payload 4.0.0-internal.4cbdd50 → 4.0.0-internal.4e1f822

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/types/index.ts"],"sourcesContent":["import type { I18n, TFunction } from '@payloadcms/translations'\nimport type DataLoader from 'dataloader'\nimport type { OptionalKeys, RequiredKeys } from 'ts-essentials'\nimport type { URL } from 'url'\n\nimport type { ServerAdapter } from '../admin/adapters/server.js'\nimport type {\n  DataFromCollectionSlug,\n  QueryDraftDataFromCollectionSlug,\n  TypeWithID,\n  TypeWithTimestamps,\n} from '../collections/config/types.js'\nimport type payload from '../index.js'\nimport type {\n  CollectionSlug,\n  DataFromGlobalSlug,\n  GlobalSlug,\n  Payload,\n  RequestContext,\n  TypedCollectionJoins,\n  TypedCollectionSelect,\n  TypedFallbackLocale,\n  TypedLocale,\n  TypedUser,\n} from '../index.js'\nimport type { File } from '../uploads/types.js'\nimport type { Operator } from './constants.js'\nexport type { TypeWithID } from '../collections/config/types.js'\nexport type { Payload } from '../index.js'\n\nexport type CustomPayloadRequestProperties = {\n  context: RequestContext\n  /** The locale that should be used for a field when it is not translated to the requested locale */\n  fallbackLocale?: TypedFallbackLocale\n  i18n: I18n\n  /**\n   * The requested locale if specified\n   * Only available for localized collections\n   *\n   * Suppressing warning below as it is a valid use case - won't be an issue if generated types exist\n   */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  locale?: 'all' | TypedLocale\n  /**\n   * The payload object\n   */\n  payload: typeof payload\n  /**\n   * The context in which the request is being made\n   */\n  payloadAPI: 'GraphQL' | 'local' | 'REST'\n  /** Optimized document loader */\n  payloadDataLoader: {\n    /**\n     * Wraps `payload.find` with a cache to deduplicate requests\n     * @experimental This is may be replaced by a more robust cache strategy in future versions\n     * By calling this method with the same arguments many times in one request, it will only be handled one time\n     * const result = await req.payloadDataLoader.find({\n     *  collection,\n     *  req,\n     *  where: findWhere,\n     * })\n     */\n    find: Payload['find']\n  } & DataLoader<string, TypeWithID>\n  /** Resized versions of the image that was uploaded during this request */\n  payloadUploadSizes?: Record<string, Buffer>\n  /** Query params on the request */\n  query: Record<string, unknown>\n  /** Any response headers that are required to be set when a response is sent */\n  responseHeaders?: Headers\n  /** The route parameters\n   * @example\n   * /:collection/:id -> /posts/123\n   * { collection: 'posts', id: '123' }\n   */\n  routeParams?: Record<string, unknown>\n  /**\n   * Framework abstraction for server-only navigation, cookies, and headers APIs.\n   * Populated by the framework adapter (e.g. `@payloadcms/next`). Plugins that\n   * have access to `req` should call methods here (`req.server.unauthorized()`,\n   * `req.server.redirect(...)`) instead of importing from `next/navigation` or\n   * `next/headers` directly. Optional because non-framework contexts (jobs,\n   * scripts, tests) construct requests without a server adapter.\n   */\n  server?: ServerAdapter\n  /** Translate function - duplicate of i18n.t */\n  t: TFunction\n  /**\n   * Identifier for the database transaction for interactions in a single, all-or-nothing operation.\n   * Can also be used to ensure consistency when multiple operations try to create a transaction concurrently on the same request.\n   */\n  transactionID?: number | Promise<number | string> | string\n  /** The signed-in user */\n  user: null | TypedUser\n} & Pick<\n  URL,\n  'hash' | 'host' | 'href' | 'origin' | 'pathname' | 'port' | 'protocol' | 'search' | 'searchParams'\n>\ntype PayloadRequestData = {\n  /**\n   * Data from the request body\n   *\n   * Within Payload operations, i.e. hooks, data will be there\n   * BUT in custom endpoints it will not be, you will need to\n   * use either:\n   *  1. `const data = await req.json()`\n   *\n   *  2. import { addDataAndFileToRequest } from 'payload'\n   *    `await addDataAndFileToRequest(req)`\n   *\n   * You should not expect this object to be the document data. It is the request data.\n   * */\n  data?: JsonObject\n  /** The file on the request, same rules apply as the `data` property */\n  file?: {\n    /**\n     * Context of the file when it was uploaded via client side.\n     */\n    clientUploadContext?: unknown\n  } & File\n  /** All files from multipart form data, keyed by field name */\n  files?: Record<string, File | File[]>\n}\nexport interface PayloadRequest\n  extends CustomPayloadRequestProperties,\n    Partial<Request>,\n    PayloadRequestData {\n  headers: Request['headers']\n}\n\nexport type { Operator }\n\n// Makes it so things like passing new Date() will error\nexport type JsonValue = JsonArray | JsonObject | unknown //Date | JsonArray | JsonObject | boolean | null | number | string // TODO: Evaluate proper, strong type for this\n\nexport type JsonArray = Array<JsonValue>\n\nexport interface JsonObject {\n  [key: string]: any\n}\n\nexport type WhereField = {\n  // any json-serializable value\n  [key in Operator]?: JsonValue\n}\n\nexport type Where = {\n  [key: string]: Where[] | WhereField\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  and?: Where[]\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  or?: Where[]\n}\n\nexport type Sort = Array<string> | string\n\ntype SerializableValue = boolean | number | object | string\nexport type DefaultValue =\n  | ((args: {\n      locale?: TypedLocale\n      req: PayloadRequest\n      user: PayloadRequest['user']\n    }) => SerializableValue)\n  | SerializableValue\n\n/**\n * Applies pagination for join fields for including collection relationships\n */\nexport type JoinQuery<TSlug extends CollectionSlug = string> =\n  TypedCollectionJoins[TSlug] extends Record<string, string>\n    ?\n        | false\n        | Partial<{\n            [K in keyof TypedCollectionJoins[TSlug]]:\n              | {\n                  count?: boolean\n                  limit?: number\n                  page?: number\n                  sort?: string\n                  where?: Where\n                }\n              | false\n          }>\n    : never\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type Document = any\n\nexport type Operation = 'create' | 'delete' | 'read' | 'update'\nexport type VersionOperations = 'readVersions'\nexport type AuthOperations = 'unlock'\nexport type AllOperations = AuthOperations | Operation | VersionOperations\n\nexport function docHasTimestamps(doc: any): doc is TypeWithTimestamps {\n  return doc?.createdAt && doc?.updatedAt\n}\n\nexport type IfAny<T, Y, N> = 0 extends 1 & T ? Y : N // This is a commonly used trick to detect 'any'\nexport type IsAny<T> = IfAny<T, true, false>\nexport type ReplaceAny<T, DefaultType> = IsAny<T> extends true ? DefaultType : T\n\nexport type SelectIncludeType = {\n  [k: string]: SelectIncludeType | true\n}\n\nexport type SelectExcludeType = {\n  [k: string]: false | SelectExcludeType\n}\n\nexport type SelectMode = 'exclude' | 'include'\n\nexport type SelectType = SelectExcludeType | SelectIncludeType\n\n/**\n * Operations that invoke an entity-level `select` function.\n *\n * Narrower than `HookOperationType`: `select` runs only for read- and\n * write-path operations that materialize a document (`create`, `delete`,\n * `read`, `restoreVersion`, `update`). Operations like `autosave`, `count`,\n * `countVersions`, `forgotPassword`, `login`, `readDistinct`, `refresh`, and\n * `resetPassword` do not invoke `select` and are intentionally excluded.\n */\nexport type SelectFnOperation = 'create' | 'delete' | 'read' | 'restoreVersion' | 'update'\n\nexport type SelectFnArgs = {\n  operation: SelectFnOperation\n  req: PayloadRequest\n  /** The caller's `select` arg, or `undefined` if not provided. */\n  select?: SelectType\n}\n\nexport type SelectFn<TSelect extends SelectType = SelectType> = (\n  args: SelectFnArgs,\n) => TSelect | undefined\n\n/**\n * Shared shape for the entity-level `select` config used by Collections and Globals.\n * The JSDoc on the `select` property is the single source of truth — pick from this\n * type when defining the config:\n *\n *   & Pick<WithSelectFn<...>, 'select'>\n */\nexport type WithSelectFn<TSelect extends SelectType = SelectType> = {\n  /**\n   * Entity-level Select API configuration.\n   *\n   * A function that receives the current request context (`operation`, `req`,\n   * the caller's `select`) and returns the final `select` to apply, replacing\n   * the caller's. Return `undefined` to leave the caller's `select` unchanged.\n   *\n   * Useful to dynamically modify the caller's selection based on the request context:\n   *  - Forcing a field to be populated for reference within hooks / access control.\n   *  - Differentiating between API requests and admin panel requests, to optimize\n   *    the amount of data being queried in each case.\n   *\n   * Note: per-document data is not available — this runs before the read.\n   *\n   * @see https://payloadcms.com/docs/queries/select\n   */\n  select?: SelectFn<TSelect>\n}\n\nexport type ApplyDisableErrors<T, DisableErrors = false> = false extends DisableErrors\n  ? T\n  : null | T\n\nexport type TransformDataWithSelect<\n  Data extends Record<string, any>,\n  Select extends SelectType,\n> = Select extends never\n  ? Data\n  : string extends keyof Select\n    ? Data\n    : // START Handle types when they aren't generated\n      // For example in any package in this repository outside of tests / plugins\n      // This stil gives us autocomplete when using include select mode, i.e select: {title :true} returns type {title: any, id: string | number}\n      string extends keyof Omit<Data, 'id'>\n      ? Select extends SelectIncludeType\n        ? {\n            [K in Data extends TypeWithID ? 'id' | keyof Select : keyof Select]: K extends 'id'\n              ? number | string\n              : unknown\n          }\n        : Data\n      : // END Handle types when they aren't generated\n        // Handle include mode\n        Select extends SelectIncludeType\n        ? {\n            [K in keyof Data as K extends keyof Select\n              ? Select[K] extends object | true\n                ? K\n                : never\n              : // select 'id' always\n                K extends 'id'\n                ? K\n                : never]: Data[K]\n          }\n        : // Handle exclude mode\n          {\n            [K in keyof Data as K extends keyof Select\n              ? Select[K] extends object | undefined\n                ? K\n                : never\n              : K]: Data[K]\n          }\n\nexport type TransformCollectionWithSelect<\n  TSlug extends CollectionSlug,\n  TSelect extends SelectType,\n> = TSelect extends SelectType\n  ? TransformDataWithSelect<DataFromCollectionSlug<TSlug>, TSelect>\n  : DataFromCollectionSlug<TSlug>\n\nexport type DraftTransformCollectionWithSelect<\n  TSlug extends CollectionSlug,\n  TSelect extends SelectType,\n> = TSelect extends SelectType\n  ? TransformDataWithSelect<QueryDraftDataFromCollectionSlug<TSlug>, TSelect>\n  : QueryDraftDataFromCollectionSlug<TSlug>\n\nexport type TransformGlobalWithSelect<\n  TSlug extends GlobalSlug,\n  TSelect extends SelectType,\n> = TSelect extends SelectType\n  ? TransformDataWithSelect<DataFromGlobalSlug<TSlug>, TSelect>\n  : DataFromGlobalSlug<TSlug>\n\nexport type PopulateType = Partial<TypedCollectionSelect>\n\nexport type ResolvedFilterOptions = { [collection: string]: Where }\n\nexport type PickPreserveOptional<T, K extends keyof T> = Partial<\n  Pick<T, Extract<K, OptionalKeys<T>>>\n> &\n  Pick<T, Extract<K, RequiredKeys<T>>>\n\nexport type MaybePromise<T> = Promise<T> | T\n"],"names":["docHasTimestamps","doc","createdAt","updatedAt"],"mappings":"AAkMA,OAAO,SAASA,iBAAiBC,GAAQ;IACvC,OAAOA,KAAKC,aAAaD,KAAKE;AAChC"}
+{"version":3,"sources":["../../src/types/index.ts"],"sourcesContent":["import type { I18n, TFunction } from '@payloadcms/translations'\nimport type DataLoader from 'dataloader'\nimport type { OptionalKeys, RequiredKeys } from 'ts-essentials'\nimport type { URL } from 'url'\n\nimport type { ServerAdapter } from '../admin/adapters/server.js'\nimport type {\n  DataFromCollectionSlug,\n  QueryDraftDataFromCollectionSlug,\n  TypeWithID,\n  TypeWithTimestamps,\n} from '../collections/config/types.js'\nimport type payload from '../index.js'\nimport type {\n  AuthenticatedUser,\n  CollectionSlug,\n  DataFromGlobalSlug,\n  GlobalSlug,\n  Payload,\n  RequestContext,\n  TypedCollectionJoins,\n  TypedCollectionSelect,\n  TypedFallbackLocale,\n  TypedLocale,\n} from '../index.js'\nimport type { File } from '../uploads/types.js'\nimport type { HasManyRelationshipOperator, Operator } from './constants.js'\nexport type { TypeWithID } from '../collections/config/types.js'\nexport type { Payload } from '../index.js'\n\nexport interface PayloadRequestAPI {\n  GraphQL: true\n  local: true\n  REST: true\n}\n\nexport type CustomPayloadRequestProperties = {\n  context: RequestContext\n  /** The locale that should be used for a field when it is not translated to the requested locale */\n  fallbackLocale?: TypedFallbackLocale\n  i18n: I18n\n  /**\n   * The requested locale if specified\n   * Only available for localized collections\n   *\n   * Suppressing warning below as it is a valid use case - won't be an issue if generated types exist\n   */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  locale?: 'all' | TypedLocale\n  /**\n   * The payload object\n   */\n  payload: typeof payload\n  /**\n   * The context in which the request is being made\n   */\n  payloadAPI: keyof PayloadRequestAPI\n  /** Optimized document loader */\n  payloadDataLoader: {\n    /**\n     * Wraps `payload.find` with a cache to deduplicate requests\n     * @experimental This is may be replaced by a more robust cache strategy in future versions\n     * By calling this method with the same arguments many times in one request, it will only be handled one time\n     * const result = await req.payloadDataLoader.find({\n     *  collection,\n     *  req,\n     *  where: findWhere,\n     * })\n     */\n    find: Payload['find']\n  } & DataLoader<string, TypeWithID>\n  /** Resized versions of the image that was uploaded during this request */\n  payloadUploadSizes?: Record<string, Buffer>\n  /** Query params on the request */\n  query: Record<string, unknown>\n  /** Any response headers that are required to be set when a response is sent */\n  responseHeaders?: Headers\n  /** The route parameters\n   * @example\n   * /:collection/:id -> /posts/123\n   * { collection: 'posts', id: '123' }\n   */\n  routeParams?: Record<string, unknown>\n  /**\n   * Framework abstraction for server-only navigation, cookies, and headers APIs.\n   * Populated by the framework adapter (e.g. `@payloadcms/next`). Plugins that\n   * have access to `req` should call methods here (`req.server.unauthorized()`,\n   * `req.server.redirect(...)`) instead of importing from `next/navigation` or\n   * `next/headers` directly. Optional because non-framework contexts (jobs,\n   * scripts, tests) construct requests without a server adapter.\n   */\n  server?: ServerAdapter\n  /** Translate function - duplicate of i18n.t */\n  t: TFunction\n  /**\n   * Identifier for the database transaction for interactions in a single, all-or-nothing operation.\n   * Can also be used to ensure consistency when multiple operations try to create a transaction concurrently on the same request.\n   */\n  transactionID?: number | Promise<number | string> | string\n  /** The signed-in user */\n  user: AuthenticatedUser | null\n} & Pick<\n  URL,\n  'hash' | 'host' | 'href' | 'origin' | 'pathname' | 'port' | 'protocol' | 'search' | 'searchParams'\n>\ntype PayloadRequestData = {\n  /**\n   * Data from the request body\n   *\n   * Within Payload operations, i.e. hooks, data will be there\n   * BUT in custom endpoints it will not be, you will need to\n   * use either:\n   *  1. `const data = await req.json()`\n   *\n   *  2. import { addDataAndFileToRequest } from 'payload'\n   *    `await addDataAndFileToRequest(req)`\n   *\n   * You should not expect this object to be the document data. It is the request data.\n   * */\n  data?: JsonObject\n  /** The file on the request, same rules apply as the `data` property */\n  file?: {\n    uploadReference?: unknown\n  } & File\n  /** All files from multipart form data, keyed by field name */\n  files?: Record<string, File | File[]>\n}\nexport interface PayloadRequest\n  extends CustomPayloadRequestProperties,\n    Partial<Request>,\n    PayloadRequestData {\n  headers: Request['headers']\n}\n\nexport type { HasManyRelationshipOperator, Operator }\n\n// Makes it so things like passing new Date() will error\nexport type JsonValue = JsonArray | JsonObject | unknown //Date | JsonArray | JsonObject | boolean | null | number | string // TODO: Evaluate proper, strong type for this\n\nexport type JsonArray = Array<JsonValue>\n\nexport interface JsonObject {\n  [key: string]: any\n}\n\nexport type WhereField = {\n  // any json-serializable value, including a nested query for supported relationship operators\n  [key in Operator]?: JsonValue\n}\n\nexport type Where = {\n  [key: string]: Where[] | WhereField\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  and?: Where[]\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  or?: Where[]\n}\n\nexport type Sort = Array<string> | string\n\ntype SerializableValue = boolean | number | object | string\nexport type DefaultValue =\n  | ((args: {\n      locale?: TypedLocale\n      req: PayloadRequest\n      user: PayloadRequest['user']\n    }) => Promise<SerializableValue> | SerializableValue)\n  | SerializableValue\n\n/**\n * Applies pagination for join fields for including collection relationships\n */\nexport type JoinQuery<TSlug extends CollectionSlug = string> =\n  TypedCollectionJoins[TSlug] extends Record<string, string>\n    ?\n        | false\n        | Partial<{\n            [K in keyof TypedCollectionJoins[TSlug]]:\n              | {\n                  count?: boolean\n                  limit?: number\n                  page?: number\n                  sort?: string\n                  where?: Where\n                }\n              | false\n          }>\n    : never\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type Document = any\n\nexport type Operation = 'create' | 'delete' | 'read' | 'update'\nexport type VersionOperations = 'readVersions'\nexport type AuthOperations = 'unlock'\nexport type AllOperations = AuthOperations | Operation | VersionOperations\n\nexport function docHasTimestamps(doc: any): doc is TypeWithTimestamps {\n  return doc?.createdAt && doc?.updatedAt\n}\n\nexport type IfAny<T, Y, N> = 0 extends 1 & T ? Y : N // This is a commonly used trick to detect 'any'\nexport type IsAny<T> = IfAny<T, true, false>\nexport type ReplaceAny<T, DefaultType> = IsAny<T> extends true ? DefaultType : T\n\nexport type SelectIncludeType = {\n  [k: string]: SelectIncludeType | true\n}\n\nexport type SelectExcludeType = {\n  [k: string]: false | SelectExcludeType\n}\n\nexport type SelectMode = 'exclude' | 'include'\n\nexport type SelectType = SelectExcludeType | SelectIncludeType\n\n/**\n * Operations that invoke an entity-level `select` function.\n *\n * Narrower than `HookOperationType`: `select` runs only for read- and\n * write-path operations that materialize a document (`create`, `delete`,\n * `read`, `restoreVersion`, `update`). Operations like `autosave`, `count`,\n * `countVersions`, `forgotPassword`, `login`, `readDistinct`, `refresh`, and\n * `resetPassword` do not invoke `select` and are intentionally excluded.\n */\nexport type SelectFnOperation = 'create' | 'delete' | 'read' | 'restoreVersion' | 'update'\n\nexport type SelectFnArgs = {\n  operation: SelectFnOperation\n  req: PayloadRequest\n  /** The caller's `select` arg, or `undefined` if not provided. */\n  select?: SelectType\n}\n\nexport type SelectFn<TSelect extends SelectType = SelectType> = (\n  args: SelectFnArgs,\n) => TSelect | undefined\n\n/**\n * Shared shape for the entity-level `select` config used by Collections and Globals.\n * The JSDoc on the `select` property is the single source of truth — pick from this\n * type when defining the config:\n *\n *   & Pick<WithSelectFn<...>, 'select'>\n */\nexport type WithSelectFn<TSelect extends SelectType = SelectType> = {\n  /**\n   * Entity-level Select API configuration.\n   *\n   * A function that receives the current request context (`operation`, `req`,\n   * the caller's `select`) and returns the final `select` to apply, replacing\n   * the caller's. Return `undefined` to leave the caller's `select` unchanged.\n   *\n   * Useful to dynamically modify the caller's selection based on the request context:\n   *  - Forcing a field to be populated for reference within hooks / access control.\n   *  - Differentiating between API requests and admin panel requests, to optimize\n   *    the amount of data being queried in each case.\n   *\n   * Note: per-document data is not available — this runs before the read.\n   *\n   * @see https://payloadcms.com/docs/queries/select\n   */\n  select?: SelectFn<TSelect>\n}\n\nexport type ApplyDisableErrors<T, DisableErrors = false> = false extends DisableErrors\n  ? T\n  : null | T\n\nexport type TransformDataWithSelect<\n  Data extends Record<string, any>,\n  Select extends SelectType,\n> = Select extends never\n  ? Data\n  : string extends keyof Select\n    ? Data\n    : // START Handle types when they aren't generated\n      // For example in any package in this repository outside of tests / plugins\n      // This stil gives us autocomplete when using include select mode, i.e select: {title :true} returns type {title: any, id: string | number}\n      string extends keyof Omit<Data, 'id'>\n      ? Select extends SelectIncludeType\n        ? {\n            [K in Data extends TypeWithID ? 'id' | keyof Select : keyof Select]: K extends 'id'\n              ? number | string\n              : unknown\n          }\n        : Data\n      : // END Handle types when they aren't generated\n        // Handle include mode\n        Select extends SelectIncludeType\n        ? {\n            [K in keyof Data as K extends keyof Select\n              ? Select[K] extends object | true\n                ? K\n                : never\n              : // select 'id' always\n                K extends 'id'\n                ? K\n                : never]: Data[K]\n          }\n        : // Handle exclude mode\n          {\n            [K in keyof Data as K extends keyof Select\n              ? Select[K] extends object | undefined\n                ? K\n                : never\n              : K]: Data[K]\n          }\n\nexport type TransformCollectionWithSelect<\n  TSlug extends CollectionSlug,\n  TSelect extends SelectType,\n> = TSelect extends SelectType\n  ? TransformDataWithSelect<DataFromCollectionSlug<TSlug>, TSelect>\n  : DataFromCollectionSlug<TSlug>\n\nexport type DraftTransformCollectionWithSelect<\n  TSlug extends CollectionSlug,\n  TSelect extends SelectType,\n> = TSelect extends SelectType\n  ? TransformDataWithSelect<QueryDraftDataFromCollectionSlug<TSlug>, TSelect>\n  : QueryDraftDataFromCollectionSlug<TSlug>\n\nexport type TransformGlobalWithSelect<\n  TSlug extends GlobalSlug,\n  TSelect extends SelectType,\n> = TSelect extends SelectType\n  ? TransformDataWithSelect<DataFromGlobalSlug<TSlug>, TSelect>\n  : DataFromGlobalSlug<TSlug>\n\nexport type PopulateType = Partial<TypedCollectionSelect>\n\nexport type ResolvedFilterOptions = { [collection: string]: Where }\n\nexport type PickPreserveOptional<T, K extends keyof T> = Partial<\n  Pick<T, Extract<K, OptionalKeys<T>>>\n> &\n  Pick<T, Extract<K, RequiredKeys<T>>>\n\nexport type MaybePromise<T> = Promise<T> | T\n"],"names":["docHasTimestamps","doc","createdAt","updatedAt"],"mappings":"AAqMA,OAAO,SAASA,iBAAiBC,GAAQ;IACvC,OAAOA,KAAKC,aAAaD,KAAKE;AAChC"}

package/dist/uploads/checkFileAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAK9D,eAAO,MAAM,eAAe,GAAU,wCAKnC;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CA8CjC,CAAA"}
+{"version":3,"file":"checkFileAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAK9D,eAAO,MAAM,eAAe,2CAKzB;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CA8CjC,CAAA"}

package/dist/uploads/checkFileAccess.js

@@ -6,6 +6,7 @@ export const checkFileAccess = async ({ collection, filename, prefix, req })=>{
     }
     const { config } = collection;
     const accessResult = await executeAccess({
+        slug: config.slug,
         data: {
             filename
         },

package/dist/uploads/checkFileAccess.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileAccess.ts"],"sourcesContent":["import type { Collection, TypeWithID } from '../collections/config/types.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\n\nexport const checkFileAccess = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<TypeWithID | undefined> => {\n  if (filename.includes('../') || filename.includes('..\\\\')) {\n    throw new Forbidden(req.t)\n  }\n  const { config } = collection\n\n  const accessResult = await executeAccess(\n    { data: { filename }, isReadingStaticFile: true, req },\n    config.access.read,\n  )\n\n  const constraints: Where[] = []\n\n  if (typeof accessResult === 'object') {\n    constraints.push(accessResult)\n  }\n\n  if (typeof prefix === 'string') {\n    constraints.push({ prefix: { equals: prefix } })\n  }\n\n  if (constraints.length > 0) {\n    const filenameCondition: Where = {\n      or: [{ filename: { equals: filename } }],\n    }\n\n    if (config.upload.imageSizes) {\n      config.upload.imageSizes.forEach(({ name }) => {\n        filenameCondition.or!.push({\n          [`sizes.${name}.filename`]: { equals: filename },\n        })\n      })\n    }\n\n    const doc = await req.payload.db.findOne({\n      collection: config.slug,\n      req,\n      where: { and: [filenameCondition, ...constraints] },\n    })\n\n    if (!doc) {\n      throw new Forbidden(req.t)\n    }\n\n    return doc\n  }\n}\n"],"names":["executeAccess","Forbidden","checkFileAccess","collection","filename","prefix","req","includes","t","config","accessResult","data","isReadingStaticFile","access","read","constraints","push","equals","length","filenameCondition","or","upload","imageSizes","forEach","name","doc","payload","db","findOne","slug","where","and"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAElD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,IAAIF,SAASG,QAAQ,CAAC,UAAUH,SAASG,QAAQ,CAAC,SAAS;QACzD,MAAM,IAAIN,UAAUK,IAAIE,CAAC;IAC3B;IACA,MAAM,EAAEC,MAAM,EAAE,GAAGN;IAEnB,MAAMO,eAAe,MAAMV,cACzB;QAAEW,MAAM;YAAEP;QAAS;QAAGQ,qBAAqB;QAAMN;IAAI,GACrDG,OAAOI,MAAM,CAACC,IAAI;IAGpB,MAAMC,cAAuB,EAAE;IAE/B,IAAI,OAAOL,iBAAiB,UAAU;QACpCK,YAAYC,IAAI,CAACN;IACnB;IAEA,IAAI,OAAOL,WAAW,UAAU;QAC9BU,YAAYC,IAAI,CAAC;YAAEX,QAAQ;gBAAEY,QAAQZ;YAAO;QAAE;IAChD;IAEA,IAAIU,YAAYG,MAAM,GAAG,GAAG;QAC1B,MAAMC,oBAA2B;YAC/BC,IAAI;gBAAC;oBAAEhB,UAAU;wBAAEa,QAAQb;oBAAS;gBAAE;aAAE;QAC1C;QAEA,IAAIK,OAAOY,MAAM,CAACC,UAAU,EAAE;YAC5Bb,OAAOY,MAAM,CAACC,UAAU,CAACC,OAAO,CAAC,CAAC,EAAEC,IAAI,EAAE;gBACxCL,kBAAkBC,EAAE,CAAEJ,IAAI,CAAC;oBACzB,CAAC,CAAC,MAAM,EAAEQ,KAAK,SAAS,CAAC,CAAC,EAAE;wBAAEP,QAAQb;oBAAS;gBACjD;YACF;QACF;QAEA,MAAMqB,MAAM,MAAMnB,IAAIoB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACvCzB,YAAYM,OAAOoB,IAAI;YACvBvB;YACAwB,OAAO;gBAAEC,KAAK;oBAACZ;uBAAsBJ;iBAAY;YAAC;QACpD;QAEA,IAAI,CAACU,KAAK;YACR,MAAM,IAAIxB,UAAUK,IAAIE,CAAC;QAC3B;QAEA,OAAOiB;IACT;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileAccess.ts"],"sourcesContent":["import type { Collection, TypeWithID } from '../collections/config/types.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\n\nexport const checkFileAccess = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<TypeWithID | undefined> => {\n  if (filename.includes('../') || filename.includes('..\\\\')) {\n    throw new Forbidden(req.t)\n  }\n  const { config } = collection\n\n  const accessResult = await executeAccess(\n    { slug: config.slug, data: { filename }, isReadingStaticFile: true, req },\n    config.access.read,\n  )\n\n  const constraints: Where[] = []\n\n  if (typeof accessResult === 'object') {\n    constraints.push(accessResult)\n  }\n\n  if (typeof prefix === 'string') {\n    constraints.push({ prefix: { equals: prefix } })\n  }\n\n  if (constraints.length > 0) {\n    const filenameCondition: Where = {\n      or: [{ filename: { equals: filename } }],\n    }\n\n    if (config.upload.imageSizes) {\n      config.upload.imageSizes.forEach(({ name }) => {\n        filenameCondition.or!.push({\n          [`sizes.${name}.filename`]: { equals: filename },\n        })\n      })\n    }\n\n    const doc = await req.payload.db.findOne({\n      collection: config.slug,\n      req,\n      where: { and: [filenameCondition, ...constraints] },\n    })\n\n    if (!doc) {\n      throw new Forbidden(req.t)\n    }\n\n    return doc\n  }\n}\n"],"names":["executeAccess","Forbidden","checkFileAccess","collection","filename","prefix","req","includes","t","config","accessResult","slug","data","isReadingStaticFile","access","read","constraints","push","equals","length","filenameCondition","or","upload","imageSizes","forEach","name","doc","payload","db","findOne","where","and"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAElD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,IAAIF,SAASG,QAAQ,CAAC,UAAUH,SAASG,QAAQ,CAAC,SAAS;QACzD,MAAM,IAAIN,UAAUK,IAAIE,CAAC;IAC3B;IACA,MAAM,EAAEC,MAAM,EAAE,GAAGN;IAEnB,MAAMO,eAAe,MAAMV,cACzB;QAAEW,MAAMF,OAAOE,IAAI;QAAEC,MAAM;YAAER;QAAS;QAAGS,qBAAqB;QAAMP;IAAI,GACxEG,OAAOK,MAAM,CAACC,IAAI;IAGpB,MAAMC,cAAuB,EAAE;IAE/B,IAAI,OAAON,iBAAiB,UAAU;QACpCM,YAAYC,IAAI,CAACP;IACnB;IAEA,IAAI,OAAOL,WAAW,UAAU;QAC9BW,YAAYC,IAAI,CAAC;YAAEZ,QAAQ;gBAAEa,QAAQb;YAAO;QAAE;IAChD;IAEA,IAAIW,YAAYG,MAAM,GAAG,GAAG;QAC1B,MAAMC,oBAA2B;YAC/BC,IAAI;gBAAC;oBAAEjB,UAAU;wBAAEc,QAAQd;oBAAS;gBAAE;aAAE;QAC1C;QAEA,IAAIK,OAAOa,MAAM,CAACC,UAAU,EAAE;YAC5Bd,OAAOa,MAAM,CAACC,UAAU,CAACC,OAAO,CAAC,CAAC,EAAEC,IAAI,EAAE;gBACxCL,kBAAkBC,EAAE,CAAEJ,IAAI,CAAC;oBACzB,CAAC,CAAC,MAAM,EAAEQ,KAAK,SAAS,CAAC,CAAC,EAAE;wBAAEP,QAAQd;oBAAS;gBACjD;YACF;QACF;QAEA,MAAMsB,MAAM,MAAMpB,IAAIqB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACvC1B,YAAYM,OAAOE,IAAI;YACvBL;YACAwB,OAAO;gBAAEC,KAAK;oBAACX;uBAAsBJ;iBAAY;YAAC;QACpD;QAEA,IAAI,CAACU,KAAK;YACR,MAAM,IAAIzB,UAAUK,IAAIE,CAAC;QAC3B;QAEA,OAAOkB;IACT;AACF,EAAC"}

package/dist/uploads/checkFileRestrictions.d.ts

@@ -3,5 +3,5 @@ import type { checkFileRestrictionsParams, FileAllowList } from './types.js';
  * Restricted file types and their extensions.
  */
 export declare const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList;
-export declare const checkFileRestrictions: ({ collection, file, req, }: checkFileRestrictionsParams) => Promise<void>;
+export declare const checkFileRestrictions: ({ checkFileContents, collection, file, req, }: checkFileRestrictionsParams) => Promise<void>;
 //# sourceMappingURL=checkFileRestrictions.d.ts.map

package/dist/uploads/checkFileRestrictions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAS5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAgC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,4BAIzC,2BAA2B,KAAG,OAAO,CAAC,IAAI,CAyJ5C,CAAA"}
+{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAS5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAgC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,kDAK/B,2BAA2B,KAAG,OAAO,CAAC,IAAI,CA2K5C,CAAA"}

package/dist/uploads/checkFileRestrictions.js

@@ -219,7 +219,7 @@ import { validateSvg } from './validateSvg.js';
         mimeType: 'application/x-command'
     }
 ];
-export const checkFileRestrictions = async ({ collection, file, req })=>{
+export const checkFileRestrictions = async ({ checkFileContents = true, collection, file, req })=>{
     const errors = [];
     const { upload: uploadConfig } = collection;
     const configMimeTypes = uploadConfig && typeof uploadConfig === 'object' && 'mimeTypes' in uploadConfig && Array.isArray(uploadConfig.mimeTypes) ? uploadConfig.mimeTypes : [];
@@ -240,6 +240,20 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
     if (allowRestrictedFileTypes) {
         return;
     }
+    if (!checkFileContents) {
+        const isAllowed = configMimeTypes.length ? validateMimeType(file.mimetype, configMimeTypes) : !RESTRICTED_FILE_EXT_AND_TYPES.some(({ extensions, mimeType })=>mimeType === file.mimetype || extensions.some((extension)=>file.name.toLowerCase().endsWith(extension)));
+        if (!isAllowed) {
+            throw new ValidationError({
+                errors: [
+                    {
+                        message: `File type '${file.mimetype}' is not allowed.`,
+                        path: 'file'
+                    }
+                ]
+            });
+        }
+        return;
+    }
     // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory
     // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is
     // loaded lazily and only when the file type actually requires it.

package/dist/uploads/checkFileRestrictions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { detectSvgFromXml } from './detectSvgFromXml.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport { validateSvg } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<void> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // Skip validation if `allowRestrictedFileTypes` is true\n  if (allowRestrictedFileTypes) {\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is\n  // loaded lazily and only when the file type actually requires it.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for small text-based types (SVG, PDF).\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    let detected\n    try {\n      detected =\n        isTempFile && tempFilePath\n          ? await fileTypeFromFile(tempFilePath)\n          : await fileTypeFromBuffer(file.data)\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n    const typeFromExtension = file.name.split('.').pop() || ''\n\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      const isSvg = detectSvgFromXml(await getFileBuffer())\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // SVG security check (text-based files not detectable by buffer)\n        if (typeFromExtension.toLowerCase() === 'svg') {\n          const isSafeSvg = validateSvg(await getFileBuffer())\n          if (!isSafeSvg) {\n            errors.push('SVG file contains potentially harmful content.')\n          }\n        }\n\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))\n      const hasRestrictedMime = type.mimeType === file.mimetype\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","detectSvgFromXml","getFileTypeFallback","validateSvg","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","tempFilePath","isTempFile","data","length","_fileBuffer","getFileBuffer","readFile","message","path","detected","typeFromExtension","name","split","pop","mime","some","type","isSvg","ext","mimeTypeFromExtension","extIsValid","push","toLowerCase","isSafeSvg","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","endsWith","hasRestrictedMime","mimetype","error","join"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,WAAW,QAAQ,mBAAkB;AAE9C;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACb;QAC7B,MAAMc,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAACf,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,aAAa;IAEjB;IAEA,wDAAwD;IACxD,IAAIY,0BAA0B;QAC5B;IACF;IAEA,gGAAgG;IAChG,6FAA6F;IAC7F,kEAAkE;IAClE,MAAM,EAAEK,YAAY,EAAE,GAAGd;IACzB,MAAMe,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACd,KAAKgB,IAAI,IAAIhB,KAAKgB,IAAI,CAACC,MAAM,KAAK,CAAA;IAEzE,mFAAmF;IACnF,IAAIC;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACH,cAAc,CAACD,cAAc;YAChC,OAAQI,cAAclB,KAAKgB,IAAI;QACjC;QACA,IAAI;YACFE,cAAc,MAAM9B,GAAGgC,QAAQ,CAACN;YAChC,OAAOI;QACT,EAAE,OAAM;YACN,MAAM,IAAI7B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,2DAA2D;IAC3D,IAAIjB,gBAAgBY,MAAM,GAAG,GAAG;QAC9B,IAAIM;QACJ,IAAI;YACFA,WACER,cAAcD,eACV,MAAM3B,iBAAiB2B,gBACvB,MAAM5B,mBAAmBc,KAAKgB,IAAI;QAC1C,EAAE,OAAM;YACN,MAAM,IAAI3B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;QACA,MAAME,oBAAoBxB,KAAKyB,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;QAExD,sEAAsE;QACtE,IACEJ,UAAUK,SAAS,qBACnBvB,gBAAgBwB,IAAI,CAClB,CAACC,OAASA,KAAKlB,QAAQ,CAAC,aAAckB,CAAAA,KAAKlB,QAAQ,CAAC,UAAUkB,SAAS,SAAQ,IAEjF;YACA,MAAMC,QAAQvC,iBAAiB,MAAM2B;YACrC,IAAIY,OAAO;gBACTR,WAAW;oBAAES,KAAK;oBAAOJ,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACL,UAAU;YACb,MAAMU,wBAAwBxC,oBAAoBO,KAAKyB,IAAI,EAAEG,IAAI;YACjE,MAAMM,aAAa5C,iBAAiB2C,uBAAuB5B;YAE3D,IAAI,CAAC6B,YAAY;gBACfhC,OAAOiC,IAAI,CACT,CAAC,UAAU,EAAEF,sBAAsB,iBAAiB,EAAET,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iEAAiE;gBACjE,IAAIA,kBAAkBY,WAAW,OAAO,OAAO;oBAC7C,MAAMC,YAAY3C,YAAY,MAAMyB;oBACpC,IAAI,CAACkB,WAAW;wBACdnC,OAAOiC,IAAI,CAAC;oBACd;gBACF;gBAEA,iBAAiB;gBACjB,IAAIF,0BAA0B,mBAAmB;oBAC/C,MAAMK,aAAa/C,YAAY,MAAM4B;oBACrC,IAAI,CAACmB,YAAY;wBACfpC,OAAOiC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAIzB,sBAAsBuB,wBAAwB;gBAChDhC,IAAIsC,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAEzC,KAAKyB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMiB,sBAAsBnB,UAAUK,QAAQtC,iBAAiBiC,SAASK,IAAI,EAAEvB;QAE9E,IAAIqC,uBAAuBnB,UAAUK,SAAS,mBAAmB;YAC/D,MAAMU,aAAa/C,YAAY,MAAM4B;YACrC,IAAI,CAACmB,YAAY;gBACfpC,OAAOiC,IAAI,CAAC;YACd;QACF;QAEA,IAAIZ,YAAY,CAACmB,qBAAqB;YACpCxC,OAAOiC,IAAI,CAAC,CAAC,mBAAmB,EAAEZ,SAASK,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMe,eAAehD,8BAA8BkC,IAAI,CAAC,CAACC;YACvD,MAAMc,mBAAmBd,KAAKlC,UAAU,CAACiC,IAAI,CAAC,CAACG,MAAQhC,KAAKyB,IAAI,CAACW,WAAW,GAAGS,QAAQ,CAACb;YACxF,MAAMc,oBAAoBhB,KAAKjC,QAAQ,KAAKG,KAAK+C,QAAQ;YACzD,OAAOH,oBAAoBE;QAC7B;QACA,IAAIH,cAAc;YAChBzC,OAAOiC,IAAI,CACT,CAAC,WAAW,EAAEnC,KAAK+C,QAAQ,CAAC,cAAc,EAAE/C,KAAKyB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIvB,OAAOe,MAAM,GAAG,GAAG;QACrBhB,IAAIsC,OAAO,CAACC,MAAM,CAACQ,KAAK,CAAC9C,OAAO+C,IAAI,CAAC;QACrC,MAAM,IAAI5D,gBAAgB;YACxBa,QAAQ;gBAAC;oBAAEmB,SAASnB,OAAO+C,IAAI,CAAC;oBAAO3B,MAAM;gBAAO;aAAE;QACxD;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { detectSvgFromXml } from './detectSvgFromXml.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport { validateSvg } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  checkFileContents = true,\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<void> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // Skip validation if `allowRestrictedFileTypes` is true\n  if (allowRestrictedFileTypes) {\n    return\n  }\n\n  if (!checkFileContents) {\n    const isAllowed = configMimeTypes.length\n      ? validateMimeType(file.mimetype, configMimeTypes)\n      : !RESTRICTED_FILE_EXT_AND_TYPES.some(\n          ({ extensions, mimeType }) =>\n            mimeType === file.mimetype ||\n            extensions.some((extension) => file.name.toLowerCase().endsWith(extension)),\n        )\n\n    if (!isAllowed) {\n      throw new ValidationError({\n        errors: [{ message: `File type '${file.mimetype}' is not allowed.`, path: 'file' }],\n      })\n    }\n\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is\n  // loaded lazily and only when the file type actually requires it.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for small text-based types (SVG, PDF).\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    let detected\n    try {\n      detected =\n        isTempFile && tempFilePath\n          ? await fileTypeFromFile(tempFilePath)\n          : await fileTypeFromBuffer(file.data)\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n    const typeFromExtension = file.name.split('.').pop() || ''\n\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      const isSvg = detectSvgFromXml(await getFileBuffer())\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // SVG security check (text-based files not detectable by buffer)\n        if (typeFromExtension.toLowerCase() === 'svg') {\n          const isSafeSvg = validateSvg(await getFileBuffer())\n          if (!isSafeSvg) {\n            errors.push('SVG file contains potentially harmful content.')\n          }\n        }\n\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))\n      const hasRestrictedMime = type.mimeType === file.mimetype\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","detectSvgFromXml","getFileTypeFallback","validateSvg","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","checkFileContents","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","isAllowed","length","mimetype","some","extension","name","toLowerCase","endsWith","message","path","tempFilePath","isTempFile","data","_fileBuffer","getFileBuffer","readFile","detected","typeFromExtension","split","pop","mime","type","isSvg","ext","mimeTypeFromExtension","extIsValid","push","isSafeSvg","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","hasRestrictedMime","error","join"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,WAAW,QAAQ,mBAAkB;AAE9C;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,oBAAoB,IAAI,EACxBC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACd;QAC7B,MAAMe,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAAChB,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,aAAa;IAEjB;IAEA,wDAAwD;IACxD,IAAIa,0BAA0B;QAC5B;IACF;IAEA,IAAI,CAACX,mBAAmB;QACtB,MAAMgB,YAAYT,gBAAgBU,MAAM,GACpC1B,iBAAiBW,KAAKgB,QAAQ,EAAEX,mBAChC,CAACX,8BAA8BuB,IAAI,CACjC,CAAC,EAAEtB,UAAU,EAAEC,QAAQ,EAAE,GACvBA,aAAaI,KAAKgB,QAAQ,IAC1BrB,WAAWsB,IAAI,CAAC,CAACC,YAAclB,KAAKmB,IAAI,CAACC,WAAW,GAAGC,QAAQ,CAACH;QAGxE,IAAI,CAACJ,WAAW;YACd,MAAM,IAAI1B,gBAAgB;gBACxBc,QAAQ;oBAAC;wBAAEoB,SAAS,CAAC,WAAW,EAAEtB,KAAKgB,QAAQ,CAAC,iBAAiB,CAAC;wBAAEO,MAAM;oBAAO;iBAAE;YACrF;QACF;QAEA;IACF;IAEA,gGAAgG;IAChG,6FAA6F;IAC7F,kEAAkE;IAClE,MAAM,EAAEC,YAAY,EAAE,GAAGxB;IACzB,MAAMyB,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACxB,KAAK0B,IAAI,IAAI1B,KAAK0B,IAAI,CAACX,MAAM,KAAK,CAAA;IAEzE,mFAAmF;IACnF,IAAIY;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACF,cAAc,CAACD,cAAc;YAChC,OAAQG,cAAc3B,KAAK0B,IAAI;QACjC;QACA,IAAI;YACFC,cAAc,MAAMxC,GAAG0C,QAAQ,CAACL;YAChC,OAAOG;QACT,EAAE,OAAM;YACN,MAAM,IAAIvC,gBAAgB;gBACxBc,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,2DAA2D;IAC3D,IAAIlB,gBAAgBU,MAAM,GAAG,GAAG;QAC9B,IAAIe;QACJ,IAAI;YACFA,WACEL,cAAcD,eACV,MAAMtC,iBAAiBsC,gBACvB,MAAMvC,mBAAmBe,KAAK0B,IAAI;QAC1C,EAAE,OAAM;YACN,MAAM,IAAItC,gBAAgB;gBACxBc,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;QACA,MAAMQ,oBAAoB/B,KAAKmB,IAAI,CAACa,KAAK,CAAC,KAAKC,GAAG,MAAM;QAExD,sEAAsE;QACtE,IACEH,UAAUI,SAAS,qBACnB7B,gBAAgBY,IAAI,CAClB,CAACkB,OAASA,KAAKvB,QAAQ,CAAC,aAAcuB,CAAAA,KAAKvB,QAAQ,CAAC,UAAUuB,SAAS,SAAQ,IAEjF;YACA,MAAMC,QAAQ7C,iBAAiB,MAAMqC;YACrC,IAAIQ,OAAO;gBACTN,WAAW;oBAAEO,KAAK;oBAAOH,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACJ,UAAU;YACb,MAAMQ,wBAAwB9C,oBAAoBQ,KAAKmB,IAAI,EAAEe,IAAI;YACjE,MAAMK,aAAalD,iBAAiBiD,uBAAuBjC;YAE3D,IAAI,CAACkC,YAAY;gBACfrC,OAAOsC,IAAI,CACT,CAAC,UAAU,EAAEF,sBAAsB,iBAAiB,EAAEP,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iEAAiE;gBACjE,IAAIA,kBAAkBX,WAAW,OAAO,OAAO;oBAC7C,MAAMqB,YAAYhD,YAAY,MAAMmC;oBACpC,IAAI,CAACa,WAAW;wBACdvC,OAAOsC,IAAI,CAAC;oBACd;gBACF;gBAEA,iBAAiB;gBACjB,IAAIF,0BAA0B,mBAAmB;oBAC/C,MAAMI,aAAapD,YAAY,MAAMsC;oBACrC,IAAI,CAACc,YAAY;wBACfxC,OAAOsC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAI9B,sBAAsB4B,wBAAwB;gBAChDrC,IAAI0C,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAE7C,KAAKmB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAM2B,sBAAsBhB,UAAUI,QAAQ7C,iBAAiByC,SAASI,IAAI,EAAE7B;QAE9E,IAAIyC,uBAAuBhB,UAAUI,SAAS,mBAAmB;YAC/D,MAAMQ,aAAapD,YAAY,MAAMsC;YACrC,IAAI,CAACc,YAAY;gBACfxC,OAAOsC,IAAI,CAAC;YACd;QACF;QAEA,IAAIV,YAAY,CAACgB,qBAAqB;YACpC5C,OAAOsC,IAAI,CAAC,CAAC,mBAAmB,EAAEV,SAASI,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMa,eAAerD,8BAA8BuB,IAAI,CAAC,CAACkB;YACvD,MAAMa,mBAAmBb,KAAKxC,UAAU,CAACsB,IAAI,CAAC,CAACoB,MAAQrC,KAAKmB,IAAI,CAACC,WAAW,GAAGC,QAAQ,CAACgB;YACxF,MAAMY,oBAAoBd,KAAKvC,QAAQ,KAAKI,KAAKgB,QAAQ;YACzD,OAAOgC,oBAAoBC;QAC7B;QACA,IAAIF,cAAc;YAChB7C,OAAOsC,IAAI,CACT,CAAC,WAAW,EAAExC,KAAKgB,QAAQ,CAAC,cAAc,EAAEhB,KAAKmB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIjB,OAAOa,MAAM,GAAG,GAAG;QACrBd,IAAI0C,OAAO,CAACC,MAAM,CAACM,KAAK,CAAChD,OAAOiD,IAAI,CAAC;QACrC,MAAM,IAAI/D,gBAAgB;YACxBc,QAAQ;gBAAC;oBAAEoB,SAASpB,OAAOiD,IAAI,CAAC;oBAAO5B,MAAM;gBAAO;aAAE;QACxD;IACF;AACF,EAAC"}

package/dist/uploads/cropImage.d.ts

@@ -11,7 +11,7 @@ type CropImageArgs = {
     file: PayloadRequest['file'];
     heightInPixels: number;
     req?: PayloadRequest;
-    sharp: SanitizedConfig['sharp'];
+    sharp: NonNullable<SanitizedConfig['sharp']>;
     widthInPixels: number;
     withMetadata?: WithMetadata;
 };

package/dist/uploads/cropImage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cropImage.d.ts","sourceRoot":"","sources":["../../src/uploads/cropImage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAQ7C,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7B,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;IAC5B,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B,CAAA;AACD,wBAAsB,SAAS,CAAC,EAC9B,QAAQ,EACR,UAAU,EACV,IAAI,EAAE,OAAO,EACb,cAAc,EACd,GAAG,EACH,KAAK,EACL,aAAa,EACb,YAAY,GACb,EAAE,aAAa;;;;;;;;;;GA8Df"}
+{"version":3,"file":"cropImage.d.ts","sourceRoot":"","sources":["../../src/uploads/cropImage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAS7C,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7B,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;IAC5B,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B,CAAA;AACD,wBAAsB,SAAS,CAAC,EAC9B,QAAQ,EACR,UAAU,EACV,IAAI,EAAE,OAAO,EACb,cAAc,EACd,GAAG,EACH,KAAK,EACL,aAAa,EACb,YAAY,GACb,EAAE,aAAa;;;;;;QAiCN,MAAM;QACN,IAAI;QACJ,KAAK;;GA2Bd"}

package/dist/uploads/cropImage.js

@@ -1,3 +1,4 @@
+import { isAnimatedImage } from './isAnimatedImage.js';
 import { optionallyAppendMetadata } from './optionallyAppendMetadata.js';
 const percentToPixel = (value, dimension)=>{
     return Math.floor(value / 100 * dimension);
@@ -6,11 +7,7 @@ export async function cropImage({ cropData, dimensions, file: fileArg, heightInP
     try {
         const { x, y } = cropData;
         const file = fileArg;
-        const fileIsAnimatedType = [
-            'image/avif',
-            'image/gif',
-            'image/webp'
-        ].includes(file.mimetype);
+        const fileIsAnimatedType = isAnimatedImage(file.mimetype);
         const sharpOptions = {};
         if (fileIsAnimatedType) {
             sharpOptions.animated = true;

package/dist/uploads/cropImage.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/cropImage.ts"],"sourcesContent":["import type { SharpOptions } from 'sharp'\n\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { WithMetadata } from './optionallyAppendMetadata.js'\nimport type { UploadEdits } from './types.js'\n\nimport { optionallyAppendMetadata } from './optionallyAppendMetadata.js'\n\nconst percentToPixel = (value: number, dimension: number) => {\n  return Math.floor((value / 100) * dimension)\n}\n\ntype CropImageArgs = {\n  cropData: UploadEdits['crop']\n  dimensions: { height: number; width: number }\n  file: PayloadRequest['file']\n  heightInPixels: number\n  req?: PayloadRequest\n  sharp: SanitizedConfig['sharp']\n  widthInPixels: number\n  withMetadata?: WithMetadata\n}\nexport async function cropImage({\n  cropData,\n  dimensions,\n  file: fileArg,\n  heightInPixels,\n  req,\n  sharp,\n  widthInPixels,\n  withMetadata,\n}: CropImageArgs) {\n  try {\n    const { x, y } = cropData!\n    const file = fileArg!\n\n    const fileIsAnimatedType = ['image/avif', 'image/gif', 'image/webp'].includes(file.mimetype)\n\n    const sharpOptions: SharpOptions = {}\n\n    if (fileIsAnimatedType) {\n      sharpOptions.animated = true\n    }\n\n    const { height: originalHeight, width: originalWidth } = dimensions\n    const newWidth = Number(widthInPixels)\n    const newHeight = Number(heightInPixels)\n\n    const dimensionsChanged = originalWidth !== newWidth || originalHeight !== newHeight\n\n    if (!dimensionsChanged) {\n      let adjustedHeight = originalHeight\n\n      if (fileIsAnimatedType) {\n        const animatedMetadata = await sharp(\n          file.tempFilePath || file.data,\n          sharpOptions,\n        ).metadata()\n        adjustedHeight = animatedMetadata.pages ? animatedMetadata.height! : originalHeight\n      }\n\n      return {\n        data: file.data,\n        info: {\n          height: adjustedHeight,\n          size: file.size,\n          width: originalWidth,\n        },\n      }\n    }\n\n    const formattedCropData = {\n      height: Number(heightInPixels),\n      left: percentToPixel(x, dimensions.width),\n      top: percentToPixel(y, dimensions.height),\n      width: Number(widthInPixels),\n    }\n\n    let cropped = sharp(file.tempFilePath || file.data, sharpOptions).extract(formattedCropData)\n\n    cropped = await optionallyAppendMetadata({\n      req: req!,\n      sharpFile: cropped,\n      withMetadata: withMetadata!,\n    })\n\n    return await cropped.toBuffer({\n      resolveWithObject: true,\n    })\n  } catch (error) {\n    console.error(`Error cropping image:`, error)\n    throw error\n  }\n}\n"],"names":["optionallyAppendMetadata","percentToPixel","value","dimension","Math","floor","cropImage","cropData","dimensions","file","fileArg","heightInPixels","req","sharp","widthInPixels","withMetadata","x","y","fileIsAnimatedType","includes","mimetype","sharpOptions","animated","height","originalHeight","width","originalWidth","newWidth","Number","newHeight","dimensionsChanged","adjustedHeight","animatedMetadata","tempFilePath","data","metadata","pages","info","size","formattedCropData","left","top","cropped","extract","sharpFile","toBuffer","resolveWithObject","error","console"],"mappings":"AAOA,SAASA,wBAAwB,QAAQ,gCAA+B;AAExE,MAAMC,iBAAiB,CAACC,OAAeC;IACrC,OAAOC,KAAKC,KAAK,CAAC,AAACH,QAAQ,MAAOC;AACpC;AAYA,OAAO,eAAeG,UAAU,EAC9BC,QAAQ,EACRC,UAAU,EACVC,MAAMC,OAAO,EACbC,cAAc,EACdC,GAAG,EACHC,KAAK,EACLC,aAAa,EACbC,YAAY,EACE;IACd,IAAI;QACF,MAAM,EAAEC,CAAC,EAAEC,CAAC,EAAE,GAAGV;QACjB,MAAME,OAAOC;QAEb,MAAMQ,qBAAqB;YAAC;YAAc;YAAa;SAAa,CAACC,QAAQ,CAACV,KAAKW,QAAQ;QAE3F,MAAMC,eAA6B,CAAC;QAEpC,IAAIH,oBAAoB;YACtBG,aAAaC,QAAQ,GAAG;QAC1B;QAEA,MAAM,EAAEC,QAAQC,cAAc,EAAEC,OAAOC,aAAa,EAAE,GAAGlB;QACzD,MAAMmB,WAAWC,OAAOd;QACxB,MAAMe,YAAYD,OAAOjB;QAEzB,MAAMmB,oBAAoBJ,kBAAkBC,YAAYH,mBAAmBK;QAE3E,IAAI,CAACC,mBAAmB;YACtB,IAAIC,iBAAiBP;YAErB,IAAIN,oBAAoB;gBACtB,MAAMc,mBAAmB,MAAMnB,MAC7BJ,KAAKwB,YAAY,IAAIxB,KAAKyB,IAAI,EAC9Bb,cACAc,QAAQ;gBACVJ,iBAAiBC,iBAAiBI,KAAK,GAAGJ,iBAAiBT,MAAM,GAAIC;YACvE;YAEA,OAAO;gBACLU,MAAMzB,KAAKyB,IAAI;gBACfG,MAAM;oBACJd,QAAQQ;oBACRO,MAAM7B,KAAK6B,IAAI;oBACfb,OAAOC;gBACT;YACF;QACF;QAEA,MAAMa,oBAAoB;YACxBhB,QAAQK,OAAOjB;YACf6B,MAAMvC,eAAee,GAAGR,WAAWiB,KAAK;YACxCgB,KAAKxC,eAAegB,GAAGT,WAAWe,MAAM;YACxCE,OAAOG,OAAOd;QAChB;QAEA,IAAI4B,UAAU7B,MAAMJ,KAAKwB,YAAY,IAAIxB,KAAKyB,IAAI,EAAEb,cAAcsB,OAAO,CAACJ;QAE1EG,UAAU,MAAM1C,yBAAyB;YACvCY,KAAKA;YACLgC,WAAWF;YACX3B,cAAcA;QAChB;QAEA,OAAO,MAAM2B,QAAQG,QAAQ,CAAC;YAC5BC,mBAAmB;QACrB;IACF,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,CAAC,qBAAqB,CAAC,EAAEA;QACvC,MAAMA;IACR;AACF"}
+{"version":3,"sources":["../../src/uploads/cropImage.ts"],"sourcesContent":["import type { SharpOptions } from 'sharp'\n\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { WithMetadata } from './optionallyAppendMetadata.js'\nimport type { UploadEdits } from './types.js'\n\nimport { isAnimatedImage } from './isAnimatedImage.js'\nimport { optionallyAppendMetadata } from './optionallyAppendMetadata.js'\n\nconst percentToPixel = (value: number, dimension: number) => {\n  return Math.floor((value / 100) * dimension)\n}\n\ntype CropImageArgs = {\n  cropData: UploadEdits['crop']\n  dimensions: { height: number; width: number }\n  file: PayloadRequest['file']\n  heightInPixels: number\n  req?: PayloadRequest\n  sharp: NonNullable<SanitizedConfig['sharp']>\n  widthInPixels: number\n  withMetadata?: WithMetadata\n}\nexport async function cropImage({\n  cropData,\n  dimensions,\n  file: fileArg,\n  heightInPixels,\n  req,\n  sharp,\n  widthInPixels,\n  withMetadata,\n}: CropImageArgs) {\n  try {\n    const { x, y } = cropData!\n    const file = fileArg!\n\n    const fileIsAnimatedType = isAnimatedImage(file.mimetype)\n\n    const sharpOptions: SharpOptions = {}\n\n    if (fileIsAnimatedType) {\n      sharpOptions.animated = true\n    }\n\n    const { height: originalHeight, width: originalWidth } = dimensions\n    const newWidth = Number(widthInPixels)\n    const newHeight = Number(heightInPixels)\n\n    const dimensionsChanged = originalWidth !== newWidth || originalHeight !== newHeight\n\n    if (!dimensionsChanged) {\n      let adjustedHeight = originalHeight\n\n      if (fileIsAnimatedType) {\n        const animatedMetadata = await sharp(\n          file.tempFilePath || file.data,\n          sharpOptions,\n        ).metadata()\n        adjustedHeight = animatedMetadata.pages ? animatedMetadata.height! : originalHeight\n      }\n\n      return {\n        data: file.data,\n        info: {\n          height: adjustedHeight,\n          size: file.size,\n          width: originalWidth,\n        },\n      }\n    }\n\n    const formattedCropData = {\n      height: Number(heightInPixels),\n      left: percentToPixel(x, dimensions.width),\n      top: percentToPixel(y, dimensions.height),\n      width: Number(widthInPixels),\n    }\n\n    let cropped = sharp(file.tempFilePath || file.data, sharpOptions).extract(formattedCropData)\n\n    cropped = await optionallyAppendMetadata({\n      req: req!,\n      sharpFile: cropped,\n      withMetadata: withMetadata!,\n    })\n\n    return await cropped.toBuffer({\n      resolveWithObject: true,\n    })\n  } catch (error) {\n    console.error(`Error cropping image:`, error)\n    throw error\n  }\n}\n"],"names":["isAnimatedImage","optionallyAppendMetadata","percentToPixel","value","dimension","Math","floor","cropImage","cropData","dimensions","file","fileArg","heightInPixels","req","sharp","widthInPixels","withMetadata","x","y","fileIsAnimatedType","mimetype","sharpOptions","animated","height","originalHeight","width","originalWidth","newWidth","Number","newHeight","dimensionsChanged","adjustedHeight","animatedMetadata","tempFilePath","data","metadata","pages","info","size","formattedCropData","left","top","cropped","extract","sharpFile","toBuffer","resolveWithObject","error","console"],"mappings":"AAOA,SAASA,eAAe,QAAQ,uBAAsB;AACtD,SAASC,wBAAwB,QAAQ,gCAA+B;AAExE,MAAMC,iBAAiB,CAACC,OAAeC;IACrC,OAAOC,KAAKC,KAAK,CAAC,AAACH,QAAQ,MAAOC;AACpC;AAYA,OAAO,eAAeG,UAAU,EAC9BC,QAAQ,EACRC,UAAU,EACVC,MAAMC,OAAO,EACbC,cAAc,EACdC,GAAG,EACHC,KAAK,EACLC,aAAa,EACbC,YAAY,EACE;IACd,IAAI;QACF,MAAM,EAAEC,CAAC,EAAEC,CAAC,EAAE,GAAGV;QACjB,MAAME,OAAOC;QAEb,MAAMQ,qBAAqBnB,gBAAgBU,KAAKU,QAAQ;QAExD,MAAMC,eAA6B,CAAC;QAEpC,IAAIF,oBAAoB;YACtBE,aAAaC,QAAQ,GAAG;QAC1B;QAEA,MAAM,EAAEC,QAAQC,cAAc,EAAEC,OAAOC,aAAa,EAAE,GAAGjB;QACzD,MAAMkB,WAAWC,OAAOb;QACxB,MAAMc,YAAYD,OAAOhB;QAEzB,MAAMkB,oBAAoBJ,kBAAkBC,YAAYH,mBAAmBK;QAE3E,IAAI,CAACC,mBAAmB;YACtB,IAAIC,iBAAiBP;YAErB,IAAIL,oBAAoB;gBACtB,MAAMa,mBAAmB,MAAMlB,MAC7BJ,KAAKuB,YAAY,IAAIvB,KAAKwB,IAAI,EAC9Bb,cACAc,QAAQ;gBACVJ,iBAAiBC,iBAAiBI,KAAK,GAAGJ,iBAAiBT,MAAM,GAAIC;YACvE;YAEA,OAAO;gBACLU,MAAMxB,KAAKwB,IAAI;gBACfG,MAAM;oBACJd,QAAQQ;oBACRO,MAAM5B,KAAK4B,IAAI;oBACfb,OAAOC;gBACT;YACF;QACF;QAEA,MAAMa,oBAAoB;YACxBhB,QAAQK,OAAOhB;YACf4B,MAAMtC,eAAee,GAAGR,WAAWgB,KAAK;YACxCgB,KAAKvC,eAAegB,GAAGT,WAAWc,MAAM;YACxCE,OAAOG,OAAOb;QAChB;QAEA,IAAI2B,UAAU5B,MAAMJ,KAAKuB,YAAY,IAAIvB,KAAKwB,IAAI,EAAEb,cAAcsB,OAAO,CAACJ;QAE1EG,UAAU,MAAMzC,yBAAyB;YACvCY,KAAKA;YACL+B,WAAWF;YACX1B,cAAcA;QAChB;QAEA,OAAO,MAAM0B,QAAQG,QAAQ,CAAC;YAC5BC,mBAAmB;QACrB;IACF,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,CAAC,qBAAqB,CAAC,EAAEA;QACvC,MAAMA;IACR;AACF"}

package/dist/uploads/cropImage.spec.js

@@ -0,0 +1,71 @@
+import { describe, expect, it, vi } from 'vitest';
+import { cropImage } from './cropImage.js';
+const createSharpMock = ()=>{
+    const chain = {
+        extract: vi.fn(()=>chain),
+        metadata: vi.fn().mockResolvedValue({
+            height: 100,
+            pages: 1
+        }),
+        toBuffer: vi.fn().mockResolvedValue({
+            data: Buffer.from('cropped'),
+            info: {
+                height: 50,
+                size: 7,
+                width: 50
+            }
+        })
+    };
+    const sharp = vi.fn(()=>chain);
+    return sharp;
+};
+const createFile = (mimetype)=>({
+        data: Buffer.from('original'),
+        mimetype,
+        name: 'photo',
+        size: 8
+    });
+describe('cropImage', ()=>{
+    it('enables sharp animated reading for tiff, matching isAnimatedImage', async ()=>{
+        const sharp = createSharpMock();
+        const file = createFile('image/tiff');
+        await cropImage({
+            cropData: {
+                x: 10,
+                y: 10
+            },
+            dimensions: {
+                height: 100,
+                width: 100
+            },
+            file,
+            heightInPixels: 50,
+            sharp: sharp,
+            widthInPixels: 50
+        });
+        expect(sharp).toHaveBeenCalledWith(file.data, {
+            animated: true
+        });
+    });
+    it('does not enable sharp animated reading for avif, matching isAnimatedImage', async ()=>{
+        const sharp = createSharpMock();
+        const file = createFile('image/avif');
+        await cropImage({
+            cropData: {
+                x: 10,
+                y: 10
+            },
+            dimensions: {
+                height: 100,
+                width: 100
+            },
+            file,
+            heightInPixels: 50,
+            sharp: sharp,
+            widthInPixels: 50
+        });
+        expect(sharp).toHaveBeenCalledWith(file.data, {});
+    });
+});
+
+//# sourceMappingURL=cropImage.spec.js.map

package/dist/uploads/cropImage.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/cropImage.spec.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nimport { describe, expect, it, vi } from 'vitest'\n\nimport { cropImage } from './cropImage.js'\n\nconst createSharpMock = () => {\n  const chain: any = {\n    extract: vi.fn(() => chain),\n    metadata: vi.fn().mockResolvedValue({ height: 100, pages: 1 }),\n    toBuffer: vi.fn().mockResolvedValue({\n      data: Buffer.from('cropped'),\n      info: { height: 50, size: 7, width: 50 },\n    }),\n  }\n\n  const sharp = vi.fn(() => chain)\n\n  return sharp\n}\n\nconst createFile = (mimetype: string): PayloadRequest['file'] =>\n  ({\n    data: Buffer.from('original'),\n    mimetype,\n    name: 'photo',\n    size: 8,\n  }) as PayloadRequest['file']\n\ndescribe('cropImage', () => {\n  it('enables sharp animated reading for tiff, matching isAnimatedImage', async () => {\n    const sharp = createSharpMock()\n    const file = createFile('image/tiff')\n\n    await cropImage({\n      cropData: { x: 10, y: 10 },\n      dimensions: { height: 100, width: 100 },\n      file,\n      heightInPixels: 50,\n      sharp: sharp as any,\n      widthInPixels: 50,\n    })\n\n    expect(sharp).toHaveBeenCalledWith(file!.data, { animated: true })\n  })\n\n  it('does not enable sharp animated reading for avif, matching isAnimatedImage', async () => {\n    const sharp = createSharpMock()\n    const file = createFile('image/avif')\n\n    await cropImage({\n      cropData: { x: 10, y: 10 },\n      dimensions: { height: 100, width: 100 },\n      file,\n      heightInPixels: 50,\n      sharp: sharp as any,\n      widthInPixels: 50,\n    })\n\n    expect(sharp).toHaveBeenCalledWith(file!.data, {})\n  })\n})\n"],"names":["describe","expect","it","vi","cropImage","createSharpMock","chain","extract","fn","metadata","mockResolvedValue","height","pages","toBuffer","data","Buffer","from","info","size","width","sharp","createFile","mimetype","name","file","cropData","x","y","dimensions","heightInPixels","widthInPixels","toHaveBeenCalledWith","animated"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,SAASC,SAAS,QAAQ,iBAAgB;AAE1C,MAAMC,kBAAkB;IACtB,MAAMC,QAAa;QACjBC,SAASJ,GAAGK,EAAE,CAAC,IAAMF;QACrBG,UAAUN,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;YAAEC,QAAQ;YAAKC,OAAO;QAAE;QAC5DC,UAAUV,GAAGK,EAAE,GAAGE,iBAAiB,CAAC;YAClCI,MAAMC,OAAOC,IAAI,CAAC;YAClBC,MAAM;gBAAEN,QAAQ;gBAAIO,MAAM;gBAAGC,OAAO;YAAG;QACzC;IACF;IAEA,MAAMC,QAAQjB,GAAGK,EAAE,CAAC,IAAMF;IAE1B,OAAOc;AACT;AAEA,MAAMC,aAAa,CAACC,WACjB,CAAA;QACCR,MAAMC,OAAOC,IAAI,CAAC;QAClBM;QACAC,MAAM;QACNL,MAAM;IACR,CAAA;AAEFlB,SAAS,aAAa;IACpBE,GAAG,qEAAqE;QACtE,MAAMkB,QAAQf;QACd,MAAMmB,OAAOH,WAAW;QAExB,MAAMjB,UAAU;YACdqB,UAAU;gBAAEC,GAAG;gBAAIC,GAAG;YAAG;YACzBC,YAAY;gBAAEjB,QAAQ;gBAAKQ,OAAO;YAAI;YACtCK;YACAK,gBAAgB;YAChBT,OAAOA;YACPU,eAAe;QACjB;QAEA7B,OAAOmB,OAAOW,oBAAoB,CAACP,KAAMV,IAAI,EAAE;YAAEkB,UAAU;QAAK;IAClE;IAEA9B,GAAG,6EAA6E;QAC9E,MAAMkB,QAAQf;QACd,MAAMmB,OAAOH,WAAW;QAExB,MAAMjB,UAAU;YACdqB,UAAU;gBAAEC,GAAG;gBAAIC,GAAG;YAAG;YACzBC,YAAY;gBAAEjB,QAAQ;gBAAKQ,OAAO;YAAI;YACtCK;YACAK,gBAAgB;YAChBT,OAAOA;YACPU,eAAe;QACjB;QAEA7B,OAAOmB,OAAOW,oBAAoB,CAACP,KAAMV,IAAI,EAAE,CAAC;IAClD;AACF"}

package/dist/uploads/docWithFilenameExists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docWithFilenameExists.d.ts","sourceRoot":"","sources":["../../src/uploads/docWithFilenameExists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAE9D,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,4CAKzC,IAAI,KAAG,OAAO,CAAC,OAAO,CAkBxB,CAAA"}
+{"version":3,"file":"docWithFilenameExists.d.ts","sourceRoot":"","sources":["../../src/uploads/docWithFilenameExists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAE9D,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,+CAK/B,IAAI,KAAG,OAAO,CAAC,OAAO,CAkBxB,CAAA"}

package/dist/uploads/endpoints/getFileFromURL.js

@@ -23,6 +23,7 @@ export const getFileFromURLHandler = async (req)=>{
     if (id) {
         // updating doc
         const accessResult = await executeAccess({
+            slug: config.slug,
             req
         }, config.access.update);
         if (!accessResult) {
@@ -31,6 +32,7 @@ export const getFileFromURLHandler = async (req)=>{
     } else {
         // creating doc
         const accessResult = await executeAccess({
+            slug: config.slug,
             req
         }, config.access?.create);
         if (!accessResult) {

package/dist/uploads/endpoints/getFileFromURL.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/getFileFromURL.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { APIError } from '../../errors/APIError.js'\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { isURLAllowed } from '../../utilities/isURLAllowed.js'\nimport { sanitizeFilename } from '../../utilities/sanitizeFilename.js'\nimport { safeFetch } from '../safeFetch.js'\n\n// If doc id is provided, it means we are updating the doc\n// /:collectionSlug/paste-url/:doc-id?src=:fileUrl\n\n// If doc id is not provided, it means we are creating a new doc\n// /:collectionSlug/paste-url?src=:fileUrl\n\nexport const getFileFromURLHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })\n\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const config = collection?.config\n\n  if (!config.upload?.pasteURL) {\n    throw new APIError('Pasting from URL is not enabled for this collection.', 400)\n  }\n\n  if (id) {\n    // updating doc\n    const accessResult = await executeAccess({ req }, config.access.update)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  } else {\n    // creating doc\n    const accessResult = await executeAccess({ req }, config.access?.create)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  if (!req.url) {\n    throw new APIError('Request URL is missing.', 400)\n  }\n\n  const { searchParams } = new URL(req.url)\n  const src = searchParams.get('src')\n\n  if (!src || typeof src !== 'string') {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  const hasAllowList =\n    typeof config.upload.pasteURL === 'object' && Array.isArray(config.upload.pasteURL.allowList)\n\n  let fileURL: string\n  try {\n    fileURL = new URL(src).href\n  } catch {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n    throw new APIError('The provided URL is not allowed.', 400)\n  }\n\n  let redirectCount = 0\n  const maxRedirects = 3\n  let response!: Response\n\n  while (true) {\n    if (hasAllowList && isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n      // Allow-listed URLs bypass SSRF filtering (e.g. internal/localhost CDNs)\n      response = await fetch(fileURL, {\n        headers: { 'Accept-Encoding': 'identity' },\n        redirect: 'manual',\n        signal: AbortSignal.timeout(30_000),\n      })\n    } else {\n      response = await safeFetch(fileURL, {\n        headers: {\n          'Accept-Encoding': 'identity',\n        },\n        signal: AbortSignal.timeout(30_000),\n      })\n    }\n\n    if (response.status >= 300 && response.status < 400) {\n      redirectCount++\n      if (redirectCount > maxRedirects) {\n        throw new APIError('Too many redirects.', 403)\n      }\n      const location = response.headers.get('location')\n      if (location) {\n        fileURL = new URL(location, fileURL).href\n        if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n          throw new APIError('The provided URL is not allowed.', 400)\n        }\n        continue\n      }\n    }\n\n    break\n  }\n\n  if (!response.ok) {\n    throw new APIError('Failed to fetch the file from the provided URL.', response.status)\n  }\n\n  const rawFileName = decodeURIComponent(new URL(fileURL).pathname.split('/').pop() || '')\n  const safeFileName = sanitizeFilename(rawFileName)\n  const encodedFileName = encodeURIComponent(safeFileName).replace(\n    /['()]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n  // Strip quotes, backslashes, and control chars from the ASCII fallback\n  const asciiFileName = safeFileName.replace(/[\"\\\\\\r\\n]/g, '_')\n\n  const headers: Record<string, string> = {\n    'Content-Disposition': `attachment; filename=\"${asciiFileName}\"; filename*=UTF-8''${encodedFileName}`,\n    'Content-Type': response.headers.get('content-type') || 'application/octet-stream',\n  }\n\n  const contentLength = response.headers.get('content-length')\n  if (contentLength) {\n    headers['Content-Length'] = contentLength\n  }\n\n  return new Response(response.body, { headers })\n}\n"],"names":["executeAccess","APIError","Forbidden","getRequestCollectionWithID","isURLAllowed","sanitizeFilename","safeFetch","getFileFromURLHandler","req","id","collection","optionalID","user","t","config","upload","pasteURL","accessResult","access","update","create","url","searchParams","URL","src","get","hasAllowList","Array","isArray","allowList","fileURL","href","redirectCount","maxRedirects","response","fetch","headers","redirect","signal","AbortSignal","timeout","status","location","ok","rawFileName","decodeURIComponent","pathname","split","pop","safeFileName","encodedFileName","encodeURIComponent","replace","c","charCodeAt","toString","toUpperCase","asciiFileName","contentLength","Response","body"],"mappings":"AAEA,SAASA,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,SAAS,QAAQ,4BAA2B;AACrD,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,YAAY,QAAQ,kCAAiC;AAC9D,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,SAAS,QAAQ,kBAAiB;AAE3C,0DAA0D;AAC1D,kDAAkD;AAElD,gEAAgE;AAChE,0CAA0C;AAE1C,OAAO,MAAMC,wBAAwC,OAAOC;IAC1D,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGP,2BAA2BK,KAAK;QAAEG,YAAY;IAAK;IAE9E,IAAI,CAACH,IAAII,IAAI,EAAE;QACb,MAAM,IAAIV,UAAUM,IAAIK,CAAC;IAC3B;IAEA,MAAMC,SAASJ,YAAYI;IAE3B,IAAI,CAACA,OAAOC,MAAM,EAAEC,UAAU;QAC5B,MAAM,IAAIf,SAAS,wDAAwD;IAC7E;IAEA,IAAIQ,IAAI;QACN,eAAe;QACf,MAAMQ,eAAe,MAAMjB,cAAc;YAAEQ;QAAI,GAAGM,OAAOI,MAAM,CAACC,MAAM;QACtE,IAAI,CAACF,cAAc;YACjB,MAAM,IAAIf,UAAUM,IAAIK,CAAC;QAC3B;IACF,OAAO;QACL,eAAe;QACf,MAAMI,eAAe,MAAMjB,cAAc;YAAEQ;QAAI,GAAGM,OAAOI,MAAM,EAAEE;QACjE,IAAI,CAACH,cAAc;YACjB,MAAM,IAAIf,UAAUM,IAAIK,CAAC;QAC3B;IACF;IAEA,IAAI,CAACL,IAAIa,GAAG,EAAE;QACZ,MAAM,IAAIpB,SAAS,2BAA2B;IAChD;IAEA,MAAM,EAAEqB,YAAY,EAAE,GAAG,IAAIC,IAAIf,IAAIa,GAAG;IACxC,MAAMG,MAAMF,aAAaG,GAAG,CAAC;IAE7B,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU;QACnC,MAAM,IAAIvB,SAAS,mCAAmC;IACxD;IAEA,MAAMyB,eACJ,OAAOZ,OAAOC,MAAM,CAACC,QAAQ,KAAK,YAAYW,MAAMC,OAAO,CAACd,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS;IAE9F,IAAIC;IACJ,IAAI;QACFA,UAAU,IAAIP,IAAIC,KAAKO,IAAI;IAC7B,EAAE,OAAM;QACN,MAAM,IAAI9B,SAAS,mCAAmC;IACxD;IAEA,IAAIyB,gBAAgB,CAACtB,aAAa0B,SAAShB,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS,GAAG;QAC5E,MAAM,IAAI5B,SAAS,oCAAoC;IACzD;IAEA,IAAI+B,gBAAgB;IACpB,MAAMC,eAAe;IACrB,IAAIC;IAEJ,MAAO,KAAM;QACX,IAAIR,gBAAgBtB,aAAa0B,SAAShB,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS,GAAG;YAC3E,yEAAyE;YACzEK,WAAW,MAAMC,MAAML,SAAS;gBAC9BM,SAAS;oBAAE,mBAAmB;gBAAW;gBACzCC,UAAU;gBACVC,QAAQC,YAAYC,OAAO,CAAC;YAC9B;QACF,OAAO;YACLN,WAAW,MAAM5B,UAAUwB,SAAS;gBAClCM,SAAS;oBACP,mBAAmB;gBACrB;gBACAE,QAAQC,YAAYC,OAAO,CAAC;YAC9B;QACF;QAEA,IAAIN,SAASO,MAAM,IAAI,OAAOP,SAASO,MAAM,GAAG,KAAK;YACnDT;YACA,IAAIA,gBAAgBC,cAAc;gBAChC,MAAM,IAAIhC,SAAS,uBAAuB;YAC5C;YACA,MAAMyC,WAAWR,SAASE,OAAO,CAACX,GAAG,CAAC;YACtC,IAAIiB,UAAU;gBACZZ,UAAU,IAAIP,IAAImB,UAAUZ,SAASC,IAAI;gBACzC,IAAIL,gBAAgB,CAACtB,aAAa0B,SAAShB,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS,GAAG;oBAC5E,MAAM,IAAI5B,SAAS,oCAAoC;gBACzD;gBACA;YACF;QACF;QAEA;IACF;IAEA,IAAI,CAACiC,SAASS,EAAE,EAAE;QAChB,MAAM,IAAI1C,SAAS,mDAAmDiC,SAASO,MAAM;IACvF;IAEA,MAAMG,cAAcC,mBAAmB,IAAItB,IAAIO,SAASgB,QAAQ,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;IACrF,MAAMC,eAAe5C,iBAAiBuC;IACtC,MAAMM,kBAAkBC,mBAAmBF,cAAcG,OAAO,CAC9D,UACA,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAEC,UAAU,CAAC,GAAGC,QAAQ,CAAC,IAAIC,WAAW,IAAI;IAEzD,uEAAuE;IACvE,MAAMC,gBAAgBR,aAAaG,OAAO,CAAC,cAAc;IAEzD,MAAMhB,UAAkC;QACtC,uBAAuB,CAAC,sBAAsB,EAAEqB,cAAc,oBAAoB,EAAEP,iBAAiB;QACrG,gBAAgBhB,SAASE,OAAO,CAACX,GAAG,CAAC,mBAAmB;IAC1D;IAEA,MAAMiC,gBAAgBxB,SAASE,OAAO,CAACX,GAAG,CAAC;IAC3C,IAAIiC,eAAe;QACjBtB,OAAO,CAAC,iBAAiB,GAAGsB;IAC9B;IAEA,OAAO,IAAIC,SAASzB,SAAS0B,IAAI,EAAE;QAAExB;IAAQ;AAC/C,EAAC"}
+{"version":3,"sources":["../../../src/uploads/endpoints/getFileFromURL.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { APIError } from '../../errors/APIError.js'\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { isURLAllowed } from '../../utilities/isURLAllowed.js'\nimport { sanitizeFilename } from '../../utilities/sanitizeFilename.js'\nimport { safeFetch } from '../safeFetch.js'\n\n// If doc id is provided, it means we are updating the doc\n// /:collectionSlug/paste-url/:doc-id?src=:fileUrl\n\n// If doc id is not provided, it means we are creating a new doc\n// /:collectionSlug/paste-url?src=:fileUrl\n\nexport const getFileFromURLHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })\n\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const config = collection?.config\n\n  if (!config.upload?.pasteURL) {\n    throw new APIError('Pasting from URL is not enabled for this collection.', 400)\n  }\n\n  if (id) {\n    // updating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access.update)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  } else {\n    // creating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access?.create)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  if (!req.url) {\n    throw new APIError('Request URL is missing.', 400)\n  }\n\n  const { searchParams } = new URL(req.url)\n  const src = searchParams.get('src')\n\n  if (!src || typeof src !== 'string') {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  const hasAllowList =\n    typeof config.upload.pasteURL === 'object' && Array.isArray(config.upload.pasteURL.allowList)\n\n  let fileURL: string\n  try {\n    fileURL = new URL(src).href\n  } catch {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n    throw new APIError('The provided URL is not allowed.', 400)\n  }\n\n  let redirectCount = 0\n  const maxRedirects = 3\n  let response!: Response\n\n  while (true) {\n    if (hasAllowList && isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n      // Allow-listed URLs bypass SSRF filtering (e.g. internal/localhost CDNs)\n      response = await fetch(fileURL, {\n        headers: { 'Accept-Encoding': 'identity' },\n        redirect: 'manual',\n        signal: AbortSignal.timeout(30_000),\n      })\n    } else {\n      response = await safeFetch(fileURL, {\n        headers: {\n          'Accept-Encoding': 'identity',\n        },\n        signal: AbortSignal.timeout(30_000),\n      })\n    }\n\n    if (response.status >= 300 && response.status < 400) {\n      redirectCount++\n      if (redirectCount > maxRedirects) {\n        throw new APIError('Too many redirects.', 403)\n      }\n      const location = response.headers.get('location')\n      if (location) {\n        fileURL = new URL(location, fileURL).href\n        if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n          throw new APIError('The provided URL is not allowed.', 400)\n        }\n        continue\n      }\n    }\n\n    break\n  }\n\n  if (!response.ok) {\n    throw new APIError('Failed to fetch the file from the provided URL.', response.status)\n  }\n\n  const rawFileName = decodeURIComponent(new URL(fileURL).pathname.split('/').pop() || '')\n  const safeFileName = sanitizeFilename(rawFileName)\n  const encodedFileName = encodeURIComponent(safeFileName).replace(\n    /['()]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n  // Strip quotes, backslashes, and control chars from the ASCII fallback\n  const asciiFileName = safeFileName.replace(/[\"\\\\\\r\\n]/g, '_')\n\n  const headers: Record<string, string> = {\n    'Content-Disposition': `attachment; filename=\"${asciiFileName}\"; filename*=UTF-8''${encodedFileName}`,\n    'Content-Type': response.headers.get('content-type') || 'application/octet-stream',\n  }\n\n  const contentLength = response.headers.get('content-length')\n  if (contentLength) {\n    headers['Content-Length'] = contentLength\n  }\n\n  return new Response(response.body, { headers })\n}\n"],"names":["executeAccess","APIError","Forbidden","getRequestCollectionWithID","isURLAllowed","sanitizeFilename","safeFetch","getFileFromURLHandler","req","id","collection","optionalID","user","t","config","upload","pasteURL","accessResult","slug","access","update","create","url","searchParams","URL","src","get","hasAllowList","Array","isArray","allowList","fileURL","href","redirectCount","maxRedirects","response","fetch","headers","redirect","signal","AbortSignal","timeout","status","location","ok","rawFileName","decodeURIComponent","pathname","split","pop","safeFileName","encodedFileName","encodeURIComponent","replace","c","charCodeAt","toString","toUpperCase","asciiFileName","contentLength","Response","body"],"mappings":"AAEA,SAASA,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,SAAS,QAAQ,4BAA2B;AACrD,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,YAAY,QAAQ,kCAAiC;AAC9D,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,SAAS,QAAQ,kBAAiB;AAE3C,0DAA0D;AAC1D,kDAAkD;AAElD,gEAAgE;AAChE,0CAA0C;AAE1C,OAAO,MAAMC,wBAAwC,OAAOC;IAC1D,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGP,2BAA2BK,KAAK;QAAEG,YAAY;IAAK;IAE9E,IAAI,CAACH,IAAII,IAAI,EAAE;QACb,MAAM,IAAIV,UAAUM,IAAIK,CAAC;IAC3B;IAEA,MAAMC,SAASJ,YAAYI;IAE3B,IAAI,CAACA,OAAOC,MAAM,EAAEC,UAAU;QAC5B,MAAM,IAAIf,SAAS,wDAAwD;IAC7E;IAEA,IAAIQ,IAAI;QACN,eAAe;QACf,MAAMQ,eAAe,MAAMjB,cAAc;YAAEkB,MAAMJ,OAAOI,IAAI;YAAEV;QAAI,GAAGM,OAAOK,MAAM,CAACC,MAAM;QACzF,IAAI,CAACH,cAAc;YACjB,MAAM,IAAIf,UAAUM,IAAIK,CAAC;QAC3B;IACF,OAAO;QACL,eAAe;QACf,MAAMI,eAAe,MAAMjB,cAAc;YAAEkB,MAAMJ,OAAOI,IAAI;YAAEV;QAAI,GAAGM,OAAOK,MAAM,EAAEE;QACpF,IAAI,CAACJ,cAAc;YACjB,MAAM,IAAIf,UAAUM,IAAIK,CAAC;QAC3B;IACF;IAEA,IAAI,CAACL,IAAIc,GAAG,EAAE;QACZ,MAAM,IAAIrB,SAAS,2BAA2B;IAChD;IAEA,MAAM,EAAEsB,YAAY,EAAE,GAAG,IAAIC,IAAIhB,IAAIc,GAAG;IACxC,MAAMG,MAAMF,aAAaG,GAAG,CAAC;IAE7B,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU;QACnC,MAAM,IAAIxB,SAAS,mCAAmC;IACxD;IAEA,MAAM0B,eACJ,OAAOb,OAAOC,MAAM,CAACC,QAAQ,KAAK,YAAYY,MAAMC,OAAO,CAACf,OAAOC,MAAM,CAACC,QAAQ,CAACc,SAAS;IAE9F,IAAIC;IACJ,IAAI;QACFA,UAAU,IAAIP,IAAIC,KAAKO,IAAI;IAC7B,EAAE,OAAM;QACN,MAAM,IAAI/B,SAAS,mCAAmC;IACxD;IAEA,IAAI0B,gBAAgB,CAACvB,aAAa2B,SAASjB,OAAOC,MAAM,CAACC,QAAQ,CAACc,SAAS,GAAG;QAC5E,MAAM,IAAI7B,SAAS,oCAAoC;IACzD;IAEA,IAAIgC,gBAAgB;IACpB,MAAMC,eAAe;IACrB,IAAIC;IAEJ,MAAO,KAAM;QACX,IAAIR,gBAAgBvB,aAAa2B,SAASjB,OAAOC,MAAM,CAACC,QAAQ,CAACc,SAAS,GAAG;YAC3E,yEAAyE;YACzEK,WAAW,MAAMC,MAAML,SAAS;gBAC9BM,SAAS;oBAAE,mBAAmB;gBAAW;gBACzCC,UAAU;gBACVC,QAAQC,YAAYC,OAAO,CAAC;YAC9B;QACF,OAAO;YACLN,WAAW,MAAM7B,UAAUyB,SAAS;gBAClCM,SAAS;oBACP,mBAAmB;gBACrB;gBACAE,QAAQC,YAAYC,OAAO,CAAC;YAC9B;QACF;QAEA,IAAIN,SAASO,MAAM,IAAI,OAAOP,SAASO,MAAM,GAAG,KAAK;YACnDT;YACA,IAAIA,gBAAgBC,cAAc;gBAChC,MAAM,IAAIjC,SAAS,uBAAuB;YAC5C;YACA,MAAM0C,WAAWR,SAASE,OAAO,CAACX,GAAG,CAAC;YACtC,IAAIiB,UAAU;gBACZZ,UAAU,IAAIP,IAAImB,UAAUZ,SAASC,IAAI;gBACzC,IAAIL,gBAAgB,CAACvB,aAAa2B,SAASjB,OAAOC,MAAM,CAACC,QAAQ,CAACc,SAAS,GAAG;oBAC5E,MAAM,IAAI7B,SAAS,oCAAoC;gBACzD;gBACA;YACF;QACF;QAEA;IACF;IAEA,IAAI,CAACkC,SAASS,EAAE,EAAE;QAChB,MAAM,IAAI3C,SAAS,mDAAmDkC,SAASO,MAAM;IACvF;IAEA,MAAMG,cAAcC,mBAAmB,IAAItB,IAAIO,SAASgB,QAAQ,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;IACrF,MAAMC,eAAe7C,iBAAiBwC;IACtC,MAAMM,kBAAkBC,mBAAmBF,cAAcG,OAAO,CAC9D,UACA,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAEC,UAAU,CAAC,GAAGC,QAAQ,CAAC,IAAIC,WAAW,IAAI;IAEzD,uEAAuE;IACvE,MAAMC,gBAAgBR,aAAaG,OAAO,CAAC,cAAc;IAEzD,MAAMhB,UAAkC;QACtC,uBAAuB,CAAC,sBAAsB,EAAEqB,cAAc,oBAAoB,EAAEP,iBAAiB;QACrG,gBAAgBhB,SAASE,OAAO,CAACX,GAAG,CAAC,mBAAmB;IAC1D;IAEA,MAAMiC,gBAAgBxB,SAASE,OAAO,CAACX,GAAG,CAAC;IAC3C,IAAIiC,eAAe;QACjBtB,OAAO,CAAC,iBAAiB,GAAGsB;IAC9B;IAEA,OAAO,IAAIC,SAASzB,SAAS0B,IAAI,EAAE;QAAExB;IAAQ;AAC/C,EAAC"}

package/dist/uploads/endpoints/uploadInstructions.d.ts

@@ -0,0 +1,15 @@
+import type { Endpoint } from '../../config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+import type { UploadInstructions, UploadInstructionsRequest } from '../types.js';
+export declare const getUploadInstructions: ({ overrideAccess, req, ...upload }: {
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+} & UploadInstructionsRequest) => Promise<UploadInstructions>;
+export declare const uploadInstructionsEndpoint: Endpoint;
+/**
+ * Stores or removes temporary files when no adapter-specific upload instructions are available.
+ * PUT keeps the file until it is used in a document request.
+ * DELETE removes a file the client no longer needs.
+ */
+export declare const stagedUploadEndpoints: Endpoint[];
+//# sourceMappingURL=uploadInstructions.d.ts.map

package/dist/uploads/endpoints/uploadInstructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadInstructions.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/uploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AA8BhF,eAAO,MAAM,qBAAqB,uCAI/B;IACD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,yBAAyB,KAAG,OAAO,CAAC,kBAAkB,CA+CzD,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,QAexC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,EAW3C,CAAA"}

package/dist/uploads/endpoints/uploadInstructions.js

@@ -0,0 +1,84 @@
+import { getAccessResults } from '../../auth/getAccessResults.js';
+import { APIError, Forbidden } from '../../errors/index.js';
+import { checkFileRestrictions } from '../checkFileRestrictions.js';
+import { deleteStagedFile, generateStagedUploadInstructions, uploadStagedFile } from '../stagedUpload.js';
+const bytesToMB = (bytes)=>bytes / 1024 / 1024;
+const isUploadInstructionsRequest = (upload)=>typeof upload === 'object' && upload !== null && 'collectionSlug' in upload && typeof upload.collectionSlug === 'string' && (!('docPrefix' in upload) || upload.docPrefix === undefined || typeof upload.docPrefix === 'string') && 'filename' in upload && typeof upload.filename === 'string' && 'filesize' in upload && typeof upload.filesize === 'number' && Number.isSafeInteger(upload.filesize) && upload.filesize >= 0 && 'mimeType' in upload && typeof upload.mimeType === 'string';
+export const getUploadInstructions = async ({ overrideAccess = false, req, ...upload })=>{
+    const collection = req.payload.collections[upload.collectionSlug];
+    const uploadInstructions = collection?.config?.upload?.uploadInstructions;
+    if (!collection?.config?.upload) {
+        throw new APIError(`Upload collection ${upload.collectionSlug} was not found`, 400);
+    }
+    const filesizeLimit = req.payload.config.upload.limits?.fileSize;
+    if (filesizeLimit && upload.filesize > filesizeLimit) {
+        throw new APIError(`Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit).toFixed(2)}MB, got: ${bytesToMB(upload.filesize).toFixed(2)}MB`, 400);
+    }
+    await checkFileRestrictions({
+        checkFileContents: false,
+        collection: collection.config,
+        file: {
+            name: upload.filename,
+            data: Buffer.alloc(0),
+            mimetype: upload.mimeType,
+            size: upload.filesize
+        },
+        req
+    });
+    if (!uploadInstructions && !overrideAccess) {
+        // Staged uploads write to Payload before a document is saved. Require a signed-in user who
+        // can create or update documents in this collection.
+        if (!req.user) {
+            throw new Forbidden(req.t);
+        }
+        const collectionPermissions = (await getAccessResults({
+            req
+        })).collections?.[upload.collectionSlug];
+        if (!collectionPermissions?.create && !collectionPermissions?.update) {
+            throw new Forbidden(req.t);
+        }
+    }
+    return uploadInstructions ? uploadInstructions.generate({
+        ...upload,
+        overrideAccess,
+        req
+    }) : generateStagedUploadInstructions({
+        ...upload,
+        req
+    });
+};
+export const uploadInstructionsEndpoint = {
+    handler: async (req)=>{
+        if (!req.json) {
+            throw new APIError('Content-Type expected to be application/json', 400);
+        }
+        const upload = await req.json();
+        if (!isUploadInstructionsRequest(upload)) {
+            throw new APIError('Invalid upload instructions request', 400);
+        }
+        return Response.json(await getUploadInstructions({
+            ...upload,
+            req
+        }));
+    },
+    method: 'post',
+    path: '/upload-instructions'
+};
+/**
+ * Stores or removes temporary files when no adapter-specific upload instructions are available.
+ * PUT keeps the file until it is used in a document request.
+ * DELETE removes a file the client no longer needs.
+ */ export const stagedUploadEndpoints = [
+    {
+        handler: uploadStagedFile,
+        method: 'put',
+        path: '/upload-instructions/:uploadId'
+    },
+    {
+        handler: deleteStagedFile,
+        method: 'delete',
+        path: '/upload-instructions/:uploadId'
+    }
+];
+
+//# sourceMappingURL=uploadInstructions.js.map

package/dist/uploads/endpoints/uploadInstructions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/endpoints/uploadInstructions.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { UploadInstructions, UploadInstructionsRequest } from '../types.js'\n\nimport { getAccessResults } from '../../auth/getAccessResults.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { checkFileRestrictions } from '../checkFileRestrictions.js'\nimport {\n  deleteStagedFile,\n  generateStagedUploadInstructions,\n  uploadStagedFile,\n} from '../stagedUpload.js'\n\nconst bytesToMB = (bytes: number) => bytes / 1024 / 1024\n\nconst isUploadInstructionsRequest = (upload: unknown): upload is UploadInstructionsRequest =>\n  typeof upload === 'object' &&\n  upload !== null &&\n  'collectionSlug' in upload &&\n  typeof upload.collectionSlug === 'string' &&\n  (!('docPrefix' in upload) ||\n    upload.docPrefix === undefined ||\n    typeof upload.docPrefix === 'string') &&\n  'filename' in upload &&\n  typeof upload.filename === 'string' &&\n  'filesize' in upload &&\n  typeof upload.filesize === 'number' &&\n  Number.isSafeInteger(upload.filesize) &&\n  upload.filesize >= 0 &&\n  'mimeType' in upload &&\n  typeof upload.mimeType === 'string'\n\nexport const getUploadInstructions = async ({\n  overrideAccess = false,\n  req,\n  ...upload\n}: {\n  overrideAccess?: boolean\n  req: PayloadRequest\n} & UploadInstructionsRequest): Promise<UploadInstructions> => {\n  const collection = req.payload.collections[upload.collectionSlug]\n  const uploadInstructions = collection?.config?.upload?.uploadInstructions\n\n  if (!collection?.config?.upload) {\n    throw new APIError(`Upload collection ${upload.collectionSlug} was not found`, 400)\n  }\n\n  const filesizeLimit = req.payload.config.upload.limits?.fileSize\n  if (filesizeLimit && upload.filesize > filesizeLimit) {\n    throw new APIError(\n      `Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit).toFixed(2)}MB, got: ${bytesToMB(upload.filesize).toFixed(2)}MB`,\n      400,\n    )\n  }\n\n  await checkFileRestrictions({\n    checkFileContents: false,\n    collection: collection.config,\n    file: {\n      name: upload.filename,\n      data: Buffer.alloc(0),\n      mimetype: upload.mimeType,\n      size: upload.filesize,\n    },\n    req,\n  })\n\n  if (!uploadInstructions && !overrideAccess) {\n    // Staged uploads write to Payload before a document is saved. Require a signed-in user who\n    // can create or update documents in this collection.\n    if (!req.user) {\n      throw new Forbidden(req.t)\n    }\n\n    const collectionPermissions = (await getAccessResults({ req })).collections?.[\n      upload.collectionSlug\n    ]\n\n    if (!collectionPermissions?.create && !collectionPermissions?.update) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  return uploadInstructions\n    ? uploadInstructions.generate({ ...upload, overrideAccess, req })\n    : generateStagedUploadInstructions({ ...upload, req })\n}\n\nexport const uploadInstructionsEndpoint: Endpoint = {\n  handler: async (req) => {\n    if (!req.json) {\n      throw new APIError('Content-Type expected to be application/json', 400)\n    }\n\n    const upload: unknown = await req.json()\n    if (!isUploadInstructionsRequest(upload)) {\n      throw new APIError('Invalid upload instructions request', 400)\n    }\n\n    return Response.json(await getUploadInstructions({ ...upload, req }))\n  },\n  method: 'post',\n  path: '/upload-instructions',\n}\n\n/**\n * Stores or removes temporary files when no adapter-specific upload instructions are available.\n * PUT keeps the file until it is used in a document request.\n * DELETE removes a file the client no longer needs.\n */\nexport const stagedUploadEndpoints: Endpoint[] = [\n  {\n    handler: uploadStagedFile,\n    method: 'put',\n    path: '/upload-instructions/:uploadId',\n  },\n  {\n    handler: deleteStagedFile,\n    method: 'delete',\n    path: '/upload-instructions/:uploadId',\n  },\n]\n"],"names":["getAccessResults","APIError","Forbidden","checkFileRestrictions","deleteStagedFile","generateStagedUploadInstructions","uploadStagedFile","bytesToMB","bytes","isUploadInstructionsRequest","upload","collectionSlug","docPrefix","undefined","filename","filesize","Number","isSafeInteger","mimeType","getUploadInstructions","overrideAccess","req","collection","payload","collections","uploadInstructions","config","filesizeLimit","limits","fileSize","toFixed","checkFileContents","file","name","data","Buffer","alloc","mimetype","size","user","t","collectionPermissions","create","update","generate","uploadInstructionsEndpoint","handler","json","Response","method","path","stagedUploadEndpoints"],"mappings":"AAIA,SAASA,gBAAgB,QAAQ,iCAAgC;AACjE,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,qBAAqB,QAAQ,8BAA6B;AACnE,SACEC,gBAAgB,EAChBC,gCAAgC,EAChCC,gBAAgB,QACX,qBAAoB;AAE3B,MAAMC,YAAY,CAACC,QAAkBA,QAAQ,OAAO;AAEpD,MAAMC,8BAA8B,CAACC,SACnC,OAAOA,WAAW,YAClBA,WAAW,QACX,oBAAoBA,UACpB,OAAOA,OAAOC,cAAc,KAAK,YAChC,CAAA,CAAE,CAAA,eAAeD,MAAK,KACrBA,OAAOE,SAAS,KAAKC,aACrB,OAAOH,OAAOE,SAAS,KAAK,QAAO,KACrC,cAAcF,UACd,OAAOA,OAAOI,QAAQ,KAAK,YAC3B,cAAcJ,UACd,OAAOA,OAAOK,QAAQ,KAAK,YAC3BC,OAAOC,aAAa,CAACP,OAAOK,QAAQ,KACpCL,OAAOK,QAAQ,IAAI,KACnB,cAAcL,UACd,OAAOA,OAAOQ,QAAQ,KAAK;AAE7B,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,iBAAiB,KAAK,EACtBC,GAAG,EACH,GAAGX,QAIwB;IAC3B,MAAMY,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACd,OAAOC,cAAc,CAAC;IACjE,MAAMc,qBAAqBH,YAAYI,QAAQhB,QAAQe;IAEvD,IAAI,CAACH,YAAYI,QAAQhB,QAAQ;QAC/B,MAAM,IAAIT,SAAS,CAAC,kBAAkB,EAAES,OAAOC,cAAc,CAAC,cAAc,CAAC,EAAE;IACjF;IAEA,MAAMgB,gBAAgBN,IAAIE,OAAO,CAACG,MAAM,CAAChB,MAAM,CAACkB,MAAM,EAAEC;IACxD,IAAIF,iBAAiBjB,OAAOK,QAAQ,GAAGY,eAAe;QACpD,MAAM,IAAI1B,SACR,CAAC,iCAAiC,EAAEM,UAAUoB,eAAeG,OAAO,CAAC,GAAG,SAAS,EAAEvB,UAAUG,OAAOK,QAAQ,EAAEe,OAAO,CAAC,GAAG,EAAE,CAAC,EAC5H;IAEJ;IAEA,MAAM3B,sBAAsB;QAC1B4B,mBAAmB;QACnBT,YAAYA,WAAWI,MAAM;QAC7BM,MAAM;YACJC,MAAMvB,OAAOI,QAAQ;YACrBoB,MAAMC,OAAOC,KAAK,CAAC;YACnBC,UAAU3B,OAAOQ,QAAQ;YACzBoB,MAAM5B,OAAOK,QAAQ;QACvB;QACAM;IACF;IAEA,IAAI,CAACI,sBAAsB,CAACL,gBAAgB;QAC1C,2FAA2F;QAC3F,qDAAqD;QACrD,IAAI,CAACC,IAAIkB,IAAI,EAAE;YACb,MAAM,IAAIrC,UAAUmB,IAAImB,CAAC;QAC3B;QAEA,MAAMC,wBAAwB,AAAC,CAAA,MAAMzC,iBAAiB;YAAEqB;QAAI,EAAC,EAAGG,WAAW,EAAE,CAC3Ed,OAAOC,cAAc,CACtB;QAED,IAAI,CAAC8B,uBAAuBC,UAAU,CAACD,uBAAuBE,QAAQ;YACpE,MAAM,IAAIzC,UAAUmB,IAAImB,CAAC;QAC3B;IACF;IAEA,OAAOf,qBACHA,mBAAmBmB,QAAQ,CAAC;QAAE,GAAGlC,MAAM;QAAEU;QAAgBC;IAAI,KAC7DhB,iCAAiC;QAAE,GAAGK,MAAM;QAAEW;IAAI;AACxD,EAAC;AAED,OAAO,MAAMwB,6BAAuC;IAClDC,SAAS,OAAOzB;QACd,IAAI,CAACA,IAAI0B,IAAI,EAAE;YACb,MAAM,IAAI9C,SAAS,gDAAgD;QACrE;QAEA,MAAMS,SAAkB,MAAMW,IAAI0B,IAAI;QACtC,IAAI,CAACtC,4BAA4BC,SAAS;YACxC,MAAM,IAAIT,SAAS,uCAAuC;QAC5D;QAEA,OAAO+C,SAASD,IAAI,CAAC,MAAM5B,sBAAsB;YAAE,GAAGT,MAAM;YAAEW;QAAI;IACpE;IACA4B,QAAQ;IACRC,MAAM;AACR,EAAC;AAED;;;;CAIC,GACD,OAAO,MAAMC,wBAAoC;IAC/C;QACEL,SAASxC;QACT2C,QAAQ;QACRC,MAAM;IACR;IACA;QACEJ,SAAS1C;QACT6C,QAAQ;QACRC,MAAM;IACR;CACD,CAAA"}

package/dist/uploads/fetchAPI-multipart/isEligibleRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isEligibleRequest.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/isEligibleRequest.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,OAMhD,CAAA"}
+{"version":3,"file":"isEligibleRequest.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/isEligibleRequest.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,iBAAiB,QAAS,OAAO,KAAG,OAMhD,CAAA"}

package/dist/uploads/fetchAPI-multipart/isEligibleRequest.js

@@ -1,5 +1,4 @@
-// eslint-disable-next-line regexp/no-super-linear-backtracking, regexp/no-obscure-range
-const ACCEPTABLE_CONTENT_TYPE = /multipart\/['"()+-_]+(?:; ?['"()+-_]*)+$/i;
+const ACCEPTABLE_CONTENT_TYPE = /multipart\/[\w'"()+,./:<=>?@[\\\]^-]+(?:; ?[\w'"()+,./:<=>?@[\\\]^-]*)+$/i;
 const UNACCEPTABLE_METHODS = new Set([
     'CONNECT',
     'DELETE',

package/dist/uploads/fetchAPI-multipart/isEligibleRequest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/isEligibleRequest.ts"],"sourcesContent":["// eslint-disable-next-line regexp/no-super-linear-backtracking, regexp/no-obscure-range\nconst ACCEPTABLE_CONTENT_TYPE = /multipart\\/['\"()+-_]+(?:; ?['\"()+-_]*)+$/i\nconst UNACCEPTABLE_METHODS = new Set(['CONNECT', 'DELETE', 'GET', 'HEAD', 'OPTIONS', 'TRACE'])\n\nconst hasBody = (req: Request): boolean => {\n  const contentLength = req.headers.get('content-length')\n\n  return Boolean(\n    req.body || req.headers.get('transfer-encoding') || (contentLength && contentLength !== '0'),\n  )\n}\n\nconst hasAcceptableMethod = (req: Request): boolean => !UNACCEPTABLE_METHODS.has(req.method)\n\nconst hasAcceptableContentType = (req: Request): boolean => {\n  const contType = req.headers.get('content-type')\n  return contType!.includes('boundary=') && ACCEPTABLE_CONTENT_TYPE.test(contType!)\n}\n\nexport const isEligibleRequest = (req: Request): boolean => {\n  try {\n    return hasBody(req) && hasAcceptableMethod(req) && hasAcceptableContentType(req)\n  } catch (ignore) {\n    return false\n  }\n}\n"],"names":["ACCEPTABLE_CONTENT_TYPE","UNACCEPTABLE_METHODS","Set","hasBody","req","contentLength","headers","get","Boolean","body","hasAcceptableMethod","has","method","hasAcceptableContentType","contType","includes","test","isEligibleRequest","ignore"],"mappings":"AAAA,wFAAwF;AACxF,MAAMA,0BAA0B;AAChC,MAAMC,uBAAuB,IAAIC,IAAI;IAAC;IAAW;IAAU;IAAO;IAAQ;IAAW;CAAQ;AAE7F,MAAMC,UAAU,CAACC;IACf,MAAMC,gBAAgBD,IAAIE,OAAO,CAACC,GAAG,CAAC;IAEtC,OAAOC,QACLJ,IAAIK,IAAI,IAAIL,IAAIE,OAAO,CAACC,GAAG,CAAC,wBAAyBF,iBAAiBA,kBAAkB;AAE5F;AAEA,MAAMK,sBAAsB,CAACN,MAA0B,CAACH,qBAAqBU,GAAG,CAACP,IAAIQ,MAAM;AAE3F,MAAMC,2BAA2B,CAACT;IAChC,MAAMU,WAAWV,IAAIE,OAAO,CAACC,GAAG,CAAC;IACjC,OAAOO,SAAUC,QAAQ,CAAC,gBAAgBf,wBAAwBgB,IAAI,CAACF;AACzE;AAEA,OAAO,MAAMG,oBAAoB,CAACb;IAChC,IAAI;QACF,OAAOD,QAAQC,QAAQM,oBAAoBN,QAAQS,yBAAyBT;IAC9E,EAAE,OAAOc,QAAQ;QACf,OAAO;IACT;AACF,EAAC"}
+{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/isEligibleRequest.ts"],"sourcesContent":["const ACCEPTABLE_CONTENT_TYPE =\n  /multipart\\/[\\w'\"()+,./:<=>?@[\\\\\\]^-]+(?:; ?[\\w'\"()+,./:<=>?@[\\\\\\]^-]*)+$/i\nconst UNACCEPTABLE_METHODS = new Set(['CONNECT', 'DELETE', 'GET', 'HEAD', 'OPTIONS', 'TRACE'])\n\nconst hasBody = (req: Request): boolean => {\n  const contentLength = req.headers.get('content-length')\n\n  return Boolean(\n    req.body || req.headers.get('transfer-encoding') || (contentLength && contentLength !== '0'),\n  )\n}\n\nconst hasAcceptableMethod = (req: Request): boolean => !UNACCEPTABLE_METHODS.has(req.method)\n\nconst hasAcceptableContentType = (req: Request): boolean => {\n  const contType = req.headers.get('content-type')\n  return contType!.includes('boundary=') && ACCEPTABLE_CONTENT_TYPE.test(contType!)\n}\n\nexport const isEligibleRequest = (req: Request): boolean => {\n  try {\n    return hasBody(req) && hasAcceptableMethod(req) && hasAcceptableContentType(req)\n  } catch (ignore) {\n    return false\n  }\n}\n"],"names":["ACCEPTABLE_CONTENT_TYPE","UNACCEPTABLE_METHODS","Set","hasBody","req","contentLength","headers","get","Boolean","body","hasAcceptableMethod","has","method","hasAcceptableContentType","contType","includes","test","isEligibleRequest","ignore"],"mappings":"AAAA,MAAMA,0BACJ;AACF,MAAMC,uBAAuB,IAAIC,IAAI;IAAC;IAAW;IAAU;IAAO;IAAQ;IAAW;CAAQ;AAE7F,MAAMC,UAAU,CAACC;IACf,MAAMC,gBAAgBD,IAAIE,OAAO,CAACC,GAAG,CAAC;IAEtC,OAAOC,QACLJ,IAAIK,IAAI,IAAIL,IAAIE,OAAO,CAACC,GAAG,CAAC,wBAAyBF,iBAAiBA,kBAAkB;AAE5F;AAEA,MAAMK,sBAAsB,CAACN,MAA0B,CAACH,qBAAqBU,GAAG,CAACP,IAAIQ,MAAM;AAE3F,MAAMC,2BAA2B,CAACT;IAChC,MAAMU,WAAWV,IAAIE,OAAO,CAACC,GAAG,CAAC;IACjC,OAAOO,SAAUC,QAAQ,CAAC,gBAAgBf,wBAAwBgB,IAAI,CAACF;AACzE;AAEA,OAAO,MAAMG,oBAAoB,CAACb;IAChC,IAAI;QACF,OAAOD,QAAQC,QAAQM,oBAAoBN,QAAQS,yBAAyBT;IAC9E,EAAE,OAAOc,QAAQ;QACf,OAAO;IACT;AACF,EAAC"}