payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/database/queryValidation/validateSearchParams.js

@@ -1,12 +1,14 @@
 import { fieldAffectsData } from '../../fields/config/types.js';
-import { SAFE_FIELD_PATH_REGEX } from '../../types/constants.js';
+import { hasManyRelationshipOperatorSet, SAFE_FIELD_PATH_REGEX } from '../../types/constants.js';
 import { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js';
 import { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js';
 import { getLocalizedPaths } from '../getLocalizedPaths.js';
+import { isNestedRelationshipQuery } from '../isNestedRelationshipQuery.js';
+import { prefixWherePaths } from '../prefixWherePaths.js';
 import { validateQueryPaths } from './validateQueryPaths.js';
 /**
  * Validate the Payload key / value / operator
- */ export async function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, val, versionFields }) {
+ */ export async function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, showHiddenFields, val, versionFields }) {
     // Replace GraphQL nested field double underscore formatting
     let sanitizedPath;
     if (incomingPath === '_id') {
@@ -38,10 +40,37 @@ import { validateQueryPaths } from './validateQueryPaths.js';
             locale: req.locale,
             overrideAccess,
             parentIsLocalized,
-            payload: req.payload
+            payload: req.payload,
+            showHiddenFields
         });
     }
     const promises = [];
+    const relationshipField = paths.length === 1 ? paths[0]?.field : undefined;
+    const hasNestedWhere = isNestedRelationshipQuery(val);
+    const relatedCollectionSlug = relationshipField && (relationshipField.type === 'relationship' || relationshipField.type === 'upload') && relationshipField.hasMany && typeof relationshipField.relationTo === 'string' ? relationshipField.relationTo : undefined;
+    const isNestedHasManyQuery = hasManyRelationshipOperatorSet.has(operator) && hasNestedWhere && Boolean(relatedCollectionSlug);
+    if (operator === 'like' || operator === 'not_like' || operator === 'contains') {
+        const isLegitimateNestedContains = operator === 'contains' && isNestedHasManyQuery;
+        const containsPlainObject = hasNestedWhere || Array.isArray(val) && val.some((entry)=>isNestedRelationshipQuery(entry));
+        if (containsPlainObject && !isLegitimateNestedContains) {
+            errors.push({
+                path: incomingPath
+            });
+            return;
+        }
+    }
+    if (isNestedHasManyQuery && relatedCollectionSlug) {
+        // Validate the nested query against the related collection.
+        promises.push(validateQueryPaths({
+            collectionConfig: req.payload.collections[relatedCollectionSlug].config,
+            errors,
+            overrideAccess,
+            policies,
+            req,
+            showHiddenFields,
+            where: val
+        }));
+    }
     // Sanitize relation.otherRelation.id to relation.otherRelation
     if (paths.at(-1)?.path === 'id') {
         const previousField = paths.at(-2)?.field;
@@ -51,7 +80,8 @@ import { validateQueryPaths } from './validateQueryPaths.js';
     }
     promises.push(...paths.map(async ({ collectionSlug, field, invalid, path }, i)=>{
         if (invalid) {
-            if (!polymorphicJoin || !SAFE_FIELD_PATH_REGEX.test(incomingPath)) {
+            const isUnknownPolymorphicJoinField = polymorphicJoin && !field && SAFE_FIELD_PATH_REGEX.test(incomingPath);
+            if (!isUnknownPolymorphicJoinField) {
                 errors.push({
                     path
                 });
@@ -60,8 +90,9 @@ import { validateQueryPaths } from './validateQueryPaths.js';
         }
         // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}
         if (field.type === 'join' && path === incomingPath) {
-            constraint[`${path}.id`] = constraint[path];
-            delete constraint[path];
+            const mutableConstraint = constraint;
+            mutableConstraint[`${path}.id`] = mutableConstraint[path];
+            delete mutableConstraint[path];
         }
         if ('virtual' in field && field.virtual) {
             if (field.virtual === true) {
@@ -95,6 +126,55 @@ import { validateQueryPaths } from './validateQueryPaths.js';
                         path: incomingPath
                     });
                 }
+                const relatedCollectionReadPermission = policies.collections[collectionSlug].read;
+                const previousSegment = paths[i - 1];
+                const traversedField = previousSegment?.field;
+                const isRelationshipHop = Boolean(traversedField) && (traversedField.type === 'relationship' || traversedField.type === 'upload' || traversedField.type === 'join');
+                if (isRelationshipHop && relatedCollectionReadPermission && typeof relatedCollectionReadPermission === 'object' && relatedCollectionReadPermission.where) {
+                    const relationshipPath = paths.slice(0, i).map(({ path: pathToRelationship })=>pathToRelationship).join('.');
+                    const mutableWhere = constraint;
+                    const existingAnd = Array.isArray(mutableWhere.and) ? mutableWhere.and : [];
+                    // Has-many relationships and joins can point to many related documents, so the user's
+                    // filter and the access constraint must be satisfied by the SAME related document.
+                    // Scoping both into a single `contains` prevents a different, readable document from
+                    // masking one the user cannot read (a related-document oracle).
+                    const isHasManyRelationship = (traversedField.type === 'relationship' || traversedField.type === 'upload') && traversedField.hasMany;
+                    const isJoin = traversedField.type === 'join';
+                    if (isHasManyRelationship || isJoin) {
+                        const relatedFieldPath = paths.at(-1)?.path;
+                        if (relatedFieldPath) {
+                            mutableWhere.and = [
+                                ...existingAnd,
+                                {
+                                    [relationshipPath]: {
+                                        contains: {
+                                            and: [
+                                                {
+                                                    [relatedFieldPath]: {
+                                                        [operator]: val
+                                                    }
+                                                },
+                                                relatedCollectionReadPermission.where
+                                            ]
+                                        }
+                                    }
+                                }
+                            ];
+                            // The scoped `contains` above fully replaces the user's original filter;
+                            // so we can remove it from the top-level where clause
+                            delete mutableWhere[incomingPath];
+                        }
+                    } else {
+                        const accessWhere = prefixWherePaths({
+                            prefix: relationshipPath,
+                            where: relatedCollectionReadPermission.where
+                        });
+                        mutableWhere.and = [
+                            ...existingAnd,
+                            accessWhere
+                        ];
+                    }
+                }
             }
             let fieldPath = path;
             // remove locale from end of path
@@ -134,7 +214,7 @@ import { validateQueryPaths } from './validateQueryPaths.js';
                 }
             }
         }
-        if (i > 1) {
+        if (!isNestedHasManyQuery && i > 1) {
             // Remove top collection and reverse array
             // to work backwards from top
             const pathsToQuery = paths.slice(1).reverse();
@@ -149,6 +229,7 @@ import { validateQueryPaths } from './validateQueryPaths.js';
                         overrideAccess,
                         policies,
                         req,
+                        showHiddenFields,
                         where: {
                             [subPath]: {
                                 [operator]: val

package/dist/database/queryValidation/validateSearchParams.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { PayloadRequest, WhereField } from '../../types/index.js'\nimport type { EntityPolicies, PathToQuery } from './types.js'\n\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { SAFE_FIELD_PATH_REGEX } from '../../types/constants.js'\nimport { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js'\nimport { getLocalizedPaths } from '../getLocalizedPaths.js'\nimport { validateQueryPaths } from './validateQueryPaths.js'\n\ntype Args = {\n  collectionConfig?: SanitizedCollectionConfig\n  constraint: WhereField\n  errors: { path: string }[]\n  fields: FlattenedField[]\n  globalConfig?: SanitizedGlobalConfig\n  operator: string\n  overrideAccess: boolean\n  parentIsLocalized?: boolean\n  path: string\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  val: unknown\n  versionFields?: FlattenedField[]\n}\n\n/**\n * Validate the Payload key / value / operator\n */\nexport async function validateSearchParam({\n  collectionConfig,\n  constraint,\n  errors,\n  fields,\n  globalConfig,\n  operator,\n  overrideAccess,\n  parentIsLocalized,\n  path: incomingPath,\n  policies,\n  polymorphicJoin,\n  req,\n  val,\n  versionFields,\n}: Args): Promise<void> {\n  // Replace GraphQL nested field double underscore formatting\n  let sanitizedPath\n  if (incomingPath === '_id') {\n    sanitizedPath = 'id'\n  } else {\n    sanitizedPath = incomingPath.replace(/__/g, '.')\n  }\n  let paths: PathToQuery[] = []\n  const { slug } = (collectionConfig || globalConfig)!\n\n  const blockReferencesPermissions = {}\n\n  if (globalConfig && !policies.globals![slug]) {\n    policies.globals![slug] = await getEntityPermissions({\n      blockReferencesPermissions,\n      entity: globalConfig,\n      entityType: 'global',\n      fetchData: false,\n      operations: ['read'],\n      req,\n    })\n  }\n\n  if (sanitizedPath !== 'id') {\n    paths = getLocalizedPaths({\n      collectionSlug: collectionConfig?.slug,\n      fields,\n      globalSlug: globalConfig?.slug,\n      incomingPath: sanitizedPath,\n      locale: req.locale!,\n      overrideAccess,\n      parentIsLocalized,\n      payload: req.payload,\n    })\n  }\n  const promises: Promise<void>[] = []\n\n  // Sanitize relation.otherRelation.id to relation.otherRelation\n  if (paths.at(-1)?.path === 'id') {\n    const previousField = paths.at(-2)?.field\n    if (\n      previousField &&\n      (previousField.type === 'relationship' || previousField.type === 'upload') &&\n      typeof previousField.relationTo === 'string'\n    ) {\n      paths.pop()\n    }\n  }\n\n  promises.push(\n    ...paths.map(async ({ collectionSlug, field, invalid, path }, i) => {\n      if (invalid) {\n        if (!polymorphicJoin || !SAFE_FIELD_PATH_REGEX.test(incomingPath)) {\n          errors.push({ path })\n        }\n\n        return\n      }\n\n      // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}\n      if (field.type === 'join' && path === incomingPath) {\n        constraint[`${path}.id` as keyof WhereField] = constraint[path as keyof WhereField]\n        delete constraint[path as keyof WhereField]\n      }\n\n      if ('virtual' in field && field.virtual) {\n        if (field.virtual === true) {\n          errors.push({ path })\n        }\n      }\n\n      if (polymorphicJoin && path === 'relationTo') {\n        return\n      }\n\n      if (!overrideAccess && fieldAffectsData(field)) {\n        if (collectionSlug) {\n          if (!policies.collections![collectionSlug]) {\n            policies.collections![collectionSlug] = await getEntityPermissions({\n              blockReferencesPermissions,\n              entity: req.payload.collections[collectionSlug]!.config,\n              entityType: 'collection',\n              fetchData: false,\n              operations: ['read'],\n              req: isolateObjectProperty(req, 'transactionID'),\n            })\n          }\n\n          if (\n            ['hash', 'salt'].includes(incomingPath) &&\n            collectionConfig!.auth &&\n            !collectionConfig!.auth?.disableLocalStrategy\n          ) {\n            errors.push({ path: incomingPath })\n          }\n        }\n        let fieldPath = path\n        // remove locale from end of path\n        if (path.endsWith(`.${req.locale}`)) {\n          fieldPath = path.slice(0, -(req.locale!.length + 1))\n        }\n        // remove \".value\" from ends of polymorphic relationship paths\n        if (\n          (field.type === 'relationship' || field.type === 'upload') &&\n          Array.isArray(field.relationTo)\n        ) {\n          fieldPath = fieldPath.replace('.value', '')\n        }\n\n        const entityType: 'collections' | 'globals' = globalConfig ? 'globals' : 'collections'\n        const entitySlug = collectionSlug || globalConfig!.slug\n        const segments = fieldPath.split('.')\n\n        let fieldAccess: any\n\n        if (versionFields) {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n\n          if (\n            segments[0] === 'parent' ||\n            segments[0] === 'version' ||\n            segments[0] === 'snapshot' ||\n            segments[0] === 'latest'\n          ) {\n            segments.shift()\n          }\n        } else {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n        }\n\n        if (segments.length) {\n          segments.forEach((segment) => {\n            if (fieldAccess[segment]) {\n              if ('fields' in fieldAccess[segment]) {\n                fieldAccess = fieldAccess[segment].fields\n              } else {\n                fieldAccess = fieldAccess[segment]\n              }\n            }\n          })\n\n          if (!fieldAccess?.read?.permission) {\n            errors.push({ path: fieldPath })\n          }\n        }\n      }\n\n      if (i > 1) {\n        // Remove top collection and reverse array\n        // to work backwards from top\n        const pathsToQuery = paths.slice(1).reverse()\n\n        pathsToQuery.forEach(\n          ({ collectionSlug: pathCollectionSlug, path: subPath }, pathToQueryIndex) => {\n            // On the \"deepest\" collection,\n            // validate query of the relationship\n            if (pathToQueryIndex === 0) {\n              promises.push(\n                validateQueryPaths({\n                  collectionConfig: req.payload.collections[pathCollectionSlug!]!.config,\n                  errors,\n                  globalConfig: undefined,\n                  overrideAccess,\n                  policies,\n                  req,\n                  where: {\n                    [subPath]: {\n                      [operator]: val,\n                    },\n                  },\n                }),\n              )\n            }\n          },\n        )\n      }\n    }),\n  )\n  await Promise.all(promises)\n}\n"],"names":["fieldAffectsData","SAFE_FIELD_PATH_REGEX","getEntityPermissions","isolateObjectProperty","getLocalizedPaths","validateQueryPaths","validateSearchParam","collectionConfig","constraint","errors","fields","globalConfig","operator","overrideAccess","parentIsLocalized","path","incomingPath","policies","polymorphicJoin","req","val","versionFields","sanitizedPath","replace","paths","slug","blockReferencesPermissions","globals","entity","entityType","fetchData","operations","collectionSlug","globalSlug","locale","payload","promises","at","previousField","field","type","relationTo","pop","push","map","invalid","i","test","virtual","collections","config","includes","auth","disableLocalStrategy","fieldPath","endsWith","slice","length","Array","isArray","entitySlug","segments","split","fieldAccess","shift","forEach","segment","read","permission","pathsToQuery","reverse","pathCollectionSlug","subPath","pathToQueryIndex","undefined","where","Promise","all"],"mappings":"AAMA,SAASA,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,qBAAqB,QAAQ,2BAA0B;AAChE,SAASC,oBAAoB,QAAQ,+DAA8D;AACnG,SAASC,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,iBAAiB,QAAQ,0BAAyB;AAC3D,SAASC,kBAAkB,QAAQ,0BAAyB;AAoB5D;;CAEC,GACD,OAAO,eAAeC,oBAAoB,EACxCC,gBAAgB,EAChBC,UAAU,EACVC,MAAM,EACNC,MAAM,EACNC,YAAY,EACZC,QAAQ,EACRC,cAAc,EACdC,iBAAiB,EACjBC,MAAMC,YAAY,EAClBC,QAAQ,EACRC,eAAe,EACfC,GAAG,EACHC,GAAG,EACHC,aAAa,EACR;IACL,4DAA4D;IAC5D,IAAIC;IACJ,IAAIN,iBAAiB,OAAO;QAC1BM,gBAAgB;IAClB,OAAO;QACLA,gBAAgBN,aAAaO,OAAO,CAAC,OAAO;IAC9C;IACA,IAAIC,QAAuB,EAAE;IAC7B,MAAM,EAAEC,IAAI,EAAE,GAAIlB,oBAAoBI;IAEtC,MAAMe,6BAA6B,CAAC;IAEpC,IAAIf,gBAAgB,CAACM,SAASU,OAAO,AAAC,CAACF,KAAK,EAAE;QAC5CR,SAASU,OAAO,AAAC,CAACF,KAAK,GAAG,MAAMvB,qBAAqB;YACnDwB;YACAE,QAAQjB;YACRkB,YAAY;YACZC,WAAW;YACXC,YAAY;gBAAC;aAAO;YACpBZ;QACF;IACF;IAEA,IAAIG,kBAAkB,MAAM;QAC1BE,QAAQpB,kBAAkB;YACxB4B,gBAAgBzB,kBAAkBkB;YAClCf;YACAuB,YAAYtB,cAAcc;YAC1BT,cAAcM;YACdY,QAAQf,IAAIe,MAAM;YAClBrB;YACAC;YACAqB,SAAShB,IAAIgB,OAAO;QACtB;IACF;IACA,MAAMC,WAA4B,EAAE;IAEpC,+DAA+D;IAC/D,IAAIZ,MAAMa,EAAE,CAAC,CAAC,IAAItB,SAAS,MAAM;QAC/B,MAAMuB,gBAAgBd,MAAMa,EAAE,CAAC,CAAC,IAAIE;QACpC,IACED,iBACCA,CAAAA,cAAcE,IAAI,KAAK,kBAAkBF,cAAcE,IAAI,KAAK,QAAO,KACxE,OAAOF,cAAcG,UAAU,KAAK,UACpC;YACAjB,MAAMkB,GAAG;QACX;IACF;IAEAN,SAASO,IAAI,IACRnB,MAAMoB,GAAG,CAAC,OAAO,EAAEZ,cAAc,EAAEO,KAAK,EAAEM,OAAO,EAAE9B,IAAI,EAAE,EAAE+B;QAC5D,IAAID,SAAS;YACX,IAAI,CAAC3B,mBAAmB,CAACjB,sBAAsB8C,IAAI,CAAC/B,eAAe;gBACjEP,OAAOkC,IAAI,CAAC;oBAAE5B;gBAAK;YACrB;YAEA;QACF;QAEA,6EAA6E;QAC7E,IAAIwB,MAAMC,IAAI,KAAK,UAAUzB,SAASC,cAAc;YAClDR,UAAU,CAAC,GAAGO,KAAK,GAAG,CAAC,CAAqB,GAAGP,UAAU,CAACO,KAAyB;YACnF,OAAOP,UAAU,CAACO,KAAyB;QAC7C;QAEA,IAAI,aAAawB,SAASA,MAAMS,OAAO,EAAE;YACvC,IAAIT,MAAMS,OAAO,KAAK,MAAM;gBAC1BvC,OAAOkC,IAAI,CAAC;oBAAE5B;gBAAK;YACrB;QACF;QAEA,IAAIG,mBAAmBH,SAAS,cAAc;YAC5C;QACF;QAEA,IAAI,CAACF,kBAAkBb,iBAAiBuC,QAAQ;YAC9C,IAAIP,gBAAgB;gBAClB,IAAI,CAACf,SAASgC,WAAW,AAAC,CAACjB,eAAe,EAAE;oBAC1Cf,SAASgC,WAAW,AAAC,CAACjB,eAAe,GAAG,MAAM9B,qBAAqB;wBACjEwB;wBACAE,QAAQT,IAAIgB,OAAO,CAACc,WAAW,CAACjB,eAAe,CAAEkB,MAAM;wBACvDrB,YAAY;wBACZC,WAAW;wBACXC,YAAY;4BAAC;yBAAO;wBACpBZ,KAAKhB,sBAAsBgB,KAAK;oBAClC;gBACF;gBAEA,IACE;oBAAC;oBAAQ;iBAAO,CAACgC,QAAQ,CAACnC,iBAC1BT,iBAAkB6C,IAAI,IACtB,CAAC7C,iBAAkB6C,IAAI,EAAEC,sBACzB;oBACA5C,OAAOkC,IAAI,CAAC;wBAAE5B,MAAMC;oBAAa;gBACnC;YACF;YACA,IAAIsC,YAAYvC;YAChB,iCAAiC;YACjC,IAAIA,KAAKwC,QAAQ,CAAC,CAAC,CAAC,EAAEpC,IAAIe,MAAM,EAAE,GAAG;gBACnCoB,YAAYvC,KAAKyC,KAAK,CAAC,GAAG,CAAErC,CAAAA,IAAIe,MAAM,CAAEuB,MAAM,GAAG,CAAA;YACnD;YACA,8DAA8D;YAC9D,IACE,AAAClB,CAAAA,MAAMC,IAAI,KAAK,kBAAkBD,MAAMC,IAAI,KAAK,QAAO,KACxDkB,MAAMC,OAAO,CAACpB,MAAME,UAAU,GAC9B;gBACAa,YAAYA,UAAU/B,OAAO,CAAC,UAAU;YAC1C;YAEA,MAAMM,aAAwClB,eAAe,YAAY;YACzE,MAAMiD,aAAa5B,kBAAkBrB,aAAcc,IAAI;YACvD,MAAMoC,WAAWP,UAAUQ,KAAK,CAAC;YAEjC,IAAIC;YAEJ,IAAI1C,eAAe;gBACjB0C,cAAc9C,QAAQ,CAACY,WAAW,AAAC,CAAC+B,WAAW,CAAElD,MAAM;gBAEvD,IACEmD,QAAQ,CAAC,EAAE,KAAK,YAChBA,QAAQ,CAAC,EAAE,KAAK,aAChBA,QAAQ,CAAC,EAAE,KAAK,cAChBA,QAAQ,CAAC,EAAE,KAAK,UAChB;oBACAA,SAASG,KAAK;gBAChB;YACF,OAAO;gBACLD,cAAc9C,QAAQ,CAACY,WAAW,AAAC,CAAC+B,WAAW,CAAElD,MAAM;YACzD;YAEA,IAAImD,SAASJ,MAAM,EAAE;gBACnBI,SAASI,OAAO,CAAC,CAACC;oBAChB,IAAIH,WAAW,CAACG,QAAQ,EAAE;wBACxB,IAAI,YAAYH,WAAW,CAACG,QAAQ,EAAE;4BACpCH,cAAcA,WAAW,CAACG,QAAQ,CAACxD,MAAM;wBAC3C,OAAO;4BACLqD,cAAcA,WAAW,CAACG,QAAQ;wBACpC;oBACF;gBACF;gBAEA,IAAI,CAACH,aAAaI,MAAMC,YAAY;oBAClC3D,OAAOkC,IAAI,CAAC;wBAAE5B,MAAMuC;oBAAU;gBAChC;YACF;QACF;QAEA,IAAIR,IAAI,GAAG;YACT,0CAA0C;YAC1C,6BAA6B;YAC7B,MAAMuB,eAAe7C,MAAMgC,KAAK,CAAC,GAAGc,OAAO;YAE3CD,aAAaJ,OAAO,CAClB,CAAC,EAAEjC,gBAAgBuC,kBAAkB,EAAExD,MAAMyD,OAAO,EAAE,EAAEC;gBACtD,+BAA+B;gBAC/B,qCAAqC;gBACrC,IAAIA,qBAAqB,GAAG;oBAC1BrC,SAASO,IAAI,CACXtC,mBAAmB;wBACjBE,kBAAkBY,IAAIgB,OAAO,CAACc,WAAW,CAACsB,mBAAoB,CAAErB,MAAM;wBACtEzC;wBACAE,cAAc+D;wBACd7D;wBACAI;wBACAE;wBACAwD,OAAO;4BACL,CAACH,QAAQ,EAAE;gCACT,CAAC5D,SAAS,EAAEQ;4BACd;wBACF;oBACF;gBAEJ;YACF;QAEJ;IACF;IAEF,MAAMwD,QAAQC,GAAG,CAACzC;AACpB"}
+{"version":3,"sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { HasManyRelationshipOperator, PayloadRequest, WhereField } from '../../types/index.js'\nimport type { EntityPolicies, PathToQuery } from './types.js'\n\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { hasManyRelationshipOperatorSet, SAFE_FIELD_PATH_REGEX } from '../../types/constants.js'\nimport { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js'\nimport { getLocalizedPaths } from '../getLocalizedPaths.js'\nimport { isNestedRelationshipQuery } from '../isNestedRelationshipQuery.js'\nimport { prefixWherePaths } from '../prefixWherePaths.js'\nimport { validateQueryPaths } from './validateQueryPaths.js'\n\ntype Args = {\n  collectionConfig?: SanitizedCollectionConfig\n  constraint: WhereField\n  errors: { path: string }[]\n  fields: FlattenedField[]\n  globalConfig?: SanitizedGlobalConfig\n  operator: string\n  overrideAccess: boolean\n  parentIsLocalized?: boolean\n  path: string\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  showHiddenFields?: boolean\n  val: unknown\n  versionFields?: FlattenedField[]\n}\n\n/**\n * Validate the Payload key / value / operator\n */\nexport async function validateSearchParam({\n  collectionConfig,\n  constraint,\n  errors,\n  fields,\n  globalConfig,\n  operator,\n  overrideAccess,\n  parentIsLocalized,\n  path: incomingPath,\n  policies,\n  polymorphicJoin,\n  req,\n  showHiddenFields,\n  val,\n  versionFields,\n}: Args): Promise<void> {\n  // Replace GraphQL nested field double underscore formatting\n  let sanitizedPath\n  if (incomingPath === '_id') {\n    sanitizedPath = 'id'\n  } else {\n    sanitizedPath = incomingPath.replace(/__/g, '.')\n  }\n  let paths: PathToQuery[] = []\n  const { slug } = (collectionConfig || globalConfig)!\n\n  const blockReferencesPermissions = {}\n\n  if (globalConfig && !policies.globals![slug]) {\n    policies.globals![slug] = await getEntityPermissions({\n      blockReferencesPermissions,\n      entity: globalConfig,\n      entityType: 'global',\n      fetchData: false,\n      operations: ['read'],\n      req,\n    })\n  }\n\n  if (sanitizedPath !== 'id') {\n    paths = getLocalizedPaths({\n      collectionSlug: collectionConfig?.slug,\n      fields,\n      globalSlug: globalConfig?.slug,\n      incomingPath: sanitizedPath,\n      locale: req.locale!,\n      overrideAccess,\n      parentIsLocalized,\n      payload: req.payload,\n      showHiddenFields,\n    })\n  }\n  const promises: Promise<void>[] = []\n\n  const relationshipField = paths.length === 1 ? paths[0]?.field : undefined\n  const hasNestedWhere = isNestedRelationshipQuery(val)\n  const relatedCollectionSlug =\n    relationshipField &&\n    (relationshipField.type === 'relationship' || relationshipField.type === 'upload') &&\n    relationshipField.hasMany &&\n    typeof relationshipField.relationTo === 'string'\n      ? relationshipField.relationTo\n      : undefined\n  const isNestedHasManyQuery =\n    hasManyRelationshipOperatorSet.has(operator as HasManyRelationshipOperator) &&\n    hasNestedWhere &&\n    Boolean(relatedCollectionSlug)\n\n  if (operator === 'like' || operator === 'not_like' || operator === 'contains') {\n    const isLegitimateNestedContains = operator === 'contains' && isNestedHasManyQuery\n    const containsPlainObject =\n      hasNestedWhere ||\n      (Array.isArray(val) && val.some((entry) => isNestedRelationshipQuery(entry)))\n\n    if (containsPlainObject && !isLegitimateNestedContains) {\n      errors.push({ path: incomingPath })\n      return\n    }\n  }\n\n  if (isNestedHasManyQuery && relatedCollectionSlug) {\n    // Validate the nested query against the related collection.\n    promises.push(\n      validateQueryPaths({\n        collectionConfig: req.payload.collections[relatedCollectionSlug]!.config,\n        errors,\n        overrideAccess,\n        policies,\n        req,\n        showHiddenFields,\n        where: val,\n      }),\n    )\n  }\n\n  // Sanitize relation.otherRelation.id to relation.otherRelation\n  if (paths.at(-1)?.path === 'id') {\n    const previousField = paths.at(-2)?.field\n    if (\n      previousField &&\n      (previousField.type === 'relationship' || previousField.type === 'upload') &&\n      typeof previousField.relationTo === 'string'\n    ) {\n      paths.pop()\n    }\n  }\n\n  promises.push(\n    ...paths.map(async ({ collectionSlug, field, invalid, path }, i) => {\n      if (invalid) {\n        const isUnknownPolymorphicJoinField =\n          polymorphicJoin && !field && SAFE_FIELD_PATH_REGEX.test(incomingPath)\n\n        if (!isUnknownPolymorphicJoinField) {\n          errors.push({ path })\n        }\n\n        return\n      }\n\n      // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}\n      if (field.type === 'join' && path === incomingPath) {\n        const mutableConstraint = constraint as Record<string, unknown>\n\n        mutableConstraint[`${path}.id`] = mutableConstraint[path]\n        delete mutableConstraint[path]\n      }\n\n      if ('virtual' in field && field.virtual) {\n        if (field.virtual === true) {\n          errors.push({ path })\n        }\n      }\n\n      if (polymorphicJoin && path === 'relationTo') {\n        return\n      }\n\n      if (!overrideAccess && fieldAffectsData(field)) {\n        if (collectionSlug) {\n          if (!policies.collections![collectionSlug]) {\n            policies.collections![collectionSlug] = await getEntityPermissions({\n              blockReferencesPermissions,\n              entity: req.payload.collections[collectionSlug]!.config,\n              entityType: 'collection',\n              fetchData: false,\n              operations: ['read'],\n              req: isolateObjectProperty(req, 'transactionID'),\n            })\n          }\n\n          if (\n            ['hash', 'salt'].includes(incomingPath) &&\n            collectionConfig!.auth &&\n            !collectionConfig!.auth?.disableLocalStrategy\n          ) {\n            errors.push({ path: incomingPath })\n          }\n\n          const relatedCollectionReadPermission = policies.collections![collectionSlug].read\n          const previousSegment = paths[i - 1]\n          const traversedField = previousSegment?.field\n          const isRelationshipHop =\n            Boolean(traversedField) &&\n            (traversedField!.type === 'relationship' ||\n              traversedField!.type === 'upload' ||\n              traversedField!.type === 'join')\n\n          if (\n            isRelationshipHop &&\n            relatedCollectionReadPermission &&\n            typeof relatedCollectionReadPermission === 'object' &&\n            relatedCollectionReadPermission.where\n          ) {\n            const relationshipPath = paths\n              .slice(0, i)\n              .map(({ path: pathToRelationship }) => pathToRelationship)\n              .join('.')\n\n            const mutableWhere = constraint as Record<string, unknown>\n            const existingAnd = Array.isArray(mutableWhere.and) ? mutableWhere.and : []\n\n            // Has-many relationships and joins can point to many related documents, so the user's\n            // filter and the access constraint must be satisfied by the SAME related document.\n            // Scoping both into a single `contains` prevents a different, readable document from\n            // masking one the user cannot read (a related-document oracle).\n            const isHasManyRelationship =\n              (traversedField!.type === 'relationship' || traversedField!.type === 'upload') &&\n              traversedField!.hasMany\n            const isJoin = traversedField!.type === 'join'\n\n            if (isHasManyRelationship || isJoin) {\n              const relatedFieldPath = paths.at(-1)?.path\n\n              if (relatedFieldPath) {\n                mutableWhere.and = [\n                  ...existingAnd,\n                  {\n                    [relationshipPath]: {\n                      contains: {\n                        and: [\n                          {\n                            [relatedFieldPath]: {\n                              [operator]: val,\n                            },\n                          },\n                          relatedCollectionReadPermission.where,\n                        ],\n                      },\n                    },\n                  },\n                ]\n\n                // The scoped `contains` above fully replaces the user's original filter;\n                // so we can remove it from the top-level where clause\n                delete mutableWhere[incomingPath]\n              }\n            } else {\n              const accessWhere = prefixWherePaths({\n                prefix: relationshipPath,\n                where: relatedCollectionReadPermission.where,\n              })\n\n              mutableWhere.and = [...existingAnd, accessWhere]\n            }\n          }\n        }\n        let fieldPath = path\n        // remove locale from end of path\n        if (path.endsWith(`.${req.locale}`)) {\n          fieldPath = path.slice(0, -(req.locale!.length + 1))\n        }\n        // remove \".value\" from ends of polymorphic relationship paths\n        if (\n          (field.type === 'relationship' || field.type === 'upload') &&\n          Array.isArray(field.relationTo)\n        ) {\n          fieldPath = fieldPath.replace('.value', '')\n        }\n\n        const entityType: 'collections' | 'globals' = globalConfig ? 'globals' : 'collections'\n        const entitySlug = collectionSlug || globalConfig!.slug\n        const segments = fieldPath.split('.')\n\n        let fieldAccess: any\n\n        if (versionFields) {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n\n          if (\n            segments[0] === 'parent' ||\n            segments[0] === 'version' ||\n            segments[0] === 'snapshot' ||\n            segments[0] === 'latest'\n          ) {\n            segments.shift()\n          }\n        } else {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n        }\n\n        if (segments.length) {\n          segments.forEach((segment) => {\n            if (fieldAccess[segment]) {\n              if ('fields' in fieldAccess[segment]) {\n                fieldAccess = fieldAccess[segment].fields\n              } else {\n                fieldAccess = fieldAccess[segment]\n              }\n            }\n          })\n\n          if (!fieldAccess?.read?.permission) {\n            errors.push({ path: fieldPath })\n          }\n        }\n      }\n\n      if (!isNestedHasManyQuery && i > 1) {\n        // Remove top collection and reverse array\n        // to work backwards from top\n        const pathsToQuery = paths.slice(1).reverse()\n\n        pathsToQuery.forEach(\n          ({ collectionSlug: pathCollectionSlug, path: subPath }, pathToQueryIndex) => {\n            // On the \"deepest\" collection,\n            // validate query of the relationship\n            if (pathToQueryIndex === 0) {\n              promises.push(\n                validateQueryPaths({\n                  collectionConfig: req.payload.collections[pathCollectionSlug!]!.config,\n                  errors,\n                  globalConfig: undefined,\n                  overrideAccess,\n                  policies,\n                  req,\n                  showHiddenFields,\n                  where: {\n                    [subPath]: {\n                      [operator]: val,\n                    },\n                  },\n                }),\n              )\n            }\n          },\n        )\n      }\n    }),\n  )\n  await Promise.all(promises)\n}\n"],"names":["fieldAffectsData","hasManyRelationshipOperatorSet","SAFE_FIELD_PATH_REGEX","getEntityPermissions","isolateObjectProperty","getLocalizedPaths","isNestedRelationshipQuery","prefixWherePaths","validateQueryPaths","validateSearchParam","collectionConfig","constraint","errors","fields","globalConfig","operator","overrideAccess","parentIsLocalized","path","incomingPath","policies","polymorphicJoin","req","showHiddenFields","val","versionFields","sanitizedPath","replace","paths","slug","blockReferencesPermissions","globals","entity","entityType","fetchData","operations","collectionSlug","globalSlug","locale","payload","promises","relationshipField","length","field","undefined","hasNestedWhere","relatedCollectionSlug","type","hasMany","relationTo","isNestedHasManyQuery","has","Boolean","isLegitimateNestedContains","containsPlainObject","Array","isArray","some","entry","push","collections","config","where","at","previousField","pop","map","invalid","i","isUnknownPolymorphicJoinField","test","mutableConstraint","virtual","includes","auth","disableLocalStrategy","relatedCollectionReadPermission","read","previousSegment","traversedField","isRelationshipHop","relationshipPath","slice","pathToRelationship","join","mutableWhere","existingAnd","and","isHasManyRelationship","isJoin","relatedFieldPath","contains","accessWhere","prefix","fieldPath","endsWith","entitySlug","segments","split","fieldAccess","shift","forEach","segment","permission","pathsToQuery","reverse","pathCollectionSlug","subPath","pathToQueryIndex","Promise","all"],"mappings":"AAMA,SAASA,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,8BAA8B,EAAEC,qBAAqB,QAAQ,2BAA0B;AAChG,SAASC,oBAAoB,QAAQ,+DAA8D;AACnG,SAASC,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,iBAAiB,QAAQ,0BAAyB;AAC3D,SAASC,yBAAyB,QAAQ,kCAAiC;AAC3E,SAASC,gBAAgB,QAAQ,yBAAwB;AACzD,SAASC,kBAAkB,QAAQ,0BAAyB;AAqB5D;;CAEC,GACD,OAAO,eAAeC,oBAAoB,EACxCC,gBAAgB,EAChBC,UAAU,EACVC,MAAM,EACNC,MAAM,EACNC,YAAY,EACZC,QAAQ,EACRC,cAAc,EACdC,iBAAiB,EACjBC,MAAMC,YAAY,EAClBC,QAAQ,EACRC,eAAe,EACfC,GAAG,EACHC,gBAAgB,EAChBC,GAAG,EACHC,aAAa,EACR;IACL,4DAA4D;IAC5D,IAAIC;IACJ,IAAIP,iBAAiB,OAAO;QAC1BO,gBAAgB;IAClB,OAAO;QACLA,gBAAgBP,aAAaQ,OAAO,CAAC,OAAO;IAC9C;IACA,IAAIC,QAAuB,EAAE;IAC7B,MAAM,EAAEC,IAAI,EAAE,GAAInB,oBAAoBI;IAEtC,MAAMgB,6BAA6B,CAAC;IAEpC,IAAIhB,gBAAgB,CAACM,SAASW,OAAO,AAAC,CAACF,KAAK,EAAE;QAC5CT,SAASW,OAAO,AAAC,CAACF,KAAK,GAAG,MAAM1B,qBAAqB;YACnD2B;YACAE,QAAQlB;YACRmB,YAAY;YACZC,WAAW;YACXC,YAAY;gBAAC;aAAO;YACpBb;QACF;IACF;IAEA,IAAII,kBAAkB,MAAM;QAC1BE,QAAQvB,kBAAkB;YACxB+B,gBAAgB1B,kBAAkBmB;YAClChB;YACAwB,YAAYvB,cAAce;YAC1BV,cAAcO;YACdY,QAAQhB,IAAIgB,MAAM;YAClBtB;YACAC;YACAsB,SAASjB,IAAIiB,OAAO;YACpBhB;QACF;IACF;IACA,MAAMiB,WAA4B,EAAE;IAEpC,MAAMC,oBAAoBb,MAAMc,MAAM,KAAK,IAAId,KAAK,CAAC,EAAE,EAAEe,QAAQC;IACjE,MAAMC,iBAAiBvC,0BAA0BkB;IACjD,MAAMsB,wBACJL,qBACCA,CAAAA,kBAAkBM,IAAI,KAAK,kBAAkBN,kBAAkBM,IAAI,KAAK,QAAO,KAChFN,kBAAkBO,OAAO,IACzB,OAAOP,kBAAkBQ,UAAU,KAAK,WACpCR,kBAAkBQ,UAAU,GAC5BL;IACN,MAAMM,uBACJjD,+BAA+BkD,GAAG,CAACpC,aACnC8B,kBACAO,QAAQN;IAEV,IAAI/B,aAAa,UAAUA,aAAa,cAAcA,aAAa,YAAY;QAC7E,MAAMsC,6BAA6BtC,aAAa,cAAcmC;QAC9D,MAAMI,sBACJT,kBACCU,MAAMC,OAAO,CAAChC,QAAQA,IAAIiC,IAAI,CAAC,CAACC,QAAUpD,0BAA0BoD;QAEvE,IAAIJ,uBAAuB,CAACD,4BAA4B;YACtDzC,OAAO+C,IAAI,CAAC;gBAAEzC,MAAMC;YAAa;YACjC;QACF;IACF;IAEA,IAAI+B,wBAAwBJ,uBAAuB;QACjD,4DAA4D;QAC5DN,SAASmB,IAAI,CACXnD,mBAAmB;YACjBE,kBAAkBY,IAAIiB,OAAO,CAACqB,WAAW,CAACd,sBAAsB,CAAEe,MAAM;YACxEjD;YACAI;YACAI;YACAE;YACAC;YACAuC,OAAOtC;QACT;IAEJ;IAEA,+DAA+D;IAC/D,IAAII,MAAMmC,EAAE,CAAC,CAAC,IAAI7C,SAAS,MAAM;QAC/B,MAAM8C,gBAAgBpC,MAAMmC,EAAE,CAAC,CAAC,IAAIpB;QACpC,IACEqB,iBACCA,CAAAA,cAAcjB,IAAI,KAAK,kBAAkBiB,cAAcjB,IAAI,KAAK,QAAO,KACxE,OAAOiB,cAAcf,UAAU,KAAK,UACpC;YACArB,MAAMqC,GAAG;QACX;IACF;IAEAzB,SAASmB,IAAI,IACR/B,MAAMsC,GAAG,CAAC,OAAO,EAAE9B,cAAc,EAAEO,KAAK,EAAEwB,OAAO,EAAEjD,IAAI,EAAE,EAAEkD;QAC5D,IAAID,SAAS;YACX,MAAME,gCACJhD,mBAAmB,CAACsB,SAASzC,sBAAsBoE,IAAI,CAACnD;YAE1D,IAAI,CAACkD,+BAA+B;gBAClCzD,OAAO+C,IAAI,CAAC;oBAAEzC;gBAAK;YACrB;YAEA;QACF;QAEA,6EAA6E;QAC7E,IAAIyB,MAAMI,IAAI,KAAK,UAAU7B,SAASC,cAAc;YAClD,MAAMoD,oBAAoB5D;YAE1B4D,iBAAiB,CAAC,GAAGrD,KAAK,GAAG,CAAC,CAAC,GAAGqD,iBAAiB,CAACrD,KAAK;YACzD,OAAOqD,iBAAiB,CAACrD,KAAK;QAChC;QAEA,IAAI,aAAayB,SAASA,MAAM6B,OAAO,EAAE;YACvC,IAAI7B,MAAM6B,OAAO,KAAK,MAAM;gBAC1B5D,OAAO+C,IAAI,CAAC;oBAAEzC;gBAAK;YACrB;QACF;QAEA,IAAIG,mBAAmBH,SAAS,cAAc;YAC5C;QACF;QAEA,IAAI,CAACF,kBAAkBhB,iBAAiB2C,QAAQ;YAC9C,IAAIP,gBAAgB;gBAClB,IAAI,CAAChB,SAASwC,WAAW,AAAC,CAACxB,eAAe,EAAE;oBAC1ChB,SAASwC,WAAW,AAAC,CAACxB,eAAe,GAAG,MAAMjC,qBAAqB;wBACjE2B;wBACAE,QAAQV,IAAIiB,OAAO,CAACqB,WAAW,CAACxB,eAAe,CAAEyB,MAAM;wBACvD5B,YAAY;wBACZC,WAAW;wBACXC,YAAY;4BAAC;yBAAO;wBACpBb,KAAKlB,sBAAsBkB,KAAK;oBAClC;gBACF;gBAEA,IACE;oBAAC;oBAAQ;iBAAO,CAACmD,QAAQ,CAACtD,iBAC1BT,iBAAkBgE,IAAI,IACtB,CAAChE,iBAAkBgE,IAAI,EAAEC,sBACzB;oBACA/D,OAAO+C,IAAI,CAAC;wBAAEzC,MAAMC;oBAAa;gBACnC;gBAEA,MAAMyD,kCAAkCxD,SAASwC,WAAW,AAAC,CAACxB,eAAe,CAACyC,IAAI;gBAClF,MAAMC,kBAAkBlD,KAAK,CAACwC,IAAI,EAAE;gBACpC,MAAMW,iBAAiBD,iBAAiBnC;gBACxC,MAAMqC,oBACJ5B,QAAQ2B,mBACPA,CAAAA,eAAgBhC,IAAI,KAAK,kBACxBgC,eAAgBhC,IAAI,KAAK,YACzBgC,eAAgBhC,IAAI,KAAK,MAAK;gBAElC,IACEiC,qBACAJ,mCACA,OAAOA,oCAAoC,YAC3CA,gCAAgCd,KAAK,EACrC;oBACA,MAAMmB,mBAAmBrD,MACtBsD,KAAK,CAAC,GAAGd,GACTF,GAAG,CAAC,CAAC,EAAEhD,MAAMiE,kBAAkB,EAAE,GAAKA,oBACtCC,IAAI,CAAC;oBAER,MAAMC,eAAe1E;oBACrB,MAAM2E,cAAc/B,MAAMC,OAAO,CAAC6B,aAAaE,GAAG,IAAIF,aAAaE,GAAG,GAAG,EAAE;oBAE3E,sFAAsF;oBACtF,mFAAmF;oBACnF,qFAAqF;oBACrF,gEAAgE;oBAChE,MAAMC,wBACJ,AAACT,CAAAA,eAAgBhC,IAAI,KAAK,kBAAkBgC,eAAgBhC,IAAI,KAAK,QAAO,KAC5EgC,eAAgB/B,OAAO;oBACzB,MAAMyC,SAASV,eAAgBhC,IAAI,KAAK;oBAExC,IAAIyC,yBAAyBC,QAAQ;wBACnC,MAAMC,mBAAmB9D,MAAMmC,EAAE,CAAC,CAAC,IAAI7C;wBAEvC,IAAIwE,kBAAkB;4BACpBL,aAAaE,GAAG,GAAG;mCACdD;gCACH;oCACE,CAACL,iBAAiB,EAAE;wCAClBU,UAAU;4CACRJ,KAAK;gDACH;oDACE,CAACG,iBAAiB,EAAE;wDAClB,CAAC3E,SAAS,EAAES;oDACd;gDACF;gDACAoD,gCAAgCd,KAAK;6CACtC;wCACH;oCACF;gCACF;6BACD;4BAED,yEAAyE;4BACzE,sDAAsD;4BACtD,OAAOuB,YAAY,CAAClE,aAAa;wBACnC;oBACF,OAAO;wBACL,MAAMyE,cAAcrF,iBAAiB;4BACnCsF,QAAQZ;4BACRnB,OAAOc,gCAAgCd,KAAK;wBAC9C;wBAEAuB,aAAaE,GAAG,GAAG;+BAAID;4BAAaM;yBAAY;oBAClD;gBACF;YACF;YACA,IAAIE,YAAY5E;YAChB,iCAAiC;YACjC,IAAIA,KAAK6E,QAAQ,CAAC,CAAC,CAAC,EAAEzE,IAAIgB,MAAM,EAAE,GAAG;gBACnCwD,YAAY5E,KAAKgE,KAAK,CAAC,GAAG,CAAE5D,CAAAA,IAAIgB,MAAM,CAAEI,MAAM,GAAG,CAAA;YACnD;YACA,8DAA8D;YAC9D,IACE,AAACC,CAAAA,MAAMI,IAAI,KAAK,kBAAkBJ,MAAMI,IAAI,KAAK,QAAO,KACxDQ,MAAMC,OAAO,CAACb,MAAMM,UAAU,GAC9B;gBACA6C,YAAYA,UAAUnE,OAAO,CAAC,UAAU;YAC1C;YAEA,MAAMM,aAAwCnB,eAAe,YAAY;YACzE,MAAMkF,aAAa5D,kBAAkBtB,aAAce,IAAI;YACvD,MAAMoE,WAAWH,UAAUI,KAAK,CAAC;YAEjC,IAAIC;YAEJ,IAAI1E,eAAe;gBACjB0E,cAAc/E,QAAQ,CAACa,WAAW,AAAC,CAAC+D,WAAW,CAAEnF,MAAM;gBAEvD,IACEoF,QAAQ,CAAC,EAAE,KAAK,YAChBA,QAAQ,CAAC,EAAE,KAAK,aAChBA,QAAQ,CAAC,EAAE,KAAK,cAChBA,QAAQ,CAAC,EAAE,KAAK,UAChB;oBACAA,SAASG,KAAK;gBAChB;YACF,OAAO;gBACLD,cAAc/E,QAAQ,CAACa,WAAW,AAAC,CAAC+D,WAAW,CAAEnF,MAAM;YACzD;YAEA,IAAIoF,SAASvD,MAAM,EAAE;gBACnBuD,SAASI,OAAO,CAAC,CAACC;oBAChB,IAAIH,WAAW,CAACG,QAAQ,EAAE;wBACxB,IAAI,YAAYH,WAAW,CAACG,QAAQ,EAAE;4BACpCH,cAAcA,WAAW,CAACG,QAAQ,CAACzF,MAAM;wBAC3C,OAAO;4BACLsF,cAAcA,WAAW,CAACG,QAAQ;wBACpC;oBACF;gBACF;gBAEA,IAAI,CAACH,aAAatB,MAAM0B,YAAY;oBAClC3F,OAAO+C,IAAI,CAAC;wBAAEzC,MAAM4E;oBAAU;gBAChC;YACF;QACF;QAEA,IAAI,CAAC5C,wBAAwBkB,IAAI,GAAG;YAClC,0CAA0C;YAC1C,6BAA6B;YAC7B,MAAMoC,eAAe5E,MAAMsD,KAAK,CAAC,GAAGuB,OAAO;YAE3CD,aAAaH,OAAO,CAClB,CAAC,EAAEjE,gBAAgBsE,kBAAkB,EAAExF,MAAMyF,OAAO,EAAE,EAAEC;gBACtD,+BAA+B;gBAC/B,qCAAqC;gBACrC,IAAIA,qBAAqB,GAAG;oBAC1BpE,SAASmB,IAAI,CACXnD,mBAAmB;wBACjBE,kBAAkBY,IAAIiB,OAAO,CAACqB,WAAW,CAAC8C,mBAAoB,CAAE7C,MAAM;wBACtEjD;wBACAE,cAAc8B;wBACd5B;wBACAI;wBACAE;wBACAC;wBACAuC,OAAO;4BACL,CAAC6C,QAAQ,EAAE;gCACT,CAAC5F,SAAS,EAAES;4BACd;wBACF;oBACF;gBAEJ;YACF;QAEJ;IACF;IAEF,MAAMqF,QAAQC,GAAG,CAACtE;AACpB"}

package/dist/database/queryValidation/validateSortQuery.d.ts

@@ -0,0 +1,23 @@
+import type { SanitizedCollectionConfig } from '../../collections/config/types.js';
+import type { FlattenedField } from '../../fields/config/types.js';
+import type { SanitizedGlobalConfig } from '../../globals/config/types.js';
+import type { PayloadRequest, Sort } from '../../types/index.js';
+type Args = {
+    overrideAccess: boolean;
+    req: PayloadRequest;
+    sort?: Sort;
+    versionFields?: FlattenedField[];
+} & ({
+    collectionConfig: SanitizedCollectionConfig;
+    globalConfig?: undefined;
+} | {
+    collectionConfig?: undefined;
+    globalConfig: SanitizedGlobalConfig;
+});
+/**
+ * Ensures sort paths are subject to the same field-read access checks as query `where` paths,
+ * since database sorting happens before response-time field redaction.
+ */
+export declare const validateSortQuery: ({ collectionConfig, globalConfig, overrideAccess, req, sort, versionFields, }: Args) => Promise<void>;
+export {};
+//# sourceMappingURL=validateSortQuery.d.ts.map

package/dist/database/queryValidation/validateSortQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateSortQuery.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateSortQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAS,MAAM,sBAAsB,CAAA;AAKvE,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;CACjC,GAAG,CACA;IACE,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,YAAY,CAAC,EAAE,SAAS,CAAA;CACzB,GACD;IACE,gBAAgB,CAAC,EAAE,SAAS,CAAA;IAC5B,YAAY,EAAE,qBAAqB,CAAA;CACpC,CACJ,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,kFAO3B,IAAI,KAAG,OAAO,CAAC,IAAI,CA+CrB,CAAA"}

package/dist/database/queryValidation/validateSortQuery.js

@@ -0,0 +1,54 @@
+import { getLocalizedPaths } from '../getLocalizedPaths.js';
+import { validateQueryPaths } from './validateQueryPaths.js';
+/**
+ * Ensures sort paths are subject to the same field-read access checks as query `where` paths,
+ * since database sorting happens before response-time field redaction.
+ */ export const validateSortQuery = async ({ collectionConfig, globalConfig, overrideAccess, req, sort, versionFields })=>{
+    if (overrideAccess || !sort) {
+        return;
+    }
+    const fields = versionFields || (globalConfig || collectionConfig).flattenedFields;
+    const sortFields = Array.isArray(sort) ? sort : [
+        sort
+    ];
+    const where = {};
+    for (const sortField of sortFields){
+        const path = sortField.replace(/^-/, '').replace(/__/g, '.');
+        const paths = getLocalizedPaths({
+            collectionSlug: collectionConfig?.slug,
+            fields,
+            globalSlug: globalConfig?.slug,
+            incomingPath: path,
+            locale: req.locale,
+            overrideAccess: true,
+            payload: req.payload
+        });
+        if (path !== 'id' && path !== '_id' && paths.every(({ invalid })=>!invalid)) {
+            where[path] = {
+                exists: true
+            };
+        }
+    }
+    if (Object.keys(where).length === 0) {
+        return;
+    }
+    if (collectionConfig) {
+        await validateQueryPaths({
+            collectionConfig,
+            overrideAccess,
+            req,
+            versionFields,
+            where
+        });
+    } else {
+        await validateQueryPaths({
+            globalConfig,
+            overrideAccess,
+            req,
+            versionFields,
+            where
+        });
+    }
+};
+
+//# sourceMappingURL=validateSortQuery.js.map

package/dist/database/queryValidation/validateSortQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/database/queryValidation/validateSortQuery.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { PayloadRequest, Sort, Where } from '../../types/index.js'\n\nimport { getLocalizedPaths } from '../getLocalizedPaths.js'\nimport { validateQueryPaths } from './validateQueryPaths.js'\n\ntype Args = {\n  overrideAccess: boolean\n  req: PayloadRequest\n  sort?: Sort\n  versionFields?: FlattenedField[]\n} & (\n  | {\n      collectionConfig: SanitizedCollectionConfig\n      globalConfig?: undefined\n    }\n  | {\n      collectionConfig?: undefined\n      globalConfig: SanitizedGlobalConfig\n    }\n)\n\n/**\n * Ensures sort paths are subject to the same field-read access checks as query `where` paths,\n * since database sorting happens before response-time field redaction.\n */\nexport const validateSortQuery = async ({\n  collectionConfig,\n  globalConfig,\n  overrideAccess,\n  req,\n  sort,\n  versionFields,\n}: Args): Promise<void> => {\n  if (overrideAccess || !sort) {\n    return\n  }\n\n  const fields = versionFields || (globalConfig || collectionConfig).flattenedFields\n  const sortFields = Array.isArray(sort) ? sort : [sort]\n  const where: Where = {}\n\n  for (const sortField of sortFields) {\n    const path = sortField.replace(/^-/, '').replace(/__/g, '.')\n    const paths = getLocalizedPaths({\n      collectionSlug: collectionConfig?.slug,\n      fields,\n      globalSlug: globalConfig?.slug,\n      incomingPath: path,\n      locale: req.locale!,\n      overrideAccess: true,\n      payload: req.payload,\n    })\n\n    if (path !== 'id' && path !== '_id' && paths.every(({ invalid }) => !invalid)) {\n      where[path] = { exists: true }\n    }\n  }\n\n  if (Object.keys(where).length === 0) {\n    return\n  }\n\n  if (collectionConfig) {\n    await validateQueryPaths({\n      collectionConfig,\n      overrideAccess,\n      req,\n      versionFields,\n      where,\n    })\n  } else {\n    await validateQueryPaths({\n      globalConfig,\n      overrideAccess,\n      req,\n      versionFields,\n      where,\n    })\n  }\n}\n"],"names":["getLocalizedPaths","validateQueryPaths","validateSortQuery","collectionConfig","globalConfig","overrideAccess","req","sort","versionFields","fields","flattenedFields","sortFields","Array","isArray","where","sortField","path","replace","paths","collectionSlug","slug","globalSlug","incomingPath","locale","payload","every","invalid","exists","Object","keys","length"],"mappings":"AAKA,SAASA,iBAAiB,QAAQ,0BAAyB;AAC3D,SAASC,kBAAkB,QAAQ,0BAAyB;AAkB5D;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,OAAO,EACtCC,gBAAgB,EAChBC,YAAY,EACZC,cAAc,EACdC,GAAG,EACHC,IAAI,EACJC,aAAa,EACR;IACL,IAAIH,kBAAkB,CAACE,MAAM;QAC3B;IACF;IAEA,MAAME,SAASD,iBAAiB,AAACJ,CAAAA,gBAAgBD,gBAAe,EAAGO,eAAe;IAClF,MAAMC,aAAaC,MAAMC,OAAO,CAACN,QAAQA,OAAO;QAACA;KAAK;IACtD,MAAMO,QAAe,CAAC;IAEtB,KAAK,MAAMC,aAAaJ,WAAY;QAClC,MAAMK,OAAOD,UAAUE,OAAO,CAAC,MAAM,IAAIA,OAAO,CAAC,OAAO;QACxD,MAAMC,QAAQlB,kBAAkB;YAC9BmB,gBAAgBhB,kBAAkBiB;YAClCX;YACAY,YAAYjB,cAAcgB;YAC1BE,cAAcN;YACdO,QAAQjB,IAAIiB,MAAM;YAClBlB,gBAAgB;YAChBmB,SAASlB,IAAIkB,OAAO;QACtB;QAEA,IAAIR,SAAS,QAAQA,SAAS,SAASE,MAAMO,KAAK,CAAC,CAAC,EAAEC,OAAO,EAAE,GAAK,CAACA,UAAU;YAC7EZ,KAAK,CAACE,KAAK,GAAG;gBAAEW,QAAQ;YAAK;QAC/B;IACF;IAEA,IAAIC,OAAOC,IAAI,CAACf,OAAOgB,MAAM,KAAK,GAAG;QACnC;IACF;IAEA,IAAI3B,kBAAkB;QACpB,MAAMF,mBAAmB;YACvBE;YACAE;YACAC;YACAE;YACAM;QACF;IACF,OAAO;QACL,MAAMb,mBAAmB;YACvBG;YACAC;YACAC;YACAE;YACAM;QACF;IACF;AACF,EAAC"}

package/dist/database/sanitizeJoinQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeJoinQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeJoinQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAiB,MAAM,gCAAgC,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAQlE,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AA0ED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,kEAK3B,IAAI;;;;;;;;GA+CN,CAAA"}
+{"version":3,"file":"sanitizeJoinQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeJoinQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAiB,MAAM,gCAAgC,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAUlE,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAmFD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,kEAK3B,IAAI;;;;;;;;GA+CN,CAAA"}

package/dist/database/sanitizeJoinQuery.js

@@ -1,7 +1,9 @@
 import { executeAccess } from '../auth/executeAccess.js';
 import { QueryError } from '../errors/QueryError.js';
+import { deepCopyObjectSimple } from '../utilities/deepCopyObject.js';
 import { combineQueries } from './combineQueries.js';
 import { validateQueryPaths } from './queryValidation/validateQueryPaths.js';
+import { validateSortQuery } from './queryValidation/validateSortQuery.js';
 import { sanitizeWhereQuery } from './sanitizeWhereQuery.js';
 const sanitizeJoinFieldQuery = async ({ collectionSlug, errors, join, joinsQuery, overrideAccess, promises, req })=>{
     const { joinPath } = join;
@@ -11,6 +13,7 @@ const sanitizeJoinFieldQuery = async ({ collectionSlug, errors, join, joinsQuery
     }
     const joinCollectionConfig = req.payload.collections[collectionSlug].config;
     const accessResult = !overrideAccess ? await executeAccess({
+        slug: joinCollectionConfig.slug,
         disableErrors: true,
         req
     }, joinCollectionConfig.access.read) : true;
@@ -28,7 +31,7 @@ const sanitizeJoinFieldQuery = async ({ collectionSlug, errors, join, joinsQuery
         joinQuery.where = {};
     }
     if (join.field.where) {
-        joinQuery.where = combineQueries(joinQuery.where, join.field.where);
+        joinQuery.where = combineQueries(joinQuery.where, deepCopyObjectSimple(join.field.where));
     }
     promises.push(validateQueryPaths({
         collectionConfig: joinCollectionConfig,
@@ -38,6 +41,11 @@ const sanitizeJoinFieldQuery = async ({ collectionSlug, errors, join, joinsQuery
         req,
         // incoming where input, but we shouldn't validate generated from the access control.
         where: joinQuery.where
+    }), validateSortQuery({
+        collectionConfig: joinCollectionConfig,
+        overrideAccess,
+        req,
+        sort: joinQuery.sort || join.field.defaultSort || joinCollectionConfig.defaultSort
     }));
     if (typeof accessResult === 'object') {
         sanitizeWhereQuery({

package/dist/database/sanitizeJoinQuery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/database/sanitizeJoinQuery.ts"],"sourcesContent":["import type { SanitizedCollectionConfig, SanitizedJoin } from '../collections/config/types.js'\nimport type { JoinQuery, PayloadRequest } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { QueryError } from '../errors/QueryError.js'\nimport { combineQueries } from './combineQueries.js'\nimport { validateQueryPaths } from './queryValidation/validateQueryPaths.js'\nimport { sanitizeWhereQuery } from './sanitizeWhereQuery.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  joins?: JoinQuery\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\nconst sanitizeJoinFieldQuery = async ({\n  collectionSlug,\n  errors,\n  join,\n  joinsQuery,\n  overrideAccess,\n  promises,\n  req,\n}: {\n  collectionSlug: string\n  errors: { path: string }[]\n  join: SanitizedJoin\n  joinsQuery: JoinQuery\n  overrideAccess: boolean\n  promises: Promise<void>[]\n  req: PayloadRequest\n}) => {\n  const { joinPath } = join\n\n  // TODO: fix any's in joinsQuery[joinPath]\n\n  if ((joinsQuery as any)[joinPath] === false) {\n    return\n  }\n\n  const joinCollectionConfig = req.payload.collections[collectionSlug]!.config\n\n  const accessResult = !overrideAccess\n    ? await executeAccess({ disableErrors: true, req }, joinCollectionConfig.access.read)\n    : true\n\n  if (accessResult === false) {\n    ;(joinsQuery as any)[joinPath] = false\n    return\n  }\n\n  if (!(joinsQuery as any)[joinPath]) {\n    ;(joinsQuery as any)[joinPath] = {}\n  }\n\n  const joinQuery = (joinsQuery as any)[joinPath]\n\n  if (!joinQuery.where) {\n    joinQuery.where = {}\n  }\n\n  if (join.field.where) {\n    joinQuery.where = combineQueries(joinQuery.where, join.field.where)\n  }\n\n  promises.push(\n    validateQueryPaths({\n      collectionConfig: joinCollectionConfig,\n      errors,\n      overrideAccess,\n      polymorphicJoin: Array.isArray(join.field.collection),\n      req,\n      // incoming where input, but we shouldn't validate generated from the access control.\n      where: joinQuery.where,\n    }),\n  )\n\n  if (typeof accessResult === 'object') {\n    sanitizeWhereQuery({\n      fields: joinCollectionConfig.flattenedFields,\n      payload: req.payload,\n      where: accessResult,\n    })\n    joinQuery.where = combineQueries(joinQuery.where, accessResult)\n  }\n}\n\n/**\n * * Validates `where` for each join\n * * Combines the access result for joined collection\n * * Combines the default join's `where`\n */\nexport const sanitizeJoinQuery = async ({\n  collectionConfig,\n  joins: joinsQuery,\n  overrideAccess,\n  req,\n}: Args) => {\n  if (joinsQuery === false) {\n    return false\n  }\n\n  if (!joinsQuery) {\n    joinsQuery = {}\n  }\n\n  const errors: { path: string }[] = []\n  const promises: Promise<void>[] = []\n\n  for (const collectionSlug in collectionConfig.joins) {\n    for (const join of collectionConfig.joins[collectionSlug]!) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  for (const join of collectionConfig.polymorphicJoins) {\n    for (const collectionSlug of join.field.collection) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  await Promise.all(promises)\n\n  if (errors.length > 0) {\n    throw new QueryError(errors)\n  }\n\n  return joinsQuery\n}\n"],"names":["executeAccess","QueryError","combineQueries","validateQueryPaths","sanitizeWhereQuery","sanitizeJoinFieldQuery","collectionSlug","errors","join","joinsQuery","overrideAccess","promises","req","joinPath","joinCollectionConfig","payload","collections","config","accessResult","disableErrors","access","read","joinQuery","where","field","push","collectionConfig","polymorphicJoin","Array","isArray","collection","fields","flattenedFields","sanitizeJoinQuery","joins","polymorphicJoins","Promise","all","length"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,UAAU,QAAQ,0BAAyB;AACpD,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,kBAAkB,QAAQ,0CAAyC;AAC5E,SAASC,kBAAkB,QAAQ,0BAAyB;AAS5D,MAAMC,yBAAyB,OAAO,EACpCC,cAAc,EACdC,MAAM,EACNC,IAAI,EACJC,UAAU,EACVC,cAAc,EACdC,QAAQ,EACRC,GAAG,EASJ;IACC,MAAM,EAAEC,QAAQ,EAAE,GAAGL;IAErB,0CAA0C;IAE1C,IAAI,AAACC,UAAkB,CAACI,SAAS,KAAK,OAAO;QAC3C;IACF;IAEA,MAAMC,uBAAuBF,IAAIG,OAAO,CAACC,WAAW,CAACV,eAAe,CAAEW,MAAM;IAE5E,MAAMC,eAAe,CAACR,iBAClB,MAAMV,cAAc;QAAEmB,eAAe;QAAMP;IAAI,GAAGE,qBAAqBM,MAAM,CAACC,IAAI,IAClF;IAEJ,IAAIH,iBAAiB,OAAO;;QACxBT,UAAkB,CAACI,SAAS,GAAG;QACjC;IACF;IAEA,IAAI,CAAC,AAACJ,UAAkB,CAACI,SAAS,EAAE;;QAChCJ,UAAkB,CAACI,SAAS,GAAG,CAAC;IACpC;IAEA,MAAMS,YAAY,AAACb,UAAkB,CAACI,SAAS;IAE/C,IAAI,CAACS,UAAUC,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAG,CAAC;IACrB;IAEA,IAAIf,KAAKgB,KAAK,CAACD,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAGrB,eAAeoB,UAAUC,KAAK,EAAEf,KAAKgB,KAAK,CAACD,KAAK;IACpE;IAEAZ,SAASc,IAAI,CACXtB,mBAAmB;QACjBuB,kBAAkBZ;QAClBP;QACAG;QACAiB,iBAAiBC,MAAMC,OAAO,CAACrB,KAAKgB,KAAK,CAACM,UAAU;QACpDlB;QACA,qFAAqF;QACrFW,OAAOD,UAAUC,KAAK;IACxB;IAGF,IAAI,OAAOL,iBAAiB,UAAU;QACpCd,mBAAmB;YACjB2B,QAAQjB,qBAAqBkB,eAAe;YAC5CjB,SAASH,IAAIG,OAAO;YACpBQ,OAAOL;QACT;QACAI,UAAUC,KAAK,GAAGrB,eAAeoB,UAAUC,KAAK,EAAEL;IACpD;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMe,oBAAoB,OAAO,EACtCP,gBAAgB,EAChBQ,OAAOzB,UAAU,EACjBC,cAAc,EACdE,GAAG,EACE;IACL,IAAIH,eAAe,OAAO;QACxB,OAAO;IACT;IAEA,IAAI,CAACA,YAAY;QACfA,aAAa,CAAC;IAChB;IAEA,MAAMF,SAA6B,EAAE;IACrC,MAAMI,WAA4B,EAAE;IAEpC,IAAK,MAAML,kBAAkBoB,iBAAiBQ,KAAK,CAAE;QACnD,KAAK,MAAM1B,QAAQkB,iBAAiBQ,KAAK,CAAC5B,eAAe,CAAG;YAC1D,MAAMD,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,KAAK,MAAMJ,QAAQkB,iBAAiBS,gBAAgB,CAAE;QACpD,KAAK,MAAM7B,kBAAkBE,KAAKgB,KAAK,CAACM,UAAU,CAAE;YAClD,MAAMzB,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,MAAMwB,QAAQC,GAAG,CAAC1B;IAElB,IAAIJ,OAAO+B,MAAM,GAAG,GAAG;QACrB,MAAM,IAAIrC,WAAWM;IACvB;IAEA,OAAOE;AACT,EAAC"}
+{"version":3,"sources":["../../src/database/sanitizeJoinQuery.ts"],"sourcesContent":["import type { SanitizedCollectionConfig, SanitizedJoin } from '../collections/config/types.js'\nimport type { JoinQuery, PayloadRequest } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { QueryError } from '../errors/QueryError.js'\nimport { deepCopyObjectSimple } from '../utilities/deepCopyObject.js'\nimport { combineQueries } from './combineQueries.js'\nimport { validateQueryPaths } from './queryValidation/validateQueryPaths.js'\nimport { validateSortQuery } from './queryValidation/validateSortQuery.js'\nimport { sanitizeWhereQuery } from './sanitizeWhereQuery.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  joins?: JoinQuery\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\nconst sanitizeJoinFieldQuery = async ({\n  collectionSlug,\n  errors,\n  join,\n  joinsQuery,\n  overrideAccess,\n  promises,\n  req,\n}: {\n  collectionSlug: string\n  errors: { path: string }[]\n  join: SanitizedJoin\n  joinsQuery: JoinQuery\n  overrideAccess: boolean\n  promises: Promise<void>[]\n  req: PayloadRequest\n}) => {\n  const { joinPath } = join\n\n  // TODO: fix any's in joinsQuery[joinPath]\n\n  if ((joinsQuery as any)[joinPath] === false) {\n    return\n  }\n\n  const joinCollectionConfig = req.payload.collections[collectionSlug]!.config\n\n  const accessResult = !overrideAccess\n    ? await executeAccess(\n        { slug: joinCollectionConfig.slug, disableErrors: true, req },\n        joinCollectionConfig.access.read,\n      )\n    : true\n\n  if (accessResult === false) {\n    ;(joinsQuery as any)[joinPath] = false\n    return\n  }\n\n  if (!(joinsQuery as any)[joinPath]) {\n    ;(joinsQuery as any)[joinPath] = {}\n  }\n\n  const joinQuery = (joinsQuery as any)[joinPath]\n\n  if (!joinQuery.where) {\n    joinQuery.where = {}\n  }\n\n  if (join.field.where) {\n    joinQuery.where = combineQueries(joinQuery.where, deepCopyObjectSimple(join.field.where))\n  }\n\n  promises.push(\n    validateQueryPaths({\n      collectionConfig: joinCollectionConfig,\n      errors,\n      overrideAccess,\n      polymorphicJoin: Array.isArray(join.field.collection),\n      req,\n      // incoming where input, but we shouldn't validate generated from the access control.\n      where: joinQuery.where,\n    }),\n    validateSortQuery({\n      collectionConfig: joinCollectionConfig,\n      overrideAccess,\n      req,\n      sort: joinQuery.sort || join.field.defaultSort || joinCollectionConfig.defaultSort,\n    }),\n  )\n\n  if (typeof accessResult === 'object') {\n    sanitizeWhereQuery({\n      fields: joinCollectionConfig.flattenedFields,\n      payload: req.payload,\n      where: accessResult,\n    })\n    joinQuery.where = combineQueries(joinQuery.where, accessResult)\n  }\n}\n\n/**\n * * Validates `where` for each join\n * * Combines the access result for joined collection\n * * Combines the default join's `where`\n */\nexport const sanitizeJoinQuery = async ({\n  collectionConfig,\n  joins: joinsQuery,\n  overrideAccess,\n  req,\n}: Args) => {\n  if (joinsQuery === false) {\n    return false\n  }\n\n  if (!joinsQuery) {\n    joinsQuery = {}\n  }\n\n  const errors: { path: string }[] = []\n  const promises: Promise<void>[] = []\n\n  for (const collectionSlug in collectionConfig.joins) {\n    for (const join of collectionConfig.joins[collectionSlug]!) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  for (const join of collectionConfig.polymorphicJoins) {\n    for (const collectionSlug of join.field.collection) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  await Promise.all(promises)\n\n  if (errors.length > 0) {\n    throw new QueryError(errors)\n  }\n\n  return joinsQuery\n}\n"],"names":["executeAccess","QueryError","deepCopyObjectSimple","combineQueries","validateQueryPaths","validateSortQuery","sanitizeWhereQuery","sanitizeJoinFieldQuery","collectionSlug","errors","join","joinsQuery","overrideAccess","promises","req","joinPath","joinCollectionConfig","payload","collections","config","accessResult","slug","disableErrors","access","read","joinQuery","where","field","push","collectionConfig","polymorphicJoin","Array","isArray","collection","sort","defaultSort","fields","flattenedFields","sanitizeJoinQuery","joins","polymorphicJoins","Promise","all","length"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,UAAU,QAAQ,0BAAyB;AACpD,SAASC,oBAAoB,QAAQ,iCAAgC;AACrE,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,kBAAkB,QAAQ,0CAAyC;AAC5E,SAASC,iBAAiB,QAAQ,yCAAwC;AAC1E,SAASC,kBAAkB,QAAQ,0BAAyB;AAS5D,MAAMC,yBAAyB,OAAO,EACpCC,cAAc,EACdC,MAAM,EACNC,IAAI,EACJC,UAAU,EACVC,cAAc,EACdC,QAAQ,EACRC,GAAG,EASJ;IACC,MAAM,EAAEC,QAAQ,EAAE,GAAGL;IAErB,0CAA0C;IAE1C,IAAI,AAACC,UAAkB,CAACI,SAAS,KAAK,OAAO;QAC3C;IACF;IAEA,MAAMC,uBAAuBF,IAAIG,OAAO,CAACC,WAAW,CAACV,eAAe,CAAEW,MAAM;IAE5E,MAAMC,eAAe,CAACR,iBAClB,MAAMZ,cACJ;QAAEqB,MAAML,qBAAqBK,IAAI;QAAEC,eAAe;QAAMR;IAAI,GAC5DE,qBAAqBO,MAAM,CAACC,IAAI,IAElC;IAEJ,IAAIJ,iBAAiB,OAAO;;QACxBT,UAAkB,CAACI,SAAS,GAAG;QACjC;IACF;IAEA,IAAI,CAAC,AAACJ,UAAkB,CAACI,SAAS,EAAE;;QAChCJ,UAAkB,CAACI,SAAS,GAAG,CAAC;IACpC;IAEA,MAAMU,YAAY,AAACd,UAAkB,CAACI,SAAS;IAE/C,IAAI,CAACU,UAAUC,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAG,CAAC;IACrB;IAEA,IAAIhB,KAAKiB,KAAK,CAACD,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAGvB,eAAesB,UAAUC,KAAK,EAAExB,qBAAqBQ,KAAKiB,KAAK,CAACD,KAAK;IACzF;IAEAb,SAASe,IAAI,CACXxB,mBAAmB;QACjByB,kBAAkBb;QAClBP;QACAG;QACAkB,iBAAiBC,MAAMC,OAAO,CAACtB,KAAKiB,KAAK,CAACM,UAAU;QACpDnB;QACA,qFAAqF;QACrFY,OAAOD,UAAUC,KAAK;IACxB,IACArB,kBAAkB;QAChBwB,kBAAkBb;QAClBJ;QACAE;QACAoB,MAAMT,UAAUS,IAAI,IAAIxB,KAAKiB,KAAK,CAACQ,WAAW,IAAInB,qBAAqBmB,WAAW;IACpF;IAGF,IAAI,OAAOf,iBAAiB,UAAU;QACpCd,mBAAmB;YACjB8B,QAAQpB,qBAAqBqB,eAAe;YAC5CpB,SAASH,IAAIG,OAAO;YACpBS,OAAON;QACT;QACAK,UAAUC,KAAK,GAAGvB,eAAesB,UAAUC,KAAK,EAAEN;IACpD;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMkB,oBAAoB,OAAO,EACtCT,gBAAgB,EAChBU,OAAO5B,UAAU,EACjBC,cAAc,EACdE,GAAG,EACE;IACL,IAAIH,eAAe,OAAO;QACxB,OAAO;IACT;IAEA,IAAI,CAACA,YAAY;QACfA,aAAa,CAAC;IAChB;IAEA,MAAMF,SAA6B,EAAE;IACrC,MAAMI,WAA4B,EAAE;IAEpC,IAAK,MAAML,kBAAkBqB,iBAAiBU,KAAK,CAAE;QACnD,KAAK,MAAM7B,QAAQmB,iBAAiBU,KAAK,CAAC/B,eAAe,CAAG;YAC1D,MAAMD,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,KAAK,MAAMJ,QAAQmB,iBAAiBW,gBAAgB,CAAE;QACpD,KAAK,MAAMhC,kBAAkBE,KAAKiB,KAAK,CAACM,UAAU,CAAE;YAClD,MAAM1B,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,MAAM2B,QAAQC,GAAG,CAAC7B;IAElB,IAAIJ,OAAOkC,MAAM,GAAG,GAAG;QACrB,MAAM,IAAI1C,WAAWQ;IACvB;IAEA,OAAOE;AACT,EAAC"}

package/dist/database/sanitizeWhereQuery.d.ts

@@ -1,7 +1,7 @@
 import type { FlattenedField } from '../fields/config/types.js';
 import type { Payload, Where } from '../types/index.js';
 /**
- * Currently used only for virtual fields linked with relationships
+ * Replaces virtual field names in a `where` query with the database paths they point to.
  */
 export declare const sanitizeWhereQuery: ({ fields, payload, where, }: {
     fields: FlattenedField[];

package/dist/database/sanitizeWhereQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeWhereQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeWhereQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,kBAAkB,gCAI5B;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,KAAK,CAAA;CACb,SAiDA,CAAA"}
+{"version":3,"file":"sanitizeWhereQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeWhereQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAKvD;;GAEG;AACH,eAAO,MAAM,kBAAkB,gCAI5B;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,KAAK,CAAA;CACb,SAuDA,CAAA"}

package/dist/database/sanitizeWhereQuery.js

@@ -1,5 +1,7 @@
+import { hasManyRelationshipOperators } from '../types/constants.js';
+import { isNestedRelationshipQuery } from './isNestedRelationshipQuery.js';
 /**
- * Currently used only for virtual fields linked with relationships
+ * Replaces virtual field names in a `where` query with the database paths they point to.
  */ export const sanitizeWhereQuery = ({ fields, payload, where })=>{
     for(const key in where){
         const value = where[key];
@@ -19,12 +21,14 @@
         const paths = key.split('.');
         let pathHasChanged = false;
         let currentFields = fields;
+        let finalField;
         for(let i = 0; i < paths.length; i++){
             const path = paths[i];
             const field = currentFields.find((each)=>each.name === path);
             if (!field) {
                 break;
             }
+            finalField = field;
             if ('virtual' in field && field.virtual && typeof field.virtual === 'string') {
                 paths[i] = field.virtual;
                 pathHasChanged = true;
@@ -39,11 +43,50 @@
                 }
             }
         }
+        // Follow relationship fields so virtual fields on related documents are also resolved.
+        sanitizeNestedHasManyRelationshipQueries({
+            field: finalField,
+            payload,
+            value
+        });
         if (pathHasChanged) {
             where[paths.join('.')] = where[key];
             delete where[key];
         }
     }
 };
+/**
+ * Resolves virtual field paths inside a nested has-many relationship query.
+ * The nested query uses fields from the related collection, not fields from the parent collection.
+ *
+ * @example
+ * ```ts
+ * {
+ *   ingredients: {
+ *     contains: {
+ *       displayName: { equals: 'Lettuce' }, // `displayName` may be a virtual field
+ *     },
+ *   },
+ * }
+ * ```
+ */ function sanitizeNestedHasManyRelationshipQueries({ field, payload, value }) {
+    if (!field || field.type !== 'relationship' && field.type !== 'upload' || !field.hasMany || typeof field.relationTo !== 'string' || value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return;
+    }
+    const relatedFields = payload.collections[field.relationTo]?.config.flattenedFields;
+    if (!relatedFields) {
+        return;
+    }
+    for (const operator of hasManyRelationshipOperators){
+        const nestedWhere = value[operator];
+        if (isNestedRelationshipQuery(nestedWhere)) {
+            sanitizeWhereQuery({
+                fields: relatedFields,
+                payload,
+                where: nestedWhere
+            });
+        }
+    }
+}
 
 //# sourceMappingURL=sanitizeWhereQuery.js.map

package/dist/database/sanitizeWhereQuery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/database/sanitizeWhereQuery.ts"],"sourcesContent":["import type { FlattenedField } from '../fields/config/types.js'\nimport type { Payload, Where } from '../types/index.js'\n\n/**\n * Currently used only for virtual fields linked with relationships\n */\nexport const sanitizeWhereQuery = ({\n  fields,\n  payload,\n  where,\n}: {\n  fields: FlattenedField[]\n  payload: Payload\n  where: Where\n}) => {\n  for (const key in where) {\n    const value = where[key]\n\n    if (['and', 'or'].includes(key.toLowerCase()) && Array.isArray(value)) {\n      for (const where of value) {\n        sanitizeWhereQuery({ fields, payload, where })\n      }\n      continue\n    }\n\n    const paths = key.split('.')\n    let pathHasChanged = false\n\n    let currentFields = fields\n\n    for (let i = 0; i < paths.length; i++) {\n      const path = paths[i]!\n      const field = currentFields.find((each) => each.name === path)\n\n      if (!field) {\n        break\n      }\n\n      if ('virtual' in field && field.virtual && typeof field.virtual === 'string') {\n        paths[i] = field.virtual\n        pathHasChanged = true\n      }\n\n      if ('flattenedFields' in field) {\n        currentFields = field.flattenedFields\n      }\n\n      if (\n        (field.type === 'relationship' || field.type === 'upload') &&\n        typeof field.relationTo === 'string'\n      ) {\n        const relatedCollection = payload.collections[field.relationTo]\n        if (relatedCollection) {\n          currentFields = relatedCollection.config.flattenedFields\n        }\n      }\n    }\n\n    if (pathHasChanged) {\n      where[paths.join('.')] = where[key]!\n      delete where[key]\n    }\n  }\n}\n"],"names":["sanitizeWhereQuery","fields","payload","where","key","value","includes","toLowerCase","Array","isArray","paths","split","pathHasChanged","currentFields","i","length","path","field","find","each","name","virtual","flattenedFields","type","relationTo","relatedCollection","collections","config","join"],"mappings":"AAGA;;CAEC,GACD,OAAO,MAAMA,qBAAqB,CAAC,EACjCC,MAAM,EACNC,OAAO,EACPC,KAAK,EAKN;IACC,IAAK,MAAMC,OAAOD,MAAO;QACvB,MAAME,QAAQF,KAAK,CAACC,IAAI;QAExB,IAAI;YAAC;YAAO;SAAK,CAACE,QAAQ,CAACF,IAAIG,WAAW,OAAOC,MAAMC,OAAO,CAACJ,QAAQ;YACrE,KAAK,MAAMF,SAASE,MAAO;gBACzBL,mBAAmB;oBAAEC;oBAAQC;oBAASC;gBAAM;YAC9C;YACA;QACF;QAEA,MAAMO,QAAQN,IAAIO,KAAK,CAAC;QACxB,IAAIC,iBAAiB;QAErB,IAAIC,gBAAgBZ;QAEpB,IAAK,IAAIa,IAAI,GAAGA,IAAIJ,MAAMK,MAAM,EAAED,IAAK;YACrC,MAAME,OAAON,KAAK,CAACI,EAAE;YACrB,MAAMG,QAAQJ,cAAcK,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKJ;YAEzD,IAAI,CAACC,OAAO;gBACV;YACF;YAEA,IAAI,aAAaA,SAASA,MAAMI,OAAO,IAAI,OAAOJ,MAAMI,OAAO,KAAK,UAAU;gBAC5EX,KAAK,CAACI,EAAE,GAAGG,MAAMI,OAAO;gBACxBT,iBAAiB;YACnB;YAEA,IAAI,qBAAqBK,OAAO;gBAC9BJ,gBAAgBI,MAAMK,eAAe;YACvC;YAEA,IACE,AAACL,CAAAA,MAAMM,IAAI,KAAK,kBAAkBN,MAAMM,IAAI,KAAK,QAAO,KACxD,OAAON,MAAMO,UAAU,KAAK,UAC5B;gBACA,MAAMC,oBAAoBvB,QAAQwB,WAAW,CAACT,MAAMO,UAAU,CAAC;gBAC/D,IAAIC,mBAAmB;oBACrBZ,gBAAgBY,kBAAkBE,MAAM,CAACL,eAAe;gBAC1D;YACF;QACF;QAEA,IAAIV,gBAAgB;YAClBT,KAAK,CAACO,MAAMkB,IAAI,CAAC,KAAK,GAAGzB,KAAK,CAACC,IAAI;YACnC,OAAOD,KAAK,CAACC,IAAI;QACnB;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/database/sanitizeWhereQuery.ts"],"sourcesContent":["import type { FlattenedField } from '../fields/config/types.js'\nimport type { Payload, Where } from '../types/index.js'\n\nimport { hasManyRelationshipOperators } from '../types/constants.js'\nimport { isNestedRelationshipQuery } from './isNestedRelationshipQuery.js'\n\n/**\n * Replaces virtual field names in a `where` query with the database paths they point to.\n */\nexport const sanitizeWhereQuery = ({\n  fields,\n  payload,\n  where,\n}: {\n  fields: FlattenedField[]\n  payload: Payload\n  where: Where\n}) => {\n  for (const key in where) {\n    const value = where[key]\n\n    if (['and', 'or'].includes(key.toLowerCase()) && Array.isArray(value)) {\n      for (const where of value) {\n        sanitizeWhereQuery({ fields, payload, where })\n      }\n      continue\n    }\n\n    const paths = key.split('.')\n    let pathHasChanged = false\n\n    let currentFields = fields\n    let finalField: FlattenedField | undefined\n\n    for (let i = 0; i < paths.length; i++) {\n      const path = paths[i]!\n      const field = currentFields.find((each) => each.name === path)\n\n      if (!field) {\n        break\n      }\n\n      finalField = field\n\n      if ('virtual' in field && field.virtual && typeof field.virtual === 'string') {\n        paths[i] = field.virtual\n        pathHasChanged = true\n      }\n\n      if ('flattenedFields' in field) {\n        currentFields = field.flattenedFields\n      }\n\n      if (\n        (field.type === 'relationship' || field.type === 'upload') &&\n        typeof field.relationTo === 'string'\n      ) {\n        const relatedCollection = payload.collections[field.relationTo]\n        if (relatedCollection) {\n          currentFields = relatedCollection.config.flattenedFields\n        }\n      }\n    }\n\n    // Follow relationship fields so virtual fields on related documents are also resolved.\n    sanitizeNestedHasManyRelationshipQueries({ field: finalField, payload, value })\n\n    if (pathHasChanged) {\n      where[paths.join('.')] = where[key]!\n      delete where[key]\n    }\n  }\n}\n\n/**\n * Resolves virtual field paths inside a nested has-many relationship query.\n * The nested query uses fields from the related collection, not fields from the parent collection.\n *\n * @example\n * ```ts\n * {\n *   ingredients: {\n *     contains: {\n *       displayName: { equals: 'Lettuce' }, // `displayName` may be a virtual field\n *     },\n *   },\n * }\n * ```\n */\nfunction sanitizeNestedHasManyRelationshipQueries({\n  field,\n  payload,\n  value,\n}: {\n  field?: FlattenedField\n  payload: Payload\n  value: unknown\n}): void {\n  if (\n    !field ||\n    (field.type !== 'relationship' && field.type !== 'upload') ||\n    !field.hasMany ||\n    typeof field.relationTo !== 'string' ||\n    value === null ||\n    typeof value !== 'object' ||\n    Array.isArray(value)\n  ) {\n    return\n  }\n\n  const relatedFields = payload.collections[field.relationTo]?.config.flattenedFields\n  if (!relatedFields) {\n    return\n  }\n\n  for (const operator of hasManyRelationshipOperators) {\n    const nestedWhere = (value as Record<string, unknown>)[operator]\n\n    if (isNestedRelationshipQuery(nestedWhere)) {\n      sanitizeWhereQuery({ fields: relatedFields, payload, where: nestedWhere })\n    }\n  }\n}\n"],"names":["hasManyRelationshipOperators","isNestedRelationshipQuery","sanitizeWhereQuery","fields","payload","where","key","value","includes","toLowerCase","Array","isArray","paths","split","pathHasChanged","currentFields","finalField","i","length","path","field","find","each","name","virtual","flattenedFields","type","relationTo","relatedCollection","collections","config","sanitizeNestedHasManyRelationshipQueries","join","hasMany","relatedFields","operator","nestedWhere"],"mappings":"AAGA,SAASA,4BAA4B,QAAQ,wBAAuB;AACpE,SAASC,yBAAyB,QAAQ,iCAAgC;AAE1E;;CAEC,GACD,OAAO,MAAMC,qBAAqB,CAAC,EACjCC,MAAM,EACNC,OAAO,EACPC,KAAK,EAKN;IACC,IAAK,MAAMC,OAAOD,MAAO;QACvB,MAAME,QAAQF,KAAK,CAACC,IAAI;QAExB,IAAI;YAAC;YAAO;SAAK,CAACE,QAAQ,CAACF,IAAIG,WAAW,OAAOC,MAAMC,OAAO,CAACJ,QAAQ;YACrE,KAAK,MAAMF,SAASE,MAAO;gBACzBL,mBAAmB;oBAAEC;oBAAQC;oBAASC;gBAAM;YAC9C;YACA;QACF;QAEA,MAAMO,QAAQN,IAAIO,KAAK,CAAC;QACxB,IAAIC,iBAAiB;QAErB,IAAIC,gBAAgBZ;QACpB,IAAIa;QAEJ,IAAK,IAAIC,IAAI,GAAGA,IAAIL,MAAMM,MAAM,EAAED,IAAK;YACrC,MAAME,OAAOP,KAAK,CAACK,EAAE;YACrB,MAAMG,QAAQL,cAAcM,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKJ;YAEzD,IAAI,CAACC,OAAO;gBACV;YACF;YAEAJ,aAAaI;YAEb,IAAI,aAAaA,SAASA,MAAMI,OAAO,IAAI,OAAOJ,MAAMI,OAAO,KAAK,UAAU;gBAC5EZ,KAAK,CAACK,EAAE,GAAGG,MAAMI,OAAO;gBACxBV,iBAAiB;YACnB;YAEA,IAAI,qBAAqBM,OAAO;gBAC9BL,gBAAgBK,MAAMK,eAAe;YACvC;YAEA,IACE,AAACL,CAAAA,MAAMM,IAAI,KAAK,kBAAkBN,MAAMM,IAAI,KAAK,QAAO,KACxD,OAAON,MAAMO,UAAU,KAAK,UAC5B;gBACA,MAAMC,oBAAoBxB,QAAQyB,WAAW,CAACT,MAAMO,UAAU,CAAC;gBAC/D,IAAIC,mBAAmB;oBACrBb,gBAAgBa,kBAAkBE,MAAM,CAACL,eAAe;gBAC1D;YACF;QACF;QAEA,uFAAuF;QACvFM,yCAAyC;YAAEX,OAAOJ;YAAYZ;YAASG;QAAM;QAE7E,IAAIO,gBAAgB;YAClBT,KAAK,CAACO,MAAMoB,IAAI,CAAC,KAAK,GAAG3B,KAAK,CAACC,IAAI;YACnC,OAAOD,KAAK,CAACC,IAAI;QACnB;IACF;AACF,EAAC;AAED;;;;;;;;;;;;;;CAcC,GACD,SAASyB,yCAAyC,EAChDX,KAAK,EACLhB,OAAO,EACPG,KAAK,EAKN;IACC,IACE,CAACa,SACAA,MAAMM,IAAI,KAAK,kBAAkBN,MAAMM,IAAI,KAAK,YACjD,CAACN,MAAMa,OAAO,IACd,OAAOb,MAAMO,UAAU,KAAK,YAC5BpB,UAAU,QACV,OAAOA,UAAU,YACjBG,MAAMC,OAAO,CAACJ,QACd;QACA;IACF;IAEA,MAAM2B,gBAAgB9B,QAAQyB,WAAW,CAACT,MAAMO,UAAU,CAAC,EAAEG,OAAOL;IACpE,IAAI,CAACS,eAAe;QAClB;IACF;IAEA,KAAK,MAAMC,YAAYnC,6BAA8B;QACnD,MAAMoC,cAAc,AAAC7B,KAAiC,CAAC4B,SAAS;QAEhE,IAAIlC,0BAA0BmC,cAAc;YAC1ClC,mBAAmB;gBAAEC,QAAQ+B;gBAAe9B;gBAASC,OAAO+B;YAAY;QAC1E;IACF;AACF"}