payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/auth/baseFields/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/baseFields/auth.ts"],"sourcesContent":["import type { Field } from '../../fields/config/types.js'\n\nexport const baseAuthFields: Field[] = [\n  {\n    name: 'resetPasswordToken',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'resetPasswordExpiration',\n    type: 'date',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'salt',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'hash',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n]\n"],"names":["baseAuthFields","name","type","access","create","update","hidden"],"mappings":"AAEA,OAAO,MAAMA,iBAA0B;IACrC;QACEC,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;CACD,CAAA"}
+{"version":3,"sources":["../../../src/auth/baseFields/auth.ts"],"sourcesContent":["import type { Field } from '../../fields/config/types.js'\n\nexport const baseAuthFields: Field[] = [\n  {\n    name: 'resetPasswordToken',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'resetPasswordExpiration',\n    type: 'date',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'salt',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'hash',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n]\n\nexport const resetPasswordRequestedAtField: Field = {\n  name: 'resetPasswordRequestedAt',\n  type: 'date',\n  access: {\n    create: () => false,\n    update: () => false,\n  },\n  hidden: true,\n}\n"],"names":["baseAuthFields","name","type","access","create","update","hidden","resetPasswordRequestedAtField"],"mappings":"AAEA,OAAO,MAAMA,iBAA0B;IACrC;QACEC,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;CACD,CAAA;AAED,OAAO,MAAMC,gCAAuC;IAClDN,MAAM;IACNC,MAAM;IACNC,QAAQ;QACNC,QAAQ,IAAM;QACdC,QAAQ,IAAM;IAChB;IACAC,QAAQ;AACV,EAAC"}

package/dist/auth/crypto.d.ts

@@ -1,3 +1,74 @@
-export declare function encrypt(text: string): string;
-export declare function decrypt(hash: string): string;
+/**
+ * A single secret in the keyring, with its derived keys precomputed.
+ */
+export type EncryptionKey = {
+    /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */
+    keyId: string;
+    /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */
+    legacyKey: string;
+    /** The raw `PAYLOAD_SECRET` string. */
+    secret: string;
+    /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */
+    v1Key: Buffer;
+};
+/**
+ * The set of secrets Payload accepts. `active` is used for all writes; every
+ * entry (active + `previousSecrets`) is accepted for reads.
+ */
+export type EncryptionKeyring = {
+    /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */
+    active: EncryptionKey;
+    all: EncryptionKey[];
+    /** keyId -> entry, for O(1) v1 key selection. */
+    byId: Record<string, EncryptionKey>;
+};
+type CryptoContext = {
+    encryptionKeyring: EncryptionKeyring;
+    secret: string;
+};
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */
+export declare const deriveSecretKey: (secret: string) => string;
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */
+export declare const deriveKeyV1: (secret: string) => Buffer;
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */
+export declare const keyIdFor: (v1Key: Buffer) => string;
+export declare const buildEncryptionKey: (secret: string) => EncryptionKey;
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */
+export declare const buildEncryptionKeyring: (secrets: string[]) => EncryptionKeyring;
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */
+export declare function encrypt(this: CryptoContext, text: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */
+export declare function decrypt(this: CryptoContext, hash: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */
+export declare function reencrypt(this: CryptoContext, hash: string, options: {
+    oldSecret: string;
+}): string;
+export {};
 //# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5C;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS5C"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oEAAoE;IACpE,MAAM,EAAE,aAAa,CAAA;IACrB,GAAG,EAAE,aAAa,EAAE,CAAA;IACpB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CACpC,CAAA;AAED,KAAK,aAAa,GAAG;IACnB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAMD;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,MACsB,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,MACgC,CAAA;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MAC6B,CAAA;AAEtE,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,aAQnD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,YAAa,MAAM,EAAE,KAAG,iBAU1D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAUhG;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAuChG;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7B,MAAM,CAGR"}

package/dist/auth/crypto.js

@@ -1,21 +1,98 @@
 import crypto from 'crypto';
-const algorithm = 'aes-256-ctr';
-export function encrypt(text) {
-    const iv = crypto.randomBytes(16);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const cipher = crypto.createCipheriv(algorithm, secret, iv);
-    const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
-    const ivString = iv.toString('hex');
-    return `${ivString}${encrypted}`;
+const legacyAlgorithm = 'aes-256-ctr';
+const v1Algorithm = 'aes-256-gcm';
+const v1Prefix = 'v1';
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */ export const deriveSecretKey = (secret)=>crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32);
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */ export const deriveKeyV1 = (secret)=>Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32));
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */ export const keyIdFor = (v1Key)=>crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16);
+export const buildEncryptionKey = (secret)=>{
+    const v1Key = deriveKeyV1(secret);
+    return {
+        keyId: keyIdFor(v1Key),
+        legacyKey: deriveSecretKey(secret),
+        secret,
+        v1Key
+    };
+};
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */ export const buildEncryptionKeyring = (secrets)=>{
+    const all = secrets.map(buildEncryptionKey);
+    const byId = {};
+    for (const key of all){
+        // First writer wins if two secrets somehow share a keyId.
+        if (!byId[key.keyId]) {
+            byId[key.keyId] = key;
+        }
+    }
+    return {
+        active: all[0],
+        all,
+        byId
+    };
+};
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */ export function encrypt(text, options) {
+    const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active;
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv);
+    const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`;
 }
-export function decrypt(hash) {
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */ export function decrypt(hash, options) {
+    if (hash.startsWith(`${v1Prefix}:`)) {
+        const parts = hash.split(':');
+        if (parts.length !== 5) {
+            throw new Error('decrypt: malformed v1 envelope, expected "v1:keyId:iv:authTag:ciphertext".');
+        }
+        const [, keyId, ivHex, authTagHex, ciphertext] = parts;
+        const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.byId[keyId];
+        if (!key) {
+            throw new Error(`decrypt: no secret in the keyring matches key id "${keyId}". Add the secret that encrypted this value to config.previousSecrets.`);
+        }
+        const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex, 'hex'));
+        decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
+        // final() throws on a wrong key or tampered ciphertext.
+        return decipher.update(ciphertext, 'hex', 'utf8') + decipher.final('utf8');
+    }
+    // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong
+    // key returns garbage instead of throwing. We therefore intentionally use only
+    // the explicit or active key here (never trial the keyring): a legacy value
+    // written under a previous secret decrypts to garbage until rotateSecret
+    // upgrades it to the authenticated v1 envelope. API key auth is unaffected
+    // (it matches the HMAC apiKeyIndex, which is keyring-aware).
+    const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret;
     const iv = hash.slice(0, 32);
     const content = hash.slice(32);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'));
+    const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'));
     return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8');
 }
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */ export function reencrypt(hash, options) {
+    const plaintext = decrypt.call(this, hash, {
+        secret: options.oldSecret
+    });
+    return encrypt.call(this, plaintext);
+}
 
 //# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\nconst algorithm = 'aes-256-ctr'\n\nexport function encrypt(text: string): string {\n  const iv = crypto.randomBytes(16)\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const cipher = crypto.createCipheriv(algorithm, secret, iv)\n\n  const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const ivString = iv.toString('hex')\n\n  return `${ivString}${encrypted}`\n}\n\nexport function decrypt(hash: string): string {\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n"],"names":["crypto","algorithm","encrypt","text","iv","randomBytes","secret","cipher","createCipheriv","encrypted","update","final","ivString","toString","decrypt","hash","slice","content","decipher","createDecipheriv","Buffer","from"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAE3B,MAAMC,YAAY;AAElB,OAAO,SAASC,QAAQC,IAAY;IAClC,MAAMC,KAAKJ,OAAOK,WAAW,CAAC;IAC9B,oFAAoF;IACpF,MAAMC,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMC,SAASP,OAAOQ,cAAc,CAACP,WAAWK,QAAQF;IAExD,MAAMK,YAAYF,OAAOG,MAAM,CAACP,MAAM,QAAQ,SAASI,OAAOI,KAAK,CAAC;IACpE,MAAMC,WAAWR,GAAGS,QAAQ,CAAC;IAE7B,OAAO,GAAGD,WAAWH,WAAW;AAClC;AAEA,OAAO,SAASK,QAAQC,IAAY;IAClC,MAAMX,KAAKW,KAAKC,KAAK,CAAC,GAAG;IACzB,MAAMC,UAAUF,KAAKC,KAAK,CAAC;IAE3B,oFAAoF;IACpF,MAAMV,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMY,WAAWlB,OAAOmB,gBAAgB,CAAClB,WAAWK,QAAQc,OAAOC,IAAI,CAACjB,IAAI;IAE5E,OAAOc,SAASR,MAAM,CAACO,SAAS,OAAO,UAAUC,SAASP,KAAK,CAAC;AAClE"}
+{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\n/**\n * A single secret in the keyring, with its derived keys precomputed.\n */\nexport type EncryptionKey = {\n  /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */\n  keyId: string\n  /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */\n  legacyKey: string\n  /** The raw `PAYLOAD_SECRET` string. */\n  secret: string\n  /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */\n  v1Key: Buffer\n}\n\n/**\n * The set of secrets Payload accepts. `active` is used for all writes; every\n * entry (active + `previousSecrets`) is accepted for reads.\n */\nexport type EncryptionKeyring = {\n  /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */\n  active: EncryptionKey\n  all: EncryptionKey[]\n  /** keyId -> entry, for O(1) v1 key selection. */\n  byId: Record<string, EncryptionKey>\n}\n\ntype CryptoContext = {\n  encryptionKeyring: EncryptionKeyring\n  secret: string\n}\n\nconst legacyAlgorithm = 'aes-256-ctr'\nconst v1Algorithm = 'aes-256-gcm'\nconst v1Prefix = 'v1'\n\n/**\n * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).\n * Kept in sync with `BasePayload.secret`.\n */\nexport const deriveSecretKey = (secret: string): string =>\n  crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32)\n\n/**\n * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced\n * effective entropy of the legacy derivation.\n */\nexport const deriveKeyV1 = (secret: string): Buffer =>\n  Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32))\n\n/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */\nexport const keyIdFor = (v1Key: Buffer): string =>\n  crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16)\n\nexport const buildEncryptionKey = (secret: string): EncryptionKey => {\n  const v1Key = deriveKeyV1(secret)\n  return {\n    keyId: keyIdFor(v1Key),\n    legacyKey: deriveSecretKey(secret),\n    secret,\n    v1Key,\n  }\n}\n\n/**\n * Builds the keyring from the active secret followed by any previous secrets.\n * The first entry is the active (writing) key.\n */\nexport const buildEncryptionKeyring = (secrets: string[]): EncryptionKeyring => {\n  const all = secrets.map(buildEncryptionKey)\n  const byId: Record<string, EncryptionKey> = {}\n  for (const key of all) {\n    // First writer wins if two secrets somehow share a keyId.\n    if (!byId[key.keyId]) {\n      byId[key.keyId] = key\n    }\n  }\n  return { active: all[0]!, all, byId }\n}\n\n/**\n * Encrypts `text` under the active secret using the versioned aes-256-gcm\n * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the\n * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.\n */\nexport function encrypt(this: CryptoContext, text: string, options?: { secret?: string }): string {\n  const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active\n\n  const iv = crypto.randomBytes(12)\n  const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv)\n\n  const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const authTag = cipher.getAuthTag().toString('hex')\n\n  return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`\n}\n\n/**\n * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1\n * envelopes are authenticated (aes-256-gcm) and select their key by keyId from\n * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to\n * decrypt under a specific secret (e.g. to read data encrypted under a previous\n * secret during a rotation).\n */\nexport function decrypt(this: CryptoContext, hash: string, options?: { secret?: string }): string {\n  if (hash.startsWith(`${v1Prefix}:`)) {\n    const parts = hash.split(':')\n\n    if (parts.length !== 5) {\n      throw new Error('decrypt: malformed v1 envelope, expected \"v1:keyId:iv:authTag:ciphertext\".')\n    }\n\n    const [, keyId, ivHex, authTagHex, ciphertext] = parts\n\n    const key = options?.secret\n      ? buildEncryptionKey(options.secret)\n      : this.encryptionKeyring.byId[keyId!]\n\n    if (!key) {\n      throw new Error(\n        `decrypt: no secret in the keyring matches key id \"${keyId}\". Add the secret that encrypted this value to config.previousSecrets.`,\n      )\n    }\n\n    const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex!, 'hex'))\n    decipher.setAuthTag(Buffer.from(authTagHex!, 'hex'))\n\n    // final() throws on a wrong key or tampered ciphertext.\n    return decipher.update(ciphertext!, 'hex', 'utf8') + decipher.final('utf8')\n  }\n\n  // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong\n  // key returns garbage instead of throwing. We therefore intentionally use only\n  // the explicit or active key here (never trial the keyring): a legacy value\n  // written under a previous secret decrypts to garbage until rotateSecret\n  // upgrades it to the authenticated v1 envelope. API key auth is unaffected\n  // (it matches the HMAC apiKeyIndex, which is keyring-aware).\n  const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n  const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n\n/**\n * Re-encrypts a value that was encrypted under a previous secret: decrypts it\n * with `options.oldSecret`, then re-encrypts it with the active secret. Also\n * upgrades a legacy aes-256-ctr value to the v1 envelope.\n */\nexport function reencrypt(\n  this: CryptoContext,\n  hash: string,\n  options: { oldSecret: string },\n): string {\n  const plaintext = decrypt.call(this, hash, { secret: options.oldSecret })\n  return encrypt.call(this, plaintext)\n}\n"],"names":["crypto","legacyAlgorithm","v1Algorithm","v1Prefix","deriveSecretKey","secret","createHash","update","digest","slice","deriveKeyV1","Buffer","from","hkdfSync","keyIdFor","v1Key","buildEncryptionKey","keyId","legacyKey","buildEncryptionKeyring","secrets","all","map","byId","key","active","encrypt","text","options","encryptionKeyring","iv","randomBytes","cipher","createCipheriv","ciphertext","final","authTag","getAuthTag","toString","decrypt","hash","startsWith","parts","split","length","Error","ivHex","authTagHex","decipher","createDecipheriv","setAuthTag","content","reencrypt","plaintext","call","oldSecret"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAiC3B,MAAMC,kBAAkB;AACxB,MAAMC,cAAc;AACpB,MAAMC,WAAW;AAEjB;;;CAGC,GACD,OAAO,MAAMC,kBAAkB,CAACC,SAC9BL,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACF,QAAQG,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEvE;;;CAGC,GACD,OAAO,MAAMC,cAAc,CAACL,SAC1BM,OAAOC,IAAI,CAACZ,OAAOa,QAAQ,CAAC,UAAUR,QAAQ,IAAI,qBAAqB,KAAI;AAE7E,2EAA2E,GAC3E,OAAO,MAAMS,WAAW,CAACC,QACvBf,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACQ,OAAOP,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEtE,OAAO,MAAMO,qBAAqB,CAACX;IACjC,MAAMU,QAAQL,YAAYL;IAC1B,OAAO;QACLY,OAAOH,SAASC;QAChBG,WAAWd,gBAAgBC;QAC3BA;QACAU;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMI,yBAAyB,CAACC;IACrC,MAAMC,MAAMD,QAAQE,GAAG,CAACN;IACxB,MAAMO,OAAsC,CAAC;IAC7C,KAAK,MAAMC,OAAOH,IAAK;QACrB,0DAA0D;QAC1D,IAAI,CAACE,IAAI,CAACC,IAAIP,KAAK,CAAC,EAAE;YACpBM,IAAI,CAACC,IAAIP,KAAK,CAAC,GAAGO;QACpB;IACF;IACA,OAAO;QAAEC,QAAQJ,GAAG,CAAC,EAAE;QAAGA;QAAKE;IAAK;AACtC,EAAC;AAED;;;;CAIC,GACD,OAAO,SAASG,QAA6BC,IAAY,EAAEC,OAA6B;IACtF,MAAMJ,MAAMI,SAASvB,SAASW,mBAAmBY,QAAQvB,MAAM,IAAI,IAAI,CAACwB,iBAAiB,CAACJ,MAAM;IAEhG,MAAMK,KAAK9B,OAAO+B,WAAW,CAAC;IAC9B,MAAMC,SAAShC,OAAOiC,cAAc,CAAC/B,aAAasB,IAAIT,KAAK,EAAEe;IAE7D,MAAMI,aAAaF,OAAOzB,MAAM,CAACoB,MAAM,QAAQ,SAASK,OAAOG,KAAK,CAAC;IACrE,MAAMC,UAAUJ,OAAOK,UAAU,GAAGC,QAAQ,CAAC;IAE7C,OAAO,GAAGnC,SAAS,CAAC,EAAEqB,IAAIP,KAAK,CAAC,CAAC,EAAEa,GAAGQ,QAAQ,CAAC,OAAO,CAAC,EAAEF,QAAQ,CAAC,EAAEF,YAAY;AAClF;AAEA;;;;;;CAMC,GACD,OAAO,SAASK,QAA6BC,IAAY,EAAEZ,OAA6B;IACtF,IAAIY,KAAKC,UAAU,CAAC,GAAGtC,SAAS,CAAC,CAAC,GAAG;QACnC,MAAMuC,QAAQF,KAAKG,KAAK,CAAC;QAEzB,IAAID,MAAME,MAAM,KAAK,GAAG;YACtB,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAM,GAAG5B,OAAO6B,OAAOC,YAAYb,WAAW,GAAGQ;QAEjD,MAAMlB,MAAMI,SAASvB,SACjBW,mBAAmBY,QAAQvB,MAAM,IACjC,IAAI,CAACwB,iBAAiB,CAACN,IAAI,CAACN,MAAO;QAEvC,IAAI,CAACO,KAAK;YACR,MAAM,IAAIqB,MACR,CAAC,kDAAkD,EAAE5B,MAAM,sEAAsE,CAAC;QAEtI;QAEA,MAAM+B,WAAWhD,OAAOiD,gBAAgB,CAAC/C,aAAasB,IAAIT,KAAK,EAAEJ,OAAOC,IAAI,CAACkC,OAAQ;QACrFE,SAASE,UAAU,CAACvC,OAAOC,IAAI,CAACmC,YAAa;QAE7C,wDAAwD;QACxD,OAAOC,SAASzC,MAAM,CAAC2B,YAAa,OAAO,UAAUc,SAASb,KAAK,CAAC;IACtE;IAEA,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMjB,YAAYU,SAASvB,SAASD,gBAAgBwB,QAAQvB,MAAM,IAAI,IAAI,CAACA,MAAM;IACjF,MAAMyB,KAAKU,KAAK/B,KAAK,CAAC,GAAG;IACzB,MAAM0C,UAAUX,KAAK/B,KAAK,CAAC;IAC3B,MAAMuC,WAAWhD,OAAOiD,gBAAgB,CAAChD,iBAAiBiB,WAAWP,OAAOC,IAAI,CAACkB,IAAI;IAErF,OAAOkB,SAASzC,MAAM,CAAC4C,SAAS,OAAO,UAAUH,SAASb,KAAK,CAAC;AAClE;AAEA;;;;CAIC,GACD,OAAO,SAASiB,UAEdZ,IAAY,EACZZ,OAA8B;IAE9B,MAAMyB,YAAYd,QAAQe,IAAI,CAAC,IAAI,EAAEd,MAAM;QAAEnC,QAAQuB,QAAQ2B,SAAS;IAAC;IACvE,OAAO7B,QAAQ4B,IAAI,CAAC,IAAI,EAAED;AAC5B"}

package/dist/auth/defaultUnlockAccess.d.ts

@@ -0,0 +1,3 @@
+import type { Access } from '../config/types.js';
+export declare const defaultUnlockAccess: Access;
+//# sourceMappingURL=defaultUnlockAccess.d.ts.map

package/dist/auth/defaultUnlockAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultUnlockAccess.d.ts","sourceRoot":"","sources":["../../src/auth/defaultUnlockAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,eAAO,MAAM,mBAAmB,EAAE,MAMjC,CAAA"}

package/dist/auth/defaultUnlockAccess.js

@@ -0,0 +1,8 @@
+export const defaultUnlockAccess = ({ req: { payload, user } })=>{
+    if (!user) {
+        return false;
+    }
+    return user.collection === payload.config.admin.user;
+};
+
+//# sourceMappingURL=defaultUnlockAccess.js.map

package/dist/auth/defaultUnlockAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/defaultUnlockAccess.ts"],"sourcesContent":["import type { Access } from '../config/types.js'\n\nexport const defaultUnlockAccess: Access = ({ req: { payload, user } }) => {\n  if (!user) {\n    return false\n  }\n\n  return user.collection === payload.config.admin.user\n}\n"],"names":["defaultUnlockAccess","req","payload","user","collection","config","admin"],"mappings":"AAEA,OAAO,MAAMA,sBAA8B,CAAC,EAAEC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE,EAAE;IACpE,IAAI,CAACA,MAAM;QACT,OAAO;IACT;IAEA,OAAOA,KAAKC,UAAU,KAAKF,QAAQG,MAAM,CAACC,KAAK,CAACH,IAAI;AACtD,EAAC"}

package/dist/auth/endpoints/index.d.ts

@@ -1,4 +1,5 @@
 import type { Endpoint } from '../../config/types.js';
 export declare const authRootEndpoints: Endpoint[];
+export declare const apiKeyRevealEndpoint: Endpoint;
 export declare const authCollectionEndpoints: Endpoint[];
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/endpoints/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAerD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,EAMtC,CAAA;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,EAmD5C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAgBrD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,EAMtC,CAAA;AAEF,eAAO,MAAM,oBAAoB,EAAE,QAM7B,CAAA;AAEN,eAAO,MAAM,uBAAuB,EAAE,QAAQ,EAmD5C,CAAA"}

package/dist/auth/endpoints/index.js

@@ -8,6 +8,7 @@ import { meHandler } from './me.js';
 import { refreshHandler } from './refresh.js';
 import { registerFirstUserHandler } from './registerFirstUser.js';
 import { resetPasswordHandler } from './resetPassword.js';
+import { revealAPIKeyHandler } from './revealAPIKey.js';
 import { unlockHandler } from './unlock.js';
 import { verifyEmailHandler } from './verifyEmail.js';
 export const authRootEndpoints = wrapInternalEndpoints([
@@ -17,6 +18,13 @@ export const authRootEndpoints = wrapInternalEndpoints([
         path: '/access'
     }
 ]);
+export const apiKeyRevealEndpoint = wrapInternalEndpoints([
+    {
+        handler: revealAPIKeyHandler,
+        method: 'post',
+        path: '/:id/api-key/reveal'
+    }
+])[0];
 export const authCollectionEndpoints = wrapInternalEndpoints([
     {
         handler: forgotPasswordHandler,

package/dist/auth/endpoints/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { accessHandler } from './access.js'\nimport { forgotPasswordHandler } from './forgotPassword.js'\nimport { initHandler } from './init.js'\nimport { loginHandler } from './login.js'\nimport { logoutHandler } from './logout.js'\nimport { meHandler } from './me.js'\nimport { refreshHandler } from './refresh.js'\nimport { registerFirstUserHandler } from './registerFirstUser.js'\nimport { resetPasswordHandler } from './resetPassword.js'\nimport { unlockHandler } from './unlock.js'\nimport { verifyEmailHandler } from './verifyEmail.js'\n\nexport const authRootEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: accessHandler,\n    method: 'get',\n    path: '/access',\n  },\n])\n\nexport const authCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: forgotPasswordHandler,\n    method: 'post',\n    path: '/forgot-password',\n  },\n  {\n    handler: initHandler,\n    method: 'get',\n    path: '/init',\n  },\n  {\n    handler: loginHandler,\n    method: 'post',\n    path: '/login',\n  },\n  {\n    handler: logoutHandler,\n    method: 'post',\n    path: '/logout',\n  },\n  {\n    handler: meHandler,\n    method: 'get',\n    path: '/me',\n  },\n  {\n    handler: refreshHandler,\n    method: 'post',\n    path: '/refresh-token',\n  },\n  {\n    handler: registerFirstUserHandler,\n    method: 'post',\n    path: '/first-register',\n  },\n  {\n    handler: resetPasswordHandler,\n    method: 'post',\n    path: '/reset-password',\n  },\n  {\n    handler: unlockHandler,\n    method: 'post',\n    path: '/unlock',\n  },\n  {\n    handler: verifyEmailHandler,\n    method: 'post',\n    path: '/verify/:id',\n  },\n])\n"],"names":["wrapInternalEndpoints","accessHandler","forgotPasswordHandler","initHandler","loginHandler","logoutHandler","meHandler","refreshHandler","registerFirstUserHandler","resetPasswordHandler","unlockHandler","verifyEmailHandler","authRootEndpoints","handler","method","path","authCollectionEndpoints"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,qBAAqB,QAAQ,sBAAqB;AAC3D,SAASC,WAAW,QAAQ,YAAW;AACvC,SAASC,YAAY,QAAQ,aAAY;AACzC,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,SAAS,QAAQ,UAAS;AACnC,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,wBAAwB,QAAQ,yBAAwB;AACjE,SAASC,oBAAoB,QAAQ,qBAAoB;AACzD,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,kBAAkB,QAAQ,mBAAkB;AAErD,OAAO,MAAMC,oBAAgCZ,sBAAsB;IACjE;QACEa,SAASZ;QACTa,QAAQ;QACRC,MAAM;IACR;CACD,EAAC;AAEF,OAAO,MAAMC,0BAAsChB,sBAAsB;IACvE;QACEa,SAASX;QACTY,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASV;QACTW,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAAST;QACTU,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASR;QACTS,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASP;QACTQ,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASN;QACTO,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASL;QACTM,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASJ;QACTK,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { accessHandler } from './access.js'\nimport { forgotPasswordHandler } from './forgotPassword.js'\nimport { initHandler } from './init.js'\nimport { loginHandler } from './login.js'\nimport { logoutHandler } from './logout.js'\nimport { meHandler } from './me.js'\nimport { refreshHandler } from './refresh.js'\nimport { registerFirstUserHandler } from './registerFirstUser.js'\nimport { resetPasswordHandler } from './resetPassword.js'\nimport { revealAPIKeyHandler } from './revealAPIKey.js'\nimport { unlockHandler } from './unlock.js'\nimport { verifyEmailHandler } from './verifyEmail.js'\n\nexport const authRootEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: accessHandler,\n    method: 'get',\n    path: '/access',\n  },\n])\n\nexport const apiKeyRevealEndpoint: Endpoint = wrapInternalEndpoints([\n  {\n    handler: revealAPIKeyHandler,\n    method: 'post',\n    path: '/:id/api-key/reveal',\n  },\n])[0]!\n\nexport const authCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: forgotPasswordHandler,\n    method: 'post',\n    path: '/forgot-password',\n  },\n  {\n    handler: initHandler,\n    method: 'get',\n    path: '/init',\n  },\n  {\n    handler: loginHandler,\n    method: 'post',\n    path: '/login',\n  },\n  {\n    handler: logoutHandler,\n    method: 'post',\n    path: '/logout',\n  },\n  {\n    handler: meHandler,\n    method: 'get',\n    path: '/me',\n  },\n  {\n    handler: refreshHandler,\n    method: 'post',\n    path: '/refresh-token',\n  },\n  {\n    handler: registerFirstUserHandler,\n    method: 'post',\n    path: '/first-register',\n  },\n  {\n    handler: resetPasswordHandler,\n    method: 'post',\n    path: '/reset-password',\n  },\n  {\n    handler: unlockHandler,\n    method: 'post',\n    path: '/unlock',\n  },\n  {\n    handler: verifyEmailHandler,\n    method: 'post',\n    path: '/verify/:id',\n  },\n])\n"],"names":["wrapInternalEndpoints","accessHandler","forgotPasswordHandler","initHandler","loginHandler","logoutHandler","meHandler","refreshHandler","registerFirstUserHandler","resetPasswordHandler","revealAPIKeyHandler","unlockHandler","verifyEmailHandler","authRootEndpoints","handler","method","path","apiKeyRevealEndpoint","authCollectionEndpoints"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,qBAAqB,QAAQ,sBAAqB;AAC3D,SAASC,WAAW,QAAQ,YAAW;AACvC,SAASC,YAAY,QAAQ,aAAY;AACzC,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,SAAS,QAAQ,UAAS;AACnC,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,wBAAwB,QAAQ,yBAAwB;AACjE,SAASC,oBAAoB,QAAQ,qBAAoB;AACzD,SAASC,mBAAmB,QAAQ,oBAAmB;AACvD,SAASC,aAAa,QAAQ,cAAa;AAC3C,SAASC,kBAAkB,QAAQ,mBAAkB;AAErD,OAAO,MAAMC,oBAAgCb,sBAAsB;IACjE;QACEc,SAASb;QACTc,QAAQ;QACRC,MAAM;IACR;CACD,EAAC;AAEF,OAAO,MAAMC,uBAAiCjB,sBAAsB;IAClE;QACEc,SAASJ;QACTK,QAAQ;QACRC,MAAM;IACR;CACD,CAAC,CAAC,EAAE,CAAC;AAEN,OAAO,MAAME,0BAAsClB,sBAAsB;IACvE;QACEc,SAASZ;QACTa,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASX;QACTY,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASV;QACTW,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAAST;QACTU,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASR;QACTS,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASP;QACTQ,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASN;QACTO,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASL;QACTM,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}

package/dist/auth/endpoints/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D,eAAO,MAAM,YAAY,EAAE,cAgD1B,CAAA"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,YAAY,EAAE,cAsC1B,CAAA"}

package/dist/auth/endpoints/login.js

@@ -2,8 +2,7 @@ import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
 import { isNumber } from '../../utilities/isNumber.js';
-import { generatePayloadCookie } from '../cookies.js';
-import { loginOperation } from '../operations/login.js';
+import { loginWithCookie } from '../loginWithCookie.js';
 export const loginHandler = async (req)=>{
     const collection = getRequestCollection(req);
     const { searchParams, t } = req;
@@ -16,20 +15,12 @@ export const loginHandler = async (req)=>{
         email: typeof req.data?.email === 'string' ? req.data.email : '',
         password: typeof req.data?.password === 'string' ? req.data.password : ''
     };
-    const result = await loginOperation({
+    const { cookie, result } = await loginWithCookie({
         collection,
         data: authData,
         depth: isNumber(depth) ? Number(depth) : undefined,
         req
     });
-    const cookie = generatePayloadCookie({
-        collectionAuthConfig: collection.config.auth,
-        cookiePrefix: req.payload.config.cookiePrefix,
-        token: result.token
-    });
-    if (collection.config.auth.removeTokenFromResponses) {
-        delete result.token;
-    }
     return Response.json({
         message: t('authentication:passed'),
         ...result

package/dist/auth/endpoints/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/login.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { isNumber } from '../../utilities/isNumber.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { loginOperation } from '../operations/login.js'\n\nexport const loginHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const result = await loginOperation({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token!,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","isNumber","generatePayloadCookie","loginOperation","loginHandler","req","collection","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","result","Number","undefined","cookie","collectionAuthConfig","cookiePrefix","payload","token","removeTokenFromResponses","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,QAAQ,QAAQ,8BAA6B;AACtD,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,cAAc,QAAQ,yBAAwB;AAEvD,OAAO,MAAMC,eAA+B,OAAOC;IACjD,MAAMC,aAAaP,qBAAqBM;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAC/B,MAAMC,WACJL,WAAWM,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;QACvEC,UAAU,OAAOb,IAAIW,IAAI,EAAEE,aAAa,WAAWb,IAAIW,IAAI,CAACE,QAAQ,GAAG;IACzE,IACA;QACEH,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;IACzE;IAEN,MAAME,SAAS,MAAMhB,eAAe;QAClCG;QACAU,MAAML;QACNF,OAAOR,SAASQ,SAASW,OAAOX,SAASY;QACzChB;IACF;IAEA,MAAMiB,SAASpB,sBAAsB;QACnCqB,sBAAsBjB,WAAWM,MAAM,CAACC,IAAI;QAC5CW,cAAcnB,IAAIoB,OAAO,CAACb,MAAM,CAACY,YAAY;QAC7CE,OAAOP,OAAOO,KAAK;IACrB;IAEA,IAAIpB,WAAWM,MAAM,CAACC,IAAI,CAACc,wBAAwB,EAAE;QACnD,OAAOR,OAAOO,KAAK;IACrB;IAEA,OAAOE,SAASC,IAAI,CAClB;QACEC,SAAStB,EAAE;QACX,GAAGW,MAAM;IACX,GACA;QACEY,SAAS/B,gBAAgB;YACvB+B,SAAS,IAAIC,QAAQ;gBACnB,cAAcV;YAChB;YACAjB;QACF;QACAR,QAAQC,WAAWmC,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/login.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { isNumber } from '../../utilities/isNumber.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\n\nexport const loginHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const { cookie, result } = await loginWithCookie({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","isNumber","loginWithCookie","loginHandler","req","collection","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","cookie","result","Number","undefined","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,QAAQ,QAAQ,8BAA6B;AACtD,SAASC,eAAe,QAAQ,wBAAuB;AAEvD,OAAO,MAAMC,eAA+B,OAAOC;IACjD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAC/B,MAAMC,WACJL,WAAWM,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;QACvEC,UAAU,OAAOb,IAAIW,IAAI,EAAEE,aAAa,WAAWb,IAAIW,IAAI,CAACE,QAAQ,GAAG;IACzE,IACA;QACEH,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;IACzE;IAEN,MAAM,EAAEE,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMjB,gBAAgB;QAC/CG;QACAU,MAAML;QACNF,OAAOP,SAASO,SAASY,OAAOZ,SAASa;QACzCjB;IACF;IAEA,OAAOkB,SAASC,IAAI,CAClB;QACEC,SAASjB,EAAE;QACX,GAAGY,MAAM;IACX,GACA;QACEM,SAASzB,gBAAgB;YACvByB,SAAS,IAAIC,QAAQ;gBACnB,cAAcR;YAChB;YACAd;QACF;QACAP,QAAQC,WAAW6B,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,cAAc,EAAE,cAuC5B,CAAA"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,cAAc,EAAE,cAwC5B,CAAA"}

package/dist/auth/endpoints/refresh.js

@@ -14,21 +14,19 @@ export const refreshHandler = async (req)=>{
         collection,
         req
     });
+    const { refreshedToken, ...resultWithoutToken } = result;
     if (result.setCookie) {
         const cookie = generatePayloadCookie({
             collectionAuthConfig: collection.config.auth,
             cookiePrefix: req.payload.config.cookiePrefix,
-            token: result.refreshedToken
+            token: refreshedToken
         });
-        if (collection.config.auth.removeTokenFromResponses) {
-            // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-            delete result.refreshedToken;
-        }
         headers.set('Set-Cookie', cookie);
     }
+    const responseResult = collection.config.auth.removeTokenFromResponses ? resultWithoutToken : result;
     return Response.json({
         message: t('authentication:tokenRefreshSuccessful'),
-        ...result
+        ...responseResult
     }, {
         headers,
         status: httpStatus.OK

package/dist/auth/endpoints/refresh.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/refresh.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { refreshOperation } from '../operations/refresh.js'\n\nexport const refreshHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { t } = req\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  const result = await refreshOperation({\n    collection,\n    req,\n  })\n\n  if (result.setCookie) {\n    const cookie = generatePayloadCookie({\n      collectionAuthConfig: collection.config.auth,\n      cookiePrefix: req.payload.config.cookiePrefix,\n      token: result.refreshedToken,\n    })\n\n    if (collection.config.auth.removeTokenFromResponses) {\n      // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n      delete result.refreshedToken\n    }\n\n    headers.set('Set-Cookie', cookie)\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:tokenRefreshSuccessful'),\n      ...result,\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","generatePayloadCookie","refreshOperation","refreshHandler","req","collection","t","headers","Headers","result","setCookie","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","token","refreshedToken","removeTokenFromResponses","set","Response","json","message","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,gBAAgB,QAAQ,2BAA0B;AAE3D,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,CAAC,EAAE,GAAGF;IAEd,MAAMG,UAAUP,gBAAgB;QAC9BO,SAAS,IAAIC;QACbJ;IACF;IAEA,MAAMK,SAAS,MAAMP,iBAAiB;QACpCG;QACAD;IACF;IAEA,IAAIK,OAAOC,SAAS,EAAE;QACpB,MAAMC,SAASV,sBAAsB;YACnCW,sBAAsBP,WAAWQ,MAAM,CAACC,IAAI;YAC5CC,cAAcX,IAAIY,OAAO,CAACH,MAAM,CAACE,YAAY;YAC7CE,OAAOR,OAAOS,cAAc;QAC9B;QAEA,IAAIb,WAAWQ,MAAM,CAACC,IAAI,CAACK,wBAAwB,EAAE;YACnD,oFAAoF;YACpF,OAAOV,OAAOS,cAAc;QAC9B;QAEAX,QAAQa,GAAG,CAAC,cAAcT;IAC5B;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASjB,EAAE;QACX,GAAGG,MAAM;IACX,GACA;QACEF;QACAV,QAAQC,WAAW0B,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/refresh.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { refreshOperation } from '../operations/refresh.js'\n\nexport const refreshHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { t } = req\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  const result = await refreshOperation({\n    collection,\n    req,\n  })\n\n  const { refreshedToken, ...resultWithoutToken } = result\n\n  if (result.setCookie) {\n    const cookie = generatePayloadCookie({\n      collectionAuthConfig: collection.config.auth,\n      cookiePrefix: req.payload.config.cookiePrefix,\n      token: refreshedToken,\n    })\n\n    headers.set('Set-Cookie', cookie)\n  }\n\n  const responseResult = collection.config.auth.removeTokenFromResponses\n    ? resultWithoutToken\n    : result\n\n  return Response.json(\n    {\n      message: t('authentication:tokenRefreshSuccessful'),\n      ...responseResult,\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","generatePayloadCookie","refreshOperation","refreshHandler","req","collection","t","headers","Headers","result","refreshedToken","resultWithoutToken","setCookie","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","token","set","responseResult","removeTokenFromResponses","Response","json","message","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,gBAAgB,QAAQ,2BAA0B;AAE3D,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,CAAC,EAAE,GAAGF;IAEd,MAAMG,UAAUP,gBAAgB;QAC9BO,SAAS,IAAIC;QACbJ;IACF;IAEA,MAAMK,SAAS,MAAMP,iBAAiB;QACpCG;QACAD;IACF;IAEA,MAAM,EAAEM,cAAc,EAAE,GAAGC,oBAAoB,GAAGF;IAElD,IAAIA,OAAOG,SAAS,EAAE;QACpB,MAAMC,SAASZ,sBAAsB;YACnCa,sBAAsBT,WAAWU,MAAM,CAACC,IAAI;YAC5CC,cAAcb,IAAIc,OAAO,CAACH,MAAM,CAACE,YAAY;YAC7CE,OAAOT;QACT;QAEAH,QAAQa,GAAG,CAAC,cAAcP;IAC5B;IAEA,MAAMQ,iBAAiBhB,WAAWU,MAAM,CAACC,IAAI,CAACM,wBAAwB,GAClEX,qBACAF;IAEJ,OAAOc,SAASC,IAAI,CAClB;QACEC,SAASnB,EAAE;QACX,GAAGe,cAAc;IACnB,GACA;QACEd;QACAV,QAAQC,WAAW4B,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/revealAPIKey.d.ts

@@ -0,0 +1,7 @@
+import type { PayloadHandler } from '../../config/types.js';
+/**
+ * Reveals an encrypted API key when the collection explicitly enables reveal support.
+ * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.
+ */
+export declare const revealAPIKeyHandler: PayloadHandler;
+//# sourceMappingURL=revealAPIKey.d.ts.map

package/dist/auth/endpoints/revealAPIKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revealAPIKey.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/revealAPIKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAS3D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,cAmFjC,CAAA"}

package/dist/auth/endpoints/revealAPIKey.js

@@ -0,0 +1,122 @@
+import { combineQueries } from '../../database/combineQueries.js';
+import { UnauthorizedError } from '../../errors/UnauthorizedError.js';
+import { fieldAffectsData } from '../../fields/config/types.js';
+import { canAccessAdmin } from '../../utilities/canAccessAdmin.js';
+import { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js';
+import { executeAccess } from '../executeAccess.js';
+/**
+ * Reveals an encrypted API key when the collection explicitly enables reveal support.
+ * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.
+ */ export const revealAPIKeyHandler = async (req)=>{
+    const { id, collection } = getRequestCollectionWithID(req);
+    const useAPIKey = collection.config.auth.useAPIKey;
+    if (typeof useAPIKey !== 'object' || useAPIKey.reveal !== true || !req.user) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    try {
+        await canAccessAdmin({
+            req
+        });
+    } catch (error) {
+        if (error instanceof UnauthorizedError) {
+            return Response.json({
+                error: 'Forbidden'
+            }, {
+                status: 403
+            });
+        }
+        throw error;
+    }
+    const userWithReadAccess = await req.payload.findByID({
+        id,
+        collection: collection.config.slug,
+        depth: 0,
+        disableErrors: true,
+        overrideAccess: false,
+        req
+    });
+    if (!userWithReadAccess) {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    // Reveal is treated as a no-op update, so `data` reflects the current document.
+    const updateAccess = await executeAccess({
+        id,
+        slug: collection.config.slug,
+        data: userWithReadAccess,
+        disableErrors: true,
+        req
+    }, collection.config.access.update);
+    if (!updateAccess) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const user = await req.payload.db.findOne({
+        collection: collection.config.slug,
+        req,
+        select: {
+            apiKey: true
+        },
+        where: combineQueries({
+            id: {
+                equals: id
+            }
+        }, updateAccess)
+    });
+    if (!user) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const apiKeyField = collection.config.fields.find((field)=>fieldAffectsData(field) && field.name === 'apiKey');
+    if (!apiKeyField || !fieldAffectsData(apiKeyField) || !apiKeyField.access?.update) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const canUpdateAPIKey = await apiKeyField.access.update({
+        id,
+        collection: collection.config,
+        data: {},
+        doc: userWithReadAccess,
+        req,
+        siblingData: {}
+    });
+    if (!canUpdateAPIKey) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    if (!('apiKey' in user) || typeof user.apiKey !== 'string') {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    return Response.json({
+        apiKey: req.payload.decrypt(user.apiKey)
+    }, {
+        headers: {
+            'Cache-Control': 'no-store'
+        }
+    });
+};
+
+//# sourceMappingURL=revealAPIKey.js.map

package/dist/auth/endpoints/revealAPIKey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/endpoints/revealAPIKey.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { combineQueries } from '../../database/combineQueries.js'\nimport { UnauthorizedError } from '../../errors/UnauthorizedError.js'\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { canAccessAdmin } from '../../utilities/canAccessAdmin.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { executeAccess } from '../executeAccess.js'\n\n/**\n * Reveals an encrypted API key when the collection explicitly enables reveal support.\n * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.\n */\nexport const revealAPIKeyHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req)\n  const useAPIKey = collection.config.auth.useAPIKey\n\n  if (typeof useAPIKey !== 'object' || useAPIKey.reveal !== true || !req.user) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  try {\n    await canAccessAdmin({ req })\n  } catch (error) {\n    if (error instanceof UnauthorizedError) {\n      return Response.json({ error: 'Forbidden' }, { status: 403 })\n    }\n\n    throw error\n  }\n\n  const userWithReadAccess = await req.payload.findByID({\n    id,\n    collection: collection.config.slug,\n    depth: 0,\n    disableErrors: true,\n    overrideAccess: false,\n    req,\n  })\n\n  if (!userWithReadAccess) {\n    return Response.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  // Reveal is treated as a no-op update, so `data` reflects the current document.\n  const updateAccess = await executeAccess(\n    { id, slug: collection.config.slug, data: userWithReadAccess, disableErrors: true, req },\n    collection.config.access.update,\n  )\n\n  if (!updateAccess) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const user = await req.payload.db.findOne({\n    collection: collection.config.slug,\n    req,\n    select: {\n      apiKey: true,\n    },\n    where: combineQueries({ id: { equals: id } }, updateAccess),\n  })\n\n  if (!user) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const apiKeyField = collection.config.fields.find(\n    (field) => fieldAffectsData(field) && field.name === 'apiKey',\n  )\n\n  if (!apiKeyField || !fieldAffectsData(apiKeyField) || !apiKeyField.access?.update) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const canUpdateAPIKey = await apiKeyField.access.update({\n    id,\n    collection: collection.config,\n    data: {},\n    doc: userWithReadAccess,\n    req,\n    siblingData: {},\n  })\n\n  if (!canUpdateAPIKey) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  if (!('apiKey' in user) || typeof user.apiKey !== 'string') {\n    return Response.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  return Response.json(\n    { apiKey: req.payload.decrypt(user.apiKey) },\n    { headers: { 'Cache-Control': 'no-store' } },\n  )\n}\n"],"names":["combineQueries","UnauthorizedError","fieldAffectsData","canAccessAdmin","getRequestCollectionWithID","executeAccess","revealAPIKeyHandler","req","id","collection","useAPIKey","config","auth","reveal","user","Response","json","error","status","userWithReadAccess","payload","findByID","slug","depth","disableErrors","overrideAccess","updateAccess","data","access","update","db","findOne","select","apiKey","where","equals","apiKeyField","fields","find","field","name","canUpdateAPIKey","doc","siblingData","decrypt","headers"],"mappings":"AAEA,SAASA,cAAc,QAAQ,mCAAkC;AACjE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,aAAa,QAAQ,sBAAqB;AAEnD;;;CAGC,GACD,OAAO,MAAMC,sBAAsC,OAAOC;IACxD,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGL,2BAA2BG;IACtD,MAAMG,YAAYD,WAAWE,MAAM,CAACC,IAAI,CAACF,SAAS;IAElD,IAAI,OAAOA,cAAc,YAAYA,UAAUG,MAAM,KAAK,QAAQ,CAACN,IAAIO,IAAI,EAAE;QAC3E,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,IAAI;QACF,MAAMf,eAAe;YAAEI;QAAI;IAC7B,EAAE,OAAOU,OAAO;QACd,IAAIA,iBAAiBhB,mBAAmB;YACtC,OAAOc,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAAY,GAAG;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMD;IACR;IAEA,MAAME,qBAAqB,MAAMZ,IAAIa,OAAO,CAACC,QAAQ,CAAC;QACpDb;QACAC,YAAYA,WAAWE,MAAM,CAACW,IAAI;QAClCC,OAAO;QACPC,eAAe;QACfC,gBAAgB;QAChBlB;IACF;IAEA,IAAI,CAACY,oBAAoB;QACvB,OAAOJ,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,gFAAgF;IAChF,MAAMQ,eAAe,MAAMrB,cACzB;QAAEG;QAAIc,MAAMb,WAAWE,MAAM,CAACW,IAAI;QAAEK,MAAMR;QAAoBK,eAAe;QAAMjB;IAAI,GACvFE,WAAWE,MAAM,CAACiB,MAAM,CAACC,MAAM;IAGjC,IAAI,CAACH,cAAc;QACjB,OAAOX,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMJ,OAAO,MAAMP,IAAIa,OAAO,CAACU,EAAE,CAACC,OAAO,CAAC;QACxCtB,YAAYA,WAAWE,MAAM,CAACW,IAAI;QAClCf;QACAyB,QAAQ;YACNC,QAAQ;QACV;QACAC,OAAOlC,eAAe;YAAEQ,IAAI;gBAAE2B,QAAQ3B;YAAG;QAAE,GAAGkB;IAChD;IAEA,IAAI,CAACZ,MAAM;QACT,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMkB,cAAc3B,WAAWE,MAAM,CAAC0B,MAAM,CAACC,IAAI,CAC/C,CAACC,QAAUrC,iBAAiBqC,UAAUA,MAAMC,IAAI,KAAK;IAGvD,IAAI,CAACJ,eAAe,CAAClC,iBAAiBkC,gBAAgB,CAACA,YAAYR,MAAM,EAAEC,QAAQ;QACjF,OAAOd,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMuB,kBAAkB,MAAML,YAAYR,MAAM,CAACC,MAAM,CAAC;QACtDrB;QACAC,YAAYA,WAAWE,MAAM;QAC7BgB,MAAM,CAAC;QACPe,KAAKvB;QACLZ;QACAoC,aAAa,CAAC;IAChB;IAEA,IAAI,CAACF,iBAAiB;QACpB,OAAO1B,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,IAAI,CAAE,CAAA,YAAYJ,IAAG,KAAM,OAAOA,KAAKmB,MAAM,KAAK,UAAU;QAC1D,OAAOlB,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,OAAOH,SAASC,IAAI,CAClB;QAAEiB,QAAQ1B,IAAIa,OAAO,CAACwB,OAAO,CAAC9B,KAAKmB,MAAM;IAAE,GAC3C;QAAEY,SAAS;YAAE,iBAAiB;QAAW;IAAE;AAE/C,EAAC"}

package/dist/auth/executeAccess.d.ts

@@ -6,7 +6,8 @@ type OperationArgs = {
     id?: number | string;
     isReadingStaticFile?: boolean;
     req: PayloadRequest;
+    slug: string;
 };
-export declare const executeAccess: ({ id, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access: Access) => Promise<AccessResult>;
+export declare const executeAccess: ({ id, slug, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access?: Access) => Promise<AccessResult>;
 export {};
 //# sourceMappingURL=executeAccess.d.ts.map

package/dist/auth/executeAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,eAAO,MAAM,aAAa,0DACuC,aAAa,UACpE,MAAM,KACb,OAAO,CAAC,YAAY,CA0BtB,CAAA"}
+{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AACD,eAAO,MAAM,aAAa,gEAC6C,aAAa,WACzE,MAAM,KACd,OAAO,CAAC,YAAY,CA2BtB,CAAA"}

package/dist/auth/executeAccess.js

@@ -1,8 +1,9 @@
 import { Forbidden } from '../errors/index.js';
-export const executeAccess = async ({ id, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
+export const executeAccess = async ({ id, slug, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
     if (access) {
         const resolvedConstraint = await access({
             id,
+            slug,
             data,
             isReadingStaticFile,
             req