npm - payload - Versions diffs - 4.0.0-internal.e16cf59 → 4.0.0-internal.e55ccef - Mend

payload 4.0.0-internal.e16cf59 → 4.0.0-internal.e55ccef

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (678) hide show

package/dist/auth/operations/refresh.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { Forbidden } from '../../errors/index.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n exp: number\n refreshedToken: string\n setCookie?: boolean\n /** @deprecated\n * use:\n * ```ts\n * user._strategy\n * ```\n /\n strategy?: string\n user: Document\n}\n\nexport type Arguments = {\n collection: Collection\n req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n let args = incomingArgs\n\n try {\n const shouldCommit = await initTransaction(args.req)\n\n // /////////////////////////////////////\n // beforeOperation - Collection\n // /////////////////////////////////////\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'refresh',\n overrideAccess: false,\n })\n\n // /////////////////////////////////////\n // Refresh\n // /////////////////////////////////////\n\n const {\n collection: { config: collectionConfig },\n req,\n req: {\n payload: { config, secret },\n },\n } = args\n\n if (!args.req.user) {\n throw new Forbidden(args.req.t)\n }\n\n const pathname = new URL(args.req.url!).pathname\n\n const isGraphQL = pathname === config.routes.graphQL\n\n let user = await req.payload.db.findOne<any>({\n collection: collectionConfig.slug,\n req,\n where: { id: { equals: args.req.user.id } },\n })\n\n const sid = args.req.user._sid\n\n if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n if (!Array.isArray(user.sessions) \|\| !sid) {\n throw new Forbidden(args.req.t)\n }\n\n const existingSession = user.sessions.find(({ id }: { id: number }) => id === sid)\n\n const now = new Date()\n const tokenExpInMs = collectionConfig.auth.tokenExpiration 1000\n existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n // Prevent updatedAt from being updated when only refreshing a session\n user.updatedAt = null\n\n await req.payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: {\n ...user,\n sessions: removeExpiredSessions(user.sessions),\n },\n req,\n returning: false,\n })\n }\n\n user = await req.payload.findByID({\n id: user.id,\n collection: collectionConfig.slug,\n depth: isGraphQL ? 0 : args.collection.config.auth.depth,\n req: args.req,\n })\n\n if (user) {\n user.collection = args.req.user.collection\n user._strategy = args.req.user._strategy\n }\n\n let result!: Result\n\n // /////////////////////////////////////\n // refresh hook - Collection\n // /////////////////////////////////////\n\n for (const refreshHook of args.collection.config.hooks.refresh) {\n const hookResult = await refreshHook({ args, user })\n\n if (hookResult) {\n result = hookResult\n break\n }\n }\n\n if (!result) {\n const fieldsToSign = getFieldsToSign({\n collectionConfig,\n email: user?.email as string,\n sid,\n user: args?.req?.user,\n })\n\n const { exp, token: refreshedToken } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n result = {\n exp,\n refreshedToken,\n setCookie: true,\n /** @deprecated\n * use:\n * ```ts\n * user._strategy\n * ```\n */\n strategy: args.req.user._strategy,\n user,\n }\n }\n\n // /////////////////////////////////////\n // After Refresh - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterRefresh?.length) {\n for (const hook of collectionConfig.hooks.afterRefresh) {\n result =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n exp: result.exp,\n req: args.req,\n token: result.refreshedToken,\n })) \|\| result\n }\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'refresh',\n overrideAccess: false,\n result,\n })\n\n // /////////////////////////////////////\n // Return results\n // /////////////////////////////////////\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n return result\n } catch (error: unknown) {\n await killTransaction(args.req)\n throw error\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","Forbidden","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","slug","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updatedAt","updateOne","data","returning","findByID","depth","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","strategy","afterRefresh","length","hook","context","error"],"mappings":"AAGA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AAqBtD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMR,gBAAgBO,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMV,qBAAqB;YAChCU;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMC,WAAW,IAAIC,IAAIb,KAAKE,GAAG,CAACY,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaR,OAAOY,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMR,IAAIM,OAAO,CAACU,EAAE,CAACC,OAAO,CAAM;YAC3ChB,YAAYI,iBAAiBa,IAAI;YACjClB;YACAmB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQvB,KAAKE,GAAG,CAACQ,IAAI,CAACY,EAAE;gBAAC;YAAE;QAC5C;QAEA,MAAME,MAAMxB,KAAKE,GAAG,CAACQ,IAAI,CAACe,IAAI;QAE9B,IAAIlB,iBAAiBmB,IAAI,CAACC,WAAW,IAAI,CAACpB,iBAAiBmB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACpB,KAAKqB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIjC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMqB,kBAAkBtB,KAAKqB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAkB,GAAKA,OAAOE;YAE9E,MAAMU,MAAM,IAAIC;YAChB,MAAMC,eAAe7B,iBAAiBmB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,sEAAsE;YACtE1B,KAAK8B,SAAS,GAAG;YAEjB,MAAMtC,IAAIM,OAAO,CAACU,EAAE,CAACuB,SAAS,CAAC;gBAC7BnB,IAAIZ,KAAKY,EAAE;gBACXnB,YAAYI,iBAAiBa,IAAI;gBACjCsB,MAAM;oBACJ,GAAGhC,IAAI;oBACPqB,UAAUlC,sBAAsBa,KAAKqB,QAAQ;gBAC/C;gBACA7B;gBACAyC,WAAW;YACb;QACF;QAEAjC,OAAO,MAAMR,IAAIM,OAAO,CAACoC,QAAQ,CAAC;YAChCtB,IAAIZ,KAAKY,EAAE;YACXnB,YAAYI,iBAAiBa,IAAI;YACjCyB,OAAO9B,YAAY,IAAIf,KAAKG,UAAU,CAACC,MAAM,CAACsB,IAAI,CAACmB,KAAK;YACxD3C,KAAKF,KAAKE,GAAG;QACf;QAEA,IAAIQ,MAAM;YACRA,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;YAC1CO,KAAKoC,SAAS,GAAG9C,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;QAC1C;QAEA,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAehD,KAAKG,UAAU,CAACC,MAAM,CAAC6C,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEhD;gBAAMU;YAAK;YAElD,IAAIyC,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAezD,gBAAgB;gBACnCY;gBACA8C,OAAO3C,MAAM2C;gBACb7B;gBACAd,MAAMV,MAAME,KAAKQ;YACnB;YAEA,MAAM,EAAE4C,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAM5D,QAAQ;gBACnDwD;gBACA3C;gBACA4B,iBAAiB9B,iBAAiBmB,IAAI,CAACW,eAAe;YACxD;YAEAU,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX;;;;;SAKC,GACDC,UAAU1D,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;gBACjCpC;YACF;QACF;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB0C,KAAK,EAAEU,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQtD,iBAAiB0C,KAAK,CAACU,YAAY,CAAE;gBACtDZ,SACE,AAAC,MAAMc,KAAK;oBACV1D,YAAYH,KAAKG,UAAU,EAAEC;oBAC7B0D,SAAS9D,KAAKE,GAAG,CAAC4D,OAAO;oBACzBR,KAAKP,OAAOO,GAAG;oBACfpD,KAAKF,KAAKE,GAAG;oBACbqD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAM1D,oBAAoB;YACjCW;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChByC;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAI9C,cAAc;YAChB,MAAMT,kBAAkBU;QAC1B;QAEA,OAAO6C;IACT,EAAE,OAAOgB,OAAgB;QACvB,MAAMrE,gBAAgBM,KAAKE,GAAG;QAC9B,MAAM6D;IACR;AACF,EAAC"}
1	+ {"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { Forbidden } from '../../errors/index.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n exp: number\n refreshedToken: string\n setCookie?: boolean\n /** @deprecated\n * use:\n * ```ts\n * user._strategy\n * ```\n /\n strategy?: string\n user: Document\n}\n\nexport type Arguments = {\n collection: Collection\n req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n let args = incomingArgs\n\n try {\n const shouldCommit = await initTransaction(args.req)\n\n // /////////////////////////////////////\n // beforeOperation - Collection\n // /////////////////////////////////////\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'refresh',\n overrideAccess: false,\n })\n\n // /////////////////////////////////////\n // Refresh\n // /////////////////////////////////////\n\n const {\n collection: { config: collectionConfig },\n req,\n req: {\n payload: { config, secret },\n },\n } = args\n\n if (!args.req.user) {\n throw new Forbidden(args.req.t)\n }\n\n const pathname = new URL(args.req.url!).pathname\n\n const isGraphQL = pathname === config.routes.graphQL\n\n let user = await req.payload.db.findOne<AuthenticatedUser>({\n collection: collectionConfig.slug,\n req,\n where: { id: { equals: args.req.user.id } },\n })\n\n if (!user) {\n throw new Forbidden(args.req.t)\n }\n\n const sid = args.req.user._sid\n\n if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n if (!Array.isArray(user.sessions) \|\| !sid) {\n throw new Forbidden(args.req.t)\n }\n\n const existingSession = user.sessions.find(({ id }) => id === sid)\n\n if (!existingSession) {\n throw new Forbidden(args.req.t)\n }\n\n const now = new Date()\n const tokenExpInMs = collectionConfig.auth.tokenExpiration 1000\n existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n await req.payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: {\n ...user,\n // Prevent updatedAt from being updated when only refreshing a session\n sessions: removeExpiredSessions(user.sessions),\n updatedAt: null,\n },\n req,\n returning: false,\n })\n }\n\n user = (await req.payload.findByID({\n id: user.id,\n collection: collectionConfig.slug,\n depth: isGraphQL ? 0 : args.collection.config.auth.depth,\n req: args.req,\n })) as AuthenticatedUser\n\n if (user) {\n user.collection = args.req.user.collection\n user._strategy = args.req.user._strategy\n }\n\n let result!: Result\n\n // /////////////////////////////////////\n // refresh hook - Collection\n // /////////////////////////////////////\n\n for (const refreshHook of args.collection.config.hooks.refresh) {\n const hookResult = await refreshHook({ args, user })\n\n if (hookResult) {\n result = hookResult\n break\n }\n }\n\n if (!result) {\n const fieldsToSign = getFieldsToSign({\n collectionConfig,\n email: user?.email as string,\n sid,\n user: args?.req?.user,\n })\n\n const { exp, token: refreshedToken } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n result = {\n exp,\n refreshedToken,\n setCookie: true,\n /** @deprecated\n * use:\n * ```ts\n * user._strategy\n * ```\n */\n strategy: args.req.user._strategy,\n user,\n }\n }\n\n // /////////////////////////////////////\n // After Refresh - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterRefresh?.length) {\n for (const hook of collectionConfig.hooks.afterRefresh) {\n result =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n exp: result.exp,\n req: args.req,\n token: result.refreshedToken,\n })) \|\| result\n }\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'refresh',\n overrideAccess: false,\n result,\n })\n\n // /////////////////////////////////////\n // Return results\n // /////////////////////////////////////\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n return result\n } catch (error: unknown) {\n await killTransaction(args.req)\n throw error\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","Forbidden","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","slug","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updateOne","data","updatedAt","returning","findByID","depth","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","strategy","afterRefresh","length","hook","context","error"],"mappings":"AAIA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AAqBtD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMR,gBAAgBO,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMV,qBAAqB;YAChCU;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMC,WAAW,IAAIC,IAAIb,KAAKE,GAAG,CAACY,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaR,OAAOY,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMR,IAAIM,OAAO,CAACU,EAAE,CAACC,OAAO,CAAoB;YACzDhB,YAAYI,iBAAiBa,IAAI;YACjClB;YACAmB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQvB,KAAKE,GAAG,CAACQ,IAAI,CAACY,EAAE;gBAAC;YAAE;QAC5C;QAEA,IAAI,CAACZ,MAAM;YACT,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMa,MAAMxB,KAAKE,GAAG,CAACQ,IAAI,CAACe,IAAI;QAE9B,IAAIlB,iBAAiBmB,IAAI,CAACC,WAAW,IAAI,CAACpB,iBAAiBmB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACpB,KAAKqB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIjC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMqB,kBAAkBtB,KAAKqB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAE,GAAKA,OAAOE;YAE9D,IAAI,CAACQ,iBAAiB;gBACpB,MAAM,IAAIzC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMuB,MAAM,IAAIC;YAChB,MAAMC,eAAe7B,iBAAiBmB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,MAAMlC,IAAIM,OAAO,CAACU,EAAE,CAACsB,SAAS,CAAC;gBAC7BlB,IAAIZ,KAAKY,EAAE;gBACXnB,YAAYI,iBAAiBa,IAAI;gBACjCqB,MAAM;oBACJ,GAAG/B,IAAI;oBACP,sEAAsE;oBACtEqB,UAAUlC,sBAAsBa,KAAKqB,QAAQ;oBAC7CW,WAAW;gBACb;gBACAxC;gBACAyC,WAAW;YACb;QACF;QAEAjC,OAAQ,MAAMR,IAAIM,OAAO,CAACoC,QAAQ,CAAC;YACjCtB,IAAIZ,KAAKY,EAAE;YACXnB,YAAYI,iBAAiBa,IAAI;YACjCyB,OAAO9B,YAAY,IAAIf,KAAKG,UAAU,CAACC,MAAM,CAACsB,IAAI,CAACmB,KAAK;YACxD3C,KAAKF,KAAKE,GAAG;QACf;QAEA,IAAIQ,MAAM;YACRA,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;YAC1CO,KAAKoC,SAAS,GAAG9C,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;QAC1C;QAEA,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAehD,KAAKG,UAAU,CAACC,MAAM,CAAC6C,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEhD;gBAAMU;YAAK;YAElD,IAAIyC,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAezD,gBAAgB;gBACnCY;gBACA8C,OAAO3C,MAAM2C;gBACb7B;gBACAd,MAAMV,MAAME,KAAKQ;YACnB;YAEA,MAAM,EAAE4C,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAM5D,QAAQ;gBACnDwD;gBACA3C;gBACA4B,iBAAiB9B,iBAAiBmB,IAAI,CAACW,eAAe;YACxD;YAEAU,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX;;;;;SAKC,GACDC,UAAU1D,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;gBACjCpC;YACF;QACF;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB0C,KAAK,EAAEU,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQtD,iBAAiB0C,KAAK,CAACU,YAAY,CAAE;gBACtDZ,SACE,AAAC,MAAMc,KAAK;oBACV1D,YAAYH,KAAKG,UAAU,EAAEC;oBAC7B0D,SAAS9D,KAAKE,GAAG,CAAC4D,OAAO;oBACzBR,KAAKP,OAAOO,GAAG;oBACfpD,KAAKF,KAAKE,GAAG;oBACbqD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAM1D,oBAAoB;YACjCW;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChByC;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAI9C,cAAc;YAChB,MAAMT,kBAAkBU;QAC1B;QAEA,OAAO6C;IACT,EAAE,OAAOgB,OAAgB;QACvB,MAAMrE,gBAAgBM,KAAKE,GAAG;QAC9B,MAAM6D;IACR;AACF,EAAC"}

package/dist/auth/operations/resetPassword.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,mCAAmC,CAAA;AAC3F,OAAO,KAAK,EAAE,kBAAkB,~~EAAa~~,MAAM,gBAAgB,CAAA;~~AACnE~~,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAe1D,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,QACrE,SAAS,KACd,OAAO,CAAC,MAAM,CA4NhB,CAAA"}
1	+ {"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,mCAAmC,CAAA;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAQ,MAAM,gBAAgB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAe1D,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,QACrE,SAAS,KACd,OAAO,CAAC,MAAM,CA4NhB,CAAA"}

package/dist/auth/operations/resetPassword.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, TypedUser } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n token?: string\n user: Record<string, unknown>\n}\n\nexport type Arguments = {\n collection: Collection\n data: {\n password: string\n token: string\n }\n depth?: number\n overrideAccess?: boolean\n req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n args: Arguments,\n): Promise<Result> => {\n const {\n collection: { config: collectionConfig },\n data,\n depth,\n overrideAccess,\n req: {\n payload: { secret },\n payload,\n },\n req,\n } = args\n\n if (\n !Object.prototype.hasOwnProperty.call(data, 'token') \|\|\n !Object.prototype.hasOwnProperty.call(data, 'password')\n ) {\n throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n }\n\n if (collectionConfig.auth.disableLocalStrategy) {\n throw new Forbidden(req.t)\n }\n\n let sid: string \| undefined\n let user: null \| TypedUser = null\n\n try {\n const shouldCommit = await initTransaction(req)\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'resetPassword',\n overrideAccess,\n })\n\n // /////////////////////////////////////\n // Reset Password\n // /////////////////////////////////////\n\n const where = appendNonTrashedFilter({\n enableTrash: Boolean(collectionConfig.trash),\n trash: false,\n where: {\n resetPasswordExpiration: { greater_than: new Date().toISOString() },\n resetPasswordToken: { equals: data.token },\n },\n })\n\n user = await payload.db.findOne<TypedUser>({\n collection: collectionConfig.slug,\n req,\n where,\n })\n\n if (!user) {\n throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n }\n\n // TODO: replace this method\n const { hash, salt } = await generatePasswordSaltHash({\n collection: collectionConfig,\n password: data.password,\n req,\n })\n\n user.salt = salt\n user.hash = hash\n\n user.resetPasswordExpiration = new Date().toISOString()\n\n if (collectionConfig.auth.verify) {\n user._verified = Boolean(user._verified)\n }\n\n // /////////////////////////////////////\n // beforeValidate - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeValidate?.length) {\n for (const hook of collectionConfig.hooks.beforeValidate) {\n await hook({\n collection: args.collection?.config,\n context: req.context,\n data: user,\n operation: 'update',\n req,\n })\n }\n }\n\n // /////////////////////////////////////\n // Update new password\n // /////////////////////////////////////\n\n // Ensure updatedAt date is always updated\n user.updatedAt = new Date().toISOString()\n\n const doc = await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: user,\n req,\n })\n\n await authenticateLocalStrategy({ doc, password: data.password })\n\n const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n collectionConfig,\n email: user.email!,\n user,\n }\n\n const session = await addSessionToUser({\n collectionConfig,\n payload,\n req,\n user,\n })\n sid = session.sid\n\n if (sid) {\n fieldsToSignArgs.sid = sid\n }\n\n const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n // /////////////////////////////////////\n // beforeLogin - Collection\n // /////////////////////////////////////\n\n let userBeforeLogin = user\n\n if (collectionConfig.hooks?.beforeLogin?.length) {\n for (const hook of collectionConfig.hooks.beforeLogin) {\n userBeforeLogin =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n user: userBeforeLogin,\n })) \|\| userBeforeLogin\n }\n }\n\n const { token } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n req.user = userBeforeLogin\n\n // /////////////////////////////////////\n // afterLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterLogin?.length) {\n for (const hook of collectionConfig.hooks.afterLogin) {\n userBeforeLogin =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n token,\n user: userBeforeLogin,\n })) \|\| userBeforeLogin\n }\n }\n\n const fullUser = await payload.findByID({\n id: user.id,\n collection: collectionConfig.slug,\n depth,\n overrideAccess,\n req,\n trash: false,\n })\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n if (fullUser) {\n fullUser.collection = collectionConfig.slug\n fullUser._strategy = 'local-jwt'\n }\n\n let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n token,\n user: fullUser,\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'resetPassword',\n overrideAccess,\n result,\n })\n\n return result\n } catch (error: unknown) {\n if (sid) {\n await revokeSession({\n collectionConfig,\n payload,\n req,\n sid,\n user,\n })\n }\n await killTransaction(req)\n throw error\n }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","user","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","db","findOne","slug","FORBIDDEN","hash","salt","password","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","doc","updateOne","id","fieldsToSignArgs","email","session","fieldsToSign","userBeforeLogin","beforeLogin","tokenExpiration","afterLogin","fullUser","findByID","_strategy","result","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAMlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJ,IACE,CAACU,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIjB,SAAS,0BAA0BH,WAAW8B,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI5B,UAAUmB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,OAAyB;IAE7B,IAAI;QACF,MAAMC,eAAe,MAAM7B,gBAAgBgB;QAE3CP,OAAO,MAAMd,qBAAqB;YAChCc;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEAb,OAAO,MAAMX,QAAQyB,EAAE,CAACC,OAAO,CAAY;YACzCjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAe;QACF;QAEA,IAAI,CAACH,MAAM;YACT,MAAM,IAAIhC,SAAS,2CAA2CH,WAAWoD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMxC,yBAAyB;YACpDG,YAAYE;YACZoC,UAAUnC,KAAKmC,QAAQ;YACvBhC;QACF;QAEAY,KAAKmB,IAAI,GAAGA;QACZnB,KAAKkB,IAAI,GAAGA;QAEZlB,KAAKO,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAACyB,MAAM,EAAE;YAChCrB,KAAKsB,SAAS,GAAGjB,QAAQL,KAAKsB,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAItC,iBAAiBuC,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACT5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAASvC,IAAIuC,OAAO;oBACpB1C,MAAMe;oBACNE,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CY,KAAK4B,SAAS,GAAG,IAAInB,OAAOC,WAAW;QAEvC,MAAMmB,MAAM,MAAMxC,QAAQyB,EAAE,CAACgB,SAAS,CAAC;YACrCC,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAMe;YACNZ;QACF;QAEA,MAAMV,0BAA0B;YAAEmD;YAAKT,UAAUnC,KAAKmC,QAAQ;QAAC;QAE/D,MAAMY,mBAA0D;YAC9DhD;YACAiD,OAAOjC,KAAKiC,KAAK;YACjBjC;QACF;QAEA,MAAMkC,UAAU,MAAM1D,iBAAiB;YACrCQ;YACAK;YACAD;YACAY;QACF;QACAD,MAAMmC,QAAQnC,GAAG;QAEjB,IAAIA,KAAK;YACPiC,iBAAiBjC,GAAG,GAAGA;QACzB;QAEA,MAAMoC,eAAe7D,gBAAgB0D;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAII,kBAAkBpC;QAEtB,IAAIhB,iBAAiBuC,KAAK,EAAEc,aAAaZ,QAAQ;YAC/C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACc,WAAW,CAAE;gBACrDD,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbY,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAM,EAAEvB,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9B4D;YACA7C;YACAgD,iBAAiBtD,iBAAiBY,IAAI,CAAC0C,eAAe;QACxD;QAEAlD,IAAIY,IAAI,GAAGoC;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIpD,iBAAiBuC,KAAK,EAAEgB,YAAYd,QAAQ;YAC9C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACgB,UAAU,CAAE;gBACpDH,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbyB;oBACAb,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAMI,WAAW,MAAMnD,QAAQoD,QAAQ,CAAC;YACtCV,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC9B;YACAC;YACAC;YACAkB,OAAO;QACT;QAEA,IAAIL,cAAc;YAChB,MAAM9B,kBAAkBiB;QAC1B;QAEA,IAAIoD,UAAU;YACZA,SAAS1D,UAAU,GAAGE,iBAAiBgC,IAAI;YAC3CwB,SAASE,SAAS,GAAG;QACvB;QAEA,IAAIC,SAA2D;YAC7D9B;YACAb,MAAMwC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCG,SAAS,MAAM7E,oBAAoB;YACjCe;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACAwD;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAI7C,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAC;YACF;QACF;QACA,MAAM3B,gBAAgBe;QACtB,MAAMwD;IACR;AACF,EAAC"}
1	+ {"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, User } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n token?: string\n user: Record<string, unknown>\n}\n\nexport type Arguments = {\n collection: Collection\n data: {\n password: string\n token: string\n }\n depth?: number\n overrideAccess?: boolean\n req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n args: Arguments,\n): Promise<Result> => {\n const {\n collection: { config: collectionConfig },\n data,\n depth,\n overrideAccess,\n req: {\n payload: { secret },\n payload,\n },\n req,\n } = args\n\n if (\n !Object.prototype.hasOwnProperty.call(data, 'token') \|\|\n !Object.prototype.hasOwnProperty.call(data, 'password')\n ) {\n throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n }\n\n if (collectionConfig.auth.disableLocalStrategy) {\n throw new Forbidden(req.t)\n }\n\n let sid: string \| undefined\n let user: null \| User = null\n\n try {\n const shouldCommit = await initTransaction(req)\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'resetPassword',\n overrideAccess,\n })\n\n // /////////////////////////////////////\n // Reset Password\n // /////////////////////////////////////\n\n const where = appendNonTrashedFilter({\n enableTrash: Boolean(collectionConfig.trash),\n trash: false,\n where: {\n resetPasswordExpiration: { greater_than: new Date().toISOString() },\n resetPasswordToken: { equals: data.token },\n },\n })\n\n user = await payload.db.findOne<User>({\n collection: collectionConfig.slug,\n req,\n where,\n })\n\n if (!user) {\n throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n }\n\n // TODO: replace this method\n const { hash, salt } = await generatePasswordSaltHash({\n collection: collectionConfig,\n password: data.password,\n req,\n })\n\n user.salt = salt\n user.hash = hash\n\n user.resetPasswordExpiration = new Date().toISOString()\n\n if (collectionConfig.auth.verify) {\n user._verified = Boolean(user._verified)\n }\n\n // /////////////////////////////////////\n // beforeValidate - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeValidate?.length) {\n for (const hook of collectionConfig.hooks.beforeValidate) {\n await hook({\n collection: args.collection?.config,\n context: req.context,\n data: user,\n operation: 'update',\n req,\n })\n }\n }\n\n // /////////////////////////////////////\n // Update new password\n // /////////////////////////////////////\n\n // Ensure updatedAt date is always updated\n user.updatedAt = new Date().toISOString()\n\n const doc = await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: user,\n req,\n })\n\n await authenticateLocalStrategy({ doc, password: data.password })\n\n const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n collectionConfig,\n email: user.email!,\n user,\n }\n\n const session = await addSessionToUser({\n collectionConfig,\n payload,\n req,\n user,\n })\n sid = session.sid\n\n if (sid) {\n fieldsToSignArgs.sid = sid\n }\n\n const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n // /////////////////////////////////////\n // beforeLogin - Collection\n // /////////////////////////////////////\n\n let userBeforeLogin = user\n\n if (collectionConfig.hooks?.beforeLogin?.length) {\n for (const hook of collectionConfig.hooks.beforeLogin) {\n userBeforeLogin =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n user: userBeforeLogin,\n })) \|\| userBeforeLogin\n }\n }\n\n const { token } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n req.user = userBeforeLogin\n\n // /////////////////////////////////////\n // afterLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterLogin?.length) {\n for (const hook of collectionConfig.hooks.afterLogin) {\n userBeforeLogin =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n token,\n user: userBeforeLogin,\n })) \|\| userBeforeLogin\n }\n }\n\n const fullUser = await payload.findByID({\n id: user.id,\n collection: collectionConfig.slug,\n depth,\n overrideAccess,\n req,\n trash: false,\n })\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n if (fullUser) {\n fullUser.collection = collectionConfig.slug\n fullUser._strategy = 'local-jwt'\n }\n\n let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n token,\n user: fullUser,\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'resetPassword',\n overrideAccess,\n result,\n })\n\n return result\n } catch (error: unknown) {\n if (sid) {\n await revokeSession({\n collectionConfig,\n payload,\n req,\n sid,\n user,\n })\n }\n await killTransaction(req)\n throw error\n }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","user","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","db","findOne","slug","FORBIDDEN","hash","salt","password","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","doc","updateOne","id","fieldsToSignArgs","email","session","fieldsToSign","userBeforeLogin","beforeLogin","tokenExpiration","afterLogin","fullUser","findByID","_strategy","result","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAMlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJ,IACE,CAACU,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIjB,SAAS,0BAA0BH,WAAW8B,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI5B,UAAUmB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,OAAoB;IAExB,IAAI;QACF,MAAMC,eAAe,MAAM7B,gBAAgBgB;QAE3CP,OAAO,MAAMd,qBAAqB;YAChCc;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEAb,OAAO,MAAMX,QAAQyB,EAAE,CAACC,OAAO,CAAO;YACpCjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAe;QACF;QAEA,IAAI,CAACH,MAAM;YACT,MAAM,IAAIhC,SAAS,2CAA2CH,WAAWoD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMxC,yBAAyB;YACpDG,YAAYE;YACZoC,UAAUnC,KAAKmC,QAAQ;YACvBhC;QACF;QAEAY,KAAKmB,IAAI,GAAGA;QACZnB,KAAKkB,IAAI,GAAGA;QAEZlB,KAAKO,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAACyB,MAAM,EAAE;YAChCrB,KAAKsB,SAAS,GAAGjB,QAAQL,KAAKsB,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAItC,iBAAiBuC,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACT5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAASvC,IAAIuC,OAAO;oBACpB1C,MAAMe;oBACNE,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CY,KAAK4B,SAAS,GAAG,IAAInB,OAAOC,WAAW;QAEvC,MAAMmB,MAAM,MAAMxC,QAAQyB,EAAE,CAACgB,SAAS,CAAC;YACrCC,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAMe;YACNZ;QACF;QAEA,MAAMV,0BAA0B;YAAEmD;YAAKT,UAAUnC,KAAKmC,QAAQ;QAAC;QAE/D,MAAMY,mBAA0D;YAC9DhD;YACAiD,OAAOjC,KAAKiC,KAAK;YACjBjC;QACF;QAEA,MAAMkC,UAAU,MAAM1D,iBAAiB;YACrCQ;YACAK;YACAD;YACAY;QACF;QACAD,MAAMmC,QAAQnC,GAAG;QAEjB,IAAIA,KAAK;YACPiC,iBAAiBjC,GAAG,GAAGA;QACzB;QAEA,MAAMoC,eAAe7D,gBAAgB0D;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAII,kBAAkBpC;QAEtB,IAAIhB,iBAAiBuC,KAAK,EAAEc,aAAaZ,QAAQ;YAC/C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACc,WAAW,CAAE;gBACrDD,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbY,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAM,EAAEvB,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9B4D;YACA7C;YACAgD,iBAAiBtD,iBAAiBY,IAAI,CAAC0C,eAAe;QACxD;QAEAlD,IAAIY,IAAI,GAAGoC;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIpD,iBAAiBuC,KAAK,EAAEgB,YAAYd,QAAQ;YAC9C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACgB,UAAU,CAAE;gBACpDH,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbyB;oBACAb,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAMI,WAAW,MAAMnD,QAAQoD,QAAQ,CAAC;YACtCV,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC9B;YACAC;YACAC;YACAkB,OAAO;QACT;QAEA,IAAIL,cAAc;YAChB,MAAM9B,kBAAkBiB;QAC1B;QAEA,IAAIoD,UAAU;YACZA,SAAS1D,UAAU,GAAGE,iBAAiBgC,IAAI;YAC3CwB,SAASE,SAAS,GAAG;QACvB;QAEA,IAAIC,SAA2D;YAC7D9B;YACAb,MAAMwC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCG,SAAS,MAAM7E,oBAAoB;YACjCe;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACAwD;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAI7C,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAC;YACF;QACF;QACA,MAAM3B,gBAAgBe;QACtB,MAAMwD;IACR;AACF,EAAC"}

package/dist/auth/sendVerificationEmail.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { Collection } from '../collections/config/types.js';
 import type { SanitizedConfig } from '../config/types.js';
 import type { InitializedEmailAdapter } from '../email/types.js';
-import type { TypedUser } from '../index.js';
+import type { User } from '../index.js';
 import type { PayloadRequest } from '../types/index.js';
 type Args = {
     collection: Collection;
@@ -10,7 +10,7 @@ type Args = {
     email: InitializedEmailAdapter;
     req: PayloadRequest;
     token: string;
-    user: TypedUser;
+    user: User;
 };
 export declare function sendVerificationEmail(args: Args): Promise<void>;
 export {};

package/dist/auth/sendVerificationEmail.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sendVerificationEmail.d.ts","sourceRoot":"","sources":["../../src/auth/sendVerificationEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,KAAK,EAAE,~~SAAS~~,EAAE,MAAM,aAAa,CAAA;~~AAC5C~~,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAMvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,eAAe,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB,KAAK,EAAE,uBAAuB,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,~~SAAS~~,CAAA;~~CAChB~~,CAAA;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDrE"}
1	+ {"version":3,"file":"sendVerificationEmail.d.ts","sourceRoot":"","sources":["../../src/auth/sendVerificationEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAMvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,eAAe,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB,KAAK,EAAE,uBAAuB,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDrE"}

package/dist/auth/sendVerificationEmail.js CHANGED Viewed

@@ -3,7 +3,7 @@ import { getRequestOrigin } from '../utilities/getRequestOrigin.js';
 export async function sendVerificationEmail(args) {
     // Verify token from e-mail
     const { collection: { config: collectionConfig }, config, disableEmail, email, req, token, user } = args;
-    if (!disableEmail) {
+    if (!disableEmail && user.email) {
         const serverURL = getRequestOrigin({
             config,
             req

package/dist/auth/sendVerificationEmail.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/auth/sendVerificationEmail.ts"],"sourcesContent":["import type { Collection } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { InitializedEmailAdapter } from '../email/types.js'\nimport type { ~~TypedUser~~ } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { VerifyConfig } from './types.js'\n\nimport { formatAdminURL } from '../utilities/formatAdminURL.js'\nimport { getRequestOrigin } from '../utilities/getRequestOrigin.js'\n\ntype Args = {\n collection: Collection\n config: SanitizedConfig\n disableEmail: boolean\n email: InitializedEmailAdapter\n req: PayloadRequest\n token: string\n user: ~~TypedUser~~\n}\n\nexport async function sendVerificationEmail(args: Args): Promise<void> {\n // Verify token from e-mail\n const {\n collection: { config: collectionConfig },\n config,\n disableEmail,\n email,\n req,\n token,\n user,\n } = args\n\n if (!disableEmail) {\n const serverURL = getRequestOrigin({ config, req })\n\n const verificationURL = formatAdminURL({\n adminRoute: config.routes.admin,\n path: `/${collectionConfig.slug}/verify/${token}`,\n serverURL,\n })\n\n let html = `${req.t('authentication:newAccountCreated', {\n serverURL: config.serverURL,\n verificationURL,\n })}`\n\n const verify = collectionConfig.auth.verify as VerifyConfig\n\n // Allow config to override email content\n if (typeof verify.generateEmailHTML === 'function') {\n html = await verify.generateEmailHTML({\n req,\n token,\n user,\n })\n }\n\n let subject = req.t('authentication:verifyYourEmail')\n\n // Allow config to override email subject\n if (typeof verify.generateEmailSubject === 'function') {\n subject = await verify.generateEmailSubject({\n req,\n token,\n user,\n })\n }\n\n await email.sendEmail({\n from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n html,\n subject,\n to: user.email,\n })\n }\n}\n"],"names":["formatAdminURL","getRequestOrigin","sendVerificationEmail","args","collection","config","collectionConfig","disableEmail","email","req","token","user","serverURL","verificationURL","adminRoute","routes","admin","path","slug","html","t","verify","auth","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to"],"mappings":"AAOA,SAASA,cAAc,QAAQ,iCAAgC;AAC/D,SAASC,gBAAgB,QAAQ,mCAAkC;AAYnE,OAAO,eAAeC,sBAAsBC,IAAU;IACpD,2BAA2B;IAC3B,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCD,MAAM,EACNE,YAAY,EACZC,KAAK,EACLC,GAAG,EACHC,KAAK,EACLC,IAAI,EACL,GAAGR;IAEJ,IAAI,CAACI,~~cAAc~~;~~QACjB~~,~~MAAMK~~,YAAYX,iBAAiB;YAAEI;YAAQI;QAAI;QAEjD,MAAMI,kBAAkBb,eAAe;YACrCc,YAAYT,OAAOU,MAAM,CAACC,KAAK;YAC/BC,MAAM,CAAC,CAAC,EAAEX,iBAAiBY,IAAI,CAAC,QAAQ,EAAER,OAAO;YACjDE;QACF;QAEA,IAAIO,OAAO,GAAGV,IAAIW,CAAC,CAAC,oCAAoC;YACtDR,WAAWP,OAAOO,SAAS;YAC3BC;QACF,IAAI;QAEJ,MAAMQ,SAASf,iBAAiBgB,IAAI,CAACD,MAAM;QAE3C,yCAAyC;QACzC,IAAI,OAAOA,OAAOE,iBAAiB,KAAK,YAAY;YAClDJ,OAAO,MAAME,OAAOE,iBAAiB,CAAC;gBACpCd;gBACAC;gBACAC;YACF;QACF;QAEA,IAAIa,UAAUf,IAAIW,CAAC,CAAC;QAEpB,yCAAyC;QACzC,IAAI,OAAOC,OAAOI,oBAAoB,KAAK,YAAY;YACrDD,UAAU,MAAMH,OAAOI,oBAAoB,CAAC;gBAC1ChB;gBACAC;gBACAC;YACF;QACF;QAEA,MAAMH,MAAMkB,SAAS,CAAC;YACpBC,MAAM,CAAC,CAAC,EAAEnB,MAAMoB,eAAe,CAAC,GAAG,EAAEpB,MAAMqB,kBAAkB,CAAC,CAAC,CAAC;YAChEV;YACAK;YACAM,IAAInB,KAAKH,KAAK;QAChB;IACF;AACF"}
1	+ {"version":3,"sources":["../../src/auth/sendVerificationEmail.ts"],"sourcesContent":["import type { Collection } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { InitializedEmailAdapter } from '../email/types.js'\nimport type { User } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { VerifyConfig } from './types.js'\n\nimport { formatAdminURL } from '../utilities/formatAdminURL.js'\nimport { getRequestOrigin } from '../utilities/getRequestOrigin.js'\n\ntype Args = {\n collection: Collection\n config: SanitizedConfig\n disableEmail: boolean\n email: InitializedEmailAdapter\n req: PayloadRequest\n token: string\n user: User\n}\n\nexport async function sendVerificationEmail(args: Args): Promise<void> {\n // Verify token from e-mail\n const {\n collection: { config: collectionConfig },\n config,\n disableEmail,\n email,\n req,\n token,\n user,\n } = args\n\n if (!disableEmail && user.email) {\n const serverURL = getRequestOrigin({ config, req })\n\n const verificationURL = formatAdminURL({\n adminRoute: config.routes.admin,\n path: `/${collectionConfig.slug}/verify/${token}`,\n serverURL,\n })\n\n let html = `${req.t('authentication:newAccountCreated', {\n serverURL: config.serverURL,\n verificationURL,\n })}`\n\n const verify = collectionConfig.auth.verify as VerifyConfig\n\n // Allow config to override email content\n if (typeof verify.generateEmailHTML === 'function') {\n html = await verify.generateEmailHTML({\n req,\n token,\n user,\n })\n }\n\n let subject = req.t('authentication:verifyYourEmail')\n\n // Allow config to override email subject\n if (typeof verify.generateEmailSubject === 'function') {\n subject = await verify.generateEmailSubject({\n req,\n token,\n user,\n })\n }\n\n await email.sendEmail({\n from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n html,\n subject,\n to: user.email,\n })\n }\n}\n"],"names":["formatAdminURL","getRequestOrigin","sendVerificationEmail","args","collection","config","collectionConfig","disableEmail","email","req","token","user","serverURL","verificationURL","adminRoute","routes","admin","path","slug","html","t","verify","auth","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to"],"mappings":"AAOA,SAASA,cAAc,QAAQ,iCAAgC;AAC/D,SAASC,gBAAgB,QAAQ,mCAAkC;AAYnE,OAAO,eAAeC,sBAAsBC,IAAU;IACpD,2BAA2B;IAC3B,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCD,MAAM,EACNE,YAAY,EACZC,KAAK,EACLC,GAAG,EACHC,KAAK,EACLC,IAAI,EACL,GAAGR;IAEJ,IAAI,CAACI,gBAAgBI,KAAKH,KAAK,EAAE;QAC/B,MAAMI,YAAYX,iBAAiB;YAAEI;YAAQI;QAAI;QAEjD,MAAMI,kBAAkBb,eAAe;YACrCc,YAAYT,OAAOU,MAAM,CAACC,KAAK;YAC/BC,MAAM,CAAC,CAAC,EAAEX,iBAAiBY,IAAI,CAAC,QAAQ,EAAER,OAAO;YACjDE;QACF;QAEA,IAAIO,OAAO,GAAGV,IAAIW,CAAC,CAAC,oCAAoC;YACtDR,WAAWP,OAAOO,SAAS;YAC3BC;QACF,IAAI;QAEJ,MAAMQ,SAASf,iBAAiBgB,IAAI,CAACD,MAAM;QAE3C,yCAAyC;QACzC,IAAI,OAAOA,OAAOE,iBAAiB,KAAK,YAAY;YAClDJ,OAAO,MAAME,OAAOE,iBAAiB,CAAC;gBACpCd;gBACAC;gBACAC;YACF;QACF;QAEA,IAAIa,UAAUf,IAAIW,CAAC,CAAC;QAEpB,yCAAyC;QACzC,IAAI,OAAOC,OAAOI,oBAAoB,KAAK,YAAY;YACrDD,UAAU,MAAMH,OAAOI,oBAAoB,CAAC;gBAC1ChB;gBACAC;gBACAC;YACF;QACF;QAEA,MAAMH,MAAMkB,SAAS,CAAC;YACpBC,MAAM,CAAC,CAAC,EAAEnB,MAAMoB,eAAe,CAAC,GAAG,EAAEpB,MAAMqB,kBAAkB,CAAC,CAAC,CAAC;YAChEV;YACAK;YACAM,IAAInB,KAAKH,KAAK;QAChB;IACF;AACF"}

package/dist/auth/sessions.d.ts CHANGED Viewed

@@ -1,7 +1,6 @@
-import type { SanitizedCollectionConfig, TypeWithID } from '../collections/config/types.js';
-import type { TypedUser } from '../index.js';
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { AuthenticatedUser, User, UserSession } from '../index.js';
 import type { Payload, PayloadRequest } from '../types/index.js';
-import type { UntypedUser, UserSession } from './types.js';
 /**
  * Removes expired sessions from an array of sessions
  */
@@ -14,7 +13,7 @@ export declare const addSessionToUser: ({ collectionConfig, payload, req, user,
     collectionConfig: SanitizedCollectionConfig;
     payload: Payload;
     req: PayloadRequest;
-    user: TypedUser;
+    user: AuthenticatedUser;
 }) => Promise<{
     sid?: string;
 }>;
@@ -23,6 +22,6 @@ export declare const revokeSession: ({ collectionConfig, payload, req, sid, user
     payload: Payload;
     req: PayloadRequest;
     sid: string;
-    user: null | (TypeWithID & UntypedUser);
+    user: null | User;
 }) => Promise<void>;
 //# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,~~UAAU,EAAE,~~MAAM,gCAAgC,CAAA;~~AAC3F~~,OAAO,KAAK,EAAE,~~SAAS~~,EAAE,~~MAAM~~,~~aAAa,CAAA;AAC5C,OAAO,KAAK,~~EAAE,~~OAAO~~,EAAE,~~cAAc,EAAE,~~MAAM,~~mBAAmB~~,CAAA;~~AAChE~~,OAAO,KAAK,EAAE,~~WAAW~~,EAAE,~~WAAW~~,EAAE,MAAM,~~YAAY~~,CAAA;~~AAE1D~~;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,~~kBAO5D~~,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8CAK1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,~~SAAS~~,CAAA;~~CAChB~~,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,~~CAoC3B~~,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,~~CAAC~~,~~UAAU,GAAG,WAAW,CAAC,~~CAAA;~~CACxC~~,KAAG,OAAO,CAAC,IAAI,CAWf,CAAA"}
1	+ {"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8CAK1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAqC3B,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAWf,CAAA"}

package/dist/auth/sessions.js CHANGED Viewed

@@ -32,12 +32,14 @@ import { v4 as uuid } from 'uuid';
             user.sessions = removeExpiredSessions(user.sessions);
             user.sessions.push(session);
         }
-        // Prevent updatedAt from being updated when only adding a session
-        user.updatedAt = null;
         await payload.db.updateOne({
             id: user.id,
             collection: collectionConfig.slug,
-            data: user,
+            data: {
+                ...user,
+                // Prevent updatedAt from being updated when only adding a session
+                updatedAt: null
+            },
             req,
             returning: false
         });

package/dist/auth/sessions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig, ~~TypeWithID~~ } from '../collections/config/types.js'\nimport type { ~~TypedUser~~ } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\~~nimport type { UntypedUser, UserSession } from './types.js'\~~n\n/*\n Removes expired sessions from an array of sessions\n /\nexport const removeExpiredSessions = (sessions: UserSession[]) => {\n const now = new Date()\n\n return sessions.filter(({ expiresAt }) => {\n const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n return expiry > now\n })\n}\n\n/\n Adds a session to the user and removes expired sessions\n * @returns The session ID (sid) if sessions are used\n /\nexport const addSessionToUser = async ({\n collectionConfig,\n payload,\n req,\n user,\n}: {\n collectionConfig: SanitizedCollectionConfig\n payload: Payload\n req: PayloadRequest\n user: ~~TypedUser~~\n}): Promise<{ sid?: string }> => {\n let sid: string \| undefined\n if (collectionConfig.auth.useSessions) {\n // Add session to user\n sid = uuid()\n const now = new Date()\n const tokenExpInMs = collectionConfig.auth.tokenExpiration 1000\n const expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n const session = { id: sid, createdAt: now, expiresAt }\n\n if (!user.sessions?.length) {\n user.sessions = [session]\n } else {\n user.sessions = removeExpiredSessions(user.sessions)\n user.sessions.push(session)\n }\n\n ~~// Prevent updatedAt from being updated when only adding a session\n user.updatedAt = null\n\n~~ await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: user,\n req,\n returning: false,\n })\n\n user.collection = collectionConfig.slug\n user._strategy = 'local-jwt'\n }\n\n return {\n sid,\n }\n}\n\nexport const revokeSession = async ({\n collectionConfig,\n payload,\n req,\n sid,\n user,\n}: {\n collectionConfig: SanitizedCollectionConfig\n payload: Payload\n req: PayloadRequest\n sid: string\n user: null \| ~~(TypeWithID & UntypedUser)~~\n}): Promise<void> => {\n if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n user.sessions = user.sessions.filter((session) => session.id !== sid)\n await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: user,\n req,\n returning: false,\n })\n }\n}\n"],"names":["v4","uuid","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","user","sid","auth","useSessions","tokenExpInMs","tokenExpiration","getTime","session","id","createdAt","length","push","~~updatedAt","~~db","updateOne","collection","slug","data","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;~~AAOjC~~;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,IAAI,EAML;IACC,IAAIC;IACJ,IAAIJ,iBAAiBK,IAAI,CAACC,WAAW,EAAE;QACrC,sBAAsB;QACtBF,MAAMb;QACN,MAAMG,MAAM,IAAIC;QAChB,MAAMY,eAAeP,iBAAiBK,IAAI,CAACG,eAAe,GAAG;QAC7D,MAAMX,YAAY,IAAIF,KAAKD,IAAIe,OAAO,KAAKF;QAE3C,MAAMG,UAAU;YAAEC,IAAIP;YAAKQ,WAAWlB;YAAKG;QAAU;QAErD,IAAI,CAACM,KAAKV,QAAQ,EAAEoB,QAAQ;YAC1BV,KAAKV,QAAQ,GAAG;gBAACiB;aAAQ;QAC3B,OAAO;YACLP,KAAKV,QAAQ,GAAGD,sBAAsBW,KAAKV,QAAQ;YACnDU,KAAKV,QAAQ,CAACqB,IAAI,CAACJ;QACrB;QAEA,~~kEAAkE;QAClEP~~,~~KAAKY~~,~~SAAS,GAAG;QAEjB,MAAMd,QAAQe,~~EAAE,CAACC,SAAS,CAAC;~~YACzBN~~,IAAIR,KAAKQ,EAAE;~~YACXO~~,~~YAAYlB~~,~~iBAAiBmB~~,IAAI;YACjCC,~~MAAMjB~~;~~YACND~~;YACAmB,WAAW;QACb;QAEAlB,~~KAAKe~~,UAAU,~~GAAGlB~~,~~iBAAiBmB~~,IAAI;~~QACvChB~~,KAAKmB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLlB;IACF;AACF,EAAC;AAED,OAAO,MAAMmB,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHE,GAAG,EACHD,IAAI,EAOL;IACC,IAAIH,iBAAiBK,IAAI,CAACC,WAAW,IAAIH,QAAQA,KAAKV,QAAQ,EAAEoB,QAAQ;QACtEV,KAAKV,QAAQ,GAAGU,KAAKV,QAAQ,CAACG,MAAM,CAAC,CAACc,UAAYA,QAAQC,EAAE,KAAKP;QACjE,MAAMH,~~QAAQe~~,EAAE,CAACC,SAAS,CAAC;~~YACzBN~~,IAAIR,KAAKQ,EAAE;~~YACXO~~,~~YAAYlB~~,~~iBAAiBmB~~,IAAI;YACjCC,~~MAAMjB~~;YACND;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}
1	+ {"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser, User, UserSession } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\n\n/*\n Removes expired sessions from an array of sessions\n /\nexport const removeExpiredSessions = (sessions: UserSession[]): UserSession[] => {\n const now = new Date()\n\n return sessions.filter(({ expiresAt }) => {\n const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n return expiry > now\n })\n}\n\n/\n Adds a session to the user and removes expired sessions\n * @returns The session ID (sid) if sessions are used\n /\nexport const addSessionToUser = async ({\n collectionConfig,\n payload,\n req,\n user,\n}: {\n collectionConfig: SanitizedCollectionConfig\n payload: Payload\n req: PayloadRequest\n user: AuthenticatedUser\n}): Promise<{ sid?: string }> => {\n let sid: string \| undefined\n if (collectionConfig.auth.useSessions) {\n // Add session to user\n sid = uuid()\n const now = new Date()\n const tokenExpInMs = collectionConfig.auth.tokenExpiration 1000\n const expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n const session = { id: sid, createdAt: now, expiresAt }\n\n if (!user.sessions?.length) {\n user.sessions = [session]\n } else {\n user.sessions = removeExpiredSessions(user.sessions)\n user.sessions.push(session)\n }\n\n await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: {\n ...user,\n // Prevent updatedAt from being updated when only adding a session\n updatedAt: null,\n },\n req,\n returning: false,\n })\n\n user.collection = collectionConfig.slug\n user._strategy = 'local-jwt'\n }\n\n return {\n sid,\n }\n}\n\nexport const revokeSession = async ({\n collectionConfig,\n payload,\n req,\n sid,\n user,\n}: {\n collectionConfig: SanitizedCollectionConfig\n payload: Payload\n req: PayloadRequest\n sid: string\n user: null \| User\n}): Promise<void> => {\n if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n user.sessions = user.sessions.filter((session) => session.id !== sid)\n await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: user,\n req,\n returning: false,\n })\n }\n}\n"],"names":["v4","uuid","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","user","sid","auth","useSessions","tokenExpInMs","tokenExpiration","getTime","session","id","createdAt","length","push","db","updateOne","collection","slug","data","updatedAt","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAMjC;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,IAAI,EAML;IACC,IAAIC;IACJ,IAAIJ,iBAAiBK,IAAI,CAACC,WAAW,EAAE;QACrC,sBAAsB;QACtBF,MAAMb;QACN,MAAMG,MAAM,IAAIC;QAChB,MAAMY,eAAeP,iBAAiBK,IAAI,CAACG,eAAe,GAAG;QAC7D,MAAMX,YAAY,IAAIF,KAAKD,IAAIe,OAAO,KAAKF;QAE3C,MAAMG,UAAU;YAAEC,IAAIP;YAAKQ,WAAWlB;YAAKG;QAAU;QAErD,IAAI,CAACM,KAAKV,QAAQ,EAAEoB,QAAQ;YAC1BV,KAAKV,QAAQ,GAAG;gBAACiB;aAAQ;QAC3B,OAAO;YACLP,KAAKV,QAAQ,GAAGD,sBAAsBW,KAAKV,QAAQ;YACnDU,KAAKV,QAAQ,CAACqB,IAAI,CAACJ;QACrB;QAEA,MAAMT,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAM;gBACJ,GAAGhB,IAAI;gBACP,kEAAkE;gBAClEiB,WAAW;YACb;YACAlB;YACAmB,WAAW;QACb;QAEAlB,KAAKc,UAAU,GAAGjB,iBAAiBkB,IAAI;QACvCf,KAAKmB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLlB;IACF;AACF,EAAC;AAED,OAAO,MAAMmB,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHE,GAAG,EACHD,IAAI,EAOL;IACC,IAAIH,iBAAiBK,IAAI,CAACC,WAAW,IAAIH,QAAQA,KAAKV,QAAQ,EAAEoB,QAAQ;QACtEV,KAAKV,QAAQ,GAAGU,KAAKV,QAAQ,CAACG,MAAM,CAAC,CAACc,UAAYA,QAAQC,EAAE,KAAKP;QACjE,MAAMH,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAMhB;YACND;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}

package/dist/auth/strategies/apiKey.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,~~oBAqE9C~~,CAAA"}
1	+ {"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAuD9C,CAAA"}

package/dist/auth/strategies/apiKey.js CHANGED Viewed

@@ -3,28 +3,15 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
         const authHeader = headers.get('Authorization');
         if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {
             const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '');
-            // TODO: V4 remove extra algorithm check
-            // api keys saved prior to v3.46.0 will have sha1
-            const sha1APIKeyIndex = crypto.createHmac('sha1', payload.secret).update(apiKey).digest('hex');
             const sha256APIKeyIndex = crypto.createHmac('sha256', payload.secret).update(apiKey).digest('hex');
-            const apiKeyConstraints = [
-                {
-                    apiKeyIndex: {
-                        equals: sha1APIKeyIndex
-                    }
-                },
-                {
-                    apiKeyIndex: {
-                        equals: sha256APIKeyIndex
-                    }
-                }
-            ];
             try {
                 const where = {};
                 if (collectionConfig.auth?.verify) {
                     where.and = [
                         {
-                            or: apiKeyConstraints
+                            apiKeyIndex: {
+                                equals: sha256APIKeyIndex
+                            }
                         },
                         {
                             _verified: {
@@ -33,7 +20,9 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                         }
                     ];
                 } else {
-                    where.or = apiKeyConstraints;
+                    where.apiKeyIndex = {
+                        equals: sha256APIKeyIndex
+                    };
                 }
                 const userQuery = await payload.find({
                     collection: collectionConfig.slug,

package/dist/auth/strategies/apiKey.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { ~~TypedUser~~ } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n async ({ headers, isGraphQL = false, payload }) => {\n const authHeader = headers.get('Authorization')\n\n if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n ~~// TODO: V4 remove extra algorithm check\n // api keys saved prior to v3.46.0 will have sha1\n~~ const ~~sha1APIKeyIndex = crypto.createHmac('sha1', payload.secret).update(apiKey).digest('hex')\n const~~ sha256APIKeyIndex = crypto\n .createHmac('sha256', payload.secret)\n .update(apiKey)\n .digest('hex')\n\n const apiKeyConstraints = [\n {\n apiKeyIndex: {\n equals: sha1APIKeyIndex,\n },\n },\n {\n apiKeyIndex: {\n equals: sha256APIKeyIndex,\n },\n },\n ]\n\n try {\n const where: Where = {}\n if (collectionConfig.auth?.verify) {\n where.and = [\n {\n or: ~~apiKeyConstraints~~,\n },\n {\n _verified: {\n not_equals: false,\n },\n },\n ]\n } else {\n where.or = ~~apiKeyConstraints~~\n }\n\n const userQuery = await payload.find({\n collection: collectionConfig.slug,\n depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n limit: 1,\n overrideAccess: true,\n pagination: false,\n where,\n })\n\n if (userQuery.docs && userQuery.docs.length > 0) {\n const user = userQuery.docs[0]\n user!.collection = collectionConfig.slug\n user!._strategy = 'api-key'\n\n return {\n user: user as ~~TypedUser~~,\n }\n }\n } catch (ignore) {\n return { user: null }\n }\n }\n\n return { user: null }\n }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","~~sha1APIKeyIndex~~","createHmac","secret","update","digest","~~sha256APIKeyIndex","apiKeyConstraints","apiKeyIndex","equals","~~where","auth","verify","and","or","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,~~wCAAwC;YACxC,iDAAiD;YACjD,~~MAAMG,~~kBAAkBZ~~,~~OAAOa,UAAU,CAAC,QAAQR,QAAQS,MAAM,EAAEC,MAAM,CAACL,QAAQM,MAAM,CAAC;YACxF,MAAMC,oBAAoBjB,~~OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,~~MAAME,oBAAoB;gBACxB;oBACEC,aAAa;wBACXC,QAAQR;oBACV;gBACF;gBACA;oBACEO,aAAa;wBACXC,QAAQH;oBACV;gBACF;aACD;YAED,~~IAAI;gBACF,~~MAAMI~~,QAAe,CAAC;gBACtB,~~IAAInB~~,~~iBAAiBoB~~,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,~~IAAIP~~;~~wBACN~~;wBACA;~~4BACEQ~~,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;~~oBACLN~~,MAAMI,~~EAAE~~,~~GAAGP~~;~~gBACb~~;gBAEA,~~MAAMU~~,YAAY,~~MAAMvB~~,~~QAAQwB~~,IAAI,CAAC;oBACnCC,~~YAAY5B~~,iBAAiBO,IAAI;~~oBACjCsB~~,~~OAAO3B~~,YAAY,IAAIF,~~iBAAiBoB~~,IAAI,~~CAACS~~,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;~~oBACZb~~;gBACF;gBAEA,~~IAAIO~~,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,~~GAAG5B~~,iBAAiBO,IAAI;~~oBACxC4B~~,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}
1	+ {"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n async ({ headers, isGraphQL = false, payload }) => {\n const authHeader = headers.get('Authorization')\n\n if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n const sha256APIKeyIndex = crypto\n .createHmac('sha256', payload.secret)\n .update(apiKey)\n .digest('hex')\n\n try {\n const where: Where = {}\n if (collectionConfig.auth?.verify) {\n where.and = [\n {\n apiKeyIndex: {\n equals: sha256APIKeyIndex,\n },\n },\n {\n _verified: {\n not_equals: false,\n },\n },\n ]\n } else {\n where.apiKeyIndex = { equals: sha256APIKeyIndex }\n }\n\n const userQuery = await payload.find({\n collection: collectionConfig.slug,\n depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n limit: 1,\n overrideAccess: true,\n pagination: false,\n where,\n })\n\n if (userQuery.docs && userQuery.docs.length > 0) {\n const user = userQuery.docs[0]\n user!.collection = collectionConfig.slug\n user!._strategy = 'api-key'\n\n return {\n user: user as User,\n }\n }\n } catch (ignore) {\n return { user: null }\n }\n }\n\n return { user: null }\n }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","sha256APIKeyIndex","createHmac","secret","update","digest","where","auth","verify","and","apiKeyIndex","equals","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,MAAMG,oBAAoBZ,OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAIf,iBAAiBgB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,QAAQV;4BACV;wBACF;wBACA;4BACEW,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,QAAQV;oBAAkB;gBAClD;gBAEA,MAAMa,YAAY,MAAMpB,QAAQqB,IAAI,CAAC;oBACnCC,YAAYzB,iBAAiBO,IAAI;oBACjCmB,OAAOxB,YAAY,IAAIF,iBAAiBgB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAGzB,iBAAiBO,IAAI;oBACxCyB,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}

package/dist/auth/strategies/local/incrementLoginAttempts.d.ts CHANGED Viewed

@@ -1,9 +1,9 @@
 import type { SanitizedCollectionConfig } from '../../../collections/config/types.js';
-import { type Payload, type TypedUser } from '../../../index.js';
+import { type Payload, type User } from '../../../index.js';
 type Args = {
     collection: SanitizedCollectionConfig;
     payload: Payload;
-    user: TypedUser;
+    user: User;
 };
 export declare const incrementLoginAttempts: ({ collection, payload, user, }: Args) => Promise<void>;
 export {};

package/dist/auth/strategies/local/incrementLoginAttempts.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,~~SAAS~~,EAAE,MAAM,mBAAmB,CAAA;~~AAGjF~~,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,~~SAAS~~,CAAA;~~CAChB~~,CAAA;AAID,eAAO,MAAM,sBAAsB,mCAIhC,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}
1	+ {"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG5E,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAID,eAAO,MAAM,sBAAsB,mCAIhC,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}

package/dist/auth/strategies/local/incrementLoginAttempts.js CHANGED Viewed

@@ -92,7 +92,7 @@ export const incrementLoginAttempts = async ({ collection, payload, user })=>{
             if (currentUser?.sessions?.length) {
                 // Does not hurt also removing expired sessions
                 currentUser.sessions = currentUser.sessions.filter((session)=>{
-                    const sessionCreatedAt = new Date(session.createdAt);
+                    const sessionCreatedAt = new Date(session.createdAt ?? 0);
                     const twentySecondsAgo = new Date(currentTime - 20000);
                     // Remove sessions created within the last 20 seconds
                     return sessionCreatedAt <= twentySecondsAgo;

package/dist/auth/strategies/local/incrementLoginAttempts.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\n\nimport { type JsonObject, type Payload, type ~~TypedUser~~ } from '../../../index.js'\nimport { isUserLocked } from '../../isUserLocked.js'\n\ntype Args = {\n collection: SanitizedCollectionConfig\n payload: Payload\n user: ~~TypedUser~~\n}\n\n// Note: this function does not use req in its updates, as we want those to be visible in parallel requests that are on a different\n// transaction. At the same time, we want updates from parallel requests to be visible here.\nexport const incrementLoginAttempts = async ({\n collection,\n payload,\n user,\n}: Args): Promise<void> => {\n const {\n auth: { lockTime, maxLoginAttempts },\n } = collection\n\n const currentTime = Date.now()\n\n let updatedLockUntil: null \| string = null\n let updatedLoginAttempts: null \| number = null\n\n if (user.lockUntil && !isUserLocked(new Date(user.lockUntil))) {\n // Expired lock, restart count at 1\n const updatedUser = await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data: {\n lockUntil: null,\n loginAttempts: 1,\n },\n select: {\n lockUntil: true,\n loginAttempts: true,\n },\n })\n updatedLockUntil = updatedUser.lockUntil\n updatedLoginAttempts = updatedUser.loginAttempts\n user.lockUntil = updatedLockUntil\n } else {\n const data: JsonObject = {\n loginAttempts: {\n $inc: 1,\n },\n }\n\n const willReachMaxAttempts =\n typeof user.loginAttempts === 'number' && user.loginAttempts + 1 >= maxLoginAttempts\n // Lock the account if at max attempts and not already locked\n if (willReachMaxAttempts) {\n const lockUntil = new Date(currentTime + lockTime).toISOString()\n data.lockUntil = lockUntil\n }\n\n const updatedUser = await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data,\n select: {\n lockUntil: true,\n loginAttempts: true,\n },\n })\n\n updatedLockUntil = updatedUser.lockUntil\n updatedLoginAttempts = updatedUser.loginAttempts\n }\n\n if (updatedLoginAttempts === null) {\n throw new Error('Failed to update login attempts or lockUntil for user')\n }\n\n // Check updated latest lockUntil and loginAttempts in case there were parallel updates\n const reachedMaxAttemptsForCurrentUser =\n typeof updatedLoginAttempts === 'number' && updatedLoginAttempts - 1 >= maxLoginAttempts\n\n const reachedMaxAttemptsForNextUser =\n typeof updatedLoginAttempts === 'number' && updatedLoginAttempts >= maxLoginAttempts\n\n if (reachedMaxAttemptsForCurrentUser) {\n user.lockUntil = updatedLockUntil\n }\n user.loginAttempts = updatedLoginAttempts - 1 // -1, as the updated increment is applied for the next login attempt, not the current one\n\n if (\n reachedMaxAttemptsForNextUser &&\n (!updatedLockUntil \|\| !isUserLocked(new Date(updatedLockUntil)))\n ) {\n // If lockUntil reached max login attempts due to multiple parallel attempts but user was not locked yet,\n const newLockUntil = new Date(currentTime + lockTime).toISOString()\n\n await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data: {\n lockUntil: newLockUntil,\n },\n returning: false,\n })\n\n if (reachedMaxAttemptsForCurrentUser) {\n user.lockUntil = newLockUntil\n }\n\n if (collection.auth.useSessions) {\n // Remove all active sessions that have been created in a 20 second window. This protects\n // against brute force attacks - example: 99 incorrect, 1 correct parallel login attempts.\n // The correct login attempt will be finished first, as it's faster due to not having to perform\n // an additional db update here.\n // However, this request (the incorrect login attempt request) can kill the successful login attempt here.\n\n // Fetch user sessions separately (do not do this in the updateOne select in order to preserve the returning: true db call optimization)\n const currentUser = await payload.db.findOne<~~TypedUser~~>({\n collection: collection.slug,\n select: {\n sessions: true,\n },\n where: {\n id: {\n equals: user.id,\n },\n },\n })\n if (currentUser?.sessions?.length) {\n // Does not hurt also removing expired sessions\n currentUser.sessions = currentUser.sessions.filter((session) => {\n const sessionCreatedAt = new Date(session.createdAt)\n const twentySecondsAgo = new Date(currentTime - 20000)\n\n // Remove sessions created within the last 20 seconds\n return sessionCreatedAt <= twentySecondsAgo\n })\n\n user.sessions = currentUser.sessions\n\n // Ensure updatedAt date is always updated\n user.updatedAt = new Date().toISOString()\n\n await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data: user,\n returning: false,\n })\n }\n }\n }\n}\n"],"names":["isUserLocked","incrementLoginAttempts","collection","payload","user","auth","lockTime","maxLoginAttempts","currentTime","Date","now","updatedLockUntil","updatedLoginAttempts","lockUntil","updatedUser","db","updateOne","id","slug","data","loginAttempts","select","$inc","willReachMaxAttempts","toISOString","Error","reachedMaxAttemptsForCurrentUser","reachedMaxAttemptsForNextUser","newLockUntil","returning","useSessions","currentUser","findOne","sessions","where","equals","length","filter","session","sessionCreatedAt","createdAt","twentySecondsAgo","updatedAt"],"mappings":"AAGA,SAASA,YAAY,QAAQ,wBAAuB;AAQpD,mIAAmI;AACnI,4FAA4F;AAC5F,OAAO,MAAMC,yBAAyB,OAAO,EAC3CC,UAAU,EACVC,OAAO,EACPC,IAAI,EACC;IACL,MAAM,EACJC,MAAM,EAAEC,QAAQ,EAAEC,gBAAgB,EAAE,EACrC,GAAGL;IAEJ,MAAMM,cAAcC,KAAKC,GAAG;IAE5B,IAAIC,mBAAkC;IACtC,IAAIC,uBAAsC;IAE1C,IAAIR,KAAKS,SAAS,IAAI,CAACb,aAAa,IAAIS,KAAKL,KAAKS,SAAS,IAAI;QAC7D,mCAAmC;QACnC,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAW;gBACXO,eAAe;YACjB;YACAC,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QACAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;QAChDhB,KAAKS,SAAS,GAAGF;IACnB,OAAO;QACL,MAAMQ,OAAmB;YACvBC,eAAe;gBACbE,MAAM;YACR;QACF;QAEA,MAAMC,uBACJ,OAAOnB,KAAKgB,aAAa,KAAK,YAAYhB,KAAKgB,aAAa,GAAG,KAAKb;QACtE,6DAA6D;QAC7D,IAAIgB,sBAAsB;YACxB,MAAMV,YAAY,IAAIJ,KAAKD,cAAcF,UAAUkB,WAAW;YAC9DL,KAAKN,SAAS,GAAGA;QACnB;QAEA,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC;YACAE,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QAEAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;IAClD;IAEA,IAAIR,yBAAyB,MAAM;QACjC,MAAM,IAAIa,MAAM;IAClB;IAEA,uFAAuF;IACvF,MAAMC,mCACJ,OAAOd,yBAAyB,YAAYA,uBAAuB,KAAKL;IAE1E,MAAMoB,gCACJ,OAAOf,yBAAyB,YAAYA,wBAAwBL;IAEtE,IAAImB,kCAAkC;QACpCtB,KAAKS,SAAS,GAAGF;IACnB;IACAP,KAAKgB,aAAa,GAAGR,uBAAuB,GAAE,4FAA4F;IAE1I,IACEe,iCACC,CAAA,CAAChB,oBAAoB,CAACX,aAAa,IAAIS,KAAKE,kBAAiB,GAC9D;QACA,yGAAyG;QACzG,MAAMiB,eAAe,IAAInB,KAAKD,cAAcF,UAAUkB,WAAW;QAEjE,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;YACzBC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAWe;YACb;YACAC,WAAW;QACb;QAEA,IAAIH,kCAAkC;YACpCtB,KAAKS,SAAS,GAAGe;QACnB;QAEA,IAAI1B,WAAWG,IAAI,CAACyB,WAAW,EAAE;YAC/B,yFAAyF;YACzF,0FAA0F;YAC1F,gGAAgG;YAChG,gCAAgC;YAChC,0GAA0G;YAE1G,wIAAwI;YACxI,MAAMC,cAAc,MAAM5B,QAAQY,EAAE,CAACiB,OAAO,~~CAAY~~;~~gBACtD9B~~,YAAYA,WAAWgB,IAAI;gBAC3BG,QAAQ;oBACNY,UAAU;gBACZ;gBACAC,OAAO;oBACLjB,IAAI;wBACFkB,QAAQ/B,KAAKa,EAAE;oBACjB;gBACF;YACF;YACA,IAAIc,aAAaE,UAAUG,QAAQ;gBACjC,+CAA+C;gBAC/CL,YAAYE,QAAQ,GAAGF,YAAYE,QAAQ,CAACI,MAAM,CAAC,CAACC;oBAClD,MAAMC,mBAAmB,IAAI9B,KAAK6B,QAAQE,SAAS;~~oBACnD~~,MAAMC,mBAAmB,IAAIhC,KAAKD,cAAc;oBAEhD,qDAAqD;oBACrD,OAAO+B,oBAAoBE;gBAC7B;gBAEArC,KAAK6B,QAAQ,GAAGF,YAAYE,QAAQ;gBAEpC,0CAA0C;gBAC1C7B,KAAKsC,SAAS,GAAG,IAAIjC,OAAOe,WAAW;gBAEvC,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;oBACzBC,IAAIb,KAAKa,EAAE;oBACXf,YAAYA,WAAWgB,IAAI;oBAC3BC,MAAMf;oBACNyB,WAAW;gBACb;YACF;QACF;IACF;AACF,EAAC"}
1	+ {"version":3,"sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\n\nimport { type JsonObject, type Payload, type User } from '../../../index.js'\nimport { isUserLocked } from '../../isUserLocked.js'\n\ntype Args = {\n collection: SanitizedCollectionConfig\n payload: Payload\n user: User\n}\n\n// Note: this function does not use req in its updates, as we want those to be visible in parallel requests that are on a different\n// transaction. At the same time, we want updates from parallel requests to be visible here.\nexport const incrementLoginAttempts = async ({\n collection,\n payload,\n user,\n}: Args): Promise<void> => {\n const {\n auth: { lockTime, maxLoginAttempts },\n } = collection\n\n const currentTime = Date.now()\n\n let updatedLockUntil: null \| string = null\n let updatedLoginAttempts: null \| number = null\n\n if (user.lockUntil && !isUserLocked(new Date(user.lockUntil))) {\n // Expired lock, restart count at 1\n const updatedUser = await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data: {\n lockUntil: null,\n loginAttempts: 1,\n },\n select: {\n lockUntil: true,\n loginAttempts: true,\n },\n })\n updatedLockUntil = updatedUser.lockUntil\n updatedLoginAttempts = updatedUser.loginAttempts\n user.lockUntil = updatedLockUntil\n } else {\n const data: JsonObject = {\n loginAttempts: {\n $inc: 1,\n },\n }\n\n const willReachMaxAttempts =\n typeof user.loginAttempts === 'number' && user.loginAttempts + 1 >= maxLoginAttempts\n // Lock the account if at max attempts and not already locked\n if (willReachMaxAttempts) {\n const lockUntil = new Date(currentTime + lockTime).toISOString()\n data.lockUntil = lockUntil\n }\n\n const updatedUser = await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data,\n select: {\n lockUntil: true,\n loginAttempts: true,\n },\n })\n\n updatedLockUntil = updatedUser.lockUntil\n updatedLoginAttempts = updatedUser.loginAttempts\n }\n\n if (updatedLoginAttempts === null) {\n throw new Error('Failed to update login attempts or lockUntil for user')\n }\n\n // Check updated latest lockUntil and loginAttempts in case there were parallel updates\n const reachedMaxAttemptsForCurrentUser =\n typeof updatedLoginAttempts === 'number' && updatedLoginAttempts - 1 >= maxLoginAttempts\n\n const reachedMaxAttemptsForNextUser =\n typeof updatedLoginAttempts === 'number' && updatedLoginAttempts >= maxLoginAttempts\n\n if (reachedMaxAttemptsForCurrentUser) {\n user.lockUntil = updatedLockUntil\n }\n user.loginAttempts = updatedLoginAttempts - 1 // -1, as the updated increment is applied for the next login attempt, not the current one\n\n if (\n reachedMaxAttemptsForNextUser &&\n (!updatedLockUntil \|\| !isUserLocked(new Date(updatedLockUntil)))\n ) {\n // If lockUntil reached max login attempts due to multiple parallel attempts but user was not locked yet,\n const newLockUntil = new Date(currentTime + lockTime).toISOString()\n\n await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data: {\n lockUntil: newLockUntil,\n },\n returning: false,\n })\n\n if (reachedMaxAttemptsForCurrentUser) {\n user.lockUntil = newLockUntil\n }\n\n if (collection.auth.useSessions) {\n // Remove all active sessions that have been created in a 20 second window. This protects\n // against brute force attacks - example: 99 incorrect, 1 correct parallel login attempts.\n // The correct login attempt will be finished first, as it's faster due to not having to perform\n // an additional db update here.\n // However, this request (the incorrect login attempt request) can kill the successful login attempt here.\n\n // Fetch user sessions separately (do not do this in the updateOne select in order to preserve the returning: true db call optimization)\n const currentUser = await payload.db.findOne<User>({\n collection: collection.slug,\n select: {\n sessions: true,\n },\n where: {\n id: {\n equals: user.id,\n },\n },\n })\n if (currentUser?.sessions?.length) {\n // Does not hurt also removing expired sessions\n currentUser.sessions = currentUser.sessions.filter((session) => {\n const sessionCreatedAt = new Date(session.createdAt ?? 0)\n const twentySecondsAgo = new Date(currentTime - 20000)\n\n // Remove sessions created within the last 20 seconds\n return sessionCreatedAt <= twentySecondsAgo\n })\n\n user.sessions = currentUser.sessions\n\n // Ensure updatedAt date is always updated\n user.updatedAt = new Date().toISOString()\n\n await payload.db.updateOne({\n id: user.id,\n collection: collection.slug,\n data: user,\n returning: false,\n })\n }\n }\n }\n}\n"],"names":["isUserLocked","incrementLoginAttempts","collection","payload","user","auth","lockTime","maxLoginAttempts","currentTime","Date","now","updatedLockUntil","updatedLoginAttempts","lockUntil","updatedUser","db","updateOne","id","slug","data","loginAttempts","select","$inc","willReachMaxAttempts","toISOString","Error","reachedMaxAttemptsForCurrentUser","reachedMaxAttemptsForNextUser","newLockUntil","returning","useSessions","currentUser","findOne","sessions","where","equals","length","filter","session","sessionCreatedAt","createdAt","twentySecondsAgo","updatedAt"],"mappings":"AAGA,SAASA,YAAY,QAAQ,wBAAuB;AAQpD,mIAAmI;AACnI,4FAA4F;AAC5F,OAAO,MAAMC,yBAAyB,OAAO,EAC3CC,UAAU,EACVC,OAAO,EACPC,IAAI,EACC;IACL,MAAM,EACJC,MAAM,EAAEC,QAAQ,EAAEC,gBAAgB,EAAE,EACrC,GAAGL;IAEJ,MAAMM,cAAcC,KAAKC,GAAG;IAE5B,IAAIC,mBAAkC;IACtC,IAAIC,uBAAsC;IAE1C,IAAIR,KAAKS,SAAS,IAAI,CAACb,aAAa,IAAIS,KAAKL,KAAKS,SAAS,IAAI;QAC7D,mCAAmC;QACnC,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAW;gBACXO,eAAe;YACjB;YACAC,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QACAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;QAChDhB,KAAKS,SAAS,GAAGF;IACnB,OAAO;QACL,MAAMQ,OAAmB;YACvBC,eAAe;gBACbE,MAAM;YACR;QACF;QAEA,MAAMC,uBACJ,OAAOnB,KAAKgB,aAAa,KAAK,YAAYhB,KAAKgB,aAAa,GAAG,KAAKb;QACtE,6DAA6D;QAC7D,IAAIgB,sBAAsB;YACxB,MAAMV,YAAY,IAAIJ,KAAKD,cAAcF,UAAUkB,WAAW;YAC9DL,KAAKN,SAAS,GAAGA;QACnB;QAEA,MAAMC,cAAc,MAAMX,QAAQY,EAAE,CAACC,SAAS,CAAC;YAC7CC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC;YACAE,QAAQ;gBACNR,WAAW;gBACXO,eAAe;YACjB;QACF;QAEAT,mBAAmBG,YAAYD,SAAS;QACxCD,uBAAuBE,YAAYM,aAAa;IAClD;IAEA,IAAIR,yBAAyB,MAAM;QACjC,MAAM,IAAIa,MAAM;IAClB;IAEA,uFAAuF;IACvF,MAAMC,mCACJ,OAAOd,yBAAyB,YAAYA,uBAAuB,KAAKL;IAE1E,MAAMoB,gCACJ,OAAOf,yBAAyB,YAAYA,wBAAwBL;IAEtE,IAAImB,kCAAkC;QACpCtB,KAAKS,SAAS,GAAGF;IACnB;IACAP,KAAKgB,aAAa,GAAGR,uBAAuB,GAAE,4FAA4F;IAE1I,IACEe,iCACC,CAAA,CAAChB,oBAAoB,CAACX,aAAa,IAAIS,KAAKE,kBAAiB,GAC9D;QACA,yGAAyG;QACzG,MAAMiB,eAAe,IAAInB,KAAKD,cAAcF,UAAUkB,WAAW;QAEjE,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;YACzBC,IAAIb,KAAKa,EAAE;YACXf,YAAYA,WAAWgB,IAAI;YAC3BC,MAAM;gBACJN,WAAWe;YACb;YACAC,WAAW;QACb;QAEA,IAAIH,kCAAkC;YACpCtB,KAAKS,SAAS,GAAGe;QACnB;QAEA,IAAI1B,WAAWG,IAAI,CAACyB,WAAW,EAAE;YAC/B,yFAAyF;YACzF,0FAA0F;YAC1F,gGAAgG;YAChG,gCAAgC;YAChC,0GAA0G;YAE1G,wIAAwI;YACxI,MAAMC,cAAc,MAAM5B,QAAQY,EAAE,CAACiB,OAAO,CAAO;gBACjD9B,YAAYA,WAAWgB,IAAI;gBAC3BG,QAAQ;oBACNY,UAAU;gBACZ;gBACAC,OAAO;oBACLjB,IAAI;wBACFkB,QAAQ/B,KAAKa,EAAE;oBACjB;gBACF;YACF;YACA,IAAIc,aAAaE,UAAUG,QAAQ;gBACjC,+CAA+C;gBAC/CL,YAAYE,QAAQ,GAAGF,YAAYE,QAAQ,CAACI,MAAM,CAAC,CAACC;oBAClD,MAAMC,mBAAmB,IAAI9B,KAAK6B,QAAQE,SAAS,IAAI;oBACvD,MAAMC,mBAAmB,IAAIhC,KAAKD,cAAc;oBAEhD,qDAAqD;oBACrD,OAAO+B,oBAAoBE;gBAC7B;gBAEArC,KAAK6B,QAAQ,GAAGF,YAAYE,QAAQ;gBAEpC,0CAA0C;gBAC1C7B,KAAKsC,SAAS,GAAG,IAAIjC,OAAOe,WAAW;gBAEvC,MAAMrB,QAAQY,EAAE,CAACC,SAAS,CAAC;oBACzBC,IAAIb,KAAKa,EAAE;oBACXf,YAAYA,WAAWgB,IAAI;oBAC3BC,MAAMf;oBACNyB,WAAW;gBACb;YACF;QACF;IACF;AACF,EAAC"}

package/dist/auth/types.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { DeepRequired } from 'ts-essentials';
-import type { CollectionSlug, GlobalSlug, Payload, TypedUser } from '../index.js';
+import type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js';
 import type { PayloadRequest, Where } from '../types/index.js';
 /**
  * A permission object that can be used to determine if a user has access to a specific operation.
@@ -89,28 +89,35 @@ export type SanitizedPermissions = {
         [globalSlug: string]: SanitizedGlobalPermission;
     };
 };
-type BaseUser = {
-    collection: string;
-    email?: string;
-    id: number | string;
-    sessions?: Array<UserSession>;
-    username?: string;
+/**
+ * Fields injected onto a user at authentication time. They are never stored in the database and
+ * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated
+ * user (`req.user`, login/auth/me results, auth strategies).
+ */
+export type AuthRuntimeFields = {
+    /**
+     * The session ID of the current request. May be present on request-authenticated users when
+     * sessions are enabled.
+     */
+    _sid?: string;
+    /**
+     * The name of the auth strategy that authenticated the request (e.g. `local-jwt`).
+     */
+    _strategy?: string;
 };
 /**
- * @deprecated Use `TypedUser` instead. This will be removed in 4.0.
+ * Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).
+ * Stripping it cleanly isn't possible, because auth operations build the authenticated user
+ * from a read `User` doc, so a `never`-typed `password` would break those assignments
  */
-export type UntypedUser = {
-    [key: string]: any;
-} & BaseUser;
 /**
- * `collection` is not available one the client. It's only available on the server (req.user)
- * On the client, you can access the collection via config.admin.user. Config can be accessed using the useConfig() hook
+ * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`). This is
+ * what `req.user`, `payload.auth()`, the `me` operation, auth strategies, and `useAuth().user`
+ * return.
  */
-export type ClientUser = {
-    [key: string]: any;
-} & BaseUser;
+export type AuthenticatedUser = AuthRuntimeFields & User;
 export type UserSession = {
-    createdAt: Date | string;
+    createdAt?: Date | null | string;
     expiresAt: Date | string;
     id: string;
 };
@@ -149,10 +156,7 @@ export type AuthStrategyFunctionArgs = {
 };
 export type AuthStrategyResult = {
     responseHeaders?: Headers;
-    user: ({
-        _strategy?: string;
-        collection?: string;
-    } & TypedUser) | null;
+    user: AuthenticatedUser | null;
 };
 export type AuthStrategyFunction = (args: AuthStrategyFunctionArgs) => AuthStrategyResult | Promise<AuthStrategyResult>;
 export type AuthStrategy = {

package/dist/auth/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,~~SAAS~~,EAAE,MAAM,aAAa,CAAA;~~AACjF~~,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;CACb,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED~~,KAAK,QAAQ,GAAG~~;~~IACd~~,~~UAAU,EAAE,~~MAAM,~~CAAA;IAClB,KAAK,CAAC,EAAE,~~MAAM,~~CAAA;IACd~~,~~EAAE,EAAE,MAAM,~~GAAG~~,MAAM,CAAA~~;~~IACnB,QAAQ,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA~~;~~IAC7B~~,~~QAAQ~~,CAAC,EAAE,MAAM,CAAA;~~CAClB,CAAA;AAED~~;;~~GAEG~~;~~AACH~~,~~MAAM~~,~~MAAM,WAAW,GAAG;IACxB,~~CAAC,~~GAAG,~~EAAE,MAAM,~~GAAG,GAAG,~~CAAA;CACnB,~~GAAG,QAAQ,~~CAAA;~~AAEZ;;;GAGG~~;AACH,MAAM,MAAM,~~UAAU~~,GAAG~~;IACvB~~,~~CAAC~~,GAAG,~~EAAE~~,~~MAAM,GAAG,GAAG,~~CAAA;~~CACnB~~,~~GAAG,QAAQ,CAAA;AAEZ,~~MAAM,MAAM,WAAW,GAAG;~~IAAE~~,SAAS,EAAE,IAAI,GAAG,MAAM,~~CAAC~~;~~IAAC~~,SAAS,EAAE,IAAI,GAAG,MAAM,~~CAAC~~;~~IAAC~~,EAAE,EAAE,MAAM,CAAA;~~CAAE~~,CAAA;~~AAC5F~~,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,~~EACA,CAAC;QACC,SAAS,CAAC,~~EAAE,~~MAAM~~,~~CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,~~GAAG,~~SAAS,CAAC,GACd,~~IAAI,CAAA;~~CACT~~,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;QAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,CAAA;IACD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,IAAI,CAAA;IACR;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC/F,cAAc,CAAC,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD,iBAAiB,EAAE,KAAK,GAAG,wBAAwB,CAAA;IACnD,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAA;CAChC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;CACb,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExD,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;IACxB,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AACD,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;QAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,CAAA;IACD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,IAAI,CAAA;IACR;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC/F,cAAc,CAAC,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD,iBAAiB,EAAE,KAAK,GAAG,wBAAwB,CAAA;IACnD,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAA;CAChC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}

package/dist/auth/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { DeepRequired } from 'ts-essentials'\n\nimport type { CollectionSlug, GlobalSlug, Payload, ~~TypedUser~~ } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/*\n A permission object that can be used to determine if a user has access to a specific operation.\n /\nexport type Permission = {\n permission: boolean\n where?: Where\n}\n\nexport type FieldsPermissions = {\n [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n create: Permission\n fields: FieldsPermissions\n read: Permission\n update: Permission\n}\n\nexport type SanitizedBlockPermissions =\n \| {\n fields: SanitizedFieldsPermissions\n }\n \| true\n\nexport type BlocksPermissions = {\n [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n \| {\n [blockSlug: string]: SanitizedBlockPermissions\n }\n \| true\n\nexport type FieldPermissions = {\n blocks?: BlocksPermissions\n create?: Permission\n fields?: FieldsPermissions\n read?: Permission\n update?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n \| {\n blocks?: SanitizedBlocksPermissions\n create: true\n fields?: SanitizedFieldsPermissions\n read: true\n update: true\n }\n \| true\n\nexport type SanitizedFieldsPermissions =\n \| {\n [fieldName: string]: SanitizedFieldPermissions\n }\n \| true\n\nexport type CollectionPermission = {\n create?: Permission\n delete?: Permission\n fields: FieldsPermissions\n read?: Permission\n readVersions?: Permission\n // Auth-enabled Collections only\n unlock?: Permission\n update?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n create?: true\n delete?: true\n fields: SanitizedFieldsPermissions\n read?: true\n readVersions?: true\n // Auth-enabled Collections only\n unlock?: true\n update?: true\n}\n\nexport type GlobalPermission = {\n fields: FieldsPermissions\n read?: Permission\n readVersions?: Permission\n update?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n fields: SanitizedFieldsPermissions\n read?: true\n readVersions?: true\n update?: true\n}\n\nexport type DocumentPermissions = CollectionPermission \| GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission \| SanitizedGlobalPermission\n\nexport type Permissions = {\n canAccessAdmin: boolean\n collections?: Record<CollectionSlug, CollectionPermission>\n globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n canAccessAdmin?: boolean\n collections?: {\n [collectionSlug: string]: SanitizedCollectionPermission\n }\n globals?: {\n [globalSlug: string]: SanitizedGlobalPermission\n }\n}\n\~~ntype~~ ~~BaseUser~~ = {\n ~~collection:~~ ~~string~~\n ~~email?:~~ ~~string~~\n ~~id:~~ ~~number~~ \| ~~string~~\n sessions?: ~~Array<UserSession>\~~n ~~username~~?: string\n~~}\n\n~~/\n ~~@deprecated~~ ~~Use~~ ~~`TypedUser`~~ ~~instead.~~ ~~This~~ ~~will~~ be ~~removed~~ in 4.0.\n /\~~nexport type UntypedUser = {\~~n ~~[key:~~ string~~]: any~~\n} ~~& BaseUser~~\n\n/\n `~~collection~~` is ~~not~~ ~~available~~ ~~one~~ ~~the~~ ~~client.~~ It's ~~only~~ ~~available~~ on the ~~server~~ ~~(req.~~user)\n * On ~~the~~ ~~client~~, ~~you~~ ~~can~~ ~~access~~ the ~~collection~~ ~~via~~ ~~config~~.~~admin~~.user. ~~Config~~ ~~can~~ be ~~accessed~~ ~~using~~ ~~the~~ ~~useConfig~~() ~~hook\~~n /\nexport type ~~ClientUser~~ = ~~{\n [key:~~ ~~string]: any\n}~~ & ~~BaseUser~~\n\nexport type UserSession = { createdAt: Date \| string; expiresAt: Date \| string; id: string }\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n req: PayloadRequest\n token: string\n user: TUser\n}) => Promise<string> \| string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n req: PayloadRequest\n token: string\n user: TUser\n}) => Promise<string> \| string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n req?: PayloadRequest\n token?: string\n user?: TUser\n}) => Promise<string> \| string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n req?: PayloadRequest\n token?: string\n user?: TUser\n}) => Promise<string> \| string\n\nexport type AuthStrategyFunctionArgs = {\n /\n Specifies whether or not response headers can be set from this strategy.\n /\n canSetHeaders?: boolean\n headers: Request['headers']\n isGraphQL?: boolean\n payload: Payload\n /\n The AuthStrategy name property from the payload config.\n /\n strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n responseHeaders?: Headers\n user~~:\n \|~~ ~~({\n _strategy?:~~ ~~string\n collection?: string\n } & TypedUser)\n~~ \| null\n}\n\nexport type AuthStrategyFunction = (\n args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult \| Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n authenticate: AuthStrategyFunction\n name: string\n}\n\nexport type LoginWithUsernameOptions =\n \| {\n allowEmailLogin?: false\n requireEmail?: boolean\n // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n requireUsername?: true\n }\n \| {\n allowEmailLogin?: true\n requireEmail?: boolean\n requireUsername?: boolean\n }\n\nexport interface IncomingAuthType {\n /\n Set cookie options, including secure, sameSite, and domain. For advanced users.\n /\n cookies?: {\n domain?: string\n sameSite?: 'Lax' \| 'None' \| 'Strict' \| boolean\n secure?: boolean\n }\n /\n How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n * @default 0\n /\n depth?: number\n /\n Advanced - disable Payload's built-in local auth strategy. Only use this property if you have replaced Payload's auth mechanisms with your own.\n /\n disableLocalStrategy?:\n \| {\n /\n Include auth fields on the collection even though the local strategy is disabled.\n * Useful when you do not want the database or types to vary depending on the auth configuration.\n /\n enableFields?: true\n optionalPassword?: true\n }\n \| true\n /\n Customize the way that the forgotPassword operation functions.\n * @link https://payloadcms.com/docs/authentication/email#forgot-password\n /\n forgotPassword?: {\n /\n The number of milliseconds that the forgot password token should be valid for.\n * @default 3600000 // 1 hour\n /\n expiration?: number\n generateEmailHTML?: GenerateForgotPasswordEmailHTML\n generateEmailSubject?: GenerateForgotPasswordEmailSubject\n }\n /\n Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n /\n lockTime?: number\n /\n Ability to allow users to login with username/password.\n \n @link https://payloadcms.com/docs/authentication/overview#login-with-username\n /\n loginWithUsername?: boolean \| LoginWithUsernameOptions\n /\n Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n /\n maxLoginAttempts?: number\n /*\n Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n /\n removeTokenFromResponses?: true\n /\n Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n * @link https://payloadcms.com/docs/authentication/custom-strategies\n /\n strategies?: AuthStrategy[]\n /\n Controls how many seconds the token will be valid for. Default is 2 hours.\n * @default 7200\n * @link https://payloadcms.com/docs/authentication/overview#config-options\n /\n tokenExpiration?: number\n /\n Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n * @default false\n * @link https://payloadcms.com/docs/authentication/api-keys\n /\n useAPIKey?: boolean\n\n /\n Use sessions for authentication. Enabled by default.\n * @default true\n /\n useSessions?: boolean\n\n /\n Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n * @link https://payloadcms.com/docs/authentication/email#email-verification\n */\n verify?:\n \| {\n generateEmailHTML?: GenerateVerifyEmailHTML\n generateEmailSubject?: GenerateVerifyEmailSubject\n }\n \| boolean\n}\n\nexport type VerifyConfig = {\n generateEmailHTML?: GenerateVerifyEmailHTML\n generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n extends Omit<DeepRequired<IncomingAuthType>, 'forgotPassword' \| 'loginWithUsername' \| 'verify'> {\n forgotPassword?: {\n expiration?: number\n generateEmailHTML?: GenerateForgotPasswordEmailHTML\n generateEmailSubject?: GenerateForgotPasswordEmailSubject\n }\n loginWithUsername: false \| LoginWithUsernameOptions\n verify?: boolean \| VerifyConfig\n}\n\nexport function hasWhereAccessResult(result: boolean \| Where): result is Where {\n return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"~~AAmUA~~,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}
1	+ {"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { DeepRequired } from 'ts-essentials'\n\nimport type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/*\n A permission object that can be used to determine if a user has access to a specific operation.\n /\nexport type Permission = {\n permission: boolean\n where?: Where\n}\n\nexport type FieldsPermissions = {\n [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n create: Permission\n fields: FieldsPermissions\n read: Permission\n update: Permission\n}\n\nexport type SanitizedBlockPermissions =\n \| {\n fields: SanitizedFieldsPermissions\n }\n \| true\n\nexport type BlocksPermissions = {\n [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n \| {\n [blockSlug: string]: SanitizedBlockPermissions\n }\n \| true\n\nexport type FieldPermissions = {\n blocks?: BlocksPermissions\n create?: Permission\n fields?: FieldsPermissions\n read?: Permission\n update?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n \| {\n blocks?: SanitizedBlocksPermissions\n create: true\n fields?: SanitizedFieldsPermissions\n read: true\n update: true\n }\n \| true\n\nexport type SanitizedFieldsPermissions =\n \| {\n [fieldName: string]: SanitizedFieldPermissions\n }\n \| true\n\nexport type CollectionPermission = {\n create?: Permission\n delete?: Permission\n fields: FieldsPermissions\n read?: Permission\n readVersions?: Permission\n // Auth-enabled Collections only\n unlock?: Permission\n update?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n create?: true\n delete?: true\n fields: SanitizedFieldsPermissions\n read?: true\n readVersions?: true\n // Auth-enabled Collections only\n unlock?: true\n update?: true\n}\n\nexport type GlobalPermission = {\n fields: FieldsPermissions\n read?: Permission\n readVersions?: Permission\n update?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n fields: SanitizedFieldsPermissions\n read?: true\n readVersions?: true\n update?: true\n}\n\nexport type DocumentPermissions = CollectionPermission \| GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission \| SanitizedGlobalPermission\n\nexport type Permissions = {\n canAccessAdmin: boolean\n collections?: Record<CollectionSlug, CollectionPermission>\n globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n canAccessAdmin?: boolean\n collections?: {\n [collectionSlug: string]: SanitizedCollectionPermission\n }\n globals?: {\n [globalSlug: string]: SanitizedGlobalPermission\n }\n}\n\n/\n Fields injected onto a user at authentication time. They are never stored in the database and\n * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated\n * user (`req.user`, login/auth/me results, auth strategies).\n /\nexport type AuthRuntimeFields = {\n /\n The session ID of the current request. May be present on request-authenticated users when\n * sessions are enabled.\n /\n _sid?: string\n /\n The name of the auth strategy that authenticated the request (e.g. `local-jwt`).\n /\n _strategy?: string\n}\n\n/\n Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).\n * Stripping it cleanly isn't possible, because auth operations build the authenticated user\n * from a read `User` doc, so a `never`-typed `password` would break those assignments\n /\n/\n The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`). This is\n * what `req.user`, `payload.auth()`, the `me` operation, auth strategies, and `useAuth().user`\n * return.\n /\nexport type AuthenticatedUser = AuthRuntimeFields & User\n\nexport type UserSession = {\n createdAt?: Date \| null \| string\n expiresAt: Date \| string\n id: string\n}\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n req: PayloadRequest\n token: string\n user: TUser\n}) => Promise<string> \| string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n req: PayloadRequest\n token: string\n user: TUser\n}) => Promise<string> \| string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n req?: PayloadRequest\n token?: string\n user?: TUser\n}) => Promise<string> \| string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n req?: PayloadRequest\n token?: string\n user?: TUser\n}) => Promise<string> \| string\n\nexport type AuthStrategyFunctionArgs = {\n /\n Specifies whether or not response headers can be set from this strategy.\n /\n canSetHeaders?: boolean\n headers: Request['headers']\n isGraphQL?: boolean\n payload: Payload\n /\n The AuthStrategy name property from the payload config.\n /\n strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n responseHeaders?: Headers\n user: AuthenticatedUser \| null\n}\n\nexport type AuthStrategyFunction = (\n args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult \| Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n authenticate: AuthStrategyFunction\n name: string\n}\n\nexport type LoginWithUsernameOptions =\n \| {\n allowEmailLogin?: false\n requireEmail?: boolean\n // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n requireUsername?: true\n }\n \| {\n allowEmailLogin?: true\n requireEmail?: boolean\n requireUsername?: boolean\n }\n\nexport interface IncomingAuthType {\n /\n Set cookie options, including secure, sameSite, and domain. For advanced users.\n /\n cookies?: {\n domain?: string\n sameSite?: 'Lax' \| 'None' \| 'Strict' \| boolean\n secure?: boolean\n }\n /\n How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n * @default 0\n /\n depth?: number\n /\n Advanced - disable Payload's built-in local auth strategy. Only use this property if you have replaced Payload's auth mechanisms with your own.\n /\n disableLocalStrategy?:\n \| {\n /\n Include auth fields on the collection even though the local strategy is disabled.\n * Useful when you do not want the database or types to vary depending on the auth configuration.\n /\n enableFields?: true\n optionalPassword?: true\n }\n \| true\n /\n Customize the way that the forgotPassword operation functions.\n * @link https://payloadcms.com/docs/authentication/email#forgot-password\n /\n forgotPassword?: {\n /\n The number of milliseconds that the forgot password token should be valid for.\n * @default 3600000 // 1 hour\n /\n expiration?: number\n generateEmailHTML?: GenerateForgotPasswordEmailHTML\n generateEmailSubject?: GenerateForgotPasswordEmailSubject\n }\n /\n Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n /\n lockTime?: number\n /\n Ability to allow users to login with username/password.\n \n @link https://payloadcms.com/docs/authentication/overview#login-with-username\n /\n loginWithUsername?: boolean \| LoginWithUsernameOptions\n /\n Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n /\n maxLoginAttempts?: number\n /*\n Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n /\n removeTokenFromResponses?: true\n /\n Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n * @link https://payloadcms.com/docs/authentication/custom-strategies\n /\n strategies?: AuthStrategy[]\n /\n Controls how many seconds the token will be valid for. Default is 2 hours.\n * @default 7200\n * @link https://payloadcms.com/docs/authentication/overview#config-options\n /\n tokenExpiration?: number\n /\n Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n * @default false\n * @link https://payloadcms.com/docs/authentication/api-keys\n /\n useAPIKey?: boolean\n\n /\n Use sessions for authentication. Enabled by default.\n * @default true\n /\n useSessions?: boolean\n\n /\n Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n * @link https://payloadcms.com/docs/authentication/email#email-verification\n */\n verify?:\n \| {\n generateEmailHTML?: GenerateVerifyEmailHTML\n generateEmailSubject?: GenerateVerifyEmailSubject\n }\n \| boolean\n}\n\nexport type VerifyConfig = {\n generateEmailHTML?: GenerateVerifyEmailHTML\n generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n extends Omit<DeepRequired<IncomingAuthType>, 'forgotPassword' \| 'loginWithUsername' \| 'verify'> {\n forgotPassword?: {\n expiration?: number\n generateEmailHTML?: GenerateForgotPasswordEmailHTML\n generateEmailSubject?: GenerateForgotPasswordEmailSubject\n }\n loginWithUsername: false \| LoginWithUsernameOptions\n verify?: boolean \| VerifyConfig\n}\n\nexport function hasWhereAccessResult(result: boolean \| Where): result is Where {\n return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"AAwUA,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}