payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/uploads/assertClientUploadAllowed.d.ts

@@ -0,0 +1,10 @@
+export declare const assertClientUploadAllowed: ({ collection, filename, mimeType, }: {
+    collection?: {
+        upload?: {
+            allowRestrictedFileTypes?: boolean;
+        } | boolean;
+    };
+    filename: unknown;
+    mimeType?: unknown;
+}) => void;
+//# sourceMappingURL=assertClientUploadAllowed.d.ts.map

package/dist/uploads/assertClientUploadAllowed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertClientUploadAllowed.d.ts","sourceRoot":"","sources":["../../src/uploads/assertClientUploadAllowed.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,yBAAyB,wCAInC;IACD,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE;YAAE,wBAAwB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAA;KAC1D,CAAA;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB,KAAG,IA+BH,CAAA"}

package/dist/uploads/assertClientUploadAllowed.js

@@ -0,0 +1,41 @@
+import { APIError } from '../errors/APIError.js';
+import { getSanitizedUploadFilename, uploadRequiresServerValidation } from './getFileTypeIdentity.js';
+const MIME_TYPE_PATTERN = /^[!#$%&'*+.^`|~\w-]+\/[!#$%&'*+.^`|~\w-]+$/;
+const isValidMimeType = (mimeType)=>{
+    if (typeof mimeType !== 'string' || mimeType.length === 0 || mimeType !== mimeType.trim() || [
+        ...mimeType
+    ].some((character)=>{
+        const codePoint = character.codePointAt(0);
+        return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f);
+    })) {
+        return false;
+    }
+    const [essence, ...parameters] = mimeType.split(';');
+    return MIME_TYPE_PATTERN.test(essence ?? '') && parameters.every((parameter)=>parameter.trim().length > 0);
+};
+export const assertClientUploadAllowed = ({ collection, filename, mimeType })=>{
+    if (typeof filename !== 'string' || filename.length === 0 || filename.trim().length === 0 || !getSanitizedUploadFilename(filename)) {
+        throw new APIError('A valid filename is required for client uploads.', 400);
+    }
+    const allowRestrictedFileTypes = collection && typeof collection.upload === 'object' ? collection.upload.allowRestrictedFileTypes : false;
+    // The explicit restricted-file opt-out also preserves legacy provider clients that did not
+    // send MIME metadata. Secure-default collections always require a bindable MIME identity.
+    if (mimeType === undefined || mimeType === null || mimeType === '') {
+        if (allowRestrictedFileTypes) {
+            return;
+        }
+        throw new APIError('A valid MIME type is required for client uploads.', 400);
+    }
+    if (!isValidMimeType(mimeType)) {
+        throw new APIError('A valid MIME type is required for client uploads.', 400);
+    }
+    if (uploadRequiresServerValidation({
+        allowRestrictedFileTypes,
+        filename,
+        mimeType
+    })) {
+        throw new APIError('SVG and XML files must be uploaded through Payload.', 400);
+    }
+};
+
+//# sourceMappingURL=assertClientUploadAllowed.js.map

package/dist/uploads/assertClientUploadAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/assertClientUploadAllowed.ts"],"sourcesContent":["import { APIError } from '../errors/APIError.js'\nimport {\n  getSanitizedUploadFilename,\n  uploadRequiresServerValidation,\n} from './getFileTypeIdentity.js'\n\nconst MIME_TYPE_PATTERN = /^[!#$%&'*+.^`|~\\w-]+\\/[!#$%&'*+.^`|~\\w-]+$/\n\nconst isValidMimeType = (mimeType: unknown): mimeType is string => {\n  if (\n    typeof mimeType !== 'string' ||\n    mimeType.length === 0 ||\n    mimeType !== mimeType.trim() ||\n    [...mimeType].some((character) => {\n      const codePoint = character.codePointAt(0)\n      return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)\n    })\n  ) {\n    return false\n  }\n\n  const [essence, ...parameters] = mimeType.split(';')\n  return (\n    MIME_TYPE_PATTERN.test(essence ?? '') &&\n    parameters.every((parameter) => parameter.trim().length > 0)\n  )\n}\n\nexport const assertClientUploadAllowed = ({\n  collection,\n  filename,\n  mimeType,\n}: {\n  collection?: {\n    upload?: { allowRestrictedFileTypes?: boolean } | boolean\n  }\n  filename: unknown\n  mimeType?: unknown\n}): void => {\n  if (\n    typeof filename !== 'string' ||\n    filename.length === 0 ||\n    filename.trim().length === 0 ||\n    !getSanitizedUploadFilename(filename)\n  ) {\n    throw new APIError('A valid filename is required for client uploads.', 400)\n  }\n\n  const allowRestrictedFileTypes =\n    collection && typeof collection.upload === 'object'\n      ? collection.upload.allowRestrictedFileTypes\n      : false\n\n  // The explicit restricted-file opt-out also preserves legacy provider clients that did not\n  // send MIME metadata. Secure-default collections always require a bindable MIME identity.\n  if (mimeType === undefined || mimeType === null || mimeType === '') {\n    if (allowRestrictedFileTypes) {\n      return\n    }\n    throw new APIError('A valid MIME type is required for client uploads.', 400)\n  }\n\n  if (!isValidMimeType(mimeType)) {\n    throw new APIError('A valid MIME type is required for client uploads.', 400)\n  }\n\n  if (uploadRequiresServerValidation({ allowRestrictedFileTypes, filename, mimeType })) {\n    throw new APIError('SVG and XML files must be uploaded through Payload.', 400)\n  }\n}\n"],"names":["APIError","getSanitizedUploadFilename","uploadRequiresServerValidation","MIME_TYPE_PATTERN","isValidMimeType","mimeType","length","trim","some","character","codePoint","codePointAt","undefined","essence","parameters","split","test","every","parameter","assertClientUploadAllowed","collection","filename","allowRestrictedFileTypes","upload"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SACEC,0BAA0B,EAC1BC,8BAA8B,QACzB,2BAA0B;AAEjC,MAAMC,oBAAoB;AAE1B,MAAMC,kBAAkB,CAACC;IACvB,IACE,OAAOA,aAAa,YACpBA,SAASC,MAAM,KAAK,KACpBD,aAAaA,SAASE,IAAI,MAC1B;WAAIF;KAAS,CAACG,IAAI,CAAC,CAACC;QAClB,MAAMC,YAAYD,UAAUE,WAAW,CAAC;QACxC,OAAOD,cAAcE,aAAcF,CAAAA,aAAa,QAAQA,cAAc,IAAG;IAC3E,IACA;QACA,OAAO;IACT;IAEA,MAAM,CAACG,SAAS,GAAGC,WAAW,GAAGT,SAASU,KAAK,CAAC;IAChD,OACEZ,kBAAkBa,IAAI,CAACH,WAAW,OAClCC,WAAWG,KAAK,CAAC,CAACC,YAAcA,UAAUX,IAAI,GAAGD,MAAM,GAAG;AAE9D;AAEA,OAAO,MAAMa,4BAA4B,CAAC,EACxCC,UAAU,EACVC,QAAQ,EACRhB,QAAQ,EAOT;IACC,IACE,OAAOgB,aAAa,YACpBA,SAASf,MAAM,KAAK,KACpBe,SAASd,IAAI,GAAGD,MAAM,KAAK,KAC3B,CAACL,2BAA2BoB,WAC5B;QACA,MAAM,IAAIrB,SAAS,oDAAoD;IACzE;IAEA,MAAMsB,2BACJF,cAAc,OAAOA,WAAWG,MAAM,KAAK,WACvCH,WAAWG,MAAM,CAACD,wBAAwB,GAC1C;IAEN,2FAA2F;IAC3F,0FAA0F;IAC1F,IAAIjB,aAAaO,aAAaP,aAAa,QAAQA,aAAa,IAAI;QAClE,IAAIiB,0BAA0B;YAC5B;QACF;QACA,MAAM,IAAItB,SAAS,qDAAqD;IAC1E;IAEA,IAAI,CAACI,gBAAgBC,WAAW;QAC9B,MAAM,IAAIL,SAAS,qDAAqD;IAC1E;IAEA,IAAIE,+BAA+B;QAAEoB;QAA0BD;QAAUhB;IAAS,IAAI;QACpF,MAAM,IAAIL,SAAS,uDAAuD;IAC5E;AACF,EAAC"}

package/dist/uploads/checkFileAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAK9D,eAAO,MAAM,eAAe,2CAKzB;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CA8CjC,CAAA"}
+{"version":3,"file":"checkFileAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAM9D,eAAO,MAAM,eAAe,2CAKzB;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAoCjC,CAAA"}

package/dist/uploads/checkFileAccess.js

@@ -1,11 +1,13 @@
 import { executeAccess } from '../auth/executeAccess.js';
 import { Forbidden } from '../errors/Forbidden.js';
+import { buildFilenameWhere } from './transformers/resolveUploadDocument.js';
 export const checkFileAccess = async ({ collection, filename, prefix, req })=>{
     if (filename.includes('../') || filename.includes('..\\')) {
         throw new Forbidden(req.t);
     }
     const { config } = collection;
     const accessResult = await executeAccess({
+        slug: config.slug,
         data: {
             filename
         },
@@ -24,24 +26,10 @@ export const checkFileAccess = async ({ collection, filename, prefix, req })=>{
         });
     }
     if (constraints.length > 0) {
-        const filenameCondition = {
-            or: [
-                {
-                    filename: {
-                        equals: filename
-                    }
-                }
-            ]
-        };
-        if (config.upload.imageSizes) {
-            config.upload.imageSizes.forEach(({ name })=>{
-                filenameCondition.or.push({
-                    [`sizes.${name}.filename`]: {
-                        equals: filename
-                    }
-                });
-            });
-        }
+        const filenameCondition = buildFilenameWhere({
+            filename,
+            variants: config.upload.variants
+        });
         const doc = await req.payload.db.findOne({
             collection: config.slug,
             req,

package/dist/uploads/checkFileAccess.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileAccess.ts"],"sourcesContent":["import type { Collection, TypeWithID } from '../collections/config/types.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\n\nexport const checkFileAccess = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<TypeWithID | undefined> => {\n  if (filename.includes('../') || filename.includes('..\\\\')) {\n    throw new Forbidden(req.t)\n  }\n  const { config } = collection\n\n  const accessResult = await executeAccess(\n    { data: { filename }, isReadingStaticFile: true, req },\n    config.access.read,\n  )\n\n  const constraints: Where[] = []\n\n  if (typeof accessResult === 'object') {\n    constraints.push(accessResult)\n  }\n\n  if (typeof prefix === 'string') {\n    constraints.push({ prefix: { equals: prefix } })\n  }\n\n  if (constraints.length > 0) {\n    const filenameCondition: Where = {\n      or: [{ filename: { equals: filename } }],\n    }\n\n    if (config.upload.imageSizes) {\n      config.upload.imageSizes.forEach(({ name }) => {\n        filenameCondition.or!.push({\n          [`sizes.${name}.filename`]: { equals: filename },\n        })\n      })\n    }\n\n    const doc = await req.payload.db.findOne({\n      collection: config.slug,\n      req,\n      where: { and: [filenameCondition, ...constraints] },\n    })\n\n    if (!doc) {\n      throw new Forbidden(req.t)\n    }\n\n    return doc\n  }\n}\n"],"names":["executeAccess","Forbidden","checkFileAccess","collection","filename","prefix","req","includes","t","config","accessResult","data","isReadingStaticFile","access","read","constraints","push","equals","length","filenameCondition","or","upload","imageSizes","forEach","name","doc","payload","db","findOne","slug","where","and"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAElD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,IAAIF,SAASG,QAAQ,CAAC,UAAUH,SAASG,QAAQ,CAAC,SAAS;QACzD,MAAM,IAAIN,UAAUK,IAAIE,CAAC;IAC3B;IACA,MAAM,EAAEC,MAAM,EAAE,GAAGN;IAEnB,MAAMO,eAAe,MAAMV,cACzB;QAAEW,MAAM;YAAEP;QAAS;QAAGQ,qBAAqB;QAAMN;IAAI,GACrDG,OAAOI,MAAM,CAACC,IAAI;IAGpB,MAAMC,cAAuB,EAAE;IAE/B,IAAI,OAAOL,iBAAiB,UAAU;QACpCK,YAAYC,IAAI,CAACN;IACnB;IAEA,IAAI,OAAOL,WAAW,UAAU;QAC9BU,YAAYC,IAAI,CAAC;YAAEX,QAAQ;gBAAEY,QAAQZ;YAAO;QAAE;IAChD;IAEA,IAAIU,YAAYG,MAAM,GAAG,GAAG;QAC1B,MAAMC,oBAA2B;YAC/BC,IAAI;gBAAC;oBAAEhB,UAAU;wBAAEa,QAAQb;oBAAS;gBAAE;aAAE;QAC1C;QAEA,IAAIK,OAAOY,MAAM,CAACC,UAAU,EAAE;YAC5Bb,OAAOY,MAAM,CAACC,UAAU,CAACC,OAAO,CAAC,CAAC,EAAEC,IAAI,EAAE;gBACxCL,kBAAkBC,EAAE,CAAEJ,IAAI,CAAC;oBACzB,CAAC,CAAC,MAAM,EAAEQ,KAAK,SAAS,CAAC,CAAC,EAAE;wBAAEP,QAAQb;oBAAS;gBACjD;YACF;QACF;QAEA,MAAMqB,MAAM,MAAMnB,IAAIoB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACvCzB,YAAYM,OAAOoB,IAAI;YACvBvB;YACAwB,OAAO;gBAAEC,KAAK;oBAACZ;uBAAsBJ;iBAAY;YAAC;QACpD;QAEA,IAAI,CAACU,KAAK;YACR,MAAM,IAAIxB,UAAUK,IAAIE,CAAC;QAC3B;QAEA,OAAOiB;IACT;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileAccess.ts"],"sourcesContent":["import type { Collection, TypeWithID } from '../collections/config/types.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\nimport { buildFilenameWhere } from './transformers/resolveUploadDocument.js'\n\nexport const checkFileAccess = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<TypeWithID | undefined> => {\n  if (filename.includes('../') || filename.includes('..\\\\')) {\n    throw new Forbidden(req.t)\n  }\n  const { config } = collection\n\n  const accessResult = await executeAccess(\n    { slug: config.slug, data: { filename }, isReadingStaticFile: true, req },\n    config.access.read,\n  )\n\n  const constraints: Where[] = []\n\n  if (typeof accessResult === 'object') {\n    constraints.push(accessResult)\n  }\n\n  if (typeof prefix === 'string') {\n    constraints.push({ prefix: { equals: prefix } })\n  }\n\n  if (constraints.length > 0) {\n    const filenameCondition = buildFilenameWhere({ filename, variants: config.upload.variants })\n\n    const doc = await req.payload.db.findOne({\n      collection: config.slug,\n      req,\n      where: { and: [filenameCondition, ...constraints] },\n    })\n\n    if (!doc) {\n      throw new Forbidden(req.t)\n    }\n\n    return doc\n  }\n}\n"],"names":["executeAccess","Forbidden","buildFilenameWhere","checkFileAccess","collection","filename","prefix","req","includes","t","config","accessResult","slug","data","isReadingStaticFile","access","read","constraints","push","equals","length","filenameCondition","variants","upload","doc","payload","db","findOne","where","and"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAClD,SAASC,kBAAkB,QAAQ,0CAAyC;AAE5E,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,IAAIF,SAASG,QAAQ,CAAC,UAAUH,SAASG,QAAQ,CAAC,SAAS;QACzD,MAAM,IAAIP,UAAUM,IAAIE,CAAC;IAC3B;IACA,MAAM,EAAEC,MAAM,EAAE,GAAGN;IAEnB,MAAMO,eAAe,MAAMX,cACzB;QAAEY,MAAMF,OAAOE,IAAI;QAAEC,MAAM;YAAER;QAAS;QAAGS,qBAAqB;QAAMP;IAAI,GACxEG,OAAOK,MAAM,CAACC,IAAI;IAGpB,MAAMC,cAAuB,EAAE;IAE/B,IAAI,OAAON,iBAAiB,UAAU;QACpCM,YAAYC,IAAI,CAACP;IACnB;IAEA,IAAI,OAAOL,WAAW,UAAU;QAC9BW,YAAYC,IAAI,CAAC;YAAEZ,QAAQ;gBAAEa,QAAQb;YAAO;QAAE;IAChD;IAEA,IAAIW,YAAYG,MAAM,GAAG,GAAG;QAC1B,MAAMC,oBAAoBnB,mBAAmB;YAAEG;YAAUiB,UAAUZ,OAAOa,MAAM,CAACD,QAAQ;QAAC;QAE1F,MAAME,MAAM,MAAMjB,IAAIkB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACvCvB,YAAYM,OAAOE,IAAI;YACvBL;YACAqB,OAAO;gBAAEC,KAAK;oBAACR;uBAAsBJ;iBAAY;YAAC;QACpD;QAEA,IAAI,CAACO,KAAK;YACR,MAAM,IAAIvB,UAAUM,IAAIE,CAAC;QAC3B;QAEA,OAAOe;IACT;AACF,EAAC"}

package/dist/uploads/checkFileRestrictions.d.ts

@@ -3,5 +3,15 @@ import type { checkFileRestrictionsParams, FileAllowList } from './types.js';
  * Restricted file types and their extensions.
  */
 export declare const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList;
-export declare const checkFileRestrictions: ({ collection, file, req, }: checkFileRestrictionsParams) => Promise<void>;
+export declare const checkFileRestrictions: ({ checkFileContents, collection, file, req, }: checkFileRestrictionsParams) => Promise<{
+    ext: string;
+    mime: string;
+} | undefined>;
+export declare const checkFileMetadataRestrictions: ({ collection, filename, filesize, mimeType, req, }: {
+    collection: checkFileRestrictionsParams['collection'];
+    filename: string;
+    filesize?: number;
+    mimeType: string;
+    req: checkFileRestrictionsParams['req'];
+}) => Promise<void>;
 //# sourceMappingURL=checkFileRestrictions.d.ts.map

package/dist/uploads/checkFileRestrictions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAS5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAgC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,+BAI/B,2BAA2B,KAAG,OAAO,CAAC,IAAI,CAyJ5C,CAAA"}
+{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAsB5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAiC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,kDAK/B,2BAA2B,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAgNjF,CAAA;AAED,eAAO,MAAM,6BAA6B,uDAMvC;IACD,UAAU,EAAE,2BAA2B,CAAC,YAAY,CAAC,CAAA;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAA;CACxC,KAAG,OAAO,CAAC,IAAI,CAYf,CAAA"}

package/dist/uploads/checkFileRestrictions.js

@@ -3,9 +3,12 @@ import fs from 'fs/promises';
 import { ValidationError } from '../errors/index.js';
 import { validateMimeType } from '../utilities/validateMimeType.js';
 import { validatePDF } from '../utilities/validatePDF.js';
-import { detectSvgFromXml } from './detectSvgFromXml.js';
 import { getFileTypeFallback } from './getFileTypeFallback.js';
-import { validateSvg } from './validateSvg.js';
+import { getFileExtension, getMimeTypeEssence, getSanitizedUploadFilename, isSvgUpload, isXmlUpload } from './getFileTypeIdentity.js';
+import { hasFullFileContents } from './hasFullFileContents.js';
+import { isProcessableImage } from './isProcessableImage.js';
+import { isISOBaseMediaMimeType, validateISOBaseMediaBuffer, validateISOBaseMediaFile } from './validateISOBaseMediaFile.js';
+import { inspectSvg, inspectSvgFile } from './validateSvg.js';
 /**
  * Restricted file types and their extensions.
  */ export const RESTRICTED_FILE_EXT_AND_TYPES = [
@@ -111,6 +114,10 @@ import { validateSvg } from './validateSvg.js';
         ],
         mimeType: 'text/html'
     },
+    {
+        extensions: [],
+        mimeType: 'application/xhtml+xml'
+    },
     {
         extensions: [
             'php',
@@ -219,7 +226,7 @@ import { validateSvg } from './validateSvg.js';
         mimeType: 'application/x-command'
     }
 ];
-export const checkFileRestrictions = async ({ collection, file, req })=>{
+export const checkFileRestrictions = async ({ checkFileContents = true, collection, file, req })=>{
     const errors = [];
     const { upload: uploadConfig } = collection;
     const configMimeTypes = uploadConfig && typeof uploadConfig === 'object' && 'mimeTypes' in uploadConfig && Array.isArray(uploadConfig.mimeTypes) ? uploadConfig.mimeTypes : [];
@@ -236,16 +243,28 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
         }
         return mimeType.startsWith('image/') || mimeType.startsWith('video/') || mimeType.startsWith('audio/') || mimeType === 'application/pdf';
     };
-    // Skip validation if `allowRestrictedFileTypes` is true
-    if (allowRestrictedFileTypes) {
+    const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name));
+    const mimeTypeEssence = getMimeTypeEssence(file.mimetype);
+    if (!checkFileContents) {
+        const isAllowed = configMimeTypes.length ? validateMimeType(file.mimetype, configMimeTypes) : !RESTRICTED_FILE_EXT_AND_TYPES.some(({ extensions, mimeType })=>mimeType === mimeTypeEssence || extensions.includes(typeFromExtension.toLowerCase()));
+        if (!isAllowed) {
+            throw new ValidationError({
+                errors: [
+                    {
+                        message: `File type '${file.mimetype}' is not allowed.`,
+                        path: 'file'
+                    }
+                ]
+            });
+        }
         return;
     }
     // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory
-    // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is
-    // loaded lazily and only when the file type actually requires it.
+    // just for detection. Content validation streams SVG/XML temp files and only loads a full
+    // temp-file buffer for PDF integrity checks.
     const { tempFilePath } = file;
     const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0);
-    // Lazily reads the full file — only reached for small text-based types (SVG, PDF).
+    // Lazily reads the full file — only reached for PDF validation.
     let _fileBuffer;
     const getFileBuffer = async ()=>{
         if (_fileBuffer) {
@@ -268,12 +287,20 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             });
         }
     };
-    // Secondary mimetype check to assess file type from buffer
-    if (configMimeTypes.length > 0) {
-        let detected;
-        try {
-            detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
-        } catch  {
+    let isSvg = isSvgUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    });
+    let svgInspection;
+    const getSvgInspection = async ()=>{
+        svgInspection ??= isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data);
+        return svgInspection;
+    };
+    let detected;
+    try {
+        detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
+    } catch  {
+        if (configMimeTypes.length > 0) {
             throw new ValidationError({
                 errors: [
                     {
@@ -283,10 +310,35 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
                 ]
             });
         }
-        const typeFromExtension = file.name.split('.').pop() || '';
+    }
+    if (isSvg || isXmlUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    }) || detected?.mime === 'application/xml' || !detected && isProcessableImage(file.mimetype)) {
+        const inspection = await getSvgInspection();
+        isSvg = inspection.isSvg;
+        if (inspection.isSvg) {
+            detected = {
+                ext: 'svg',
+                mime: 'image/svg+xml'
+            };
+        } else if (inspection.isValid && !detected) {
+            detected = {
+                ext: 'xml',
+                mime: 'application/xml'
+            };
+        }
+    }
+    if (detected && isISOBaseMediaMimeType(detected.mime) && (hasFullFileContents(file) || configMimeTypes.length > 0)) {
+        const isValidISOBaseMedia = isTempFile && tempFilePath ? await validateISOBaseMediaFile(tempFilePath) : await validateISOBaseMediaBuffer(file.data);
+        if (!isValidISOBaseMedia) {
+            errors.push('Invalid or corrupted ISO base media file.');
+        }
+    }
+    // Secondary mimetype check to assess file type from buffer
+    if (configMimeTypes.length > 0) {
         // Handle SVG files that are detected as XML due to <?xml declarations
         if (detected?.mime === 'application/xml' && configMimeTypes.some((type)=>type.includes('image/') && (type.includes('svg') || type === 'image/*'))) {
-            const isSvg = detectSvgFromXml(await getFileBuffer());
             if (isSvg) {
                 detected = {
                     ext: 'svg',
@@ -300,13 +352,6 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             if (!extIsValid) {
                 errors.push(`File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`);
             } else {
-                // SVG security check (text-based files not detectable by buffer)
-                if (typeFromExtension.toLowerCase() === 'svg') {
-                    const isSafeSvg = validateSvg(await getFileBuffer());
-                    if (!isSafeSvg) {
-                        errors.push('SVG file contains potentially harmful content.');
-                    }
-                }
                 // PDF validation
                 if (mimeTypeFromExtension === 'application/pdf') {
                     const isValidPDF = validatePDF(await getFileBuffer());
@@ -329,16 +374,22 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
         if (detected && !passesMimeTypeCheck) {
             errors.push(`Invalid MIME type: ${detected.mime}.`);
         }
-    } else {
+    } else if (!allowRestrictedFileTypes) {
         const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type)=>{
-            const hasRestrictedExt = type.extensions.some((ext)=>file.name.toLowerCase().endsWith(ext));
-            const hasRestrictedMime = type.mimeType === file.mimetype;
+            const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase());
+            const hasRestrictedMime = type.mimeType === mimeTypeEssence;
             return hasRestrictedExt || hasRestrictedMime;
         });
         if (isRestricted) {
             errors.push(`File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`);
         }
     }
+    if (isSvg) {
+        const isSafeSvg = (await getSvgInspection()).isSafe;
+        if (!isSafeSvg) {
+            errors.push('SVG file contains potentially harmful content.');
+        }
+    }
     if (errors.length > 0) {
         req.payload.logger.error(errors.join(', '));
         throw new ValidationError({
@@ -350,6 +401,20 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             ]
         });
     }
+    return detected;
+};
+export const checkFileMetadataRestrictions = async ({ collection, filename, filesize = 0, mimeType, req })=>{
+    await checkFileRestrictions({
+        checkFileContents: false,
+        collection,
+        file: {
+            name: filename,
+            data: Buffer.alloc(0),
+            mimetype: mimeType,
+            size: filesize
+        },
+        req
+    });
 };
 
 //# sourceMappingURL=checkFileRestrictions.js.map

package/dist/uploads/checkFileRestrictions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { detectSvgFromXml } from './detectSvgFromXml.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport { validateSvg } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<void> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // Skip validation if `allowRestrictedFileTypes` is true\n  if (allowRestrictedFileTypes) {\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is\n  // loaded lazily and only when the file type actually requires it.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for small text-based types (SVG, PDF).\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    let detected\n    try {\n      detected =\n        isTempFile && tempFilePath\n          ? await fileTypeFromFile(tempFilePath)\n          : await fileTypeFromBuffer(file.data)\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n    const typeFromExtension = file.name.split('.').pop() || ''\n\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      const isSvg = detectSvgFromXml(await getFileBuffer())\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // SVG security check (text-based files not detectable by buffer)\n        if (typeFromExtension.toLowerCase() === 'svg') {\n          const isSafeSvg = validateSvg(await getFileBuffer())\n          if (!isSafeSvg) {\n            errors.push('SVG file contains potentially harmful content.')\n          }\n        }\n\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))\n      const hasRestrictedMime = type.mimeType === file.mimetype\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","detectSvgFromXml","getFileTypeFallback","validateSvg","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","tempFilePath","isTempFile","data","length","_fileBuffer","getFileBuffer","readFile","message","path","detected","typeFromExtension","name","split","pop","mime","some","type","isSvg","ext","mimeTypeFromExtension","extIsValid","push","toLowerCase","isSafeSvg","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","endsWith","hasRestrictedMime","mimetype","error","join"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,WAAW,QAAQ,mBAAkB;AAE9C;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACb;QAC7B,MAAMc,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAACf,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,aAAa;IAEjB;IAEA,wDAAwD;IACxD,IAAIY,0BAA0B;QAC5B;IACF;IAEA,gGAAgG;IAChG,6FAA6F;IAC7F,kEAAkE;IAClE,MAAM,EAAEK,YAAY,EAAE,GAAGd;IACzB,MAAMe,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACd,KAAKgB,IAAI,IAAIhB,KAAKgB,IAAI,CAACC,MAAM,KAAK,CAAA;IAEzE,mFAAmF;IACnF,IAAIC;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACH,cAAc,CAACD,cAAc;YAChC,OAAQI,cAAclB,KAAKgB,IAAI;QACjC;QACA,IAAI;YACFE,cAAc,MAAM9B,GAAGgC,QAAQ,CAACN;YAChC,OAAOI;QACT,EAAE,OAAM;YACN,MAAM,IAAI7B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,2DAA2D;IAC3D,IAAIjB,gBAAgBY,MAAM,GAAG,GAAG;QAC9B,IAAIM;QACJ,IAAI;YACFA,WACER,cAAcD,eACV,MAAM3B,iBAAiB2B,gBACvB,MAAM5B,mBAAmBc,KAAKgB,IAAI;QAC1C,EAAE,OAAM;YACN,MAAM,IAAI3B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;QACA,MAAME,oBAAoBxB,KAAKyB,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;QAExD,sEAAsE;QACtE,IACEJ,UAAUK,SAAS,qBACnBvB,gBAAgBwB,IAAI,CAClB,CAACC,OAASA,KAAKlB,QAAQ,CAAC,aAAckB,CAAAA,KAAKlB,QAAQ,CAAC,UAAUkB,SAAS,SAAQ,IAEjF;YACA,MAAMC,QAAQvC,iBAAiB,MAAM2B;YACrC,IAAIY,OAAO;gBACTR,WAAW;oBAAES,KAAK;oBAAOJ,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACL,UAAU;YACb,MAAMU,wBAAwBxC,oBAAoBO,KAAKyB,IAAI,EAAEG,IAAI;YACjE,MAAMM,aAAa5C,iBAAiB2C,uBAAuB5B;YAE3D,IAAI,CAAC6B,YAAY;gBACfhC,OAAOiC,IAAI,CACT,CAAC,UAAU,EAAEF,sBAAsB,iBAAiB,EAAET,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iEAAiE;gBACjE,IAAIA,kBAAkBY,WAAW,OAAO,OAAO;oBAC7C,MAAMC,YAAY3C,YAAY,MAAMyB;oBACpC,IAAI,CAACkB,WAAW;wBACdnC,OAAOiC,IAAI,CAAC;oBACd;gBACF;gBAEA,iBAAiB;gBACjB,IAAIF,0BAA0B,mBAAmB;oBAC/C,MAAMK,aAAa/C,YAAY,MAAM4B;oBACrC,IAAI,CAACmB,YAAY;wBACfpC,OAAOiC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAIzB,sBAAsBuB,wBAAwB;gBAChDhC,IAAIsC,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAEzC,KAAKyB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMiB,sBAAsBnB,UAAUK,QAAQtC,iBAAiBiC,SAASK,IAAI,EAAEvB;QAE9E,IAAIqC,uBAAuBnB,UAAUK,SAAS,mBAAmB;YAC/D,MAAMU,aAAa/C,YAAY,MAAM4B;YACrC,IAAI,CAACmB,YAAY;gBACfpC,OAAOiC,IAAI,CAAC;YACd;QACF;QAEA,IAAIZ,YAAY,CAACmB,qBAAqB;YACpCxC,OAAOiC,IAAI,CAAC,CAAC,mBAAmB,EAAEZ,SAASK,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMe,eAAehD,8BAA8BkC,IAAI,CAAC,CAACC;YACvD,MAAMc,mBAAmBd,KAAKlC,UAAU,CAACiC,IAAI,CAAC,CAACG,MAAQhC,KAAKyB,IAAI,CAACW,WAAW,GAAGS,QAAQ,CAACb;YACxF,MAAMc,oBAAoBhB,KAAKjC,QAAQ,KAAKG,KAAK+C,QAAQ;YACzD,OAAOH,oBAAoBE;QAC7B;QACA,IAAIH,cAAc;YAChBzC,OAAOiC,IAAI,CACT,CAAC,WAAW,EAAEnC,KAAK+C,QAAQ,CAAC,cAAc,EAAE/C,KAAKyB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIvB,OAAOe,MAAM,GAAG,GAAG;QACrBhB,IAAIsC,OAAO,CAACC,MAAM,CAACQ,KAAK,CAAC9C,OAAO+C,IAAI,CAAC;QACrC,MAAM,IAAI5D,gBAAgB;YACxBa,QAAQ;gBAAC;oBAAEmB,SAASnB,OAAO+C,IAAI,CAAC;oBAAO3B,MAAM;gBAAO;aAAE;QACxD;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport {\n  getFileExtension,\n  getMimeTypeEssence,\n  getSanitizedUploadFilename,\n  isSvgUpload,\n  isXmlUpload,\n} from './getFileTypeIdentity.js'\nimport { hasFullFileContents } from './hasFullFileContents.js'\nimport { isProcessableImage } from './isProcessableImage.js'\nimport {\n  isISOBaseMediaMimeType,\n  validateISOBaseMediaBuffer,\n  validateISOBaseMediaFile,\n} from './validateISOBaseMediaFile.js'\nimport { inspectSvg, inspectSvgFile } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: [], mimeType: 'application/xhtml+xml' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  checkFileContents = true,\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<{ ext: string; mime: string } | undefined> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name))\n  const mimeTypeEssence = getMimeTypeEssence(file.mimetype)\n\n  if (!checkFileContents) {\n    const isAllowed = configMimeTypes.length\n      ? validateMimeType(file.mimetype, configMimeTypes)\n      : !RESTRICTED_FILE_EXT_AND_TYPES.some(\n          ({ extensions, mimeType }) =>\n            mimeType === mimeTypeEssence || extensions.includes(typeFromExtension.toLowerCase()),\n        )\n\n    if (!isAllowed) {\n      throw new ValidationError({\n        errors: [{ message: `File type '${file.mimetype}' is not allowed.`, path: 'file' }],\n      })\n    }\n\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. Content validation streams SVG/XML temp files and only loads a full\n  // temp-file buffer for PDF integrity checks.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for PDF validation.\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  let isSvg = isSvgUpload({ filename: file.name, mimeType: file.mimetype })\n  let svgInspection: Awaited<ReturnType<typeof inspectSvgFile>> | undefined\n\n  const getSvgInspection = async () => {\n    svgInspection ??=\n      isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data)\n    return svgInspection\n  }\n\n  let detected\n  try {\n    detected =\n      isTempFile && tempFilePath\n        ? await fileTypeFromFile(tempFilePath)\n        : await fileTypeFromBuffer(file.data)\n  } catch {\n    if (configMimeTypes.length > 0) {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n  }\n\n  if (\n    isSvg ||\n    isXmlUpload({ filename: file.name, mimeType: file.mimetype }) ||\n    detected?.mime === 'application/xml' ||\n    (!detected && isProcessableImage(file.mimetype))\n  ) {\n    const inspection = await getSvgInspection()\n    isSvg = inspection.isSvg\n    if (inspection.isSvg) {\n      detected = { ext: 'svg', mime: 'image/svg+xml' }\n    } else if (inspection.isValid && !detected) {\n      detected = { ext: 'xml', mime: 'application/xml' }\n    }\n  }\n\n  if (\n    detected &&\n    isISOBaseMediaMimeType(detected.mime) &&\n    (hasFullFileContents(file) || configMimeTypes.length > 0)\n  ) {\n    const isValidISOBaseMedia =\n      isTempFile && tempFilePath\n        ? await validateISOBaseMediaFile(tempFilePath)\n        : await validateISOBaseMediaBuffer(file.data)\n\n    if (!isValidISOBaseMedia) {\n      errors.push('Invalid or corrupted ISO base media file.')\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else if (!allowRestrictedFileTypes) {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase())\n      const hasRestrictedMime = type.mimeType === mimeTypeEssence\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (isSvg) {\n    const isSafeSvg = (await getSvgInspection()).isSafe\n    if (!isSafeSvg) {\n      errors.push('SVG file contains potentially harmful content.')\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n\n  return detected\n}\n\nexport const checkFileMetadataRestrictions = async ({\n  collection,\n  filename,\n  filesize = 0,\n  mimeType,\n  req,\n}: {\n  collection: checkFileRestrictionsParams['collection']\n  filename: string\n  filesize?: number\n  mimeType: string\n  req: checkFileRestrictionsParams['req']\n}): Promise<void> => {\n  await checkFileRestrictions({\n    checkFileContents: false,\n    collection,\n    file: {\n      name: filename,\n      data: Buffer.alloc(0),\n      mimetype: mimeType,\n      size: filesize,\n    },\n    req,\n  })\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","getFileTypeFallback","getFileExtension","getMimeTypeEssence","getSanitizedUploadFilename","isSvgUpload","isXmlUpload","hasFullFileContents","isProcessableImage","isISOBaseMediaMimeType","validateISOBaseMediaBuffer","validateISOBaseMediaFile","inspectSvg","inspectSvgFile","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","checkFileContents","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","typeFromExtension","name","mimeTypeEssence","mimetype","isAllowed","length","some","toLowerCase","message","path","tempFilePath","isTempFile","data","_fileBuffer","getFileBuffer","readFile","isSvg","filename","svgInspection","getSvgInspection","detected","mime","inspection","ext","isValid","isValidISOBaseMedia","push","type","mimeTypeFromExtension","extIsValid","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","hasRestrictedMime","isSafeSvg","isSafe","error","join","checkFileMetadataRestrictions","filesize","Buffer","alloc","size"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SACEC,gBAAgB,EAChBC,kBAAkB,EAClBC,0BAA0B,EAC1BC,WAAW,EACXC,WAAW,QACN,2BAA0B;AACjC,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,wBAAwB,QACnB,gCAA+B;AACtC,SAASC,UAAU,EAAEC,cAAc,QAAQ,mBAAkB;AAE7D;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY,EAAE;QAAEC,UAAU;IAAwB;IACpD;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,oBAAoB,IAAI,EACxBC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACd;QAC7B,MAAMe,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAAChB,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,aAAa;IAEjB;IAEA,MAAMkB,oBAAoBhC,iBAAiBE,2BAA2BgB,KAAKe,IAAI;IAC/E,MAAMC,kBAAkBjC,mBAAmBiB,KAAKiB,QAAQ;IAExD,IAAI,CAACnB,mBAAmB;QACtB,MAAMoB,YAAYb,gBAAgBc,MAAM,GACpCxC,iBAAiBqB,KAAKiB,QAAQ,EAAEZ,mBAChC,CAACX,8BAA8B0B,IAAI,CACjC,CAAC,EAAEzB,UAAU,EAAEC,QAAQ,EAAE,GACvBA,aAAaoB,mBAAmBrB,WAAWiB,QAAQ,CAACE,kBAAkBO,WAAW;QAGzF,IAAI,CAACH,WAAW;YACd,MAAM,IAAIxC,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS,CAAC,WAAW,EAAEtB,KAAKiB,QAAQ,CAAC,iBAAiB,CAAC;wBAAEM,MAAM;oBAAO;iBAAE;YACrF;QACF;QAEA;IACF;IAEA,gGAAgG;IAChG,0FAA0F;IAC1F,6CAA6C;IAC7C,MAAM,EAAEC,YAAY,EAAE,GAAGxB;IACzB,MAAMyB,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACxB,KAAK0B,IAAI,IAAI1B,KAAK0B,IAAI,CAACP,MAAM,KAAK,CAAA;IAEzE,gEAAgE;IAChE,IAAIQ;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACF,cAAc,CAACD,cAAc;YAChC,OAAQG,cAAc3B,KAAK0B,IAAI;QACjC;QACA,IAAI;YACFC,cAAc,MAAMlD,GAAGoD,QAAQ,CAACL;YAChC,OAAOG;QACT,EAAE,OAAM;YACN,MAAM,IAAIjD,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,IAAIO,QAAQ7C,YAAY;QAAE8C,UAAU/B,KAAKe,IAAI;QAAEnB,UAAUI,KAAKiB,QAAQ;IAAC;IACvE,IAAIe;IAEJ,MAAMC,mBAAmB;QACvBD,kBACEP,cAAcD,eAAe,MAAM/B,eAAe+B,gBAAgBhC,WAAWQ,KAAK0B,IAAI;QACxF,OAAOM;IACT;IAEA,IAAIE;IACJ,IAAI;QACFA,WACET,cAAcD,eACV,MAAMhD,iBAAiBgD,gBACvB,MAAMjD,mBAAmByB,KAAK0B,IAAI;IAC1C,EAAE,OAAM;QACN,IAAIrB,gBAAgBc,MAAM,GAAG,GAAG;YAC9B,MAAM,IAAIzC,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;IACF;IAEA,IACEO,SACA5C,YAAY;QAAE6C,UAAU/B,KAAKe,IAAI;QAAEnB,UAAUI,KAAKiB,QAAQ;IAAC,MAC3DiB,UAAUC,SAAS,qBAClB,CAACD,YAAY9C,mBAAmBY,KAAKiB,QAAQ,GAC9C;QACA,MAAMmB,aAAa,MAAMH;QACzBH,QAAQM,WAAWN,KAAK;QACxB,IAAIM,WAAWN,KAAK,EAAE;YACpBI,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAgB;QACjD,OAAO,IAAIC,WAAWE,OAAO,IAAI,CAACJ,UAAU;YAC1CA,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAkB;QACnD;IACF;IAEA,IACED,YACA7C,uBAAuB6C,SAASC,IAAI,KACnChD,CAAAA,oBAAoBa,SAASK,gBAAgBc,MAAM,GAAG,CAAA,GACvD;QACA,MAAMoB,sBACJd,cAAcD,eACV,MAAMjC,yBAAyBiC,gBAC/B,MAAMlC,2BAA2BU,KAAK0B,IAAI;QAEhD,IAAI,CAACa,qBAAqB;YACxBrC,OAAOsC,IAAI,CAAC;QACd;IACF;IAEA,2DAA2D;IAC3D,IAAInC,gBAAgBc,MAAM,GAAG,GAAG;QAC9B,sEAAsE;QACtE,IACEe,UAAUC,SAAS,qBACnB9B,gBAAgBe,IAAI,CAClB,CAACqB,OAASA,KAAK7B,QAAQ,CAAC,aAAc6B,CAAAA,KAAK7B,QAAQ,CAAC,UAAU6B,SAAS,SAAQ,IAEjF;YACA,IAAIX,OAAO;gBACTI,WAAW;oBAAEG,KAAK;oBAAOF,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACD,UAAU;YACb,MAAMQ,wBAAwB7D,oBAAoBmB,KAAKe,IAAI,EAAEoB,IAAI;YACjE,MAAMQ,aAAahE,iBAAiB+D,uBAAuBrC;YAE3D,IAAI,CAACsC,YAAY;gBACfzC,OAAOsC,IAAI,CACT,CAAC,UAAU,EAAEE,sBAAsB,iBAAiB,EAAE5B,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iBAAiB;gBACjB,IAAI4B,0BAA0B,mBAAmB;oBAC/C,MAAME,aAAahE,YAAY,MAAMgD;oBACrC,IAAI,CAACgB,YAAY;wBACf1C,OAAOsC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAI9B,sBAAsBgC,wBAAwB;gBAChDzC,IAAI4C,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAE/C,KAAKe,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMiC,sBAAsBd,UAAUC,QAAQxD,iBAAiBuD,SAASC,IAAI,EAAE9B;QAE9E,IAAI2C,uBAAuBd,UAAUC,SAAS,mBAAmB;YAC/D,MAAMS,aAAahE,YAAY,MAAMgD;YACrC,IAAI,CAACgB,YAAY;gBACf1C,OAAOsC,IAAI,CAAC;YACd;QACF;QAEA,IAAIN,YAAY,CAACc,qBAAqB;YACpC9C,OAAOsC,IAAI,CAAC,CAAC,mBAAmB,EAAEN,SAASC,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO,IAAI,CAAC1B,0BAA0B;QACpC,MAAMwC,eAAevD,8BAA8B0B,IAAI,CAAC,CAACqB;YACvD,MAAMS,mBAAmBT,KAAK9C,UAAU,CAACiB,QAAQ,CAACE,kBAAkBO,WAAW;YAC/E,MAAM8B,oBAAoBV,KAAK7C,QAAQ,KAAKoB;YAC5C,OAAOkC,oBAAoBC;QAC7B;QACA,IAAIF,cAAc;YAChB/C,OAAOsC,IAAI,CACT,CAAC,WAAW,EAAExC,KAAKiB,QAAQ,CAAC,cAAc,EAAEjB,KAAKe,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIe,OAAO;QACT,MAAMsB,YAAY,AAAC,CAAA,MAAMnB,kBAAiB,EAAGoB,MAAM;QACnD,IAAI,CAACD,WAAW;YACdlD,OAAOsC,IAAI,CAAC;QACd;IACF;IAEA,IAAItC,OAAOiB,MAAM,GAAG,GAAG;QACrBlB,IAAI4C,OAAO,CAACC,MAAM,CAACQ,KAAK,CAACpD,OAAOqD,IAAI,CAAC;QACrC,MAAM,IAAI7E,gBAAgB;YACxBwB,QAAQ;gBAAC;oBAAEoB,SAASpB,OAAOqD,IAAI,CAAC;oBAAOhC,MAAM;gBAAO;aAAE;QACxD;IACF;IAEA,OAAOW;AACT,EAAC;AAED,OAAO,MAAMsB,gCAAgC,OAAO,EAClDzD,UAAU,EACVgC,QAAQ,EACR0B,WAAW,CAAC,EACZ7D,QAAQ,EACRK,GAAG,EAOJ;IACC,MAAMJ,sBAAsB;QAC1BC,mBAAmB;QACnBC;QACAC,MAAM;YACJe,MAAMgB;YACNL,MAAMgC,OAAOC,KAAK,CAAC;YACnB1C,UAAUrB;YACVgE,MAAMH;QACR;QACAxD;IACF;AACF,EAAC"}

package/dist/uploads/clientUploadReceipt.d.ts

@@ -0,0 +1,29 @@
+import type { PayloadRequest } from '../types/index.js';
+type ClientUploadReceipt = {
+    _objectKey?: string;
+    allowOverwrite?: boolean;
+    collectionSlug: string;
+    expiresAt: number;
+    filename: string;
+    filePrefix: string;
+    storageFilePath: string;
+    userCollection: null | string;
+    userID: null | number | string;
+};
+export declare const createClientUploadReceipt: ({ _objectKey, allowOverwrite, collectionSlug, filename, filePrefix, req, storageFilePath, }: {
+    _objectKey?: string;
+    allowOverwrite?: boolean;
+    collectionSlug: string;
+    filename: string;
+    filePrefix: string;
+    req: PayloadRequest;
+    storageFilePath: string;
+}) => `${string}.${string}`;
+export declare const verifyClientUploadReceipt: ({ collectionSlug, filename, req, signedReceipt, }: {
+    collectionSlug?: string;
+    filename?: string;
+    req: PayloadRequest;
+    signedReceipt: unknown;
+}) => ClientUploadReceipt;
+export {};
+//# sourceMappingURL=clientUploadReceipt.d.ts.map

package/dist/uploads/clientUploadReceipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientUploadReceipt.d.ts","sourceRoot":"","sources":["../../src/uploads/clientUploadReceipt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,mBAAmB,GAAG;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,IAAI,GAAG,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B,CAAA;AAOD,eAAO,MAAM,yBAAyB,gGAQnC;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;CACxB,KAAG,GAAG,MAAM,IAAI,MAAM,EActB,CAAA;AAED,eAAO,MAAM,yBAAyB,sDAKnC;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,OAAO,CAAA;CACvB,KAAG,mBA+BH,CAAA"}

package/dist/uploads/clientUploadReceipt.js

@@ -0,0 +1,76 @@
+import crypto from 'node:crypto';
+import { APIError } from '../errors/APIError.js';
+// Longer than the longest provider upload URL (GCS: five hours).
+const LIFETIME_MS = 6 * 60 * 60 * 1000;
+// Separates these signatures from any future receipt format.
+const DOMAIN = 'payload-client-upload-receipt-v1';
+export const createClientUploadReceipt = ({ _objectKey, allowOverwrite, collectionSlug, filename, filePrefix, req, storageFilePath })=>{
+    const data = {
+        ..._objectKey !== undefined && {
+            _objectKey
+        },
+        ...allowOverwrite && {
+            allowOverwrite: true
+        },
+        collectionSlug,
+        expiresAt: Date.now() + LIFETIME_MS,
+        filename,
+        filePrefix,
+        storageFilePath,
+        ...getUser(req)
+    };
+    const encodedReceipt = Buffer.from(JSON.stringify(data)).toString('base64url');
+    return `${encodedReceipt}.${sign({
+        encodedReceipt,
+        secret: req.payload.secret
+    })}`;
+};
+export const verifyClientUploadReceipt = ({ collectionSlug, filename, req, signedReceipt })=>{
+    if (typeof signedReceipt !== 'string') {
+        throwInvalidReference();
+    }
+    const [encodedReceipt, signature, extra] = signedReceipt.split('.');
+    const expected = encodedReceipt ? sign({
+        encodedReceipt,
+        secret: req.payload.secret
+    }) : '';
+    if (!encodedReceipt || !signature || extra || !equal({
+        actual: signature,
+        expected
+    })) {
+        throwInvalidReference();
+    }
+    let decodedReceipt;
+    try {
+        decodedReceipt = JSON.parse(Buffer.from(encodedReceipt, 'base64url').toString());
+    } catch  {
+        throwInvalidReference();
+    }
+    const user = getUser(req);
+    if (!isReceipt(decodedReceipt) || decodedReceipt.expiresAt <= Date.now() || decodedReceipt.userCollection !== user.userCollection || decodedReceipt.userID !== user.userID || collectionSlug !== undefined && decodedReceipt.collectionSlug !== collectionSlug || filename !== undefined && decodedReceipt.filename !== filename) {
+        throwInvalidReference();
+    }
+    return decodedReceipt;
+};
+function throwInvalidReference() {
+    throw new APIError('Invalid upload reference.', 400);
+}
+const getUser = (req)=>({
+        userCollection: req.user?.collection ?? null,
+        userID: req.user?.id ?? null
+    });
+const sign = ({ encodedReceipt, secret })=>crypto.createHmac('sha256', `${DOMAIN}:${secret}`).update(encodedReceipt).digest('base64url');
+const equal = ({ actual, expected })=>{
+    const actualBuffer = Buffer.from(actual);
+    const expectedBuffer = Buffer.from(expected);
+    return actualBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(actualBuffer, expectedBuffer);
+};
+const isReceipt = (value)=>{
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const data = value;
+    return (data._objectKey === undefined || typeof data._objectKey === 'string') && (data.allowOverwrite === undefined || typeof data.allowOverwrite === 'boolean') && typeof data.collectionSlug === 'string' && typeof data.expiresAt === 'number' && Number.isFinite(data.expiresAt) && typeof data.storageFilePath === 'string' && typeof data.filePrefix === 'string' && typeof data.filename === 'string' && (data.userCollection === null || typeof data.userCollection === 'string') && (data.userID === null || typeof data.userID === 'string' || typeof data.userID === 'number' && Number.isFinite(data.userID));
+};
+
+//# sourceMappingURL=clientUploadReceipt.js.map

package/dist/uploads/clientUploadReceipt.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/clientUploadReceipt.ts"],"sourcesContent":["import crypto from 'node:crypto'\n\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { APIError } from '../errors/APIError.js'\n\ntype ClientUploadReceipt = {\n  _objectKey?: string\n  allowOverwrite?: boolean\n  collectionSlug: string\n  expiresAt: number\n  filename: string\n  filePrefix: string\n  storageFilePath: string\n  userCollection: null | string\n  userID: null | number | string\n}\n\n// Longer than the longest provider upload URL (GCS: five hours).\nconst LIFETIME_MS = 6 * 60 * 60 * 1000\n// Separates these signatures from any future receipt format.\nconst DOMAIN = 'payload-client-upload-receipt-v1'\n\nexport const createClientUploadReceipt = ({\n  _objectKey,\n  allowOverwrite,\n  collectionSlug,\n  filename,\n  filePrefix,\n  req,\n  storageFilePath,\n}: {\n  _objectKey?: string\n  allowOverwrite?: boolean\n  collectionSlug: string\n  filename: string\n  filePrefix: string\n  req: PayloadRequest\n  storageFilePath: string\n}): `${string}.${string}` => {\n  const data: ClientUploadReceipt = {\n    ...(_objectKey !== undefined && { _objectKey }),\n    ...(allowOverwrite && { allowOverwrite: true }),\n    collectionSlug,\n    expiresAt: Date.now() + LIFETIME_MS,\n    filename,\n    filePrefix,\n    storageFilePath,\n    ...getUser(req),\n  }\n  const encodedReceipt = Buffer.from(JSON.stringify(data)).toString('base64url')\n\n  return `${encodedReceipt}.${sign({ encodedReceipt, secret: req.payload.secret })}`\n}\n\nexport const verifyClientUploadReceipt = ({\n  collectionSlug,\n  filename,\n  req,\n  signedReceipt,\n}: {\n  collectionSlug?: string\n  filename?: string\n  req: PayloadRequest\n  signedReceipt: unknown\n}): ClientUploadReceipt => {\n  if (typeof signedReceipt !== 'string') {\n    throwInvalidReference()\n  }\n  const [encodedReceipt, signature, extra] = signedReceipt.split('.')\n  const expected = encodedReceipt ? sign({ encodedReceipt, secret: req.payload.secret }) : ''\n\n  if (!encodedReceipt || !signature || extra || !equal({ actual: signature, expected })) {\n    throwInvalidReference()\n  }\n\n  let decodedReceipt: unknown\n  try {\n    decodedReceipt = JSON.parse(Buffer.from(encodedReceipt, 'base64url').toString())\n  } catch {\n    throwInvalidReference()\n  }\n\n  const user = getUser(req)\n  if (\n    !isReceipt(decodedReceipt) ||\n    decodedReceipt.expiresAt <= Date.now() ||\n    decodedReceipt.userCollection !== user.userCollection ||\n    decodedReceipt.userID !== user.userID ||\n    (collectionSlug !== undefined && decodedReceipt.collectionSlug !== collectionSlug) ||\n    (filename !== undefined && decodedReceipt.filename !== filename)\n  ) {\n    throwInvalidReference()\n  }\n\n  return decodedReceipt\n}\n\nfunction throwInvalidReference(): never {\n  throw new APIError('Invalid upload reference.', 400)\n}\n\nconst getUser = (req: PayloadRequest) => ({\n  userCollection: req.user?.collection ?? null,\n  userID: req.user?.id ?? null,\n})\n\nconst sign = ({ encodedReceipt, secret }: { encodedReceipt: string; secret: string }) =>\n  crypto.createHmac('sha256', `${DOMAIN}:${secret}`).update(encodedReceipt).digest('base64url')\n\nconst equal = ({ actual, expected }: { actual: string; expected: string }) => {\n  const actualBuffer = Buffer.from(actual)\n  const expectedBuffer = Buffer.from(expected)\n  return (\n    actualBuffer.length === expectedBuffer.length &&\n    crypto.timingSafeEqual(actualBuffer, expectedBuffer)\n  )\n}\n\nconst isReceipt = (value: unknown): value is ClientUploadReceipt => {\n  if (!value || typeof value !== 'object') {\n    return false\n  }\n  const data = value as Partial<ClientUploadReceipt>\n  return (\n    (data._objectKey === undefined || typeof data._objectKey === 'string') &&\n    (data.allowOverwrite === undefined || typeof data.allowOverwrite === 'boolean') &&\n    typeof data.collectionSlug === 'string' &&\n    typeof data.expiresAt === 'number' &&\n    Number.isFinite(data.expiresAt) &&\n    typeof data.storageFilePath === 'string' &&\n    typeof data.filePrefix === 'string' &&\n    typeof data.filename === 'string' &&\n    (data.userCollection === null || typeof data.userCollection === 'string') &&\n    (data.userID === null ||\n      typeof data.userID === 'string' ||\n      (typeof data.userID === 'number' && Number.isFinite(data.userID)))\n  )\n}\n"],"names":["crypto","APIError","LIFETIME_MS","DOMAIN","createClientUploadReceipt","_objectKey","allowOverwrite","collectionSlug","filename","filePrefix","req","storageFilePath","data","undefined","expiresAt","Date","now","getUser","encodedReceipt","Buffer","from","JSON","stringify","toString","sign","secret","payload","verifyClientUploadReceipt","signedReceipt","throwInvalidReference","signature","extra","split","expected","equal","actual","decodedReceipt","parse","user","isReceipt","userCollection","userID","collection","id","createHmac","update","digest","actualBuffer","expectedBuffer","length","timingSafeEqual","value","Number","isFinite"],"mappings":"AAAA,OAAOA,YAAY,cAAa;AAIhC,SAASC,QAAQ,QAAQ,wBAAuB;AAchD,iEAAiE;AACjE,MAAMC,cAAc,IAAI,KAAK,KAAK;AAClC,6DAA6D;AAC7D,MAAMC,SAAS;AAEf,OAAO,MAAMC,4BAA4B,CAAC,EACxCC,UAAU,EACVC,cAAc,EACdC,cAAc,EACdC,QAAQ,EACRC,UAAU,EACVC,GAAG,EACHC,eAAe,EAShB;IACC,MAAMC,OAA4B;QAChC,GAAIP,eAAeQ,aAAa;YAAER;QAAW,CAAC;QAC9C,GAAIC,kBAAkB;YAAEA,gBAAgB;QAAK,CAAC;QAC9CC;QACAO,WAAWC,KAAKC,GAAG,KAAKd;QACxBM;QACAC;QACAE;QACA,GAAGM,QAAQP,IAAI;IACjB;IACA,MAAMQ,iBAAiBC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACV,OAAOW,QAAQ,CAAC;IAElE,OAAO,GAAGL,eAAe,CAAC,EAAEM,KAAK;QAAEN;QAAgBO,QAAQf,IAAIgB,OAAO,CAACD,MAAM;IAAC,IAAI;AACpF,EAAC;AAED,OAAO,MAAME,4BAA4B,CAAC,EACxCpB,cAAc,EACdC,QAAQ,EACRE,GAAG,EACHkB,aAAa,EAMd;IACC,IAAI,OAAOA,kBAAkB,UAAU;QACrCC;IACF;IACA,MAAM,CAACX,gBAAgBY,WAAWC,MAAM,GAAGH,cAAcI,KAAK,CAAC;IAC/D,MAAMC,WAAWf,iBAAiBM,KAAK;QAAEN;QAAgBO,QAAQf,IAAIgB,OAAO,CAACD,MAAM;IAAC,KAAK;IAEzF,IAAI,CAACP,kBAAkB,CAACY,aAAaC,SAAS,CAACG,MAAM;QAAEC,QAAQL;QAAWG;IAAS,IAAI;QACrFJ;IACF;IAEA,IAAIO;IACJ,IAAI;QACFA,iBAAiBf,KAAKgB,KAAK,CAAClB,OAAOC,IAAI,CAACF,gBAAgB,aAAaK,QAAQ;IAC/E,EAAE,OAAM;QACNM;IACF;IAEA,MAAMS,OAAOrB,QAAQP;IACrB,IACE,CAAC6B,UAAUH,mBACXA,eAAetB,SAAS,IAAIC,KAAKC,GAAG,MACpCoB,eAAeI,cAAc,KAAKF,KAAKE,cAAc,IACrDJ,eAAeK,MAAM,KAAKH,KAAKG,MAAM,IACpClC,mBAAmBM,aAAauB,eAAe7B,cAAc,KAAKA,kBAClEC,aAAaK,aAAauB,eAAe5B,QAAQ,KAAKA,UACvD;QACAqB;IACF;IAEA,OAAOO;AACT,EAAC;AAED,SAASP;IACP,MAAM,IAAI5B,SAAS,6BAA6B;AAClD;AAEA,MAAMgB,UAAU,CAACP,MAAyB,CAAA;QACxC8B,gBAAgB9B,IAAI4B,IAAI,EAAEI,cAAc;QACxCD,QAAQ/B,IAAI4B,IAAI,EAAEK,MAAM;IAC1B,CAAA;AAEA,MAAMnB,OAAO,CAAC,EAAEN,cAAc,EAAEO,MAAM,EAA8C,GAClFzB,OAAO4C,UAAU,CAAC,UAAU,GAAGzC,OAAO,CAAC,EAAEsB,QAAQ,EAAEoB,MAAM,CAAC3B,gBAAgB4B,MAAM,CAAC;AAEnF,MAAMZ,QAAQ,CAAC,EAAEC,MAAM,EAAEF,QAAQ,EAAwC;IACvE,MAAMc,eAAe5B,OAAOC,IAAI,CAACe;IACjC,MAAMa,iBAAiB7B,OAAOC,IAAI,CAACa;IACnC,OACEc,aAAaE,MAAM,KAAKD,eAAeC,MAAM,IAC7CjD,OAAOkD,eAAe,CAACH,cAAcC;AAEzC;AAEA,MAAMT,YAAY,CAACY;IACjB,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;QACvC,OAAO;IACT;IACA,MAAMvC,OAAOuC;IACb,OACE,AAACvC,CAAAA,KAAKP,UAAU,KAAKQ,aAAa,OAAOD,KAAKP,UAAU,KAAK,QAAO,KACnEO,CAAAA,KAAKN,cAAc,KAAKO,aAAa,OAAOD,KAAKN,cAAc,KAAK,SAAQ,KAC7E,OAAOM,KAAKL,cAAc,KAAK,YAC/B,OAAOK,KAAKE,SAAS,KAAK,YAC1BsC,OAAOC,QAAQ,CAACzC,KAAKE,SAAS,KAC9B,OAAOF,KAAKD,eAAe,KAAK,YAChC,OAAOC,KAAKH,UAAU,KAAK,YAC3B,OAAOG,KAAKJ,QAAQ,KAAK,YACxBI,CAAAA,KAAK4B,cAAc,KAAK,QAAQ,OAAO5B,KAAK4B,cAAc,KAAK,QAAO,KACtE5B,CAAAA,KAAK6B,MAAM,KAAK,QACf,OAAO7B,KAAK6B,MAAM,KAAK,YACtB,OAAO7B,KAAK6B,MAAM,KAAK,YAAYW,OAAOC,QAAQ,CAACzC,KAAK6B,MAAM,CAAC;AAEtE"}

package/dist/uploads/deleteAssociatedFiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteAssociatedFiles.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteAssociatedFiles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAyC/D,CAAA"}
+{"version":3,"file":"deleteAssociatedFiles.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteAssociatedFiles.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAwC/D,CAAA"}