payload 4.0.0-internal.ccea85d → 4.0.0-internal.cd47d20

package/dist/auth/getAuthFields.js

@@ -1,14 +1,14 @@
 import { accountLockFields } from './baseFields/accountLock.js';
-import { createAPIKeyFields } from './baseFields/apiKey.js';
-import { baseAuthFields } from './baseFields/auth.js';
+import { getAPIKeyFields } from './baseFields/apiKey.js';
+import { baseAuthFields, resetPasswordRequestedAtField } from './baseFields/auth.js';
 import { emailFieldConfig } from './baseFields/email.js';
 import { sessionsFieldConfig } from './baseFields/sessions.js';
 import { usernameFieldConfig } from './baseFields/username.js';
 import { verificationFields } from './baseFields/verification.js';
-export const getBaseAuthFields = (authConfig)=>{
+export const getBaseAuthFields = (authConfig, fields = [])=>{
     const authFields = [];
     if (authConfig.useAPIKey) {
-        authFields.push(...createAPIKeyFields());
+        authFields.push(...getAPIKeyFields(fields));
     }
     if (!authConfig.disableLocalStrategy || typeof authConfig.disableLocalStrategy === 'object' && authConfig.disableLocalStrategy.enableFields) {
         const emailField = {
@@ -36,6 +36,9 @@ export const getBaseAuthFields = (authConfig)=>{
             authFields.push(usernameField);
         }
         authFields.push(...baseAuthFields);
+        if (authConfig.forgotPassword?.minRequestInterval && authConfig.forgotPassword.minRequestInterval > 0) {
+            authFields.push(resetPasswordRequestedAtField);
+        }
         if (authConfig.verify) {
             authFields.push(...verificationFields);
         }

package/dist/auth/getAuthFields.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getAuthFields.ts"],"sourcesContent":["import type { Field, TextField } from '../fields/config/types.js'\nimport type { IncomingAuthType } from './types.js'\n\nimport { accountLockFields } from './baseFields/accountLock.js'\nimport { createAPIKeyFields } from './baseFields/apiKey.js'\nimport { baseAuthFields } from './baseFields/auth.js'\nimport { emailFieldConfig } from './baseFields/email.js'\nimport { sessionsFieldConfig } from './baseFields/sessions.js'\nimport { usernameFieldConfig } from './baseFields/username.js'\nimport { verificationFields } from './baseFields/verification.js'\n\nexport const getBaseAuthFields = (authConfig: IncomingAuthType): Field[] => {\n  const authFields: Field[] = []\n\n  if (authConfig.useAPIKey) {\n    authFields.push(...createAPIKeyFields())\n  }\n\n  if (\n    !authConfig.disableLocalStrategy ||\n    (typeof authConfig.disableLocalStrategy === 'object' &&\n      authConfig.disableLocalStrategy.enableFields)\n  ) {\n    const emailField = { ...emailFieldConfig }\n    let usernameField: TextField | undefined\n\n    if (authConfig.loginWithUsername) {\n      usernameField = { ...usernameFieldConfig }\n      if (typeof authConfig.loginWithUsername === 'object') {\n        if (authConfig.loginWithUsername.requireEmail === false) {\n          emailField.required = false\n        }\n        if (authConfig.loginWithUsername.requireUsername === false) {\n          usernameField.required = false\n        }\n        if (authConfig.loginWithUsername.allowEmailLogin === false) {\n          emailField.unique = false\n        }\n      }\n    }\n\n    authFields.push(emailField)\n    if (usernameField) {\n      authFields.push(usernameField)\n    }\n\n    authFields.push(...baseAuthFields)\n\n    if (authConfig.verify) {\n      authFields.push(...verificationFields)\n    }\n\n    if (authConfig?.maxLoginAttempts && authConfig.maxLoginAttempts > 0) {\n      authFields.push(...accountLockFields)\n    }\n\n    if (authConfig.useSessions) {\n      authFields.push(sessionsFieldConfig)\n    }\n  }\n\n  return authFields\n}\n"],"names":["accountLockFields","createAPIKeyFields","baseAuthFields","emailFieldConfig","sessionsFieldConfig","usernameFieldConfig","verificationFields","getBaseAuthFields","authConfig","authFields","useAPIKey","push","disableLocalStrategy","enableFields","emailField","usernameField","loginWithUsername","requireEmail","required","requireUsername","allowEmailLogin","unique","verify","maxLoginAttempts","useSessions"],"mappings":"AAGA,SAASA,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,kBAAkB,QAAQ,yBAAwB;AAC3D,SAASC,cAAc,QAAQ,uBAAsB;AACrD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,+BAA8B;AAEjE,OAAO,MAAMC,oBAAoB,CAACC;IAChC,MAAMC,aAAsB,EAAE;IAE9B,IAAID,WAAWE,SAAS,EAAE;QACxBD,WAAWE,IAAI,IAAIV;IACrB;IAEA,IACE,CAACO,WAAWI,oBAAoB,IAC/B,OAAOJ,WAAWI,oBAAoB,KAAK,YAC1CJ,WAAWI,oBAAoB,CAACC,YAAY,EAC9C;QACA,MAAMC,aAAa;YAAE,GAAGX,gBAAgB;QAAC;QACzC,IAAIY;QAEJ,IAAIP,WAAWQ,iBAAiB,EAAE;YAChCD,gBAAgB;gBAAE,GAAGV,mBAAmB;YAAC;YACzC,IAAI,OAAOG,WAAWQ,iBAAiB,KAAK,UAAU;gBACpD,IAAIR,WAAWQ,iBAAiB,CAACC,YAAY,KAAK,OAAO;oBACvDH,WAAWI,QAAQ,GAAG;gBACxB;gBACA,IAAIV,WAAWQ,iBAAiB,CAACG,eAAe,KAAK,OAAO;oBAC1DJ,cAAcG,QAAQ,GAAG;gBAC3B;gBACA,IAAIV,WAAWQ,iBAAiB,CAACI,eAAe,KAAK,OAAO;oBAC1DN,WAAWO,MAAM,GAAG;gBACtB;YACF;QACF;QAEAZ,WAAWE,IAAI,CAACG;QAChB,IAAIC,eAAe;YACjBN,WAAWE,IAAI,CAACI;QAClB;QAEAN,WAAWE,IAAI,IAAIT;QAEnB,IAAIM,WAAWc,MAAM,EAAE;YACrBb,WAAWE,IAAI,IAAIL;QACrB;QAEA,IAAIE,YAAYe,oBAAoBf,WAAWe,gBAAgB,GAAG,GAAG;YACnEd,WAAWE,IAAI,IAAIX;QACrB;QAEA,IAAIQ,WAAWgB,WAAW,EAAE;YAC1Bf,WAAWE,IAAI,CAACP;QAClB;IACF;IAEA,OAAOK;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/getAuthFields.ts"],"sourcesContent":["import type { Field, TextField } from '../fields/config/types.js'\nimport type { IncomingAuthType } from './types.js'\n\nimport { accountLockFields } from './baseFields/accountLock.js'\nimport { getAPIKeyFields } from './baseFields/apiKey.js'\nimport { baseAuthFields, resetPasswordRequestedAtField } from './baseFields/auth.js'\nimport { emailFieldConfig } from './baseFields/email.js'\nimport { sessionsFieldConfig } from './baseFields/sessions.js'\nimport { usernameFieldConfig } from './baseFields/username.js'\nimport { verificationFields } from './baseFields/verification.js'\n\nexport const getBaseAuthFields = (authConfig: IncomingAuthType, fields: Field[] = []): Field[] => {\n  const authFields: Field[] = []\n\n  if (authConfig.useAPIKey) {\n    authFields.push(...getAPIKeyFields(fields))\n  }\n\n  if (\n    !authConfig.disableLocalStrategy ||\n    (typeof authConfig.disableLocalStrategy === 'object' &&\n      authConfig.disableLocalStrategy.enableFields)\n  ) {\n    const emailField = { ...emailFieldConfig }\n    let usernameField: TextField | undefined\n\n    if (authConfig.loginWithUsername) {\n      usernameField = { ...usernameFieldConfig }\n      if (typeof authConfig.loginWithUsername === 'object') {\n        if (authConfig.loginWithUsername.requireEmail === false) {\n          emailField.required = false\n        }\n        if (authConfig.loginWithUsername.requireUsername === false) {\n          usernameField.required = false\n        }\n        if (authConfig.loginWithUsername.allowEmailLogin === false) {\n          emailField.unique = false\n        }\n      }\n    }\n\n    authFields.push(emailField)\n    if (usernameField) {\n      authFields.push(usernameField)\n    }\n\n    authFields.push(...baseAuthFields)\n\n    if (\n      authConfig.forgotPassword?.minRequestInterval &&\n      authConfig.forgotPassword.minRequestInterval > 0\n    ) {\n      authFields.push(resetPasswordRequestedAtField)\n    }\n\n    if (authConfig.verify) {\n      authFields.push(...verificationFields)\n    }\n\n    if (authConfig?.maxLoginAttempts && authConfig.maxLoginAttempts > 0) {\n      authFields.push(...accountLockFields)\n    }\n\n    if (authConfig.useSessions) {\n      authFields.push(sessionsFieldConfig)\n    }\n  }\n\n  return authFields\n}\n"],"names":["accountLockFields","getAPIKeyFields","baseAuthFields","resetPasswordRequestedAtField","emailFieldConfig","sessionsFieldConfig","usernameFieldConfig","verificationFields","getBaseAuthFields","authConfig","fields","authFields","useAPIKey","push","disableLocalStrategy","enableFields","emailField","usernameField","loginWithUsername","requireEmail","required","requireUsername","allowEmailLogin","unique","forgotPassword","minRequestInterval","verify","maxLoginAttempts","useSessions"],"mappings":"AAGA,SAASA,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,cAAc,EAAEC,6BAA6B,QAAQ,uBAAsB;AACpF,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,+BAA8B;AAEjE,OAAO,MAAMC,oBAAoB,CAACC,YAA8BC,SAAkB,EAAE;IAClF,MAAMC,aAAsB,EAAE;IAE9B,IAAIF,WAAWG,SAAS,EAAE;QACxBD,WAAWE,IAAI,IAAIZ,gBAAgBS;IACrC;IAEA,IACE,CAACD,WAAWK,oBAAoB,IAC/B,OAAOL,WAAWK,oBAAoB,KAAK,YAC1CL,WAAWK,oBAAoB,CAACC,YAAY,EAC9C;QACA,MAAMC,aAAa;YAAE,GAAGZ,gBAAgB;QAAC;QACzC,IAAIa;QAEJ,IAAIR,WAAWS,iBAAiB,EAAE;YAChCD,gBAAgB;gBAAE,GAAGX,mBAAmB;YAAC;YACzC,IAAI,OAAOG,WAAWS,iBAAiB,KAAK,UAAU;gBACpD,IAAIT,WAAWS,iBAAiB,CAACC,YAAY,KAAK,OAAO;oBACvDH,WAAWI,QAAQ,GAAG;gBACxB;gBACA,IAAIX,WAAWS,iBAAiB,CAACG,eAAe,KAAK,OAAO;oBAC1DJ,cAAcG,QAAQ,GAAG;gBAC3B;gBACA,IAAIX,WAAWS,iBAAiB,CAACI,eAAe,KAAK,OAAO;oBAC1DN,WAAWO,MAAM,GAAG;gBACtB;YACF;QACF;QAEAZ,WAAWE,IAAI,CAACG;QAChB,IAAIC,eAAe;YACjBN,WAAWE,IAAI,CAACI;QAClB;QAEAN,WAAWE,IAAI,IAAIX;QAEnB,IACEO,WAAWe,cAAc,EAAEC,sBAC3BhB,WAAWe,cAAc,CAACC,kBAAkB,GAAG,GAC/C;YACAd,WAAWE,IAAI,CAACV;QAClB;QAEA,IAAIM,WAAWiB,MAAM,EAAE;YACrBf,WAAWE,IAAI,IAAIN;QACrB;QAEA,IAAIE,YAAYkB,oBAAoBlB,WAAWkB,gBAAgB,GAAG,GAAG;YACnEhB,WAAWE,IAAI,IAAIb;QACrB;QAEA,IAAIS,WAAWmB,WAAW,EAAE;YAC1BjB,WAAWE,IAAI,CAACR;QAClB;IACF;IAEA,OAAOM;AACT,EAAC"}

package/dist/auth/getFieldsToSign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAiHvD,eAAO,MAAM,eAAe,SAAU;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoBzB,CAAA"}
+{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAmHvD,eAAO,MAAM,eAAe,SAAU;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAwBzB,CAAA"}

package/dist/auth/getFieldsToSign.js

@@ -1,4 +1,12 @@
 import { fieldAffectsData, tabHasName } from '../fields/config/types.js';
+const reservedJWTFields = new Set([
+    'collection',
+    'email',
+    'exp',
+    'iat',
+    'id',
+    'sid'
+]);
 const traverseFields = ({ data, // parent,
 fields, result })=>{
     fields.forEach((field)=>{
@@ -99,20 +107,22 @@ fields, result })=>{
 };
 export const getFieldsToSign = (args)=>{
     const { collectionConfig, email, sid, user } = args;
-    const result = {
-        id: user?.id,
-        collection: collectionConfig.slug,
-        email
-    };
-    if (sid) {
-        result.sid = sid;
-    }
+    const fieldsToSign = Object.create(null);
     traverseFields({
         data: user,
         fields: collectionConfig.fields,
-        result
+        result: fieldsToSign
     });
-    return result;
+    for (const fieldName of reservedJWTFields){
+        delete fieldsToSign[fieldName];
+    }
+    fieldsToSign.id = user?.id;
+    fieldsToSign.collection = collectionConfig.slug;
+    fieldsToSign.email = email;
+    if (sid) {
+        fieldsToSign.sid = sid;
+    }
+    return fieldsToSign;
 };
 
 //# sourceMappingURL=getFieldsToSign.js.map

package/dist/auth/getFieldsToSign.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getFieldsToSign.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { Field, TabAsField } from '../fields/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldAffectsData, tabHasName } from '../fields/config/types.js'\n\ntype TraverseFieldsArgs = {\n  data: Record<string, unknown>\n  fields: (Field | TabAsField)[]\n  result: Record<string, unknown>\n}\nconst traverseFields = ({\n  data,\n  // parent,\n  fields,\n  result,\n}: TraverseFieldsArgs) => {\n  fields.forEach((field) => {\n    switch (field.type) {\n      case 'collapsible':\n      case 'row': {\n        traverseFields({\n          data,\n          fields: field.fields,\n          result,\n        })\n        break\n      }\n      case 'group': {\n        if (fieldAffectsData(field)) {\n          const groupData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = groupData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = groupData\n          }\n          const groupResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: groupData,\n            fields: field.fields,\n            result: groupResult,\n          })\n          break\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n\n          break\n        }\n      }\n      case 'tab': {\n        if (tabHasName(field)) {\n          const tabData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = tabData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = tabData\n          }\n          const tabResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: tabData,\n            fields: field.fields,\n            result: tabResult,\n          })\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n        }\n        break\n      }\n      case 'tabs': {\n        traverseFields({\n          data,\n          fields: field.tabs.map((tab) => ({ ...tab, type: 'tab' })),\n          result,\n        })\n        break\n      }\n      default:\n        if (fieldAffectsData(field)) {\n          if (field.saveToJWT) {\n            if (typeof field.saveToJWT === 'string') {\n              result[field.saveToJWT] = data[field.name]\n              delete result[field.name]\n            } else {\n              result[field.name] = data[field.name] as Record<string, unknown>\n            }\n          } else if (field.saveToJWT === false) {\n            delete result[field.name]\n          }\n        }\n    }\n  })\n  return result\n}\nexport const getFieldsToSign = (args: {\n  collectionConfig: CollectionConfig\n  email: string\n  sid?: string\n  user: PayloadRequest['user']\n}): Record<string, unknown> => {\n  const { collectionConfig, email, sid, user } = args\n\n  const result: Record<string, unknown> = {\n    id: user?.id,\n    collection: collectionConfig.slug,\n    email,\n  }\n\n  if (sid) {\n    result.sid = sid\n  }\n\n  traverseFields({\n    data: user!,\n    fields: collectionConfig.fields,\n    result,\n  })\n\n  return result\n}\n"],"names":["fieldAffectsData","tabHasName","traverseFields","data","fields","result","forEach","field","type","groupData","name","targetResult","saveToJWT","groupResult","tabData","tabResult","tabs","map","tab","getFieldsToSign","args","collectionConfig","email","sid","user","id","collection","slug"],"mappings":"AAIA,SAASA,gBAAgB,EAAEC,UAAU,QAAQ,4BAA2B;AAOxE,MAAMC,iBAAiB,CAAC,EACtBC,IAAI,EACJ,UAAU;AACVC,MAAM,EACNC,MAAM,EACa;IACnBD,OAAOE,OAAO,CAAC,CAACC;QACd,OAAQA,MAAMC,IAAI;YAChB,KAAK;YACL,KAAK;gBAAO;oBACVN,eAAe;wBACbC;wBACAC,QAAQG,MAAMH,MAAM;wBACpBC;oBACF;oBACA;gBACF;YACA,KAAK;gBAAS;oBACZ,IAAIL,iBAAiBO,QAAQ;wBAC3B,MAAME,YACJ,AAACN,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGH;wBAC5B,OAAO,IAAIF,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGD;wBACvB;wBACA,MAAMI,cAAeF,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAI3DH,eAAe;4BACbC,MAAMM;4BACNL,QAAQG,MAAMH,MAAM;4BACpBC,QAAQQ;wBACV;wBACA;oBACF,OAAO;wBACLX,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;wBAEA;oBACF;gBACF;YACA,KAAK;gBAAO;oBACV,IAAIJ,WAAWM,QAAQ;wBACrB,MAAMO,UACJ,AAACX,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGE;wBAC5B,OAAO,IAAIP,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGI;wBACvB;wBACA,MAAMC,YAAaJ,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAIzDH,eAAe;4BACbC,MAAMW;4BACNV,QAAQG,MAAMH,MAAM;4BACpBC,QAAQU;wBACV;oBACF,OAAO;wBACLb,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;oBACF;oBACA;gBACF;YACA,KAAK;gBAAQ;oBACXH,eAAe;wBACbC;wBACAC,QAAQG,MAAMS,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gCAAE,GAAGA,GAAG;gCAAEV,MAAM;4BAAM,CAAA;wBACvDH;oBACF;oBACA;gBACF;YACA;gBACE,IAAIL,iBAAiBO,QAAQ;oBAC3B,IAAIA,MAAMK,SAAS,EAAE;wBACnB,IAAI,OAAOL,MAAMK,SAAS,KAAK,UAAU;4BACvCP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGT,IAAI,CAACI,MAAMG,IAAI,CAAC;4BAC1C,OAAOL,MAAM,CAACE,MAAMG,IAAI,CAAC;wBAC3B,OAAO;4BACLL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGP,IAAI,CAACI,MAAMG,IAAI,CAAC;wBACvC;oBACF,OAAO,IAAIH,MAAMK,SAAS,KAAK,OAAO;wBACpC,OAAOP,MAAM,CAACE,MAAMG,IAAI,CAAC;oBAC3B;gBACF;QACJ;IACF;IACA,OAAOL;AACT;AACA,OAAO,MAAMc,kBAAkB,CAACC;IAM9B,MAAM,EAAEC,gBAAgB,EAAEC,KAAK,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGJ;IAE/C,MAAMf,SAAkC;QACtCoB,IAAID,MAAMC;QACVC,YAAYL,iBAAiBM,IAAI;QACjCL;IACF;IAEA,IAAIC,KAAK;QACPlB,OAAOkB,GAAG,GAAGA;IACf;IAEArB,eAAe;QACbC,MAAMqB;QACNpB,QAAQiB,iBAAiBjB,MAAM;QAC/BC;IACF;IAEA,OAAOA;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/getFieldsToSign.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { Field, TabAsField } from '../fields/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldAffectsData, tabHasName } from '../fields/config/types.js'\n\nconst reservedJWTFields = new Set(['collection', 'email', 'exp', 'iat', 'id', 'sid'])\n\ntype TraverseFieldsArgs = {\n  data: Record<string, unknown>\n  fields: (Field | TabAsField)[]\n  result: Record<string, unknown>\n}\nconst traverseFields = ({\n  data,\n  // parent,\n  fields,\n  result,\n}: TraverseFieldsArgs) => {\n  fields.forEach((field) => {\n    switch (field.type) {\n      case 'collapsible':\n      case 'row': {\n        traverseFields({\n          data,\n          fields: field.fields,\n          result,\n        })\n        break\n      }\n      case 'group': {\n        if (fieldAffectsData(field)) {\n          const groupData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = groupData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = groupData\n          }\n          const groupResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: groupData,\n            fields: field.fields,\n            result: groupResult,\n          })\n          break\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n\n          break\n        }\n      }\n      case 'tab': {\n        if (tabHasName(field)) {\n          const tabData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = tabData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = tabData\n          }\n          const tabResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: tabData,\n            fields: field.fields,\n            result: tabResult,\n          })\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n        }\n        break\n      }\n      case 'tabs': {\n        traverseFields({\n          data,\n          fields: field.tabs.map((tab) => ({ ...tab, type: 'tab' })),\n          result,\n        })\n        break\n      }\n      default:\n        if (fieldAffectsData(field)) {\n          if (field.saveToJWT) {\n            if (typeof field.saveToJWT === 'string') {\n              result[field.saveToJWT] = data[field.name]\n              delete result[field.name]\n            } else {\n              result[field.name] = data[field.name] as Record<string, unknown>\n            }\n          } else if (field.saveToJWT === false) {\n            delete result[field.name]\n          }\n        }\n    }\n  })\n  return result\n}\nexport const getFieldsToSign = (args: {\n  collectionConfig: CollectionConfig\n  email: string\n  sid?: string\n  user: PayloadRequest['user']\n}): Record<string, unknown> => {\n  const { collectionConfig, email, sid, user } = args\n\n  const fieldsToSign = Object.create(null) as Record<string, unknown>\n\n  traverseFields({\n    data: user!,\n    fields: collectionConfig.fields,\n    result: fieldsToSign,\n  })\n\n  for (const fieldName of reservedJWTFields) {\n    delete fieldsToSign[fieldName]\n  }\n\n  fieldsToSign.id = user?.id\n  fieldsToSign.collection = collectionConfig.slug\n  fieldsToSign.email = email\n\n  if (sid) {\n    fieldsToSign.sid = sid\n  }\n\n  return fieldsToSign\n}\n"],"names":["fieldAffectsData","tabHasName","reservedJWTFields","Set","traverseFields","data","fields","result","forEach","field","type","groupData","name","targetResult","saveToJWT","groupResult","tabData","tabResult","tabs","map","tab","getFieldsToSign","args","collectionConfig","email","sid","user","fieldsToSign","Object","create","fieldName","id","collection","slug"],"mappings":"AAIA,SAASA,gBAAgB,EAAEC,UAAU,QAAQ,4BAA2B;AAExE,MAAMC,oBAAoB,IAAIC,IAAI;IAAC;IAAc;IAAS;IAAO;IAAO;IAAM;CAAM;AAOpF,MAAMC,iBAAiB,CAAC,EACtBC,IAAI,EACJ,UAAU;AACVC,MAAM,EACNC,MAAM,EACa;IACnBD,OAAOE,OAAO,CAAC,CAACC;QACd,OAAQA,MAAMC,IAAI;YAChB,KAAK;YACL,KAAK;gBAAO;oBACVN,eAAe;wBACbC;wBACAC,QAAQG,MAAMH,MAAM;wBACpBC;oBACF;oBACA;gBACF;YACA,KAAK;gBAAS;oBACZ,IAAIP,iBAAiBS,QAAQ;wBAC3B,MAAME,YACJ,AAACN,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGH;wBAC5B,OAAO,IAAIF,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGD;wBACvB;wBACA,MAAMI,cAAeF,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAI3DH,eAAe;4BACbC,MAAMM;4BACNL,QAAQG,MAAMH,MAAM;4BACpBC,QAAQQ;wBACV;wBACA;oBACF,OAAO;wBACLX,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;wBAEA;oBACF;gBACF;YACA,KAAK;gBAAO;oBACV,IAAIN,WAAWQ,QAAQ;wBACrB,MAAMO,UACJ,AAACX,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGE;wBAC5B,OAAO,IAAIP,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGI;wBACvB;wBACA,MAAMC,YAAaJ,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAIzDH,eAAe;4BACbC,MAAMW;4BACNV,QAAQG,MAAMH,MAAM;4BACpBC,QAAQU;wBACV;oBACF,OAAO;wBACLb,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;oBACF;oBACA;gBACF;YACA,KAAK;gBAAQ;oBACXH,eAAe;wBACbC;wBACAC,QAAQG,MAAMS,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gCAAE,GAAGA,GAAG;gCAAEV,MAAM;4BAAM,CAAA;wBACvDH;oBACF;oBACA;gBACF;YACA;gBACE,IAAIP,iBAAiBS,QAAQ;oBAC3B,IAAIA,MAAMK,SAAS,EAAE;wBACnB,IAAI,OAAOL,MAAMK,SAAS,KAAK,UAAU;4BACvCP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGT,IAAI,CAACI,MAAMG,IAAI,CAAC;4BAC1C,OAAOL,MAAM,CAACE,MAAMG,IAAI,CAAC;wBAC3B,OAAO;4BACLL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGP,IAAI,CAACI,MAAMG,IAAI,CAAC;wBACvC;oBACF,OAAO,IAAIH,MAAMK,SAAS,KAAK,OAAO;wBACpC,OAAOP,MAAM,CAACE,MAAMG,IAAI,CAAC;oBAC3B;gBACF;QACJ;IACF;IACA,OAAOL;AACT;AACA,OAAO,MAAMc,kBAAkB,CAACC;IAM9B,MAAM,EAAEC,gBAAgB,EAAEC,KAAK,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGJ;IAE/C,MAAMK,eAAeC,OAAOC,MAAM,CAAC;IAEnCzB,eAAe;QACbC,MAAMqB;QACNpB,QAAQiB,iBAAiBjB,MAAM;QAC/BC,QAAQoB;IACV;IAEA,KAAK,MAAMG,aAAa5B,kBAAmB;QACzC,OAAOyB,YAAY,CAACG,UAAU;IAChC;IAEAH,aAAaI,EAAE,GAAGL,MAAMK;IACxBJ,aAAaK,UAAU,GAAGT,iBAAiBU,IAAI;IAC/CN,aAAaH,KAAK,GAAGA;IAErB,IAAIC,KAAK;QACPE,aAAaF,GAAG,GAAGA;IACrB;IAEA,OAAOE;AACT,EAAC"}

package/dist/auth/getLoginOptions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getLoginOptions.ts"],"sourcesContent":["import type { Auth } from './types.js'\n\nexport const getLoginOptions = (\n  loginWithUsername: Auth['loginWithUsername'],\n): {\n  canLoginWithEmail: boolean\n  canLoginWithUsername: boolean\n} => {\n  return {\n    canLoginWithEmail: !loginWithUsername || loginWithUsername.allowEmailLogin!,\n    canLoginWithUsername: Boolean(loginWithUsername),\n  }\n}\n"],"names":["getLoginOptions","loginWithUsername","canLoginWithEmail","allowEmailLogin","canLoginWithUsername","Boolean"],"mappings":"AAEA,OAAO,MAAMA,kBAAkB,CAC7BC;IAKA,OAAO;QACLC,mBAAmB,CAACD,qBAAqBA,kBAAkBE,eAAe;QAC1EC,sBAAsBC,QAAQJ;IAChC;AACF,EAAC"}
+{"version":3,"sources":["../../src/auth/getLoginOptions.ts"],"sourcesContent":["import type { Auth } from './types.js'\n\nexport const getLoginOptions = (\n  loginWithUsername: Auth['loginWithUsername'],\n): {\n  canLoginWithEmail: boolean\n  canLoginWithUsername: boolean\n} => {\n  return {\n    canLoginWithEmail: !loginWithUsername || loginWithUsername.allowEmailLogin,\n    canLoginWithUsername: Boolean(loginWithUsername),\n  }\n}\n"],"names":["getLoginOptions","loginWithUsername","canLoginWithEmail","allowEmailLogin","canLoginWithUsername","Boolean"],"mappings":"AAEA,OAAO,MAAMA,kBAAkB,CAC7BC;IAKA,OAAO;QACLC,mBAAmB,CAACD,qBAAqBA,kBAAkBE,eAAe;QAC1EC,sBAAsBC,QAAQJ;IAChC;AACF,EAAC"}

package/dist/auth/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,+CAIjB;IACD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;;;EAUA,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,OAAO,+CAIjB;IACD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;;;EAUA,CAAA"}

package/dist/auth/jwt.js

@@ -1,10 +1,12 @@
 import { SignJWT } from 'jose';
+import { JWT_AUTH_VERSION } from './jwtAuth.js';
 export const jwtSign = async ({ fieldsToSign, secret, tokenExpiration })=>{
     const secretKey = new TextEncoder().encode(secret);
     const issuedAt = Math.floor(Date.now() / 1000);
     const exp = issuedAt + tokenExpiration;
     const token = await new SignJWT(fieldsToSign).setProtectedHeader({
         alg: 'HS256',
+        authVersion: JWT_AUTH_VERSION,
         typ: 'JWT'
     }).setIssuedAt(issuedAt).setExpirationTime(exp).sign(secretKey);
     return {

package/dist/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/jwt.ts"],"sourcesContent":["import { SignJWT } from 'jose'\n\nexport const jwtSign = async ({\n  fieldsToSign,\n  secret,\n  tokenExpiration,\n}: {\n  fieldsToSign: Record<string, unknown>\n  secret: string\n  tokenExpiration: number\n}) => {\n  const secretKey = new TextEncoder().encode(secret)\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const exp = issuedAt + tokenExpiration\n  const token = await new SignJWT(fieldsToSign)\n    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })\n    .setIssuedAt(issuedAt)\n    .setExpirationTime(exp)\n    .sign(secretKey)\n  return { exp, token }\n}\n"],"names":["SignJWT","jwtSign","fieldsToSign","secret","tokenExpiration","secretKey","TextEncoder","encode","issuedAt","Math","floor","Date","now","exp","token","setProtectedHeader","alg","typ","setIssuedAt","setExpirationTime","sign"],"mappings":"AAAA,SAASA,OAAO,QAAQ,OAAM;AAE9B,OAAO,MAAMC,UAAU,OAAO,EAC5BC,YAAY,EACZC,MAAM,EACNC,eAAe,EAKhB;IACC,MAAMC,YAAY,IAAIC,cAAcC,MAAM,CAACJ;IAC3C,MAAMK,WAAWC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;IACzC,MAAMC,MAAML,WAAWJ;IACvB,MAAMU,QAAQ,MAAM,IAAId,QAAQE,cAC7Ba,kBAAkB,CAAC;QAAEC,KAAK;QAASC,KAAK;IAAM,GAC9CC,WAAW,CAACV,UACZW,iBAAiB,CAACN,KAClBO,IAAI,CAACf;IACR,OAAO;QAAEQ;QAAKC;IAAM;AACtB,EAAC"}
+{"version":3,"sources":["../../src/auth/jwt.ts"],"sourcesContent":["import { SignJWT } from 'jose'\n\nimport { JWT_AUTH_VERSION } from './jwtAuth.js'\n\nexport const jwtSign = async ({\n  fieldsToSign,\n  secret,\n  tokenExpiration,\n}: {\n  fieldsToSign: Record<string, unknown>\n  secret: string\n  tokenExpiration: number\n}) => {\n  const secretKey = new TextEncoder().encode(secret)\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const exp = issuedAt + tokenExpiration\n  const token = await new SignJWT(fieldsToSign)\n    .setProtectedHeader({ alg: 'HS256', authVersion: JWT_AUTH_VERSION, typ: 'JWT' })\n    .setIssuedAt(issuedAt)\n    .setExpirationTime(exp)\n    .sign(secretKey)\n  return { exp, token }\n}\n"],"names":["SignJWT","JWT_AUTH_VERSION","jwtSign","fieldsToSign","secret","tokenExpiration","secretKey","TextEncoder","encode","issuedAt","Math","floor","Date","now","exp","token","setProtectedHeader","alg","authVersion","typ","setIssuedAt","setExpirationTime","sign"],"mappings":"AAAA,SAASA,OAAO,QAAQ,OAAM;AAE9B,SAASC,gBAAgB,QAAQ,eAAc;AAE/C,OAAO,MAAMC,UAAU,OAAO,EAC5BC,YAAY,EACZC,MAAM,EACNC,eAAe,EAKhB;IACC,MAAMC,YAAY,IAAIC,cAAcC,MAAM,CAACJ;IAC3C,MAAMK,WAAWC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;IACzC,MAAMC,MAAML,WAAWJ;IACvB,MAAMU,QAAQ,MAAM,IAAIf,QAAQG,cAC7Ba,kBAAkB,CAAC;QAAEC,KAAK;QAASC,aAAajB;QAAkBkB,KAAK;IAAM,GAC7EC,WAAW,CAACX,UACZY,iBAAiB,CAACP,KAClBQ,IAAI,CAAChB;IACR,OAAO;QAAEQ;QAAKC;IAAM;AACtB,EAAC"}

package/dist/auth/jwtAuth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Version of Payload's JWT authentication format, stored in the signed protected header.
+ *
+ * The signer, verifier, and external validators must agree on this value. A mismatch
+ * rejects every token in the system, so they should import it rather than repeat the literal.
+ */
+export declare const JWT_AUTH_VERSION = 1;
+export type JWTAuthVersion = typeof JWT_AUTH_VERSION;
+//# sourceMappingURL=jwtAuth.d.ts.map

package/dist/auth/jwtAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtAuth.d.ts","sourceRoot":"","sources":["../../src/auth/jwtAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAEjC,MAAM,MAAM,cAAc,GAAG,OAAO,gBAAgB,CAAA"}

package/dist/auth/jwtAuth.js

@@ -0,0 +1,8 @@
+/**
+ * Version of Payload's JWT authentication format, stored in the signed protected header.
+ *
+ * The signer, verifier, and external validators must agree on this value. A mismatch
+ * rejects every token in the system, so they should import it rather than repeat the literal.
+ */ export const JWT_AUTH_VERSION = 1;
+
+//# sourceMappingURL=jwtAuth.js.map

package/dist/auth/jwtAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/jwtAuth.ts"],"sourcesContent":["/**\n * Version of Payload's JWT authentication format, stored in the signed protected header.\n *\n * The signer, verifier, and external validators must agree on this value. A mismatch\n * rejects every token in the system, so they should import it rather than repeat the literal.\n */\nexport const JWT_AUTH_VERSION = 1\n\nexport type JWTAuthVersion = typeof JWT_AUTH_VERSION\n"],"names":["JWT_AUTH_VERSION"],"mappings":"AAAA;;;;;CAKC,GACD,OAAO,MAAMA,mBAAmB,EAAC"}

package/dist/auth/loginWithCookie.d.ts

@@ -0,0 +1,33 @@
+import type { Collection } from '../collections/config/types.js';
+import type { AuthCollectionSlug } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+import type { generateCookie } from './cookies.js';
+import type { LoginResult } from './operations/login.js';
+import { loginOperation } from './operations/login.js';
+type CookieObject = Extract<ReturnType<typeof generateCookie<true>>, {
+    name: string;
+}>;
+type LoginWithCookieArgs<TReturnCookieAsObject extends boolean> = {
+    collection: Collection;
+    data: Parameters<typeof loginOperation>[0]['data'];
+    depth?: number;
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+    /** Return the cookie as parts rather than a serialized header string. */
+    returnCookieAsObject?: TReturnCookieAsObject;
+};
+/**
+ * Runs the login operation and builds the auth cookie from its token, then
+ * applies `auth.removeTokenFromResponses` to the returned result.
+ *
+ * The order matters: the token has to be read before the flag strips it, or the
+ * caller ends up returning a user with no way to establish a session. Shared by
+ * the REST login handler and the framework adapters' `login` server function so
+ * that ordering only exists in one place.
+ */
+export declare const loginWithCookie: <TSlug extends AuthCollectionSlug, TReturnCookieAsObject extends boolean = false>({ collection, data, depth, overrideAccess, req, returnCookieAsObject, }: LoginWithCookieArgs<TReturnCookieAsObject>) => Promise<{
+    cookie: TReturnCookieAsObject extends true ? CookieObject : string;
+    result: LoginResult<TSlug>;
+}>;
+export {};
+//# sourceMappingURL=loginWithCookie.d.ts.map

package/dist/auth/loginWithCookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginWithCookie.d.ts","sourceRoot":"","sources":["../../src/auth/loginWithCookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,KAAK,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAEtF,KAAK,mBAAmB,CAAC,qBAAqB,SAAS,OAAO,IAAI;IAChE,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,qBAAqB,CAAA;CAC7C,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAC1B,KAAK,SAAS,kBAAkB,EAChC,qBAAqB,SAAS,OAAO,GAAG,KAAK,2EAQ5C,mBAAmB,CAAC,qBAAqB,CAAC,KAAG,OAAO,CAAC;IACtD,MAAM,EAAE,qBAAqB,SAAS,IAAI,GAAG,YAAY,GAAG,MAAM,CAAA;IAClE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAA;CAC3B,CAqBA,CAAA"}

package/dist/auth/loginWithCookie.js

@@ -0,0 +1,34 @@
+import { generatePayloadCookie } from './cookies.js';
+import { loginOperation } from './operations/login.js';
+/**
+ * Runs the login operation and builds the auth cookie from its token, then
+ * applies `auth.removeTokenFromResponses` to the returned result.
+ *
+ * The order matters: the token has to be read before the flag strips it, or the
+ * caller ends up returning a user with no way to establish a session. Shared by
+ * the REST login handler and the framework adapters' `login` server function so
+ * that ordering only exists in one place.
+ */ export const loginWithCookie = async ({ collection, data, depth, overrideAccess, req, returnCookieAsObject })=>{
+    const result = await loginOperation({
+        collection,
+        data,
+        depth,
+        overrideAccess,
+        req
+    });
+    const cookie = generatePayloadCookie({
+        collectionAuthConfig: collection.config.auth,
+        cookiePrefix: req.payload.config.cookiePrefix,
+        returnCookieAsObject: returnCookieAsObject ?? false,
+        token: result.token
+    });
+    if (collection.config.auth.removeTokenFromResponses) {
+        delete result.token;
+    }
+    return {
+        cookie,
+        result
+    };
+};
+
+//# sourceMappingURL=loginWithCookie.js.map

package/dist/auth/loginWithCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/loginWithCookie.ts"],"sourcesContent":["import type { Collection } from '../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { generateCookie } from './cookies.js'\nimport type { LoginResult } from './operations/login.js'\n\nimport { generatePayloadCookie } from './cookies.js'\nimport { loginOperation } from './operations/login.js'\n\ntype CookieObject = Extract<ReturnType<typeof generateCookie<true>>, { name: string }>\n\ntype LoginWithCookieArgs<TReturnCookieAsObject extends boolean> = {\n  collection: Collection\n  data: Parameters<typeof loginOperation>[0]['data']\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n  /** Return the cookie as parts rather than a serialized header string. */\n  returnCookieAsObject?: TReturnCookieAsObject\n}\n\n/**\n * Runs the login operation and builds the auth cookie from its token, then\n * applies `auth.removeTokenFromResponses` to the returned result.\n *\n * The order matters: the token has to be read before the flag strips it, or the\n * caller ends up returning a user with no way to establish a session. Shared by\n * the REST login handler and the framework adapters' `login` server function so\n * that ordering only exists in one place.\n */\nexport const loginWithCookie = async <\n  TSlug extends AuthCollectionSlug,\n  TReturnCookieAsObject extends boolean = false,\n>({\n  collection,\n  data,\n  depth,\n  overrideAccess,\n  req,\n  returnCookieAsObject,\n}: LoginWithCookieArgs<TReturnCookieAsObject>): Promise<{\n  cookie: TReturnCookieAsObject extends true ? CookieObject : string\n  result: LoginResult<TSlug>\n}> => {\n  const result = await loginOperation({\n    collection,\n    data,\n    depth,\n    overrideAccess,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    returnCookieAsObject: returnCookieAsObject ?? false,\n    token: result.token!,\n  }) as TReturnCookieAsObject extends true ? CookieObject : string\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return { cookie, result }\n}\n"],"names":["generatePayloadCookie","loginOperation","loginWithCookie","collection","data","depth","overrideAccess","req","returnCookieAsObject","result","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","token","removeTokenFromResponses"],"mappings":"AAMA,SAASA,qBAAqB,QAAQ,eAAc;AACpD,SAASC,cAAc,QAAQ,wBAAuB;AActD;;;;;;;;CAQC,GACD,OAAO,MAAMC,kBAAkB,OAG7B,EACAC,UAAU,EACVC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,GAAG,EACHC,oBAAoB,EACuB;IAI3C,MAAMC,SAAS,MAAMR,eAAe;QAClCE;QACAC;QACAC;QACAC;QACAC;IACF;IAEA,MAAMG,SAASV,sBAAsB;QACnCW,sBAAsBR,WAAWS,MAAM,CAACC,IAAI;QAC5CC,cAAcP,IAAIQ,OAAO,CAACH,MAAM,CAACE,YAAY;QAC7CN,sBAAsBA,wBAAwB;QAC9CQ,OAAOP,OAAOO,KAAK;IACrB;IAEA,IAAIb,WAAWS,MAAM,CAACC,IAAI,CAACI,wBAAwB,EAAE;QACnD,OAAOR,OAAOO,KAAK;IACrB;IAEA,OAAO;QAAEN;QAAQD;IAAO;AAC1B,EAAC"}

package/dist/auth/operations/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAMvD,KAAK,SAAS,GAAG;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,SAAgB,SAAS,KAAG,OAAO,CAAC,oBAAoB,CAWnF,CAAA"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAKvD,KAAK,SAAS,GAAG;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,SAAgB,SAAS,KAAG,OAAO,CAAC,oBAAoB,CAMnF,CAAA"}

package/dist/auth/operations/access.js

@@ -1,17 +1,11 @@
-import { killTransaction } from '../../utilities/killTransaction.js';
 import { adminInit as adminInitTelemetry } from '../../utilities/telemetry/events/adminInit.js';
 import { getAccessResults } from '../getAccessResults.js';
 export const accessOperation = async (args)=>{
     const { req } = args;
     adminInitTelemetry(req);
-    try {
-        return getAccessResults({
-            req
-        });
-    } catch (e) {
-        await killTransaction(req);
-        throw e;
-    }
+    return getAccessResults({
+        req
+    });
 };
 
 //# sourceMappingURL=access.js.map

package/dist/auth/operations/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/access.ts"],"sourcesContent":["import type { PayloadRequest } from '../../types/index.js'\nimport type { SanitizedPermissions } from '../types.js'\n\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { adminInit as adminInitTelemetry } from '../../utilities/telemetry/events/adminInit.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\ntype Arguments = {\n  req: PayloadRequest\n}\n\nexport const accessOperation = async (args: Arguments): Promise<SanitizedPermissions> => {\n  const { req } = args\n\n  adminInitTelemetry(req)\n\n  try {\n    return getAccessResults({ req })\n  } catch (e: unknown) {\n    await killTransaction(req)\n    throw e\n  }\n}\n"],"names":["killTransaction","adminInit","adminInitTelemetry","getAccessResults","accessOperation","args","req","e"],"mappings":"AAGA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAaC,kBAAkB,QAAQ,gDAA+C;AAC/F,SAASC,gBAAgB,QAAQ,yBAAwB;AAMzD,OAAO,MAAMC,kBAAkB,OAAOC;IACpC,MAAM,EAAEC,GAAG,EAAE,GAAGD;IAEhBH,mBAAmBI;IAEnB,IAAI;QACF,OAAOH,iBAAiB;YAAEG;QAAI;IAChC,EAAE,OAAOC,GAAY;QACnB,MAAMP,gBAAgBM;QACtB,MAAMC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/access.ts"],"sourcesContent":["import type { PayloadRequest } from '../../types/index.js'\nimport type { SanitizedPermissions } from '../types.js'\n\nimport { adminInit as adminInitTelemetry } from '../../utilities/telemetry/events/adminInit.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\ntype Arguments = {\n  req: PayloadRequest\n}\n\nexport const accessOperation = async (args: Arguments): Promise<SanitizedPermissions> => {\n  const { req } = args\n\n  adminInitTelemetry(req)\n\n  return getAccessResults({ req })\n}\n"],"names":["adminInit","adminInitTelemetry","getAccessResults","accessOperation","args","req"],"mappings":"AAGA,SAASA,aAAaC,kBAAkB,QAAQ,gDAA+C;AAC/F,SAASC,gBAAgB,QAAQ,yBAAwB;AAMzD,OAAO,MAAMC,kBAAkB,OAAOC;IACpC,MAAM,EAAEC,GAAG,EAAE,GAAGD;IAEhBH,mBAAmBI;IAEnB,OAAOH,iBAAiB;QAAEG;IAAI;AAChC,EAAC"}

package/dist/auth/operations/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAM1D,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,EAAE,oBAAoB,CAAA;IACjC,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,eAAO,MAAM,IAAI,SAAgB,QAAQ,CAAC,QAAQ,CAAC,KAAG,OAAO,CAAC,UAAU,CA4BvE,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAK1D,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,EAAE,oBAAoB,CAAA;IACjC,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,eAAO,MAAM,IAAI,SAAgB,QAAQ,CAAC,QAAQ,CAAC,KAAG,OAAO,CAAC,UAAU,CAwBvE,CAAA"}

package/dist/auth/operations/auth.js

@@ -1,30 +1,25 @@
-import { killTransaction } from '../../utilities/killTransaction.js';
 import { executeAuthStrategies } from '../executeAuthStrategies.js';
 import { getAccessResults } from '../getAccessResults.js';
 export const auth = async (args)=>{
     const { canSetHeaders, headers } = args;
     const req = args.req;
     const { payload } = req;
-    try {
-        const { responseHeaders, user } = await executeAuthStrategies({
-            canSetHeaders,
-            headers,
-            payload
-        });
-        req.user = user;
-        req.responseHeaders = responseHeaders;
-        const permissions = await getAccessResults({
-            req
-        });
-        return {
-            permissions,
-            responseHeaders,
-            user
-        };
-    } catch (error) {
-        await killTransaction(req);
-        throw error;
-    }
+    const { responseHeaders, user } = await executeAuthStrategies({
+        canSetHeaders,
+        headers,
+        payload,
+        req
+    });
+    req.user = user;
+    req.responseHeaders = responseHeaders;
+    const permissions = await getAccessResults({
+        req
+    });
+    return {
+        permissions,
+        responseHeaders,
+        user
+    };
 };
 
 //# sourceMappingURL=auth.js.map

package/dist/auth/operations/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/auth.ts"],"sourcesContent":["import type { AuthenticatedUser, SanitizedPermissions } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAuthStrategies } from '../executeAuthStrategies.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\nexport type AuthArgs = {\n  /**\n   * Specify if it's possible for auth strategies to set headers within this operation.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  req?: Omit<PayloadRequest, 'user'>\n}\n\nexport type AuthResult = {\n  permissions: SanitizedPermissions\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport const auth = async (args: Required<AuthArgs>): Promise<AuthResult> => {\n  const { canSetHeaders, headers } = args\n  const req = args.req as PayloadRequest\n  const { payload } = req\n\n  try {\n    const { responseHeaders, user } = await executeAuthStrategies({\n      canSetHeaders,\n      headers,\n      payload,\n    })\n\n    req.user = user\n    req.responseHeaders = responseHeaders\n\n    const permissions = await getAccessResults({\n      req,\n    })\n\n    return {\n      permissions,\n      responseHeaders,\n      user,\n    }\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["killTransaction","executeAuthStrategies","getAccessResults","auth","args","canSetHeaders","headers","req","payload","responseHeaders","user","permissions","error"],"mappings":"AAGA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,gBAAgB,QAAQ,yBAAwB;AAiBzD,OAAO,MAAMC,OAAO,OAAOC;IACzB,MAAM,EAAEC,aAAa,EAAEC,OAAO,EAAE,GAAGF;IACnC,MAAMG,MAAMH,KAAKG,GAAG;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAGD;IAEpB,IAAI;QACF,MAAM,EAAEE,eAAe,EAAEC,IAAI,EAAE,GAAG,MAAMT,sBAAsB;YAC5DI;YACAC;YACAE;QACF;QAEAD,IAAIG,IAAI,GAAGA;QACXH,IAAIE,eAAe,GAAGA;QAEtB,MAAME,cAAc,MAAMT,iBAAiB;YACzCK;QACF;QAEA,OAAO;YACLI;YACAF;YACAC;QACF;IACF,EAAE,OAAOE,OAAgB;QACvB,MAAMZ,gBAAgBO;QACtB,MAAMK;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/auth.ts"],"sourcesContent":["import type { AuthenticatedUser, SanitizedPermissions } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { executeAuthStrategies } from '../executeAuthStrategies.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\nexport type AuthArgs = {\n  /**\n   * Specify if it's possible for auth strategies to set headers within this operation.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  req?: Omit<PayloadRequest, 'user'>\n}\n\nexport type AuthResult = {\n  permissions: SanitizedPermissions\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport const auth = async (args: Required<AuthArgs>): Promise<AuthResult> => {\n  const { canSetHeaders, headers } = args\n  const req = args.req as PayloadRequest\n  const { payload } = req\n\n  const { responseHeaders, user } = await executeAuthStrategies({\n    canSetHeaders,\n    headers,\n    payload,\n    req,\n  })\n\n  req.user = user\n  req.responseHeaders = responseHeaders\n\n  const permissions = await getAccessResults({\n    req,\n  })\n\n  return {\n    permissions,\n    responseHeaders,\n    user,\n  }\n}\n"],"names":["executeAuthStrategies","getAccessResults","auth","args","canSetHeaders","headers","req","payload","responseHeaders","user","permissions"],"mappings":"AAGA,SAASA,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,gBAAgB,QAAQ,yBAAwB;AAiBzD,OAAO,MAAMC,OAAO,OAAOC;IACzB,MAAM,EAAEC,aAAa,EAAEC,OAAO,EAAE,GAAGF;IACnC,MAAMG,MAAMH,KAAKG,GAAG;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAGD;IAEpB,MAAM,EAAEE,eAAe,EAAEC,IAAI,EAAE,GAAG,MAAMT,sBAAsB;QAC5DI;QACAC;QACAE;QACAD;IACF;IAEAA,IAAIG,IAAI,GAAGA;IACXH,IAAIE,eAAe,GAAGA;IAEtB,MAAME,cAAc,MAAMT,iBAAiB;QACzCK;IACF;IAEA,OAAO;QACLI;QACAF;QACAC;IACF;AACF,EAAC"}

package/dist/auth/operations/forgotPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/forgotPassword.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,eAAO,MAAM,uBAAuB,GAAU,KAAK,SAAS,kBAAkB,gBAC9D,SAAS,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,IAAI,GAAG,MAAM,CA2LvB,CAAA"}
+{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/forgotPassword.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAejE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,eAAO,MAAM,uBAAuB,GAAU,KAAK,SAAS,kBAAkB,gBAC9D,SAAS,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,IAAI,GAAG,MAAM,CAuPvB,CAAA"}

package/dist/auth/operations/forgotPassword.js

@@ -9,6 +9,7 @@ import { commitTransaction } from '../../utilities/commitTransaction.js';
 import { formatAdminURL } from '../../utilities/formatAdminURL.js';
 import { getRequestOrigin } from '../../utilities/getRequestOrigin.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
+import { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 import { getLoginOptions } from '../getLoginOptions.js';
 export const forgotPasswordOperation = async (incomingArgs)=>{
@@ -18,6 +19,8 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
     const sanitizedEmail = canLoginWithEmail && (incomingArgs.data.email || '').toLowerCase().trim() || null;
     const sanitizedUsername = 'username' in data && typeof data?.username === 'string' ? data.username.toLowerCase().trim() : null;
     let args = incomingArgs;
+    let hasSentEmail = false;
+    let releaseRequestInterval = null;
     if (incomingArgs.collection.config.auth.disableLocalStrategy) {
         throw new Forbidden(incomingArgs.req.t);
     }
@@ -36,13 +39,7 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
             overrideAccess
         });
         const { collection: { config: collectionConfig }, disableEmail, expiration, req: { payload: { config, email }, payload }, req } = args;
-        // /////////////////////////////////////
-        // Forget password
-        // /////////////////////////////////////
-        let token = crypto.randomBytes(20).toString('hex');
-        if (!sanitizedEmail && !sanitizedUsername) {
-            throw new APIError(`Missing ${loginWithUsername ? 'username' : 'email'}.`, httpStatus.BAD_REQUEST);
-        }
+        const minRequestInterval = collectionConfig.auth.forgotPassword.minRequestInterval ?? 15000;
         let whereConstraint = {};
         if (canLoginWithEmail && sanitizedEmail) {
             whereConstraint = {
@@ -63,19 +60,93 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
             trash: false,
             where: whereConstraint
         });
-        let user = await payload.db.findOne({
-            collection: collectionConfig.slug,
-            req,
-            where: whereConstraint
-        });
+        const now = Date.now();
+        let token = crypto.randomBytes(20).toString('hex');
+        const resetPasswordExpiration = new Date(now + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000)).toISOString();
+        let user;
+        if (!disableEmail && minRequestInterval > 0) {
+            const requestedAt = new Date(now).toISOString();
+            const reservationReq = isolateObjectProperty(req, 'transactionID');
+            reservationReq.transactionID = undefined;
+            user = await payload.db.updateOne({
+                collection: collectionConfig.slug,
+                data: {
+                    resetPasswordRequestedAt: requestedAt
+                },
+                options: {
+                    atomic: true
+                },
+                req: reservationReq,
+                where: {
+                    and: [
+                        whereConstraint,
+                        {
+                            or: [
+                                {
+                                    resetPasswordRequestedAt: {
+                                        exists: false
+                                    }
+                                },
+                                {
+                                    resetPasswordRequestedAt: {
+                                        equals: null
+                                    }
+                                },
+                                {
+                                    resetPasswordRequestedAt: {
+                                        less_than_equal: new Date(now - minRequestInterval).toISOString()
+                                    }
+                                }
+                            ]
+                        }
+                    ]
+                }
+            });
+            if (user) {
+                const userID = user.id;
+                releaseRequestInterval = async ()=>{
+                    await payload.db.updateOne({
+                        collection: collectionConfig.slug,
+                        data: {
+                            resetPasswordRequestedAt: null
+                        },
+                        options: {
+                            atomic: true
+                        },
+                        req: reservationReq,
+                        where: {
+                            and: [
+                                {
+                                    id: {
+                                        equals: userID
+                                    }
+                                },
+                                {
+                                    resetPasswordRequestedAt: {
+                                        equals: requestedAt
+                                    }
+                                }
+                            ]
+                        }
+                    });
+                };
+            }
+        } else {
+            user = await payload.db.findOne({
+                collection: collectionConfig.slug,
+                req,
+                where: whereConstraint
+            });
+        }
         // We don't want to indicate specifically that an email was not found,
         // as doing so could lead to the exposure of registered emails.
         // Therefore, we prefer to fail silently.
         if (!user) {
-            await commitTransaction(args.req);
+            if (shouldCommit) {
+                await commitTransaction(args.req);
+            }
             return null;
         }
-        const resetPasswordExpiration = new Date(Date.now() + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000)).toISOString();
         user = await payload.update({
             id: user.id,
             collection: collectionConfig.slug,
@@ -83,6 +154,7 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
                 resetPasswordExpiration,
                 resetPasswordToken: token
             },
+            overrideAccess: true,
             req
         });
         if (!disableEmail && user.email) {
@@ -119,6 +191,7 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
                 subject,
                 to: user.email
             });
+            hasSentEmail = true;
         }
         // /////////////////////////////////////
         // afterForgotPassword - Collection
@@ -148,6 +221,16 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
         return token;
     } catch (error) {
         await killTransaction(args.req);
+        if (!hasSentEmail && releaseRequestInterval) {
+            try {
+                await releaseRequestInterval();
+            } catch (err) {
+                args.req.payload.logger.error({
+                    err,
+                    msg: 'Failed to release forgot-password interval'
+                });
+            }
+        }
         throw error;
     }
 };