payload 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee

package/dist/uploads/detectSvgFromXml.js

@@ -1,43 +1,4 @@
-/**
- * Securely detect if an XML buffer contains a valid SVG document
- */ export function detectSvgFromXml(buffer) {
-    try {
-        // Limit buffer size to prevent processing large malicious files
-        const maxSize = 2048;
-        const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize));
-        // Check for XML declaration and extract encoding if present
-        const xmlDeclMatch = content.match(/^<\?xml[^>]*encoding=["']([^"']+)["']/i);
-        const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase();
-        // Only support safe encodings
-        if (declaredEncoding && ![
-            'ascii',
-            'utf-8',
-            'utf8'
-        ].includes(declaredEncoding)) {
-            return false;
-        }
-        // Remove XML declarations, comments, and processing instructions
-        const cleanContent = content.replace(/<\?xml[^>]*\?>/gi, '').replace(/<!--[\s\S]*?-->/g, '').replace(/<\?[^>]*\?>/g, '').trim();
-        // Find the first actual element (root element)
-        const rootElementMatch = cleanContent.match(/^<(\w+)(?:\s|>)/);
-        if (!rootElementMatch || rootElementMatch[1] !== 'svg') {
-            return false;
-        }
-        // Validate SVG namespace - must be present for valid SVG
-        const svgNamespaceRegex = /xmlns=["']http:\/\/www\.w3\.org\/2000\/svg["']/;
-        if (!svgNamespaceRegex.test(content)) {
-            return false;
-        }
-        // Additional validation: ensure it's not malformed
-        const svgOpenTag = content.match(/<svg[\s>]/);
-        if (!svgOpenTag) {
-            return false;
-        }
-        return true;
-    } catch (_error) {
-        // If any error occurs during parsing, treat as not SVG
-        return false;
-    }
-}
+import { inspectSvg } from './validateSvg.js';
+export const detectSvgFromXml = (buffer)=>inspectSvg(buffer).isSvg;
 
 //# sourceMappingURL=detectSvgFromXml.js.map

package/dist/uploads/detectSvgFromXml.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["/**\n * Securely detect if an XML buffer contains a valid SVG document\n */\nexport function detectSvgFromXml(buffer: Buffer): boolean {\n  try {\n    // Limit buffer size to prevent processing large malicious files\n    const maxSize = 2048\n    const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize))\n\n    // Check for XML declaration and extract encoding if present\n    const xmlDeclMatch = content.match(/^<\\?xml[^>]*encoding=[\"']([^\"']+)[\"']/i)\n    const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase()\n\n    // Only support safe encodings\n    if (declaredEncoding && !['ascii', 'utf-8', 'utf8'].includes(declaredEncoding)) {\n      return false\n    }\n\n    // Remove XML declarations, comments, and processing instructions\n    const cleanContent = content\n      .replace(/<\\?xml[^>]*\\?>/gi, '')\n      .replace(/<!--[\\s\\S]*?-->/g, '')\n      .replace(/<\\?[^>]*\\?>/g, '')\n      .trim()\n\n    // Find the first actual element (root element)\n    const rootElementMatch = cleanContent.match(/^<(\\w+)(?:\\s|>)/)\n    if (!rootElementMatch || rootElementMatch[1] !== 'svg') {\n      return false\n    }\n\n    // Validate SVG namespace - must be present for valid SVG\n    const svgNamespaceRegex = /xmlns=[\"']http:\\/\\/www\\.w3\\.org\\/2000\\/svg[\"']/\n    if (!svgNamespaceRegex.test(content)) {\n      return false\n    }\n\n    // Additional validation: ensure it's not malformed\n    const svgOpenTag = content.match(/<svg[\\s>]/)\n    if (!svgOpenTag) {\n      return false\n    }\n\n    return true\n  } catch (_error) {\n    // If any error occurs during parsing, treat as not SVG\n    return false\n  }\n}\n"],"names":["detectSvgFromXml","buffer","maxSize","content","toString","Math","min","length","xmlDeclMatch","match","declaredEncoding","toLowerCase","includes","cleanContent","replace","trim","rootElementMatch","svgNamespaceRegex","test","svgOpenTag","_error"],"mappings":"AAAA;;CAEC,GACD,OAAO,SAASA,iBAAiBC,MAAc;IAC7C,IAAI;QACF,gEAAgE;QAChE,MAAMC,UAAU;QAChB,MAAMC,UAAUF,OAAOG,QAAQ,CAAC,QAAQ,GAAGC,KAAKC,GAAG,CAACL,OAAOM,MAAM,EAAEL;QAEnE,4DAA4D;QAC5D,MAAMM,eAAeL,QAAQM,KAAK,CAAC;QACnC,MAAMC,mBAAmBF,cAAc,CAAC,EAAE,EAAEG;QAE5C,8BAA8B;QAC9B,IAAID,oBAAoB,CAAC;YAAC;YAAS;YAAS;SAAO,CAACE,QAAQ,CAACF,mBAAmB;YAC9E,OAAO;QACT;QAEA,iEAAiE;QACjE,MAAMG,eAAeV,QAClBW,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,gBAAgB,IACxBC,IAAI;QAEP,+CAA+C;QAC/C,MAAMC,mBAAmBH,aAAaJ,KAAK,CAAC;QAC5C,IAAI,CAACO,oBAAoBA,gBAAgB,CAAC,EAAE,KAAK,OAAO;YACtD,OAAO;QACT;QAEA,yDAAyD;QACzD,MAAMC,oBAAoB;QAC1B,IAAI,CAACA,kBAAkBC,IAAI,CAACf,UAAU;YACpC,OAAO;QACT;QAEA,mDAAmD;QACnD,MAAMgB,aAAahB,QAAQM,KAAK,CAAC;QACjC,IAAI,CAACU,YAAY;YACf,OAAO;QACT;QAEA,OAAO;IACT,EAAE,OAAOC,QAAQ;QACf,uDAAuD;QACvD,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["import { inspectSvg } from './validateSvg.js'\n\nexport const detectSvgFromXml = (buffer: Buffer): boolean => inspectSvg(buffer).isSvg\n"],"names":["inspectSvg","detectSvgFromXml","buffer","isSvg"],"mappings":"AAAA,SAASA,UAAU,QAAQ,mBAAkB;AAE7C,OAAO,MAAMC,mBAAmB,CAACC,SAA4BF,WAAWE,QAAQC,KAAK,CAAA"}

package/dist/uploads/docWithFilenameExists.d.ts

@@ -2,10 +2,11 @@ import type { PayloadRequest } from '../types/index.js';
 type Args = {
     collectionSlug: string;
     filename: string;
+    matchAnyPrefix?: boolean;
     path: string;
     prefix?: string;
     req: PayloadRequest;
 };
-export declare const docWithFilenameExists: ({ collectionSlug, filename, prefix, req, }: Args) => Promise<boolean>;
+export declare const docWithFilenameExists: ({ collectionSlug, filename, matchAnyPrefix, prefix, req, }: Args) => Promise<boolean>;
 export {};
 //# sourceMappingURL=docWithFilenameExists.d.ts.map

package/dist/uploads/docWithFilenameExists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docWithFilenameExists.d.ts","sourceRoot":"","sources":["../../src/uploads/docWithFilenameExists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAE9D,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,4CAKzC,IAAI,KAAG,OAAO,CAAC,OAAO,CAkBxB,CAAA"}
+{"version":3,"file":"docWithFilenameExists.d.ts","sourceRoot":"","sources":["../../src/uploads/docWithFilenameExists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAE9D,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,+DAM/B,IAAI,KAAG,OAAO,CAAC,OAAO,CAiCxB,CAAA"}

package/dist/uploads/docWithFilenameExists.js

@@ -1,14 +1,31 @@
-export const docWithFilenameExists = async ({ collectionSlug, filename, prefix, req })=>{
-    const where = {
-        filename: {
-            equals: filename
-        }
+export const docWithFilenameExists = async ({ collectionSlug, filename, matchAnyPrefix = false, prefix, req })=>{
+    const collection = req.payload.collections[collectionSlug]?.config;
+    const upload = collection?.upload;
+    const hasPrefixField = (collection?.fields ?? []).some((field)=>'name' in field && field.name === 'prefix');
+    const filenameCondition = {
+        or: [
+            {
+                filename: {
+                    equals: filename
+                }
+            },
+            ...upload && typeof upload === 'object' && upload.imageSizes ? upload.imageSizes.map(({ name })=>({
+                    [`sizes.${name}.filename`]: {
+                        equals: filename
+                    }
+                })) : []
+        ]
     };
-    if (prefix) {
-        where.prefix = {
-            equals: prefix
-        };
-    }
+    const where = !matchAnyPrefix && typeof prefix === 'string' && hasPrefixField ? {
+        and: [
+            filenameCondition,
+            {
+                prefix: {
+                    equals: prefix
+                }
+            }
+        ]
+    } : filenameCondition;
     const doc = await req.payload.db.findOne({
         collection: collectionSlug,
         req,

package/dist/uploads/docWithFilenameExists.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/docWithFilenameExists.ts"],"sourcesContent":["import type { PayloadRequest, Where } from '../types/index.js'\n\ntype Args = {\n  collectionSlug: string\n  filename: string\n  path: string\n  prefix?: string\n  req: PayloadRequest\n}\n\nexport const docWithFilenameExists = async ({\n  collectionSlug,\n  filename,\n  prefix,\n  req,\n}: Args): Promise<boolean> => {\n  const where: Where = {\n    filename: {\n      equals: filename,\n    },\n  }\n\n  if (prefix) {\n    where.prefix = { equals: prefix }\n  }\n\n  const doc = await req.payload.db.findOne({\n    collection: collectionSlug,\n    req,\n    where,\n  })\n\n  return !!doc\n}\n"],"names":["docWithFilenameExists","collectionSlug","filename","prefix","req","where","equals","doc","payload","db","findOne","collection"],"mappings":"AAUA,OAAO,MAAMA,wBAAwB,OAAO,EAC1CC,cAAc,EACdC,QAAQ,EACRC,MAAM,EACNC,GAAG,EACE;IACL,MAAMC,QAAe;QACnBH,UAAU;YACRI,QAAQJ;QACV;IACF;IAEA,IAAIC,QAAQ;QACVE,MAAMF,MAAM,GAAG;YAAEG,QAAQH;QAAO;IAClC;IAEA,MAAMI,MAAM,MAAMH,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;QACvCC,YAAYV;QACZG;QACAC;IACF;IAEA,OAAO,CAAC,CAACE;AACX,EAAC"}
+{"version":3,"sources":["../../src/uploads/docWithFilenameExists.ts"],"sourcesContent":["import type { PayloadRequest, Where } from '../types/index.js'\n\ntype Args = {\n  collectionSlug: string\n  filename: string\n  matchAnyPrefix?: boolean\n  path: string\n  prefix?: string\n  req: PayloadRequest\n}\n\nexport const docWithFilenameExists = async ({\n  collectionSlug,\n  filename,\n  matchAnyPrefix = false,\n  prefix,\n  req,\n}: Args): Promise<boolean> => {\n  const collection = req.payload.collections[collectionSlug]?.config\n  const upload = collection?.upload\n  const hasPrefixField = (collection?.fields ?? []).some(\n    (field) => 'name' in field && field.name === 'prefix',\n  )\n  const filenameCondition: Where = {\n    or: [\n      {\n        filename: {\n          equals: filename,\n        },\n      },\n      ...(upload && typeof upload === 'object' && upload.imageSizes\n        ? upload.imageSizes.map(({ name }) => ({\n            [`sizes.${name}.filename`]: { equals: filename },\n          }))\n        : []),\n    ],\n  }\n\n  const where: Where =\n    !matchAnyPrefix && typeof prefix === 'string' && hasPrefixField\n      ? { and: [filenameCondition, { prefix: { equals: prefix } }] }\n      : filenameCondition\n\n  const doc = await req.payload.db.findOne({\n    collection: collectionSlug,\n    req,\n    where,\n  })\n\n  return !!doc\n}\n"],"names":["docWithFilenameExists","collectionSlug","filename","matchAnyPrefix","prefix","req","collection","payload","collections","config","upload","hasPrefixField","fields","some","field","name","filenameCondition","or","equals","imageSizes","map","where","and","doc","db","findOne"],"mappings":"AAWA,OAAO,MAAMA,wBAAwB,OAAO,EAC1CC,cAAc,EACdC,QAAQ,EACRC,iBAAiB,KAAK,EACtBC,MAAM,EACNC,GAAG,EACE;IACL,MAAMC,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACP,eAAe,EAAEQ;IAC5D,MAAMC,SAASJ,YAAYI;IAC3B,MAAMC,iBAAiB,AAACL,CAAAA,YAAYM,UAAU,EAAE,AAAD,EAAGC,IAAI,CACpD,CAACC,QAAU,UAAUA,SAASA,MAAMC,IAAI,KAAK;IAE/C,MAAMC,oBAA2B;QAC/BC,IAAI;YACF;gBACEf,UAAU;oBACRgB,QAAQhB;gBACV;YACF;eACIQ,UAAU,OAAOA,WAAW,YAAYA,OAAOS,UAAU,GACzDT,OAAOS,UAAU,CAACC,GAAG,CAAC,CAAC,EAAEL,IAAI,EAAE,GAAM,CAAA;oBACnC,CAAC,CAAC,MAAM,EAAEA,KAAK,SAAS,CAAC,CAAC,EAAE;wBAAEG,QAAQhB;oBAAS;gBACjD,CAAA,KACA,EAAE;SACP;IACH;IAEA,MAAMmB,QACJ,CAAClB,kBAAkB,OAAOC,WAAW,YAAYO,iBAC7C;QAAEW,KAAK;YAACN;YAAmB;gBAAEZ,QAAQ;oBAAEc,QAAQd;gBAAO;YAAE;SAAE;IAAC,IAC3DY;IAEN,MAAMO,MAAM,MAAMlB,IAAIE,OAAO,CAACiB,EAAE,CAACC,OAAO,CAAC;QACvCnB,YAAYL;QACZI;QACAgB;IACF;IAEA,OAAO,CAAC,CAACE;AACX,EAAC"}

package/dist/uploads/downloadFileToBuffer.d.ts

@@ -0,0 +1,11 @@
+import type { PayloadRequest } from '../types/index.js';
+import type { File, FileData, UploadConfig } from './types.js';
+type Args = {
+    data: Pick<FileData, 'filename' | 'url'>;
+    req: PayloadRequest;
+    uploadConfig: UploadConfig;
+};
+/** Downloads a file into a Payload File buffer, including existing files being resized or copied. */
+export declare const downloadFileToBuffer: ({ data, req, uploadConfig }: Args) => Promise<File>;
+export {};
+//# sourceMappingURL=downloadFileToBuffer.d.ts.map

package/dist/uploads/downloadFileToBuffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"downloadFileToBuffer.d.ts","sourceRoot":"","sources":["../../src/uploads/downloadFileToBuffer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAM9D,KAAK,IAAI,GAAG;IACV,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,CAAA;IACxC,GAAG,EAAE,cAAc,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,CAAA;AAeD,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,gCAAuC,IAAI,KAAG,OAAO,CAAC,IAAI,CAuE1F,CAAA"}

package/dist/uploads/downloadFileToBuffer.js

@@ -0,0 +1,72 @@
+import { APIError } from '../errors/index.js';
+import { getRequestOrigin } from '../utilities/getRequestOrigin.js';
+import { fetchWithRedirects, parseFileURL } from './fetchWithRedirects.js';
+const hasProtocol = (url)=>/^[a-z][a-z\d+.-]*:/i.test(url);
+const getRequestBaseURL = (req)=>{
+    try {
+        const requestURL = parseFileURL(req.url);
+        const host = req.headers.get('host') || requestURL.host;
+        return parseFileURL(`${requestURL.protocol}//${host}`);
+    } catch  {
+        return undefined;
+    }
+};
+/** Downloads a file into a Payload File buffer, including existing files being resized or copied. */ export const downloadFileToBuffer = async ({ data, req, uploadConfig })=>{
+    const { filename, url } = data;
+    if (typeof url === 'string') {
+        let baseOrigin;
+        let parsedFileURL;
+        if (hasProtocol(url)) {
+            parsedFileURL = parseFileURL(url);
+        } else {
+            const requestOrigin = getRequestOrigin({
+                config: req.payload.config,
+                req
+            });
+            let requestBaseURL;
+            if (requestOrigin) {
+                requestBaseURL = parseFileURL(requestOrigin);
+                baseOrigin = requestBaseURL.origin;
+            } else {
+                requestBaseURL = getRequestBaseURL(req);
+            }
+            if (!requestBaseURL) {
+                throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400);
+            }
+            parsedFileURL = parseFileURL(url, requestBaseURL);
+        }
+        const fileURL = parsedFileURL.toString();
+        const requestHeaders = Object.fromEntries(new Headers(req.headers));
+        const cookies = (req.headers.get('cookie') ?? '').split(';');
+        const getHeaders = (currentURL)=>{
+            const isSameOrigin = Boolean(baseOrigin && new URL(currentURL).origin === baseOrigin);
+            return uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter({
+                ...requestHeaders
+            }, {
+                isSameOrigin,
+                url: currentURL
+            }) : {
+                cookie: cookies.filter((cookie)=>isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix)).join(';')
+            };
+        };
+        const { response, url: resolvedURL } = await fetchWithRedirects({
+            allowList: uploadConfig.pasteURL ? uploadConfig.pasteURL.allowList : undefined,
+            getHeaders,
+            skipSafeFetch: uploadConfig.skipSafeFetch,
+            url: fileURL
+        });
+        if (!response.ok) {
+            throw new APIError(`Failed to fetch file from ${resolvedURL}`, response.status);
+        }
+        const data = await response.arrayBuffer();
+        return {
+            name: filename,
+            data: Buffer.from(data),
+            mimetype: response.headers.get('content-type') || undefined,
+            size: Number(response.headers.get('content-length')) || 0
+        };
+    }
+    throw new APIError('Invalid file url', 400);
+};
+
+//# sourceMappingURL=downloadFileToBuffer.js.map

package/dist/uploads/downloadFileToBuffer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/downloadFileToBuffer.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { getRequestOrigin } from '../utilities/getRequestOrigin.js'\nimport { fetchWithRedirects, parseFileURL } from './fetchWithRedirects.js'\n\ntype Args = {\n  data: Pick<FileData, 'filename' | 'url'>\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\n\nconst hasProtocol = (url: string): boolean => /^[a-z][a-z\\d+.-]*:/i.test(url)\n\nconst getRequestBaseURL = (req: PayloadRequest): undefined | URL => {\n  try {\n    const requestURL = parseFileURL(req.url!)\n    const host = req.headers.get('host') || requestURL.host\n\n    return parseFileURL(`${requestURL.protocol}//${host}`)\n  } catch {\n    return undefined\n  }\n}\n\n/** Downloads a file into a Payload File buffer, including existing files being resized or copied. */\nexport const downloadFileToBuffer = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  if (typeof url === 'string') {\n    let baseOrigin: string | undefined\n    let parsedFileURL: URL\n\n    if (hasProtocol(url)) {\n      parsedFileURL = parseFileURL(url)\n    } else {\n      const requestOrigin = getRequestOrigin({ config: req.payload.config, req })\n      let requestBaseURL: undefined | URL\n\n      if (requestOrigin) {\n        requestBaseURL = parseFileURL(requestOrigin)\n        baseOrigin = requestBaseURL.origin\n      } else {\n        requestBaseURL = getRequestBaseURL(req)\n      }\n\n      if (!requestBaseURL) {\n        throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400)\n      }\n\n      parsedFileURL = parseFileURL(url, requestBaseURL)\n    }\n\n    const fileURL = parsedFileURL.toString()\n    const requestHeaders = Object.fromEntries(new Headers(req.headers))\n    const cookies = (req.headers.get('cookie') ?? '').split(';')\n\n    const getHeaders = (currentURL: string): Record<string, string> => {\n      const isSameOrigin = Boolean(baseOrigin && new URL(currentURL).origin === baseOrigin)\n\n      return uploadConfig.externalFileHeaderFilter\n        ? uploadConfig.externalFileHeaderFilter(\n            { ...requestHeaders },\n            { isSameOrigin, url: currentURL },\n          )\n        : {\n            cookie: cookies\n              .filter(\n                (cookie) =>\n                  isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix),\n              )\n              .join(';'),\n          }\n    }\n\n    const { response, url: resolvedURL } = await fetchWithRedirects({\n      allowList: uploadConfig.pasteURL ? uploadConfig.pasteURL.allowList : undefined,\n      getHeaders,\n      skipSafeFetch: uploadConfig.skipSafeFetch,\n      url: fileURL,\n    })\n\n    if (!response.ok) {\n      throw new APIError(`Failed to fetch file from ${resolvedURL}`, response.status)\n    }\n\n    const data = await response.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: response.headers.get('content-type') || undefined!,\n      size: Number(response.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","getRequestOrigin","fetchWithRedirects","parseFileURL","hasProtocol","url","test","getRequestBaseURL","req","requestURL","host","headers","get","protocol","undefined","downloadFileToBuffer","data","uploadConfig","filename","baseOrigin","parsedFileURL","requestOrigin","config","payload","requestBaseURL","origin","fileURL","toString","requestHeaders","Object","fromEntries","Headers","cookies","split","getHeaders","currentURL","isSameOrigin","Boolean","URL","externalFileHeaderFilter","cookie","filter","trim","startsWith","cookiePrefix","join","response","resolvedURL","allowList","pasteURL","skipSafeFetch","ok","status","arrayBuffer","name","Buffer","from","mimetype","size","Number"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,kBAAkB,EAAEC,YAAY,QAAQ,0BAAyB;AAQ1E,MAAMC,cAAc,CAACC,MAAyB,sBAAsBC,IAAI,CAACD;AAEzE,MAAME,oBAAoB,CAACC;IACzB,IAAI;QACF,MAAMC,aAAaN,aAAaK,IAAIH,GAAG;QACvC,MAAMK,OAAOF,IAAIG,OAAO,CAACC,GAAG,CAAC,WAAWH,WAAWC,IAAI;QAEvD,OAAOP,aAAa,GAAGM,WAAWI,QAAQ,CAAC,EAAE,EAAEH,MAAM;IACvD,EAAE,OAAM;QACN,OAAOI;IACT;AACF;AAEA,mGAAmG,GACnG,OAAO,MAAMC,uBAAuB,OAAO,EAAEC,IAAI,EAAER,GAAG,EAAES,YAAY,EAAQ;IAC1E,MAAM,EAAEC,QAAQ,EAAEb,GAAG,EAAE,GAAGW;IAE1B,IAAI,OAAOX,QAAQ,UAAU;QAC3B,IAAIc;QACJ,IAAIC;QAEJ,IAAIhB,YAAYC,MAAM;YACpBe,gBAAgBjB,aAAaE;QAC/B,OAAO;YACL,MAAMgB,gBAAgBpB,iBAAiB;gBAAEqB,QAAQd,IAAIe,OAAO,CAACD,MAAM;gBAAEd;YAAI;YACzE,IAAIgB;YAEJ,IAAIH,eAAe;gBACjBG,iBAAiBrB,aAAakB;gBAC9BF,aAAaK,eAAeC,MAAM;YACpC,OAAO;gBACLD,iBAAiBjB,kBAAkBC;YACrC;YAEA,IAAI,CAACgB,gBAAgB;gBACnB,MAAM,IAAIxB,SAAS,kEAAkE;YACvF;YAEAoB,gBAAgBjB,aAAaE,KAAKmB;QACpC;QAEA,MAAME,UAAUN,cAAcO,QAAQ;QACtC,MAAMC,iBAAiBC,OAAOC,WAAW,CAAC,IAAIC,QAAQvB,IAAIG,OAAO;QACjE,MAAMqB,UAAU,AAACxB,CAAAA,IAAIG,OAAO,CAACC,GAAG,CAAC,aAAa,EAAC,EAAGqB,KAAK,CAAC;QAExD,MAAMC,aAAa,CAACC;YAClB,MAAMC,eAAeC,QAAQlB,cAAc,IAAImB,IAAIH,YAAYV,MAAM,KAAKN;YAE1E,OAAOF,aAAasB,wBAAwB,GACxCtB,aAAasB,wBAAwB,CACnC;gBAAE,GAAGX,cAAc;YAAC,GACpB;gBAAEQ;gBAAc/B,KAAK8B;YAAW,KAElC;gBACEK,QAAQR,QACLS,MAAM,CACL,CAACD,SACCJ,gBAAgB,CAACI,OAAOE,IAAI,GAAGC,UAAU,CAACnC,IAAIe,OAAO,CAACD,MAAM,CAACsB,YAAY,GAE5EC,IAAI,CAAC;YACV;QACN;QAEA,MAAM,EAAEC,QAAQ,EAAEzC,KAAK0C,WAAW,EAAE,GAAG,MAAM7C,mBAAmB;YAC9D8C,WAAW/B,aAAagC,QAAQ,GAAGhC,aAAagC,QAAQ,CAACD,SAAS,GAAGlC;YACrEoB;YACAgB,eAAejC,aAAaiC,aAAa;YACzC7C,KAAKqB;QACP;QAEA,IAAI,CAACoB,SAASK,EAAE,EAAE;YAChB,MAAM,IAAInD,SAAS,CAAC,0BAA0B,EAAE+C,aAAa,EAAED,SAASM,MAAM;QAChF;QAEA,MAAMpC,OAAO,MAAM8B,SAASO,WAAW;QAEvC,OAAO;YACLC,MAAMpC;YACNF,MAAMuC,OAAOC,IAAI,CAACxC;YAClByC,UAAUX,SAASnC,OAAO,CAACC,GAAG,CAAC,mBAAmBE;YAClD4C,MAAMC,OAAOb,SAASnC,OAAO,CAACC,GAAG,CAAC,sBAAsB;QAC1D;IACF;IAEA,MAAM,IAAIZ,SAAS,oBAAoB;AACzC,EAAC"}

package/dist/uploads/endpoints/getFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFile.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAU3D,eAAO,MAAM,cAAc,EAAE,cA6J5B,CAAA"}
+{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFile.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAY3D,eAAO,MAAM,cAAc,EAAE,cAgK5B,CAAA"}

package/dist/uploads/endpoints/getFile.js

@@ -6,9 +6,11 @@ import { APIError } from '../../errors/APIError.js';
 import { checkFileAccess } from '../../uploads/checkFileAccess.js';
 import { streamFile } from '../../uploads/fetchAPI-stream-file/index.js';
 import { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js';
+import { getFileExtension, isXmlMimeType } from '../../uploads/getFileTypeIdentity.js';
 import { parseRangeHeader } from '../../uploads/parseRangeHeader.js';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js';
 export const getFileHandler = async (req)=>{
     const collection = getRequestCollection(req);
     const filename = req.routeParams?.filename;
@@ -80,7 +82,7 @@ export const getFileHandler = async (req)=>{
     }
     const fileTypeResult = await fileTypeFromFile(filePath) || getFileTypeFallback(filePath);
     let mimeType = fileTypeResult.mime;
-    if (filePath.endsWith('.svg') && fileTypeResult.mime === 'application/xml') {
+    if (getFileExtension(filePath).toLowerCase() === 'svg' && fileTypeResult.mime === 'application/xml') {
         mimeType = 'image/svg+xml';
     }
     // Parse Range header for byte range requests
@@ -106,8 +108,8 @@ export const getFileHandler = async (req)=>{
     let headers = new Headers();
     headers.set('Content-Type', mimeType);
     headers.set('Accept-Ranges', 'bytes');
-    if (mimeType === 'image/svg+xml') {
-        headers.set('Content-Security-Policy', "script-src 'none'");
+    if (isXmlMimeType(mimeType)) {
+        headers.set('Content-Security-Policy', uploadContentSecurityPolicy);
     }
     let data;
     let status;

package/dist/uploads/endpoints/getFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/getFile.ts"],"sourcesContent":["import type { Stats } from 'fs'\n\nimport { fileTypeFromFile } from 'file-type'\nimport fsPromises from 'fs/promises'\nimport { status as httpStatus } from 'http-status'\nimport path from 'path'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { checkFileAccess } from '../../uploads/checkFileAccess.js'\nimport { streamFile } from '../../uploads/fetchAPI-stream-file/index.js'\nimport { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js'\nimport { parseRangeHeader } from '../../uploads/parseRangeHeader.js'\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\n\nexport const getFileHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n\n  const filename = req.routeParams?.filename as string\n  const prefix = req.searchParams?.get('prefix') ?? undefined\n\n  if (!collection.config.upload) {\n    throw new APIError(\n      `This collection is not an upload collection: ${collection.config.slug}`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  const accessResult = (await checkFileAccess({\n    collection,\n    filename,\n    prefix,\n    req,\n  }))!\n\n  if (accessResult instanceof Response) {\n    return accessResult\n  }\n\n  if (collection.config.upload.handlers?.length) {\n    let customResponse: null | Response | void = null\n    const headers = new Headers()\n\n    for (const handler of collection.config.upload.handlers) {\n      customResponse = await handler(req, {\n        doc: accessResult,\n        headers,\n        params: {\n          collection: collection.config.slug,\n          filename,\n          prefix,\n        },\n      })\n      if (customResponse && customResponse instanceof Response) {\n        break\n      }\n    }\n\n    if (customResponse instanceof Response) {\n      return customResponse\n    }\n  }\n\n  // Local filesystem fallback — cloud storage handlers return a Response above\n  // and have their own filename validation via sanitizeFilename.\n  const fileDir = collection.config.upload?.staticDir || collection.config.slug\n  const resolvedDir = path.resolve(fileDir)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!filePath.startsWith(resolvedDir + path.sep)) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  let stats: Stats\n\n  try {\n    stats = await fsPromises.stat(filePath)\n  } catch (err) {\n    if ((err as { code?: string }).code === 'ENOENT') {\n      req.payload.logger.error(\n        `File ${filename} for collection ${collection.config.slug} is missing on the disk. Expected path: ${filePath}`,\n      )\n\n      // Omit going to the routeError handler by returning response instead of\n      // throwing an error to cut down log noise. The response still matches what you get with APIError to not leak details to the user.\n      return Response.json(\n        {\n          errors: [\n            {\n              message: 'Something went wrong.',\n            },\n          ],\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: 500,\n        },\n      )\n    }\n\n    throw err\n  }\n\n  const fileTypeResult = (await fileTypeFromFile(filePath)) || getFileTypeFallback(filePath)\n  let mimeType = fileTypeResult.mime\n\n  if (filePath.endsWith('.svg') && fileTypeResult.mime === 'application/xml') {\n    mimeType = 'image/svg+xml'\n  }\n\n  // Parse Range header for byte range requests\n  const rangeHeader = req.headers.get('range')\n  const rangeResult = parseRangeHeader({\n    fileSize: stats.size,\n    rangeHeader,\n  })\n\n  if (rangeResult.type === 'invalid') {\n    let headers = new Headers()\n    headers.set('Content-Range', `bytes */${stats.size}`)\n    headers = collection.config.upload?.modifyResponseHeaders\n      ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n      : headers\n\n    return new Response(null, {\n      headers: headersWithCors({\n        headers,\n        req,\n      }),\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    })\n  }\n\n  let headers = new Headers()\n  headers.set('Content-Type', mimeType)\n  headers.set('Accept-Ranges', 'bytes')\n\n  if (mimeType === 'image/svg+xml') {\n    headers.set('Content-Security-Policy', \"script-src 'none'\")\n  }\n\n  let data: ReadableStream\n  let status: number\n  const isPartial = rangeResult.type === 'partial'\n  const range = rangeResult.range\n\n  if (isPartial && range) {\n    const contentLength = range.end - range.start + 1\n    headers.set('Content-Length', String(contentLength))\n    headers.set('Content-Range', `bytes ${range.start}-${range.end}/${stats.size}`)\n    data = streamFile({ filePath, options: { end: range.end, start: range.start } })\n    status = httpStatus.PARTIAL_CONTENT\n  } else {\n    headers.set('Content-Length', String(stats.size))\n    data = streamFile({ filePath })\n    status = httpStatus.OK\n  }\n\n  headers = collection.config.upload?.modifyResponseHeaders\n    ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n    : headers\n\n  return new Response(data, {\n    headers: headersWithCors({\n      headers,\n      req,\n    }),\n    status,\n  })\n}\n"],"names":["fileTypeFromFile","fsPromises","status","httpStatus","path","APIError","checkFileAccess","streamFile","getFileTypeFallback","parseRangeHeader","getRequestCollection","headersWithCors","getFileHandler","req","collection","filename","routeParams","prefix","searchParams","get","undefined","config","upload","slug","BAD_REQUEST","accessResult","Response","handlers","length","customResponse","headers","Headers","handler","doc","params","fileDir","staticDir","resolvedDir","resolve","filePath","startsWith","sep","stats","stat","err","code","payload","logger","error","json","errors","message","fileTypeResult","mimeType","mime","endsWith","rangeHeader","rangeResult","fileSize","size","type","set","modifyResponseHeaders","REQUESTED_RANGE_NOT_SATISFIABLE","data","isPartial","range","contentLength","end","start","String","options","PARTIAL_CONTENT","OK"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,YAAW;AAC5C,OAAOC,gBAAgB,cAAa;AACpC,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAClD,OAAOC,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,UAAU,QAAQ,8CAA6C;AACxE,SAASC,mBAAmB,QAAQ,uCAAsC;AAC1E,SAASC,gBAAgB,QAAQ,oCAAmC;AACpE,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AAEpE,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaJ,qBAAqBG;IAExC,MAAME,WAAWF,IAAIG,WAAW,EAAED;IAClC,MAAME,SAASJ,IAAIK,YAAY,EAAEC,IAAI,aAAaC;IAElD,IAAI,CAACN,WAAWO,MAAM,CAACC,MAAM,EAAE;QAC7B,MAAM,IAAIjB,SACR,CAAC,6CAA6C,EAAES,WAAWO,MAAM,CAACE,IAAI,EAAE,EACxEpB,WAAWqB,WAAW;IAE1B;IAEA,MAAMC,eAAgB,MAAMnB,gBAAgB;QAC1CQ;QACAC;QACAE;QACAJ;IACF;IAEA,IAAIY,wBAAwBC,UAAU;QACpC,OAAOD;IACT;IAEA,IAAIX,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,EAAEC,QAAQ;QAC7C,IAAIC,iBAAyC;QAC7C,MAAMC,UAAU,IAAIC;QAEpB,KAAK,MAAMC,WAAWlB,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,CAAE;YACvDE,iBAAiB,MAAMG,QAAQnB,KAAK;gBAClCoB,KAAKR;gBACLK;gBACAI,QAAQ;oBACNpB,YAAYA,WAAWO,MAAM,CAACE,IAAI;oBAClCR;oBACAE;gBACF;YACF;YACA,IAAIY,kBAAkBA,0BAA0BH,UAAU;gBACxD;YACF;QACF;QAEA,IAAIG,0BAA0BH,UAAU;YACtC,OAAOG;QACT;IACF;IAEA,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAMM,UAAUrB,WAAWO,MAAM,CAACC,MAAM,EAAEc,aAAatB,WAAWO,MAAM,CAACE,IAAI;IAC7E,MAAMc,cAAcjC,KAAKkC,OAAO,CAACH;IACjC,MAAMI,WAAWnC,KAAKkC,OAAO,CAACD,aAAatB;IAE3C,IAAI,CAACwB,SAASC,UAAU,CAACH,cAAcjC,KAAKqC,GAAG,GAAG;QAChD,MAAM,IAAIpC,SAAS,qBAAqBF,WAAWqB,WAAW;IAChE;IAEA,IAAIkB;IAEJ,IAAI;QACFA,QAAQ,MAAMzC,WAAW0C,IAAI,CAACJ;IAChC,EAAE,OAAOK,KAAK;QACZ,IAAI,AAACA,IAA0BC,IAAI,KAAK,UAAU;YAChDhC,IAAIiC,OAAO,CAACC,MAAM,CAACC,KAAK,CACtB,CAAC,KAAK,EAAEjC,SAAS,gBAAgB,EAAED,WAAWO,MAAM,CAACE,IAAI,CAAC,wCAAwC,EAAEgB,UAAU;YAGhH,wEAAwE;YACxE,kIAAkI;YAClI,OAAOb,SAASuB,IAAI,CAClB;gBACEC,QAAQ;oBACN;wBACEC,SAAS;oBACX;iBACD;YACH,GACA;gBACErB,SAASnB,gBAAgB;oBACvBmB,SAAS,IAAIC;oBACblB;gBACF;gBACAX,QAAQ;YACV;QAEJ;QAEA,MAAM0C;IACR;IAEA,MAAMQ,iBAAiB,AAAC,MAAMpD,iBAAiBuC,aAAc/B,oBAAoB+B;IACjF,IAAIc,WAAWD,eAAeE,IAAI;IAElC,IAAIf,SAASgB,QAAQ,CAAC,WAAWH,eAAeE,IAAI,KAAK,mBAAmB;QAC1ED,WAAW;IACb;IAEA,6CAA6C;IAC7C,MAAMG,cAAc3C,IAAIiB,OAAO,CAACX,GAAG,CAAC;IACpC,MAAMsC,cAAchD,iBAAiB;QACnCiD,UAAUhB,MAAMiB,IAAI;QACpBH;IACF;IAEA,IAAIC,YAAYG,IAAI,KAAK,WAAW;QAClC,IAAI9B,UAAU,IAAIC;QAClBD,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAEnB,MAAMiB,IAAI,EAAE;QACpD7B,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;YAAEhC;QAAQ,MAAMA,UAC/DA;QAEJ,OAAO,IAAIJ,SAAS,MAAM;YACxBI,SAASnB,gBAAgB;gBACvBmB;gBACAjB;YACF;YACAX,QAAQC,WAAW4D,+BAA+B;QACpD;IACF;IAEA,IAAIjC,UAAU,IAAIC;IAClBD,QAAQ+B,GAAG,CAAC,gBAAgBR;IAC5BvB,QAAQ+B,GAAG,CAAC,iBAAiB;IAE7B,IAAIR,aAAa,iBAAiB;QAChCvB,QAAQ+B,GAAG,CAAC,2BAA2B;IACzC;IAEA,IAAIG;IACJ,IAAI9D;IACJ,MAAM+D,YAAYR,YAAYG,IAAI,KAAK;IACvC,MAAMM,QAAQT,YAAYS,KAAK;IAE/B,IAAID,aAAaC,OAAO;QACtB,MAAMC,gBAAgBD,MAAME,GAAG,GAAGF,MAAMG,KAAK,GAAG;QAChDvC,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAOH;QACrCrC,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAEK,MAAMG,KAAK,CAAC,CAAC,EAAEH,MAAME,GAAG,CAAC,CAAC,EAAE1B,MAAMiB,IAAI,EAAE;QAC9EK,OAAOzD,WAAW;YAAEgC;YAAUgC,SAAS;gBAAEH,KAAKF,MAAME,GAAG;gBAAEC,OAAOH,MAAMG,KAAK;YAAC;QAAE;QAC9EnE,SAASC,WAAWqE,eAAe;IACrC,OAAO;QACL1C,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAO5B,MAAMiB,IAAI;QAC/CK,OAAOzD,WAAW;YAAEgC;QAAS;QAC7BrC,SAASC,WAAWsE,EAAE;IACxB;IAEA3C,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;QAAEhC;IAAQ,MAAMA,UAC/DA;IAEJ,OAAO,IAAIJ,SAASsC,MAAM;QACxBlC,SAASnB,gBAAgB;YACvBmB;YACAjB;QACF;QACAX;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../src/uploads/endpoints/getFile.ts"],"sourcesContent":["import type { Stats } from 'fs'\n\nimport { fileTypeFromFile } from 'file-type'\nimport fsPromises from 'fs/promises'\nimport { status as httpStatus } from 'http-status'\nimport path from 'path'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { checkFileAccess } from '../../uploads/checkFileAccess.js'\nimport { streamFile } from '../../uploads/fetchAPI-stream-file/index.js'\nimport { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js'\nimport { getFileExtension, isXmlMimeType } from '../../uploads/getFileTypeIdentity.js'\nimport { parseRangeHeader } from '../../uploads/parseRangeHeader.js'\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js'\n\nexport const getFileHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n\n  const filename = req.routeParams?.filename as string\n  const prefix = req.searchParams?.get('prefix') ?? undefined\n\n  if (!collection.config.upload) {\n    throw new APIError(\n      `This collection is not an upload collection: ${collection.config.slug}`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  const accessResult = (await checkFileAccess({\n    collection,\n    filename,\n    prefix,\n    req,\n  }))!\n\n  if (accessResult instanceof Response) {\n    return accessResult\n  }\n\n  if (collection.config.upload.handlers?.length) {\n    let customResponse: null | Response | void = null\n    const headers = new Headers()\n\n    for (const handler of collection.config.upload.handlers) {\n      customResponse = await handler(req, {\n        doc: accessResult,\n        headers,\n        params: {\n          collection: collection.config.slug,\n          filename,\n          prefix,\n        },\n      })\n      if (customResponse && customResponse instanceof Response) {\n        break\n      }\n    }\n\n    if (customResponse instanceof Response) {\n      return customResponse\n    }\n  }\n\n  // Local filesystem fallback — cloud storage handlers return a Response above\n  // and have their own filename validation via sanitizeFilename.\n  const fileDir = collection.config.upload?.staticDir || collection.config.slug\n  const resolvedDir = path.resolve(fileDir)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!filePath.startsWith(resolvedDir + path.sep)) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  let stats: Stats\n\n  try {\n    stats = await fsPromises.stat(filePath)\n  } catch (err) {\n    if ((err as { code?: string }).code === 'ENOENT') {\n      req.payload.logger.error(\n        `File ${filename} for collection ${collection.config.slug} is missing on the disk. Expected path: ${filePath}`,\n      )\n\n      // Omit going to the routeError handler by returning response instead of\n      // throwing an error to cut down log noise. The response still matches what you get with APIError to not leak details to the user.\n      return Response.json(\n        {\n          errors: [\n            {\n              message: 'Something went wrong.',\n            },\n          ],\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: 500,\n        },\n      )\n    }\n\n    throw err\n  }\n\n  const fileTypeResult = (await fileTypeFromFile(filePath)) || getFileTypeFallback(filePath)\n  let mimeType = fileTypeResult.mime\n\n  if (\n    getFileExtension(filePath).toLowerCase() === 'svg' &&\n    fileTypeResult.mime === 'application/xml'\n  ) {\n    mimeType = 'image/svg+xml'\n  }\n\n  // Parse Range header for byte range requests\n  const rangeHeader = req.headers.get('range')\n  const rangeResult = parseRangeHeader({\n    fileSize: stats.size,\n    rangeHeader,\n  })\n\n  if (rangeResult.type === 'invalid') {\n    let headers = new Headers()\n    headers.set('Content-Range', `bytes */${stats.size}`)\n    headers = collection.config.upload?.modifyResponseHeaders\n      ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n      : headers\n\n    return new Response(null, {\n      headers: headersWithCors({\n        headers,\n        req,\n      }),\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    })\n  }\n\n  let headers = new Headers()\n  headers.set('Content-Type', mimeType)\n  headers.set('Accept-Ranges', 'bytes')\n\n  if (isXmlMimeType(mimeType)) {\n    headers.set('Content-Security-Policy', uploadContentSecurityPolicy)\n  }\n\n  let data: ReadableStream\n  let status: number\n  const isPartial = rangeResult.type === 'partial'\n  const range = rangeResult.range\n\n  if (isPartial && range) {\n    const contentLength = range.end - range.start + 1\n    headers.set('Content-Length', String(contentLength))\n    headers.set('Content-Range', `bytes ${range.start}-${range.end}/${stats.size}`)\n    data = streamFile({ filePath, options: { end: range.end, start: range.start } })\n    status = httpStatus.PARTIAL_CONTENT\n  } else {\n    headers.set('Content-Length', String(stats.size))\n    data = streamFile({ filePath })\n    status = httpStatus.OK\n  }\n\n  headers = collection.config.upload?.modifyResponseHeaders\n    ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n    : headers\n\n  return new Response(data, {\n    headers: headersWithCors({\n      headers,\n      req,\n    }),\n    status,\n  })\n}\n"],"names":["fileTypeFromFile","fsPromises","status","httpStatus","path","APIError","checkFileAccess","streamFile","getFileTypeFallback","getFileExtension","isXmlMimeType","parseRangeHeader","getRequestCollection","headersWithCors","uploadContentSecurityPolicy","getFileHandler","req","collection","filename","routeParams","prefix","searchParams","get","undefined","config","upload","slug","BAD_REQUEST","accessResult","Response","handlers","length","customResponse","headers","Headers","handler","doc","params","fileDir","staticDir","resolvedDir","resolve","filePath","startsWith","sep","stats","stat","err","code","payload","logger","error","json","errors","message","fileTypeResult","mimeType","mime","toLowerCase","rangeHeader","rangeResult","fileSize","size","type","set","modifyResponseHeaders","REQUESTED_RANGE_NOT_SATISFIABLE","data","isPartial","range","contentLength","end","start","String","options","PARTIAL_CONTENT","OK"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,YAAW;AAC5C,OAAOC,gBAAgB,cAAa;AACpC,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAClD,OAAOC,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,UAAU,QAAQ,8CAA6C;AACxE,SAASC,mBAAmB,QAAQ,uCAAsC;AAC1E,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,uCAAsC;AACtF,SAASC,gBAAgB,QAAQ,oCAAmC;AACpE,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,2BAA2B,QAAQ,oCAAmC;AAE/E,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaL,qBAAqBI;IAExC,MAAME,WAAWF,IAAIG,WAAW,EAAED;IAClC,MAAME,SAASJ,IAAIK,YAAY,EAAEC,IAAI,aAAaC;IAElD,IAAI,CAACN,WAAWO,MAAM,CAACC,MAAM,EAAE;QAC7B,MAAM,IAAIpB,SACR,CAAC,6CAA6C,EAAEY,WAAWO,MAAM,CAACE,IAAI,EAAE,EACxEvB,WAAWwB,WAAW;IAE1B;IAEA,MAAMC,eAAgB,MAAMtB,gBAAgB;QAC1CW;QACAC;QACAE;QACAJ;IACF;IAEA,IAAIY,wBAAwBC,UAAU;QACpC,OAAOD;IACT;IAEA,IAAIX,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,EAAEC,QAAQ;QAC7C,IAAIC,iBAAyC;QAC7C,MAAMC,UAAU,IAAIC;QAEpB,KAAK,MAAMC,WAAWlB,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,CAAE;YACvDE,iBAAiB,MAAMG,QAAQnB,KAAK;gBAClCoB,KAAKR;gBACLK;gBACAI,QAAQ;oBACNpB,YAAYA,WAAWO,MAAM,CAACE,IAAI;oBAClCR;oBACAE;gBACF;YACF;YACA,IAAIY,kBAAkBA,0BAA0BH,UAAU;gBACxD;YACF;QACF;QAEA,IAAIG,0BAA0BH,UAAU;YACtC,OAAOG;QACT;IACF;IAEA,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAMM,UAAUrB,WAAWO,MAAM,CAACC,MAAM,EAAEc,aAAatB,WAAWO,MAAM,CAACE,IAAI;IAC7E,MAAMc,cAAcpC,KAAKqC,OAAO,CAACH;IACjC,MAAMI,WAAWtC,KAAKqC,OAAO,CAACD,aAAatB;IAE3C,IAAI,CAACwB,SAASC,UAAU,CAACH,cAAcpC,KAAKwC,GAAG,GAAG;QAChD,MAAM,IAAIvC,SAAS,qBAAqBF,WAAWwB,WAAW;IAChE;IAEA,IAAIkB;IAEJ,IAAI;QACFA,QAAQ,MAAM5C,WAAW6C,IAAI,CAACJ;IAChC,EAAE,OAAOK,KAAK;QACZ,IAAI,AAACA,IAA0BC,IAAI,KAAK,UAAU;YAChDhC,IAAIiC,OAAO,CAACC,MAAM,CAACC,KAAK,CACtB,CAAC,KAAK,EAAEjC,SAAS,gBAAgB,EAAED,WAAWO,MAAM,CAACE,IAAI,CAAC,wCAAwC,EAAEgB,UAAU;YAGhH,wEAAwE;YACxE,kIAAkI;YAClI,OAAOb,SAASuB,IAAI,CAClB;gBACEC,QAAQ;oBACN;wBACEC,SAAS;oBACX;iBACD;YACH,GACA;gBACErB,SAASpB,gBAAgB;oBACvBoB,SAAS,IAAIC;oBACblB;gBACF;gBACAd,QAAQ;YACV;QAEJ;QAEA,MAAM6C;IACR;IAEA,MAAMQ,iBAAiB,AAAC,MAAMvD,iBAAiB0C,aAAclC,oBAAoBkC;IACjF,IAAIc,WAAWD,eAAeE,IAAI;IAElC,IACEhD,iBAAiBiC,UAAUgB,WAAW,OAAO,SAC7CH,eAAeE,IAAI,KAAK,mBACxB;QACAD,WAAW;IACb;IAEA,6CAA6C;IAC7C,MAAMG,cAAc3C,IAAIiB,OAAO,CAACX,GAAG,CAAC;IACpC,MAAMsC,cAAcjD,iBAAiB;QACnCkD,UAAUhB,MAAMiB,IAAI;QACpBH;IACF;IAEA,IAAIC,YAAYG,IAAI,KAAK,WAAW;QAClC,IAAI9B,UAAU,IAAIC;QAClBD,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAEnB,MAAMiB,IAAI,EAAE;QACpD7B,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;YAAEhC;QAAQ,MAAMA,UAC/DA;QAEJ,OAAO,IAAIJ,SAAS,MAAM;YACxBI,SAASpB,gBAAgB;gBACvBoB;gBACAjB;YACF;YACAd,QAAQC,WAAW+D,+BAA+B;QACpD;IACF;IAEA,IAAIjC,UAAU,IAAIC;IAClBD,QAAQ+B,GAAG,CAAC,gBAAgBR;IAC5BvB,QAAQ+B,GAAG,CAAC,iBAAiB;IAE7B,IAAItD,cAAc8C,WAAW;QAC3BvB,QAAQ+B,GAAG,CAAC,2BAA2BlD;IACzC;IAEA,IAAIqD;IACJ,IAAIjE;IACJ,MAAMkE,YAAYR,YAAYG,IAAI,KAAK;IACvC,MAAMM,QAAQT,YAAYS,KAAK;IAE/B,IAAID,aAAaC,OAAO;QACtB,MAAMC,gBAAgBD,MAAME,GAAG,GAAGF,MAAMG,KAAK,GAAG;QAChDvC,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAOH;QACrCrC,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAEK,MAAMG,KAAK,CAAC,CAAC,EAAEH,MAAME,GAAG,CAAC,CAAC,EAAE1B,MAAMiB,IAAI,EAAE;QAC9EK,OAAO5D,WAAW;YAAEmC;YAAUgC,SAAS;gBAAEH,KAAKF,MAAME,GAAG;gBAAEC,OAAOH,MAAMG,KAAK;YAAC;QAAE;QAC9EtE,SAASC,WAAWwE,eAAe;IACrC,OAAO;QACL1C,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAO5B,MAAMiB,IAAI;QAC/CK,OAAO5D,WAAW;YAAEmC;QAAS;QAC7BxC,SAASC,WAAWyE,EAAE;IACxB;IAEA3C,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;QAAEhC;IAAQ,MAAMA,UAC/DA;IAEJ,OAAO,IAAIJ,SAASsC,MAAM;QACxBlC,SAASpB,gBAAgB;YACvBoB;YACAjB;QACF;QACAd;IACF;AACF,EAAC"}

package/dist/uploads/endpoints/index.js

@@ -1,9 +1,9 @@
 import { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js';
 import { getFileHandler } from './getFile.js';
-import { getFileFromURLHandler } from './getFileFromURL.js';
+import { pasteURLHandler } from './pasteURL.js';
 export const uploadCollectionEndpoints = wrapInternalEndpoints([
     {
-        handler: getFileFromURLHandler,
+        handler: pasteURLHandler,
         method: 'get',
         path: '/paste-url/:id?'
     },

package/dist/uploads/endpoints/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { getFileHandler } from './getFile.js'\nimport { getFileFromURLHandler } from './getFileFromURL.js'\n\nexport const uploadCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: getFileFromURLHandler,\n    method: 'get',\n    path: '/paste-url/:id?',\n  },\n  {\n    handler: getFileHandler,\n    method: 'get',\n    path: '/file/:filename',\n  },\n])\n"],"names":["wrapInternalEndpoints","getFileHandler","getFileFromURLHandler","uploadCollectionEndpoints","handler","method","path"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,qBAAqB,QAAQ,sBAAqB;AAE3D,OAAO,MAAMC,4BAAwCH,sBAAsB;IACzE;QACEI,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}
+{"version":3,"sources":["../../../src/uploads/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { getFileHandler } from './getFile.js'\nimport { pasteURLHandler } from './pasteURL.js'\n\nexport const uploadCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: pasteURLHandler,\n    method: 'get',\n    path: '/paste-url/:id?',\n  },\n  {\n    handler: getFileHandler,\n    method: 'get',\n    path: '/file/:filename',\n  },\n])\n"],"names":["wrapInternalEndpoints","getFileHandler","pasteURLHandler","uploadCollectionEndpoints","handler","method","path"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,eAAe,QAAQ,gBAAe;AAE/C,OAAO,MAAMC,4BAAwCH,sBAAsB;IACzE;QACEI,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}

package/dist/uploads/endpoints/pasteURL.d.ts

@@ -0,0 +1,3 @@
+import type { PayloadHandler } from '../../config/types.js';
+export declare const pasteURLHandler: PayloadHandler;
+//# sourceMappingURL=pasteURL.d.ts.map

package/dist/uploads/endpoints/pasteURL.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pasteURL.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/pasteURL.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAgB3D,eAAO,MAAM,eAAe,EAAE,cAmE7B,CAAA"}

package/dist/uploads/endpoints/{getFileFromURL.js → pasteURL.js}

@@ -2,14 +2,14 @@ import { executeAccess } from '../../auth/executeAccess.js';
 import { APIError } from '../../errors/APIError.js';
 import { Forbidden } from '../../errors/Forbidden.js';
 import { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js';
-import { isURLAllowed } from '../../utilities/isURLAllowed.js';
 import { sanitizeFilename } from '../../utilities/sanitizeFilename.js';
-import { safeFetch } from '../safeFetch.js';
+import { fetchWithRedirects } from '../fetchWithRedirects.js';
+import { validateUploadURL } from '../validateUploadURL.js';
 // If doc id is provided, it means we are updating the doc
 // /:collectionSlug/paste-url/:doc-id?src=:fileUrl
 // If doc id is not provided, it means we are creating a new doc
 // /:collectionSlug/paste-url?src=:fileUrl
-export const getFileFromURLHandler = async (req)=>{
+export const pasteURLHandler = async (req)=>{
     const { id, collection } = getRequestCollectionWithID(req, {
         optionalID: true
     });
@@ -17,12 +17,10 @@ export const getFileFromURLHandler = async (req)=>{
         throw new Forbidden(req.t);
     }
     const config = collection?.config;
-    if (!config.upload?.pasteURL) {
-        throw new APIError('Pasting from URL is not enabled for this collection.', 400);
-    }
     if (id) {
         // updating doc
         const accessResult = await executeAccess({
+            slug: config.slug,
             req
         }, config.access.update);
         if (!accessResult) {
@@ -31,6 +29,7 @@ export const getFileFromURLHandler = async (req)=>{
     } else {
         // creating doc
         const accessResult = await executeAccess({
+            slug: config.slug,
             req
         }, config.access?.create);
         if (!accessResult) {
@@ -45,57 +44,22 @@ export const getFileFromURLHandler = async (req)=>{
     if (!src || typeof src !== 'string') {
         throw new APIError('A valid URL string is required.', 400);
     }
-    const hasAllowList = typeof config.upload.pasteURL === 'object' && Array.isArray(config.upload.pasteURL.allowList);
-    let fileURL;
-    try {
-        fileURL = new URL(src).href;
-    } catch  {
-        throw new APIError('A valid URL string is required.', 400);
-    }
-    if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {
-        throw new APIError('The provided URL is not allowed.', 400);
-    }
-    let redirectCount = 0;
-    const maxRedirects = 3;
-    let response;
-    while(true){
-        if (hasAllowList && isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {
-            // Allow-listed URLs bypass SSRF filtering (e.g. internal/localhost CDNs)
-            response = await fetch(fileURL, {
-                headers: {
-                    'Accept-Encoding': 'identity'
-                },
-                redirect: 'manual',
-                signal: AbortSignal.timeout(30_000)
-            });
-        } else {
-            response = await safeFetch(fileURL, {
-                headers: {
-                    'Accept-Encoding': 'identity'
-                },
-                signal: AbortSignal.timeout(30_000)
-            });
-        }
-        if (response.status >= 300 && response.status < 400) {
-            redirectCount++;
-            if (redirectCount > maxRedirects) {
-                throw new APIError('Too many redirects.', 403);
-            }
-            const location = response.headers.get('location');
-            if (location) {
-                fileURL = new URL(location, fileURL).href;
-                if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {
-                    throw new APIError('The provided URL is not allowed.', 400);
-                }
-                continue;
-            }
-        }
-        break;
-    }
+    const url = validateUploadURL({
+        uploadConfig: config.upload,
+        url: src
+    });
+    const { response, url: resolvedURL } = await fetchWithRedirects({
+        allowList: config.upload.pasteURL ? config.upload.pasteURL.allowList : undefined,
+        headers: {
+            'Accept-Encoding': 'identity'
+        },
+        timeout: 30_000,
+        url: url.href
+    });
     if (!response.ok) {
         throw new APIError('Failed to fetch the file from the provided URL.', response.status);
     }
-    const rawFileName = decodeURIComponent(new URL(fileURL).pathname.split('/').pop() || '');
+    const rawFileName = decodeURIComponent(new URL(resolvedURL).pathname.split('/').pop() || '');
     const safeFileName = sanitizeFilename(rawFileName);
     const encodedFileName = encodeURIComponent(safeFileName).replace(/['()]/g, (c)=>`%${c.charCodeAt(0).toString(16).toUpperCase()}`);
     // Strip quotes, backslashes, and control chars from the ASCII fallback
@@ -113,4 +77,4 @@ export const getFileFromURLHandler = async (req)=>{
     });
 };
 
-//# sourceMappingURL=getFileFromURL.js.map
+//# sourceMappingURL=pasteURL.js.map

package/dist/uploads/endpoints/pasteURL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/endpoints/pasteURL.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { APIError } from '../../errors/APIError.js'\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { sanitizeFilename } from '../../utilities/sanitizeFilename.js'\nimport { fetchWithRedirects } from '../fetchWithRedirects.js'\nimport { validateUploadURL } from '../validateUploadURL.js'\n\n// If doc id is provided, it means we are updating the doc\n// /:collectionSlug/paste-url/:doc-id?src=:fileUrl\n\n// If doc id is not provided, it means we are creating a new doc\n// /:collectionSlug/paste-url?src=:fileUrl\n\nexport const pasteURLHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })\n\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const config = collection?.config\n\n  if (id) {\n    // updating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access.update)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  } else {\n    // creating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access?.create)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  if (!req.url) {\n    throw new APIError('Request URL is missing.', 400)\n  }\n\n  const { searchParams } = new URL(req.url)\n  const src = searchParams.get('src')\n\n  if (!src || typeof src !== 'string') {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  const url = validateUploadURL({ uploadConfig: config.upload, url: src })\n\n  const { response, url: resolvedURL } = await fetchWithRedirects({\n    allowList: config.upload.pasteURL ? config.upload.pasteURL.allowList : undefined,\n    headers: { 'Accept-Encoding': 'identity' },\n    timeout: 30_000,\n    url: url.href,\n  })\n\n  if (!response.ok) {\n    throw new APIError('Failed to fetch the file from the provided URL.', response.status)\n  }\n\n  const rawFileName = decodeURIComponent(new URL(resolvedURL).pathname.split('/').pop() || '')\n  const safeFileName = sanitizeFilename(rawFileName)\n  const encodedFileName = encodeURIComponent(safeFileName).replace(\n    /['()]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n  // Strip quotes, backslashes, and control chars from the ASCII fallback\n  const asciiFileName = safeFileName.replace(/[\"\\\\\\r\\n]/g, '_')\n\n  const headers: Record<string, string> = {\n    'Content-Disposition': `attachment; filename=\"${asciiFileName}\"; filename*=UTF-8''${encodedFileName}`,\n    'Content-Type': response.headers.get('content-type') || 'application/octet-stream',\n  }\n\n  const contentLength = response.headers.get('content-length')\n  if (contentLength) {\n    headers['Content-Length'] = contentLength\n  }\n\n  return new Response(response.body, { headers })\n}\n"],"names":["executeAccess","APIError","Forbidden","getRequestCollectionWithID","sanitizeFilename","fetchWithRedirects","validateUploadURL","pasteURLHandler","req","id","collection","optionalID","user","t","config","accessResult","slug","access","update","create","url","searchParams","URL","src","get","uploadConfig","upload","response","resolvedURL","allowList","pasteURL","undefined","headers","timeout","href","ok","status","rawFileName","decodeURIComponent","pathname","split","pop","safeFileName","encodedFileName","encodeURIComponent","replace","c","charCodeAt","toString","toUpperCase","asciiFileName","contentLength","Response","body"],"mappings":"AAEA,SAASA,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,SAAS,QAAQ,4BAA2B;AACrD,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,kBAAkB,QAAQ,2BAA0B;AAC7D,SAASC,iBAAiB,QAAQ,0BAAyB;AAE3D,0DAA0D;AAC1D,kDAAkD;AAElD,gEAAgE;AAChE,0CAA0C;AAE1C,OAAO,MAAMC,kBAAkC,OAAOC;IACpD,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGP,2BAA2BK,KAAK;QAAEG,YAAY;IAAK;IAE9E,IAAI,CAACH,IAAII,IAAI,EAAE;QACb,MAAM,IAAIV,UAAUM,IAAIK,CAAC;IAC3B;IAEA,MAAMC,SAASJ,YAAYI;IAE3B,IAAIL,IAAI;QACN,eAAe;QACf,MAAMM,eAAe,MAAMf,cAAc;YAAEgB,MAAMF,OAAOE,IAAI;YAAER;QAAI,GAAGM,OAAOG,MAAM,CAACC,MAAM;QACzF,IAAI,CAACH,cAAc;YACjB,MAAM,IAAIb,UAAUM,IAAIK,CAAC;QAC3B;IACF,OAAO;QACL,eAAe;QACf,MAAME,eAAe,MAAMf,cAAc;YAAEgB,MAAMF,OAAOE,IAAI;YAAER;QAAI,GAAGM,OAAOG,MAAM,EAAEE;QACpF,IAAI,CAACJ,cAAc;YACjB,MAAM,IAAIb,UAAUM,IAAIK,CAAC;QAC3B;IACF;IAEA,IAAI,CAACL,IAAIY,GAAG,EAAE;QACZ,MAAM,IAAInB,SAAS,2BAA2B;IAChD;IAEA,MAAM,EAAEoB,YAAY,EAAE,GAAG,IAAIC,IAAId,IAAIY,GAAG;IACxC,MAAMG,MAAMF,aAAaG,GAAG,CAAC;IAE7B,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU;QACnC,MAAM,IAAItB,SAAS,mCAAmC;IACxD;IAEA,MAAMmB,MAAMd,kBAAkB;QAAEmB,cAAcX,OAAOY,MAAM;QAAEN,KAAKG;IAAI;IAEtE,MAAM,EAAEI,QAAQ,EAAEP,KAAKQ,WAAW,EAAE,GAAG,MAAMvB,mBAAmB;QAC9DwB,WAAWf,OAAOY,MAAM,CAACI,QAAQ,GAAGhB,OAAOY,MAAM,CAACI,QAAQ,CAACD,SAAS,GAAGE;QACvEC,SAAS;YAAE,mBAAmB;QAAW;QACzCC,SAAS;QACTb,KAAKA,IAAIc,IAAI;IACf;IAEA,IAAI,CAACP,SAASQ,EAAE,EAAE;QAChB,MAAM,IAAIlC,SAAS,mDAAmD0B,SAASS,MAAM;IACvF;IAEA,MAAMC,cAAcC,mBAAmB,IAAIhB,IAAIM,aAAaW,QAAQ,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;IACzF,MAAMC,eAAetC,iBAAiBiC;IACtC,MAAMM,kBAAkBC,mBAAmBF,cAAcG,OAAO,CAC9D,UACA,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAEC,UAAU,CAAC,GAAGC,QAAQ,CAAC,IAAIC,WAAW,IAAI;IAEzD,uEAAuE;IACvE,MAAMC,gBAAgBR,aAAaG,OAAO,CAAC,cAAc;IAEzD,MAAMb,UAAkC;QACtC,uBAAuB,CAAC,sBAAsB,EAAEkB,cAAc,oBAAoB,EAAEP,iBAAiB;QACrG,gBAAgBhB,SAASK,OAAO,CAACR,GAAG,CAAC,mBAAmB;IAC1D;IAEA,MAAM2B,gBAAgBxB,SAASK,OAAO,CAACR,GAAG,CAAC;IAC3C,IAAI2B,eAAe;QACjBnB,OAAO,CAAC,iBAAiB,GAAGmB;IAC9B;IAEA,OAAO,IAAIC,SAASzB,SAAS0B,IAAI,EAAE;QAAErB;IAAQ;AAC/C,EAAC"}

package/dist/uploads/endpoints/uploadInstructions.d.ts

@@ -0,0 +1,15 @@
+import type { Endpoint } from '../../config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+import type { UploadInstructions, UploadInstructionsRequest } from '../types.js';
+export declare const getUploadInstructions: ({ overrideAccess, req, ...upload }: {
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+} & UploadInstructionsRequest) => Promise<UploadInstructions>;
+export declare const uploadInstructionsEndpoint: Endpoint;
+/**
+ * Stores or removes temporary files when no adapter-specific upload instructions are available.
+ * PUT keeps the file until it is used in a document request.
+ * DELETE removes a file the client no longer needs.
+ */
+export declare const stagedUploadEndpoints: Endpoint[];
+//# sourceMappingURL=uploadInstructions.d.ts.map

package/dist/uploads/endpoints/uploadInstructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadInstructions.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/uploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AA+BhF,eAAO,MAAM,qBAAqB,uCAI/B;IACD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,yBAAyB,KAAG,OAAO,CAAC,kBAAkB,CA0CzD,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,QAwBxC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,EAW3C,CAAA"}

package/dist/uploads/endpoints/uploadInstructions.js

@@ -0,0 +1,87 @@
+import { APIError } from '../../errors/index.js';
+import { assertClientUploadAccess } from '../assertClientUploadAccess.js';
+import { checkFileMetadataRestrictions } from '../checkFileRestrictions.js';
+import { uploadRequiresServerValidation } from '../getFileTypeIdentity.js';
+import { deleteStagedFile, generateStagedUploadInstructions, uploadStagedFile } from '../stagedUpload.js';
+const bytesToMB = (bytes)=>bytes / 1024 / 1024;
+const isUploadInstructionsRequest = (upload)=>typeof upload === 'object' && upload !== null && 'collectionSlug' in upload && typeof upload.collectionSlug === 'string' && (!('docPrefix' in upload) || upload.docPrefix === undefined || typeof upload.docPrefix === 'string') && 'filename' in upload && typeof upload.filename === 'string' && 'filesize' in upload && typeof upload.filesize === 'number' && Number.isSafeInteger(upload.filesize) && upload.filesize >= 0 && 'mimeType' in upload && typeof upload.mimeType === 'string';
+export const getUploadInstructions = async ({ overrideAccess = false, req, ...upload })=>{
+    const collection = req.payload.collections[upload.collectionSlug];
+    const uploadConfig = collection?.config?.upload;
+    if (!overrideAccess) {
+        await assertClientUploadAccess({
+            collectionSlug: upload.collectionSlug,
+            req
+        });
+    }
+    if (!uploadConfig) {
+        throw new APIError(`Upload collection ${upload.collectionSlug} was not found`, 400);
+    }
+    const filesizeLimit = req.payload.config.upload.limits?.fileSize;
+    if (filesizeLimit && upload.filesize > filesizeLimit) {
+        throw new APIError(`Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit).toFixed(2)}MB, got: ${bytesToMB(upload.filesize).toFixed(2)}MB`, 400);
+    }
+    const uploadInstructions = uploadConfig.uploadInstructions;
+    const requiresServerValidation = uploadRequiresServerValidation({
+        allowRestrictedFileTypes: uploadConfig.allowRestrictedFileTypes,
+        filename: upload.filename,
+        mimeType: upload.mimeType
+    });
+    await checkFileMetadataRestrictions({
+        collection: collection.config,
+        filename: upload.filename,
+        filesize: upload.filesize,
+        mimeType: upload.mimeType,
+        req
+    });
+    if (uploadInstructions && requiresServerValidation) {
+        throw new APIError('SVG and XML files must be uploaded with the document through Payload.', 400);
+    }
+    return uploadInstructions ? uploadInstructions.generate({
+        ...upload,
+        overrideAccess,
+        req
+    }) : generateStagedUploadInstructions({
+        ...upload,
+        req
+    });
+};
+export const uploadInstructionsEndpoint = {
+    handler: async (req)=>{
+        if (!req.json) {
+            throw new APIError('Content-Type expected to be application/json', 400);
+        }
+        const upload = await req.json();
+        if (!isUploadInstructionsRequest(upload)) {
+            throw new APIError('Invalid upload instructions request', 400);
+        }
+        return Response.json(await getUploadInstructions({
+            collectionSlug: upload.collectionSlug,
+            docPrefix: upload.docPrefix,
+            filename: upload.filename,
+            filesize: upload.filesize,
+            mimeType: upload.mimeType,
+            req
+        }));
+    },
+    method: 'post',
+    path: '/upload-instructions'
+};
+/**
+ * Stores or removes temporary files when no adapter-specific upload instructions are available.
+ * PUT keeps the file until it is used in a document request.
+ * DELETE removes a file the client no longer needs.
+ */ export const stagedUploadEndpoints = [
+    {
+        handler: uploadStagedFile,
+        method: 'put',
+        path: '/upload-instructions/:uploadId'
+    },
+    {
+        handler: deleteStagedFile,
+        method: 'delete',
+        path: '/upload-instructions/:uploadId'
+    }
+];
+
+//# sourceMappingURL=uploadInstructions.js.map