payload 4.0.0-internal.4cbdd50 → 4.0.0-internal.4e1f822

package/dist/auth/sessions.d.ts

@@ -1,7 +1,6 @@
-import type { SanitizedCollectionConfig, TypeWithID } from '../collections/config/types.js';
-import type { TypedUser } from '../index.js';
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { AuthenticatedUser, User, UserSession } from '../index.js';
 import type { Payload, PayloadRequest } from '../types/index.js';
-import type { UntypedUser, UserSession } from './types.js';
 /**
  * Removes expired sessions from an array of sessions
  */
@@ -14,7 +13,7 @@ export declare const addSessionToUser: ({ collectionConfig, payload, req, user,
     collectionConfig: SanitizedCollectionConfig;
     payload: Payload;
     req: PayloadRequest;
-    user: TypedUser;
+    user: AuthenticatedUser;
 }) => Promise<{
     sid?: string;
 }>;
@@ -23,6 +22,6 @@ export declare const revokeSession: ({ collectionConfig, payload, req, sid, user
     payload: Payload;
     req: PayloadRequest;
     sid: string;
-    user: null | (TypeWithID & UntypedUser);
+    user: null | User;
 }) => Promise<void>;
 //# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE1D;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,WAAW,EAAE,kBAO5D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAU,2CAKpC;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,SAAS,CAAA;CAChB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAoC3B,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,gDAMjC;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,CAAC,UAAU,GAAG,WAAW,CAAC,CAAA;CACxC,KAAG,OAAO,CAAC,IAAI,CAWf,CAAA"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8CAK1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAqC3B,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAWf,CAAA"}

package/dist/auth/sessions.js

@@ -32,12 +32,14 @@ import { v4 as uuid } from 'uuid';
             user.sessions = removeExpiredSessions(user.sessions);
             user.sessions.push(session);
         }
-        // Prevent updatedAt from being updated when only adding a session
-        user.updatedAt = null;
         await payload.db.updateOne({
             id: user.id,
             collection: collectionConfig.slug,
-            data: user,
+            data: {
+                ...user,
+                // Prevent updatedAt from being updated when only adding a session
+                updatedAt: null
+            },
             req,
             returning: false
         });

package/dist/auth/sessions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig, TypeWithID } from '../collections/config/types.js'\nimport type { TypedUser } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\nimport type { UntypedUser, UserSession } from './types.js'\n\n/**\n * Removes expired sessions from an array of sessions\n */\nexport const removeExpiredSessions = (sessions: UserSession[]) => {\n  const now = new Date()\n\n  return sessions.filter(({ expiresAt }) => {\n    const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n    return expiry > now\n  })\n}\n\n/**\n * Adds a session to the user and removes expired sessions\n * @returns The session ID (sid) if sessions are used\n */\nexport const addSessionToUser = async ({\n  collectionConfig,\n  payload,\n  req,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  user: TypedUser\n}): Promise<{ sid?: string }> => {\n  let sid: string | undefined\n  if (collectionConfig.auth.useSessions) {\n    // Add session to user\n    sid = uuid()\n    const now = new Date()\n    const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n    const expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n    const session = { id: sid, createdAt: now, expiresAt }\n\n    if (!user.sessions?.length) {\n      user.sessions = [session]\n    } else {\n      user.sessions = removeExpiredSessions(user.sessions)\n      user.sessions.push(session)\n    }\n\n    // Prevent updatedAt from being updated when only adding a session\n    user.updatedAt = null\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n      returning: false,\n    })\n\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n  }\n\n  return {\n    sid,\n  }\n}\n\nexport const revokeSession = async ({\n  collectionConfig,\n  payload,\n  req,\n  sid,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  sid: string\n  user: null | (TypeWithID & UntypedUser)\n}): Promise<void> => {\n  if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n    user.sessions = user.sessions.filter((session) => session.id !== sid)\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n      returning: false,\n    })\n  }\n}\n"],"names":["v4","uuid","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","user","sid","auth","useSessions","tokenExpInMs","tokenExpiration","getTime","session","id","createdAt","length","push","updatedAt","db","updateOne","collection","slug","data","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAOjC;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,IAAI,EAML;IACC,IAAIC;IACJ,IAAIJ,iBAAiBK,IAAI,CAACC,WAAW,EAAE;QACrC,sBAAsB;QACtBF,MAAMb;QACN,MAAMG,MAAM,IAAIC;QAChB,MAAMY,eAAeP,iBAAiBK,IAAI,CAACG,eAAe,GAAG;QAC7D,MAAMX,YAAY,IAAIF,KAAKD,IAAIe,OAAO,KAAKF;QAE3C,MAAMG,UAAU;YAAEC,IAAIP;YAAKQ,WAAWlB;YAAKG;QAAU;QAErD,IAAI,CAACM,KAAKV,QAAQ,EAAEoB,QAAQ;YAC1BV,KAAKV,QAAQ,GAAG;gBAACiB;aAAQ;QAC3B,OAAO;YACLP,KAAKV,QAAQ,GAAGD,sBAAsBW,KAAKV,QAAQ;YACnDU,KAAKV,QAAQ,CAACqB,IAAI,CAACJ;QACrB;QAEA,kEAAkE;QAClEP,KAAKY,SAAS,GAAG;QAEjB,MAAMd,QAAQe,EAAE,CAACC,SAAS,CAAC;YACzBN,IAAIR,KAAKQ,EAAE;YACXO,YAAYlB,iBAAiBmB,IAAI;YACjCC,MAAMjB;YACND;YACAmB,WAAW;QACb;QAEAlB,KAAKe,UAAU,GAAGlB,iBAAiBmB,IAAI;QACvChB,KAAKmB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLlB;IACF;AACF,EAAC;AAED,OAAO,MAAMmB,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHE,GAAG,EACHD,IAAI,EAOL;IACC,IAAIH,iBAAiBK,IAAI,CAACC,WAAW,IAAIH,QAAQA,KAAKV,QAAQ,EAAEoB,QAAQ;QACtEV,KAAKV,QAAQ,GAAGU,KAAKV,QAAQ,CAACG,MAAM,CAAC,CAACc,UAAYA,QAAQC,EAAE,KAAKP;QACjE,MAAMH,QAAQe,EAAE,CAACC,SAAS,CAAC;YACzBN,IAAIR,KAAKQ,EAAE;YACXO,YAAYlB,iBAAiBmB,IAAI;YACjCC,MAAMjB;YACND;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser, User, UserSession } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\n\n/**\n * Removes expired sessions from an array of sessions\n */\nexport const removeExpiredSessions = (sessions: UserSession[]): UserSession[] => {\n  const now = new Date()\n\n  return sessions.filter(({ expiresAt }) => {\n    const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n    return expiry > now\n  })\n}\n\n/**\n * Adds a session to the user and removes expired sessions\n * @returns The session ID (sid) if sessions are used\n */\nexport const addSessionToUser = async ({\n  collectionConfig,\n  payload,\n  req,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  user: AuthenticatedUser\n}): Promise<{ sid?: string }> => {\n  let sid: string | undefined\n  if (collectionConfig.auth.useSessions) {\n    // Add session to user\n    sid = uuid()\n    const now = new Date()\n    const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n    const expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n    const session = { id: sid, createdAt: now, expiresAt }\n\n    if (!user.sessions?.length) {\n      user.sessions = [session]\n    } else {\n      user.sessions = removeExpiredSessions(user.sessions)\n      user.sessions.push(session)\n    }\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        ...user,\n        // Prevent updatedAt from being updated when only adding a session\n        updatedAt: null,\n      },\n      req,\n      returning: false,\n    })\n\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n  }\n\n  return {\n    sid,\n  }\n}\n\nexport const revokeSession = async ({\n  collectionConfig,\n  payload,\n  req,\n  sid,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  sid: string\n  user: null | User\n}): Promise<void> => {\n  if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n    user.sessions = user.sessions.filter((session) => session.id !== sid)\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n      returning: false,\n    })\n  }\n}\n"],"names":["v4","uuid","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","user","sid","auth","useSessions","tokenExpInMs","tokenExpiration","getTime","session","id","createdAt","length","push","db","updateOne","collection","slug","data","updatedAt","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAMjC;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,IAAI,EAML;IACC,IAAIC;IACJ,IAAIJ,iBAAiBK,IAAI,CAACC,WAAW,EAAE;QACrC,sBAAsB;QACtBF,MAAMb;QACN,MAAMG,MAAM,IAAIC;QAChB,MAAMY,eAAeP,iBAAiBK,IAAI,CAACG,eAAe,GAAG;QAC7D,MAAMX,YAAY,IAAIF,KAAKD,IAAIe,OAAO,KAAKF;QAE3C,MAAMG,UAAU;YAAEC,IAAIP;YAAKQ,WAAWlB;YAAKG;QAAU;QAErD,IAAI,CAACM,KAAKV,QAAQ,EAAEoB,QAAQ;YAC1BV,KAAKV,QAAQ,GAAG;gBAACiB;aAAQ;QAC3B,OAAO;YACLP,KAAKV,QAAQ,GAAGD,sBAAsBW,KAAKV,QAAQ;YACnDU,KAAKV,QAAQ,CAACqB,IAAI,CAACJ;QACrB;QAEA,MAAMT,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAM;gBACJ,GAAGhB,IAAI;gBACP,kEAAkE;gBAClEiB,WAAW;YACb;YACAlB;YACAmB,WAAW;QACb;QAEAlB,KAAKc,UAAU,GAAGjB,iBAAiBkB,IAAI;QACvCf,KAAKmB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLlB;IACF;AACF,EAAC;AAED,OAAO,MAAMmB,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHE,GAAG,EACHD,IAAI,EAOL;IACC,IAAIH,iBAAiBK,IAAI,CAACC,WAAW,IAAIH,QAAQA,KAAKV,QAAQ,EAAEoB,QAAQ;QACtEV,KAAKV,QAAQ,GAAGU,KAAKV,QAAQ,CAACG,MAAM,CAAC,CAACc,UAAYA,QAAQC,EAAE,KAAKP;QACjE,MAAMH,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAMhB;YACND;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}

package/dist/auth/strategies/apiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,GAC9B,kBAAkB,yBAAyB,KAAG,oBAuD9C,CAAA"}
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAwD9C,CAAA"}

package/dist/auth/strategies/apiKey.js

@@ -3,14 +3,16 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
         const authHeader = headers.get('Authorization');
         if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {
             const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '');
-            const sha256APIKeyIndex = crypto.createHmac('sha256', payload.secret).update(apiKey).digest('hex');
+            // The stored index was written under whichever secret was active at the
+            // time, so match against the index computed under every keyring secret.
+            const apiKeyIndexes = payload.encryptionKeyring.all.map((key)=>crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'));
             try {
                 const where = {};
                 if (collectionConfig.auth?.verify) {
                     where.and = [
                         {
                             apiKeyIndex: {
-                                equals: sha256APIKeyIndex
+                                in: apiKeyIndexes
                             }
                         },
                         {
@@ -21,7 +23,7 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                     ];
                 } else {
                     where.apiKeyIndex = {
-                        equals: sha256APIKeyIndex
+                        in: apiKeyIndexes
                     };
                 }
                 const userQuery = await payload.find({

package/dist/auth/strategies/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { TypedUser } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey)\n        .digest('hex')\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                equals: sha256APIKeyIndex,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { equals: sha256APIKeyIndex }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as TypedUser,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","sha256APIKeyIndex","createHmac","secret","update","digest","where","auth","verify","and","apiKeyIndex","equals","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,MAAMG,oBAAoBZ,OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAIf,iBAAiBgB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,QAAQV;4BACV;wBACF;wBACA;4BACEW,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,QAAQV;oBAAkB;gBAClD;gBAEA,MAAMa,YAAY,MAAMpB,QAAQqB,IAAI,CAAC;oBACnCC,YAAYzB,iBAAiBO,IAAI;oBACjCmB,OAAOxB,YAAY,IAAIF,iBAAiBgB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAGzB,iBAAiBO,IAAI;oBACxCyB,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      // The stored index was written under whichever secret was active at the\n      // time, so match against the index computed under every keyring secret.\n      const apiKeyIndexes = payload.encryptionKeyring.all.map((key) =>\n        crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'),\n      )\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                in: apiKeyIndexes,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { in: apiKeyIndexes }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","apiKeyIndexes","encryptionKeyring","all","map","key","createHmac","legacyKey","update","digest","where","auth","verify","and","apiKeyIndex","in","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAMG,gBAAgBP,QAAQQ,iBAAiB,CAACC,GAAG,CAACC,GAAG,CAAC,CAACC,MACvDhB,OAAOiB,UAAU,CAAC,UAAUD,IAAIE,SAAS,EAAEC,MAAM,CAACT,QAAQU,MAAM,CAAC;YAGnE,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAInB,iBAAiBoB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,IAAId;4BACN;wBACF;wBACA;4BACEe,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,IAAId;oBAAc;gBAC1C;gBAEA,MAAMiB,YAAY,MAAMxB,QAAQyB,IAAI,CAAC;oBACnCC,YAAY7B,iBAAiBO,IAAI;oBACjCuB,OAAO5B,YAAY,IAAIF,iBAAiBoB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAG7B,iBAAiBO,IAAI;oBACxC6B,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}

package/dist/auth/strategies/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAsE3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAwD/B,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAiG3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBA0D/B,CAAA"}

package/dist/auth/strategies/jwt.js

@@ -1,5 +1,21 @@
 import { jwtVerify } from 'jose';
 import { extractJWT } from '../extractJWT.js';
+/**
+ * Verifies a token against every secret in the keyring (active first), so tokens
+ * signed under a previous secret still validate during a bounded rotation.
+ * Throws if no key verifies.
+ */ async function verifyWithKeyring({ payload, token }) {
+    let lastError;
+    for (const key of payload.encryptionKeyring.all){
+        try {
+            const { payload: decodedPayload } = await jwtVerify(token, new TextEncoder().encode(key.legacyKey));
+            return decodedPayload;
+        } catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError;
+}
 async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
     if (typeof payload?.config?.admin?.autoLogin !== 'object' || payload.config.admin?.autoLogin.prefillOnly || !payload?.config?.admin?.autoLogin || !payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username) {
         return {
@@ -61,8 +77,13 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
                 user: null
             };
         }
-        const secretKey = new TextEncoder().encode(payload.secret);
-        const { payload: decodedPayload } = await jwtVerify(token, secretKey);
+        // Verify against every keyring secret so tokens signed under a previous
+        // secret still validate during a bounded rotation. New tokens are always
+        // signed with the active secret.
+        const decodedPayload = await verifyWithKeyring({
+            payload,
+            token
+        });
         const collection = payload.collections[decodedPayload.collection];
         const user = await payload.findByID({
             id: decodedPayload.id,

package/dist/auth/strategies/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\n\ntype JWTToken = {\n  collection: string\n  id: string\n  sid?: string\n}\n\nasync function autoLogin({\n  isGraphQL,\n  payload,\n  strategyName = 'local-jwt',\n}: {\n  isGraphQL: boolean\n  payload: Payload\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      limit: 1,\n      pagination: false,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  strategyName = 'local-jwt',\n}) => {\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n\n    const secretKey = new TextEncoder().encode(payload.secret)\n    const { payload: decodedPayload } = await jwtVerify<JWTToken>(token, secretKey)\n    const collection = payload.collections[decodedPayload.collection]\n\n    const user = (await payload.findByID({\n      id: decodedPayload.id,\n      collection: decodedPayload.collection,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection!.config.auth.verify || user._verified)) {\n      if (collection!.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(({ id }) => id === decodedPayload.sid)\n\n        if (!existingSession || !decodedPayload.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = decodedPayload.sid\n      }\n\n      user.collection = collection!.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({ isGraphQL, payload, strategyName })\n    }\n    return { user: null }\n  }\n}\n"],"names":["jwtVerify","extractJWT","autoLogin","isGraphQL","payload","strategyName","config","admin","prefillOnly","email","username","user","collection","collections","where","or","push","equals","find","slug","depth","auth","limit","pagination","docs","_strategy","JWTAuthentication","headers","token","get","secretKey","TextEncoder","encode","secret","decodedPayload","findByID","id","verify","_verified","useSessions","existingSession","sessions","sid","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAQ7C,eAAeC,UAAU,EACvBC,SAAS,EACTC,OAAO,EACPC,eAAe,WAAW,EAK3B;IAGC,IACE,OAAOD,SAASE,QAAQC,OAAOL,cAAc,YAC7CE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUM,eAChC,CAACJ,SAASE,QAAQC,OAAOL,aACxB,CAACE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,SAAS,CAACL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMC,aAAaR,QAAQS,WAAW,CAACT,QAAQE,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAMG,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIX,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,OAAO;QACzCK,MAAMC,EAAE,EAAEC,KAAK;YACbP,OAAO;gBACLQ,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO;YAC1C;QACF;IACF,OAAO,IAAIL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAAU;QACnDI,MAAMC,EAAE,EAAEC,KAAK;YACbN,UAAU;gBACRO,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMP,QAAQc,IAAI,CAAC;QACjBN,YAAYA,WAAYN,MAAM,CAACa,IAAI;QACnCC,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACpDE,OAAO;QACPC,YAAY;QACZT;IACF,EAAC,EACDU,IAAI,CAAC,EAAE;IAET,IAAI,CAACb,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;IACzCR,KAAKc,SAAS,GAAGpB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMe,oBAA0C,OAAO,EAC5DC,OAAO,EACPxB,YAAY,KAAK,EACjBC,OAAO,EACPC,eAAe,WAAW,EAC3B;IACC,IAAI;QACF,MAAMuB,QAAQ3B,WAAW;YAAE0B;YAASvB;QAAQ;QAE5C,IAAI,CAACwB,OAAO;YACV,IAAID,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,MAAMmB,YAAY,IAAIC,cAAcC,MAAM,CAAC5B,QAAQ6B,MAAM;QACzD,MAAM,EAAE7B,SAAS8B,cAAc,EAAE,GAAG,MAAMlC,UAAoB4B,OAAOE;QACrE,MAAMlB,aAAaR,QAAQS,WAAW,CAACqB,eAAetB,UAAU,CAAC;QAEjE,MAAMD,OAAQ,MAAMP,QAAQ+B,QAAQ,CAAC;YACnCC,IAAIF,eAAeE,EAAE;YACrBxB,YAAYsB,eAAetB,UAAU;YACrCQ,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACtD;QAEA,IAAIT,QAAS,CAAA,CAACC,WAAYN,MAAM,CAACe,IAAI,CAACgB,MAAM,IAAI1B,KAAK2B,SAAS,AAAD,GAAI;YAC/D,IAAI1B,WAAYN,MAAM,CAACe,IAAI,CAACkB,WAAW,EAAE;gBACvC,MAAMC,kBAAkB,AAAC7B,CAAAA,KAAK8B,QAAQ,IAAI,EAAE,AAAD,EAAGvB,IAAI,CAAC,CAAC,EAAEkB,EAAE,EAAE,GAAKA,OAAOF,eAAeQ,GAAG;gBAExF,IAAI,CAACF,mBAAmB,CAACN,eAAeQ,GAAG,EAAE;oBAC3C,OAAO;wBACL/B,MAAM;oBACR;gBACF;gBAEAA,KAAKgC,IAAI,GAAGT,eAAeQ,GAAG;YAChC;YAEA/B,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;YACzCR,KAAKc,SAAS,GAAGpB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIgB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAOiC,QAAQ;QACf,IAAIjB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAM3B,UAAU;gBAAEC;gBAAWC;gBAASC;YAAa;QAC5D;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\n\ntype JWTToken = {\n  collection: string\n  id: string\n  sid?: string\n}\n\n/**\n * Verifies a token against every secret in the keyring (active first), so tokens\n * signed under a previous secret still validate during a bounded rotation.\n * Throws if no key verifies.\n */\nasync function verifyWithKeyring({\n  payload,\n  token,\n}: {\n  payload: Payload\n  token: string\n}): Promise<JWTToken> {\n  let lastError: unknown\n  for (const key of payload.encryptionKeyring.all) {\n    try {\n      const { payload: decodedPayload } = await jwtVerify<JWTToken>(\n        token,\n        new TextEncoder().encode(key.legacyKey),\n      )\n      return decodedPayload\n    } catch (error) {\n      lastError = error\n    }\n  }\n  throw lastError\n}\n\nasync function autoLogin({\n  isGraphQL,\n  payload,\n  strategyName = 'local-jwt',\n}: {\n  isGraphQL: boolean\n  payload: Payload\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      limit: 1,\n      pagination: false,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  strategyName = 'local-jwt',\n}) => {\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n\n    // Verify against every keyring secret so tokens signed under a previous\n    // secret still validate during a bounded rotation. New tokens are always\n    // signed with the active secret.\n    const decodedPayload = await verifyWithKeyring({ payload, token })\n    const collection = payload.collections[decodedPayload.collection]\n\n    const user = (await payload.findByID({\n      id: decodedPayload.id,\n      collection: decodedPayload.collection,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection!.config.auth.verify || user._verified)) {\n      if (collection!.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(({ id }) => id === decodedPayload.sid)\n\n        if (!existingSession || !decodedPayload.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = decodedPayload.sid\n      }\n\n      user.collection = collection!.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({ isGraphQL, payload, strategyName })\n    }\n    return { user: null }\n  }\n}\n"],"names":["jwtVerify","extractJWT","verifyWithKeyring","payload","token","lastError","key","encryptionKeyring","all","decodedPayload","TextEncoder","encode","legacyKey","error","autoLogin","isGraphQL","strategyName","config","admin","prefillOnly","email","username","user","collection","collections","where","or","push","equals","find","slug","depth","auth","limit","pagination","docs","_strategy","JWTAuthentication","headers","get","findByID","id","verify","_verified","useSessions","existingSession","sessions","sid","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAQ7C;;;;CAIC,GACD,eAAeC,kBAAkB,EAC/BC,OAAO,EACPC,KAAK,EAIN;IACC,IAAIC;IACJ,KAAK,MAAMC,OAAOH,QAAQI,iBAAiB,CAACC,GAAG,CAAE;QAC/C,IAAI;YACF,MAAM,EAAEL,SAASM,cAAc,EAAE,GAAG,MAAMT,UACxCI,OACA,IAAIM,cAAcC,MAAM,CAACL,IAAIM,SAAS;YAExC,OAAOH;QACT,EAAE,OAAOI,OAAO;YACdR,YAAYQ;QACd;IACF;IACA,MAAMR;AACR;AAEA,eAAeS,UAAU,EACvBC,SAAS,EACTZ,OAAO,EACPa,eAAe,WAAW,EAK3B;IAGC,IACE,OAAOb,SAASc,QAAQC,OAAOJ,cAAc,YAC7CX,QAAQc,MAAM,CAACC,KAAK,EAAEJ,UAAUK,eAChC,CAAChB,SAASc,QAAQC,OAAOJ,aACxB,CAACX,QAAQc,MAAM,CAACC,KAAK,EAAEJ,UAAUM,SAAS,CAACjB,QAAQc,MAAM,CAACC,KAAK,EAAEJ,UAAUO,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMC,aAAapB,QAAQqB,WAAW,CAACrB,QAAQc,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAMG,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIvB,QAAQc,MAAM,CAACC,KAAK,EAAEJ,UAAUM,OAAO;QACzCK,MAAMC,EAAE,EAAEC,KAAK;YACbP,OAAO;gBACLQ,QAAQzB,QAAQc,MAAM,CAACC,KAAK,EAAEJ,UAAUM;YAC1C;QACF;IACF,OAAO,IAAIjB,QAAQc,MAAM,CAACC,KAAK,EAAEJ,UAAUO,UAAU;QACnDI,MAAMC,EAAE,EAAEC,KAAK;YACbN,UAAU;gBACRO,QAAQzB,QAAQc,MAAM,CAACC,KAAK,EAAEJ,UAAUO;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMnB,QAAQ0B,IAAI,CAAC;QACjBN,YAAYA,WAAYN,MAAM,CAACa,IAAI;QACnCC,OAAOhB,YAAY,IAAIQ,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACpDE,OAAO;QACPC,YAAY;QACZT;IACF,EAAC,EACDU,IAAI,CAAC,EAAE;IAET,IAAI,CAACb,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;IACzCR,KAAKc,SAAS,GAAGpB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMe,oBAA0C,OAAO,EAC5DC,OAAO,EACPvB,YAAY,KAAK,EACjBZ,OAAO,EACPa,eAAe,WAAW,EAC3B;IACC,IAAI;QACF,MAAMZ,QAAQH,WAAW;YAAEqC;YAASnC;QAAQ;QAE5C,IAAI,CAACC,OAAO;YACV,IAAIkC,QAAQC,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMzB,UAAU;oBAAEC;oBAAWZ;oBAASa;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,wEAAwE;QACxE,yEAAyE;QACzE,iCAAiC;QACjC,MAAMb,iBAAiB,MAAMP,kBAAkB;YAAEC;YAASC;QAAM;QAChE,MAAMmB,aAAapB,QAAQqB,WAAW,CAACf,eAAec,UAAU,CAAC;QAEjE,MAAMD,OAAQ,MAAMnB,QAAQqC,QAAQ,CAAC;YACnCC,IAAIhC,eAAegC,EAAE;YACrBlB,YAAYd,eAAec,UAAU;YACrCQ,OAAOhB,YAAY,IAAIQ,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACtD;QAEA,IAAIT,QAAS,CAAA,CAACC,WAAYN,MAAM,CAACe,IAAI,CAACU,MAAM,IAAIpB,KAAKqB,SAAS,AAAD,GAAI;YAC/D,IAAIpB,WAAYN,MAAM,CAACe,IAAI,CAACY,WAAW,EAAE;gBACvC,MAAMC,kBAAkB,AAACvB,CAAAA,KAAKwB,QAAQ,IAAI,EAAE,AAAD,EAAGjB,IAAI,CAAC,CAAC,EAAEY,EAAE,EAAE,GAAKA,OAAOhC,eAAesC,GAAG;gBAExF,IAAI,CAACF,mBAAmB,CAACpC,eAAesC,GAAG,EAAE;oBAC3C,OAAO;wBACLzB,MAAM;oBACR;gBACF;gBAEAA,KAAK0B,IAAI,GAAGvC,eAAesC,GAAG;YAChC;YAEAzB,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;YACzCR,KAAKc,SAAS,GAAGpB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIgB,QAAQC,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMzB,UAAU;oBAAEC;oBAAWZ;oBAASa;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAO2B,QAAQ;QACf,IAAIX,QAAQC,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAMzB,UAAU;gBAAEC;gBAAWZ;gBAASa;YAAa;QAC5D;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB;AACF,EAAC"}

package/dist/auth/strategies/local/authenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/authenticate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEtE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;AAE/C,KAAK,IAAI,GAAG;IACV,GAAG,EAAE,GAAG,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAU,mBAAmB,IAAI,KAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CA+B3F,CAAA"}
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/authenticate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEtE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;AAE/C,KAAK,IAAI,GAAG;IACV,GAAG,EAAE,GAAG,CAAA;IACR,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,yBAAyB,sBAA6B,IAAI,KAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CA+B3F,CAAA"}

package/dist/auth/strategies/local/generatePasswordSaltHash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generatePasswordSaltHash.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAmB7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAU,+CAI5C,IAAI,KAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4B/C,CAAA"}
+{"version":3,"file":"generatePasswordSaltHash.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAmB7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,kDAIlC,IAAI,KAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4B/C,CAAA"}

package/dist/auth/strategies/local/incrementLoginAttempts.d.ts

@@ -1,9 +1,9 @@
 import type { SanitizedCollectionConfig } from '../../../collections/config/types.js';
-import { type Payload, type TypedUser } from '../../../index.js';
+import { type Payload, type User } from '../../../index.js';
 type Args = {
     collection: SanitizedCollectionConfig;
     payload: Payload;
-    user: TypedUser;
+    user: User;
 };
 export declare const incrementLoginAttempts: ({ collection, payload, user, }: Args) => Promise<void>;
 export {};

package/dist/auth/strategies/local/incrementLoginAttempts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAGjF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,SAAS,CAAA;CAChB,CAAA;AAID,eAAO,MAAM,sBAAsB,GAAU,gCAI1C,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}
+{"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG5E,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAID,eAAO,MAAM,sBAAsB,mCAIhC,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}

package/dist/auth/strategies/local/incrementLoginAttempts.js

@@ -92,7 +92,7 @@ export const incrementLoginAttempts = async ({ collection, payload, user })=>{
             if (currentUser?.sessions?.length) {
                 // Does not hurt also removing expired sessions
                 currentUser.sessions = currentUser.sessions.filter((session)=>{
-                    const sessionCreatedAt = new Date(session.createdAt);
+                    const sessionCreatedAt = new Date(session.createdAt ?? 0);
                     const twentySecondsAgo = new Date(currentTime - 20000);
                     // Remove sessions created within the last 20 seconds
                     return sessionCreatedAt <= twentySecondsAgo;

package/dist/auth/strategies/local/incrementLoginAttempts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\n\nimport { type JsonObject, type Payload, type TypedUser } from '../../../index.js'\nimport { isUserLocked } from '../../isUserLocked.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  payload: Payload\n  user: TypedUser\n}\n\n// Note: this function does not use req in its updates, as we want those to be visible in parallel requests that are on a different\n// transaction. At the same time, we want updates from parallel requests to be visible here.\nexport const incrementLoginAttempts = async ({\n  collection,\n  payload,\n  user,\n}: Args): Promise<void> => {\n  const {\n    auth: { lockTime, maxLoginAttempts },\n  } = collection\n\n  const currentTime = Date.now()\n\n  let updatedLockUntil: null | string = null\n  let updatedLoginAttempts: null | number = null\n\n  if (user.lockUntil && !isUserLocked(new Date(user.lockUntil))) {\n    // Expired lock, restart count at 1\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: null,\n        loginAttempts: 1,\n      },\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n    user.lockUntil = updatedLockUntil\n  } else {\n    const data: JsonObject = {\n      loginAttempts: {\n        $inc: 1,\n      },\n    }\n\n    const willReachMaxAttempts =\n      typeof user.loginAttempts === 'number' && user.loginAttempts + 1 >= maxLoginAttempts\n    // Lock the account if at max attempts and not already locked\n    if (willReachMaxAttempts) {\n      const lockUntil = new Date(currentTime + lockTime).toISOString()\n      data.lockUntil = lockUntil\n    }\n\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data,\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n  }\n\n  if (updatedLoginAttempts === null) {\n    throw new Error('Failed to update login attempts or lockUntil for user')\n  }\n\n  // Check updated latest lockUntil and loginAttempts in case there were parallel updates\n  const reachedMaxAttemptsForCurrentUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts - 1 >= maxLoginAttempts\n\n  const reachedMaxAttemptsForNextUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts >= maxLoginAttempts\n\n  if (reachedMaxAttemptsForCurrentUser) {\n    user.lockUntil = updatedLockUntil\n  }\n  user.loginAttempts = updatedLoginAttempts - 1 // -1, as the updated increment is applied for the *next* login attempt, not the current one\n\n  if (\n    reachedMaxAttemptsForNextUser &&\n    (!updatedLockUntil || !isUserLocked(new Date(updatedLockUntil)))\n  ) {\n    // If lockUntil reached max login attempts due to multiple parallel attempts but user was not locked yet,\n    const newLockUntil = new Date(currentTime + lockTime).toISOString()\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: newLockUntil,\n      },\n      returning: false,\n    })\n\n    if (reachedMaxAttemptsForCurrentUser) {\n      user.lockUntil = newLockUntil\n    }\n\n    if (collection.auth.useSessions) {\n      // Remove all active sessions that have been created in a 20 second window. This protects\n      // against brute force attacks - example: 99 incorrect, 1 correct parallel login attempts.\n      // The correct login attempt will be finished first, as it's faster due to not having to perform\n      // an additional db update here.\n      // However, this request (the incorrect login attempt request) can kill the successful login attempt here.\n\n      // Fetch user sessions separately (do not do this in the updateOne select in order to preserve the returning: true db call optimization)\n      const currentUser = await payload.db.findOne<TypedUser>({\n        collection: collection.slug,\n        select: {\n          sessions: true,\n        },\n        where: {\n          id: {\n            equals: user.id,\n          },\n        },\n      })\n      if (currentUser?.sessions?.length) {\n        // Does not hurt also removing expired sessions\n        currentUser.sessions = currentUser.sessions.filter((session) => {\n          const sessionCreatedAt = new Date(session.createdAt)\n          const twentySecondsAgo = new Date(currentTime - 20000)\n\n          // Remove sessions created within the last 20 seconds\n          return sessionCreatedAt <= twentySecondsAgo\n        })\n\n        user.sessions = currentUser.sessions\n\n        // Ensure updatedAt date is always updated\n        user.updatedAt = new Date().toISOString()\n\n        await payload.db.updateOne({\n          id: user.id,\n          collection: collection.slug,\n          data: user,\n          returning: false,\n        })\n      }\n    }\n  }\n}\n"],"names":["isUserLocked","incrementLoginAttempts","collection","payload","user","auth","lockTime","maxLoginAttempts","currentTime","Date","now","updatedLockUntil","updatedLoginAttempts","lockUntil","updatedUser","db","updateOne","id","slug","data","loginAttempts","select","$inc","willReachMaxAttempts","toISOString","Error","reachedMaxAttemptsForCurrentUser","reachedMaxAttemptsForNextUser","newLockUntil","returning","useSessions","currentUser","findOne","sessions","where","equals","length","filter","session","sessionCreatedAt","createdAt","twentySecondsAgo","updatedAt"],"mappings":"AAGA,SAASA,YAAY,QAAQ,wBAAuB;AAQpD,mIAAmI;AACnI,4FAA4F;AAC5F,OAAO,MAAMC,yBAAyB,OAAO,EAC3CC,UAAU,EACVC,OAAO,EACPC,IAAI,EACC;IACL,MAAM,EACJC,MAAM,EAAEC,QAAQ,EAAEC,gBAAgB,EAAE,EACrC,GAAGL;IAEJ,MAAMM,cAAcC,KAAKC,GAAG;IAE5B,IAAIC,mBAAkC;IACtC,IAAIC,uBAAsC;IAE1C,IAAIR,KAAKS,SAAS,IAAI,CAACb,aAAa,IAAIS,KAAKL,KAAKS,SAAS,IAAI;QAC7D,mCAAmC;QACnC,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAW;gBACXO,eAAe;YACjB;YACAC,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QACAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;QAChDhB,KAAKS,SAAS,GAAGF;IACnB,OAAO;QACL,MAAMQ,OAAmB;YACvBC,eAAe;gBACbE,MAAM;YACR;QACF;QAEA,MAAMC,uBACJ,OAAOnB,KAAKgB,aAAa,KAAK,YAAYhB,KAAKgB,aAAa,GAAG,KAAKb;QACtE,6DAA6D;QAC7D,IAAIgB,sBAAsB;YACxB,MAAMV,YAAY,IAAIJ,KAAKD,cAAcF,UAAUkB,WAAW;YAC9DL,KAAKN,SAAS,GAAGA;QACnB;QAEA,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC;YACAE,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QAEAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;IAClD;IAEA,IAAIR,yBAAyB,MAAM;QACjC,MAAM,IAAIa,MAAM;IAClB;IAEA,uFAAuF;IACvF,MAAMC,mCACJ,OAAOd,yBAAyB,YAAYA,uBAAuB,KAAKL;IAE1E,MAAMoB,gCACJ,OAAOf,yBAAyB,YAAYA,wBAAwBL;IAEtE,IAAImB,kCAAkC;QACpCtB,KAAKS,SAAS,GAAGF;IACnB;IACAP,KAAKgB,aAAa,GAAGR,uBAAuB,GAAE,4FAA4F;IAE1I,IACEe,iCACC,CAAA,CAAChB,oBAAoB,CAACX,aAAa,IAAIS,KAAKE,kBAAiB,GAC9D;QACA,yGAAyG;QACzG,MAAMiB,eAAe,IAAInB,KAAKD,cAAcF,UAAUkB,WAAW;QAEjE,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;YACzBC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAWe;YACb;YACAC,WAAW;QACb;QAEA,IAAIH,kCAAkC;YACpCtB,KAAKS,SAAS,GAAGe;QACnB;QAEA,IAAI1B,WAAWG,IAAI,CAACyB,WAAW,EAAE;YAC/B,yFAAyF;YACzF,0FAA0F;YAC1F,gGAAgG;YAChG,gCAAgC;YAChC,0GAA0G;YAE1G,wIAAwI;YACxI,MAAMC,cAAc,MAAM5B,QAAQY,EAAE,CAACiB,OAAO,CAAY;gBACtD9B,YAAYA,WAAWgB,IAAI;gBAC3BG,QAAQ;oBACNY,UAAU;gBACZ;gBACAC,OAAO;oBACLjB,IAAI;wBACFkB,QAAQ/B,KAAKa,EAAE;oBACjB;gBACF;YACF;YACA,IAAIc,aAAaE,UAAUG,QAAQ;gBACjC,+CAA+C;gBAC/CL,YAAYE,QAAQ,GAAGF,YAAYE,QAAQ,CAACI,MAAM,CAAC,CAACC;oBAClD,MAAMC,mBAAmB,IAAI9B,KAAK6B,QAAQE,SAAS;oBACnD,MAAMC,mBAAmB,IAAIhC,KAAKD,cAAc;oBAEhD,qDAAqD;oBACrD,OAAO+B,oBAAoBE;gBAC7B;gBAEArC,KAAK6B,QAAQ,GAAGF,YAAYE,QAAQ;gBAEpC,0CAA0C;gBAC1C7B,KAAKsC,SAAS,GAAG,IAAIjC,OAAOe,WAAW;gBAEvC,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;oBACzBC,IAAIb,KAAKa,EAAE;oBACXf,YAAYA,WAAWgB,IAAI;oBAC3BC,MAAMf;oBACNyB,WAAW;gBACb;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\n\nimport { type JsonObject, type Payload, type User } from '../../../index.js'\nimport { isUserLocked } from '../../isUserLocked.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  payload: Payload\n  user: User\n}\n\n// Note: this function does not use req in its updates, as we want those to be visible in parallel requests that are on a different\n// transaction. At the same time, we want updates from parallel requests to be visible here.\nexport const incrementLoginAttempts = async ({\n  collection,\n  payload,\n  user,\n}: Args): Promise<void> => {\n  const {\n    auth: { lockTime, maxLoginAttempts },\n  } = collection\n\n  const currentTime = Date.now()\n\n  let updatedLockUntil: null | string = null\n  let updatedLoginAttempts: null | number = null\n\n  if (user.lockUntil && !isUserLocked(new Date(user.lockUntil))) {\n    // Expired lock, restart count at 1\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: null,\n        loginAttempts: 1,\n      },\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n    user.lockUntil = updatedLockUntil\n  } else {\n    const data: JsonObject = {\n      loginAttempts: {\n        $inc: 1,\n      },\n    }\n\n    const willReachMaxAttempts =\n      typeof user.loginAttempts === 'number' && user.loginAttempts + 1 >= maxLoginAttempts\n    // Lock the account if at max attempts and not already locked\n    if (willReachMaxAttempts) {\n      const lockUntil = new Date(currentTime + lockTime).toISOString()\n      data.lockUntil = lockUntil\n    }\n\n    const updatedUser = await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data,\n      select: {\n        lockUntil: true,\n        loginAttempts: true,\n      },\n    })\n\n    updatedLockUntil = updatedUser.lockUntil\n    updatedLoginAttempts = updatedUser.loginAttempts\n  }\n\n  if (updatedLoginAttempts === null) {\n    throw new Error('Failed to update login attempts or lockUntil for user')\n  }\n\n  // Check updated latest lockUntil and loginAttempts in case there were parallel updates\n  const reachedMaxAttemptsForCurrentUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts - 1 >= maxLoginAttempts\n\n  const reachedMaxAttemptsForNextUser =\n    typeof updatedLoginAttempts === 'number' && updatedLoginAttempts >= maxLoginAttempts\n\n  if (reachedMaxAttemptsForCurrentUser) {\n    user.lockUntil = updatedLockUntil\n  }\n  user.loginAttempts = updatedLoginAttempts - 1 // -1, as the updated increment is applied for the *next* login attempt, not the current one\n\n  if (\n    reachedMaxAttemptsForNextUser &&\n    (!updatedLockUntil || !isUserLocked(new Date(updatedLockUntil)))\n  ) {\n    // If lockUntil reached max login attempts due to multiple parallel attempts but user was not locked yet,\n    const newLockUntil = new Date(currentTime + lockTime).toISOString()\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collection.slug,\n      data: {\n        lockUntil: newLockUntil,\n      },\n      returning: false,\n    })\n\n    if (reachedMaxAttemptsForCurrentUser) {\n      user.lockUntil = newLockUntil\n    }\n\n    if (collection.auth.useSessions) {\n      // Remove all active sessions that have been created in a 20 second window. This protects\n      // against brute force attacks - example: 99 incorrect, 1 correct parallel login attempts.\n      // The correct login attempt will be finished first, as it's faster due to not having to perform\n      // an additional db update here.\n      // However, this request (the incorrect login attempt request) can kill the successful login attempt here.\n\n      // Fetch user sessions separately (do not do this in the updateOne select in order to preserve the returning: true db call optimization)\n      const currentUser = await payload.db.findOne<User>({\n        collection: collection.slug,\n        select: {\n          sessions: true,\n        },\n        where: {\n          id: {\n            equals: user.id,\n          },\n        },\n      })\n      if (currentUser?.sessions?.length) {\n        // Does not hurt also removing expired sessions\n        currentUser.sessions = currentUser.sessions.filter((session) => {\n          const sessionCreatedAt = new Date(session.createdAt ?? 0)\n          const twentySecondsAgo = new Date(currentTime - 20000)\n\n          // Remove sessions created within the last 20 seconds\n          return sessionCreatedAt <= twentySecondsAgo\n        })\n\n        user.sessions = currentUser.sessions\n\n        // Ensure updatedAt date is always updated\n        user.updatedAt = new Date().toISOString()\n\n        await payload.db.updateOne({\n          id: user.id,\n          collection: collection.slug,\n          data: user,\n          returning: false,\n        })\n      }\n    }\n  }\n}\n"],"names":["isUserLocked","incrementLoginAttempts","collection","payload","user","auth","lockTime","maxLoginAttempts","currentTime","Date","now","updatedLockUntil","updatedLoginAttempts","lockUntil","updatedUser","db","updateOne","id","slug","data","loginAttempts","select","$inc","willReachMaxAttempts","toISOString","Error","reachedMaxAttemptsForCurrentUser","reachedMaxAttemptsForNextUser","newLockUntil","returning","useSessions","currentUser","findOne","sessions","where","equals","length","filter","session","sessionCreatedAt","createdAt","twentySecondsAgo","updatedAt"],"mappings":"AAGA,SAASA,YAAY,QAAQ,wBAAuB;AAQpD,mIAAmI;AACnI,4FAA4F;AAC5F,OAAO,MAAMC,yBAAyB,OAAO,EAC3CC,UAAU,EACVC,OAAO,EACPC,IAAI,EACC;IACL,MAAM,EACJC,MAAM,EAAEC,QAAQ,EAAEC,gBAAgB,EAAE,EACrC,GAAGL;IAEJ,MAAMM,cAAcC,KAAKC,GAAG;IAE5B,IAAIC,mBAAkC;IACtC,IAAIC,uBAAsC;IAE1C,IAAIR,KAAKS,SAAS,IAAI,CAACb,aAAa,IAAIS,KAAKL,KAAKS,SAAS,IAAI;QAC7D,mCAAmC;QACnC,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAW;gBACXO,eAAe;YACjB;YACAC,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QACAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;QAChDhB,KAAKS,SAAS,GAAGF;IACnB,OAAO;QACL,MAAMQ,OAAmB;YACvBC,eAAe;gBACbE,MAAM;YACR;QACF;QAEA,MAAMC,uBACJ,OAAOnB,KAAKgB,aAAa,KAAK,YAAYhB,KAAKgB,aAAa,GAAG,KAAKb;QACtE,6DAA6D;QAC7D,IAAIgB,sBAAsB;YACxB,MAAMV,YAAY,IAAIJ,KAAKD,cAAcF,UAAUkB,WAAW;YAC9DL,KAAKN,SAAS,GAAGA;QACnB;QAEA,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC;YACAE,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QAEAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;IAClD;IAEA,IAAIR,yBAAyB,MAAM;QACjC,MAAM,IAAIa,MAAM;IAClB;IAEA,uFAAuF;IACvF,MAAMC,mCACJ,OAAOd,yBAAyB,YAAYA,uBAAuB,KAAKL;IAE1E,MAAMoB,gCACJ,OAAOf,yBAAyB,YAAYA,wBAAwBL;IAEtE,IAAImB,kCAAkC;QACpCtB,KAAKS,SAAS,GAAGF;IACnB;IACAP,KAAKgB,aAAa,GAAGR,uBAAuB,GAAE,4FAA4F;IAE1I,IACEe,iCACC,CAAA,CAAChB,oBAAoB,CAACX,aAAa,IAAIS,KAAKE,kBAAiB,GAC9D;QACA,yGAAyG;QACzG,MAAMiB,eAAe,IAAInB,KAAKD,cAAcF,UAAUkB,WAAW;QAEjE,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;YACzBC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAWe;YACb;YACAC,WAAW;QACb;QAEA,IAAIH,kCAAkC;YACpCtB,KAAKS,SAAS,GAAGe;QACnB;QAEA,IAAI1B,WAAWG,IAAI,CAACyB,WAAW,EAAE;YAC/B,yFAAyF;YACzF,0FAA0F;YAC1F,gGAAgG;YAChG,gCAAgC;YAChC,0GAA0G;YAE1G,wIAAwI;YACxI,MAAMC,cAAc,MAAM5B,QAAQY,EAAE,CAACiB,OAAO,CAAO;gBACjD9B,YAAYA,WAAWgB,IAAI;gBAC3BG,QAAQ;oBACNY,UAAU;gBACZ;gBACAC,OAAO;oBACLjB,IAAI;wBACFkB,QAAQ/B,KAAKa,EAAE;oBACjB;gBACF;YACF;YACA,IAAIc,aAAaE,UAAUG,QAAQ;gBACjC,+CAA+C;gBAC/CL,YAAYE,QAAQ,GAAGF,YAAYE,QAAQ,CAACI,MAAM,CAAC,CAACC;oBAClD,MAAMC,mBAAmB,IAAI9B,KAAK6B,QAAQE,SAAS,IAAI;oBACvD,MAAMC,mBAAmB,IAAIhC,KAAKD,cAAc;oBAEhD,qDAAqD;oBACrD,OAAO+B,oBAAoBE;gBAC7B;gBAEArC,KAAK6B,QAAQ,GAAGF,YAAYE,QAAQ;gBAEpC,0CAA0C;gBAC1C7B,KAAKsC,SAAS,GAAG,IAAIjC,OAAOe,WAAW;gBAEvC,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;oBACzBC,IAAIb,KAAKa,EAAE;oBACXf,YAAYA,WAAWgB,IAAI;oBAC3BC,MAAMf;oBACNyB,WAAW;gBACb;YACF;QACF;IACF;AACF,EAAC"}

package/dist/auth/strategies/local/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAMhF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,UAAU,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,8CAMzC,IAAI,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0ExC,CAAA"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAMhF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,UAAU,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,iDAM/B,IAAI,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0ExC,CAAA"}

package/dist/auth/strategies/local/resetLoginAttempts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resetLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAU,oCAKtC,IAAI,KAAG,OAAO,CAAC,IAAI,CAiBrB,CAAA"}
+{"version":3,"file":"resetLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,kBAAkB,uCAK5B,IAAI,KAAG,OAAO,CAAC,IAAI,CAiBrB,CAAA"}

package/dist/auth/types.d.ts

@@ -1,5 +1,4 @@
-import type { DeepRequired } from 'ts-essentials';
-import type { CollectionSlug, GlobalSlug, Payload, TypedUser } from '../index.js';
+import type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js';
 import type { PayloadRequest, Where } from '../types/index.js';
 /**
  * A permission object that can be used to determine if a user has access to a specific operation.
@@ -89,28 +88,35 @@ export type SanitizedPermissions = {
         [globalSlug: string]: SanitizedGlobalPermission;
     };
 };
-type BaseUser = {
-    collection: string;
-    email?: string;
-    id: number | string;
-    sessions?: Array<UserSession>;
-    username?: string;
+/**
+ * Fields injected onto a user at authentication time. They are never stored in the database and
+ * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated
+ * user (`req.user`, login/auth/me results, auth strategies).
+ */
+export type AuthRuntimeFields = {
+    /**
+     * The session ID of the current request. May be present on request-authenticated users when
+     * sessions are enabled.
+     */
+    _sid?: string;
+    /**
+     * The name of the auth strategy that authenticated the request (e.g. `local-jwt`).
+     */
+    _strategy?: string;
 };
 /**
- * @deprecated Use `TypedUser` instead. This will be removed in 4.0.
+ * Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).
+ * Stripping it cleanly isn't possible, because auth operations build the authenticated user
+ * from a read `User` doc, so a `never`-typed `password` would break those assignments
  */
-export type UntypedUser = {
-    [key: string]: any;
-} & BaseUser;
 /**
- * `collection` is not available one the client. It's only available on the server (req.user)
- * On the client, you can access the collection via config.admin.user. Config can be accessed using the useConfig() hook
+ * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`). This is
+ * what `req.user`, `payload.auth()`, the `me` operation, auth strategies, and `useAuth().user`
+ * return.
  */
-export type ClientUser = {
-    [key: string]: any;
-} & BaseUser;
+export type AuthenticatedUser = AuthRuntimeFields & User;
 export type UserSession = {
-    createdAt: Date | string;
+    createdAt?: Date | null | string;
     expiresAt: Date | string;
     id: string;
 };
@@ -149,10 +155,7 @@ export type AuthStrategyFunctionArgs = {
 };
 export type AuthStrategyResult = {
     responseHeaders?: Headers;
-    user: ({
-        _strategy?: string;
-        collection?: string;
-    } & TypedUser) | null;
+    user: AuthenticatedUser | null;
 };
 export type AuthStrategyFunction = (args: AuthStrategyFunctionArgs) => AuthStrategyResult | Promise<AuthStrategyResult>;
 export type AuthStrategy = {
@@ -168,15 +171,16 @@ export type LoginWithUsernameOptions = {
     requireEmail?: boolean;
     requireUsername?: boolean;
 };
+type AuthCookies = {
+    domain?: string;
+    sameSite?: 'Lax' | 'None' | 'Strict' | boolean;
+    secure?: boolean;
+};
 export interface IncomingAuthType {
     /**
      * Set cookie options, including secure, sameSite, and domain. For advanced users.
      */
-    cookies?: {
-        domain?: string;
-        sameSite?: 'Lax' | 'None' | 'Strict' | boolean;
-        secure?: boolean;
-    };
+    cookies?: AuthCookies;
     /**
      * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.
      * @default 0
@@ -259,14 +263,9 @@ export type VerifyConfig = {
     generateEmailHTML?: GenerateVerifyEmailHTML;
     generateEmailSubject?: GenerateVerifyEmailSubject;
 };
-export interface Auth extends Omit<DeepRequired<IncomingAuthType>, 'forgotPassword' | 'loginWithUsername' | 'verify'> {
-    forgotPassword?: {
-        expiration?: number;
-        generateEmailHTML?: GenerateForgotPasswordEmailHTML;
-        generateEmailSubject?: GenerateForgotPasswordEmailSubject;
-    };
-    loginWithUsername: false | LoginWithUsernameOptions;
-    verify?: boolean | VerifyConfig;
+export interface Auth extends Omit<IncomingAuthType, 'cookies' | 'forgotPassword' | 'lockTime' | 'loginWithUsername' | 'maxLoginAttempts' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>, Required<Pick<IncomingAuthType, 'forgotPassword' | 'lockTime' | 'maxLoginAttempts' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>> {
+    cookies: Pick<AuthCookies, 'domain'> & Required<Pick<AuthCookies, 'sameSite' | 'secure'>>;
+    loginWithUsername: false | Required<LoginWithUsernameOptions>;
 }
 export declare function hasWhereAccessResult(result: boolean | Where): result is Where;
 export {};

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;CACb,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG,QAAQ,CAAA;AAEZ;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG,QAAQ,CAAA;AAEZ,MAAM,MAAM,WAAW,GAAG;IAAE,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAC5F,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EACA,CAAC;QACC,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,SAAS,CAAC,GACd,IAAI,CAAA;CACT,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;QAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,CAAA;IACD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,IAAI,CAAA;IACR;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC/F,cAAc,CAAC,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD,iBAAiB,EAAE,KAAK,GAAG,wBAAwB,CAAA;IACnD,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAA;CAChC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;CACb,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExD,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;IACxB,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AACD,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,KAAK,WAAW,GAAG;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,IAAI,CAAA;IACR;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SAAQ,IAAI,CACR,gBAAgB,EACd,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,EACD,QAAQ,CACN,IAAI,CACF,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,CACF;IACH,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAA;IACzF,iBAAiB,EAAE,KAAK,GAAG,QAAQ,CAAC,wBAAwB,CAAC,CAAA;CAC9D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}

package/dist/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { DeepRequired } from 'ts-essentials'\n\nimport type { CollectionSlug, GlobalSlug, Payload, TypedUser } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/**\n * A permission object that can be used to determine if a user has access to a specific operation.\n */\nexport type Permission = {\n  permission: boolean\n  where?: Where\n}\n\nexport type FieldsPermissions = {\n  [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n  create: Permission\n  fields: FieldsPermissions\n  read: Permission\n  update: Permission\n}\n\nexport type SanitizedBlockPermissions =\n  | {\n      fields: SanitizedFieldsPermissions\n    }\n  | true\n\nexport type BlocksPermissions = {\n  [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n  | {\n      [blockSlug: string]: SanitizedBlockPermissions\n    }\n  | true\n\nexport type FieldPermissions = {\n  blocks?: BlocksPermissions\n  create?: Permission\n  fields?: FieldsPermissions\n  read?: Permission\n  update?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n  | {\n      blocks?: SanitizedBlocksPermissions\n      create: true\n      fields?: SanitizedFieldsPermissions\n      read: true\n      update: true\n    }\n  | true\n\nexport type SanitizedFieldsPermissions =\n  | {\n      [fieldName: string]: SanitizedFieldPermissions\n    }\n  | true\n\nexport type CollectionPermission = {\n  create?: Permission\n  delete?: Permission\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  // Auth-enabled Collections only\n  unlock?: Permission\n  update?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n  create?: true\n  delete?: true\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  // Auth-enabled Collections only\n  unlock?: true\n  update?: true\n}\n\nexport type GlobalPermission = {\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  update?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  update?: true\n}\n\nexport type DocumentPermissions = CollectionPermission | GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission | SanitizedGlobalPermission\n\nexport type Permissions = {\n  canAccessAdmin: boolean\n  collections?: Record<CollectionSlug, CollectionPermission>\n  globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n  canAccessAdmin?: boolean\n  collections?: {\n    [collectionSlug: string]: SanitizedCollectionPermission\n  }\n  globals?: {\n    [globalSlug: string]: SanitizedGlobalPermission\n  }\n}\n\ntype BaseUser = {\n  collection: string\n  email?: string\n  id: number | string\n  sessions?: Array<UserSession>\n  username?: string\n}\n\n/**\n * @deprecated Use `TypedUser` instead. This will be removed in 4.0.\n */\nexport type UntypedUser = {\n  [key: string]: any\n} & BaseUser\n\n/**\n * `collection` is not available one the client. It's only available on the server (req.user)\n * On the client, you can access the collection via config.admin.user. Config can be accessed using the useConfig() hook\n */\nexport type ClientUser = {\n  [key: string]: any\n} & BaseUser\n\nexport type UserSession = { createdAt: Date | string; expiresAt: Date | string; id: string }\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\nexport type AuthStrategyFunctionArgs = {\n  /**\n   * Specifies whether or not response headers can be set from this strategy.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  isGraphQL?: boolean\n  payload: Payload\n  /**\n   * The AuthStrategy name property from the payload config.\n   */\n  strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n  responseHeaders?: Headers\n  user:\n    | ({\n        _strategy?: string\n        collection?: string\n      } & TypedUser)\n    | null\n}\n\nexport type AuthStrategyFunction = (\n  args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult | Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n  authenticate: AuthStrategyFunction\n  name: string\n}\n\nexport type LoginWithUsernameOptions =\n  | {\n      allowEmailLogin?: false\n      requireEmail?: boolean\n      // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n      requireUsername?: true\n    }\n  | {\n      allowEmailLogin?: true\n      requireEmail?: boolean\n      requireUsername?: boolean\n    }\n\nexport interface IncomingAuthType {\n  /**\n   * Set cookie options, including secure, sameSite, and domain. For advanced users.\n   */\n  cookies?: {\n    domain?: string\n    sameSite?: 'Lax' | 'None' | 'Strict' | boolean\n    secure?: boolean\n  }\n  /**\n   * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n   * @default 0\n   */\n  depth?: number\n  /**\n   * Advanced - disable Payload's built-in local auth strategy. Only use this property if you have replaced Payload's auth mechanisms with your own.\n   */\n  disableLocalStrategy?:\n    | {\n        /**\n         * Include auth fields on the collection even though the local strategy is disabled.\n         * Useful when you do not want the database or types to vary depending on the auth configuration.\n         */\n        enableFields?: true\n        optionalPassword?: true\n      }\n    | true\n  /**\n   * Customize the way that the forgotPassword operation functions.\n   * @link https://payloadcms.com/docs/authentication/email#forgot-password\n   */\n  forgotPassword?: {\n    /**\n     * The number of milliseconds that the forgot password token should be valid for.\n     * @default 3600000 // 1 hour\n     */\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n  }\n  /**\n   * Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n   */\n  lockTime?: number\n  /**\n   * Ability to allow users to login with username/password.\n   *\n   * @link https://payloadcms.com/docs/authentication/overview#login-with-username\n   */\n  loginWithUsername?: boolean | LoginWithUsernameOptions\n  /**\n   * Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n   */\n  maxLoginAttempts?: number\n  /***\n   * Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n   */\n  removeTokenFromResponses?: true\n  /**\n   * Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n   * @link https://payloadcms.com/docs/authentication/custom-strategies\n   */\n  strategies?: AuthStrategy[]\n  /**\n   * Controls how many seconds the token will be valid for. Default is 2 hours.\n   * @default 7200\n   * @link https://payloadcms.com/docs/authentication/overview#config-options\n   */\n  tokenExpiration?: number\n  /**\n   * Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n   * @default false\n   * @link https://payloadcms.com/docs/authentication/api-keys\n   */\n  useAPIKey?: boolean\n\n  /**\n   * Use sessions for authentication. Enabled by default.\n   * @default true\n   */\n  useSessions?: boolean\n\n  /**\n   * Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n   * @link https://payloadcms.com/docs/authentication/email#email-verification\n   */\n  verify?:\n    | {\n        generateEmailHTML?: GenerateVerifyEmailHTML\n        generateEmailSubject?: GenerateVerifyEmailSubject\n      }\n    | boolean\n}\n\nexport type VerifyConfig = {\n  generateEmailHTML?: GenerateVerifyEmailHTML\n  generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n  extends Omit<DeepRequired<IncomingAuthType>, 'forgotPassword' | 'loginWithUsername' | 'verify'> {\n  forgotPassword?: {\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n  }\n  loginWithUsername: false | LoginWithUsernameOptions\n  verify?: boolean | VerifyConfig\n}\n\nexport function hasWhereAccessResult(result: boolean | Where): result is Where {\n  return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"AAmUA,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/**\n * A permission object that can be used to determine if a user has access to a specific operation.\n */\nexport type Permission = {\n  permission: boolean\n  where?: Where\n}\n\nexport type FieldsPermissions = {\n  [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n  create: Permission\n  fields: FieldsPermissions\n  read: Permission\n  update: Permission\n}\n\nexport type SanitizedBlockPermissions =\n  | {\n      fields: SanitizedFieldsPermissions\n    }\n  | true\n\nexport type BlocksPermissions = {\n  [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n  | {\n      [blockSlug: string]: SanitizedBlockPermissions\n    }\n  | true\n\nexport type FieldPermissions = {\n  blocks?: BlocksPermissions\n  create?: Permission\n  fields?: FieldsPermissions\n  read?: Permission\n  update?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n  | {\n      blocks?: SanitizedBlocksPermissions\n      create: true\n      fields?: SanitizedFieldsPermissions\n      read: true\n      update: true\n    }\n  | true\n\nexport type SanitizedFieldsPermissions =\n  | {\n      [fieldName: string]: SanitizedFieldPermissions\n    }\n  | true\n\nexport type CollectionPermission = {\n  create?: Permission\n  delete?: Permission\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  // Auth-enabled Collections only\n  unlock?: Permission\n  update?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n  create?: true\n  delete?: true\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  // Auth-enabled Collections only\n  unlock?: true\n  update?: true\n}\n\nexport type GlobalPermission = {\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  update?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  update?: true\n}\n\nexport type DocumentPermissions = CollectionPermission | GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission | SanitizedGlobalPermission\n\nexport type Permissions = {\n  canAccessAdmin: boolean\n  collections?: Record<CollectionSlug, CollectionPermission>\n  globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n  canAccessAdmin?: boolean\n  collections?: {\n    [collectionSlug: string]: SanitizedCollectionPermission\n  }\n  globals?: {\n    [globalSlug: string]: SanitizedGlobalPermission\n  }\n}\n\n/**\n * Fields injected onto a user at authentication time. They are never stored in the database and\n * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated\n * user (`req.user`, login/auth/me results, auth strategies).\n */\nexport type AuthRuntimeFields = {\n  /**\n   * The session ID of the current request. May be present on request-authenticated users when\n   * sessions are enabled.\n   */\n  _sid?: string\n  /**\n   * The name of the auth strategy that authenticated the request (e.g. `local-jwt`).\n   */\n  _strategy?: string\n}\n\n/**\n * Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).\n * Stripping it cleanly isn't possible, because auth operations build the authenticated user\n * from a read `User` doc, so a `never`-typed `password` would break those assignments\n */\n/**\n * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`). This is\n * what `req.user`, `payload.auth()`, the `me` operation, auth strategies, and `useAuth().user`\n * return.\n */\nexport type AuthenticatedUser = AuthRuntimeFields & User\n\nexport type UserSession = {\n  createdAt?: Date | null | string\n  expiresAt: Date | string\n  id: string\n}\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\nexport type AuthStrategyFunctionArgs = {\n  /**\n   * Specifies whether or not response headers can be set from this strategy.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  isGraphQL?: boolean\n  payload: Payload\n  /**\n   * The AuthStrategy name property from the payload config.\n   */\n  strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport type AuthStrategyFunction = (\n  args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult | Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n  authenticate: AuthStrategyFunction\n  name: string\n}\n\nexport type LoginWithUsernameOptions =\n  | {\n      allowEmailLogin?: false\n      requireEmail?: boolean\n      // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n      requireUsername?: true\n    }\n  | {\n      allowEmailLogin?: true\n      requireEmail?: boolean\n      requireUsername?: boolean\n    }\n\ntype AuthCookies = {\n  domain?: string\n  sameSite?: 'Lax' | 'None' | 'Strict' | boolean\n  secure?: boolean\n}\n\nexport interface IncomingAuthType {\n  /**\n   * Set cookie options, including secure, sameSite, and domain. For advanced users.\n   */\n  cookies?: AuthCookies\n  /**\n   * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n   * @default 0\n   */\n  depth?: number\n  /**\n   * Advanced - disable Payload's built-in local auth strategy. Only use this property if you have replaced Payload's auth mechanisms with your own.\n   */\n  disableLocalStrategy?:\n    | {\n        /**\n         * Include auth fields on the collection even though the local strategy is disabled.\n         * Useful when you do not want the database or types to vary depending on the auth configuration.\n         */\n        enableFields?: true\n        optionalPassword?: true\n      }\n    | true\n  /**\n   * Customize the way that the forgotPassword operation functions.\n   * @link https://payloadcms.com/docs/authentication/email#forgot-password\n   */\n  forgotPassword?: {\n    /**\n     * The number of milliseconds that the forgot password token should be valid for.\n     * @default 3600000 // 1 hour\n     */\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n  }\n  /**\n   * Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n   */\n  lockTime?: number\n  /**\n   * Ability to allow users to login with username/password.\n   *\n   * @link https://payloadcms.com/docs/authentication/overview#login-with-username\n   */\n  loginWithUsername?: boolean | LoginWithUsernameOptions\n  /**\n   * Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n   */\n  maxLoginAttempts?: number\n  /***\n   * Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n   */\n  removeTokenFromResponses?: true\n  /**\n   * Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n   * @link https://payloadcms.com/docs/authentication/custom-strategies\n   */\n  strategies?: AuthStrategy[]\n  /**\n   * Controls how many seconds the token will be valid for. Default is 2 hours.\n   * @default 7200\n   * @link https://payloadcms.com/docs/authentication/overview#config-options\n   */\n  tokenExpiration?: number\n  /**\n   * Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n   * @default false\n   * @link https://payloadcms.com/docs/authentication/api-keys\n   */\n  useAPIKey?: boolean\n\n  /**\n   * Use sessions for authentication. Enabled by default.\n   * @default true\n   */\n  useSessions?: boolean\n\n  /**\n   * Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n   * @link https://payloadcms.com/docs/authentication/email#email-verification\n   */\n  verify?:\n    | {\n        generateEmailHTML?: GenerateVerifyEmailHTML\n        generateEmailSubject?: GenerateVerifyEmailSubject\n      }\n    | boolean\n}\n\nexport type VerifyConfig = {\n  generateEmailHTML?: GenerateVerifyEmailHTML\n  generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n  extends Omit<\n      IncomingAuthType,\n      | 'cookies'\n      | 'forgotPassword'\n      | 'lockTime'\n      | 'loginWithUsername'\n      | 'maxLoginAttempts'\n      | 'strategies'\n      | 'tokenExpiration'\n      | 'useSessions'\n      | 'verify'\n    >,\n    Required<\n      Pick<\n        IncomingAuthType,\n        | 'forgotPassword'\n        | 'lockTime'\n        | 'maxLoginAttempts'\n        | 'strategies'\n        | 'tokenExpiration'\n        | 'useSessions'\n        | 'verify'\n      >\n    > {\n  cookies: Pick<AuthCookies, 'domain'> & Required<Pick<AuthCookies, 'sameSite' | 'secure'>>\n  loginWithUsername: false | Required<LoginWithUsernameOptions>\n}\n\nexport function hasWhereAccessResult(result: boolean | Where): result is Where {\n  return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"AA0VA,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}

package/dist/auth/withBaseAccess.d.ts

@@ -0,0 +1,22 @@
+import type { CollectionAccess } from '../collections/config/types.js';
+import type { Access } from '../config/types.js';
+import type { GlobalAccess } from '../globals/config/types.js';
+type CommonArgs = {
+    access?: Access;
+    slug: string;
+};
+type AdminAccess = NonNullable<CollectionAccess['admin']>;
+type Args = ({
+    entityType: 'collection';
+    operation: Exclude<keyof CollectionAccess, 'admin'>;
+} | {
+    entityType: 'global';
+    operation: keyof GlobalAccess;
+}) & CommonArgs;
+export declare const withBaseAccess: (options: Args) => Access;
+export declare const withBaseAdminAccess: ({ slug, access, }: {
+    access?: AdminAccess;
+    slug: string;
+}) => AdminAccess;
+export {};
+//# sourceMappingURL=withBaseAccess.d.ts.map

package/dist/auth/withBaseAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withBaseAccess.d.ts","sourceRoot":"","sources":["../../src/auth/withBaseAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,MAAM,EAA4B,MAAM,oBAAoB,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAE9D,KAAK,UAAU,GAAG;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,KAAK,WAAW,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;AAEzD,KAAK,IAAI,GAAG,CACR;IACE,UAAU,EAAE,YAAY,CAAA;IACxB,SAAS,EAAE,OAAO,CAAC,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAA;CACpD,GACD;IACE,UAAU,EAAE,QAAQ,CAAA;IACpB,SAAS,EAAE,MAAM,YAAY,CAAA;CAC9B,CACJ,GACC,UAAU,CAAA;AAIZ,eAAO,MAAM,cAAc,YAAa,IAAI,KAAG,MAkD9C,CAAA;AAED,eAAO,MAAM,mBAAmB,sBAG7B;IACD,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;CACb,KAAG,WA2BH,CAAA"}