npm - payload - Versions diffs - 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee - Mend

payload 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1826) hide show

package/dist/utilities/getEntityPermissions/populateFieldPermissions.js CHANGED Viewed

@@ -27,7 +27,7 @@ target, operation, value, promises)=>{
 /**
  * Build up permissions object and run access functions for each field of an entity
  * This function is synchronous and collects all async work into the promises array
- */ export const populateFieldPermissions = ({ id, blockReferencesPermissions, data, fields, operations, parentPermissionsObject, permissionsObject, promises, req })=>{
+ */ export const populateFieldPermissions = ({ id, blockReferencesPermissions, collection, data, fields, global, operations, parentPermissionsObject, permissionsObject, promises, req })=>{
     for (const field of fields){
         // Set up permissions for all operations
         for (const operation of operations){
@@ -42,11 +42,18 @@ target, operation, value, promises)=>{
                 }
                 const fieldPermissions = permissionsObject[field.name];
                 if ('access' in field && field.access && typeof field.access[operation] === 'function') {
-                    const accessResult = field.access[operation]({
+                    const accessResult = field.access[operation](collection ? {
                         id,
+                        collection,
                         data,
                         doc: data,
                         req
+                    } : {
+                        id,
+                        data,
+                        doc: data,
+                        global: global,
+                        req
                     });
                     // Handle both sync and async access results
                     if (isThenable(accessResult)) {
@@ -71,8 +78,10 @@ target, operation, value, promises)=>{
                 populateFieldPermissions({
                     id,
                     blockReferencesPermissions,
+                    collection,
                     data,
                     fields: field.fields,
+                    global,
                     operations,
                     parentPermissionsObject: fieldPermissions,
                     permissionsObject: fieldPermissions.fields,
@@ -145,8 +154,10 @@ target, operation, value, promises)=>{
                     populateFieldPermissions({
                         id,
                         blockReferencesPermissions,
+                        collection,
                         data,
                         fields: block.fields,
+                        global,
                         operations,
                         parentPermissionsObject: blockPermission,
                         permissionsObject: blockPermission.fields,
@@ -161,8 +172,10 @@ target, operation, value, promises)=>{
             // Field does not have a name => same parentPermissionsObject
             populateFieldPermissions({
                 id,
+                collection,
                 data,
                 fields: field.fields,
+                global,
                 operations,
                 // Field does not have a name here => use parent permissions object
                 blockReferencesPermissions,
@@ -205,8 +218,10 @@ target, operation, value, promises)=>{
                     populateFieldPermissions({
                         id,
                         blockReferencesPermissions,
+                        collection,
                         data,
                         fields: tab.fields,
+                        global,
                         operations,
                         parentPermissionsObject: tabPermissions,
                         permissionsObject: tabPermissions.fields,
@@ -217,8 +232,10 @@ target, operation, value, promises)=>{
                     // Tab does not have a name => same parentPermissionsObject
                     populateFieldPermissions({
                         id,
+                        collection,
                         data,
                         fields: tab.fields,
+                        global,
                         operations,
                         // Tab does not have a name here => use parent permissions object
                         blockReferencesPermissions,

package/dist/utilities/getEntityPermissions/populateFieldPermissions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/utilities/getEntityPermissions/populateFieldPermissions.ts"],"sourcesContent":["import type {\n BlockPermissions,\n BlocksPermissions,\n CollectionPermission,\n FieldPermissions,\n FieldsPermissions,\n GlobalPermission,\n Permission,\n} from '../../auth/types.js'\nimport type { DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest } from '../../types/index.js'\nimport type { BlockReferencesPermissions } from './getEntityPermissions.js'\n\nimport { type Field, tabHasName } from '../../fields/config/types.js'\n\nconst isThenable = (value: unknown): value is Promise<unknown> =>\n value != null && typeof (value as { then?: unknown }).then === 'function'\n\n/*\n Helper to set a permission value that might be a promise.\n * If it's a promise, creates a chained promise that resolves to update the target,\n * stores the promise temporarily, and adds it to the promises array for later resolution.\n /\nconst setPermission = (\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n target: any,\n operation: AllOperations,\n value: boolean \| Promise<boolean> \| undefined,\n promises: Promise<void>[],\n): void => {\n if (isThenable(value)) {\n // Create a single permission object that will be mutated in place\n // This ensures all references (including cached blocks) see the resolved value\n const permissionObj = { permission: value as any }\n target[operation] = permissionObj\n\n const permissionPromise = value.then((result) => {\n // Mutate the permission property in place so all references see the update\n permissionObj.permission = result\n })\n\n promises.push(permissionPromise)\n } else {\n target[operation] = { permission: value }\n }\n}\n\n/\n Build up permissions object and run access functions for each field of an entity\n * This function is synchronous and collects all async work into the promises array\n /\nexport const populateFieldPermissions = ({\n id,\n blockReferencesPermissions,\n data,\n fields,\n operations,\n parentPermissionsObject,\n permissionsObject,\n promises,\n req,\n}: {\n blockReferencesPermissions: BlockReferencesPermissions\n data: JsonObject \| undefined\n fields: Field[]\n id?: DefaultDocumentIDType\n /\n Operations to check access for\n */\n operations: AllOperations[]\n parentPermissionsObject: CollectionPermission \| FieldPermissions \| GlobalPermission\n permissionsObject: FieldsPermissions\n promises: Promise<void>[]\n req: PayloadRequest\n}): void => {\n for (const field of fields) {\n // Set up permissions for all operations\n for (const operation of operations) {\n const parentPermissionForOperation = (\n parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n )?.permission\n\n // Fields don't have all operations of a collection\n if (operation === 'delete' \|\| operation === 'readVersions' \|\| operation === 'unlock') {\n continue\n }\n\n if ('name' in field && field.name) {\n if (!permissionsObject[field.name]) {\n permissionsObject[field.name] = {} as FieldPermissions\n }\n const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n if ('access' in field && field.access && typeof field.access[operation] === 'function') {\n const accessResult = field.access[operation]({\n id,\n data,\n doc: data,\n req,\n // We cannot include siblingData or blockData here, as we do not have siblingData/blockData available once we reach block or array\n // rows, as we're calculating schema permissions, which do not include individual rows.\n // For consistency, it's thus better to never include the siblingData and blockData\n })\n\n // Handle both sync and async access results\n if (isThenable(accessResult)) {\n const booleanPromise = accessResult.then((result) => Boolean(result))\n setPermission(fieldPermissions, operation, booleanPromise, promises)\n } else {\n setPermission(fieldPermissions, operation, Boolean(accessResult), promises)\n }\n } else {\n // Inherit from parent (which might be a promise)\n setPermission(fieldPermissions, operation, parentPermissionForOperation, promises)\n }\n }\n }\n\n // Handle named fields with nested content\n if ('name' in field && field.name) {\n const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n if ('fields' in field && field.fields) {\n if (!fieldPermissions.fields) {\n fieldPermissions.fields = {}\n }\n\n populateFieldPermissions({\n id,\n blockReferencesPermissions,\n data,\n fields: field.fields,\n operations,\n parentPermissionsObject: fieldPermissions,\n permissionsObject: fieldPermissions.fields,\n promises,\n req,\n })\n }\n\n if ('blocks' in field && field.blocks?.length) {\n if (!fieldPermissions.blocks) {\n fieldPermissions.blocks = {}\n }\n const blocksPermissions: BlocksPermissions = fieldPermissions.blocks\n\n // Set up permissions for all operations for all blocks\n for (const operation of operations) {\n // Fields don't have all operations of a collection\n if (operation === 'delete' \|\| operation === 'readVersions' \|\| operation === 'unlock') {\n continue\n }\n\n const parentPermissionForOperation = (\n parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n )?.permission\n\n for (const _block of field.blocks) {\n const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n // Skip if block doesn't exist (invalid block reference)\n if (!block) {\n continue\n }\n\n // Handle block references - check if we've seen this block before\n if (typeof _block === 'string') {\n const blockReferencePermissions = blockReferencesPermissions[_block]\n if (blockReferencePermissions) {\n // Reference the cached permissions (may be a promise or resolved object)\n blocksPermissions[block.slug] = blockReferencePermissions as BlockPermissions\n continue\n }\n }\n\n // Initialize block permissions object if needed\n if (!blocksPermissions[block.slug]) {\n blocksPermissions[block.slug] = {} as BlockPermissions\n }\n\n const blockPermission = blocksPermissions[block.slug]!\n\n // Set permission for this operation\n if (!blockPermission[operation]) {\n const fieldPermission =\n fieldPermissions[operation]?.permission ?? parentPermissionForOperation\n\n // Inherit from field permission (which might be a promise)\n setPermission(blockPermission, operation, fieldPermission, promises)\n }\n }\n }\n\n // Process nested content for each unique block (once per block, not once per operation)\n const processedBlocks = new Set<string>()\n for (const _block of field.blocks) {\n const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n // Skip if block doesn't exist (invalid block reference)\n if (!block \|\| processedBlocks.has(block.slug)) {\n continue\n }\n processedBlocks.add(block.slug)\n\n const blockPermission = blocksPermissions[block.slug]\n if (!blockPermission) {\n continue\n }\n\n if (!blockPermission.fields) {\n blockPermission.fields = {}\n }\n\n // Handle block references with caching - store as promise that will be resolved later\n if (typeof _block === 'string' && !blockReferencesPermissions[_block]) {\n // Mark this block as being processed by storing a reference\n blockReferencesPermissions[_block] = blockPermission\n }\n\n // Recursively process block fields synchronously\n populateFieldPermissions({\n id,\n blockReferencesPermissions,\n data,\n fields: block.fields,\n operations,\n parentPermissionsObject: blockPermission,\n permissionsObject: blockPermission.fields,\n promises,\n req,\n })\n }\n }\n }\n\n // Handle unnamed group fields\n if ('fields' in field && field.fields && !('name' in field && field.name)) {\n // Field does not have a name => same parentPermissionsObject\n populateFieldPermissions({\n id,\n data,\n fields: field.fields,\n operations,\n // Field does not have a name here => use parent permissions object\n blockReferencesPermissions,\n parentPermissionsObject,\n permissionsObject,\n promises,\n req,\n })\n }\n\n // Handle tabs fields\n if (field.type === 'tabs') {\n // Process tabs for all operations\n for (const operation of operations) {\n // Fields don't have all operations of a collection\n if (operation === 'delete' \|\| operation === 'readVersions' \|\| operation === 'unlock') {\n continue\n }\n\n const parentPermissionForOperation = (\n parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n )?.permission\n\n for (const tab of field.tabs) {\n if (tabHasName(tab)) {\n if (!permissionsObject[tab.name]) {\n permissionsObject[tab.name] = { fields: {} } as FieldPermissions\n }\n\n const tabPermissions = permissionsObject[tab.name]!\n if (!tabPermissions[operation]) {\n // Inherit from parent (which might be a promise)\n setPermission(tabPermissions, operation, parentPermissionForOperation, promises)\n }\n }\n }\n }\n\n for (const tab of field.tabs) {\n if (tabHasName(tab)) {\n const tabPermissions: FieldPermissions = permissionsObject[tab.name]!\n\n if (!tabPermissions.fields) {\n tabPermissions.fields = {}\n }\n\n populateFieldPermissions({\n id,\n blockReferencesPermissions,\n data,\n fields: tab.fields,\n operations,\n parentPermissionsObject: tabPermissions,\n permissionsObject: tabPermissions.fields,\n promises,\n req,\n })\n } else {\n // Tab does not have a name => same parentPermissionsObject\n populateFieldPermissions({\n id,\n data,\n fields: tab.fields,\n operations,\n // Tab does not have a name here => use parent permissions object\n blockReferencesPermissions,\n parentPermissionsObject,\n permissionsObject,\n promises,\n req,\n })\n }\n }\n }\n }\n}\n"],"names":["tabHasName","isThenable","value","then","setPermission","target","operation","promises","permissionObj","permission","permissionPromise","result","push","populateFieldPermissions","id","blockReferencesPermissions","data","fields","operations","parentPermissionsObject","permissionsObject","req","field","parentPermissionForOperation","name","fieldPermissions","access","accessResult","doc","booleanPromise","Boolean","blocks","length","blocksPermissions","_block","block","payload","blockReferencePermissions","slug","blockPermission","fieldPermission","processedBlocks","Set","has","add","type","tab","tabs","tabPermissions"],"mappings":"AAaA,SAAqBA,UAAU,QAAQ,+BAA8B;AAErE,MAAMC,aAAa,CAACC,QAClBA,SAAS,QAAQ,OAAO,AAACA,MAA6BC,IAAI,KAAK;AAEjE;;;;CAIC,GACD,MAAMC,gBAAgB,CACpB,8DAA8D;AAC9DC,QACAC,WACAJ,OACAK;IAEA,IAAIN,WAAWC,QAAQ;QACrB,kEAAkE;QAClE,+EAA+E;QAC/E,MAAMM,gBAAgB;YAAEC,YAAYP;QAAa;QACjDG,MAAM,CAACC,UAAU,GAAGE;QAEpB,MAAME,oBAAoBR,MAAMC,IAAI,CAAC,CAACQ;YACpC,2EAA2E;YAC3EH,cAAcC,UAAU,GAAGE;QAC7B;QAEAJ,SAASK,IAAI,CAACF;IAChB,OAAO;QACLL,MAAM,CAACC,UAAU,GAAG;YAAEG,YAAYP;QAAM;IAC1C;AACF;AAEA;;;CAGC,GACD,OAAO,MAAMW,2BAA2B,CAAC,EACvCC,EAAE,EACFC,0BAA0B,EAC1BC,IAAI,EACJC,MAAM,EACNC,UAAU,EACVC,uBAAuB,EACvBC,iBAAiB,EACjBb,QAAQ,EACRc,GAAG,EAcJ;IACC,KAAK,MAAMC,SAASL,OAAQ;QAC1B,wCAAwC;QACxC,KAAK,MAAMX,aAAaY,WAAY;YAClC,MAAMK,+BACJJ,uBAAuB,CAACb,UAAkD,EACzEG;YAEH,mDAAmD;YACnD,IAAIH,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;gBACpF;YACF;YAEA,IAAI,UAAUgB,SAASA,MAAME,IAAI,EAAE;gBACjC,IAAI,CAACJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,EAAE;oBAClCJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,GAAG,CAAC;gBACnC;gBACA,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;gBAExE,IAAI,YAAYF,SAASA,MAAMI,MAAM,IAAI,OAAOJ,MAAMI,MAAM,CAACpB,UAAU,KAAK,YAAY;oBACtF,MAAMqB,eAAeL,MAAMI,MAAM,CAACpB,UAAU,CAAC;wBAC3CQ;wBACAE;wBACAY,KAAKZ;wBACLK;oBAIF;oBAEA,4CAA4C;oBAC5C,IAAIpB,WAAW0B,eAAe;wBAC5B,MAAME,iBAAiBF,aAAaxB,IAAI,CAAC,CAACQ,SAAWmB,QAAQnB;wBAC7DP,cAAcqB,kBAAkBnB,WAAWuB,gBAAgBtB;oBAC7D,OAAO;wBACLH,cAAcqB,kBAAkBnB,WAAWwB,QAAQH,eAAepB;oBACpE;gBACF,OAAO;oBACL,iDAAiD;oBACjDH,cAAcqB,kBAAkBnB,WAAWiB,8BAA8BhB;gBAC3E;YACF;QACF;QAEA,0CAA0C;QAC1C,IAAI,UAAUe,SAASA,MAAME,IAAI,EAAE;YACjC,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;YAExE,IAAI,YAAYF,SAASA,MAAML,MAAM,EAAE;gBACrC,IAAI,CAACQ,iBAAiBR,MAAM,EAAE;oBAC5BQ,iBAAiBR,MAAM,GAAG,CAAC;gBAC7B;gBAEAJ,yBAAyB;oBACvBC;oBACAC;oBACAC;oBACAC,QAAQK,MAAML,MAAM;oBACpBC;oBACAC,yBAAyBM;oBACzBL,mBAAmBK,iBAAiBR,MAAM;oBAC1CV;oBACAc;gBACF;YACF;YAEA,IAAI,YAAYC,SAASA,MAAMS,MAAM,EAAEC,QAAQ;gBAC7C,IAAI,CAACP,iBAAiBM,MAAM,EAAE;oBAC5BN,iBAAiBM,MAAM,GAAG,CAAC;gBAC7B;gBACA,MAAME,oBAAuCR,iBAAiBM,MAAM;gBAEpE,uDAAuD;gBACvD,KAAK,MAAMzB,aAAaY,WAAY;oBAClC,mDAAmD;oBACnD,IAAIZ,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;wBACpF;oBACF;oBAEA,MAAMiB,+BACJJ,uBAAuB,CAACb,UAAkD,EACzEG;oBAEH,KAAK,MAAMyB,UAAUZ,MAAMS,MAAM,CAAE;wBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;wBAExE,wDAAwD;wBACxD,IAAI,CAACC,OAAO;4BACV;wBACF;wBAEA,kEAAkE;wBAClE,IAAI,OAAOD,WAAW,UAAU;4BAC9B,MAAMG,4BAA4BtB,0BAA0B,CAACmB,OAAO;4BACpE,IAAIG,2BAA2B;gCAC7B,yEAAyE;gCACzEJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAGD;gCAChC;4BACF;wBACF;wBAEA,gDAAgD;wBAChD,IAAI,CAACJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,EAAE;4BAClCL,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAG,CAAC;wBACnC;wBAEA,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;wBAErD,oCAAoC;wBACpC,IAAI,CAACC,eAAe,CAACjC,UAAU,EAAE;4BAC/B,MAAMkC,kBACJf,gBAAgB,CAACnB,UAAU,EAAEG,cAAcc;4BAE7C,2DAA2D;4BAC3DnB,cAAcmC,iBAAiBjC,WAAWkC,iBAAiBjC;wBAC7D;oBACF;gBACF;gBAEA,wFAAwF;gBACxF,MAAMkC,kBAAkB,IAAIC;gBAC5B,KAAK,MAAMR,UAAUZ,MAAMS,MAAM,CAAE;oBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;oBAExE,wDAAwD;oBACxD,IAAI,CAACC,SAASM,gBAAgBE,GAAG,CAACR,MAAMG,IAAI,GAAG;wBAC7C;oBACF;oBACAG,gBAAgBG,GAAG,CAACT,MAAMG,IAAI;oBAE9B,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;oBACrD,IAAI,CAACC,iBAAiB;wBACpB;oBACF;oBAEA,IAAI,CAACA,gBAAgBtB,MAAM,EAAE;wBAC3BsB,gBAAgBtB,MAAM,GAAG,CAAC;oBAC5B;oBAEA,sFAAsF;oBACtF,IAAI,OAAOiB,WAAW,YAAY,CAACnB,0BAA0B,CAACmB,OAAO,EAAE;wBACrE,4DAA4D;wBAC5DnB,0BAA0B,CAACmB,OAAO,GAAGK;oBACvC;oBAEA,iDAAiD;oBACjD1B,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC,QAAQkB,MAAMlB,MAAM;wBACpBC;wBACAC,yBAAyBoB;wBACzBnB,mBAAmBmB,gBAAgBtB,MAAM;wBACzCV;wBACAc;oBACF;gBACF;YACF;QACF;QAEA,8BAA8B;QAC9B,IAAI,YAAYC,SAASA,MAAML,MAAM,IAAI,CAAE,CAAA,UAAUK,SAASA,MAAME,IAAI,AAAD,GAAI;YACzE,6DAA6D;YAC7DX,yBAAyB;gBACvBC;gBACAE;gBACAC,QAAQK,MAAML,MAAM;gBACpBC;gBACA,mEAAmE;gBACnEH;gBACAI;gBACAC;gBACAb;gBACAc;YACF;QACF;QAEA,qBAAqB;QACrB,IAAIC,MAAMuB,IAAI,KAAK,QAAQ;YACzB,kCAAkC;YAClC,KAAK,MAAMvC,aAAaY,WAAY;gBAClC,mDAAmD;gBACnD,IAAIZ,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;oBACpF;gBACF;gBAEA,MAAMiB,+BACJJ,uBAAuB,CAACb,UAAkD,EACzEG;gBAEH,KAAK,MAAMqC,OAAOxB,MAAMyB,IAAI,CAAE;oBAC5B,IAAI/C,WAAW8C,MAAM;wBACnB,IAAI,CAAC1B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,EAAE;4BAChCJ,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,GAAG;gCAAEP,QAAQ,CAAC;4BAAE;wBAC7C;wBAEA,MAAM+B,iBAAiB5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;wBAClD,IAAI,CAACwB,cAAc,CAAC1C,UAAU,EAAE;4BAC9B,iDAAiD;4BACjDF,cAAc4C,gBAAgB1C,WAAWiB,8BAA8BhB;wBACzE;oBACF;gBACF;YACF;YAEA,KAAK,MAAMuC,OAAOxB,MAAMyB,IAAI,CAAE;gBAC5B,IAAI/C,WAAW8C,MAAM;oBACnB,MAAME,iBAAmC5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;oBAEpE,IAAI,CAACwB,eAAe/B,MAAM,EAAE;wBAC1B+B,eAAe/B,MAAM,GAAG,CAAC;oBAC3B;oBAEAJ,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC,QAAQ6B,IAAI7B,MAAM;wBAClBC;wBACAC,yBAAyB6B;wBACzB5B,mBAAmB4B,eAAe/B,MAAM;wBACxCV;wBACAc;oBACF;gBACF,OAAO;oBACL,2DAA2D;oBAC3DR,yBAAyB;wBACvBC;wBACAE;wBACAC,QAAQ6B,IAAI7B,MAAM;wBAClBC;wBACA,iEAAiE;wBACjEH;wBACAI;wBACAC;wBACAb;wBACAc;oBACF;gBACF;YACF;QACF;IACF;AACF,EAAC"}
1	+ {"version":3,"sources":["../../../src/utilities/getEntityPermissions/populateFieldPermissions.ts"],"sourcesContent":["import type {\n BlockPermissions,\n BlocksPermissions,\n CollectionPermission,\n FieldPermissions,\n FieldsPermissions,\n GlobalPermission,\n Permission,\n} from '../../auth/types.js'\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest } from '../../types/index.js'\nimport type { BlockReferencesPermissions } from './getEntityPermissions.js'\n\nimport { type Field, tabHasName } from '../../fields/config/types.js'\n\nconst isThenable = (value: unknown): value is Promise<unknown> =>\n value != null && typeof (value as { then?: unknown }).then === 'function'\n\n/*\n Helper to set a permission value that might be a promise.\n * If it's a promise, creates a chained promise that resolves to update the target,\n * stores the promise temporarily, and adds it to the promises array for later resolution.\n /\nconst setPermission = (\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n target: any,\n operation: AllOperations,\n value: boolean \| Promise<boolean> \| undefined,\n promises: Promise<void>[],\n): void => {\n if (isThenable(value)) {\n // Create a single permission object that will be mutated in place\n // This ensures all references (including cached blocks) see the resolved value\n const permissionObj = { permission: value as any }\n target[operation] = permissionObj\n\n const permissionPromise = value.then((result) => {\n // Mutate the permission property in place so all references see the update\n permissionObj.permission = result\n })\n\n promises.push(permissionPromise)\n } else {\n target[operation] = { permission: value }\n }\n}\n\n/\n Build up permissions object and run access functions for each field of an entity\n * This function is synchronous and collects all async work into the promises array\n /\nexport const populateFieldPermissions = ({\n id,\n blockReferencesPermissions,\n collection,\n data,\n fields,\n global,\n operations,\n parentPermissionsObject,\n permissionsObject,\n promises,\n req,\n}: {\n blockReferencesPermissions: BlockReferencesPermissions\n /* The collection which the fields belong to. If the fields belong to a global, this will be null. /\n collection: null \| SanitizedCollectionConfig\n data: JsonObject \| undefined\n fields: Field[]\n /* The global which the fields belong to. If the fields belong to a collection, this will be null. /\n global: null \| SanitizedGlobalConfig\n id?: DefaultDocumentIDType\n /\n Operations to check access for\n */\n operations: AllOperations[]\n parentPermissionsObject: CollectionPermission \| FieldPermissions \| GlobalPermission\n permissionsObject: FieldsPermissions\n promises: Promise<void>[]\n req: PayloadRequest\n}): void => {\n for (const field of fields) {\n // Set up permissions for all operations\n for (const operation of operations) {\n const parentPermissionForOperation = (\n parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n )?.permission\n\n // Fields don't have all operations of a collection\n if (operation === 'delete' \|\| operation === 'readVersions' \|\| operation === 'unlock') {\n continue\n }\n\n if ('name' in field && field.name) {\n if (!permissionsObject[field.name]) {\n permissionsObject[field.name] = {} as FieldPermissions\n }\n const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n if ('access' in field && field.access && typeof field.access[operation] === 'function') {\n const accessResult = field.access[operation](\n collection\n ? {\n id,\n collection,\n data,\n doc: data,\n req,\n // We cannot include siblingData or blockData here, as we do not have siblingData/blockData available once we reach block or array\n // rows, as we're calculating schema permissions, which do not include individual rows.\n // For consistency, it's thus better to never include the siblingData and blockData\n }\n : {\n id,\n data,\n doc: data,\n global: global!,\n req,\n // We cannot include siblingData or blockData here, as we do not have siblingData/blockData available once we reach block or array\n // rows, as we're calculating schema permissions, which do not include individual rows.\n // For consistency, it's thus better to never include the siblingData and blockData\n },\n )\n\n // Handle both sync and async access results\n if (isThenable(accessResult)) {\n const booleanPromise = accessResult.then((result) => Boolean(result))\n setPermission(fieldPermissions, operation, booleanPromise, promises)\n } else {\n setPermission(fieldPermissions, operation, Boolean(accessResult), promises)\n }\n } else {\n // Inherit from parent (which might be a promise)\n setPermission(fieldPermissions, operation, parentPermissionForOperation, promises)\n }\n }\n }\n\n // Handle named fields with nested content\n if ('name' in field && field.name) {\n const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n if ('fields' in field && field.fields) {\n if (!fieldPermissions.fields) {\n fieldPermissions.fields = {}\n }\n\n populateFieldPermissions({\n id,\n blockReferencesPermissions,\n collection,\n data,\n fields: field.fields,\n global,\n operations,\n parentPermissionsObject: fieldPermissions,\n permissionsObject: fieldPermissions.fields,\n promises,\n req,\n })\n }\n\n if ('blocks' in field && field.blocks?.length) {\n if (!fieldPermissions.blocks) {\n fieldPermissions.blocks = {}\n }\n const blocksPermissions: BlocksPermissions = fieldPermissions.blocks\n\n // Set up permissions for all operations for all blocks\n for (const operation of operations) {\n // Fields don't have all operations of a collection\n if (operation === 'delete' \|\| operation === 'readVersions' \|\| operation === 'unlock') {\n continue\n }\n\n const parentPermissionForOperation = (\n parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n )?.permission\n\n for (const _block of field.blocks) {\n const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n // Skip if block doesn't exist (invalid block reference)\n if (!block) {\n continue\n }\n\n // Handle block references - check if we've seen this block before\n if (typeof _block === 'string') {\n const blockReferencePermissions = blockReferencesPermissions[_block]\n if (blockReferencePermissions) {\n // Reference the cached permissions (may be a promise or resolved object)\n blocksPermissions[block.slug] = blockReferencePermissions as BlockPermissions\n continue\n }\n }\n\n // Initialize block permissions object if needed\n if (!blocksPermissions[block.slug]) {\n blocksPermissions[block.slug] = {} as BlockPermissions\n }\n\n const blockPermission = blocksPermissions[block.slug]!\n\n // Set permission for this operation\n if (!blockPermission[operation]) {\n const fieldPermission =\n fieldPermissions[operation]?.permission ?? parentPermissionForOperation\n\n // Inherit from field permission (which might be a promise)\n setPermission(blockPermission, operation, fieldPermission, promises)\n }\n }\n }\n\n // Process nested content for each unique block (once per block, not once per operation)\n const processedBlocks = new Set<string>()\n for (const _block of field.blocks) {\n const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n // Skip if block doesn't exist (invalid block reference)\n if (!block \|\| processedBlocks.has(block.slug)) {\n continue\n }\n processedBlocks.add(block.slug)\n\n const blockPermission = blocksPermissions[block.slug]\n if (!blockPermission) {\n continue\n }\n\n if (!blockPermission.fields) {\n blockPermission.fields = {}\n }\n\n // Handle block references with caching - store as promise that will be resolved later\n if (typeof _block === 'string' && !blockReferencesPermissions[_block]) {\n // Mark this block as being processed by storing a reference\n blockReferencesPermissions[_block] = blockPermission\n }\n\n // Recursively process block fields synchronously\n populateFieldPermissions({\n id,\n blockReferencesPermissions,\n collection,\n data,\n fields: block.fields,\n global,\n operations,\n parentPermissionsObject: blockPermission,\n permissionsObject: blockPermission.fields,\n promises,\n req,\n })\n }\n }\n }\n\n // Handle unnamed group fields\n if ('fields' in field && field.fields && !('name' in field && field.name)) {\n // Field does not have a name => same parentPermissionsObject\n populateFieldPermissions({\n id,\n collection,\n data,\n fields: field.fields,\n global,\n operations,\n // Field does not have a name here => use parent permissions object\n blockReferencesPermissions,\n parentPermissionsObject,\n permissionsObject,\n promises,\n req,\n })\n }\n\n // Handle tabs fields\n if (field.type === 'tabs') {\n // Process tabs for all operations\n for (const operation of operations) {\n // Fields don't have all operations of a collection\n if (operation === 'delete' \|\| operation === 'readVersions' \|\| operation === 'unlock') {\n continue\n }\n\n const parentPermissionForOperation = (\n parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n )?.permission\n\n for (const tab of field.tabs) {\n if (tabHasName(tab)) {\n if (!permissionsObject[tab.name]) {\n permissionsObject[tab.name] = { fields: {} } as FieldPermissions\n }\n\n const tabPermissions = permissionsObject[tab.name]!\n if (!tabPermissions[operation]) {\n // Inherit from parent (which might be a promise)\n setPermission(tabPermissions, operation, parentPermissionForOperation, promises)\n }\n }\n }\n }\n\n for (const tab of field.tabs) {\n if (tabHasName(tab)) {\n const tabPermissions: FieldPermissions = permissionsObject[tab.name]!\n\n if (!tabPermissions.fields) {\n tabPermissions.fields = {}\n }\n\n populateFieldPermissions({\n id,\n blockReferencesPermissions,\n collection,\n data,\n fields: tab.fields,\n global,\n operations,\n parentPermissionsObject: tabPermissions,\n permissionsObject: tabPermissions.fields,\n promises,\n req,\n })\n } else {\n // Tab does not have a name => same parentPermissionsObject\n populateFieldPermissions({\n id,\n collection,\n data,\n fields: tab.fields,\n global,\n operations,\n // Tab does not have a name here => use parent permissions object\n blockReferencesPermissions,\n parentPermissionsObject,\n permissionsObject,\n promises,\n req,\n })\n }\n }\n }\n }\n}\n"],"names":["tabHasName","isThenable","value","then","setPermission","target","operation","promises","permissionObj","permission","permissionPromise","result","push","populateFieldPermissions","id","blockReferencesPermissions","collection","data","fields","global","operations","parentPermissionsObject","permissionsObject","req","field","parentPermissionForOperation","name","fieldPermissions","access","accessResult","doc","booleanPromise","Boolean","blocks","length","blocksPermissions","_block","block","payload","blockReferencePermissions","slug","blockPermission","fieldPermission","processedBlocks","Set","has","add","type","tab","tabs","tabPermissions"],"mappings":"AAeA,SAAqBA,UAAU,QAAQ,+BAA8B;AAErE,MAAMC,aAAa,CAACC,QAClBA,SAAS,QAAQ,OAAO,AAACA,MAA6BC,IAAI,KAAK;AAEjE;;;;CAIC,GACD,MAAMC,gBAAgB,CACpB,8DAA8D;AAC9DC,QACAC,WACAJ,OACAK;IAEA,IAAIN,WAAWC,QAAQ;QACrB,kEAAkE;QAClE,+EAA+E;QAC/E,MAAMM,gBAAgB;YAAEC,YAAYP;QAAa;QACjDG,MAAM,CAACC,UAAU,GAAGE;QAEpB,MAAME,oBAAoBR,MAAMC,IAAI,CAAC,CAACQ;YACpC,2EAA2E;YAC3EH,cAAcC,UAAU,GAAGE;QAC7B;QAEAJ,SAASK,IAAI,CAACF;IAChB,OAAO;QACLL,MAAM,CAACC,UAAU,GAAG;YAAEG,YAAYP;QAAM;IAC1C;AACF;AAEA;;;CAGC,GACD,OAAO,MAAMW,2BAA2B,CAAC,EACvCC,EAAE,EACFC,0BAA0B,EAC1BC,UAAU,EACVC,IAAI,EACJC,MAAM,EACNC,MAAM,EACNC,UAAU,EACVC,uBAAuB,EACvBC,iBAAiB,EACjBf,QAAQ,EACRgB,GAAG,EAkBJ;IACC,KAAK,MAAMC,SAASN,OAAQ;QAC1B,wCAAwC;QACxC,KAAK,MAAMZ,aAAac,WAAY;YAClC,MAAMK,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;YAEH,mDAAmD;YACnD,IAAIH,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;gBACpF;YACF;YAEA,IAAI,UAAUkB,SAASA,MAAME,IAAI,EAAE;gBACjC,IAAI,CAACJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,EAAE;oBAClCJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,GAAG,CAAC;gBACnC;gBACA,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;gBAExE,IAAI,YAAYF,SAASA,MAAMI,MAAM,IAAI,OAAOJ,MAAMI,MAAM,CAACtB,UAAU,KAAK,YAAY;oBACtF,MAAMuB,eAAeL,MAAMI,MAAM,CAACtB,UAAU,CAC1CU,aACI;wBACEF;wBACAE;wBACAC;wBACAa,KAAKb;wBACLM;oBAIF,IACA;wBACET;wBACAG;wBACAa,KAAKb;wBACLE,QAAQA;wBACRI;oBAIF;oBAGN,4CAA4C;oBAC5C,IAAItB,WAAW4B,eAAe;wBAC5B,MAAME,iBAAiBF,aAAa1B,IAAI,CAAC,CAACQ,SAAWqB,QAAQrB;wBAC7DP,cAAcuB,kBAAkBrB,WAAWyB,gBAAgBxB;oBAC7D,OAAO;wBACLH,cAAcuB,kBAAkBrB,WAAW0B,QAAQH,eAAetB;oBACpE;gBACF,OAAO;oBACL,iDAAiD;oBACjDH,cAAcuB,kBAAkBrB,WAAWmB,8BAA8BlB;gBAC3E;YACF;QACF;QAEA,0CAA0C;QAC1C,IAAI,UAAUiB,SAASA,MAAME,IAAI,EAAE;YACjC,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;YAExE,IAAI,YAAYF,SAASA,MAAMN,MAAM,EAAE;gBACrC,IAAI,CAACS,iBAAiBT,MAAM,EAAE;oBAC5BS,iBAAiBT,MAAM,GAAG,CAAC;gBAC7B;gBAEAL,yBAAyB;oBACvBC;oBACAC;oBACAC;oBACAC;oBACAC,QAAQM,MAAMN,MAAM;oBACpBC;oBACAC;oBACAC,yBAAyBM;oBACzBL,mBAAmBK,iBAAiBT,MAAM;oBAC1CX;oBACAgB;gBACF;YACF;YAEA,IAAI,YAAYC,SAASA,MAAMS,MAAM,EAAEC,QAAQ;gBAC7C,IAAI,CAACP,iBAAiBM,MAAM,EAAE;oBAC5BN,iBAAiBM,MAAM,GAAG,CAAC;gBAC7B;gBACA,MAAME,oBAAuCR,iBAAiBM,MAAM;gBAEpE,uDAAuD;gBACvD,KAAK,MAAM3B,aAAac,WAAY;oBAClC,mDAAmD;oBACnD,IAAId,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;wBACpF;oBACF;oBAEA,MAAMmB,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;oBAEH,KAAK,MAAM2B,UAAUZ,MAAMS,MAAM,CAAE;wBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;wBAExE,wDAAwD;wBACxD,IAAI,CAACC,OAAO;4BACV;wBACF;wBAEA,kEAAkE;wBAClE,IAAI,OAAOD,WAAW,UAAU;4BAC9B,MAAMG,4BAA4BxB,0BAA0B,CAACqB,OAAO;4BACpE,IAAIG,2BAA2B;gCAC7B,yEAAyE;gCACzEJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAGD;gCAChC;4BACF;wBACF;wBAEA,gDAAgD;wBAChD,IAAI,CAACJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,EAAE;4BAClCL,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAG,CAAC;wBACnC;wBAEA,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;wBAErD,oCAAoC;wBACpC,IAAI,CAACC,eAAe,CAACnC,UAAU,EAAE;4BAC/B,MAAMoC,kBACJf,gBAAgB,CAACrB,UAAU,EAAEG,cAAcgB;4BAE7C,2DAA2D;4BAC3DrB,cAAcqC,iBAAiBnC,WAAWoC,iBAAiBnC;wBAC7D;oBACF;gBACF;gBAEA,wFAAwF;gBACxF,MAAMoC,kBAAkB,IAAIC;gBAC5B,KAAK,MAAMR,UAAUZ,MAAMS,MAAM,CAAE;oBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;oBAExE,wDAAwD;oBACxD,IAAI,CAACC,SAASM,gBAAgBE,GAAG,CAACR,MAAMG,IAAI,GAAG;wBAC7C;oBACF;oBACAG,gBAAgBG,GAAG,CAACT,MAAMG,IAAI;oBAE9B,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;oBACrD,IAAI,CAACC,iBAAiB;wBACpB;oBACF;oBAEA,IAAI,CAACA,gBAAgBvB,MAAM,EAAE;wBAC3BuB,gBAAgBvB,MAAM,GAAG,CAAC;oBAC5B;oBAEA,sFAAsF;oBACtF,IAAI,OAAOkB,WAAW,YAAY,CAACrB,0BAA0B,CAACqB,OAAO,EAAE;wBACrE,4DAA4D;wBAC5DrB,0BAA0B,CAACqB,OAAO,GAAGK;oBACvC;oBAEA,iDAAiD;oBACjD5B,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC;wBACAC,QAAQmB,MAAMnB,MAAM;wBACpBC;wBACAC;wBACAC,yBAAyBoB;wBACzBnB,mBAAmBmB,gBAAgBvB,MAAM;wBACzCX;wBACAgB;oBACF;gBACF;YACF;QACF;QAEA,8BAA8B;QAC9B,IAAI,YAAYC,SAASA,MAAMN,MAAM,IAAI,CAAE,CAAA,UAAUM,SAASA,MAAME,IAAI,AAAD,GAAI;YACzE,6DAA6D;YAC7Db,yBAAyB;gBACvBC;gBACAE;gBACAC;gBACAC,QAAQM,MAAMN,MAAM;gBACpBC;gBACAC;gBACA,mEAAmE;gBACnEL;gBACAM;gBACAC;gBACAf;gBACAgB;YACF;QACF;QAEA,qBAAqB;QACrB,IAAIC,MAAMuB,IAAI,KAAK,QAAQ;YACzB,kCAAkC;YAClC,KAAK,MAAMzC,aAAac,WAAY;gBAClC,mDAAmD;gBACnD,IAAId,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;oBACpF;gBACF;gBAEA,MAAMmB,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;gBAEH,KAAK,MAAMuC,OAAOxB,MAAMyB,IAAI,CAAE;oBAC5B,IAAIjD,WAAWgD,MAAM;wBACnB,IAAI,CAAC1B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,EAAE;4BAChCJ,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,GAAG;gCAAER,QAAQ,CAAC;4BAAE;wBAC7C;wBAEA,MAAMgC,iBAAiB5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;wBAClD,IAAI,CAACwB,cAAc,CAAC5C,UAAU,EAAE;4BAC9B,iDAAiD;4BACjDF,cAAc8C,gBAAgB5C,WAAWmB,8BAA8BlB;wBACzE;oBACF;gBACF;YACF;YAEA,KAAK,MAAMyC,OAAOxB,MAAMyB,IAAI,CAAE;gBAC5B,IAAIjD,WAAWgD,MAAM;oBACnB,MAAME,iBAAmC5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;oBAEpE,IAAI,CAACwB,eAAehC,MAAM,EAAE;wBAC1BgC,eAAehC,MAAM,GAAG,CAAC;oBAC3B;oBAEAL,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC;wBACAC,QAAQ8B,IAAI9B,MAAM;wBAClBC;wBACAC;wBACAC,yBAAyB6B;wBACzB5B,mBAAmB4B,eAAehC,MAAM;wBACxCX;wBACAgB;oBACF;gBACF,OAAO;oBACL,2DAA2D;oBAC3DV,yBAAyB;wBACvBC;wBACAE;wBACAC;wBACAC,QAAQ8B,IAAI9B,MAAM;wBAClBC;wBACAC;wBACA,iEAAiE;wBACjEL;wBACAM;wBACAC;wBACAf;wBACAgB;oBACF;gBACF;YACF;QACF;IACF;AACF,EAAC"}

package/dist/utilities/getFieldByPath.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getFieldByPath.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldByPath.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAE/E;;;;GAIG;AACH,eAAO,MAAM,cAAc,~~GAAI,gEAM5B~~;IACD,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;CACb,KAAG;IACF,KAAK,EAAE,cAAc,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,OAAO,CAAA;CAC1B,GAAG,IA8EH,CAAA"}
1	+ {"version":3,"file":"getFieldByPath.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldByPath.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAE/E;;;;GAIG;AACH,eAAO,MAAM,cAAc,mEAMxB;IACD,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;CACb,KAAG;IACF,KAAK,EAAE,cAAc,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,OAAO,CAAA;CAC1B,GAAG,IA8EH,CAAA"}

package/dist/utilities/getFieldPermissions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getFieldPermissions.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,~~GAAI,uEAMjC~~;IACD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IAC7D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;CAC7E,KAAG;IACF,SAAS,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;IACnE,IAAI,EAAE,OAAO,CAAA;CA6Dd,CAAA"}
1	+ {"version":3,"file":"getFieldPermissions.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,0EAM7B;IACD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IAC7D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;CAC7E,KAAG;IACF,SAAS,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;IACnE,IAAI,EAAE,OAAO,CAAA;CA6Dd,CAAA"}

package/dist/utilities/getNextVersion.d.ts ADDED Viewed

@@ -0,0 +1,7 @@
+/**
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */
+export declare const getNextVersion: () => string | undefined;
+//# sourceMappingURL=getNextVersion.d.ts.map

package/dist/utilities/getNextVersion.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"getNextVersion.d.ts","sourceRoot":"","sources":["../../src/utilities/getNextVersion.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAAM,GAAG,SAc1C,CAAA"}

package/dist/utilities/getNextVersion.js ADDED Viewed

@@ -0,0 +1,20 @@
+import { readFileSync } from 'fs';
+import { resolveFrom } from './dependencies/resolveFrom.js';
+/**
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */ export const getNextVersion = ()=>{
+    try {
+        const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true);
+        if (!packageJSONPath) {
+            return undefined;
+        }
+        const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'));
+        return typeof version === 'string' ? version : undefined;
+    } catch (_) {
+        return undefined;
+    }
+};
+//# sourceMappingURL=getNextVersion.js.map

package/dist/utilities/getNextVersion.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../src/utilities/getNextVersion.ts"],"sourcesContent":["import { readFileSync } from 'fs'\n\nimport { resolveFrom } from './dependencies/resolveFrom.js'\n\n/**\n * Reads the version of the Next.js installed alongside the running app.\n * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs\n * outside of Next.js or from a directory the app's dependencies are not visible from.\n */\nexport const getNextVersion = (): string | undefined => {\n try {\n const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true)\n\n if (!packageJSONPath) {\n return undefined\n }\n\n const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'))\n\n return typeof version === 'string' ? version : undefined\n } catch (_) {\n return undefined\n }\n}\n"],"names":["readFileSync","resolveFrom","getNextVersion","packageJSONPath","process","cwd","undefined","version","JSON","parse","_"],"mappings":"AAAA,SAASA,YAAY,QAAQ,KAAI;AAEjC,SAASC,WAAW,QAAQ,gCAA+B;AAE3D;;;;CAIC,GACD,OAAO,MAAMC,iBAAiB;IAC5B,IAAI;QACF,MAAMC,kBAAkBF,YAAYG,QAAQC,GAAG,IAAI,qBAAqB;QAExE,IAAI,CAACF,iBAAiB;YACpB,OAAOG;QACT;QAEA,MAAM,EAAEC,OAAO,EAAE,GAAGC,KAAKC,KAAK,CAACT,aAAaG,iBAAiB;QAE7D,OAAO,OAAOI,YAAY,WAAWA,UAAUD;IACjD,EAAE,OAAOI,GAAG;QACV,OAAOJ;IACT;AACF,EAAC"}

package/dist/utilities/getObjectDotNotation.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,~~EACpC~~,~~KAAK,~~MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,~~EAC5B~~,MAAM,~~MAAM~~,~~EACZ,eAAe,~~CAAC,KACf,~~CAMF~~,CAAA"}
1	+ {"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAgBF,CAAA"}

package/dist/utilities/getObjectDotNotation.js CHANGED Viewed

@@ -15,7 +15,13 @@
     if (!path || !obj) {
         return defaultValue;
     }
-    const result = path.split('.').reduce((o, i)=>o?.[i], obj);
+    let result = obj;
+    for (const segment of path.split('.')){
+        if (result === null || typeof result !== 'object' || !Object.hasOwn(result, segment)) {
+            return defaultValue;
+        }
+        result = result[segment];
+    }
     return result === undefined ? defaultValue : result;
 };

package/dist/utilities/getObjectDotNotation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/*\n \n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n \n @example\n \n ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n \n const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n obj: Record<string, unknown>,\n path: string,\n defaultValue?: T,\n): T => {\n if (!path \|\| !obj) {\n return defaultValue!\n }\n ~~const~~ result = path.split('.').~~reduce~~((o, i) => ~~o?.[i]~~ as Record<string, unknown~~>, obj~~)\n return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","~~split~~","~~reduce~~","o","i","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;~~IACA~~,~~MAAMC~~,~~SAASF~~,~~KAAKG~~,KAAK,CAAC,~~KAAKC~~,MAAM,~~CAAC~~,~~CAACC~~,~~GAAGC~~,~~IAAMD~~,~~GAAG~~,CAACC,~~EAAE,EAA6BP~~;~~IACnF~~,~~OAAOG~~,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}
1	+ {"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/*\n \n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n \n @example\n \n ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n \n const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n obj: Record<string, unknown>,\n path: string,\n defaultValue?: T,\n): T => {\n if (!path \|\| !obj) {\n return defaultValue!\n }\n\n let result: unknown = obj\n\n for (const segment of path.split('.')) {\n if (result === null \|\| typeof result !== 'object' \|\| !Object.hasOwn(result, segment)) {\n return defaultValue!\n }\n\n result = (result as Record<string, unknown>)[segment]\n }\n\n return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","segment","split","Object","hasOwn","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IAEA,IAAIC,SAAkBH;IAEtB,KAAK,MAAMI,WAAWH,KAAKI,KAAK,CAAC,KAAM;QACrC,IAAIF,WAAW,QAAQ,OAAOA,WAAW,YAAY,CAACG,OAAOC,MAAM,CAACJ,QAAQC,UAAU;YACpF,OAAOF;QACT;QAEAC,SAAS,AAACA,MAAkC,CAACC,QAAQ;IACvD;IAEA,OAAOD,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}

package/dist/utilities/getRequestEntity.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getRequestEntity.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestEntity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,eAAO,MAAM,oBAAoB,~~GAAI~~,~~KAAK,~~cAAc,KAAG,UAc1D,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,CAAC,SAAS,OAAO,~~EAC1D~~,~~KAAK,~~cAAc,~~EACnB,mCAGG~~;IACD,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;~~CAChB~~,~~KACL~~;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,EAAE,EAAE,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CA2C9C,CAAA;AAED,eAAO,MAAM,gBAAgB,~~GAAI~~,~~KAAK,~~cAAc,KAAG,qBActD,CAAA"}
1	+ {"version":3,"file":"getRequestEntity.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestEntity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,eAAO,MAAM,oBAAoB,QAAS,cAAc,KAAG,UAc1D,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,CAAC,SAAS,OAAO,OACrD,cAAc,qCAIhB;IACD,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,KACA;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,EAAE,EAAE,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CA2C9C,CAAA;AAED,eAAO,MAAM,gBAAgB,QAAS,cAAc,KAAG,qBActD,CAAA"}

package/dist/utilities/getRequestLanguage.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getRequestLanguage.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestLanguage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAIjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,eAAe,CAAA;IACvB,OAAO,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,eAAe,CAAC,EAAE,iBAAiB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CAC5B,CAAA;AAED,eAAO,MAAM,kBAAkB,~~GAAI,+BAIhC~~,sBAAsB,KAAG,iBAqB3B,CAAA"}
1	+ {"version":3,"file":"getRequestLanguage.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestLanguage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAIjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,eAAe,CAAA;IACvB,OAAO,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,eAAe,CAAC,EAAE,iBAAiB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CAC5B,CAAA;AAED,eAAO,MAAM,kBAAkB,kCAI5B,sBAAsB,KAAG,iBAqB3B,CAAA"}

package/dist/utilities/getRequestOrigin.d.ts CHANGED Viewed

@@ -4,7 +4,7 @@ import type { PayloadRequest } from '../types/index.js';
  * Returns a trusted request origin
  */
 export declare const getRequestOrigin: ({ config, req, }: {
-    config: Pick<SanitizedConfig, "cors" | "csrf" | "serverURL">;
-    req: Pick<PayloadRequest, "headers" | "payload" | "url">;
+    config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>;
+    req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>;
 }) => string;
 //# sourceMappingURL=getRequestOrigin.d.ts.map

package/dist/utilities/getRequestOrigin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,~~EAAc~~,eAAe,EAAE,MAAM,oBAAoB,CAAA;~~AACrE~~,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,~~GAAI,kBAG9B~~;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}
1	+ {"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,qBAG1B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}

package/dist/utilities/getRequestOrigin.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { ~~CORSConfig,~~ SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' \| 'csrf'>): null \| string[] => {\n const origins = new Set<string>()\n\n const { cors, csrf } = config\n\n if (cors === '') {\n return null\n }\n\n if (Array.isArray(cors)) {\n cors.forEach((o) => origins.add(o))\n } else if (cors && typeof cors === 'object') {\n const corsOrigins = (cors ~~as CORSConfig)~~.origins\n if (corsOrigins === '') {\n return null\n }\n if (Array.isArray(corsOrigins)) {\n corsOrigins.forEach((o) => origins.add(o))\n }\n }\n\n if (Array.isArray(csrf)) {\n csrf.forEach((o) => origins.add(o))\n }\n\n return [...origins]\n}\n\n/*\n Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n config,\n req,\n}: {\n config: Pick<SanitizedConfig, 'cors' \| 'csrf' \| 'serverURL'>\n req: Pick<PayloadRequest, 'headers' \| 'payload' \| 'url'>\n}): string => {\n if (config.serverURL !== null && config.serverURL !== '') {\n return config.serverURL\n }\n\n let origin = ''\n try {\n const protocol = new URL(req.url!).protocol\n const host = req.headers?.get('host')\n if (host) {\n origin = `${protocol}//${host}`\n }\n } catch {\n // req.url is malformed; origin stays empty\n }\n\n const trustedOrigins = getTrustedOrigins(config)\n\n if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n return origin\n }\n\n req.payload.logger.warn(\n `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n )\n\n return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,~~cAAc~~,~~AAACP~~,~~KAAoBF,~~OAAO;~~QAChD~~,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}
1	+ {"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' \| 'csrf'>): null \| string[] => {\n const origins = new Set<string>()\n\n const { cors, csrf } = config\n\n if (cors === '') {\n return null\n }\n\n if (Array.isArray(cors)) {\n cors.forEach((o) => origins.add(o))\n } else if (cors && typeof cors === 'object') {\n const corsOrigins = cors.origins\n if (corsOrigins === '') {\n return null\n }\n if (Array.isArray(corsOrigins)) {\n corsOrigins.forEach((o) => origins.add(o))\n }\n }\n\n if (Array.isArray(csrf)) {\n csrf.forEach((o) => origins.add(o))\n }\n\n return [...origins]\n}\n\n/*\n Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n config,\n req,\n}: {\n config: Pick<SanitizedConfig, 'cors' \| 'csrf' \| 'serverURL'>\n req: Pick<PayloadRequest, 'headers' \| 'payload' \| 'url'>\n}): string => {\n if (config.serverURL !== null && config.serverURL !== '') {\n return config.serverURL\n }\n\n let origin = ''\n try {\n const protocol = new URL(req.url!).protocol\n const host = req.headers?.get('host')\n if (host) {\n origin = `${protocol}//${host}`\n }\n } catch {\n // req.url is malformed; origin stays empty\n }\n\n const trustedOrigins = getTrustedOrigins(config)\n\n if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n return origin\n }\n\n req.payload.logger.warn(\n `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n )\n\n return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAcP,KAAKF,OAAO;QAChC,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}

package/dist/utilities/getSafeRedirect.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,~~GAAI,gDAI7B~~;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,~~MAmCH~~,CAAA"}
1	+ {"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,mDAIzB;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAgDH,CAAA"}

package/dist/utilities/getSafeRedirect.js CHANGED Viewed

@@ -2,23 +2,30 @@ export const getSafeRedirect = ({ allowAbsoluteUrls = false, fallbackTo = '/', r
     if (typeof redirectTo !== 'string') {
         return fallbackTo;
     }
-    // Normalize and decode the path
-    let redirectPath;
+    const redirectPath = redirectTo.trim();
+    const hasControlCharacters = [
+        ...redirectPath
+    ].some((character)=>{
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+    const hasAmbiguousPathPrefix = /^\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath);
+    let parsedRedirect;
     try {
-        redirectPath = decodeURIComponent(redirectTo.trim());
+        parsedRedirect = new URL(redirectPath, 'http://localhost');
     } catch  {
-        return fallbackTo // invalid encoding
-        ;
+        return fallbackTo;
     }
-    const isSafeRedirect = // Must start with a single forward slash (e.g., "/admin")
-    redirectPath.startsWith('/') && // Prevent protocol-relative URLs (e.g., "//example.com")
+    const isSafeRedirect = !hasControlCharacters && !hasAmbiguousPathPrefix && // Must start with a single forward slash (e.g., "/admin")
+    redirectPath.startsWith('/') && // Must resolve to the same origin after URL parser normalization
+    parsedRedirect.origin === 'http://localhost' && // Prevent protocol-relative URLs (e.g., "//example.com")
     !redirectPath.startsWith('//') && // Prevent encoded slashes that could resolve to protocol-relative
     !redirectPath.startsWith('/%2F') && // Prevent backslash-based escape attempts (e.g., "/\\/example.com", "/\\\\example.com", "/\\example.com")
     !redirectPath.startsWith('/\\/') && !redirectPath.startsWith('/\\\\') && !redirectPath.startsWith('/\\') && // Prevent javascript-based schemes (e.g., "/javascript:alert(1)")
     !redirectPath.toLowerCase().startsWith('/javascript:') && // Prevent attempts to redirect to full URLs using "/http:" or "/https:"
     !redirectPath.toLowerCase().startsWith('/http');
-    const isAbsoluteSafeRedirect = allowAbsoluteUrls && // Must be a valid absolute URL with http or https
-    /^https?:\/\/\S+$/i.test(redirectPath);
+    const isAbsoluteSafeRedirect = allowAbsoluteUrls && !hasControlCharacters && // Must be a valid absolute URL with http or https
+    /^https?:\/\/\S+$/i.test(redirectPath) && (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:');
     return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo;
 };

package/dist/utilities/getSafeRedirect.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n allowAbsoluteUrls = false,\n fallbackTo = '/',\n redirectTo,\n}: {\n allowAbsoluteUrls?: boolean\n fallbackTo?: string\n redirectTo: string \| string[]\n}): string => {\n if (typeof redirectTo !== 'string') {\n return fallbackTo\n }\n\n // ~~Normalize~~ ~~and~~ ~~decode~~ ~~the~~ ~~path~~\n let ~~redirectPath~~: ~~string~~\n try {\n ~~redirectPath~~ = ~~decodeURIComponent~~(~~redirectTo.trim(~~))\n } catch {\n return fallbackTo ~~// invalid encoding~~\n }\n\n const isSafeRedirect =\n // Must start with a single forward slash (e.g., \"/admin\")\n redirectPath.startsWith('/') &&\n // Prevent protocol-relative URLs (e.g., \"//example.com\")\n !redirectPath.startsWith('//') &&\n // Prevent encoded slashes that could resolve to protocol-relative\n !redirectPath.startsWith('/%2F') &&\n // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n !redirectPath.startsWith('/\\\\/') &&\n !redirectPath.startsWith('/\\\\\\\\') &&\n !redirectPath.startsWith('/\\\\') &&\n // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n !redirectPath.toLowerCase().startsWith('/javascript:') &&\n // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n !redirectPath.toLowerCase().startsWith('/http')\n\n const isAbsoluteSafeRedirect =\n allowAbsoluteUrls &&\n // Must be a valid absolute URL with http or https\n /^https?:\\/\\/\\S+$/i.test(redirectPath)\n\n return isSafeRedirect \|\| isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","~~decodeURIComponent~~","~~trim~~","isSafeRedirect","startsWith","toLowerCase","isAbsoluteSafeRedirect","~~test~~"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,~~gCAAgC~~;IAChC,~~IAAIE~~;IACJ,IAAI;QACFA,~~eAAeC~~,~~mBAAmBF~~,~~WAAWG~~,~~IAAI~~;~~IACnD~~,EAAE,OAAM;QACN,~~OAAOJ,WAAW,mBAAmB;;IACvC~~;IAEA,~~MAAMK~~,iBACJ,0DAA0D;~~IAC1DH~~,~~aAAaI~~,UAAU,CAAC,QACxB,yDAAyD;IACzD,~~CAACJ~~,~~aAAaI~~,UAAU,CAAC,SACzB,kEAAkE;IAClE,~~CAACJ~~,~~aAAaI~~,UAAU,CAAC,WACzB,0GAA0G;IAC1G,~~CAACJ~~,~~aAAaI~~,UAAU,CAAC,WACzB,~~CAACJ~~,~~aAAaI~~,UAAU,CAAC,YACzB,~~CAACJ~~,~~aAAaI~~,UAAU,CAAC,UACzB,kEAAkE;IAClE,~~CAACJ~~,~~aAAaK~~,WAAW,~~GAAGD~~,UAAU,CAAC,mBACvC,wEAAwE;IACxE,~~CAACJ~~,~~aAAaK~~,WAAW,~~GAAGD~~,UAAU,CAAC;IAEzC,~~MAAME~~,~~yBACJT~~,qBACA,kDAAkD;IAClD,~~oBAAoBU~~,IAAI,~~CAACP~~;~~IAE3B~~,~~OAAOG~~,~~kBAAkBG~~,~~yBAAyBN~~,eAAeF;AACnE,EAAC"}
1	+ {"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n allowAbsoluteUrls = false,\n fallbackTo = '/',\n redirectTo,\n}: {\n allowAbsoluteUrls?: boolean\n fallbackTo?: string\n redirectTo: string \| string[]\n}): string => {\n if (typeof redirectTo !== 'string') {\n return fallbackTo\n }\n\n const redirectPath = redirectTo.trim()\n\n const hasControlCharacters = [...redirectPath].some((character) => {\n const code = character.charCodeAt(0)\n return code <= 31 \|\| code === 127\n })\n const hasAmbiguousPathPrefix = /^\\/%(?:25)*(?:09\|0a\|0d\|2f\|5c)/i.test(redirectPath)\n\n let parsedRedirect: URL\n try {\n parsedRedirect = new URL(redirectPath, 'http://localhost')\n } catch {\n return fallbackTo\n }\n\n const isSafeRedirect =\n !hasControlCharacters &&\n !hasAmbiguousPathPrefix &&\n // Must start with a single forward slash (e.g., \"/admin\")\n redirectPath.startsWith('/') &&\n // Must resolve to the same origin after URL parser normalization\n parsedRedirect.origin === 'http://localhost' &&\n // Prevent protocol-relative URLs (e.g., \"//example.com\")\n !redirectPath.startsWith('//') &&\n // Prevent encoded slashes that could resolve to protocol-relative\n !redirectPath.startsWith('/%2F') &&\n // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n !redirectPath.startsWith('/\\\\/') &&\n !redirectPath.startsWith('/\\\\\\\\') &&\n !redirectPath.startsWith('/\\\\') &&\n // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n !redirectPath.toLowerCase().startsWith('/javascript:') &&\n // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n !redirectPath.toLowerCase().startsWith('/http')\n\n const isAbsoluteSafeRedirect =\n allowAbsoluteUrls &&\n !hasControlCharacters &&\n // Must be a valid absolute URL with http or https\n /^https?:\\/\\/\\S+$/i.test(redirectPath) &&\n (parsedRedirect.protocol === 'http:' \|\| parsedRedirect.protocol === 'https:')\n\n return isSafeRedirect \|\| isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","trim","hasControlCharacters","some","character","code","charCodeAt","hasAmbiguousPathPrefix","test","parsedRedirect","URL","isSafeRedirect","startsWith","origin","toLowerCase","isAbsoluteSafeRedirect","protocol"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,MAAME,eAAeD,WAAWE,IAAI;IAEpC,MAAMC,uBAAuB;WAAIF;KAAa,CAACG,IAAI,CAAC,CAACC;QACnD,MAAMC,OAAOD,UAAUE,UAAU,CAAC;QAClC,OAAOD,QAAQ,MAAMA,SAAS;IAChC;IACA,MAAME,yBAAyB,iCAAiCC,IAAI,CAACR;IAErE,IAAIS;IACJ,IAAI;QACFA,iBAAiB,IAAIC,IAAIV,cAAc;IACzC,EAAE,OAAM;QACN,OAAOF;IACT;IAEA,MAAMa,iBACJ,CAACT,wBACD,CAACK,0BACD,0DAA0D;IAC1DP,aAAaY,UAAU,CAAC,QACxB,iEAAiE;IACjEH,eAAeI,MAAM,KAAK,sBAC1B,yDAAyD;IACzD,CAACb,aAAaY,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACZ,aAAaY,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACZ,aAAaY,UAAU,CAAC,WACzB,CAACZ,aAAaY,UAAU,CAAC,YACzB,CAACZ,aAAaY,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC;IAEzC,MAAMG,yBACJlB,qBACA,CAACK,wBACD,kDAAkD;IAClD,oBAAoBM,IAAI,CAACR,iBACxBS,CAAAA,eAAeO,QAAQ,KAAK,WAAWP,eAAeO,QAAQ,KAAK,QAAO;IAE7E,OAAOL,kBAAkBI,yBAAyBf,eAAeF;AACnE,EAAC"}

package/dist/utilities/getSelectMode.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getSelectMode.d.ts","sourceRoot":"","sources":["../../src/utilities/getSelectMode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE/D,eAAO,MAAM,aAAa,~~GAAI~~,~~QAAQ,~~UAAU,KAAG,UAalD,CAAA"}
1	+ {"version":3,"file":"getSelectMode.d.ts","sourceRoot":"","sources":["../../src/utilities/getSelectMode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE/D,eAAO,MAAM,aAAa,WAAY,UAAU,KAAG,UAalD,CAAA"}

package/dist/utilities/getSiblingData.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getSiblingData.d.ts","sourceRoot":"","sources":["../../src/utilities/getSiblingData.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAKxD,eAAO,MAAM,cAAc,~~GAAI~~,~~QAAQ,~~SAAS,~~EAAE~~,MAAM,~~MAAM,~~KAAG,IAqChE,CAAA"}
1	+ {"version":3,"file":"getSiblingData.d.ts","sourceRoot":"","sources":["../../src/utilities/getSiblingData.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAKxD,eAAO,MAAM,cAAc,WAAY,SAAS,QAAQ,MAAM,KAAG,IAqChE,CAAA"}

package/dist/utilities/getTopLevelFieldNames.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export declare const getTopLevelFieldNames: (data: object) => Set<string>;
2	+ //# sourceMappingURL=getTopLevelFieldNames.d.ts.map

package/dist/utilities/getTopLevelFieldNames.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"getTopLevelFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getTopLevelFieldNames.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,GAAG,CAAC,MAAM,CACa,CAAA"}

package/dist/utilities/getTopLevelFieldNames.js ADDED Viewed

@@ -0,0 +1,3 @@
+export const getTopLevelFieldNames = (data)=>new Set(Object.keys(data).map((fieldPath)=>fieldPath.split('.', 1)[0]));
+//# sourceMappingURL=getTopLevelFieldNames.js.map

package/dist/utilities/getTopLevelFieldNames.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../src/utilities/getTopLevelFieldNames.ts"],"sourcesContent":["export const getTopLevelFieldNames = (data: object): Set<string> =>\n new Set(Object.keys(data).map((fieldPath) => fieldPath.split('.', 1)[0]!))\n"],"names":["getTopLevelFieldNames","data","Set","Object","keys","map","fieldPath","split"],"mappings":"AAAA,OAAO,MAAMA,wBAAwB,CAACC,OACpC,IAAIC,IAAIC,OAAOC,IAAI,CAACH,MAAMI,GAAG,CAAC,CAACC,YAAcA,UAAUC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG"}

package/dist/utilities/getTranslatedLabel.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getTranslatedLabel.d.ts","sourceRoot":"","sources":["../../src/utilities/getTranslatedLabel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEpE,eAAO,MAAM,kBAAkB,~~GAC7B~~,~~OAAO,~~aAAa,GAAG,WAAW,GAAG,SAAS,~~EAC9C~~,~~OAAO,~~IAAI,KACV,MAAM,GAAG,SAUX,CAAA"}
1	+ {"version":3,"file":"getTranslatedLabel.d.ts","sourceRoot":"","sources":["../../src/utilities/getTranslatedLabel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEpE,eAAO,MAAM,kBAAkB,UACtB,aAAa,GAAG,WAAW,GAAG,SAAS,SACvC,IAAI,KACV,MAAM,GAAG,SAUX,CAAA"}

package/dist/utilities/getUniqueFieldValue.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+import type { DefaultDocumentIDType, Locale } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+type Args = {
+    collection: string;
+    /** Also treat a value taken by a draft-only version as unavailable. */
+    draftsEnabled?: boolean;
+    /** Field name to check for uniqueness. */
+    field: string;
+    /** Exclude this doc from the check when updating; omit for a new doc. */
+    id?: DefaultDocumentIDType;
+    /** Locale to scope the check to, for localized fields. */
+    locale?: Locale['code'];
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+    /**
+     * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …
+     * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.
+     */
+    startIndex?: number;
+    value: string;
+};
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */
+export declare const getUniqueFieldValue: ({ id, collection, draftsEnabled, field, locale, overrideAccess, req, startIndex, value, }: Args) => Promise<string>;
+export {};
+//# sourceMappingURL=getUniqueFieldValue.d.ts.map

package/dist/utilities/getUniqueFieldValue.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"getUniqueFieldValue.d.ts","sourceRoot":"","sources":["../../src/utilities/getUniqueFieldValue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAKD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,8FAU7B,IAAI,KAAG,OAAO,CAAC,MAAM,CAqBvB,CAAA"}

package/dist/utilities/getUniqueFieldValue.js ADDED Viewed

@@ -0,0 +1,27 @@
+import { fieldValueExists } from './fieldValueExists.js';
+// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.
+const MAX_SUFFIX_ATTEMPTS = 50;
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */ export const getUniqueFieldValue = async ({ id, collection, draftsEnabled, field, locale, overrideAccess = false, req, startIndex = 0, value })=>{
+    for(let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++){
+        const candidate = index === 0 ? value : `${value}-${index}`;
+        const taken = await fieldValueExists({
+            id,
+            collection,
+            draftsEnabled,
+            field,
+            locale,
+            overrideAccess,
+            req,
+            value: candidate
+        });
+        if (!taken) {
+            return candidate;
+        }
+    }
+    return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`;
+};
+//# sourceMappingURL=getUniqueFieldValue.js.map

package/dist/utilities/getUniqueFieldValue.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../src/utilities/getUniqueFieldValue.ts"],"sourcesContent":["import type { DefaultDocumentIDType, Locale } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldValueExists } from './fieldValueExists.js'\n\ntype Args = {\n collection: string\n /** Also treat a value taken by a draft-only version as unavailable. */\n draftsEnabled?: boolean\n /** Field name to check for uniqueness. */\n field: string\n /** Exclude this doc from the check when updating; omit for a new doc. */\n id?: DefaultDocumentIDType\n /** Locale to scope the check to, for localized fields. */\n locale?: Locale['code']\n overrideAccess?: boolean\n req: PayloadRequest\n /**\n * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …\n * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.\n */\n startIndex?: number\n value: string\n}\n\n// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.\nconst MAX_SUFFIX_ATTEMPTS = 50\n\n/**\n * Returns the first available value for `field` in `collection` — either the bare `value` or a\n * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.\n */\nexport const getUniqueFieldValue = async ({\n id,\n collection,\n draftsEnabled,\n field,\n locale,\n overrideAccess = false,\n req,\n startIndex = 0,\n value,\n}: Args): Promise<string> => {\n for (let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++) {\n const candidate = index === 0 ? value : `${value}-${index}`\n\n const taken = await fieldValueExists({\n id,\n collection,\n draftsEnabled,\n field,\n locale,\n overrideAccess,\n req,\n value: candidate,\n })\n\n if (!taken) {\n return candidate\n }\n }\n\n return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`\n}\n"],"names":["fieldValueExists","MAX_SUFFIX_ATTEMPTS","getUniqueFieldValue","id","collection","draftsEnabled","field","locale","overrideAccess","req","startIndex","value","index","candidate","taken"],"mappings":"AAGA,SAASA,gBAAgB,QAAQ,wBAAuB;AAsBxD,oGAAoG;AACpG,MAAMC,sBAAsB;AAE5B;;;CAGC,GACD,OAAO,MAAMC,sBAAsB,OAAO,EACxCC,EAAE,EACFC,UAAU,EACVC,aAAa,EACbC,KAAK,EACLC,MAAM,EACNC,iBAAiB,KAAK,EACtBC,GAAG,EACHC,aAAa,CAAC,EACdC,KAAK,EACA;IACL,IAAK,IAAIC,QAAQF,YAAYE,SAASF,aAAaT,qBAAqBW,QAAS;QAC/E,MAAMC,YAAYD,UAAU,IAAID,QAAQ,GAAGA,MAAM,CAAC,EAAEC,OAAO;QAE3D,MAAME,QAAQ,MAAMd,iBAAiB;YACnCG;YACAC;YACAC;YACAC;YACAC;YACAC;YACAC;YACAE,OAAOE;QACT;QAEA,IAAI,CAACC,OAAO;YACV,OAAOD;QACT;IACF;IAEA,OAAO,GAAGF,MAAM,CAAC,EAAED,aAAaT,qBAAqB;AACvD,EAAC"}

package/dist/utilities/getVersionsConfig.d.ts CHANGED Viewed

@@ -27,7 +27,7 @@ export declare const hasDraftValidationEnabled: (config: EntityConfig) => boolea
 export declare const hasScheduledPublishEnabled: (config: EntityConfig) => config is {
     versions: {
         drafts: {
-            schedulePublish: SanitizedDrafts["schedulePublish"];
+            schedulePublish: SanitizedDrafts['schedulePublish'];
         };
     };
 } & EntityConfig;

package/dist/utilities/getVersionsConfig.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getVersionsConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/getVersionsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIrE,KAAK,YAAY,GAAG,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,UAAU,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,gBAAgB,~~GAAI~~,~~QAAQ,~~YAAY,KAAG,OAEvD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,~~GAAI~~,~~QAAQ,~~YAAY,KAAG,OAQ/D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,~~GAC7B~~,~~QAAQ,~~YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;SAAE,CAAA;KACvC,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,~~GAAI~~,~~QAAQ,~~YAAY,KAAG,OAQhE,CAAA;AAED,eAAO,MAAM,0BAA0B,~~GACrC~~,~~QAAQ,~~YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAA;SAAE,CAAA;KAChE,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,~~GAAI~~,~~QAAQ,~~YAAY,KAAG,MAYrD,CAAA;AAED,eAAO,MAAM,mBAAmB,~~GAAI~~,~~QAAQ,~~YAAY,KAAG,MAa1D,CAAA"}
1	+ {"version":3,"file":"getVersionsConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/getVersionsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIrE,KAAK,YAAY,GAAG,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,UAAU,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,gBAAgB,WAAY,YAAY,KAAG,OAEvD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,WAAY,YAAY,KAAG,OAQ/D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,WACrB,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;SAAE,CAAA;KACvC,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,WAAY,YAAY,KAAG,OAQhE,CAAA;AAED,eAAO,MAAM,0BAA0B,WAC7B,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAA;SAAE,CAAA;KAChE,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,YAAY,KAAG,MAYrD,CAAA;AAED,eAAO,MAAM,mBAAmB,WAAY,YAAY,KAAG,MAa1D,CAAA"}

package/dist/utilities/getVirtualFieldNames.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+import type { SanitizedConfig } from '../config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */
+export declare function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */
+export declare function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */
+export declare function stripVirtualFields(data: Record<string, unknown>, virtualFieldNames: string[]): Record<string, unknown>;
+//# sourceMappingURL=getVirtualFieldNames.d.ts.map

package/dist/utilities/getVirtualFieldNames.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"getVirtualFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getVirtualFieldNames.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIzD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU9F;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU1F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/utilities/getVirtualFieldNames.js ADDED Viewed

@@ -0,0 +1,35 @@
+import { fieldIsVirtual } from '../fields/config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */ export function getCollectionVirtualFieldNames(config, slug) {
+    const collection = config.collections.find((c)=>c.slug === slug);
+    if (!collection) {
+        return [];
+    }
+    return collection.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */ export function getGlobalVirtualFieldNames(config, slug) {
+    const global = config.globals.find((g)=>g.slug === slug);
+    if (!global) {
+        return [];
+    }
+    return global.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */ export function stripVirtualFields(data, virtualFieldNames) {
+    if (virtualFieldNames.length === 0) {
+        return data;
+    }
+    const stripped = {
+        ...data
+    };
+    for (const name of virtualFieldNames){
+        delete stripped[name];
+    }
+    return stripped;
+}
+//# sourceMappingURL=getVirtualFieldNames.js.map

package/dist/utilities/getVirtualFieldNames.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../src/utilities/getVirtualFieldNames.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\n\nimport { fieldIsVirtual } from '../fields/config/types.js'\n\n/**\n * Returns the names of all top-level virtual fields for a given collection slug.\n */\nexport function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n const collection = config.collections.find((c) => c.slug === slug)\n\n if (!collection) {\n return []\n }\n\n return collection.flattenedFields\n .filter((field) => 'name' in field && fieldIsVirtual(field))\n .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Returns the names of all top-level virtual fields for a given global slug.\n */\nexport function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n const global = config.globals.find((g) => g.slug === slug)\n\n if (!global) {\n return []\n }\n\n return global.flattenedFields\n .filter((field) => 'name' in field && fieldIsVirtual(field))\n .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Strips virtual field values from a data object given a list of virtual field names.\n */\nexport function stripVirtualFields(\n data: Record<string, unknown>,\n virtualFieldNames: string[],\n): Record<string, unknown> {\n if (virtualFieldNames.length === 0) {\n return data\n }\n\n const stripped = { ...data }\n\n for (const name of virtualFieldNames) {\n delete stripped[name]\n }\n\n return stripped\n}\n"],"names":["fieldIsVirtual","getCollectionVirtualFieldNames","config","slug","collection","collections","find","c","flattenedFields","filter","field","map","name","getGlobalVirtualFieldNames","global","globals","g","stripVirtualFields","data","virtualFieldNames","length","stripped"],"mappings":"AAEA,SAASA,cAAc,QAAQ,4BAA2B;AAE1D;;CAEC,GACD,OAAO,SAASC,+BAA+BC,MAAuB,EAAEC,IAAY;IAClF,MAAMC,aAAaF,OAAOG,WAAW,CAACC,IAAI,CAAC,CAACC,IAAMA,EAAEJ,IAAI,KAAKA;IAE7D,IAAI,CAACC,YAAY;QACf,OAAO,EAAE;IACX;IAEA,OAAOA,WAAWI,eAAe,CAC9BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASC,2BAA2BX,MAAuB,EAAEC,IAAY;IAC9E,MAAMW,SAASZ,OAAOa,OAAO,CAACT,IAAI,CAAC,CAACU,IAAMA,EAAEb,IAAI,KAAKA;IAErD,IAAI,CAACW,QAAQ;QACX,OAAO,EAAE;IACX;IAEA,OAAOA,OAAON,eAAe,CAC1BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASK,mBACdC,IAA6B,EAC7BC,iBAA2B;IAE3B,IAAIA,kBAAkBC,MAAM,KAAK,GAAG;QAClC,OAAOF;IACT;IAEA,MAAMG,WAAW;QAAE,GAAGH,IAAI;IAAC;IAE3B,KAAK,MAAMN,QAAQO,kBAAmB;QACpC,OAAOE,QAAQ,CAACT,KAAK;IACvB;IAEA,OAAOS;AACT"}

package/dist/utilities/handleEndpoints.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,~~GAAU,+EAMnC~~;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,~~CAmNnB~~,CAAA"}
1	+ {"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAoNnB,CAAA"}