenFields,
                             val,
                             versionFields
                         }));

package/dist/database/queryValidation/validateQueryPaths.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/database/queryValidation/validateQueryPaths.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { Operator, PayloadRequest, Where, WhereField } from '../../types/index.js'\nimport type { EntityPolicies } from './types.js'\n\nimport { QueryError } from '../../errors/QueryError.js'\nimport { validOperatorSet } from '../../types/constants.js'\nimport { validateSearchParam } from './validateSearchParams.js'\n\ntype Args = {\n  errors?: { path: string }[]\n  overrideAccess: boolean\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies?: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  versionFields?: FlattenedField[]\n  where: Where\n} & (\n  | {\n      collectionConfig: SanitizedCollectionConfig\n      globalConfig?: never | undefined\n    }\n  | {\n      collectionConfig?: never | undefined\n      globalConfig: SanitizedGlobalConfig\n    }\n)\n\nexport async function validateQueryPaths({\n  collectionConfig,\n  errors = [],\n  globalConfig,\n  overrideAccess,\n  policies = {\n    collections: {},\n    globals: {},\n  },\n  polymorphicJoin,\n  req,\n  versionFields,\n  where,\n}: Args): Promise<void> {\n  const fields = versionFields || (globalConfig || collectionConfig).flattenedFields\n\n  if (typeof where === 'object') {\n    // We need to determine if the whereKey is an AND, OR, or a schema path\n    const promises: Promise<void>[] = []\n    for (const path in where) {\n      const constraint = where[path]\n\n      if ((path === 'and' || path === 'or') && Array.isArray(constraint)) {\n        for (const item of constraint) {\n          if (collectionConfig) {\n            promises.push(\n              validateQueryPaths({\n                collectionConfig,\n                errors,\n                overrideAccess,\n                policies,\n                polymorphicJoin,\n                req,\n                versionFields,\n                where: item,\n              }),\n            )\n          } else {\n            promises.push(\n              validateQueryPaths({\n                errors,\n                globalConfig,\n                overrideAccess,\n                policies,\n                polymorphicJoin,\n                req,\n                versionFields,\n                where: item,\n              }),\n            )\n          }\n        }\n      } else if (!Array.isArray(constraint)) {\n        for (const operator in constraint) {\n          const val = constraint[operator as keyof typeof constraint]\n          if (validOperatorSet.has(operator as Operator)) {\n            promises.push(\n              validateSearchParam({\n                collectionConfig,\n                constraint: where as WhereField,\n                errors,\n                fields,\n                globalConfig,\n                operator,\n                overrideAccess,\n                path,\n                policies,\n                polymorphicJoin,\n                req,\n                val,\n                versionFields,\n              }),\n            )\n          } else {\n            errors.push({ path: `${path}.${operator}` })\n          }\n        }\n      }\n    }\n\n    await Promise.all(promises)\n    if (errors.length > 0) {\n      throw new QueryError(errors)\n    }\n  }\n}\n"],"names":["QueryError","validOperatorSet","validateSearchParam","validateQueryPaths","collectionConfig","errors","globalConfig","overrideAccess","policies","collections","globals","polymorphicJoin","req","versionFields","where","fields","flattenedFields","promises","path","constraint","Array","isArray","item","push","operator","val","has","Promise","all","length"],"mappings":"AAMA,SAASA,UAAU,QAAQ,6BAA4B;AACvD,SAASC,gBAAgB,QAAQ,2BAA0B;AAC3D,SAASC,mBAAmB,QAAQ,4BAA2B;AAsB/D,OAAO,eAAeC,mBAAmB,EACvCC,gBAAgB,EAChBC,SAAS,EAAE,EACXC,YAAY,EACZC,cAAc,EACdC,WAAW;IACTC,aAAa,CAAC;IACdC,SAAS,CAAC;AACZ,CAAC,EACDC,eAAe,EACfC,GAAG,EACHC,aAAa,EACbC,KAAK,EACA;IACL,MAAMC,SAASF,iBAAiB,AAACP,CAAAA,gBAAgBF,gBAAe,EAAGY,eAAe;IAElF,IAAI,OAAOF,UAAU,UAAU;QAC7B,uEAAuE;QACvE,MAAMG,WAA4B,EAAE;QACpC,IAAK,MAAMC,QAAQJ,MAAO;YACxB,MAAMK,aAAaL,KAAK,CAACI,KAAK;YAE9B,IAAI,AAACA,CAAAA,SAAS,SAASA,SAAS,IAAG,KAAME,MAAMC,OAAO,CAACF,aAAa;gBAClE,KAAK,MAAMG,QAAQH,WAAY;oBAC7B,IAAIf,kBAAkB;wBACpBa,SAASM,IAAI,CACXpB,mBAAmB;4BACjBC;4BACAC;4BACAE;4BACAC;4BACAG;4BACAC;4BACAC;4BACAC,OAAOQ;wBACT;oBAEJ,OAAO;wBACLL,SAASM,IAAI,CACXpB,mBAAmB;4BACjBE;4BACAC;4BACAC;4BACAC;4BACAG;4BACAC;4BACAC;4BACAC,OAAOQ;wBACT;oBAEJ;gBACF;YACF,OAAO,IAAI,CAACF,MAAMC,OAAO,CAACF,aAAa;gBACrC,IAAK,MAAMK,YAAYL,WAAY;oBACjC,MAAMM,MAAMN,UAAU,CAACK,SAAoC;oBAC3D,IAAIvB,iBAAiByB,GAAG,CAACF,WAAuB;wBAC9CP,SAASM,IAAI,CACXrB,oBAAoB;4BAClBE;4BACAe,YAAYL;4BACZT;4BACAU;4BACAT;4BACAkB;4BACAjB;4BACAW;4BACAV;4BACAG;4BACAC;4BACAa;4BACAZ;wBACF;oBAEJ,OAAO;wBACLR,OAAOkB,IAAI,CAAC;4BAAEL,MAAM,GAAGA,KAAK,CAAC,EAAEM,UAAU;wBAAC;oBAC5C;gBACF;YACF;QACF;QAEA,MAAMG,QAAQC,GAAG,CAACX;QAClB,IAAIZ,OAAOwB,MAAM,GAAG,GAAG;YACrB,MAAM,IAAI7B,WAAWK;QACvB;IACF;AACF"}
+{"version":3,"sources":["../../../src/database/queryValidation/validateQueryPaths.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { Operator, PayloadRequest, Where, WhereField } from '../../types/index.js'\nimport type { EntityPolicies } from './types.js'\n\nimport { QueryError } from '../../errors/QueryError.js'\nimport { validOperatorSet } from '../../types/constants.js'\nimport { validateSearchParam } from './validateSearchParams.js'\n\ntype Args = {\n  errors?: { path: string }[]\n  overrideAccess: boolean\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies?: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  showHiddenFields?: boolean\n  versionFields?: FlattenedField[]\n  where: Where\n} & (\n  | {\n      collectionConfig: SanitizedCollectionConfig\n      globalConfig?: never | undefined\n    }\n  | {\n      collectionConfig?: never | undefined\n      globalConfig: SanitizedGlobalConfig\n    }\n)\n\nexport async function validateQueryPaths({\n  collectionConfig,\n  errors = [],\n  globalConfig,\n  overrideAccess,\n  policies = {\n    collections: {},\n    globals: {},\n  },\n  polymorphicJoin,\n  req,\n  showHiddenFields,\n  versionFields,\n  where,\n}: Args): Promise<void> {\n  const fields = versionFields || (globalConfig || collectionConfig).flattenedFields\n\n  if (typeof where === 'object') {\n    // We need to determine if the whereKey is an AND, OR, or a schema path\n    const promises: Promise<void>[] = []\n    for (const path in where) {\n      const constraint = where[path]\n\n      if (['and', 'or'].includes(path.toLowerCase()) && Array.isArray(constraint)) {\n        for (const item of constraint) {\n          if (collectionConfig) {\n            promises.push(\n              validateQueryPaths({\n                collectionConfig,\n                errors,\n                overrideAccess,\n                policies,\n                polymorphicJoin,\n                req,\n                showHiddenFields,\n                versionFields,\n                where: item,\n              }),\n            )\n          } else {\n            promises.push(\n              validateQueryPaths({\n                errors,\n                globalConfig,\n                overrideAccess,\n                policies,\n                polymorphicJoin,\n                req,\n                showHiddenFields,\n                versionFields,\n                where: item,\n              }),\n            )\n          }\n        }\n      } else if (Array.isArray(constraint)) {\n        errors.push({ path })\n      } else if (!Array.isArray(constraint)) {\n        for (const operator in constraint) {\n          const val = constraint[operator as keyof typeof constraint]\n          if (validOperatorSet.has(operator as Operator)) {\n            promises.push(\n              validateSearchParam({\n                collectionConfig,\n                constraint: where as WhereField,\n                errors,\n                fields,\n                globalConfig,\n                operator,\n                overrideAccess,\n                path,\n                policies,\n                polymorphicJoin,\n                req,\n                showHiddenFields,\n                val,\n                versionFields,\n              }),\n            )\n          } else {\n            errors.push({ path: `${path}.${operator}` })\n          }\n        }\n      }\n    }\n\n    await Promise.all(promises)\n    if (errors.length > 0) {\n      throw new QueryError(errors)\n    }\n  }\n}\n"],"names":["QueryError","validOperatorSet","validateSearchParam","validateQueryPaths","collectionConfig","errors","globalConfig","overrideAccess","policies","collections","globals","polymorphicJoin","req","showHiddenFields","versionFields","where","fields","flattenedFields","promises","path","constraint","includes","toLowerCase","Array","isArray","item","push","operator","val","has","Promise","all","length"],"mappings":"AAMA,SAASA,UAAU,QAAQ,6BAA4B;AACvD,SAASC,gBAAgB,QAAQ,2BAA0B;AAC3D,SAASC,mBAAmB,QAAQ,4BAA2B;AAuB/D,OAAO,eAAeC,mBAAmB,EACvCC,gBAAgB,EAChBC,SAAS,EAAE,EACXC,YAAY,EACZC,cAAc,EACdC,WAAW;IACTC,aAAa,CAAC;IACdC,SAAS,CAAC;AACZ,CAAC,EACDC,eAAe,EACfC,GAAG,EACHC,gBAAgB,EAChBC,aAAa,EACbC,KAAK,EACA;IACL,MAAMC,SAASF,iBAAiB,AAACR,CAAAA,gBAAgBF,gBAAe,EAAGa,eAAe;IAElF,IAAI,OAAOF,UAAU,UAAU;QAC7B,uEAAuE;QACvE,MAAMG,WAA4B,EAAE;QACpC,IAAK,MAAMC,QAAQJ,MAAO;YACxB,MAAMK,aAAaL,KAAK,CAACI,KAAK;YAE9B,IAAI;gBAAC;gBAAO;aAAK,CAACE,QAAQ,CAACF,KAAKG,WAAW,OAAOC,MAAMC,OAAO,CAACJ,aAAa;gBAC3E,KAAK,MAAMK,QAAQL,WAAY;oBAC7B,IAAIhB,kBAAkB;wBACpBc,SAASQ,IAAI,CACXvB,mBAAmB;4BACjBC;4BACAC;4BACAE;4BACAC;4BACAG;4BACAC;4BACAC;4BACAC;4BACAC,OAAOU;wBACT;oBAEJ,OAAO;wBACLP,SAASQ,IAAI,CACXvB,mBAAmB;4BACjBE;4BACAC;4BACAC;4BACAC;4BACAG;4BACAC;4BACAC;4BACAC;4BACAC,OAAOU;wBACT;oBAEJ;gBACF;YACF,OAAO,IAAIF,MAAMC,OAAO,CAACJ,aAAa;gBACpCf,OAAOqB,IAAI,CAAC;oBAAEP;gBAAK;YACrB,OAAO,IAAI,CAACI,MAAMC,OAAO,CAACJ,aAAa;gBACrC,IAAK,MAAMO,YAAYP,WAAY;oBACjC,MAAMQ,MAAMR,UAAU,CAACO,SAAoC;oBAC3D,IAAI1B,iBAAiB4B,GAAG,CAACF,WAAuB;wBAC9CT,SAASQ,IAAI,CACXxB,oBAAoB;4BAClBE;4BACAgB,YAAYL;4BACZV;4BACAW;4BACAV;4BACAqB;4BACApB;4BACAY;4BACAX;4BACAG;4BACAC;4BACAC;4BACAe;4BACAd;wBACF;oBAEJ,OAAO;wBACLT,OAAOqB,IAAI,CAAC;4BAAEP,MAAM,GAAGA,KAAK,CAAC,EAAEQ,UAAU;wBAAC;oBAC5C;gBACF;YACF;QACF;QAEA,MAAMG,QAAQC,GAAG,CAACb;QAClB,IAAIb,OAAO2B,MAAM,GAAG,GAAG;YACrB,MAAM,IAAIhC,WAAWK;QACvB;IACF;AACF"}

package/dist/database/queryValidation/validateSearchParams.d.ts

@@ -18,12 +18,13 @@ type Args = {
     policies: EntityPolicies;
     polymorphicJoin?: boolean;
     req: PayloadRequest;
+    showHiddenFields?: boolean;
     val: unknown;
     versionFields?: FlattenedField[];
 };
 /**
  * Validate the Payload key / value / operator
  */
-export declare function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, val, versionFields, }: Args): Promise<void>;
+export declare function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, showHiddenFields, val, versionFields, }: Args): Promise<void>;
 export {};
 //# sourceMappingURL=validateSearchParams.d.ts.map

package/dist/database/queryValidation/validateSearchParams.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateSearchParams.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,YAAY,CAAA;AAS7D,KAAK,IAAI,GAAG;IACV,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IAC5C,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IAEZ,QAAQ,EAAE,cAAc,CAAA;IACxB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,OAAO,CAAA;IACZ,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,gBAAgB,EAChB,UAAU,EACV,MAAM,EACN,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,IAAI,EAAE,YAAY,EAClB,QAAQ,EACR,eAAe,EACf,GAAG,EACH,GAAG,EACH,aAAa,GACd,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAoLtB"}
+{"version":3,"file":"validateSearchParams.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAA+B,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACnG,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,YAAY,CAAA;AAW7D,KAAK,IAAI,GAAG;IACV,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IAC5C,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IAEZ,QAAQ,EAAE,cAAc,CAAA;IACxB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,GAAG,EAAE,OAAO,CAAA;IACZ,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,gBAAgB,EAChB,UAAU,EACV,MAAM,EACN,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,IAAI,EAAE,YAAY,EAClB,QAAQ,EACR,eAAe,EACf,GAAG,EACH,gBAAgB,EAChB,GAAG,EACH,aAAa,GACd,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAwStB"}

package/dist/database/queryValidation/validateSearchParams.js

@@ -1,12 +1,14 @@
 import { fieldAffectsData } from '../../fields/config/types.js';
-import { SAFE_FIELD_PATH_REGEX } from '../../types/constants.js';
+import { hasManyRelationshipOperatorSet, SAFE_FIELD_PATH_REGEX } from '../../types/constants.js';
 import { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js';
 import { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js';
 import { getLocalizedPaths } from '../getLocalizedPaths.js';
+import { isNestedRelationshipQuery } from '../isNestedRelationshipQuery.js';
+import { prefixWherePaths } from '../prefixWherePaths.js';
 import { validateQueryPaths } from './validateQueryPaths.js';
 /**
  * Validate the Payload key / value / operator
- */ export async function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, val, versionFields }) {
+ */ export async function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, showHiddenFields, val, versionFields }) {
     // Replace GraphQL nested field double underscore formatting
     let sanitizedPath;
     if (incomingPath === '_id') {
@@ -38,10 +40,37 @@ import { validateQueryPaths } from './validateQueryPaths.js';
             locale: req.locale,
             overrideAccess,
             parentIsLocalized,
-            payload: req.payload
+            payload: req.payload,
+            showHiddenFields
         });
     }
     const promises = [];
+    const relationshipField = paths.length === 1 ? paths[0]?.field : undefined;
+    const hasNestedWhere = isNestedRelationshipQuery(val);
+    const relatedCollectionSlug = relationshipField && (relationshipField.type === 'relationship' || relationshipField.type === 'upload') && relationshipField.hasMany && typeof relationshipField.relationTo === 'string' ? relationshipField.relationTo : undefined;
+    const isNestedHasManyQuery = hasManyRelationshipOperatorSet.has(operator) && hasNestedWhere && Boolean(relatedCollectionSlug);
+    if (operator === 'like' || operator === 'not_like' || operator === 'contains') {
+        const isLegitimateNestedContains = operator === 'contains' && isNestedHasManyQuery;
+        const containsPlainObject = hasNestedWhere || Array.isArray(val) && val.some((entry)=>isNestedRelationshipQuery(entry));
+        if (containsPlainObject && !isLegitimateNestedContains) {
+            errors.push({
+                path: incomingPath
+            });
+            return;
+        }
+    }
+    if (isNestedHasManyQuery && relatedCollectionSlug) {
+        // Validate the nested query against the related collection.
+        promises.push(validateQueryPaths({
+            collectionConfig: req.payload.collections[relatedCollectionSlug].config,
+            errors,
+            overrideAccess,
+            policies,
+            req,
+            showHiddenFields,
+            where: val
+        }));
+    }
     // Sanitize relation.otherRelation.id to relation.otherRelation
     if (paths.at(-1)?.path === 'id') {
         const previousField = paths.at(-2)?.field;
@@ -51,7 +80,8 @@ import { validateQueryPaths } from './validateQueryPaths.js';
     }
     promises.push(...paths.map(async ({ collectionSlug, field, invalid, path }, i)=>{
         if (invalid) {
-            if (!polymorphicJoin || !SAFE_FIELD_PATH_REGEX.test(incomingPath)) {
+            const isUnknownPolymorphicJoinField = polymorphicJoin && !field && SAFE_FIELD_PATH_REGEX.test(incomingPath);
+            if (!isUnknownPolymorphicJoinField) {
                 errors.push({
                     path
                 });
@@ -60,8 +90,9 @@ import { validateQueryPaths } from './validateQueryPaths.js';
         }
         // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}
         if (field.type === 'join' && path === incomingPath) {
-            constraint[`${path}.id`] = constraint[path];
-            delete constraint[path];
+            const mutableConstraint = constraint;
+            mutableConstraint[`${path}.id`] = mutableConstraint[path];
+            delete mutableConstraint[path];
         }
         if ('virtual' in field && field.virtual) {
             if (field.virtual === true) {
@@ -95,6 +126,55 @@ import { validateQueryPaths } from './validateQueryPaths.js';
                         path: incomingPath
                     });
                 }
+                const relatedCollectionReadPermission = policies.collections[collectionSlug].read;
+                const previousSegment = paths[i - 1];
+                const traversedField = previousSegment?.field;
+                const isRelationshipHop = Boolean(traversedField) && (traversedField.type === 'relationship' || traversedField.type === 'upload' || traversedField.type === 'join');
+                if (isRelationshipHop && relatedCollectionReadPermission && typeof relatedCollectionReadPermission === 'object' && relatedCollectionReadPermission.where) {
+                    const relationshipPath = paths.slice(0, i).map(({ path: pathToRelationship })=>pathToRelationship).join('.');
+                    const mutableWhere = constraint;
+                    const existingAnd = Array.isArray(mutableWhere.and) ? mutableWhere.and : [];
+                    // Has-many relationships and joins can point to many related documents, so the user's
+                    // filter and the access constraint must be satisfied by the SAME related document.
+                    // Scoping both into a single `contains` prevents a different, readable document from
+                    // masking one the user cannot read (a related-document oracle).
+                    const isHasManyRelationship = (traversedField.type === 'relationship' || traversedField.type === 'upload') && traversedField.hasMany;
+                    const isJoin = traversedField.type === 'join';
+                    if (isHasManyRelationship || isJoin) {
+                        const relatedFieldPath = paths.at(-1)?.path;
+                        if (relatedFieldPath) {
+                            mutableWhere.and = [
+                                ...existingAnd,
+                                {
+                                    [relationshipPath]: {
+                                        contains: {
+                                            and: [
+                                                {
+                                                    [relatedFieldPath]: {
+                                                        [operator]: val
+                                                    }
+                                                },
+                                                relatedCollectionReadPermission.where
+                                            ]
+                                        }
+                                    }
+                                }
+                            ];
+                            // The scoped `contains` above fully replaces the user's original filter;
+                            // so we can remove it from the top-level where clause
+                            delete mutableWhere[incomingPath];
+                        }
+                    } else {
+                        const accessWhere = prefixWherePaths({
+                            prefix: relationshipPath,
+                            where: relatedCollectionReadPermission.where
+                        });
+                        mutableWhere.and = [
+                            ...existingAnd,
+                            accessWhere
+                        ];
+                    }
+                }
             }
             let fieldPath = path;
             // remove locale from end of path
@@ -134,7 +214,7 @@ import { validateQueryPaths } from './validateQueryPaths.js';
                 }
             }
         }
-        if (i > 1) {
+        if (!isNestedHasManyQuery && i > 1) {
             // Remove top collection and reverse array
             // to work backwards from top
             const pathsToQuery = paths.slice(1).reverse();
@@ -149,6 +229,7 @@ import { validateQueryPaths } from './validateQueryPaths.js';
                         overrideAccess,
                         policies,
                         req,
+                        showHiddenFields,
                         where: {
                             [subPath]: {
                                 [operator]: val

package/dist/database/queryValidation/validateSearchParams.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { PayloadRequest, WhereField } from '../../types/index.js'\nimport type { EntityPolicies, PathToQuery } from './types.js'\n\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { SAFE_FIELD_PATH_REGEX } from '../../types/constants.js'\nimport { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js'\nimport { getLocalizedPaths } from '../getLocalizedPaths.js'\nimport { validateQueryPaths } from './validateQueryPaths.js'\n\ntype Args = {\n  collectionConfig?: SanitizedCollectionConfig\n  constraint: WhereField\n  errors: { path: string }[]\n  fields: FlattenedField[]\n  globalConfig?: SanitizedGlobalConfig\n  operator: string\n  overrideAccess: boolean\n  parentIsLocalized?: boolean\n  path: string\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  val: unknown\n  versionFields?: FlattenedField[]\n}\n\n/**\n * Validate the Payload key / value / operator\n */\nexport async function validateSearchParam({\n  collectionConfig,\n  constraint,\n  errors,\n  fields,\n  globalConfig,\n  operator,\n  overrideAccess,\n  parentIsLocalized,\n  path: incomingPath,\n  policies,\n  polymorphicJoin,\n  req,\n  val,\n  versionFields,\n}: Args): Promise<void> {\n  // Replace GraphQL nested field double underscore formatting\n  let sanitizedPath\n  if (incomingPath === '_id') {\n    sanitizedPath = 'id'\n  } else {\n    sanitizedPath = incomingPath.replace(/__/g, '.')\n  }\n  let paths: PathToQuery[] = []\n  const { slug } = (collectionConfig || globalConfig)!\n\n  const blockReferencesPermissions = {}\n\n  if (globalConfig && !policies.globals![slug]) {\n    policies.globals![slug] = await getEntityPermissions({\n      blockReferencesPermissions,\n      entity: globalConfig,\n      entityType: 'global',\n      fetchData: false,\n      operations: ['read'],\n      req,\n    })\n  }\n\n  if (sanitizedPath !== 'id') {\n    paths = getLocalizedPaths({\n      collectionSlug: collectionConfig?.slug,\n      fields,\n      globalSlug: globalConfig?.slug,\n      incomingPath: sanitizedPath,\n      locale: req.locale!,\n      overrideAccess,\n      parentIsLocalized,\n      payload: req.payload,\n    })\n  }\n  const promises: Promise<void>[] = []\n\n  // Sanitize relation.otherRelation.id to relation.otherRelation\n  if (paths.at(-1)?.path === 'id') {\n    const previousField = paths.at(-2)?.field\n    if (\n      previousField &&\n      (previousField.type === 'relationship' || previousField.type === 'upload') &&\n      typeof previousField.relationTo === 'string'\n    ) {\n      paths.pop()\n    }\n  }\n\n  promises.push(\n    ...paths.map(async ({ collectionSlug, field, invalid, path }, i) => {\n      if (invalid) {\n        if (!polymorphicJoin || !SAFE_FIELD_PATH_REGEX.test(incomingPath)) {\n          errors.push({ path })\n        }\n\n        return\n      }\n\n      // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}\n      if (field.type === 'join' && path === incomingPath) {\n        constraint[`${path}.id` as keyof WhereField] = constraint[path as keyof WhereField]\n        delete constraint[path as keyof WhereField]\n      }\n\n      if ('virtual' in field && field.virtual) {\n        if (field.virtual === true) {\n          errors.push({ path })\n        }\n      }\n\n      if (polymorphicJoin && path === 'relationTo') {\n        return\n      }\n\n      if (!overrideAccess && fieldAffectsData(field)) {\n        if (collectionSlug) {\n          if (!policies.collections![collectionSlug]) {\n            policies.collections![collectionSlug] = await getEntityPermissions({\n              blockReferencesPermissions,\n              entity: req.payload.collections[collectionSlug]!.config,\n              entityType: 'collection',\n              fetchData: false,\n              operations: ['read'],\n              req: isolateObjectProperty(req, 'transactionID'),\n            })\n          }\n\n          if (\n            ['hash', 'salt'].includes(incomingPath) &&\n            collectionConfig!.auth &&\n            !collectionConfig!.auth?.disableLocalStrategy\n          ) {\n            errors.push({ path: incomingPath })\n          }\n        }\n        let fieldPath = path\n        // remove locale from end of path\n        if (path.endsWith(`.${req.locale}`)) {\n          fieldPath = path.slice(0, -(req.locale!.length + 1))\n        }\n        // remove \".value\" from ends of polymorphic relationship paths\n        if (\n          (field.type === 'relationship' || field.type === 'upload') &&\n          Array.isArray(field.relationTo)\n        ) {\n          fieldPath = fieldPath.replace('.value', '')\n        }\n\n        const entityType: 'collections' | 'globals' = globalConfig ? 'globals' : 'collections'\n        const entitySlug = collectionSlug || globalConfig!.slug\n        const segments = fieldPath.split('.')\n\n        let fieldAccess: any\n\n        if (versionFields) {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n\n          if (\n            segments[0] === 'parent' ||\n            segments[0] === 'version' ||\n            segments[0] === 'snapshot' ||\n            segments[0] === 'latest'\n          ) {\n            segments.shift()\n          }\n        } else {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n        }\n\n        if (segments.length) {\n          segments.forEach((segment) => {\n            if (fieldAccess[segment]) {\n              if ('fields' in fieldAccess[segment]) {\n                fieldAccess = fieldAccess[segment].fields\n              } else {\n                fieldAccess = fieldAccess[segment]\n              }\n            }\n          })\n\n          if (!fieldAccess?.read?.permission) {\n            errors.push({ path: fieldPath })\n          }\n        }\n      }\n\n      if (i > 1) {\n        // Remove top collection and reverse array\n        // to work backwards from top\n        const pathsToQuery = paths.slice(1).reverse()\n\n        pathsToQuery.forEach(\n          ({ collectionSlug: pathCollectionSlug, path: subPath }, pathToQueryIndex) => {\n            // On the \"deepest\" collection,\n            // validate query of the relationship\n            if (pathToQueryIndex === 0) {\n              promises.push(\n                validateQueryPaths({\n                  collectionConfig: req.payload.collections[pathCollectionSlug!]!.config,\n                  errors,\n                  globalConfig: undefined,\n                  overrideAccess,\n                  policies,\n                  req,\n                  where: {\n                    [subPath]: {\n                      [operator]: val,\n                    },\n                  },\n                }),\n              )\n            }\n          },\n        )\n      }\n    }),\n  )\n  await Promise.all(promises)\n}\n"],"names":["fieldAffectsData","SAFE_FIELD_PATH_REGEX","getEntityPermissions","isolateObjectProperty","getLocalizedPaths","validateQueryPaths","validateSearchParam","collectionConfig","constraint","errors","fields","globalConfig","operator","overrideAccess","parentIsLocalized","path","incomingPath","policies","polymorphicJoin","req","val","versionFields","sanitizedPath","replace","paths","slug","blockReferencesPermissions","globals","entity","entityType","fetchData","operations","collectionSlug","globalSlug","locale","payload","promises","at","previousField","field","type","relationTo","pop","push","map","invalid","i","test","virtual","collections","config","includes","auth","disableLocalStrategy","fieldPath","endsWith","slice","length","Array","isArray","entitySlug","segments","split","fieldAccess","shift","forEach","segment","read","permission","pathsToQuery","reverse","pathCollectionSlug","subPath","pathToQueryIndex","undefined","where","Promise","all"],"mappings":"AAMA,SAASA,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,qBAAqB,QAAQ,2BAA0B;AAChE,SAASC,oBAAoB,QAAQ,+DAA8D;AACnG,SAASC,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,iBAAiB,QAAQ,0BAAyB;AAC3D,SAASC,kBAAkB,QAAQ,0BAAyB;AAoB5D;;CAEC,GACD,OAAO,eAAeC,oBAAoB,EACxCC,gBAAgB,EAChBC,UAAU,EACVC,MAAM,EACNC,MAAM,EACNC,YAAY,EACZC,QAAQ,EACRC,cAAc,EACdC,iBAAiB,EACjBC,MAAMC,YAAY,EAClBC,QAAQ,EACRC,eAAe,EACfC,GAAG,EACHC,GAAG,EACHC,aAAa,EACR;IACL,4DAA4D;IAC5D,IAAIC;IACJ,IAAIN,iBAAiB,OAAO;QAC1BM,gBAAgB;IAClB,OAAO;QACLA,gBAAgBN,aAAaO,OAAO,CAAC,OAAO;IAC9C;IACA,IAAIC,QAAuB,EAAE;IAC7B,MAAM,EAAEC,IAAI,EAAE,GAAIlB,oBAAoBI;IAEtC,MAAMe,6BAA6B,CAAC;IAEpC,IAAIf,gBAAgB,CAACM,SAASU,OAAO,AAAC,CAACF,KAAK,EAAE;QAC5CR,SAASU,OAAO,AAAC,CAACF,KAAK,GAAG,MAAMvB,qBAAqB;YACnDwB;YACAE,QAAQjB;YACRkB,YAAY;YACZC,WAAW;YACXC,YAAY;gBAAC;aAAO;YACpBZ;QACF;IACF;IAEA,IAAIG,kBAAkB,MAAM;QAC1BE,QAAQpB,kBAAkB;YACxB4B,gBAAgBzB,kBAAkBkB;YAClCf;YACAuB,YAAYtB,cAAcc;YAC1BT,cAAcM;YACdY,QAAQf,IAAIe,MAAM;YAClBrB;YACAC;YACAqB,SAAShB,IAAIgB,OAAO;QACtB;IACF;IACA,MAAMC,WAA4B,EAAE;IAEpC,+DAA+D;IAC/D,IAAIZ,MAAMa,EAAE,CAAC,CAAC,IAAItB,SAAS,MAAM;QAC/B,MAAMuB,gBAAgBd,MAAMa,EAAE,CAAC,CAAC,IAAIE;QACpC,IACED,iBACCA,CAAAA,cAAcE,IAAI,KAAK,kBAAkBF,cAAcE,IAAI,KAAK,QAAO,KACxE,OAAOF,cAAcG,UAAU,KAAK,UACpC;YACAjB,MAAMkB,GAAG;QACX;IACF;IAEAN,SAASO,IAAI,IACRnB,MAAMoB,GAAG,CAAC,OAAO,EAAEZ,cAAc,EAAEO,KAAK,EAAEM,OAAO,EAAE9B,IAAI,EAAE,EAAE+B;QAC5D,IAAID,SAAS;YACX,IAAI,CAAC3B,mBAAmB,CAACjB,sBAAsB8C,IAAI,CAAC/B,eAAe;gBACjEP,OAAOkC,IAAI,CAAC;oBAAE5B;gBAAK;YACrB;YAEA;QACF;QAEA,6EAA6E;QAC7E,IAAIwB,MAAMC,IAAI,KAAK,UAAUzB,SAASC,cAAc;YAClDR,UAAU,CAAC,GAAGO,KAAK,GAAG,CAAC,CAAqB,GAAGP,UAAU,CAACO,KAAyB;YACnF,OAAOP,UAAU,CAACO,KAAyB;QAC7C;QAEA,IAAI,aAAawB,SAASA,MAAMS,OAAO,EAAE;YACvC,IAAIT,MAAMS,OAAO,KAAK,MAAM;gBAC1BvC,OAAOkC,IAAI,CAAC;oBAAE5B;gBAAK;YACrB;QACF;QAEA,IAAIG,mBAAmBH,SAAS,cAAc;YAC5C;QACF;QAEA,IAAI,CAACF,kBAAkBb,iBAAiBuC,QAAQ;YAC9C,IAAIP,gBAAgB;gBAClB,IAAI,CAACf,SAASgC,WAAW,AAAC,CAACjB,eAAe,EAAE;oBAC1Cf,SAASgC,WAAW,AAAC,CAACjB,eAAe,GAAG,MAAM9B,qBAAqB;wBACjEwB;wBACAE,QAAQT,IAAIgB,OAAO,CAACc,WAAW,CAACjB,eAAe,CAAEkB,MAAM;wBACvDrB,YAAY;wBACZC,WAAW;wBACXC,YAAY;4BAAC;yBAAO;wBACpBZ,KAAKhB,sBAAsBgB,KAAK;oBAClC;gBACF;gBAEA,IACE;oBAAC;oBAAQ;iBAAO,CAACgC,QAAQ,CAACnC,iBAC1BT,iBAAkB6C,IAAI,IACtB,CAAC7C,iBAAkB6C,IAAI,EAAEC,sBACzB;oBACA5C,OAAOkC,IAAI,CAAC;wBAAE5B,MAAMC;oBAAa;gBACnC;YACF;YACA,IAAIsC,YAAYvC;YAChB,iCAAiC;YACjC,IAAIA,KAAKwC,QAAQ,CAAC,CAAC,CAAC,EAAEpC,IAAIe,MAAM,EAAE,GAAG;gBACnCoB,YAAYvC,KAAKyC,KAAK,CAAC,GAAG,CAAErC,CAAAA,IAAIe,MAAM,CAAEuB,MAAM,GAAG,CAAA;YACnD;YACA,8DAA8D;YAC9D,IACE,AAAClB,CAAAA,MAAMC,IAAI,KAAK,kBAAkBD,MAAMC,IAAI,KAAK,QAAO,KACxDkB,MAAMC,OAAO,CAACpB,MAAME,UAAU,GAC9B;gBACAa,YAAYA,UAAU/B,OAAO,CAAC,UAAU;YAC1C;YAEA,MAAMM,aAAwClB,eAAe,YAAY;YACzE,MAAMiD,aAAa5B,kBAAkBrB,aAAcc,IAAI;YACvD,MAAMoC,WAAWP,UAAUQ,KAAK,CAAC;YAEjC,IAAIC;YAEJ,IAAI1C,eAAe;gBACjB0C,cAAc9C,QAAQ,CAACY,WAAW,AAAC,CAAC+B,WAAW,CAAElD,MAAM;gBAEvD,IACEmD,QAAQ,CAAC,EAAE,KAAK,YAChBA,QAAQ,CAAC,EAAE,KAAK,aAChBA,QAAQ,CAAC,EAAE,KAAK,cAChBA,QAAQ,CAAC,EAAE,KAAK,UAChB;oBACAA,SAASG,KAAK;gBAChB;YACF,OAAO;gBACLD,cAAc9C,QAAQ,CAACY,WAAW,AAAC,CAAC+B,WAAW,CAAElD,MAAM;YACzD;YAEA,IAAImD,SAASJ,MAAM,EAAE;gBACnBI,SAASI,OAAO,CAAC,CAACC;oBAChB,IAAIH,WAAW,CAACG,QAAQ,EAAE;wBACxB,IAAI,YAAYH,WAAW,CAACG,QAAQ,EAAE;4BACpCH,cAAcA,WAAW,CAACG,QAAQ,CAACxD,MAAM;wBAC3C,OAAO;4BACLqD,cAAcA,WAAW,CAACG,QAAQ;wBACpC;oBACF;gBACF;gBAEA,IAAI,CAACH,aAAaI,MAAMC,YAAY;oBAClC3D,OAAOkC,IAAI,CAAC;wBAAE5B,MAAMuC;oBAAU;gBAChC;YACF;QACF;QAEA,IAAIR,IAAI,GAAG;YACT,0CAA0C;YAC1C,6BAA6B;YAC7B,MAAMuB,eAAe7C,MAAMgC,KAAK,CAAC,GAAGc,OAAO;YAE3CD,aAAaJ,OAAO,CAClB,CAAC,EAAEjC,gBAAgBuC,kBAAkB,EAAExD,MAAMyD,OAAO,EAAE,EAAEC;gBACtD,+BAA+B;gBAC/B,qCAAqC;gBACrC,IAAIA,qBAAqB,GAAG;oBAC1BrC,SAASO,IAAI,CACXtC,mBAAmB;wBACjBE,kBAAkBY,IAAIgB,OAAO,CAACc,WAAW,CAACsB,mBAAoB,CAAErB,MAAM;wBACtEzC;wBACAE,cAAc+D;wBACd7D;wBACAI;wBACAE;wBACAwD,OAAO;4BACL,CAACH,QAAQ,EAAE;gCACT,CAAC5D,SAAS,EAAEQ;4BACd;wBACF;oBACF;gBAEJ;YACF;QAEJ;IACF;IAEF,MAAMwD,QAAQC,GAAG,CAACzC;AACpB"}
+{"version":3,"sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { HasManyRelationshipOperator, PayloadRequest, WhereField } from '../../types/index.js'\nimport type { EntityPolicies, PathToQuery } from './types.js'\n\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { hasManyRelationshipOperatorSet, SAFE_FIELD_PATH_REGEX } from '../../types/constants.js'\nimport { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js'\nimport { getLocalizedPaths } from '../getLocalizedPaths.js'\nimport { isNestedRelationshipQuery } from '../isNestedRelationshipQuery.js'\nimport { prefixWherePaths } from '../prefixWherePaths.js'\nimport { validateQueryPaths } from './validateQueryPaths.js'\n\ntype Args = {\n  collectionConfig?: SanitizedCollectionConfig\n  constraint: WhereField\n  errors: { path: string }[]\n  fields: FlattenedField[]\n  globalConfig?: SanitizedGlobalConfig\n  operator: string\n  overrideAccess: boolean\n  parentIsLocalized?: boolean\n  path: string\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  showHiddenFields?: boolean\n  val: unknown\n  versionFields?: FlattenedField[]\n}\n\n/**\n * Validate the Payload key / value / operator\n */\nexport async function validateSearchParam({\n  collectionConfig,\n  constraint,\n  errors,\n  fields,\n  globalConfig,\n  operator,\n  overrideAccess,\n  parentIsLocalized,\n  path: incomingPath,\n  policies,\n  polymorphicJoin,\n  req,\n  showHiddenFields,\n  val,\n  versionFields,\n}: Args): Promise<void> {\n  // Replace GraphQL nested field double underscore formatting\n  let sanitizedPath\n  if (incomingPath === '_id') {\n    sanitizedPath = 'id'\n  } else {\n    sanitizedPath = incomingPath.replace(/__/g, '.')\n  }\n  let paths: PathToQuery[] = []\n  const { slug } = (collectionConfig || globalConfig)!\n\n  const blockReferencesPermissions = {}\n\n  if (globalConfig && !policies.globals![slug]) {\n    policies.globals![slug] = await getEntityPermissions({\n      blockReferencesPermissions,\n      entity: globalConfig,\n      entityType: 'global',\n      fetchData: false,\n      operations: ['read'],\n      req,\n    })\n  }\n\n  if (sanitizedPath !== 'id') {\n    paths = getLocalizedPaths({\n      collectionSlug: collectionConfig?.slug,\n      fields,\n      globalSlug: globalConfig?.slug,\n      incomingPath: sanitizedPath,\n      locale: req.locale!,\n      overrideAccess,\n      parentIsLocalized,\n      payload: req.payload,\n      showHiddenFields,\n    })\n  }\n  const promises: Promise<void>[] = []\n\n  const relationshipField = paths.length === 1 ? paths[0]?.field : undefined\n  const hasNestedWhere = isNestedRelationshipQuery(val)\n  const relatedCollectionSlug =\n    relationshipField &&\n    (relationshipField.type === 'relationship' || relationshipField.type === 'upload') &&\n    relationshipField.hasMany &&\n    typeof relationshipField.relationTo === 'string'\n      ? relationshipField.relationTo\n      : undefined\n  const isNestedHasManyQuery =\n    hasManyRelationshipOperatorSet.has(operator as HasManyRelationshipOperator) &&\n    hasNestedWhere &&\n    Boolean(relatedCollectionSlug)\n\n  if (operator === 'like' || operator === 'not_like' || operator === 'contains') {\n    const isLegitimateNestedContains = operator === 'contains' && isNestedHasManyQuery\n    const containsPlainObject =\n      hasNestedWhere ||\n      (Array.isArray(val) && val.some((entry) => isNestedRelationshipQuery(entry)))\n\n    if (containsPlainObject && !isLegitimateNestedContains) {\n      errors.push({ path: incomingPath })\n      return\n    }\n  }\n\n  if (isNestedHasManyQuery && relatedCollectionSlug) {\n    // Validate the nested query against the related collection.\n    promises.push(\n      validateQueryPaths({\n        collectionConfig: req.payload.collections[relatedCollectionSlug]!.config,\n        errors,\n        overrideAccess,\n        policies,\n        req,\n        showHiddenFields,\n        where: val,\n      }),\n    )\n  }\n\n  // Sanitize relation.otherRelation.id to relation.otherRelation\n  if (paths.at(-1)?.path === 'id') {\n    const previousField = paths.at(-2)?.field\n    if (\n      previousField &&\n      (previousField.type === 'relationship' || previousField.type === 'upload') &&\n      typeof previousField.relationTo === 'string'\n    ) {\n      paths.pop()\n    }\n  }\n\n  promises.push(\n    ...paths.map(async ({ collectionSlug, field, invalid, path }, i) => {\n      if (invalid) {\n        const isUnknownPolymorphicJoinField =\n          polymorphicJoin && !field && SAFE_FIELD_PATH_REGEX.test(incomingPath)\n\n        if (!isUnknownPolymorphicJoinField) {\n          errors.push({ path })\n        }\n\n        return\n      }\n\n      // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}\n      if (field.type === 'join' && path === incomingPath) {\n        const mutableConstraint = constraint as Record<string, unknown>\n\n        mutableConstraint[`${path}.id`] = mutableConstraint[path]\n        delete mutableConstraint[path]\n      }\n\n      if ('virtual' in field && field.virtual) {\n        if (field.virtual === true) {\n          errors.push({ path })\n        }\n      }\n\n      if (polymorphicJoin && path === 'relationTo') {\n        return\n      }\n\n      if (!overrideAccess && fieldAffectsData(field)) {\n        if (collectionSlug) {\n          if (!policies.collections![collectionSlug]) {\n            policies.collections![collectionSlug] = await getEntityPermissions({\n              blockReferencesPermissions,\n              entity: req.payload.collections[collectionSlug]!.config,\n              entityType: 'collection',\n              fetchData: false,\n              operations: ['read'],\n              req: isolateObjectProperty(req, 'transactionID'),\n            })\n          }\n\n          if (\n            ['hash', 'salt'].includes(incomingPath) &&\n            collectionConfig!.auth &&\n            !collectionConfig!.auth?.disableLocalStrategy\n          ) {\n            errors.push({ path: incomingPath })\n          }\n\n          const relatedCollectionReadPermission = policies.collections![collectionSlug].read\n          const previousSegment = paths[i - 1]\n          const traversedField = previousSegment?.field\n          const isRelationshipHop =\n            Boolean(traversedField) &&\n            (traversedField!.type === 'relationship' ||\n              traversedField!.type === 'upload' ||\n              traversedField!.type === 'join')\n\n          if (\n            isRelationshipHop &&\n            relatedCollectionReadPermission &&\n            typeof relatedCollectionReadPermission === 'object' &&\n            relatedCollectionReadPermission.where\n          ) {\n            const relationshipPath = paths\n              .slice(0, i)\n              .map(({ path: pathToRelationship }) => pathToRelationship)\n              .join('.')\n\n            const mutableWhere = constraint as Record<string, unknown>\n            const existingAnd = Array.isArray(mutableWhere.and) ? mutableWhere.and : []\n\n            // Has-many relationships and joins can point to many related documents, so the user's\n            // filter and the access constraint must be satisfied by the SAME related document.\n            // Scoping both into a single `contains` prevents a different, readable document from\n            // masking one the user cannot read (a related-document oracle).\n            const isHasManyRelationship =\n              (traversedField!.type === 'relationship' || traversedField!.type === 'upload') &&\n              traversedField!.hasMany\n            const isJoin = traversedField!.type === 'join'\n\n            if (isHasManyRelationship || isJoin) {\n              const relatedFieldPath = paths.at(-1)?.path\n\n              if (relatedFieldPath) {\n                mutableWhere.and = [\n                  ...existingAnd,\n                  {\n                    [relationshipPath]: {\n                      contains: {\n                        and: [\n                          {\n                            [relatedFieldPath]: {\n                              [operator]: val,\n                            },\n                          },\n                          relatedCollectionReadPermission.where,\n                        ],\n                      },\n                    },\n                  },\n                ]\n\n                // The scoped `contains` above fully replaces the user's original filter;\n                // so we can remove it from the top-level where clause\n                delete mutableWhere[incomingPath]\n              }\n            } else {\n              const accessWhere = prefixWherePaths({\n                prefix: relationshipPath,\n                where: relatedCollectionReadPermission.where,\n              })\n\n              mutableWhere.and = [...existingAnd, accessWhere]\n            }\n          }\n        }\n        let fieldPath = path\n        // remove locale from end of path\n        if (path.endsWith(`.${req.locale}`)) {\n          fieldPath = path.slice(0, -(req.locale!.length + 1))\n        }\n        // remove \".value\" from ends of polymorphic relationship paths\n        if (\n          (field.type === 'relationship' || field.type === 'upload') &&\n          Array.isArray(field.relationTo)\n        ) {\n          fieldPath = fieldPath.replace('.value', '')\n        }\n\n        const entityType: 'collections' | 'globals' = globalConfig ? 'globals' : 'collections'\n        const entitySlug = collectionSlug || globalConfig!.slug\n        const segments = fieldPath.split('.')\n\n        let fieldAccess: any\n\n        if (versionFields) {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n\n          if (\n            segments[0] === 'parent' ||\n            segments[0] === 'version' ||\n            segments[0] === 'snapshot' ||\n            segments[0] === 'latest'\n          ) {\n            segments.shift()\n          }\n        } else {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n        }\n\n        if (segments.length) {\n          segments.forEach((segment) => {\n            if (fieldAccess[segment]) {\n              if ('fields' in fieldAccess[segment]) {\n                fieldAccess = fieldAccess[segment].fields\n              } else {\n                fieldAccess = fieldAccess[segment]\n              }\n            }\n          })\n\n          if (!fieldAccess?.read?.permission) {\n            errors.push({ path: fieldPath })\n          }\n        }\n      }\n\n      if (!isNestedHasManyQuery && i > 1) {\n        // Remove top collection and reverse array\n        // to work backwards from top\n        const pathsToQuery = paths.slice(1).reverse()\n\n        pathsToQuery.forEach(\n          ({ collectionSlug: pathCollectionSlug, path: subPath }, pathToQueryIndex) => {\n            // On the \"deepest\" collection,\n            // validate query of the relationship\n            if (pathToQueryIndex === 0) {\n              promises.push(\n                validateQueryPaths({\n                  collectionConfig: req.payload.collections[pathCollectionSlug!]!.config,\n                  errors,\n                  globalConfig: undefined,\n                  overrideAccess,\n                  policies,\n                  req,\n                  showHiddenFields,\n                  where: {\n                    [subPath]: {\n                      [operator]: val,\n                    },\n                  },\n                }),\n              )\n            }\n          },\n        )\n      }\n    }),\n  )\n  await Promise.all(promises)\n}\n"],"names":["fieldAffectsData","hasManyRelationshipOperatorSet","SAFE_FIELD_PATH_REGEX","getEntityPermissions","isolateObjectProperty","getLocalizedPaths","isNestedRelationshipQuery","prefixWherePaths","validateQueryPaths","validateSearchParam","collectionConfig","constraint","errors","fields","globalConfig","operator","overrideAccess","parentIsLocalized","path","incomingPath","policies","polymorphicJoin","req","showHiddenFields","val","versionFields","sanitizedPath","replace","paths","slug","blockReferencesPermissions","globals","entity","entityType","fetchData","operations","collectionSlug","globalSlug","locale","payload","promises","relationshipField","length","field","undefined","hasNestedWhere","relatedCollectionSlug","type","hasMany","relationTo","isNestedHasManyQuery","has","Boolean","isLegitimateNestedContains","containsPlainObject","Array","isArray","some","entry","push","collections","config","where","at","previousField","pop","map","invalid","i","isUnknownPolymorphicJoinField","test","mutableConstraint","virtual","includes","auth","disableLocalStrategy","relatedCollectionReadPermission","read","previousSegment","traversedField","isRelationshipHop","relationshipPath","slice","pathToRelationship","join","mutableWhere","existingAnd","and","isHasManyRelationship","isJoin","relatedFieldPath","contains","accessWhere","prefix","fieldPath","endsWith","entitySlug","segments","split","fieldAccess","shift","forEach","segment","permission","pathsToQuery","reverse","pathCollectionSlug","subPath","pathToQueryIndex","Promise","all"],"mappings":"AAMA,SAASA,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,8BAA8B,EAAEC,qBAAqB,QAAQ,2BAA0B;AAChG,SAASC,oBAAoB,QAAQ,+DAA8D;AACnG,SAASC,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,iBAAiB,QAAQ,0BAAyB;AAC3D,SAASC,yBAAyB,QAAQ,kCAAiC;AAC3E,SAASC,gBAAgB,QAAQ,yBAAwB;AACzD,SAASC,kBAAkB,QAAQ,0BAAyB;AAqB5D;;CAEC,GACD,OAAO,eAAeC,oBAAoB,EACxCC,gBAAgB,EAChBC,UAAU,EACVC,MAAM,EACNC,MAAM,EACNC,YAAY,EACZC,QAAQ,EACRC,cAAc,EACdC,iBAAiB,EACjBC,MAAMC,YAAY,EAClBC,QAAQ,EACRC,eAAe,EACfC,GAAG,EACHC,gBAAgB,EAChBC,GAAG,EACHC,aAAa,EACR;IACL,4DAA4D;IAC5D,IAAIC;IACJ,IAAIP,iBAAiB,OAAO;QAC1BO,gBAAgB;IAClB,OAAO;QACLA,gBAAgBP,aAAaQ,OAAO,CAAC,OAAO;IAC9C;IACA,IAAIC,QAAuB,EAAE;IAC7B,MAAM,EAAEC,IAAI,EAAE,GAAInB,oBAAoBI;IAEtC,MAAMgB,6BAA6B,CAAC;IAEpC,IAAIhB,gBAAgB,CAACM,SAASW,OAAO,AAAC,CAACF,KAAK,EAAE;QAC5CT,SAASW,OAAO,AAAC,CAACF,KAAK,GAAG,MAAM1B,qBAAqB;YACnD2B;YACAE,QAAQlB;YACRmB,YAAY;YACZC,WAAW;YACXC,YAAY;gBAAC;aAAO;YACpBb;QACF;IACF;IAEA,IAAII,kBAAkB,MAAM;QAC1BE,QAAQvB,kBAAkB;YACxB+B,gBAAgB1B,kBAAkBmB;YAClChB;YACAwB,YAAYvB,cAAce;YAC1BV,cAAcO;YACdY,QAAQhB,IAAIgB,MAAM;YAClBtB;YACAC;YACAsB,SAASjB,IAAIiB,OAAO;YACpBhB;QACF;IACF;IACA,MAAMiB,WAA4B,EAAE;IAEpC,MAAMC,oBAAoBb,MAAMc,MAAM,KAAK,IAAId,KAAK,CAAC,EAAE,EAAEe,QAAQC;IACjE,MAAMC,iBAAiBvC,0BAA0BkB;IACjD,MAAMsB,wBACJL,qBACCA,CAAAA,kBAAkBM,IAAI,KAAK,kBAAkBN,kBAAkBM,IAAI,KAAK,QAAO,KAChFN,kBAAkBO,OAAO,IACzB,OAAOP,kBAAkBQ,UAAU,KAAK,WACpCR,kBAAkBQ,UAAU,GAC5BL;IACN,MAAMM,uBACJjD,+BAA+BkD,GAAG,CAACpC,aACnC8B,kBACAO,QAAQN;IAEV,IAAI/B,aAAa,UAAUA,aAAa,cAAcA,aAAa,YAAY;QAC7E,MAAMsC,6BAA6BtC,aAAa,cAAcmC;QAC9D,MAAMI,sBACJT,kBACCU,MAAMC,OAAO,CAAChC,QAAQA,IAAIiC,IAAI,CAAC,CAACC,QAAUpD,0BAA0BoD;QAEvE,IAAIJ,uBAAuB,CAACD,4BAA4B;YACtDzC,OAAO+C,IAAI,CAAC;gBAAEzC,MAAMC;YAAa;YACjC;QACF;IACF;IAEA,IAAI+B,wBAAwBJ,uBAAuB;QACjD,4DAA4D;QAC5DN,SAASmB,IAAI,CACXnD,mBAAmB;YACjBE,kBAAkBY,IAAIiB,OAAO,CAACqB,WAAW,CAACd,sBAAsB,CAAEe,MAAM;YACxEjD;YACAI;YACAI;YACAE;YACAC;YACAuC,OAAOtC;QACT;IAEJ;IAEA,+DAA+D;IAC/D,IAAII,MAAMmC,EAAE,CAAC,CAAC,IAAI7C,SAAS,MAAM;QAC/B,MAAM8C,gBAAgBpC,MAAMmC,EAAE,CAAC,CAAC,IAAIpB;QACpC,IACEqB,iBACCA,CAAAA,cAAcjB,IAAI,KAAK,kBAAkBiB,cAAcjB,IAAI,KAAK,QAAO,KACxE,OAAOiB,cAAcf,UAAU,KAAK,UACpC;YACArB,MAAMqC,GAAG;QACX;IACF;IAEAzB,SAASmB,IAAI,IACR/B,MAAMsC,GAAG,CAAC,OAAO,EAAE9B,cAAc,EAAEO,KAAK,EAAEwB,OAAO,EAAEjD,IAAI,EAAE,EAAEkD;QAC5D,IAAID,SAAS;YACX,MAAME,gCACJhD,mBAAmB,CAACsB,SAASzC,sBAAsBoE,IAAI,CAACnD;YAE1D,IAAI,CAACkD,+BAA+B;gBAClCzD,OAAO+C,IAAI,CAAC;oBAAEzC;gBAAK;YACrB;YAEA;QACF;QAEA,6EAA6E;QAC7E,IAAIyB,MAAMI,IAAI,KAAK,UAAU7B,SAASC,cAAc;YAClD,MAAMoD,oBAAoB5D;YAE1B4D,iBAAiB,CAAC,GAAGrD,KAAK,GAAG,CAAC,CAAC,GAAGqD,iBAAiB,CAACrD,KAAK;YACzD,OAAOqD,iBAAiB,CAACrD,KAAK;QAChC;QAEA,IAAI,aAAayB,SAASA,MAAM6B,OAAO,EAAE;YACvC,IAAI7B,MAAM6B,OAAO,KAAK,MAAM;gBAC1B5D,OAAO+C,IAAI,CAAC;oBAAEzC;gBAAK;YACrB;QACF;QAEA,IAAIG,mBAAmBH,SAAS,cAAc;YAC5C;QACF;QAEA,IAAI,CAACF,kBAAkBhB,iBAAiB2C,QAAQ;YAC9C,IAAIP,gBAAgB;gBAClB,IAAI,CAAChB,SAASwC,WAAW,AAAC,CAACxB,eAAe,EAAE;oBAC1ChB,SAASwC,WAAW,AAAC,CAACxB,eAAe,GAAG,MAAMjC,qBAAqB;wBACjE2B;wBACAE,QAAQV,IAAIiB,OAAO,CAACqB,WAAW,CAACxB,eAAe,CAAEyB,MAAM;wBACvD5B,YAAY;wBACZC,WAAW;wBACXC,YAAY;4BAAC;yBAAO;wBACpBb,KAAKlB,sBAAsBkB,KAAK;oBAClC;gBACF;gBAEA,IACE;oBAAC;oBAAQ;iBAAO,CAACmD,QAAQ,CAACtD,iBAC1BT,iBAAkBgE,IAAI,IACtB,CAAChE,iBAAkBgE,IAAI,EAAEC,sBACzB;oBACA/D,OAAO+C,IAAI,CAAC;wBAAEzC,MAAMC;oBAAa;gBACnC;gBAEA,MAAMyD,kCAAkCxD,SAASwC,WAAW,AAAC,CAACxB,eAAe,CAACyC,IAAI;gBAClF,MAAMC,kBAAkBlD,KAAK,CAACwC,IAAI,EAAE;gBACpC,MAAMW,iBAAiBD,iBAAiBnC;gBACxC,MAAMqC,oBACJ5B,QAAQ2B,mBACPA,CAAAA,eAAgBhC,IAAI,KAAK,kBACxBgC,eAAgBhC,IAAI,KAAK,YACzBgC,eAAgBhC,IAAI,KAAK,MAAK;gBAElC,IACEiC,qBACAJ,mCACA,OAAOA,oCAAoC,YAC3CA,gCAAgCd,KAAK,EACrC;oBACA,MAAMmB,mBAAmBrD,MACtBsD,KAAK,CAAC,GAAGd,GACTF,GAAG,CAAC,CAAC,EAAEhD,MAAMiE,kBAAkB,EAAE,GAAKA,oBACtCC,IAAI,CAAC;oBAER,MAAMC,eAAe1E;oBACrB,MAAM2E,cAAc/B,MAAMC,OAAO,CAAC6B,aAAaE,GAAG,IAAIF,aAAaE,GAAG,GAAG,EAAE;oBAE3E,sFAAsF;oBACtF,mFAAmF;oBACnF,qFAAqF;oBACrF,gEAAgE;oBAChE,MAAMC,wBACJ,AAACT,CAAAA,eAAgBhC,IAAI,KAAK,kBAAkBgC,eAAgBhC,IAAI,KAAK,QAAO,KAC5EgC,eAAgB/B,OAAO;oBACzB,MAAMyC,SAASV,eAAgBhC,IAAI,KAAK;oBAExC,IAAIyC,yBAAyBC,QAAQ;wBACnC,MAAMC,mBAAmB9D,MAAMmC,EAAE,CAAC,CAAC,IAAI7C;wBAEvC,IAAIwE,kBAAkB;4BACpBL,aAAaE,GAAG,GAAG;mCACdD;gCACH;oCACE,CAACL,iBAAiB,EAAE;wCAClBU,UAAU;4CACRJ,KAAK;gDACH;oDACE,CAACG,iBAAiB,EAAE;wDAClB,CAAC3E,SAAS,EAAES;oDACd;gDACF;gDACAoD,gCAAgCd,KAAK;6CACtC;wCACH;oCACF;gCACF;6BACD;4BAED,yEAAyE;4BACzE,sDAAsD;4BACtD,OAAOuB,YAAY,CAAClE,aAAa;wBACnC;oBACF,OAAO;wBACL,MAAMyE,cAAcrF,iBAAiB;4BACnCsF,QAAQZ;4BACRnB,OAAOc,gCAAgCd,KAAK;wBAC9C;wBAEAuB,aAAaE,GAAG,GAAG;+BAAID;4BAAaM;yBAAY;oBAClD;gBACF;YACF;YACA,IAAIE,YAAY5E;YAChB,iCAAiC;YACjC,IAAIA,KAAK6E,QAAQ,CAAC,CAAC,CAAC,EAAEzE,IAAIgB,MAAM,EAAE,GAAG;gBACnCwD,YAAY5E,KAAKgE,KAAK,CAAC,GAAG,CAAE5D,CAAAA,IAAIgB,MAAM,CAAEI,MAAM,GAAG,CAAA;YACnD;YACA,8DAA8D;YAC9D,IACE,AAACC,CAAAA,MAAMI,IAAI,KAAK,kBAAkBJ,MAAMI,IAAI,KAAK,QAAO,KACxDQ,MAAMC,OAAO,CAACb,MAAMM,UAAU,GAC9B;gBACA6C,YAAYA,UAAUnE,OAAO,CAAC,UAAU;YAC1C;YAEA,MAAMM,aAAwCnB,eAAe,YAAY;YACzE,MAAMkF,aAAa5D,kBAAkBtB,aAAce,IAAI;YACvD,MAAMoE,WAAWH,UAAUI,KAAK,CAAC;YAEjC,IAAIC;YAEJ,IAAI1E,eAAe;gBACjB0E,cAAc/E,QAAQ,CAACa,WAAW,AAAC,CAAC+D,WAAW,CAAEnF,MAAM;gBAEvD,IACEoF,QAAQ,CAAC,EAAE,KAAK,YAChBA,QAAQ,CAAC,EAAE,KAAK,aAChBA,QAAQ,CAAC,EAAE,KAAK,cAChBA,QAAQ,CAAC,EAAE,KAAK,UAChB;oBACAA,SAASG,KAAK;gBAChB;YACF,OAAO;gBACLD,cAAc/E,QAAQ,CAACa,WAAW,AAAC,CAAC+D,WAAW,CAAEnF,MAAM;YACzD;YAEA,IAAIoF,SAASvD,MAAM,EAAE;gBACnBuD,SAASI,OAAO,CAAC,CAACC;oBAChB,IAAIH,WAAW,CAACG,QAAQ,EAAE;wBACxB,IAAI,YAAYH,WAAW,CAACG,QAAQ,EAAE;4BACpCH,cAAcA,WAAW,CAACG,QAAQ,CAACzF,MAAM;wBAC3C,OAAO;4BACLsF,cAAcA,WAAW,CAACG,QAAQ;wBACpC;oBACF;gBACF;gBAEA,IAAI,CAACH,aAAatB,MAAM0B,YAAY;oBAClC3F,OAAO+C,IAAI,CAAC;wBAAEzC,MAAM4E;oBAAU;gBAChC;YACF;QACF;QAEA,IAAI,CAAC5C,wBAAwBkB,IAAI,GAAG;YAClC,0CAA0C;YAC1C,6BAA6B;YAC7B,MAAMoC,eAAe5E,MAAMsD,KAAK,CAAC,GAAGuB,OAAO;YAE3CD,aAAaH,OAAO,CAClB,CAAC,EAAEjE,gBAAgBsE,kBAAkB,EAAExF,MAAMyF,OAAO,EAAE,EAAEC;gBACtD,+BAA+B;gBAC/B,qCAAqC;gBACrC,IAAIA,qBAAqB,GAAG;oBAC1BpE,SAASmB,IAAI,CACXnD,mBAAmB;wBACjBE,kBAAkBY,IAAIiB,OAAO,CAACqB,WAAW,CAAC8C,mBAAoB,CAAE7C,MAAM;wBACtEjD;wBACAE,cAAc8B;wBACd5B;wBACAI;wBACAE;wBACAC;wBACAuC,OAAO;4BACL,CAAC6C,QAAQ,EAAE;gCACT,CAAC5F,SAAS,EAAES;4BACd;wBACF;oBACF;gBAEJ;YACF;QAEJ;IACF;IAEF,MAAMqF,QAAQC,GAAG,CAACtE;AACpB"}