payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/auth/serverFunctions/login.d.ts

@@ -0,0 +1,29 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { AuthCollectionSlug } from '../../index.js';
+import type { MaybePromise } from '../../types/index.js';
+import type { LoginResult } from '../operations/login.js';
+export type LoginArgs<TSlug extends AuthCollectionSlug> = {
+    collection: TSlug;
+    config: MaybePromise<SanitizedConfig>;
+    password: string;
+    serverAdapter: ServerAdapter;
+} & ({
+    email: string;
+    username?: never;
+} | {
+    email?: never;
+    username: string;
+});
+/**
+ * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.
+ * Distributes over the email/username union so the either-or survives; a plain
+ * `Omit` collapses the union and accepts both keys at once.
+ */
+export type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> = LoginArgs<TSlug> extends infer TArgs ? TArgs extends unknown ? Omit<TArgs, 'serverAdapter'> : never : never;
+/**
+ * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,
+ * so the function is framework-agnostic; each adapter binds its own.
+ */
+export declare function login<TSlug extends AuthCollectionSlug>({ collection, config, email, password, serverAdapter, username, }: LoginArgs<TSlug>): Promise<LoginResult<TSlug>>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/serverFunctions/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAOzD,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,KAAK,CAAA;IACjB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAE/E;;;;GAIG;AACH,MAAM,MAAM,6BAA6B,CAAC,KAAK,SAAS,kBAAkB,IACxE,SAAS,CAAC,KAAK,CAAC,SAAS,MAAM,KAAK,GAChC,KAAK,SAAS,OAAO,GACnB,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,GAC5B,KAAK,GACP,KAAK,CAAA;AAEX;;;GAGG;AACH,wBAAsB,KAAK,CAAC,KAAK,SAAS,kBAAkB,EAAE,EAC5D,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,EACR,aAAa,EACb,QAAQ,GACT,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAgDhD"}

package/dist/auth/serverFunctions/login.js

@@ -0,0 +1,65 @@
+import { getPayload } from '../../index.js';
+import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
+import { loginWithCookie } from '../loginWithCookie.js';
+import { applyAuthCookie } from './cookies.js';
+/**
+ * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,
+ * so the function is framework-agnostic; each adapter binds its own.
+ */ export async function login({ collection, config, email, password, serverAdapter, username }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const authConfig = payload.collections[collection]?.config.auth;
+    if (!authConfig) {
+        throw new Error(`No auth config found for collection: ${collection}`);
+    }
+    const loginWithUsername = authConfig.loginWithUsername ?? false;
+    if (loginWithUsername) {
+        if (loginWithUsername.allowEmailLogin) {
+            if (!email && !username) {
+                throw new Error('Email or username is required.');
+            }
+        } else {
+            if (!username) {
+                throw new Error('Username is required.');
+            }
+        }
+    } else {
+        if (!email) {
+            throw new Error('Email is required.');
+        }
+    }
+    let loginData;
+    if (loginWithUsername) {
+        loginData = username ? {
+            password,
+            username
+        } : {
+            email,
+            password
+        };
+    } else {
+        loginData = {
+            email,
+            password
+        };
+    }
+    const collectionConfig = payload.collections[collection];
+    const { cookie, result } = await loginWithCookie({
+        collection: collectionConfig,
+        data: loginData,
+        overrideAccess: true,
+        req: await createPayloadRequest({
+            payload
+        }),
+        returnCookieAsObject: true
+    });
+    await applyAuthCookie({
+        cookie,
+        serverAdapter
+    });
+    return result;
+}
+
+//# sourceMappingURL=login.js.map

package/dist/auth/serverFunctions/login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/login.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\nimport type { LoginResult } from '../operations/login.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\nimport { applyAuthCookie } from './cookies.js'\n\nexport type LoginArgs<TSlug extends AuthCollectionSlug> = {\n  collection: TSlug\n  config: MaybePromise<SanitizedConfig>\n  password: string\n  serverAdapter: ServerAdapter\n} & ({ email: string; username?: never } | { email?: never; username: string })\n\n/**\n * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.\n * Distributes over the email/username union so the either-or survives; a plain\n * `Omit` collapses the union and accepts both keys at once.\n */\nexport type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> =\n  LoginArgs<TSlug> extends infer TArgs\n    ? TArgs extends unknown\n      ? Omit<TArgs, 'serverAdapter'>\n      : never\n    : never\n\n/**\n * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,\n * so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function login<TSlug extends AuthCollectionSlug>({\n  collection,\n  config,\n  email,\n  password,\n  serverAdapter,\n  username,\n}: LoginArgs<TSlug>): Promise<LoginResult<TSlug>> {\n  const payload = await getPayload({ config, cron: true })\n\n  const authConfig = payload.collections[collection]?.config.auth\n\n  if (!authConfig) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const loginWithUsername = authConfig.loginWithUsername ?? false\n\n  if (loginWithUsername) {\n    if (loginWithUsername.allowEmailLogin) {\n      if (!email && !username) {\n        throw new Error('Email or username is required.')\n      }\n    } else {\n      if (!username) {\n        throw new Error('Username is required.')\n      }\n    }\n  } else {\n    if (!email) {\n      throw new Error('Email is required.')\n    }\n  }\n\n  let loginData\n\n  if (loginWithUsername) {\n    loginData = username ? { password, username } : { email, password }\n  } else {\n    loginData = { email, password }\n  }\n\n  const collectionConfig = payload.collections[collection]!\n\n  const { cookie, result } = await loginWithCookie({\n    collection: collectionConfig,\n    data: loginData as Parameters<typeof loginWithCookie>[0]['data'],\n    overrideAccess: true,\n    req: await createPayloadRequest({ payload }),\n    returnCookieAsObject: true,\n  })\n\n  await applyAuthCookie({ cookie, serverAdapter })\n\n  return result as LoginResult<TSlug>\n}\n"],"names":["getPayload","createPayloadRequest","loginWithCookie","applyAuthCookie","login","collection","config","email","password","serverAdapter","username","payload","cron","authConfig","collections","auth","Error","loginWithUsername","allowEmailLogin","loginData","collectionConfig","cookie","result","data","overrideAccess","req","returnCookieAsObject"],"mappings":"AAMA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,eAAc;AAqB9C;;;CAGC,GACD,OAAO,eAAeC,MAAwC,EAC5DC,UAAU,EACVC,MAAM,EACNC,KAAK,EACLC,QAAQ,EACRC,aAAa,EACbC,QAAQ,EACS;IACjB,MAAMC,UAAU,MAAMX,WAAW;QAAEM;QAAQM,MAAM;IAAK;IAEtD,MAAMC,aAAaF,QAAQG,WAAW,CAACT,WAAW,EAAEC,OAAOS;IAE3D,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM,CAAC,qCAAqC,EAAEX,YAAY;IACtE;IAEA,MAAMY,oBAAoBJ,WAAWI,iBAAiB,IAAI;IAE1D,IAAIA,mBAAmB;QACrB,IAAIA,kBAAkBC,eAAe,EAAE;YACrC,IAAI,CAACX,SAAS,CAACG,UAAU;gBACvB,MAAM,IAAIM,MAAM;YAClB;QACF,OAAO;YACL,IAAI,CAACN,UAAU;gBACb,MAAM,IAAIM,MAAM;YAClB;QACF;IACF,OAAO;QACL,IAAI,CAACT,OAAO;YACV,MAAM,IAAIS,MAAM;QAClB;IACF;IAEA,IAAIG;IAEJ,IAAIF,mBAAmB;QACrBE,YAAYT,WAAW;YAAEF;YAAUE;QAAS,IAAI;YAAEH;YAAOC;QAAS;IACpE,OAAO;QACLW,YAAY;YAAEZ;YAAOC;QAAS;IAChC;IAEA,MAAMY,mBAAmBT,QAAQG,WAAW,CAACT,WAAW;IAExD,MAAM,EAAEgB,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMpB,gBAAgB;QAC/CG,YAAYe;QACZG,MAAMJ;QACNK,gBAAgB;QAChBC,KAAK,MAAMxB,qBAAqB;YAAEU;QAAQ;QAC1Ce,sBAAsB;IACxB;IAEA,MAAMvB,gBAAgB;QAAEkB;QAAQZ;IAAc;IAE9C,OAAOa;AACT"}

package/dist/auth/serverFunctions/logout.d.ts

@@ -0,0 +1,17 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { MaybePromise } from '../../types/index.js';
+export type LogoutArgs = {
+    allSessions?: boolean;
+    config: MaybePromise<SanitizedConfig>;
+    serverAdapter: ServerAdapter;
+};
+/**
+ * Logs the current user out and expires the auth cookie through the supplied
+ * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.
+ */
+export declare function logout({ allSessions, config, serverAdapter, }: LogoutArgs): Promise<{
+    message: string;
+    success: boolean;
+}>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/auth/serverFunctions/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAOxD,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,EAC3B,WAAmB,EACnB,MAAM,EACN,aAAa,GACd,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC7D"}

package/dist/auth/serverFunctions/logout.js

@@ -0,0 +1,59 @@
+import { getPayload } from '../../index.js';
+import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
+import { logoutOperation } from '../operations/logout.js';
+import { clearAuthCookie } from './cookies.js';
+/**
+ * Logs the current user out and expires the auth cookie through the supplied
+ * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.
+ */ export async function logout({ allSessions = false, config, serverAdapter }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const headers = await serverAdapter.getHeaders();
+    const authResult = await payload.auth({
+        headers
+    });
+    if (!authResult.user) {
+        return {
+            message: 'User already logged out',
+            success: true
+        };
+    }
+    const { user } = authResult;
+    const req = await createPayloadRequest({
+        payload,
+        user
+    });
+    const collection = payload.collections[user.collection];
+    if (!collection) {
+        return {
+            message: 'Collection not found',
+            success: false
+        };
+    }
+    const logoutResult = await logoutOperation({
+        allSessions,
+        collection,
+        req
+    });
+    if (!logoutResult) {
+        return {
+            message: 'Logout failed',
+            success: false
+        };
+    }
+    if (collection.config.auth) {
+        await clearAuthCookie({
+            authConfig: collection.config.auth,
+            cookiePrefix: payload.config.cookiePrefix,
+            serverAdapter
+        });
+    }
+    return {
+        message: 'User logged out successfully',
+        success: true
+    };
+}
+
+//# sourceMappingURL=logout.js.map

package/dist/auth/serverFunctions/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/logout.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { MaybePromise } from '../../types/index.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { logoutOperation } from '../operations/logout.js'\nimport { clearAuthCookie } from './cookies.js'\n\nexport type LogoutArgs = {\n  allSessions?: boolean\n  config: MaybePromise<SanitizedConfig>\n  serverAdapter: ServerAdapter\n}\n\n/**\n * Logs the current user out and expires the auth cookie through the supplied\n * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function logout({\n  allSessions = false,\n  config,\n  serverAdapter,\n}: LogoutArgs): Promise<{ message: string; success: boolean }> {\n  const payload = await getPayload({ config, cron: true })\n  const headers = await serverAdapter.getHeaders()\n  const authResult = await payload.auth({ headers })\n\n  if (!authResult.user) {\n    return { message: 'User already logged out', success: true }\n  }\n\n  const { user } = authResult\n  const req = await createPayloadRequest({ payload, user })\n  const collection = payload.collections[user.collection]\n\n  if (!collection) {\n    return { message: 'Collection not found', success: false }\n  }\n\n  const logoutResult = await logoutOperation({\n    allSessions,\n    collection,\n    req,\n  })\n\n  if (!logoutResult) {\n    return { message: 'Logout failed', success: false }\n  }\n\n  if (collection.config.auth) {\n    await clearAuthCookie({\n      authConfig: collection.config.auth,\n      cookiePrefix: payload.config.cookiePrefix,\n      serverAdapter,\n    })\n  }\n\n  return { message: 'User logged out successfully', success: true }\n}\n"],"names":["getPayload","createPayloadRequest","logoutOperation","clearAuthCookie","logout","allSessions","config","serverAdapter","payload","cron","headers","getHeaders","authResult","auth","user","message","success","req","collection","collections","logoutResult","authConfig","cookiePrefix"],"mappings":"AAIA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,eAAe,QAAQ,0BAAyB;AACzD,SAASC,eAAe,QAAQ,eAAc;AAQ9C;;;CAGC,GACD,OAAO,eAAeC,OAAO,EAC3BC,cAAc,KAAK,EACnBC,MAAM,EACNC,aAAa,EACF;IACX,MAAMC,UAAU,MAAMR,WAAW;QAAEM;QAAQG,MAAM;IAAK;IACtD,MAAMC,UAAU,MAAMH,cAAcI,UAAU;IAC9C,MAAMC,aAAa,MAAMJ,QAAQK,IAAI,CAAC;QAAEH;IAAQ;IAEhD,IAAI,CAACE,WAAWE,IAAI,EAAE;QACpB,OAAO;YAAEC,SAAS;YAA2BC,SAAS;QAAK;IAC7D;IAEA,MAAM,EAAEF,IAAI,EAAE,GAAGF;IACjB,MAAMK,MAAM,MAAMhB,qBAAqB;QAAEO;QAASM;IAAK;IACvD,MAAMI,aAAaV,QAAQW,WAAW,CAACL,KAAKI,UAAU,CAAC;IAEvD,IAAI,CAACA,YAAY;QACf,OAAO;YAAEH,SAAS;YAAwBC,SAAS;QAAM;IAC3D;IAEA,MAAMI,eAAe,MAAMlB,gBAAgB;QACzCG;QACAa;QACAD;IACF;IAEA,IAAI,CAACG,cAAc;QACjB,OAAO;YAAEL,SAAS;YAAiBC,SAAS;QAAM;IACpD;IAEA,IAAIE,WAAWZ,MAAM,CAACO,IAAI,EAAE;QAC1B,MAAMV,gBAAgB;YACpBkB,YAAYH,WAAWZ,MAAM,CAACO,IAAI;YAClCS,cAAcd,QAAQF,MAAM,CAACgB,YAAY;YACzCf;QACF;IACF;IAEA,OAAO;QAAEQ,SAAS;QAAgCC,SAAS;IAAK;AAClE"}

package/dist/auth/serverFunctions/refresh.d.ts

@@ -0,0 +1,17 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { MaybePromise } from '../../types/index.js';
+export type RefreshArgs = {
+    config: MaybePromise<SanitizedConfig>;
+    serverAdapter: ServerAdapter;
+};
+/**
+ * Refreshes the current user's auth token and rewrites the cookie through the
+ * supplied `serverAdapter`, so the function is framework-agnostic; each adapter
+ * binds its own.
+ */
+export declare function refresh({ config, serverAdapter, }: RefreshArgs): Promise<{
+    message: string;
+    success: boolean;
+}>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/auth/serverFunctions/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAOxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,aAAa,GACd,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4C9D"}

package/dist/auth/serverFunctions/refresh.js

@@ -0,0 +1,62 @@
+import { getPayload } from '../../index.js';
+import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
+import { refreshOperation } from '../operations/refresh.js';
+import { getExistingAuthToken, setAuthCookie } from './cookies.js';
+/**
+ * Refreshes the current user's auth token and rewrites the cookie through the
+ * supplied `serverAdapter`, so the function is framework-agnostic; each adapter
+ * binds its own.
+ */ export async function refresh({ config, serverAdapter }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const headers = await serverAdapter.getHeaders();
+    const result = await payload.auth({
+        headers
+    });
+    if (!result.user) {
+        throw new Error('Cannot refresh token: user not authenticated');
+    }
+    const existingCookie = await getExistingAuthToken({
+        cookiePrefix: payload.config.cookiePrefix,
+        serverAdapter
+    });
+    if (!existingCookie) {
+        return {
+            message: 'No valid token found to refresh',
+            success: false
+        };
+    }
+    const collection = result.user.collection;
+    const collectionConfig = payload.collections[collection];
+    if (!collectionConfig?.config.auth) {
+        throw new Error(`No auth config found for collection: ${collection}`);
+    }
+    const req = await createPayloadRequest({
+        payload,
+        user: result.user
+    });
+    const refreshResult = await refreshOperation({
+        collection: collectionConfig,
+        req
+    });
+    if (!refreshResult) {
+        return {
+            message: 'Token refresh failed',
+            success: false
+        };
+    }
+    await setAuthCookie({
+        authConfig: collectionConfig.config.auth,
+        cookiePrefix: payload.config.cookiePrefix,
+        serverAdapter,
+        token: refreshResult.refreshedToken
+    });
+    return {
+        message: 'Token refreshed successfully',
+        success: true
+    };
+}
+
+//# sourceMappingURL=refresh.js.map

package/dist/auth/serverFunctions/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/refresh.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { CollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { refreshOperation } from '../operations/refresh.js'\nimport { getExistingAuthToken, setAuthCookie } from './cookies.js'\n\nexport type RefreshArgs = {\n  config: MaybePromise<SanitizedConfig>\n  serverAdapter: ServerAdapter\n}\n\n/**\n * Refreshes the current user's auth token and rewrites the cookie through the\n * supplied `serverAdapter`, so the function is framework-agnostic; each adapter\n * binds its own.\n */\nexport async function refresh({\n  config,\n  serverAdapter,\n}: RefreshArgs): Promise<{ message: string; success: boolean }> {\n  const payload = await getPayload({ config, cron: true })\n  const headers = await serverAdapter.getHeaders()\n  const result = await payload.auth({ headers })\n\n  if (!result.user) {\n    throw new Error('Cannot refresh token: user not authenticated')\n  }\n\n  const existingCookie = await getExistingAuthToken({\n    cookiePrefix: payload.config.cookiePrefix,\n    serverAdapter,\n  })\n\n  if (!existingCookie) {\n    return { message: 'No valid token found to refresh', success: false }\n  }\n\n  const collection: CollectionSlug | undefined = result.user.collection\n  const collectionConfig = payload.collections[collection]\n\n  if (!collectionConfig?.config.auth) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const req = await createPayloadRequest({ payload, user: result.user })\n\n  const refreshResult = await refreshOperation({\n    collection: collectionConfig,\n    req,\n  })\n\n  if (!refreshResult) {\n    return { message: 'Token refresh failed', success: false }\n  }\n\n  await setAuthCookie({\n    authConfig: collectionConfig.config.auth,\n    cookiePrefix: payload.config.cookiePrefix,\n    serverAdapter,\n    token: refreshResult.refreshedToken,\n  })\n\n  return { message: 'Token refreshed successfully', success: true }\n}\n"],"names":["getPayload","createPayloadRequest","refreshOperation","getExistingAuthToken","setAuthCookie","refresh","config","serverAdapter","payload","cron","headers","getHeaders","result","auth","user","Error","existingCookie","cookiePrefix","message","success","collection","collectionConfig","collections","req","refreshResult","authConfig","token","refreshedToken"],"mappings":"AAKA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,gBAAgB,QAAQ,2BAA0B;AAC3D,SAASC,oBAAoB,EAAEC,aAAa,QAAQ,eAAc;AAOlE;;;;CAIC,GACD,OAAO,eAAeC,QAAQ,EAC5BC,MAAM,EACNC,aAAa,EACD;IACZ,MAAMC,UAAU,MAAMR,WAAW;QAAEM;QAAQG,MAAM;IAAK;IACtD,MAAMC,UAAU,MAAMH,cAAcI,UAAU;IAC9C,MAAMC,SAAS,MAAMJ,QAAQK,IAAI,CAAC;QAAEH;IAAQ;IAE5C,IAAI,CAACE,OAAOE,IAAI,EAAE;QAChB,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,iBAAiB,MAAMb,qBAAqB;QAChDc,cAAcT,QAAQF,MAAM,CAACW,YAAY;QACzCV;IACF;IAEA,IAAI,CAACS,gBAAgB;QACnB,OAAO;YAAEE,SAAS;YAAmCC,SAAS;QAAM;IACtE;IAEA,MAAMC,aAAyCR,OAAOE,IAAI,CAACM,UAAU;IACrE,MAAMC,mBAAmBb,QAAQc,WAAW,CAACF,WAAW;IAExD,IAAI,CAACC,kBAAkBf,OAAOO,MAAM;QAClC,MAAM,IAAIE,MAAM,CAAC,qCAAqC,EAAEK,YAAY;IACtE;IAEA,MAAMG,MAAM,MAAMtB,qBAAqB;QAAEO;QAASM,MAAMF,OAAOE,IAAI;IAAC;IAEpE,MAAMU,gBAAgB,MAAMtB,iBAAiB;QAC3CkB,YAAYC;QACZE;IACF;IAEA,IAAI,CAACC,eAAe;QAClB,OAAO;YAAEN,SAAS;YAAwBC,SAAS;QAAM;IAC3D;IAEA,MAAMf,cAAc;QAClBqB,YAAYJ,iBAAiBf,MAAM,CAACO,IAAI;QACxCI,cAAcT,QAAQF,MAAM,CAACW,YAAY;QACzCV;QACAmB,OAAOF,cAAcG,cAAc;IACrC;IAEA,OAAO;QAAET,SAAS;QAAgCC,SAAS;IAAK;AAClE"}

package/dist/auth/strategies/apiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAuD9C,CAAA"}
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAKvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBA4F9C,CAAA"}

package/dist/auth/strategies/apiKey.js

@@ -1,16 +1,23 @@
 import crypto from 'crypto';
-export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGraphQL = false, payload })=>{
+import { getAPIKeyLast4 } from '../baseFields/apiKey/getAPIKeyLast4.js';
+import { legacyAPIKeyLast4 } from '../baseFields/apiKey/omitAPIKey.js';
+export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGraphQL = false, payload, req })=>{
         const authHeader = headers.get('Authorization');
         if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {
             const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '');
-            const sha256APIKeyIndex = crypto.createHmac('sha256', payload.secret).update(apiKey).digest('hex');
+            // The stored index was written under whichever secret was active at the
+            // time, so match against the index computed under every keyring secret.
+            const apiKeyIndexes = payload.encryptionKeyring.all.map((key)=>crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'));
+            const requestFallbackLocale = req?.fallbackLocale;
+            const requestLocale = req?.locale;
+            const requestDepth = req?.query?.depth;
             try {
                 const where = {};
                 if (collectionConfig.auth?.verify) {
                     where.and = [
                         {
                             apiKeyIndex: {
-                                equals: sha256APIKeyIndex
+                                in: apiKeyIndexes
                             }
                         },
                         {
@@ -21,19 +28,42 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                     ];
                 } else {
                     where.apiKeyIndex = {
-                        equals: sha256APIKeyIndex
+                        in: apiKeyIndexes
                     };
                 }
                 const userQuery = await payload.find({
                     collection: collectionConfig.slug,
                     depth: isGraphQL ? 0 : collectionConfig.auth.depth,
+                    fallbackLocale: requestFallbackLocale,
                     limit: 1,
+                    locale: requestLocale,
                     overrideAccess: true,
                     pagination: false,
+                    req,
                     where
                 });
                 if (userQuery.docs && userQuery.docs.length > 0) {
                     const user = userQuery.docs[0];
+                    const apiKeyLast4 = getAPIKeyLast4(apiKey);
+                    if (user?.apiKeyLast4 === legacyAPIKeyLast4 && apiKeyLast4 !== legacyAPIKeyLast4) {
+                        try {
+                            await payload.db.updateOne({
+                                id: user.id,
+                                collection: collectionConfig.slug,
+                                data: {
+                                    apiKeyLast4
+                                },
+                                req,
+                                returning: false
+                            });
+                            user.apiKeyLast4 = apiKeyLast4;
+                        } catch (err) {
+                            payload.logger.error({
+                                err,
+                                msg: `Failed to backfill API key last four for ${collectionConfig.slug} ${user.id}`
+                            });
+                        }
+                    }
                     user.collection = collectionConfig.slug;
                     user._strategy = 'api-key';
                     return {
@@ -44,6 +74,14 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                 return {
                     user: null
                 };
+            } finally{
+                if (req) {
+                    req.fallbackLocale = requestFallbackLocale;
+                    req.locale = requestLocale;
+                    if (req.query) {
+                        req.query.depth = requestDepth;
+                    }
+                }
             }
         }
         return {

package/dist/auth/strategies/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey)\n        .digest('hex')\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                equals: sha256APIKeyIndex,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { equals: sha256APIKeyIndex }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","sha256APIKeyIndex","createHmac","secret","update","digest","where","auth","verify","and","apiKeyIndex","equals","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,MAAMG,oBAAoBZ,OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAIf,iBAAiBgB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,QAAQV;4BACV;wBACF;wBACA;4BACEW,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,QAAQV;oBAAkB;gBAClD;gBAEA,MAAMa,YAAY,MAAMpB,QAAQqB,IAAI,CAAC;oBACnCC,YAAYzB,iBAAiBO,IAAI;oBACjCmB,OAAOxB,YAAY,IAAIF,iBAAiBgB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAGzB,iBAAiBO,IAAI;oBACxCyB,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nimport { getAPIKeyLast4 } from '../baseFields/apiKey/getAPIKeyLast4.js'\nimport { legacyAPIKeyLast4 } from '../baseFields/apiKey/omitAPIKey.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload, req }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      // The stored index was written under whichever secret was active at the\n      // time, so match against the index computed under every keyring secret.\n      const apiKeyIndexes = payload.encryptionKeyring.all.map((key) =>\n        crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'),\n      )\n\n      const requestFallbackLocale = req?.fallbackLocale\n      const requestLocale = req?.locale\n      const requestDepth = req?.query?.depth\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                in: apiKeyIndexes,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { in: apiKeyIndexes }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          fallbackLocale: requestFallbackLocale,\n          limit: 1,\n          locale: requestLocale,\n          overrideAccess: true,\n          pagination: false,\n          req,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          const apiKeyLast4 = getAPIKeyLast4(apiKey)\n\n          if (user?.apiKeyLast4 === legacyAPIKeyLast4 && apiKeyLast4 !== legacyAPIKeyLast4) {\n            try {\n              await payload.db.updateOne({\n                id: user.id,\n                collection: collectionConfig.slug,\n                data: { apiKeyLast4 },\n                req,\n                returning: false,\n              })\n              user.apiKeyLast4 = apiKeyLast4\n            } catch (err) {\n              payload.logger.error({\n                err,\n                msg: `Failed to backfill API key last four for ${collectionConfig.slug} ${user.id}`,\n              })\n            }\n          }\n\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      } finally {\n        if (req) {\n          req.fallbackLocale = requestFallbackLocale!\n          req.locale = requestLocale!\n\n          if (req.query) {\n            req.query.depth = requestDepth\n          }\n        }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","getAPIKeyLast4","legacyAPIKeyLast4","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","req","authHeader","get","startsWith","slug","apiKey","replace","apiKeyIndexes","encryptionKeyring","all","map","key","createHmac","legacyKey","update","digest","requestFallbackLocale","fallbackLocale","requestLocale","locale","requestDepth","query","depth","where","auth","verify","and","apiKeyIndex","in","_verified","not_equals","userQuery","find","collection","limit","overrideAccess","pagination","docs","length","user","apiKeyLast4","db","updateOne","id","data","returning","err","logger","error","msg","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,SAASC,cAAc,QAAQ,yCAAwC;AACvE,SAASC,iBAAiB,QAAQ,qCAAoC;AAEtE,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAEC,GAAG,EAAE;QACjD,MAAMC,aAAaJ,QAAQK,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGP,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGV,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAMG,gBAAgBR,QAAQS,iBAAiB,CAACC,GAAG,CAACC,GAAG,CAAC,CAACC,MACvDnB,OAAOoB,UAAU,CAAC,UAAUD,IAAIE,SAAS,EAAEC,MAAM,CAACT,QAAQU,MAAM,CAAC;YAGnE,MAAMC,wBAAwBhB,KAAKiB;YACnC,MAAMC,gBAAgBlB,KAAKmB;YAC3B,MAAMC,eAAepB,KAAKqB,OAAOC;YAEjC,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAI3B,iBAAiB4B,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,IAAIrB;4BACN;wBACF;wBACA;4BACEsB,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,IAAIrB;oBAAc;gBAC1C;gBAEA,MAAMwB,YAAY,MAAMhC,QAAQiC,IAAI,CAAC;oBACnCC,YAAYrC,iBAAiBQ,IAAI;oBACjCkB,OAAOxB,YAAY,IAAIF,iBAAiB4B,IAAI,CAACF,KAAK;oBAClDL,gBAAgBD;oBAChBkB,OAAO;oBACPf,QAAQD;oBACRiB,gBAAgB;oBAChBC,YAAY;oBACZpC;oBACAuB;gBACF;gBAEA,IAAIQ,UAAUM,IAAI,IAAIN,UAAUM,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOR,UAAUM,IAAI,CAAC,EAAE;oBAC9B,MAAMG,cAAc/C,eAAeY;oBAEnC,IAAIkC,MAAMC,gBAAgB9C,qBAAqB8C,gBAAgB9C,mBAAmB;wBAChF,IAAI;4BACF,MAAMK,QAAQ0C,EAAE,CAACC,SAAS,CAAC;gCACzBC,IAAIJ,KAAKI,EAAE;gCACXV,YAAYrC,iBAAiBQ,IAAI;gCACjCwC,MAAM;oCAAEJ;gCAAY;gCACpBxC;gCACA6C,WAAW;4BACb;4BACAN,KAAKC,WAAW,GAAGA;wBACrB,EAAE,OAAOM,KAAK;4BACZ/C,QAAQgD,MAAM,CAACC,KAAK,CAAC;gCACnBF;gCACAG,KAAK,CAAC,yCAAyC,EAAErD,iBAAiBQ,IAAI,CAAC,CAAC,EAAEmC,KAAKI,EAAE,EAAE;4BACrF;wBACF;oBACF;oBAEAJ,KAAMN,UAAU,GAAGrC,iBAAiBQ,IAAI;oBACxCmC,KAAMW,SAAS,GAAG;oBAElB,OAAO;wBACLX,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOY,QAAQ;gBACf,OAAO;oBAAEZ,MAAM;gBAAK;YACtB,SAAU;gBACR,IAAIvC,KAAK;oBACPA,IAAIiB,cAAc,GAAGD;oBACrBhB,IAAImB,MAAM,GAAGD;oBAEb,IAAIlB,IAAIqB,KAAK,EAAE;wBACbrB,IAAIqB,KAAK,CAACC,KAAK,GAAGF;oBACpB;gBACF;YACF;QACF;QAEA,OAAO;YAAEmB,MAAM;QAAK;IACtB,EAAC"}

package/dist/auth/strategies/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAsE3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAwD/B,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAwH3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAuH/B,CAAA"}

package/dist/auth/strategies/jwt.js

@@ -1,6 +1,35 @@
 import { jwtVerify } from 'jose';
 import { extractJWT } from '../extractJWT.js';
-async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
+import { JWT_AUTH_VERSION } from '../jwtAuth.js';
+const getJWTAuthenticationReference = (token)=>{
+    const { id, collection, sid } = token;
+    if (typeof collection !== 'string' || typeof id !== 'number' && typeof id !== 'string' || typeof sid !== 'undefined' && typeof sid !== 'string') {
+        return null;
+    }
+    return {
+        id,
+        collection,
+        ...sid ? {
+            sid
+        } : {}
+    };
+};
+/**
+ * Verifies a token against every secret in the keyring (active first), so tokens
+ * signed under a previous secret still validate during a bounded rotation.
+ * Throws if no key verifies.
+ */ async function verifyWithKeyring({ payload, token }) {
+    let lastError;
+    for (const key of payload.encryptionKeyring.all){
+        try {
+            return await jwtVerify(token, new TextEncoder().encode(key.legacyKey));
+        } catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError;
+}
+async function autoLogin({ fallbackLocale, isGraphQL, locale, payload, req, strategyName = 'local-jwt' }) {
     if (typeof payload?.config?.admin?.autoLogin !== 'object' || payload.config.admin?.autoLogin.prefillOnly || !payload?.config?.admin?.autoLogin || !payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username) {
         return {
             user: null
@@ -26,8 +55,12 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
     const user = (await payload.find({
         collection: collection.config.slug,
         depth: isGraphQL ? 0 : collection.config.auth.depth,
+        fallbackLocale,
         limit: 1,
+        locale,
+        overrideAccess: true,
         pagination: false,
+        req,
         where
     })).docs[0];
     if (!user) {
@@ -43,7 +76,10 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
 }
 /**
  * Authentication strategy function for JWT tokens
- */ export const JWTAuthentication = async ({ headers, isGraphQL = false, payload, strategyName = 'local-jwt' })=>{
+ */ export const JWTAuthentication = async ({ headers, isGraphQL = false, payload, req, strategyName = 'local-jwt' })=>{
+    const requestFallbackLocale = req?.fallbackLocale;
+    const requestLocale = req?.locale;
+    const requestDepth = req?.query?.depth;
     try {
         const token = extractJWT({
             headers,
@@ -52,8 +88,11 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
         if (!token) {
             if (headers.get('DisableAutologin') !== 'true') {
                 return await autoLogin({
+                    fallbackLocale: requestFallbackLocale,
                     isGraphQL,
+                    locale: requestLocale,
                     payload,
+                    req,
                     strategyName
                 });
             }
@@ -61,23 +100,42 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
                 user: null
             };
         }
-        const secretKey = new TextEncoder().encode(payload.secret);
-        const { payload: decodedPayload } = await jwtVerify(token, secretKey);
-        const collection = payload.collections[decodedPayload.collection];
+        // Verify against every keyring secret so tokens signed under a previous
+        // secret still validate during a bounded rotation. New tokens are always
+        // signed with the active secret.
+        const { payload: decodedPayload, protectedHeader } = await verifyWithKeyring({
+            payload,
+            token
+        });
+        if (protectedHeader.authVersion !== JWT_AUTH_VERSION) {
+            throw new Error('Invalid JWT protected header');
+        }
+        const authenticationReference = getJWTAuthenticationReference(decodedPayload);
+        if (!authenticationReference) {
+            throw new Error('Invalid JWT authentication reference');
+        }
+        const collection = Object.prototype.hasOwnProperty.call(payload.collections, authenticationReference.collection) ? payload.collections[authenticationReference.collection] : undefined;
+        if (!collection?.config.auth || collection.config.auth.disableLocalStrategy) {
+            throw new Error('JWT authentication requires an auth-enabled local collection');
+        }
         const user = await payload.findByID({
-            id: decodedPayload.id,
-            collection: decodedPayload.collection,
-            depth: isGraphQL ? 0 : collection.config.auth.depth
+            id: authenticationReference.id,
+            collection: authenticationReference.collection,
+            depth: isGraphQL ? 0 : collection.config.auth.depth,
+            fallbackLocale: requestFallbackLocale,
+            locale: requestLocale,
+            overrideAccess: true,
+            req
         });
         if (user && (!collection.config.auth.verify || user._verified)) {
             if (collection.config.auth.useSessions) {
-                const existingSession = (user.sessions || []).find(({ id })=>id === decodedPayload.sid);
-                if (!existingSession || !decodedPayload.sid) {
+                const existingSession = (user.sessions || []).find(({ id })=>id === authenticationReference.sid);
+                if (!existingSession || !authenticationReference.sid) {
                     return {
                         user: null
                     };
                 }
-                user._sid = decodedPayload.sid;
+                user._sid = authenticationReference.sid;
             }
             user.collection = collection.config.slug;
             user._strategy = strategyName;
@@ -87,8 +145,11 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
         } else {
             if (headers.get('DisableAutologin') !== 'true') {
                 return await autoLogin({
+                    fallbackLocale: requestFallbackLocale,
                     isGraphQL,
+                    locale: requestLocale,
                     payload,
+                    req,
                     strategyName
                 });
             }
@@ -99,14 +160,25 @@ async function autoLogin({ isGraphQL, payload, strategyName = 'local-jwt' }) {
     } catch (ignore) {
         if (headers.get('DisableAutologin') !== 'true') {
             return await autoLogin({
+                fallbackLocale: requestFallbackLocale,
                 isGraphQL,
+                locale: requestLocale,
                 payload,
+                req,
                 strategyName
             });
         }
         return {
             user: null
         };
+    } finally{
+        if (req) {
+            req.fallbackLocale = requestFallbackLocale;
+            req.locale = requestLocale;
+            if (req.query) {
+                req.query.depth = requestDepth;
+            }
+        }
     }
 };
 

package/dist/auth/strategies/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\n\ntype JWTToken = {\n  collection: string\n  id: string\n  sid?: string\n}\n\nasync function autoLogin({\n  isGraphQL,\n  payload,\n  strategyName = 'local-jwt',\n}: {\n  isGraphQL: boolean\n  payload: Payload\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      limit: 1,\n      pagination: false,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  strategyName = 'local-jwt',\n}) => {\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n\n    const secretKey = new TextEncoder().encode(payload.secret)\n    const { payload: decodedPayload } = await jwtVerify<JWTToken>(token, secretKey)\n    const collection = payload.collections[decodedPayload.collection]\n\n    const user = (await payload.findByID({\n      id: decodedPayload.id,\n      collection: decodedPayload.collection,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection!.config.auth.verify || user._verified)) {\n      if (collection!.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(({ id }) => id === decodedPayload.sid)\n\n        if (!existingSession || !decodedPayload.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = decodedPayload.sid\n      }\n\n      user.collection = collection!.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({ isGraphQL, payload, strategyName })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({ isGraphQL, payload, strategyName })\n    }\n    return { user: null }\n  }\n}\n"],"names":["jwtVerify","extractJWT","autoLogin","isGraphQL","payload","strategyName","config","admin","prefillOnly","email","username","user","collection","collections","where","or","push","equals","find","slug","depth","auth","limit","pagination","docs","_strategy","JWTAuthentication","headers","token","get","secretKey","TextEncoder","encode","secret","decodedPayload","findByID","id","verify","_verified","useSessions","existingSession","sessions","sid","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAQ7C,eAAeC,UAAU,EACvBC,SAAS,EACTC,OAAO,EACPC,eAAe,WAAW,EAK3B;IAGC,IACE,OAAOD,SAASE,QAAQC,OAAOL,cAAc,YAC7CE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUM,eAChC,CAACJ,SAASE,QAAQC,OAAOL,aACxB,CAACE,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,SAAS,CAACL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMC,aAAaR,QAAQS,WAAW,CAACT,QAAQE,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAMG,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIX,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO,OAAO;QACzCK,MAAMC,EAAE,EAAEC,KAAK;YACbP,OAAO;gBACLQ,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUO;YAC1C;QACF;IACF,OAAO,IAAIL,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ,UAAU;QACnDI,MAAMC,EAAE,EAAEC,KAAK;YACbN,UAAU;gBACRO,QAAQb,QAAQE,MAAM,CAACC,KAAK,EAAEL,UAAUQ;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMP,QAAQc,IAAI,CAAC;QACjBN,YAAYA,WAAYN,MAAM,CAACa,IAAI;QACnCC,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACpDE,OAAO;QACPC,YAAY;QACZT;IACF,EAAC,EACDU,IAAI,CAAC,EAAE;IAET,IAAI,CAACb,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;IACzCR,KAAKc,SAAS,GAAGpB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMe,oBAA0C,OAAO,EAC5DC,OAAO,EACPxB,YAAY,KAAK,EACjBC,OAAO,EACPC,eAAe,WAAW,EAC3B;IACC,IAAI;QACF,MAAMuB,QAAQ3B,WAAW;YAAE0B;YAASvB;QAAQ;QAE5C,IAAI,CAACwB,OAAO;YACV,IAAID,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,MAAMmB,YAAY,IAAIC,cAAcC,MAAM,CAAC5B,QAAQ6B,MAAM;QACzD,MAAM,EAAE7B,SAAS8B,cAAc,EAAE,GAAG,MAAMlC,UAAoB4B,OAAOE;QACrE,MAAMlB,aAAaR,QAAQS,WAAW,CAACqB,eAAetB,UAAU,CAAC;QAEjE,MAAMD,OAAQ,MAAMP,QAAQ+B,QAAQ,CAAC;YACnCC,IAAIF,eAAeE,EAAE;YACrBxB,YAAYsB,eAAetB,UAAU;YACrCQ,OAAOjB,YAAY,IAAIS,WAAYN,MAAM,CAACe,IAAI,CAACD,KAAK;QACtD;QAEA,IAAIT,QAAS,CAAA,CAACC,WAAYN,MAAM,CAACe,IAAI,CAACgB,MAAM,IAAI1B,KAAK2B,SAAS,AAAD,GAAI;YAC/D,IAAI1B,WAAYN,MAAM,CAACe,IAAI,CAACkB,WAAW,EAAE;gBACvC,MAAMC,kBAAkB,AAAC7B,CAAAA,KAAK8B,QAAQ,IAAI,EAAE,AAAD,EAAGvB,IAAI,CAAC,CAAC,EAAEkB,EAAE,EAAE,GAAKA,OAAOF,eAAeQ,GAAG;gBAExF,IAAI,CAACF,mBAAmB,CAACN,eAAeQ,GAAG,EAAE;oBAC3C,OAAO;wBACL/B,MAAM;oBACR;gBACF;gBAEAA,KAAKgC,IAAI,GAAGT,eAAeQ,GAAG;YAChC;YAEA/B,KAAKC,UAAU,GAAGA,WAAYN,MAAM,CAACa,IAAI;YACzCR,KAAKc,SAAS,GAAGpB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIgB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAM3B,UAAU;oBAAEC;oBAAWC;oBAASC;gBAAa;YAC5D;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAOiC,QAAQ;QACf,IAAIjB,QAAQE,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAM3B,UAAU;gBAAEC;gBAAWC;gBAASC;YAAa;QAC5D;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/jwt.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\n\nimport type { Payload, PayloadRequest, Where } from '../../types/index.js'\nimport type { AuthStrategyFunction, AuthStrategyResult } from '../index.js'\n\nimport { extractJWT } from '../extractJWT.js'\nimport { JWT_AUTH_VERSION } from '../jwtAuth.js'\n\ntype DecodedJWTPayload = Record<string, unknown>\n\ntype JWTAuthenticationReference = {\n  collection: string\n  id: number | string\n  sid?: string\n}\n\nconst getJWTAuthenticationReference = (\n  token: DecodedJWTPayload,\n): JWTAuthenticationReference | null => {\n  const { id, collection, sid } = token\n\n  if (\n    typeof collection !== 'string' ||\n    (typeof id !== 'number' && typeof id !== 'string') ||\n    (typeof sid !== 'undefined' && typeof sid !== 'string')\n  ) {\n    return null\n  }\n\n  return {\n    id,\n    collection,\n    ...(sid ? { sid } : {}),\n  }\n}\n\n/**\n * Verifies a token against every secret in the keyring (active first), so tokens\n * signed under a previous secret still validate during a bounded rotation.\n * Throws if no key verifies.\n */\nasync function verifyWithKeyring({ payload, token }: { payload: Payload; token: string }) {\n  let lastError: unknown\n  for (const key of payload.encryptionKeyring.all) {\n    try {\n      return await jwtVerify<DecodedJWTPayload>(token, new TextEncoder().encode(key.legacyKey))\n    } catch (error) {\n      lastError = error\n    }\n  }\n  throw lastError\n}\n\nasync function autoLogin({\n  fallbackLocale,\n  isGraphQL,\n  locale,\n  payload,\n  req,\n  strategyName = 'local-jwt',\n}: {\n  fallbackLocale?: PayloadRequest['fallbackLocale']\n  isGraphQL: boolean\n  locale?: PayloadRequest['locale']\n  payload: Payload\n  req?: PayloadRequest\n  strategyName?: string\n}): Promise<{\n  user: AuthStrategyResult['user']\n}> {\n  if (\n    typeof payload?.config?.admin?.autoLogin !== 'object' ||\n    payload.config.admin?.autoLogin.prefillOnly ||\n    !payload?.config?.admin?.autoLogin ||\n    (!payload.config.admin?.autoLogin.email && !payload.config.admin?.autoLogin.username)\n  ) {\n    return { user: null }\n  }\n\n  const collection = payload.collections[payload.config.admin.user]\n\n  const where: Where = {\n    or: [],\n  }\n  if (payload.config.admin?.autoLogin.email) {\n    where.or?.push({\n      email: {\n        equals: payload.config.admin?.autoLogin.email,\n      },\n    })\n  } else if (payload.config.admin?.autoLogin.username) {\n    where.or?.push({\n      username: {\n        equals: payload.config.admin?.autoLogin.username,\n      },\n    })\n  }\n\n  const user = (\n    await payload.find({\n      collection: collection!.config.slug,\n      depth: isGraphQL ? 0 : collection!.config.auth.depth,\n      fallbackLocale,\n      limit: 1,\n      locale,\n      overrideAccess: true,\n      pagination: false,\n      req,\n      where,\n    })\n  ).docs[0] as AuthStrategyResult['user']\n\n  if (!user) {\n    return { user: null }\n  }\n  user.collection = collection!.config.slug\n  user._strategy = strategyName\n\n  return {\n    user,\n  }\n}\n\n/**\n * Authentication strategy function for JWT tokens\n */\nexport const JWTAuthentication: AuthStrategyFunction = async ({\n  headers,\n  isGraphQL = false,\n  payload,\n  req,\n  strategyName = 'local-jwt',\n}) => {\n  const requestFallbackLocale = req?.fallbackLocale\n  const requestLocale = req?.locale\n  const requestDepth = req?.query?.depth\n\n  try {\n    const token = extractJWT({ headers, payload })\n\n    if (!token) {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({\n          fallbackLocale: requestFallbackLocale,\n          isGraphQL,\n          locale: requestLocale,\n          payload,\n          req,\n          strategyName,\n        })\n      }\n      return { user: null }\n    }\n\n    // Verify against every keyring secret so tokens signed under a previous\n    // secret still validate during a bounded rotation. New tokens are always\n    // signed with the active secret.\n    const { payload: decodedPayload, protectedHeader } = await verifyWithKeyring({ payload, token })\n\n    if (protectedHeader.authVersion !== JWT_AUTH_VERSION) {\n      throw new Error('Invalid JWT protected header')\n    }\n\n    const authenticationReference = getJWTAuthenticationReference(decodedPayload)\n\n    if (!authenticationReference) {\n      throw new Error('Invalid JWT authentication reference')\n    }\n\n    const collection = Object.prototype.hasOwnProperty.call(\n      payload.collections,\n      authenticationReference.collection,\n    )\n      ? payload.collections[authenticationReference.collection]\n      : undefined\n\n    if (!collection?.config.auth || collection.config.auth.disableLocalStrategy) {\n      throw new Error('JWT authentication requires an auth-enabled local collection')\n    }\n\n    const user = (await payload.findByID({\n      id: authenticationReference.id,\n      collection: authenticationReference.collection,\n      depth: isGraphQL ? 0 : collection.config.auth.depth,\n      fallbackLocale: requestFallbackLocale,\n      locale: requestLocale,\n      overrideAccess: true,\n      req,\n    })) as AuthStrategyResult['user']\n\n    if (user && (!collection.config.auth.verify || user._verified)) {\n      if (collection.config.auth.useSessions) {\n        const existingSession = (user.sessions || []).find(\n          ({ id }) => id === authenticationReference.sid,\n        )\n\n        if (!existingSession || !authenticationReference.sid) {\n          return {\n            user: null,\n          }\n        }\n\n        user._sid = authenticationReference.sid\n      }\n\n      user.collection = collection.config.slug\n      user._strategy = strategyName\n      return {\n        user,\n      }\n    } else {\n      if (headers.get('DisableAutologin') !== 'true') {\n        return await autoLogin({\n          fallbackLocale: requestFallbackLocale,\n          isGraphQL,\n          locale: requestLocale,\n          payload,\n          req,\n          strategyName,\n        })\n      }\n      return { user: null }\n    }\n  } catch (ignore) {\n    if (headers.get('DisableAutologin') !== 'true') {\n      return await autoLogin({\n        fallbackLocale: requestFallbackLocale,\n        isGraphQL,\n        locale: requestLocale,\n        payload,\n        req,\n        strategyName,\n      })\n    }\n    return { user: null }\n  } finally {\n    if (req) {\n      req.fallbackLocale = requestFallbackLocale!\n      req.locale = requestLocale!\n\n      if (req.query) {\n        req.query.depth = requestDepth\n      }\n    }\n  }\n}\n"],"names":["jwtVerify","extractJWT","JWT_AUTH_VERSION","getJWTAuthenticationReference","token","id","collection","sid","verifyWithKeyring","payload","lastError","key","encryptionKeyring","all","TextEncoder","encode","legacyKey","error","autoLogin","fallbackLocale","isGraphQL","locale","req","strategyName","config","admin","prefillOnly","email","username","user","collections","where","or","push","equals","find","slug","depth","auth","limit","overrideAccess","pagination","docs","_strategy","JWTAuthentication","headers","requestFallbackLocale","requestLocale","requestDepth","query","get","decodedPayload","protectedHeader","authVersion","Error","authenticationReference","Object","prototype","hasOwnProperty","call","undefined","disableLocalStrategy","findByID","verify","_verified","useSessions","existingSession","sessions","_sid","ignore"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAKhC,SAASC,UAAU,QAAQ,mBAAkB;AAC7C,SAASC,gBAAgB,QAAQ,gBAAe;AAUhD,MAAMC,gCAAgC,CACpCC;IAEA,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAEC,GAAG,EAAE,GAAGH;IAEhC,IACE,OAAOE,eAAe,YACrB,OAAOD,OAAO,YAAY,OAAOA,OAAO,YACxC,OAAOE,QAAQ,eAAe,OAAOA,QAAQ,UAC9C;QACA,OAAO;IACT;IAEA,OAAO;QACLF;QACAC;QACA,GAAIC,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;AACF;AAEA;;;;CAIC,GACD,eAAeC,kBAAkB,EAAEC,OAAO,EAAEL,KAAK,EAAuC;IACtF,IAAIM;IACJ,KAAK,MAAMC,OAAOF,QAAQG,iBAAiB,CAACC,GAAG,CAAE;QAC/C,IAAI;YACF,OAAO,MAAMb,UAA6BI,OAAO,IAAIU,cAAcC,MAAM,CAACJ,IAAIK,SAAS;QACzF,EAAE,OAAOC,OAAO;YACdP,YAAYO;QACd;IACF;IACA,MAAMP;AACR;AAEA,eAAeQ,UAAU,EACvBC,cAAc,EACdC,SAAS,EACTC,MAAM,EACNZ,OAAO,EACPa,GAAG,EACHC,eAAe,WAAW,EAQ3B;IAGC,IACE,OAAOd,SAASe,QAAQC,OAAOP,cAAc,YAC7CT,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUQ,eAChC,CAACjB,SAASe,QAAQC,OAAOP,aACxB,CAACT,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUS,SAAS,CAAClB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUU,UAC5E;QACA,OAAO;YAAEC,MAAM;QAAK;IACtB;IAEA,MAAMvB,aAAaG,QAAQqB,WAAW,CAACrB,QAAQe,MAAM,CAACC,KAAK,CAACI,IAAI,CAAC;IAEjE,MAAME,QAAe;QACnBC,IAAI,EAAE;IACR;IACA,IAAIvB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUS,OAAO;QACzCI,MAAMC,EAAE,EAAEC,KAAK;YACbN,OAAO;gBACLO,QAAQzB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUS;YAC1C;QACF;IACF,OAAO,IAAIlB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUU,UAAU;QACnDG,MAAMC,EAAE,EAAEC,KAAK;YACbL,UAAU;gBACRM,QAAQzB,QAAQe,MAAM,CAACC,KAAK,EAAEP,UAAUU;YAC1C;QACF;IACF;IAEA,MAAMC,OAAO,AACX,CAAA,MAAMpB,QAAQ0B,IAAI,CAAC;QACjB7B,YAAYA,WAAYkB,MAAM,CAACY,IAAI;QACnCC,OAAOjB,YAAY,IAAId,WAAYkB,MAAM,CAACc,IAAI,CAACD,KAAK;QACpDlB;QACAoB,OAAO;QACPlB;QACAmB,gBAAgB;QAChBC,YAAY;QACZnB;QACAS;IACF,EAAC,EACDW,IAAI,CAAC,EAAE;IAET,IAAI,CAACb,MAAM;QACT,OAAO;YAAEA,MAAM;QAAK;IACtB;IACAA,KAAKvB,UAAU,GAAGA,WAAYkB,MAAM,CAACY,IAAI;IACzCP,KAAKc,SAAS,GAAGpB;IAEjB,OAAO;QACLM;IACF;AACF;AAEA;;CAEC,GACD,OAAO,MAAMe,oBAA0C,OAAO,EAC5DC,OAAO,EACPzB,YAAY,KAAK,EACjBX,OAAO,EACPa,GAAG,EACHC,eAAe,WAAW,EAC3B;IACC,MAAMuB,wBAAwBxB,KAAKH;IACnC,MAAM4B,gBAAgBzB,KAAKD;IAC3B,MAAM2B,eAAe1B,KAAK2B,OAAOZ;IAEjC,IAAI;QACF,MAAMjC,QAAQH,WAAW;YAAE4C;YAASpC;QAAQ;QAE5C,IAAI,CAACL,OAAO;YACV,IAAIyC,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMhC,UAAU;oBACrBC,gBAAgB2B;oBAChB1B;oBACAC,QAAQ0B;oBACRtC;oBACAa;oBACAC;gBACF;YACF;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;QAEA,wEAAwE;QACxE,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,EAAEpB,SAAS0C,cAAc,EAAEC,eAAe,EAAE,GAAG,MAAM5C,kBAAkB;YAAEC;YAASL;QAAM;QAE9F,IAAIgD,gBAAgBC,WAAW,KAAKnD,kBAAkB;YACpD,MAAM,IAAIoD,MAAM;QAClB;QAEA,MAAMC,0BAA0BpD,8BAA8BgD;QAE9D,IAAI,CAACI,yBAAyB;YAC5B,MAAM,IAAID,MAAM;QAClB;QAEA,MAAMhD,aAAakD,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CACrDlD,QAAQqB,WAAW,EACnByB,wBAAwBjD,UAAU,IAEhCG,QAAQqB,WAAW,CAACyB,wBAAwBjD,UAAU,CAAC,GACvDsD;QAEJ,IAAI,CAACtD,YAAYkB,OAAOc,QAAQhC,WAAWkB,MAAM,CAACc,IAAI,CAACuB,oBAAoB,EAAE;YAC3E,MAAM,IAAIP,MAAM;QAClB;QAEA,MAAMzB,OAAQ,MAAMpB,QAAQqD,QAAQ,CAAC;YACnCzD,IAAIkD,wBAAwBlD,EAAE;YAC9BC,YAAYiD,wBAAwBjD,UAAU;YAC9C+B,OAAOjB,YAAY,IAAId,WAAWkB,MAAM,CAACc,IAAI,CAACD,KAAK;YACnDlB,gBAAgB2B;YAChBzB,QAAQ0B;YACRP,gBAAgB;YAChBlB;QACF;QAEA,IAAIO,QAAS,CAAA,CAACvB,WAAWkB,MAAM,CAACc,IAAI,CAACyB,MAAM,IAAIlC,KAAKmC,SAAS,AAAD,GAAI;YAC9D,IAAI1D,WAAWkB,MAAM,CAACc,IAAI,CAAC2B,WAAW,EAAE;gBACtC,MAAMC,kBAAkB,AAACrC,CAAAA,KAAKsC,QAAQ,IAAI,EAAE,AAAD,EAAGhC,IAAI,CAChD,CAAC,EAAE9B,EAAE,EAAE,GAAKA,OAAOkD,wBAAwBhD,GAAG;gBAGhD,IAAI,CAAC2D,mBAAmB,CAACX,wBAAwBhD,GAAG,EAAE;oBACpD,OAAO;wBACLsB,MAAM;oBACR;gBACF;gBAEAA,KAAKuC,IAAI,GAAGb,wBAAwBhD,GAAG;YACzC;YAEAsB,KAAKvB,UAAU,GAAGA,WAAWkB,MAAM,CAACY,IAAI;YACxCP,KAAKc,SAAS,GAAGpB;YACjB,OAAO;gBACLM;YACF;QACF,OAAO;YACL,IAAIgB,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;gBAC9C,OAAO,MAAMhC,UAAU;oBACrBC,gBAAgB2B;oBAChB1B;oBACAC,QAAQ0B;oBACRtC;oBACAa;oBACAC;gBACF;YACF;YACA,OAAO;gBAAEM,MAAM;YAAK;QACtB;IACF,EAAE,OAAOwC,QAAQ;QACf,IAAIxB,QAAQK,GAAG,CAAC,wBAAwB,QAAQ;YAC9C,OAAO,MAAMhC,UAAU;gBACrBC,gBAAgB2B;gBAChB1B;gBACAC,QAAQ0B;gBACRtC;gBACAa;gBACAC;YACF;QACF;QACA,OAAO;YAAEM,MAAM;QAAK;IACtB,SAAU;QACR,IAAIP,KAAK;YACPA,IAAIH,cAAc,GAAG2B;YACrBxB,IAAID,MAAM,GAAG0B;YAEb,IAAIzB,IAAI2B,KAAK,EAAE;gBACb3B,IAAI2B,KAAK,CAACZ,KAAK,GAAGW;YACpB;QACF;IACF;AACF,EAAC"}