payload 4.0.0-internal.4cbdd50 → 4.0.0-internal.4e1f822

package/dist/auth/operations/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/login.ts"],"sourcesContent":["import type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n  DataFromCollectionSlug,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, TypedUser } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport {\n  AuthenticationError,\n  LockedAuth,\n  UnverifiedEmail,\n  ValidationError,\n} from '../../errors/index.js'\nimport { afterRead } from '../../fields/hooks/afterRead/index.js'\nimport { commitTransaction, Forbidden, initTransaction } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { isUserLocked } from '../isUserLocked.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { incrementLoginAttempts } from '../strategies/local/incrementLoginAttempts.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type LoginResult<TSlug extends AuthCollectionSlug> = {\n  exp?: number\n  token?: string\n  user?: DataFromCollectionSlug<TSlug>\n}\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['login']\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n  showHiddenFields?: boolean\n}\n\ntype CheckLoginPermissionArgs<TSlug extends AuthCollectionSlug> = {\n  loggingInWithUsername?: boolean\n  req: PayloadRequest\n  user: DataFromCollectionSlug<TSlug>\n}\n\n/**\n * Throws an error if the user is locked or does not exist.\n * This does not check the login attempts, only the lock status. Whoever increments login attempts\n * is responsible for locking the user properly, not whoever checks the login permission.\n */\nexport const checkLoginPermission = <TSlug extends AuthCollectionSlug>({\n  loggingInWithUsername,\n  req,\n  user,\n}: CheckLoginPermissionArgs<TSlug>) => {\n  if (!user) {\n    throw new AuthenticationError(req.t, Boolean(loggingInWithUsername))\n  }\n\n  if (isUserLocked(new Date(user.lockUntil))) {\n    throw new LockedAuth(req.t)\n  }\n}\n\nexport const loginOperation = async <TSlug extends AuthCollectionSlug>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<LoginResult<TSlug>> => {\n  let args = incomingArgs\n\n  if (args.collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(args.req.t)\n  }\n\n  // /////////////////////////////////////\n  // beforeOperation - Collection\n  // /////////////////////////////////////\n\n  args = await buildBeforeOperation({\n    args,\n    collection: args.collection.config,\n    operation: 'login',\n    overrideAccess: args.overrideAccess!,\n  })\n\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess = false,\n    req,\n    req: {\n      fallbackLocale,\n      locale,\n      payload,\n      payload: { secret },\n    },\n    showHiddenFields,\n  } = args\n\n  // /////////////////////////////////////\n  // Login\n  // /////////////////////////////////////\n\n  const { email: unsanitizedEmail, password } = data\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const sanitizedEmail =\n    typeof unsanitizedEmail === 'string' ? unsanitizedEmail.toLowerCase().trim() : null\n  const sanitizedUsername =\n    'username' in data && typeof data?.username === 'string'\n      ? data.username.toLowerCase().trim()\n      : null\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  // cannot login with email, did not provide username\n  if (!canLoginWithEmail && !sanitizedUsername) {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [{ message: req.i18n.t('validation:required'), path: 'username' }],\n    })\n  }\n\n  // cannot login with username, did not provide email\n  if (!canLoginWithUsername && !sanitizedEmail) {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [{ message: req.i18n.t('validation:required'), path: 'email' }],\n    })\n  }\n\n  // can login with either email or username, did not provide either\n  if (!sanitizedUsername && !sanitizedEmail) {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [\n        { message: req.i18n.t('validation:required'), path: 'email' },\n        { message: req.i18n.t('validation:required'), path: 'username' },\n      ],\n    })\n  }\n\n  // did not provide password for login\n  if (typeof password !== 'string' || password.trim() === '') {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [{ message: req.i18n.t('validation:required'), path: 'password' }],\n    })\n  }\n\n  let whereConstraint: Where = {}\n  const emailConstraint: Where = {\n    email: {\n      equals: sanitizedEmail,\n    },\n  }\n  const usernameConstraint: Where = {\n    username: {\n      equals: sanitizedUsername,\n    },\n  }\n\n  if (canLoginWithEmail && canLoginWithUsername && (sanitizedUsername || sanitizedEmail)) {\n    if (sanitizedUsername) {\n      whereConstraint = {\n        or: [\n          usernameConstraint,\n          {\n            email: {\n              equals: sanitizedUsername,\n            },\n          },\n        ],\n      }\n    } else {\n      whereConstraint = {\n        or: [\n          emailConstraint,\n          {\n            username: {\n              equals: sanitizedEmail,\n            },\n          },\n        ],\n      }\n    }\n  } else if (canLoginWithEmail && sanitizedEmail) {\n    whereConstraint = emailConstraint\n  } else if (canLoginWithUsername && sanitizedUsername) {\n    whereConstraint = usernameConstraint\n  }\n\n  // Exclude trashed users\n  whereConstraint = appendNonTrashedFilter({\n    enableTrash: collectionConfig.trash,\n    trash: false,\n    where: whereConstraint,\n  })\n\n  let user = (await payload.db.findOne<TypedUser>({\n    collection: collectionConfig.slug,\n    req,\n    where: whereConstraint,\n  })) as TypedUser\n\n  checkLoginPermission({\n    loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n    req,\n    user,\n  })\n\n  user.collection = collectionConfig.slug\n  user._strategy = 'local-jwt'\n\n  const authResult = await authenticateLocalStrategy({ doc: user, password })\n  user = sanitizeInternalFields(user)\n\n  const maxLoginAttemptsEnabled = args.collection.config.auth.maxLoginAttempts > 0\n\n  if (!authResult) {\n    if (maxLoginAttemptsEnabled) {\n      await incrementLoginAttempts({\n        collection: collectionConfig,\n        payload: req.payload,\n        user,\n      })\n\n      // Re-check login permissions and max attempts after incrementing attempts, in case parallel updates occurred\n      checkLoginPermission({\n        loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n        req,\n        user,\n      })\n    }\n\n    throw new AuthenticationError(req.t)\n  }\n\n  if (collectionConfig.auth.verify && user._verified === false) {\n    throw new UnverifiedEmail({ t: req.t })\n  }\n\n  // Authentication successful - start transaction for remaining operations\n  const shouldCommit = await initTransaction(args.req)\n  let sid: string | undefined\n\n  try {\n    /*\n     * Correct password accepted - re‑check that the account didn't\n     * get locked by parallel bad attempts in the meantime.\n     */\n    if (maxLoginAttemptsEnabled) {\n      const { lockUntil, loginAttempts } = (await payload.db.findOne<TypedUser>({\n        collection: collectionConfig.slug,\n        req,\n        select: {\n          lockUntil: true,\n          loginAttempts: true,\n        },\n        where: { id: { equals: user.id } },\n      }))!\n\n      user.lockUntil = lockUntil\n      user.loginAttempts = loginAttempts\n\n      checkLoginPermission({\n        req,\n        user,\n      })\n    }\n\n    const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n      collectionConfig,\n      email: sanitizedEmail!,\n      user,\n    }\n\n    const session = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req,\n      user,\n    })\n    sid = session.sid\n\n    if (sid) {\n      fieldsToSignArgs.sid = sid\n    }\n\n    const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n    if (maxLoginAttemptsEnabled) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n    }\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            user,\n          })) || user\n      }\n    }\n\n    const { exp, token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: collectionConfig.auth.tokenExpiration,\n    })\n\n    req.user = user\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            token,\n            user,\n          })) || user\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterRead - Fields\n    // /////////////////////////////////////\n\n    user = await afterRead({\n      collection: collectionConfig,\n      context: req.context,\n      depth: depth!,\n      doc: user,\n      // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n      draft: undefined,\n      fallbackLocale: fallbackLocale!,\n      global: null,\n      locale: locale!,\n      overrideAccess,\n      req,\n      showHiddenFields: showHiddenFields!,\n    })\n\n    // /////////////////////////////////////\n    // afterRead - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRead?.length) {\n      for (const hook of collectionConfig.hooks.afterRead) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: req.context,\n            doc: user,\n            overrideAccess,\n            req,\n          })) || user\n      }\n    }\n\n    let result: LoginResult<TSlug> = {\n      exp,\n      token,\n      user,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'login',\n      overrideAccess: args.overrideAccess!,\n      result,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    return result\n  } catch (error: unknown) {\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user,\n      })\n    }\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","AuthenticationError","LockedAuth","UnverifiedEmail","ValidationError","afterRead","commitTransaction","Forbidden","initTransaction","appendNonTrashedFilter","killTransaction","sanitizeInternalFields","getFieldsToSign","getLoginOptions","isUserLocked","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","incrementLoginAttempts","resetLoginAttempts","checkLoginPermission","loggingInWithUsername","req","user","t","Boolean","Date","lockUntil","loginOperation","incomingArgs","args","collection","config","auth","disableLocalStrategy","operation","overrideAccess","collectionConfig","data","depth","fallbackLocale","locale","payload","secret","showHiddenFields","email","unsanitizedEmail","password","loginWithUsername","sanitizedEmail","toLowerCase","trim","sanitizedUsername","username","canLoginWithEmail","canLoginWithUsername","slug","errors","message","i18n","path","whereConstraint","emailConstraint","equals","usernameConstraint","or","enableTrash","trash","where","db","findOne","_strategy","authResult","doc","maxLoginAttemptsEnabled","maxLoginAttempts","verify","_verified","shouldCommit","sid","loginAttempts","select","id","fieldsToSignArgs","session","fieldsToSign","hooks","beforeLogin","length","hook","context","exp","token","tokenExpiration","afterLogin","draft","undefined","global","result","error"],"mappings":"AAQA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SACEC,mBAAmB,EACnBC,UAAU,EACVC,eAAe,EACfC,eAAe,QACV,wBAAuB;AAC9B,SAASC,SAAS,QAAQ,wCAAuC;AACjE,SAASC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,QAAQ,iBAAgB;AAC9E,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,YAAY,QAAQ,qBAAoB;AACjD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,sBAAsB,QAAQ,gDAA+C;AACtF,SAASC,kBAAkB,QAAQ,4CAA2C;AAuB9E;;;;CAIC,GACD,OAAO,MAAMC,uBAAuB,CAAmC,EACrEC,qBAAqB,EACrBC,GAAG,EACHC,IAAI,EAC4B;IAChC,IAAI,CAACA,MAAM;QACT,MAAM,IAAIvB,oBAAoBsB,IAAIE,CAAC,EAAEC,QAAQJ;IAC/C;IAEA,IAAIR,aAAa,IAAIa,KAAKH,KAAKI,SAAS,IAAI;QAC1C,MAAM,IAAI1B,WAAWqB,IAAIE,CAAC;IAC5B;AACF,EAAC;AAED,OAAO,MAAMI,iBAAiB,OAC5BC;IAEA,IAAIC,OAAOD;IAEX,IAAIC,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAACC,oBAAoB,EAAE;QACpD,MAAM,IAAI5B,UAAUwB,KAAKR,GAAG,CAACE,CAAC;IAChC;IAEA,wCAAwC;IACxC,+BAA+B;IAC/B,wCAAwC;IAExCM,OAAO,MAAM/B,qBAAqB;QAChC+B;QACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;QAClCG,WAAW;QACXC,gBAAgBN,KAAKM,cAAc;IACrC;IAEA,MAAM,EACJL,YAAY,EAAEC,QAAQK,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLH,iBAAiB,KAAK,EACtBd,GAAG,EACHA,KAAK,EACHkB,cAAc,EACdC,MAAM,EACNC,OAAO,EACPA,SAAS,EAAEC,MAAM,EAAE,EACpB,EACDC,gBAAgB,EACjB,GAAGd;IAEJ,wCAAwC;IACxC,QAAQ;IACR,wCAAwC;IAExC,MAAM,EAAEe,OAAOC,gBAAgB,EAAEC,QAAQ,EAAE,GAAGT;IAC9C,MAAMU,oBAAoBX,iBAAiBJ,IAAI,CAACe,iBAAiB;IAEjE,MAAMC,iBACJ,OAAOH,qBAAqB,WAAWA,iBAAiBI,WAAW,GAAGC,IAAI,KAAK;IACjF,MAAMC,oBACJ,cAAcd,QAAQ,OAAOA,MAAMe,aAAa,WAC5Cf,KAAKe,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IAEN,MAAM,EAAEG,iBAAiB,EAAEC,oBAAoB,EAAE,GAAG3C,gBAAgBoC;IAEpE,oDAAoD;IACpD,IAAI,CAACM,qBAAqB,CAACF,mBAAmB;QAC5C,MAAM,IAAIjD,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,oDAAoD;IACpD,IAAI,CAACL,wBAAwB,CAACN,gBAAgB;QAC5C,MAAM,IAAI9C,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAQ;aAAE;QACzE;IACF;IAEA,kEAAkE;IAClE,IAAI,CAACR,qBAAqB,CAACH,gBAAgB;QACzC,MAAM,IAAI9C,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBACN;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAQ;gBAC5D;oBAAEF,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAW;aAChE;QACH;IACF;IAEA,qCAAqC;IACrC,IAAI,OAAOb,aAAa,YAAYA,SAASI,IAAI,OAAO,IAAI;QAC1D,MAAM,IAAIhD,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,IAAIC,kBAAyB,CAAC;IAC9B,MAAMC,kBAAyB;QAC7BjB,OAAO;YACLkB,QAAQd;QACV;IACF;IACA,MAAMe,qBAA4B;QAChCX,UAAU;YACRU,QAAQX;QACV;IACF;IAEA,IAAIE,qBAAqBC,wBAAyBH,CAAAA,qBAAqBH,cAAa,GAAI;QACtF,IAAIG,mBAAmB;YACrBS,kBAAkB;gBAChBI,IAAI;oBACFD;oBACA;wBACEnB,OAAO;4BACLkB,QAAQX;wBACV;oBACF;iBACD;YACH;QACF,OAAO;YACLS,kBAAkB;gBAChBI,IAAI;oBACFH;oBACA;wBACET,UAAU;4BACRU,QAAQd;wBACV;oBACF;iBACD;YACH;QACF;IACF,OAAO,IAAIK,qBAAqBL,gBAAgB;QAC9CY,kBAAkBC;IACpB,OAAO,IAAIP,wBAAwBH,mBAAmB;QACpDS,kBAAkBG;IACpB;IAEA,wBAAwB;IACxBH,kBAAkBrD,uBAAuB;QACvC0D,aAAa7B,iBAAiB8B,KAAK;QACnCA,OAAO;QACPC,OAAOP;IACT;IAEA,IAAItC,OAAQ,MAAMmB,QAAQ2B,EAAE,CAACC,OAAO,CAAY;QAC9CvC,YAAYM,iBAAiBmB,IAAI;QACjClC;QACA8C,OAAOP;IACT;IAEAzC,qBAAqB;QACnBC,uBAAuBI,QAAQ8B,wBAAwBH;QACvD9B;QACAC;IACF;IAEAA,KAAKQ,UAAU,GAAGM,iBAAiBmB,IAAI;IACvCjC,KAAKgD,SAAS,GAAG;IAEjB,MAAMC,aAAa,MAAMvD,0BAA0B;QAAEwD,KAAKlD;QAAMwB;IAAS;IACzExB,OAAOb,uBAAuBa;IAE9B,MAAMmD,0BAA0B5C,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAAC0C,gBAAgB,GAAG;IAE/E,IAAI,CAACH,YAAY;QACf,IAAIE,yBAAyB;YAC3B,MAAMxD,uBAAuB;gBAC3Ba,YAAYM;gBACZK,SAASpB,IAAIoB,OAAO;gBACpBnB;YACF;YAEA,6GAA6G;YAC7GH,qBAAqB;gBACnBC,uBAAuBI,QAAQ8B,wBAAwBH;gBACvD9B;gBACAC;YACF;QACF;QAEA,MAAM,IAAIvB,oBAAoBsB,IAAIE,CAAC;IACrC;IAEA,IAAIa,iBAAiBJ,IAAI,CAAC2C,MAAM,IAAIrD,KAAKsD,SAAS,KAAK,OAAO;QAC5D,MAAM,IAAI3E,gBAAgB;YAAEsB,GAAGF,IAAIE,CAAC;QAAC;IACvC;IAEA,yEAAyE;IACzE,MAAMsD,eAAe,MAAMvE,gBAAgBuB,KAAKR,GAAG;IACnD,IAAIyD;IAEJ,IAAI;QACF;;;KAGC,GACD,IAAIL,yBAAyB;YAC3B,MAAM,EAAE/C,SAAS,EAAEqD,aAAa,EAAE,GAAI,MAAMtC,QAAQ2B,EAAE,CAACC,OAAO,CAAY;gBACxEvC,YAAYM,iBAAiBmB,IAAI;gBACjClC;gBACA2D,QAAQ;oBACNtD,WAAW;oBACXqD,eAAe;gBACjB;gBACAZ,OAAO;oBAAEc,IAAI;wBAAEnB,QAAQxC,KAAK2D,EAAE;oBAAC;gBAAE;YACnC;YAEA3D,KAAKI,SAAS,GAAGA;YACjBJ,KAAKyD,aAAa,GAAGA;YAErB5D,qBAAqB;gBACnBE;gBACAC;YACF;QACF;QAEA,MAAM4D,mBAA0D;YAC9D9C;YACAQ,OAAOI;YACP1B;QACF;QAEA,MAAM6D,UAAU,MAAMrE,iBAAiB;YACrCsB;YACAK;YACApB;YACAC;QACF;QACAwD,MAAMK,QAAQL,GAAG;QAEjB,IAAIA,KAAK;YACPI,iBAAiBJ,GAAG,GAAGA;QACzB;QAEA,MAAMM,eAAe1E,gBAAgBwE;QAErC,IAAIT,yBAAyB;YAC3B,MAAMvD,mBAAmB;gBACvBY,YAAYM;gBACZoC,KAAKlD;gBACLmB,SAASpB,IAAIoB,OAAO;gBACpBpB;YACF;QACF;QAEA,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAIe,iBAAiBiD,KAAK,EAAEC,aAAaC,QAAQ;YAC/C,KAAK,MAAMC,QAAQpD,iBAAiBiD,KAAK,CAACC,WAAW,CAAE;gBACrDhE,OACE,AAAC,MAAMkE,KAAK;oBACV1D,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B0D,SAAS5D,KAAKR,GAAG,CAACoE,OAAO;oBACzBpE,KAAKQ,KAAKR,GAAG;oBACbC;gBACF,MAAOA;YACX;QACF;QAEA,MAAM,EAAEoE,GAAG,EAAEC,KAAK,EAAE,GAAG,MAAM9E,QAAQ;YACnCuE;YACA1C;YACAkD,iBAAiBxD,iBAAiBJ,IAAI,CAAC4D,eAAe;QACxD;QAEAvE,IAAIC,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIc,iBAAiBiD,KAAK,EAAEQ,YAAYN,QAAQ;YAC9C,KAAK,MAAMC,QAAQpD,iBAAiBiD,KAAK,CAACQ,UAAU,CAAE;gBACpDvE,OACE,AAAC,MAAMkE,KAAK;oBACV1D,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B0D,SAAS5D,KAAKR,GAAG,CAACoE,OAAO;oBACzBpE,KAAKQ,KAAKR,GAAG;oBACbsE;oBACArE;gBACF,MAAOA;YACX;QACF;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExCA,OAAO,MAAMnB,UAAU;YACrB2B,YAAYM;YACZqD,SAASpE,IAAIoE,OAAO;YACpBnD,OAAOA;YACPkC,KAAKlD;YACL,oFAAoF;YACpFwE,OAAOC;YACPxD,gBAAgBA;YAChByD,QAAQ;YACRxD,QAAQA;YACRL;YACAd;YACAsB,kBAAkBA;QACpB;QAEA,wCAAwC;QACxC,yBAAyB;QACzB,wCAAwC;QAExC,IAAIP,iBAAiBiD,KAAK,EAAElF,WAAWoF,QAAQ;YAC7C,KAAK,MAAMC,QAAQpD,iBAAiBiD,KAAK,CAAClF,SAAS,CAAE;gBACnDmB,OACE,AAAC,MAAMkE,KAAK;oBACV1D,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B0D,SAASpE,IAAIoE,OAAO;oBACpBjB,KAAKlD;oBACLa;oBACAd;gBACF,MAAOC;YACX;QACF;QAEA,IAAI2E,SAA6B;YAC/BP;YACAC;YACArE;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC2E,SAAS,MAAMpG,oBAAoB;YACjCgC;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BG,WAAW;YACXC,gBAAgBN,KAAKM,cAAc;YACnC8D;QACF;QAEA,IAAIpB,cAAc;YAChB,MAAMzE,kBAAkBiB;QAC1B;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,OAAO4E;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAIpB,KAAK;YACP,MAAM/D,cAAc;gBAClBqB;gBACAK;gBACApB;gBACAyD;gBACAxD;YACF;QACF;QACA,MAAMd,gBAAgBqB,KAAKR,GAAG;QAC9B,MAAM6E;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/login.ts"],"sourcesContent":["import type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n  DataFromCollectionSlug,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, AuthenticatedUser, User } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\nimport type { AuthRuntimeFields } from '../types.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport {\n  AuthenticationError,\n  LockedAuth,\n  UnverifiedEmail,\n  ValidationError,\n} from '../../errors/index.js'\nimport { afterRead } from '../../fields/hooks/afterRead/index.js'\nimport { commitTransaction, Forbidden, initTransaction } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { isUserLocked } from '../isUserLocked.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { incrementLoginAttempts } from '../strategies/local/incrementLoginAttempts.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type LoginResult<TSlug extends AuthCollectionSlug> = {\n  exp?: number\n  token?: string\n  user?: AuthRuntimeFields & DataFromCollectionSlug<TSlug>\n}\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['login']\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n  showHiddenFields?: boolean\n}\n\ntype CheckLoginPermissionArgs<TSlug extends AuthCollectionSlug> = {\n  loggingInWithUsername?: boolean\n  req: PayloadRequest\n  user: DataFromCollectionSlug<TSlug>\n}\n\n/**\n * Throws an error if the user is locked or does not exist.\n * This does not check the login attempts, only the lock status. Whoever increments login attempts\n * is responsible for locking the user properly, not whoever checks the login permission.\n */\nexport const checkLoginPermission = <TSlug extends AuthCollectionSlug>({\n  loggingInWithUsername,\n  req,\n  user,\n}: CheckLoginPermissionArgs<TSlug>) => {\n  if (!user) {\n    throw new AuthenticationError(req.t, Boolean(loggingInWithUsername))\n  }\n\n  if (isUserLocked(new Date(user.lockUntil))) {\n    throw new LockedAuth(req.t)\n  }\n}\n\nexport const loginOperation = async <TSlug extends AuthCollectionSlug>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<LoginResult<TSlug>> => {\n  let args = incomingArgs\n\n  if (args.collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(args.req.t)\n  }\n\n  // /////////////////////////////////////\n  // beforeOperation - Collection\n  // /////////////////////////////////////\n\n  args = await buildBeforeOperation({\n    args,\n    collection: args.collection.config,\n    operation: 'login',\n    overrideAccess: args.overrideAccess!,\n  })\n\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess = false,\n    req,\n    req: {\n      fallbackLocale,\n      locale,\n      payload,\n      payload: { secret },\n    },\n    showHiddenFields,\n  } = args\n\n  // /////////////////////////////////////\n  // Login\n  // /////////////////////////////////////\n\n  const { email: unsanitizedEmail, password } = data\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const sanitizedEmail =\n    typeof unsanitizedEmail === 'string' ? unsanitizedEmail.toLowerCase().trim() : null\n  const sanitizedUsername =\n    'username' in data && typeof data?.username === 'string'\n      ? data.username.toLowerCase().trim()\n      : null\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  // cannot login with email, did not provide username\n  if (!canLoginWithEmail && !sanitizedUsername) {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [{ message: req.i18n.t('validation:required'), path: 'username' }],\n    })\n  }\n\n  // cannot login with username, did not provide email\n  if (!canLoginWithUsername && !sanitizedEmail) {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [{ message: req.i18n.t('validation:required'), path: 'email' }],\n    })\n  }\n\n  // can login with either email or username, did not provide either\n  if (!sanitizedUsername && !sanitizedEmail) {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [\n        { message: req.i18n.t('validation:required'), path: 'email' },\n        { message: req.i18n.t('validation:required'), path: 'username' },\n      ],\n    })\n  }\n\n  // did not provide password for login\n  if (typeof password !== 'string' || password.trim() === '') {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [{ message: req.i18n.t('validation:required'), path: 'password' }],\n    })\n  }\n\n  let whereConstraint: Where = {}\n  const emailConstraint: Where = {\n    email: {\n      equals: sanitizedEmail,\n    },\n  }\n  const usernameConstraint: Where = {\n    username: {\n      equals: sanitizedUsername,\n    },\n  }\n\n  if (canLoginWithEmail && canLoginWithUsername && (sanitizedUsername || sanitizedEmail)) {\n    if (sanitizedUsername) {\n      whereConstraint = {\n        or: [\n          usernameConstraint,\n          {\n            email: {\n              equals: sanitizedUsername,\n            },\n          },\n        ],\n      }\n    } else {\n      whereConstraint = {\n        or: [\n          emailConstraint,\n          {\n            username: {\n              equals: sanitizedEmail,\n            },\n          },\n        ],\n      }\n    }\n  } else if (canLoginWithEmail && sanitizedEmail) {\n    whereConstraint = emailConstraint\n  } else if (canLoginWithUsername && sanitizedUsername) {\n    whereConstraint = usernameConstraint\n  }\n\n  // Exclude trashed users\n  whereConstraint = appendNonTrashedFilter({\n    enableTrash: collectionConfig.trash,\n    trash: false,\n    where: whereConstraint,\n  })\n\n  let user = (await payload.db.findOne<User>({\n    collection: collectionConfig.slug,\n    req,\n    where: whereConstraint,\n  })) as AuthenticatedUser\n\n  checkLoginPermission({\n    loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n    req,\n    user,\n  })\n\n  user.collection = collectionConfig.slug\n  user._strategy = 'local-jwt'\n\n  const authResult = await authenticateLocalStrategy({ doc: user, password })\n  user = sanitizeInternalFields(user)\n\n  const maxLoginAttemptsEnabled = args.collection.config.auth.maxLoginAttempts > 0\n\n  if (!authResult) {\n    if (maxLoginAttemptsEnabled) {\n      await incrementLoginAttempts({\n        collection: collectionConfig,\n        payload: req.payload,\n        user,\n      })\n\n      // Re-check login permissions and max attempts after incrementing attempts, in case parallel updates occurred\n      checkLoginPermission({\n        loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n        req,\n        user,\n      })\n    }\n\n    throw new AuthenticationError(req.t)\n  }\n\n  if (collectionConfig.auth.verify && user._verified === false) {\n    throw new UnverifiedEmail({ t: req.t })\n  }\n\n  // Authentication successful - start transaction for remaining operations\n  const shouldCommit = await initTransaction(args.req)\n  let sid: string | undefined\n\n  try {\n    /*\n     * Correct password accepted - re‑check that the account didn't\n     * get locked by parallel bad attempts in the meantime.\n     */\n    if (maxLoginAttemptsEnabled) {\n      const { lockUntil, loginAttempts } = (await payload.db.findOne<User>({\n        collection: collectionConfig.slug,\n        req,\n        select: {\n          lockUntil: true,\n          loginAttempts: true,\n        },\n        where: { id: { equals: user.id } },\n      }))!\n\n      user.lockUntil = lockUntil\n      user.loginAttempts = loginAttempts\n\n      checkLoginPermission({\n        req,\n        user,\n      })\n    }\n\n    const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n      collectionConfig,\n      email: sanitizedEmail!,\n      user,\n    }\n\n    const session = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req,\n      user,\n    })\n    sid = session.sid\n\n    if (sid) {\n      fieldsToSignArgs.sid = sid\n    }\n\n    const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n    if (maxLoginAttemptsEnabled) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n    }\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            user,\n          })) || user\n      }\n    }\n\n    const { exp, token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: collectionConfig.auth.tokenExpiration,\n    })\n\n    req.user = user\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            token,\n            user,\n          })) || user\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterRead - Fields\n    // /////////////////////////////////////\n\n    user = await afterRead({\n      collection: collectionConfig,\n      context: req.context,\n      depth: depth!,\n      doc: user,\n      // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n      draft: undefined,\n      fallbackLocale: fallbackLocale!,\n      global: null,\n      locale: locale!,\n      overrideAccess,\n      req,\n      showHiddenFields: showHiddenFields!,\n    })\n\n    // /////////////////////////////////////\n    // afterRead - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRead?.length) {\n      for (const hook of collectionConfig.hooks.afterRead) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: req.context,\n            doc: user,\n            overrideAccess,\n            req,\n          })) || user\n      }\n    }\n\n    let result: LoginResult<TSlug> = {\n      exp,\n      token,\n      user,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'login',\n      overrideAccess: args.overrideAccess!,\n      result,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    return result\n  } catch (error: unknown) {\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user,\n      })\n    }\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","AuthenticationError","LockedAuth","UnverifiedEmail","ValidationError","afterRead","commitTransaction","Forbidden","initTransaction","appendNonTrashedFilter","killTransaction","sanitizeInternalFields","getFieldsToSign","getLoginOptions","isUserLocked","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","incrementLoginAttempts","resetLoginAttempts","checkLoginPermission","loggingInWithUsername","req","user","t","Boolean","Date","lockUntil","loginOperation","incomingArgs","args","collection","config","auth","disableLocalStrategy","operation","overrideAccess","collectionConfig","data","depth","fallbackLocale","locale","payload","secret","showHiddenFields","email","unsanitizedEmail","password","loginWithUsername","sanitizedEmail","toLowerCase","trim","sanitizedUsername","username","canLoginWithEmail","canLoginWithUsername","slug","errors","message","i18n","path","whereConstraint","emailConstraint","equals","usernameConstraint","or","enableTrash","trash","where","db","findOne","_strategy","authResult","doc","maxLoginAttemptsEnabled","maxLoginAttempts","verify","_verified","shouldCommit","sid","loginAttempts","select","id","fieldsToSignArgs","session","fieldsToSign","hooks","beforeLogin","length","hook","context","exp","token","tokenExpiration","afterLogin","draft","undefined","global","result","error"],"mappings":"AASA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SACEC,mBAAmB,EACnBC,UAAU,EACVC,eAAe,EACfC,eAAe,QACV,wBAAuB;AAC9B,SAASC,SAAS,QAAQ,wCAAuC;AACjE,SAASC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,QAAQ,iBAAgB;AAC9E,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,YAAY,QAAQ,qBAAoB;AACjD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,sBAAsB,QAAQ,gDAA+C;AACtF,SAASC,kBAAkB,QAAQ,4CAA2C;AAuB9E;;;;CAIC,GACD,OAAO,MAAMC,uBAAuB,CAAmC,EACrEC,qBAAqB,EACrBC,GAAG,EACHC,IAAI,EAC4B;IAChC,IAAI,CAACA,MAAM;QACT,MAAM,IAAIvB,oBAAoBsB,IAAIE,CAAC,EAAEC,QAAQJ;IAC/C;IAEA,IAAIR,aAAa,IAAIa,KAAKH,KAAKI,SAAS,IAAI;QAC1C,MAAM,IAAI1B,WAAWqB,IAAIE,CAAC;IAC5B;AACF,EAAC;AAED,OAAO,MAAMI,iBAAiB,OAC5BC;IAEA,IAAIC,OAAOD;IAEX,IAAIC,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAACC,oBAAoB,EAAE;QACpD,MAAM,IAAI5B,UAAUwB,KAAKR,GAAG,CAACE,CAAC;IAChC;IAEA,wCAAwC;IACxC,+BAA+B;IAC/B,wCAAwC;IAExCM,OAAO,MAAM/B,qBAAqB;QAChC+B;QACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;QAClCG,WAAW;QACXC,gBAAgBN,KAAKM,cAAc;IACrC;IAEA,MAAM,EACJL,YAAY,EAAEC,QAAQK,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLH,iBAAiB,KAAK,EACtBd,GAAG,EACHA,KAAK,EACHkB,cAAc,EACdC,MAAM,EACNC,OAAO,EACPA,SAAS,EAAEC,MAAM,EAAE,EACpB,EACDC,gBAAgB,EACjB,GAAGd;IAEJ,wCAAwC;IACxC,QAAQ;IACR,wCAAwC;IAExC,MAAM,EAAEe,OAAOC,gBAAgB,EAAEC,QAAQ,EAAE,GAAGT;IAC9C,MAAMU,oBAAoBX,iBAAiBJ,IAAI,CAACe,iBAAiB;IAEjE,MAAMC,iBACJ,OAAOH,qBAAqB,WAAWA,iBAAiBI,WAAW,GAAGC,IAAI,KAAK;IACjF,MAAMC,oBACJ,cAAcd,QAAQ,OAAOA,MAAMe,aAAa,WAC5Cf,KAAKe,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IAEN,MAAM,EAAEG,iBAAiB,EAAEC,oBAAoB,EAAE,GAAG3C,gBAAgBoC;IAEpE,oDAAoD;IACpD,IAAI,CAACM,qBAAqB,CAACF,mBAAmB;QAC5C,MAAM,IAAIjD,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,oDAAoD;IACpD,IAAI,CAACL,wBAAwB,CAACN,gBAAgB;QAC5C,MAAM,IAAI9C,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAQ;aAAE;QACzE;IACF;IAEA,kEAAkE;IAClE,IAAI,CAACR,qBAAqB,CAACH,gBAAgB;QACzC,MAAM,IAAI9C,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBACN;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAQ;gBAC5D;oBAAEF,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAW;aAChE;QACH;IACF;IAEA,qCAAqC;IACrC,IAAI,OAAOb,aAAa,YAAYA,SAASI,IAAI,OAAO,IAAI;QAC1D,MAAM,IAAIhD,gBAAgB;YACxB4B,YAAYM,iBAAiBmB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASpC,IAAIqC,IAAI,CAACnC,CAAC,CAAC;oBAAwBoC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,IAAIC,kBAAyB,CAAC;IAC9B,MAAMC,kBAAyB;QAC7BjB,OAAO;YACLkB,QAAQd;QACV;IACF;IACA,MAAMe,qBAA4B;QAChCX,UAAU;YACRU,QAAQX;QACV;IACF;IAEA,IAAIE,qBAAqBC,wBAAyBH,CAAAA,qBAAqBH,cAAa,GAAI;QACtF,IAAIG,mBAAmB;YACrBS,kBAAkB;gBAChBI,IAAI;oBACFD;oBACA;wBACEnB,OAAO;4BACLkB,QAAQX;wBACV;oBACF;iBACD;YACH;QACF,OAAO;YACLS,kBAAkB;gBAChBI,IAAI;oBACFH;oBACA;wBACET,UAAU;4BACRU,QAAQd;wBACV;oBACF;iBACD;YACH;QACF;IACF,OAAO,IAAIK,qBAAqBL,gBAAgB;QAC9CY,kBAAkBC;IACpB,OAAO,IAAIP,wBAAwBH,mBAAmB;QACpDS,kBAAkBG;IACpB;IAEA,wBAAwB;IACxBH,kBAAkBrD,uBAAuB;QACvC0D,aAAa7B,iBAAiB8B,KAAK;QACnCA,OAAO;QACPC,OAAOP;IACT;IAEA,IAAItC,OAAQ,MAAMmB,QAAQ2B,EAAE,CAACC,OAAO,CAAO;QACzCvC,YAAYM,iBAAiBmB,IAAI;QACjClC;QACA8C,OAAOP;IACT;IAEAzC,qBAAqB;QACnBC,uBAAuBI,QAAQ8B,wBAAwBH;QACvD9B;QACAC;IACF;IAEAA,KAAKQ,UAAU,GAAGM,iBAAiBmB,IAAI;IACvCjC,KAAKgD,SAAS,GAAG;IAEjB,MAAMC,aAAa,MAAMvD,0BAA0B;QAAEwD,KAAKlD;QAAMwB;IAAS;IACzExB,OAAOb,uBAAuBa;IAE9B,MAAMmD,0BAA0B5C,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAAC0C,gBAAgB,GAAG;IAE/E,IAAI,CAACH,YAAY;QACf,IAAIE,yBAAyB;YAC3B,MAAMxD,uBAAuB;gBAC3Ba,YAAYM;gBACZK,SAASpB,IAAIoB,OAAO;gBACpBnB;YACF;YAEA,6GAA6G;YAC7GH,qBAAqB;gBACnBC,uBAAuBI,QAAQ8B,wBAAwBH;gBACvD9B;gBACAC;YACF;QACF;QAEA,MAAM,IAAIvB,oBAAoBsB,IAAIE,CAAC;IACrC;IAEA,IAAIa,iBAAiBJ,IAAI,CAAC2C,MAAM,IAAIrD,KAAKsD,SAAS,KAAK,OAAO;QAC5D,MAAM,IAAI3E,gBAAgB;YAAEsB,GAAGF,IAAIE,CAAC;QAAC;IACvC;IAEA,yEAAyE;IACzE,MAAMsD,eAAe,MAAMvE,gBAAgBuB,KAAKR,GAAG;IACnD,IAAIyD;IAEJ,IAAI;QACF;;;KAGC,GACD,IAAIL,yBAAyB;YAC3B,MAAM,EAAE/C,SAAS,EAAEqD,aAAa,EAAE,GAAI,MAAMtC,QAAQ2B,EAAE,CAACC,OAAO,CAAO;gBACnEvC,YAAYM,iBAAiBmB,IAAI;gBACjClC;gBACA2D,QAAQ;oBACNtD,WAAW;oBACXqD,eAAe;gBACjB;gBACAZ,OAAO;oBAAEc,IAAI;wBAAEnB,QAAQxC,KAAK2D,EAAE;oBAAC;gBAAE;YACnC;YAEA3D,KAAKI,SAAS,GAAGA;YACjBJ,KAAKyD,aAAa,GAAGA;YAErB5D,qBAAqB;gBACnBE;gBACAC;YACF;QACF;QAEA,MAAM4D,mBAA0D;YAC9D9C;YACAQ,OAAOI;YACP1B;QACF;QAEA,MAAM6D,UAAU,MAAMrE,iBAAiB;YACrCsB;YACAK;YACApB;YACAC;QACF;QACAwD,MAAMK,QAAQL,GAAG;QAEjB,IAAIA,KAAK;YACPI,iBAAiBJ,GAAG,GAAGA;QACzB;QAEA,MAAMM,eAAe1E,gBAAgBwE;QAErC,IAAIT,yBAAyB;YAC3B,MAAMvD,mBAAmB;gBACvBY,YAAYM;gBACZoC,KAAKlD;gBACLmB,SAASpB,IAAIoB,OAAO;gBACpBpB;YACF;QACF;QAEA,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAIe,iBAAiBiD,KAAK,EAAEC,aAAaC,QAAQ;YAC/C,KAAK,MAAMC,QAAQpD,iBAAiBiD,KAAK,CAACC,WAAW,CAAE;gBACrDhE,OACE,AAAC,MAAMkE,KAAK;oBACV1D,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B0D,SAAS5D,KAAKR,GAAG,CAACoE,OAAO;oBACzBpE,KAAKQ,KAAKR,GAAG;oBACbC;gBACF,MAAOA;YACX;QACF;QAEA,MAAM,EAAEoE,GAAG,EAAEC,KAAK,EAAE,GAAG,MAAM9E,QAAQ;YACnCuE;YACA1C;YACAkD,iBAAiBxD,iBAAiBJ,IAAI,CAAC4D,eAAe;QACxD;QAEAvE,IAAIC,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIc,iBAAiBiD,KAAK,EAAEQ,YAAYN,QAAQ;YAC9C,KAAK,MAAMC,QAAQpD,iBAAiBiD,KAAK,CAACQ,UAAU,CAAE;gBACpDvE,OACE,AAAC,MAAMkE,KAAK;oBACV1D,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B0D,SAAS5D,KAAKR,GAAG,CAACoE,OAAO;oBACzBpE,KAAKQ,KAAKR,GAAG;oBACbsE;oBACArE;gBACF,MAAOA;YACX;QACF;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExCA,OAAO,MAAMnB,UAAU;YACrB2B,YAAYM;YACZqD,SAASpE,IAAIoE,OAAO;YACpBnD,OAAOA;YACPkC,KAAKlD;YACL,oFAAoF;YACpFwE,OAAOC;YACPxD,gBAAgBA;YAChByD,QAAQ;YACRxD,QAAQA;YACRL;YACAd;YACAsB,kBAAkBA;QACpB;QAEA,wCAAwC;QACxC,yBAAyB;QACzB,wCAAwC;QAExC,IAAIP,iBAAiBiD,KAAK,EAAElF,WAAWoF,QAAQ;YAC7C,KAAK,MAAMC,QAAQpD,iBAAiBiD,KAAK,CAAClF,SAAS,CAAE;gBACnDmB,OACE,AAAC,MAAMkE,KAAK;oBACV1D,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B0D,SAASpE,IAAIoE,OAAO;oBACpBjB,KAAKlD;oBACLa;oBACAd;gBACF,MAAOC;YACX;QACF;QAEA,IAAI2E,SAA6B;YAC/BP;YACAC;YACArE;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC2E,SAAS,MAAMpG,oBAAoB;YACjCgC;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BG,WAAW;YACXC,gBAAgBN,KAAKM,cAAc;YACnC8D;QACF;QAEA,IAAIpB,cAAc;YAChB,MAAMzE,kBAAkBiB;QAC1B;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,OAAO4E;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAIpB,KAAK;YACP,MAAM/D,cAAc;gBAClBqB;gBACAK;gBACApB;gBACAyD;gBACAxD;YACF;QACF;QACA,MAAMd,gBAAgBqB,KAAKR,GAAG;QAC9B,MAAM6E;IACR;AACF,EAAC"}

package/dist/auth/operations/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/logout.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,cAAc,SAAS,KAAG,OAAO,CAAC,OAAO,CAqF9E,CAAA"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/logout.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,iBAAwB,SAAS,KAAG,OAAO,CAAC,OAAO,CAqF9E,CAAA"}

package/dist/auth/operations/me.d.ts

@@ -1,18 +1,11 @@
 import type { Collection } from '../../collections/config/types.js';
+import type { AuthenticatedUser } from '../../index.js';
 import type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../types/index.js';
-import type { ClientUser } from '../types.js';
 export type MeOperationResult = {
     collection?: string;
     exp?: number;
-    /** @deprecated
-     * use:
-     * ```ts
-     * user._strategy
-     * ```
-     */
-    strategy?: string;
     token?: string;
-    user?: ClientUser;
+    user?: AuthenticatedUser | null;
 };
 export type Arguments = {
     collection: Collection;

package/dist/auth/operations/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/me.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,WAAW,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,iBAAiB,CA2F5E,CAAA"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/me.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAE/F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,WAAW,SAAgB,SAAS,KAAG,OAAO,CAAC,iBAAiB,CAoF5E,CAAA"}

package/dist/auth/operations/me.js

@@ -43,12 +43,6 @@ export const meOperation = async (args)=>{
             }
         }
         result.collection = req.user.collection;
-        /** @deprecated
-     * use:
-     * ```ts
-     * user._strategy
-     * ```
-     */ result.strategy = req.user._strategy;
         if (!result.user) {
             result.user = user;
             if (currentToken) {

package/dist/auth/operations/me.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/me.ts"],"sourcesContent":["import { decodeJwt } from 'jose'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { TypedUser } from '../../index.js'\nimport type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../types/index.js'\nimport type { ClientUser } from '../types.js'\n\nexport type MeOperationResult = {\n  collection?: string\n  exp?: number\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  token?: string\n  user?: ClientUser\n}\n\nexport type Arguments = {\n  collection: Collection\n  currentToken?: string\n  depth?: number\n  draft?: boolean\n  joins?: JoinQuery\n  populate?: PopulateType\n  req: PayloadRequest\n  select?: SelectType\n}\n\nexport const meOperation = async (args: Arguments): Promise<MeOperationResult> => {\n  const { collection, currentToken, depth, draft, joins, populate, req, select } = args\n\n  let result: MeOperationResult = {\n    user: null!,\n  }\n\n  if (req.user) {\n    if (req.user.collection !== collection.config.slug) {\n      return {\n        user: null!,\n      }\n    }\n\n    const { pathname } = req\n    const isGraphQL = pathname === `/api${req.payload.config.routes.graphQL}`\n\n    const user = (await req.payload.findByID({\n      id: req.user.id,\n      collection: collection.config.slug,\n      depth: isGraphQL ? 0 : (depth ?? collection.config.auth.depth),\n      draft,\n      joins,\n      overrideAccess: false,\n      populate,\n      req,\n      select,\n      showHiddenFields: false,\n    })) as TypedUser\n\n    if (user) {\n      user.collection = collection.config.slug\n      user._strategy = req.user._strategy\n    }\n\n    // /////////////////////////////////////\n    // me hook - Collection\n    // /////////////////////////////////////\n\n    for (const meHook of collection.config.hooks.me) {\n      const hookResult = await meHook({ args, user })\n\n      if (hookResult) {\n        result.user = hookResult.user\n        result.exp = hookResult.exp\n\n        break\n      }\n    }\n\n    result.collection = req.user.collection\n    /** @deprecated\n     * use:\n     * ```ts\n     * user._strategy\n     * ```\n     */\n    result.strategy = req.user._strategy\n\n    if (!result.user) {\n      result.user = user\n\n      if (currentToken) {\n        const decoded = decodeJwt(currentToken)\n        if (decoded) {\n          result.exp = decoded.exp\n        }\n        if (!collection.config.auth.removeTokenFromResponses) {\n          result.token = currentToken\n        }\n      }\n    }\n  }\n\n  // /////////////////////////////////////\n  // After Me - Collection\n  // /////////////////////////////////////\n\n  if (collection.config.hooks?.afterMe?.length) {\n    for (const hook of collection.config.hooks.afterMe) {\n      result =\n        (await hook({\n          collection: collection?.config,\n          context: req.context,\n          req,\n          response: result,\n        })) || result\n    }\n  }\n\n  return result\n}\n"],"names":["decodeJwt","meOperation","args","collection","currentToken","depth","draft","joins","populate","req","select","result","user","config","slug","pathname","isGraphQL","payload","routes","graphQL","findByID","id","auth","overrideAccess","showHiddenFields","_strategy","meHook","hooks","me","hookResult","exp","strategy","decoded","removeTokenFromResponses","token","afterMe","length","hook","context","response"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAgChC,OAAO,MAAMC,cAAc,OAAOC;IAChC,MAAM,EAAEC,UAAU,EAAEC,YAAY,EAAEC,KAAK,EAAEC,KAAK,EAAEC,KAAK,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,MAAM,EAAE,GAAGR;IAEjF,IAAIS,SAA4B;QAC9BC,MAAM;IACR;IAEA,IAAIH,IAAIG,IAAI,EAAE;QACZ,IAAIH,IAAIG,IAAI,CAACT,UAAU,KAAKA,WAAWU,MAAM,CAACC,IAAI,EAAE;YAClD,OAAO;gBACLF,MAAM;YACR;QACF;QAEA,MAAM,EAAEG,QAAQ,EAAE,GAAGN;QACrB,MAAMO,YAAYD,aAAa,CAAC,IAAI,EAAEN,IAAIQ,OAAO,CAACJ,MAAM,CAACK,MAAM,CAACC,OAAO,EAAE;QAEzE,MAAMP,OAAQ,MAAMH,IAAIQ,OAAO,CAACG,QAAQ,CAAC;YACvCC,IAAIZ,IAAIG,IAAI,CAACS,EAAE;YACflB,YAAYA,WAAWU,MAAM,CAACC,IAAI;YAClCT,OAAOW,YAAY,IAAKX,SAASF,WAAWU,MAAM,CAACS,IAAI,CAACjB,KAAK;YAC7DC;YACAC;YACAgB,gBAAgB;YAChBf;YACAC;YACAC;YACAc,kBAAkB;QACpB;QAEA,IAAIZ,MAAM;YACRA,KAAKT,UAAU,GAAGA,WAAWU,MAAM,CAACC,IAAI;YACxCF,KAAKa,SAAS,GAAGhB,IAAIG,IAAI,CAACa,SAAS;QACrC;QAEA,wCAAwC;QACxC,uBAAuB;QACvB,wCAAwC;QAExC,KAAK,MAAMC,UAAUvB,WAAWU,MAAM,CAACc,KAAK,CAACC,EAAE,CAAE;YAC/C,MAAMC,aAAa,MAAMH,OAAO;gBAAExB;gBAAMU;YAAK;YAE7C,IAAIiB,YAAY;gBACdlB,OAAOC,IAAI,GAAGiB,WAAWjB,IAAI;gBAC7BD,OAAOmB,GAAG,GAAGD,WAAWC,GAAG;gBAE3B;YACF;QACF;QAEAnB,OAAOR,UAAU,GAAGM,IAAIG,IAAI,CAACT,UAAU;QACvC;;;;;KAKC,GACDQ,OAAOoB,QAAQ,GAAGtB,IAAIG,IAAI,CAACa,SAAS;QAEpC,IAAI,CAACd,OAAOC,IAAI,EAAE;YAChBD,OAAOC,IAAI,GAAGA;YAEd,IAAIR,cAAc;gBAChB,MAAM4B,UAAUhC,UAAUI;gBAC1B,IAAI4B,SAAS;oBACXrB,OAAOmB,GAAG,GAAGE,QAAQF,GAAG;gBAC1B;gBACA,IAAI,CAAC3B,WAAWU,MAAM,CAACS,IAAI,CAACW,wBAAwB,EAAE;oBACpDtB,OAAOuB,KAAK,GAAG9B;gBACjB;YACF;QACF;IACF;IAEA,wCAAwC;IACxC,wBAAwB;IACxB,wCAAwC;IAExC,IAAID,WAAWU,MAAM,CAACc,KAAK,EAAEQ,SAASC,QAAQ;QAC5C,KAAK,MAAMC,QAAQlC,WAAWU,MAAM,CAACc,KAAK,CAACQ,OAAO,CAAE;YAClDxB,SACE,AAAC,MAAM0B,KAAK;gBACVlC,YAAYA,YAAYU;gBACxByB,SAAS7B,IAAI6B,OAAO;gBACpB7B;gBACA8B,UAAU5B;YACZ,MAAOA;QACX;IACF;IAEA,OAAOA;AACT,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/me.ts"],"sourcesContent":["import { decodeJwt } from 'jose'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../types/index.js'\n\nexport type MeOperationResult = {\n  collection?: string\n  exp?: number\n  token?: string\n  user?: AuthenticatedUser | null\n}\n\nexport type Arguments = {\n  collection: Collection\n  currentToken?: string\n  depth?: number\n  draft?: boolean\n  joins?: JoinQuery\n  populate?: PopulateType\n  req: PayloadRequest\n  select?: SelectType\n}\n\nexport const meOperation = async (args: Arguments): Promise<MeOperationResult> => {\n  const { collection, currentToken, depth, draft, joins, populate, req, select } = args\n\n  let result: MeOperationResult = {\n    user: null!,\n  }\n\n  if (req.user) {\n    if (req.user.collection !== collection.config.slug) {\n      return {\n        user: null!,\n      }\n    }\n\n    const { pathname } = req\n    const isGraphQL = pathname === `/api${req.payload.config.routes.graphQL}`\n\n    const user = (await req.payload.findByID({\n      id: req.user.id,\n      collection: collection.config.slug,\n      depth: isGraphQL ? 0 : (depth ?? collection.config.auth.depth),\n      draft,\n      joins,\n      overrideAccess: false,\n      populate,\n      req,\n      select,\n      showHiddenFields: false,\n    })) as AuthenticatedUser\n\n    if (user) {\n      user.collection = collection.config.slug\n      user._strategy = req.user._strategy\n    }\n\n    // /////////////////////////////////////\n    // me hook - Collection\n    // /////////////////////////////////////\n\n    for (const meHook of collection.config.hooks.me) {\n      const hookResult = await meHook({ args, user })\n\n      if (hookResult) {\n        result.user = hookResult.user\n        result.exp = hookResult.exp\n\n        break\n      }\n    }\n\n    result.collection = req.user.collection\n\n    if (!result.user) {\n      result.user = user\n\n      if (currentToken) {\n        const decoded = decodeJwt(currentToken)\n        if (decoded) {\n          result.exp = decoded.exp\n        }\n        if (!collection.config.auth.removeTokenFromResponses) {\n          result.token = currentToken\n        }\n      }\n    }\n  }\n\n  // /////////////////////////////////////\n  // After Me - Collection\n  // /////////////////////////////////////\n\n  if (collection.config.hooks?.afterMe?.length) {\n    for (const hook of collection.config.hooks.afterMe) {\n      result =\n        (await hook({\n          collection: collection?.config,\n          context: req.context,\n          req,\n          response: result,\n        })) || result\n    }\n  }\n\n  return result\n}\n"],"names":["decodeJwt","meOperation","args","collection","currentToken","depth","draft","joins","populate","req","select","result","user","config","slug","pathname","isGraphQL","payload","routes","graphQL","findByID","id","auth","overrideAccess","showHiddenFields","_strategy","meHook","hooks","me","hookResult","exp","decoded","removeTokenFromResponses","token","afterMe","length","hook","context","response"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAwBhC,OAAO,MAAMC,cAAc,OAAOC;IAChC,MAAM,EAAEC,UAAU,EAAEC,YAAY,EAAEC,KAAK,EAAEC,KAAK,EAAEC,KAAK,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,MAAM,EAAE,GAAGR;IAEjF,IAAIS,SAA4B;QAC9BC,MAAM;IACR;IAEA,IAAIH,IAAIG,IAAI,EAAE;QACZ,IAAIH,IAAIG,IAAI,CAACT,UAAU,KAAKA,WAAWU,MAAM,CAACC,IAAI,EAAE;YAClD,OAAO;gBACLF,MAAM;YACR;QACF;QAEA,MAAM,EAAEG,QAAQ,EAAE,GAAGN;QACrB,MAAMO,YAAYD,aAAa,CAAC,IAAI,EAAEN,IAAIQ,OAAO,CAACJ,MAAM,CAACK,MAAM,CAACC,OAAO,EAAE;QAEzE,MAAMP,OAAQ,MAAMH,IAAIQ,OAAO,CAACG,QAAQ,CAAC;YACvCC,IAAIZ,IAAIG,IAAI,CAACS,EAAE;YACflB,YAAYA,WAAWU,MAAM,CAACC,IAAI;YAClCT,OAAOW,YAAY,IAAKX,SAASF,WAAWU,MAAM,CAACS,IAAI,CAACjB,KAAK;YAC7DC;YACAC;YACAgB,gBAAgB;YAChBf;YACAC;YACAC;YACAc,kBAAkB;QACpB;QAEA,IAAIZ,MAAM;YACRA,KAAKT,UAAU,GAAGA,WAAWU,MAAM,CAACC,IAAI;YACxCF,KAAKa,SAAS,GAAGhB,IAAIG,IAAI,CAACa,SAAS;QACrC;QAEA,wCAAwC;QACxC,uBAAuB;QACvB,wCAAwC;QAExC,KAAK,MAAMC,UAAUvB,WAAWU,MAAM,CAACc,KAAK,CAACC,EAAE,CAAE;YAC/C,MAAMC,aAAa,MAAMH,OAAO;gBAAExB;gBAAMU;YAAK;YAE7C,IAAIiB,YAAY;gBACdlB,OAAOC,IAAI,GAAGiB,WAAWjB,IAAI;gBAC7BD,OAAOmB,GAAG,GAAGD,WAAWC,GAAG;gBAE3B;YACF;QACF;QAEAnB,OAAOR,UAAU,GAAGM,IAAIG,IAAI,CAACT,UAAU;QAEvC,IAAI,CAACQ,OAAOC,IAAI,EAAE;YAChBD,OAAOC,IAAI,GAAGA;YAEd,IAAIR,cAAc;gBAChB,MAAM2B,UAAU/B,UAAUI;gBAC1B,IAAI2B,SAAS;oBACXpB,OAAOmB,GAAG,GAAGC,QAAQD,GAAG;gBAC1B;gBACA,IAAI,CAAC3B,WAAWU,MAAM,CAACS,IAAI,CAACU,wBAAwB,EAAE;oBACpDrB,OAAOsB,KAAK,GAAG7B;gBACjB;YACF;QACF;IACF;IAEA,wCAAwC;IACxC,wBAAwB;IACxB,wCAAwC;IAExC,IAAID,WAAWU,MAAM,CAACc,KAAK,EAAEO,SAASC,QAAQ;QAC5C,KAAK,MAAMC,QAAQjC,WAAWU,MAAM,CAACc,KAAK,CAACO,OAAO,CAAE;YAClDvB,SACE,AAAC,MAAMyB,KAAK;gBACVjC,YAAYA,YAAYU;gBACxBwB,SAAS5B,IAAI4B,OAAO;gBACpB5B;gBACA6B,UAAU3B;YACZ,MAAOA;QACX;IACF;IAEA,OAAOA;AACT,EAAC"}

package/dist/auth/operations/refresh.d.ts

@@ -4,13 +4,6 @@ export type Result = {
     exp: number;
     refreshedToken: string;
     setCookie?: boolean;
-    /** @deprecated
-     * use:
-     * ```ts
-     * user._strategy
-     * ```
-     */
-    strategy?: string;
     user: Document;
 };
 export type Arguments = {

package/dist/auth/operations/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAYpE,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,cAAc,SAAS,KAAG,OAAO,CAAC,MAAM,CAyK9E,CAAA"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAYpE,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,iBAAwB,SAAS,KAAG,OAAO,CAAC,MAAM,CAyK9E,CAAA"}

package/dist/auth/operations/refresh.js

@@ -38,23 +38,29 @@ export const refreshOperation = async (incomingArgs)=>{
                 }
             }
         });
+        if (!user) {
+            throw new Forbidden(args.req.t);
+        }
         const sid = args.req.user._sid;
         if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {
             if (!Array.isArray(user.sessions) || !sid) {
                 throw new Forbidden(args.req.t);
             }
             const existingSession = user.sessions.find(({ id })=>id === sid);
+            if (!existingSession) {
+                throw new Forbidden(args.req.t);
+            }
             const now = new Date();
             const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000;
             existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs);
-            // Prevent updatedAt from being updated when only refreshing a session
-            user.updatedAt = null;
             await req.payload.db.updateOne({
                 id: user.id,
                 collection: collectionConfig.slug,
                 data: {
                     ...user,
-                    sessions: removeExpiredSessions(user.sessions)
+                    // Prevent updatedAt from being updated when only refreshing a session
+                    sessions: removeExpiredSessions(user.sessions),
+                    updatedAt: null
                 },
                 req,
                 returning: false
@@ -100,12 +106,6 @@ export const refreshOperation = async (incomingArgs)=>{
                 exp,
                 refreshedToken,
                 setCookie: true,
-                /** @deprecated
-         * use:
-         * ```ts
-         * user._strategy
-         * ```
-         */ strategy: args.req.user._strategy,
                 user
             };
         }

package/dist/auth/operations/refresh.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { Forbidden } from '../../errors/index.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n  exp: number\n  refreshedToken: string\n  setCookie?: boolean\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  user: Document\n}\n\nexport type Arguments = {\n  collection: Collection\n  req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n  let args = incomingArgs\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'refresh',\n      overrideAccess: false,\n    })\n\n    // /////////////////////////////////////\n    // Refresh\n    // /////////////////////////////////////\n\n    const {\n      collection: { config: collectionConfig },\n      req,\n      req: {\n        payload: { config, secret },\n      },\n    } = args\n\n    if (!args.req.user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const pathname = new URL(args.req.url!).pathname\n\n    const isGraphQL = pathname === config.routes.graphQL\n\n    let user = await req.payload.db.findOne<any>({\n      collection: collectionConfig.slug,\n      req,\n      where: { id: { equals: args.req.user.id } },\n    })\n\n    const sid = args.req.user._sid\n\n    if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n      if (!Array.isArray(user.sessions) || !sid) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const existingSession = user.sessions.find(({ id }: { id: number }) => id === sid)\n\n      const now = new Date()\n      const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n      existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n      // Prevent updatedAt from being updated when only refreshing a session\n      user.updatedAt = null\n\n      await req.payload.db.updateOne({\n        id: user.id,\n        collection: collectionConfig.slug,\n        data: {\n          ...user,\n          sessions: removeExpiredSessions(user.sessions),\n        },\n        req,\n        returning: false,\n      })\n    }\n\n    user = await req.payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth: isGraphQL ? 0 : args.collection.config.auth.depth,\n      req: args.req,\n    })\n\n    if (user) {\n      user.collection = args.req.user.collection\n      user._strategy = args.req.user._strategy\n    }\n\n    let result!: Result\n\n    // /////////////////////////////////////\n    // refresh hook - Collection\n    // /////////////////////////////////////\n\n    for (const refreshHook of args.collection.config.hooks.refresh) {\n      const hookResult = await refreshHook({ args, user })\n\n      if (hookResult) {\n        result = hookResult\n        break\n      }\n    }\n\n    if (!result) {\n      const fieldsToSign = getFieldsToSign({\n        collectionConfig,\n        email: user?.email as string,\n        sid,\n        user: args?.req?.user,\n      })\n\n      const { exp, token: refreshedToken } = await jwtSign({\n        fieldsToSign,\n        secret,\n        tokenExpiration: collectionConfig.auth.tokenExpiration,\n      })\n\n      result = {\n        exp,\n        refreshedToken,\n        setCookie: true,\n        /** @deprecated\n         * use:\n         * ```ts\n         * user._strategy\n         * ```\n         */\n        strategy: args.req.user._strategy,\n        user,\n      }\n    }\n\n    // /////////////////////////////////////\n    // After Refresh - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRefresh?.length) {\n      for (const hook of collectionConfig.hooks.afterRefresh) {\n        result =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            exp: result.exp,\n            req: args.req,\n            token: result.refreshedToken,\n          })) || result\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'refresh',\n      overrideAccess: false,\n      result,\n    })\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","Forbidden","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","slug","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updatedAt","updateOne","data","returning","findByID","depth","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","strategy","afterRefresh","length","hook","context","error"],"mappings":"AAGA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AAqBtD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMR,gBAAgBO,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMV,qBAAqB;YAChCU;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMC,WAAW,IAAIC,IAAIb,KAAKE,GAAG,CAACY,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaR,OAAOY,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMR,IAAIM,OAAO,CAACU,EAAE,CAACC,OAAO,CAAM;YAC3ChB,YAAYI,iBAAiBa,IAAI;YACjClB;YACAmB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQvB,KAAKE,GAAG,CAACQ,IAAI,CAACY,EAAE;gBAAC;YAAE;QAC5C;QAEA,MAAME,MAAMxB,KAAKE,GAAG,CAACQ,IAAI,CAACe,IAAI;QAE9B,IAAIlB,iBAAiBmB,IAAI,CAACC,WAAW,IAAI,CAACpB,iBAAiBmB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACpB,KAAKqB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIjC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMqB,kBAAkBtB,KAAKqB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAkB,GAAKA,OAAOE;YAE9E,MAAMU,MAAM,IAAIC;YAChB,MAAMC,eAAe7B,iBAAiBmB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,sEAAsE;YACtE1B,KAAK8B,SAAS,GAAG;YAEjB,MAAMtC,IAAIM,OAAO,CAACU,EAAE,CAACuB,SAAS,CAAC;gBAC7BnB,IAAIZ,KAAKY,EAAE;gBACXnB,YAAYI,iBAAiBa,IAAI;gBACjCsB,MAAM;oBACJ,GAAGhC,IAAI;oBACPqB,UAAUlC,sBAAsBa,KAAKqB,QAAQ;gBAC/C;gBACA7B;gBACAyC,WAAW;YACb;QACF;QAEAjC,OAAO,MAAMR,IAAIM,OAAO,CAACoC,QAAQ,CAAC;YAChCtB,IAAIZ,KAAKY,EAAE;YACXnB,YAAYI,iBAAiBa,IAAI;YACjCyB,OAAO9B,YAAY,IAAIf,KAAKG,UAAU,CAACC,MAAM,CAACsB,IAAI,CAACmB,KAAK;YACxD3C,KAAKF,KAAKE,GAAG;QACf;QAEA,IAAIQ,MAAM;YACRA,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;YAC1CO,KAAKoC,SAAS,GAAG9C,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;QAC1C;QAEA,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAehD,KAAKG,UAAU,CAACC,MAAM,CAAC6C,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEhD;gBAAMU;YAAK;YAElD,IAAIyC,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAezD,gBAAgB;gBACnCY;gBACA8C,OAAO3C,MAAM2C;gBACb7B;gBACAd,MAAMV,MAAME,KAAKQ;YACnB;YAEA,MAAM,EAAE4C,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAM5D,QAAQ;gBACnDwD;gBACA3C;gBACA4B,iBAAiB9B,iBAAiBmB,IAAI,CAACW,eAAe;YACxD;YAEAU,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX;;;;;SAKC,GACDC,UAAU1D,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;gBACjCpC;YACF;QACF;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB0C,KAAK,EAAEU,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQtD,iBAAiB0C,KAAK,CAACU,YAAY,CAAE;gBACtDZ,SACE,AAAC,MAAMc,KAAK;oBACV1D,YAAYH,KAAKG,UAAU,EAAEC;oBAC7B0D,SAAS9D,KAAKE,GAAG,CAAC4D,OAAO;oBACzBR,KAAKP,OAAOO,GAAG;oBACfpD,KAAKF,KAAKE,GAAG;oBACbqD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAM1D,oBAAoB;YACjCW;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChByC;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAI9C,cAAc;YAChB,MAAMT,kBAAkBU;QAC1B;QAEA,OAAO6C;IACT,EAAE,OAAOgB,OAAgB;QACvB,MAAMrE,gBAAgBM,KAAKE,GAAG;QAC9B,MAAM6D;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { Forbidden } from '../../errors/index.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n  exp: number\n  refreshedToken: string\n  setCookie?: boolean\n  user: Document\n}\n\nexport type Arguments = {\n  collection: Collection\n  req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n  let args = incomingArgs\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'refresh',\n      overrideAccess: false,\n    })\n\n    // /////////////////////////////////////\n    // Refresh\n    // /////////////////////////////////////\n\n    const {\n      collection: { config: collectionConfig },\n      req,\n      req: {\n        payload: { config, secret },\n      },\n    } = args\n\n    if (!args.req.user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const pathname = new URL(args.req.url!).pathname\n\n    const isGraphQL = pathname === config.routes.graphQL\n\n    let user = await req.payload.db.findOne<AuthenticatedUser>({\n      collection: collectionConfig.slug,\n      req,\n      where: { id: { equals: args.req.user.id } },\n    })\n\n    if (!user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const sid = args.req.user._sid\n\n    if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n      if (!Array.isArray(user.sessions) || !sid) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const existingSession = user.sessions.find(({ id }) => id === sid)\n\n      if (!existingSession) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const now = new Date()\n      const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n      existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n      await req.payload.db.updateOne({\n        id: user.id,\n        collection: collectionConfig.slug,\n        data: {\n          ...user,\n          // Prevent updatedAt from being updated when only refreshing a session\n          sessions: removeExpiredSessions(user.sessions),\n          updatedAt: null,\n        },\n        req,\n        returning: false,\n      })\n    }\n\n    user = (await req.payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth: isGraphQL ? 0 : args.collection.config.auth.depth,\n      req: args.req,\n    })) as AuthenticatedUser\n\n    if (user) {\n      user.collection = args.req.user.collection\n      user._strategy = args.req.user._strategy\n    }\n\n    let result!: Result\n\n    // /////////////////////////////////////\n    // refresh hook - Collection\n    // /////////////////////////////////////\n\n    for (const refreshHook of args.collection.config.hooks.refresh) {\n      const hookResult = await refreshHook({ args, user })\n\n      if (hookResult) {\n        result = hookResult\n        break\n      }\n    }\n\n    if (!result) {\n      const fieldsToSign = getFieldsToSign({\n        collectionConfig,\n        email: user?.email as string,\n        sid,\n        user: args?.req?.user,\n      })\n\n      const { exp, token: refreshedToken } = await jwtSign({\n        fieldsToSign,\n        secret,\n        tokenExpiration: collectionConfig.auth.tokenExpiration,\n      })\n\n      result = {\n        exp,\n        refreshedToken,\n        setCookie: true,\n        user,\n      }\n    }\n\n    // /////////////////////////////////////\n    // After Refresh - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRefresh?.length) {\n      for (const hook of collectionConfig.hooks.afterRefresh) {\n        result =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            exp: result.exp,\n            req: args.req,\n            token: result.refreshedToken,\n          })) || result\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'refresh',\n      overrideAccess: false,\n      result,\n    })\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","Forbidden","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","slug","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updateOne","data","updatedAt","returning","findByID","depth","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","afterRefresh","length","hook","context","error"],"mappings":"AAIA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AActD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMR,gBAAgBO,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMV,qBAAqB;YAChCU;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMC,WAAW,IAAIC,IAAIb,KAAKE,GAAG,CAACY,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaR,OAAOY,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMR,IAAIM,OAAO,CAACU,EAAE,CAACC,OAAO,CAAoB;YACzDhB,YAAYI,iBAAiBa,IAAI;YACjClB;YACAmB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQvB,KAAKE,GAAG,CAACQ,IAAI,CAACY,EAAE;gBAAC;YAAE;QAC5C;QAEA,IAAI,CAACZ,MAAM;YACT,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMa,MAAMxB,KAAKE,GAAG,CAACQ,IAAI,CAACe,IAAI;QAE9B,IAAIlB,iBAAiBmB,IAAI,CAACC,WAAW,IAAI,CAACpB,iBAAiBmB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACpB,KAAKqB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIjC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMqB,kBAAkBtB,KAAKqB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAE,GAAKA,OAAOE;YAE9D,IAAI,CAACQ,iBAAiB;gBACpB,MAAM,IAAIzC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMuB,MAAM,IAAIC;YAChB,MAAMC,eAAe7B,iBAAiBmB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,MAAMlC,IAAIM,OAAO,CAACU,EAAE,CAACsB,SAAS,CAAC;gBAC7BlB,IAAIZ,KAAKY,EAAE;gBACXnB,YAAYI,iBAAiBa,IAAI;gBACjCqB,MAAM;oBACJ,GAAG/B,IAAI;oBACP,sEAAsE;oBACtEqB,UAAUlC,sBAAsBa,KAAKqB,QAAQ;oBAC7CW,WAAW;gBACb;gBACAxC;gBACAyC,WAAW;YACb;QACF;QAEAjC,OAAQ,MAAMR,IAAIM,OAAO,CAACoC,QAAQ,CAAC;YACjCtB,IAAIZ,KAAKY,EAAE;YACXnB,YAAYI,iBAAiBa,IAAI;YACjCyB,OAAO9B,YAAY,IAAIf,KAAKG,UAAU,CAACC,MAAM,CAACsB,IAAI,CAACmB,KAAK;YACxD3C,KAAKF,KAAKE,GAAG;QACf;QAEA,IAAIQ,MAAM;YACRA,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;YAC1CO,KAAKoC,SAAS,GAAG9C,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;QAC1C;QAEA,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAehD,KAAKG,UAAU,CAACC,MAAM,CAAC6C,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEhD;gBAAMU;YAAK;YAElD,IAAIyC,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAezD,gBAAgB;gBACnCY;gBACA8C,OAAO3C,MAAM2C;gBACb7B;gBACAd,MAAMV,MAAME,KAAKQ;YACnB;YAEA,MAAM,EAAE4C,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAM5D,QAAQ;gBACnDwD;gBACA3C;gBACA4B,iBAAiB9B,iBAAiBmB,IAAI,CAACW,eAAe;YACxD;YAEAU,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX/C;YACF;QACF;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB0C,KAAK,EAAES,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQrD,iBAAiB0C,KAAK,CAACS,YAAY,CAAE;gBACtDX,SACE,AAAC,MAAMa,KAAK;oBACVzD,YAAYH,KAAKG,UAAU,EAAEC;oBAC7ByD,SAAS7D,KAAKE,GAAG,CAAC2D,OAAO;oBACzBP,KAAKP,OAAOO,GAAG;oBACfpD,KAAKF,KAAKE,GAAG;oBACbqD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAM1D,oBAAoB;YACjCW;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChByC;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAI9C,cAAc;YAChB,MAAMT,kBAAkBU;QAC1B;QAEA,OAAO6C;IACT,EAAE,OAAOe,OAAgB;QACvB,MAAMpE,gBAAgBM,KAAKE,GAAG;QAC9B,MAAM4D;IACR;AACF,EAAC"}

package/dist/auth/operations/registerFirstUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registerFirstUser.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/registerFirstUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACV,sBAAsB,EACtB,8BAA8B,EAC/B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,sBAAsB,CAAA;AAStE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,GAChE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAU,KAAK,SAAS,kBAAkB,EAC/E,MAAM,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CA8F/C,CAAA"}
+{"version":3,"file":"registerFirstUser.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/registerFirstUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACV,sBAAsB,EACtB,8BAA8B,EAC/B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,sBAAsB,CAAA;AAStE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,GAChE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAU,KAAK,SAAS,kBAAkB,QACzE,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CA8F/C,CAAA"}

package/dist/auth/operations/resetPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,mCAAmC,CAAA;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAa,MAAM,gBAAgB,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAe1D,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,EAC3E,MAAM,SAAS,KACd,OAAO,CAAC,MAAM,CA4NhB,CAAA"}
+{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,mCAAmC,CAAA;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAQ,MAAM,gBAAgB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAe1D,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,QACrE,SAAS,KACd,OAAO,CAAC,MAAM,CA4NhB,CAAA"}

package/dist/auth/operations/resetPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, TypedUser } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n  token?: string\n  user: Record<string, unknown>\n}\n\nexport type Arguments = {\n  collection: Collection\n  data: {\n    password: string\n    token: string\n  }\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments,\n): Promise<Result> => {\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess,\n    req: {\n      payload: { secret },\n      payload,\n    },\n    req,\n  } = args\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let user: null | TypedUser = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })\n\n    // /////////////////////////////////////\n    // Reset Password\n    // /////////////////////////////////////\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: {\n        resetPasswordExpiration: { greater_than: new Date().toISOString() },\n        resetPasswordToken: { equals: data.token },\n      },\n    })\n\n    user = await payload.db.findOne<TypedUser>({\n      collection: collectionConfig.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n    }\n\n    // TODO: replace this method\n    const { hash, salt } = await generatePasswordSaltHash({\n      collection: collectionConfig,\n      password: data.password,\n      req,\n    })\n\n    user.salt = salt\n    user.hash = hash\n\n    user.resetPasswordExpiration = new Date().toISOString()\n\n    if (collectionConfig.auth.verify) {\n      user._verified = Boolean(user._verified)\n    }\n\n    // /////////////////////////////////////\n    // beforeValidate - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeValidate?.length) {\n      for (const hook of collectionConfig.hooks.beforeValidate) {\n        await hook({\n          collection: args.collection?.config,\n          context: req.context,\n          data: user,\n          operation: 'update',\n          req,\n        })\n      }\n    }\n\n    // /////////////////////////////////////\n    // Update new password\n    // /////////////////////////////////////\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    const doc = await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n    })\n\n    await authenticateLocalStrategy({ doc, password: data.password })\n\n    const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n      collectionConfig,\n      email: user.email!,\n      user,\n    }\n\n    const session = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req,\n      user,\n    })\n    sid = session.sid\n\n    if (sid) {\n      fieldsToSignArgs.sid = sid\n    }\n\n    const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    let userBeforeLogin = user\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const { token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: collectionConfig.auth.tokenExpiration,\n    })\n\n    req.user = userBeforeLogin\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            token,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const fullUser = await payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth,\n      overrideAccess,\n      req,\n      trash: false,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    if (fullUser) {\n      fullUser.collection = collectionConfig.slug\n      fullUser._strategy = 'local-jwt'\n    }\n\n    let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n      token,\n      user: fullUser,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'resetPassword',\n      overrideAccess,\n      result,\n    })\n\n    return result\n  } catch (error: unknown) {\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user,\n      })\n    }\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","user","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","db","findOne","slug","FORBIDDEN","hash","salt","password","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","doc","updateOne","id","fieldsToSignArgs","email","session","fieldsToSign","userBeforeLogin","beforeLogin","tokenExpiration","afterLogin","fullUser","findByID","_strategy","result","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAMlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJ,IACE,CAACU,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIjB,SAAS,0BAA0BH,WAAW8B,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI5B,UAAUmB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,OAAyB;IAE7B,IAAI;QACF,MAAMC,eAAe,MAAM7B,gBAAgBgB;QAE3CP,OAAO,MAAMd,qBAAqB;YAChCc;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEAb,OAAO,MAAMX,QAAQyB,EAAE,CAACC,OAAO,CAAY;YACzCjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAe;QACF;QAEA,IAAI,CAACH,MAAM;YACT,MAAM,IAAIhC,SAAS,2CAA2CH,WAAWoD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMxC,yBAAyB;YACpDG,YAAYE;YACZoC,UAAUnC,KAAKmC,QAAQ;YACvBhC;QACF;QAEAY,KAAKmB,IAAI,GAAGA;QACZnB,KAAKkB,IAAI,GAAGA;QAEZlB,KAAKO,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAACyB,MAAM,EAAE;YAChCrB,KAAKsB,SAAS,GAAGjB,QAAQL,KAAKsB,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAItC,iBAAiBuC,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACT5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAASvC,IAAIuC,OAAO;oBACpB1C,MAAMe;oBACNE,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CY,KAAK4B,SAAS,GAAG,IAAInB,OAAOC,WAAW;QAEvC,MAAMmB,MAAM,MAAMxC,QAAQyB,EAAE,CAACgB,SAAS,CAAC;YACrCC,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAMe;YACNZ;QACF;QAEA,MAAMV,0BAA0B;YAAEmD;YAAKT,UAAUnC,KAAKmC,QAAQ;QAAC;QAE/D,MAAMY,mBAA0D;YAC9DhD;YACAiD,OAAOjC,KAAKiC,KAAK;YACjBjC;QACF;QAEA,MAAMkC,UAAU,MAAM1D,iBAAiB;YACrCQ;YACAK;YACAD;YACAY;QACF;QACAD,MAAMmC,QAAQnC,GAAG;QAEjB,IAAIA,KAAK;YACPiC,iBAAiBjC,GAAG,GAAGA;QACzB;QAEA,MAAMoC,eAAe7D,gBAAgB0D;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAII,kBAAkBpC;QAEtB,IAAIhB,iBAAiBuC,KAAK,EAAEc,aAAaZ,QAAQ;YAC/C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACc,WAAW,CAAE;gBACrDD,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbY,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAM,EAAEvB,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9B4D;YACA7C;YACAgD,iBAAiBtD,iBAAiBY,IAAI,CAAC0C,eAAe;QACxD;QAEAlD,IAAIY,IAAI,GAAGoC;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIpD,iBAAiBuC,KAAK,EAAEgB,YAAYd,QAAQ;YAC9C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACgB,UAAU,CAAE;gBACpDH,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbyB;oBACAb,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAMI,WAAW,MAAMnD,QAAQoD,QAAQ,CAAC;YACtCV,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC9B;YACAC;YACAC;YACAkB,OAAO;QACT;QAEA,IAAIL,cAAc;YAChB,MAAM9B,kBAAkBiB;QAC1B;QAEA,IAAIoD,UAAU;YACZA,SAAS1D,UAAU,GAAGE,iBAAiBgC,IAAI;YAC3CwB,SAASE,SAAS,GAAG;QACvB;QAEA,IAAIC,SAA2D;YAC7D9B;YACAb,MAAMwC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCG,SAAS,MAAM7E,oBAAoB;YACjCe;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACAwD;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAI7C,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAC;YACF;QACF;QACA,MAAM3B,gBAAgBe;QACtB,MAAMwD;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, User } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n  token?: string\n  user: Record<string, unknown>\n}\n\nexport type Arguments = {\n  collection: Collection\n  data: {\n    password: string\n    token: string\n  }\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments,\n): Promise<Result> => {\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess,\n    req: {\n      payload: { secret },\n      payload,\n    },\n    req,\n  } = args\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let user: null | User = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })\n\n    // /////////////////////////////////////\n    // Reset Password\n    // /////////////////////////////////////\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: {\n        resetPasswordExpiration: { greater_than: new Date().toISOString() },\n        resetPasswordToken: { equals: data.token },\n      },\n    })\n\n    user = await payload.db.findOne<User>({\n      collection: collectionConfig.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n    }\n\n    // TODO: replace this method\n    const { hash, salt } = await generatePasswordSaltHash({\n      collection: collectionConfig,\n      password: data.password,\n      req,\n    })\n\n    user.salt = salt\n    user.hash = hash\n\n    user.resetPasswordExpiration = new Date().toISOString()\n\n    if (collectionConfig.auth.verify) {\n      user._verified = Boolean(user._verified)\n    }\n\n    // /////////////////////////////////////\n    // beforeValidate - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeValidate?.length) {\n      for (const hook of collectionConfig.hooks.beforeValidate) {\n        await hook({\n          collection: args.collection?.config,\n          context: req.context,\n          data: user,\n          operation: 'update',\n          req,\n        })\n      }\n    }\n\n    // /////////////////////////////////////\n    // Update new password\n    // /////////////////////////////////////\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    const doc = await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n    })\n\n    await authenticateLocalStrategy({ doc, password: data.password })\n\n    const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n      collectionConfig,\n      email: user.email!,\n      user,\n    }\n\n    const session = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req,\n      user,\n    })\n    sid = session.sid\n\n    if (sid) {\n      fieldsToSignArgs.sid = sid\n    }\n\n    const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    let userBeforeLogin = user\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const { token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: collectionConfig.auth.tokenExpiration,\n    })\n\n    req.user = userBeforeLogin\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            token,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const fullUser = await payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth,\n      overrideAccess,\n      req,\n      trash: false,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    if (fullUser) {\n      fullUser.collection = collectionConfig.slug\n      fullUser._strategy = 'local-jwt'\n    }\n\n    let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n      token,\n      user: fullUser,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'resetPassword',\n      overrideAccess,\n      result,\n    })\n\n    return result\n  } catch (error: unknown) {\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user,\n      })\n    }\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","user","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","db","findOne","slug","FORBIDDEN","hash","salt","password","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","doc","updateOne","id","fieldsToSignArgs","email","session","fieldsToSign","userBeforeLogin","beforeLogin","tokenExpiration","afterLogin","fullUser","findByID","_strategy","result","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAMlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJ,IACE,CAACU,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIjB,SAAS,0BAA0BH,WAAW8B,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI5B,UAAUmB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,OAAoB;IAExB,IAAI;QACF,MAAMC,eAAe,MAAM7B,gBAAgBgB;QAE3CP,OAAO,MAAMd,qBAAqB;YAChCc;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEAb,OAAO,MAAMX,QAAQyB,EAAE,CAACC,OAAO,CAAO;YACpCjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAe;QACF;QAEA,IAAI,CAACH,MAAM;YACT,MAAM,IAAIhC,SAAS,2CAA2CH,WAAWoD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMxC,yBAAyB;YACpDG,YAAYE;YACZoC,UAAUnC,KAAKmC,QAAQ;YACvBhC;QACF;QAEAY,KAAKmB,IAAI,GAAGA;QACZnB,KAAKkB,IAAI,GAAGA;QAEZlB,KAAKO,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAACyB,MAAM,EAAE;YAChCrB,KAAKsB,SAAS,GAAGjB,QAAQL,KAAKsB,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAItC,iBAAiBuC,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACT5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAASvC,IAAIuC,OAAO;oBACpB1C,MAAMe;oBACNE,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CY,KAAK4B,SAAS,GAAG,IAAInB,OAAOC,WAAW;QAEvC,MAAMmB,MAAM,MAAMxC,QAAQyB,EAAE,CAACgB,SAAS,CAAC;YACrCC,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAMe;YACNZ;QACF;QAEA,MAAMV,0BAA0B;YAAEmD;YAAKT,UAAUnC,KAAKmC,QAAQ;QAAC;QAE/D,MAAMY,mBAA0D;YAC9DhD;YACAiD,OAAOjC,KAAKiC,KAAK;YACjBjC;QACF;QAEA,MAAMkC,UAAU,MAAM1D,iBAAiB;YACrCQ;YACAK;YACAD;YACAY;QACF;QACAD,MAAMmC,QAAQnC,GAAG;QAEjB,IAAIA,KAAK;YACPiC,iBAAiBjC,GAAG,GAAGA;QACzB;QAEA,MAAMoC,eAAe7D,gBAAgB0D;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAII,kBAAkBpC;QAEtB,IAAIhB,iBAAiBuC,KAAK,EAAEc,aAAaZ,QAAQ;YAC/C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACc,WAAW,CAAE;gBACrDD,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbY,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAM,EAAEvB,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9B4D;YACA7C;YACAgD,iBAAiBtD,iBAAiBY,IAAI,CAAC0C,eAAe;QACxD;QAEAlD,IAAIY,IAAI,GAAGoC;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIpD,iBAAiBuC,KAAK,EAAEgB,YAAYd,QAAQ;YAC9C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACgB,UAAU,CAAE;gBACpDH,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbyB;oBACAb,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAMI,WAAW,MAAMnD,QAAQoD,QAAQ,CAAC;YACtCV,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC9B;YACAC;YACAC;YACAkB,OAAO;QACT;QAEA,IAAIL,cAAc;YAChB,MAAM9B,kBAAkBiB;QAC1B;QAEA,IAAIoD,UAAU;YACZA,SAAS1D,UAAU,GAAGE,iBAAiBgC,IAAI;YAC3CwB,SAASE,SAAS,GAAG;QACvB;QAEA,IAAIC,SAA2D;YAC7D9B;YACAb,MAAMwC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCG,SAAS,MAAM7E,oBAAoB;YACjCe;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACAwD;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAI7C,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAC;YACF;QACF;QACA,MAAM3B,gBAAgBe;QACtB,MAAMwD;IACR;AACF,EAAC"}

package/dist/auth/operations/unlock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,EACpE,MAAM,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAqHjB,CAAA"}
+{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,QAC9D,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAwHjB,CAAA"}

package/dist/auth/operations/unlock.js

@@ -36,6 +36,7 @@ export const unlockOperation = async (args)=>{
         // /////////////////////////////////////
         if (!overrideAccess) {
             const accessResult = await executeAccess({
+                slug: collectionConfig.slug,
                 req
             }, collectionConfig.access.unlock);
             if (accessResult && typeof accessResult === 'object') {

package/dist/auth/operations/unlock.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess({ req }, collectionConfig.access.unlock)\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","slug","result","doc","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI3B,UAAUc,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEc,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5ErB,WAAWkC,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMZ,qBAAqB;YAChCY;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cAAc;gBAAES;YAAI,GAAGF,iBAAiBsB,MAAM,CAACC,MAAM;YAEhF,IAAIF,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBjC,eAAeiC,iBAAiB;gBAChDV,OAAO;oBACLc,QAAQhB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBjC,eAAeiC,iBAAiB;gBAChDN,UAAU;oBACRU,QAAQX;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkB/B,uBAAuB;YACvCoC,aAAaC,QAAQ1B,iBAAiB2B,KAAK;YAC3CA,OAAO;YACPC,OAAOR;QACT;QAEA,MAAMS,OAAO,MAAM3B,IAAI4B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxClC,YAAYE,iBAAiBiC,IAAI;YACjC9B,QAAQA;YACRD;YACA0B,OAAOR;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIL,MAAM;YACR,MAAMlC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKN;gBACLC,SAAS5B,IAAI4B,OAAO;gBACpB5B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI9C,UAAUc,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM7B,kBAAkBY;QAC1B;QAEAgC,SAAS,MAAMlD,oBAAoB;YACjCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOR,QAAQQ;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess(\n        { slug: collectionConfig.slug, req },\n        collectionConfig.access.unlock,\n      )\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","slug","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","result","doc","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI3B,UAAUc,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEc,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5ErB,WAAWkC,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMZ,qBAAqB;YAChCY;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cACzB;gBAAE6B,MAAMtB,iBAAiBsB,IAAI;gBAAEpB;YAAI,GACnCF,iBAAiBuB,MAAM,CAACC,MAAM;YAGhC,IAAIH,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBjC,eAAeiC,iBAAiB;gBAChDV,OAAO;oBACLe,QAAQjB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBjC,eAAeiC,iBAAiB;gBAChDN,UAAU;oBACRW,QAAQZ;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkB/B,uBAAuB;YACvCqC,aAAaC,QAAQ3B,iBAAiB4B,KAAK;YAC3CA,OAAO;YACPC,OAAOT;QACT;QAEA,MAAMU,OAAO,MAAM5B,IAAI6B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxCnC,YAAYE,iBAAiBsB,IAAI;YACjCnB,QAAQA;YACRD;YACA2B,OAAOT;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIJ,MAAM;YACR,MAAMnC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKL;gBACLC,SAAS7B,IAAI6B,OAAO;gBACpB7B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI9C,UAAUc,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM7B,kBAAkBY;QAC1B;QAEAgC,SAAS,MAAMlD,oBAAoB;YACjCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOP,QAAQO;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}

package/dist/auth/operations/verifyEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyEmail.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/verifyEmail.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D,MAAM,MAAM,IAAI,GAAG;IACjB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAU,MAAM,IAAI,KAAG,OAAO,CAAC,OAAO,CAuDtE,CAAA"}
+{"version":3,"file":"verifyEmail.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/verifyEmail.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D,MAAM,MAAM,IAAI,GAAG;IACjB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,eAAO,MAAM,oBAAoB,SAAgB,IAAI,KAAG,OAAO,CAAC,OAAO,CAuDtE,CAAA"}

package/dist/auth/rotateSecret.d.ts

@@ -0,0 +1,51 @@
+import type { CollectionSlug, Payload } from '../index.js';
+export type RotateSecretArgs = {
+    /**
+     * Number of documents to process per batch.
+     * @default 100
+     */
+    batchSize?: number;
+    /**
+     * Limit rotation to these collection slugs. Defaults to every auth collection
+     * configured with `useAPIKey`.
+     */
+    collections?: CollectionSlug[];
+    /**
+     * When true, verifies every row against the old and current secrets without
+     * writing. Run this first to confirm `oldSecret` is correct.
+     * @default false
+     */
+    dryRun?: boolean;
+    /**
+     * The previous raw `PAYLOAD_SECRET` that existing data was encrypted under.
+     */
+    oldSecret: string;
+    payload: Payload;
+};
+export type RotateSecretResult = {
+    /** Documents re-keyed from the old secret to the current secret. */
+    migrated: number;
+    /** Documents already encrypted under the current secret (safe re-run). */
+    skipped: number;
+};
+/**
+ * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous
+ * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.
+ *
+ * Operates at the database-adapter layer to bypass the `apiKey` field's
+ * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).
+ *
+ * Each document is verified against the old and current secrets before it is
+ * written, so the run is:
+ * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC
+ *   index), so it is safe to run repeatedly;
+ * - **fail-closed** — a row that matches neither the old nor the current secret
+ *   throws and aborts the run before that row is written. Rows already migrated
+ *   earlier in the same run remain migrated and are safe to keep: fix the secret
+ *   and re-run.
+ *
+ * Password logins are unaffected by a secret rotation, and active JWT sessions
+ * are invalidated by design. See the "Rotating your PAYLOAD_SECRET" docs.
+ */
+export declare const rotateSecret: ({ batchSize, collections, dryRun, oldSecret, payload, }: RotateSecretArgs) => Promise<RotateSecretResult>;
+//# sourceMappingURL=rotateSecret.d.ts.map

package/dist/auth/rotateSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotateSecret.d.ts","sourceRoot":"","sources":["../../src/auth/rotateSecret.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAI1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,4DAMtB,gBAAgB,KAAG,OAAO,CAAC,kBAAkB,CA4F/C,CAAA"}