payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ea6e8f8

package/dist/auth/serverFunctions/cookies.d.ts

@@ -0,0 +1,47 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { Auth } from '../types.js';
+/**
+ * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`
+ * when `returnCookieAsObject` is `true`.
+ */
+export type GeneratedCookie = {
+    domain?: string;
+    expires?: string;
+    httpOnly?: boolean;
+    maxAge?: number;
+    name: string;
+    path?: string;
+    sameSite?: 'Lax' | 'None' | 'Strict';
+    secure?: boolean;
+    value: string | undefined;
+};
+type AuthCookieArgs = {
+    authConfig: Auth;
+    cookiePrefix: string;
+    serverAdapter: ServerAdapter;
+};
+/** Writes an already-generated cookie through the framework's cookie API. */
+export declare function applyAuthCookie({ cookie, serverAdapter, }: {
+    cookie: GeneratedCookie;
+    serverAdapter: ServerAdapter;
+}): Promise<void>;
+/** Writes the Payload auth cookie for `token` through the framework's cookie API. */
+export declare function setAuthCookie({ authConfig, cookiePrefix, serverAdapter, token, }: {
+    token: string;
+} & AuthCookieArgs): Promise<void>;
+/**
+ * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`
+ * attributes it was set with — a mismatched `domain` leaves the original cookie
+ * in place.
+ */
+export declare function clearAuthCookie({ authConfig, cookiePrefix, serverAdapter, }: AuthCookieArgs): Promise<void>;
+/** Reads the request's existing Payload auth cookie, if any. */
+export declare function getExistingAuthToken({ cookiePrefix, serverAdapter, }: {
+    cookiePrefix: string;
+    serverAdapter: ServerAdapter;
+}): Promise<{
+    name: string;
+    value: string;
+} | undefined>;
+export {};
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/serverFunctions/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAIvC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAcD,KAAK,cAAc,GAAG;IACpB,UAAU,EAAE,IAAI,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,aAAa,GACd,EAAE;IACD,MAAM,EAAE,eAAe,CAAA;IACvB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,YAAY,EACZ,aAAa,EACb,KAAK,GACN,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CASpD;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,YAAY,EACZ,aAAa,GACd,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhC;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CAAC,EACzC,YAAY,EACZ,aAAa,GACd,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CASvD"}

package/dist/auth/serverFunctions/cookies.js

@@ -0,0 +1,52 @@
+import { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js';
+// `generateCookie` emits capitalized `SameSite` values (as they appear in the
+// header); `CookieOptions` takes the lowercase form.
+const toCookieOptions = (cookie)=>({
+        domain: cookie.domain,
+        expires: cookie.expires ? new Date(cookie.expires) : undefined,
+        httpOnly: cookie.httpOnly,
+        maxAge: cookie.maxAge,
+        path: cookie.path,
+        sameSite: cookie.sameSite?.toLowerCase(),
+        secure: cookie.secure
+    });
+/** Writes an already-generated cookie through the framework's cookie API. */ export async function applyAuthCookie({ cookie, serverAdapter }) {
+    if (!cookie.value) {
+        return;
+    }
+    await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie));
+}
+/** Writes the Payload auth cookie for `token` through the framework's cookie API. */ export async function setAuthCookie({ authConfig, cookiePrefix, serverAdapter, token }) {
+    const cookie = generatePayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        returnCookieAsObject: true,
+        token
+    });
+    await applyAuthCookie({
+        cookie,
+        serverAdapter
+    });
+}
+/**
+ * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`
+ * attributes it was set with — a mismatched `domain` leaves the original cookie
+ * in place.
+ */ export async function clearAuthCookie({ authConfig, cookiePrefix, serverAdapter }) {
+    const cookie = generateExpiredPayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        returnCookieAsObject: true
+    });
+    await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie));
+}
+/** Reads the request's existing Payload auth cookie, if any. */ export async function getExistingAuthToken({ cookiePrefix, serverAdapter }) {
+    const store = await serverAdapter.getCookies();
+    const allCookies = store.getAll?.();
+    if (allCookies) {
+        return allCookies.find((cookie)=>cookie.name.startsWith(cookiePrefix));
+    }
+    return store.get(`${cookiePrefix}-token`) ?? undefined;
+}
+
+//# sourceMappingURL=cookies.js.map

package/dist/auth/serverFunctions/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/cookies.ts"],"sourcesContent":["import type { CookieOptions } from '../../admin/adapters/cookies.js'\nimport type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { Auth } from '../types.js'\n\nimport { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js'\n\n/**\n * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`\n * when `returnCookieAsObject` is `true`.\n */\nexport type GeneratedCookie = {\n  domain?: string\n  expires?: string\n  httpOnly?: boolean\n  maxAge?: number\n  name: string\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n  value: string | undefined\n}\n\n// `generateCookie` emits capitalized `SameSite` values (as they appear in the\n// header); `CookieOptions` takes the lowercase form.\nconst toCookieOptions = (cookie: GeneratedCookie): CookieOptions => ({\n  domain: cookie.domain,\n  expires: cookie.expires ? new Date(cookie.expires) : undefined,\n  httpOnly: cookie.httpOnly,\n  maxAge: cookie.maxAge,\n  path: cookie.path,\n  sameSite: cookie.sameSite?.toLowerCase() as CookieOptions['sameSite'],\n  secure: cookie.secure,\n})\n\ntype AuthCookieArgs = {\n  authConfig: Auth\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}\n\n/** Writes an already-generated cookie through the framework's cookie API. */\nexport async function applyAuthCookie({\n  cookie,\n  serverAdapter,\n}: {\n  cookie: GeneratedCookie\n  serverAdapter: ServerAdapter\n}): Promise<void> {\n  if (!cookie.value) {\n    return\n  }\n\n  await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie))\n}\n\n/** Writes the Payload auth cookie for `token` through the framework's cookie API. */\nexport async function setAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n  token,\n}: { token: string } & AuthCookieArgs): Promise<void> {\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n    token,\n  }) as GeneratedCookie\n\n  await applyAuthCookie({ cookie, serverAdapter })\n}\n\n/**\n * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`\n * attributes it was set with — a mismatched `domain` leaves the original cookie\n * in place.\n */\nexport async function clearAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n}: AuthCookieArgs): Promise<void> {\n  const cookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n  }) as GeneratedCookie\n\n  await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie))\n}\n\n/** Reads the request's existing Payload auth cookie, if any. */\nexport async function getExistingAuthToken({\n  cookiePrefix,\n  serverAdapter,\n}: {\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}): Promise<{ name: string; value: string } | undefined> {\n  const store = await serverAdapter.getCookies()\n  const allCookies = store.getAll?.()\n\n  if (allCookies) {\n    return allCookies.find((cookie) => cookie.name.startsWith(cookiePrefix))\n  }\n\n  return store.get(`${cookiePrefix}-token`) ?? undefined\n}\n"],"names":["generateExpiredPayloadCookie","generatePayloadCookie","toCookieOptions","cookie","domain","expires","Date","undefined","httpOnly","maxAge","path","sameSite","toLowerCase","secure","applyAuthCookie","serverAdapter","value","setCookie","name","setAuthCookie","authConfig","cookiePrefix","token","collectionAuthConfig","returnCookieAsObject","clearAuthCookie","getExistingAuthToken","store","getCookies","allCookies","getAll","find","startsWith","get"],"mappings":"AAIA,SAASA,4BAA4B,EAAEC,qBAAqB,QAAQ,gBAAe;AAkBnF,8EAA8E;AAC9E,qDAAqD;AACrD,MAAMC,kBAAkB,CAACC,SAA4C,CAAA;QACnEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO,GAAG,IAAIC,KAAKH,OAAOE,OAAO,IAAIE;QACrDC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,MAAMP,OAAOO,IAAI;QACjBC,UAAUR,OAAOQ,QAAQ,EAAEC;QAC3BC,QAAQV,OAAOU,MAAM;IACvB,CAAA;AAQA,2EAA2E,GAC3E,OAAO,eAAeC,gBAAgB,EACpCX,MAAM,EACNY,aAAa,EAId;IACC,IAAI,CAACZ,OAAOa,KAAK,EAAE;QACjB;IACF;IAEA,MAAMD,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAEf,OAAOa,KAAK,EAAEd,gBAAgBC;AAC3E;AAEA,mFAAmF,GACnF,OAAO,eAAegB,cAAc,EAClCC,UAAU,EACVC,YAAY,EACZN,aAAa,EACbO,KAAK,EAC8B;IACnC,MAAMnB,SAASF,sBAAsB;QACnCsB,sBAAsBH;QACtBC;QACAG,sBAAsB;QACtBF;IACF;IAEA,MAAMR,gBAAgB;QAAEX;QAAQY;IAAc;AAChD;AAEA;;;;CAIC,GACD,OAAO,eAAeU,gBAAgB,EACpCL,UAAU,EACVC,YAAY,EACZN,aAAa,EACE;IACf,MAAMZ,SAASH,6BAA6B;QAC1CuB,sBAAsBH;QACtBC;QACAG,sBAAsB;IACxB;IAEA,MAAMT,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAE,IAAIhB,gBAAgBC;AACjE;AAEA,8DAA8D,GAC9D,OAAO,eAAeuB,qBAAqB,EACzCL,YAAY,EACZN,aAAa,EAId;IACC,MAAMY,QAAQ,MAAMZ,cAAca,UAAU;IAC5C,MAAMC,aAAaF,MAAMG,MAAM;IAE/B,IAAID,YAAY;QACd,OAAOA,WAAWE,IAAI,CAAC,CAAC5B,SAAWA,OAAOe,IAAI,CAACc,UAAU,CAACX;IAC5D;IAEA,OAAOM,MAAMM,GAAG,CAAC,GAAGZ,aAAa,MAAM,CAAC,KAAKd;AAC/C"}

package/dist/auth/serverFunctions/login.d.ts

@@ -0,0 +1,29 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { AuthCollectionSlug } from '../../index.js';
+import type { MaybePromise } from '../../types/index.js';
+import type { LoginResult } from '../operations/login.js';
+export type LoginArgs<TSlug extends AuthCollectionSlug> = {
+    collection: TSlug;
+    config: MaybePromise<SanitizedConfig>;
+    password: string;
+    serverAdapter: ServerAdapter;
+} & ({
+    email: string;
+    username?: never;
+} | {
+    email?: never;
+    username: string;
+});
+/**
+ * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.
+ * Distributes over the email/username union so the either-or survives; a plain
+ * `Omit` collapses the union and accepts both keys at once.
+ */
+export type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> = LoginArgs<TSlug> extends infer TArgs ? TArgs extends unknown ? Omit<TArgs, 'serverAdapter'> : never : never;
+/**
+ * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,
+ * so the function is framework-agnostic; each adapter binds its own.
+ */
+export declare function login<TSlug extends AuthCollectionSlug>({ collection, config, email, password, serverAdapter, username, }: LoginArgs<TSlug>): Promise<LoginResult<TSlug>>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/serverFunctions/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAOzD,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,KAAK,CAAA;IACjB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAE/E;;;;GAIG;AACH,MAAM,MAAM,6BAA6B,CAAC,KAAK,SAAS,kBAAkB,IACxE,SAAS,CAAC,KAAK,CAAC,SAAS,MAAM,KAAK,GAChC,KAAK,SAAS,OAAO,GACnB,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,GAC5B,KAAK,GACP,KAAK,CAAA;AAEX;;;GAGG;AACH,wBAAsB,KAAK,CAAC,KAAK,SAAS,kBAAkB,EAAE,EAC5D,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,EACR,aAAa,EACb,QAAQ,GACT,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAgDhD"}

package/dist/auth/serverFunctions/login.js

@@ -0,0 +1,65 @@
+import { getPayload } from '../../index.js';
+import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
+import { loginWithCookie } from '../loginWithCookie.js';
+import { applyAuthCookie } from './cookies.js';
+/**
+ * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,
+ * so the function is framework-agnostic; each adapter binds its own.
+ */ export async function login({ collection, config, email, password, serverAdapter, username }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const authConfig = payload.collections[collection]?.config.auth;
+    if (!authConfig) {
+        throw new Error(`No auth config found for collection: ${collection}`);
+    }
+    const loginWithUsername = authConfig.loginWithUsername ?? false;
+    if (loginWithUsername) {
+        if (loginWithUsername.allowEmailLogin) {
+            if (!email && !username) {
+                throw new Error('Email or username is required.');
+            }
+        } else {
+            if (!username) {
+                throw new Error('Username is required.');
+            }
+        }
+    } else {
+        if (!email) {
+            throw new Error('Email is required.');
+        }
+    }
+    let loginData;
+    if (loginWithUsername) {
+        loginData = username ? {
+            password,
+            username
+        } : {
+            email,
+            password
+        };
+    } else {
+        loginData = {
+            email,
+            password
+        };
+    }
+    const collectionConfig = payload.collections[collection];
+    const { cookie, result } = await loginWithCookie({
+        collection: collectionConfig,
+        data: loginData,
+        overrideAccess: true,
+        req: await createPayloadRequest({
+            payload
+        }),
+        returnCookieAsObject: true
+    });
+    await applyAuthCookie({
+        cookie,
+        serverAdapter
+    });
+    return result;
+}
+
+//# sourceMappingURL=login.js.map

package/dist/auth/serverFunctions/login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/login.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\nimport type { LoginResult } from '../operations/login.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\nimport { applyAuthCookie } from './cookies.js'\n\nexport type LoginArgs<TSlug extends AuthCollectionSlug> = {\n  collection: TSlug\n  config: MaybePromise<SanitizedConfig>\n  password: string\n  serverAdapter: ServerAdapter\n} & ({ email: string; username?: never } | { email?: never; username: string })\n\n/**\n * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.\n * Distributes over the email/username union so the either-or survives; a plain\n * `Omit` collapses the union and accepts both keys at once.\n */\nexport type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> =\n  LoginArgs<TSlug> extends infer TArgs\n    ? TArgs extends unknown\n      ? Omit<TArgs, 'serverAdapter'>\n      : never\n    : never\n\n/**\n * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,\n * so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function login<TSlug extends AuthCollectionSlug>({\n  collection,\n  config,\n  email,\n  password,\n  serverAdapter,\n  username,\n}: LoginArgs<TSlug>): Promise<LoginResult<TSlug>> {\n  const payload = await getPayload({ config, cron: true })\n\n  const authConfig = payload.collections[collection]?.config.auth\n\n  if (!authConfig) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const loginWithUsername = authConfig.loginWithUsername ?? false\n\n  if (loginWithUsername) {\n    if (loginWithUsername.allowEmailLogin) {\n      if (!email && !username) {\n        throw new Error('Email or username is required.')\n      }\n    } else {\n      if (!username) {\n        throw new Error('Username is required.')\n      }\n    }\n  } else {\n    if (!email) {\n      throw new Error('Email is required.')\n    }\n  }\n\n  let loginData\n\n  if (loginWithUsername) {\n    loginData = username ? { password, username } : { email, password }\n  } else {\n    loginData = { email, password }\n  }\n\n  const collectionConfig = payload.collections[collection]!\n\n  const { cookie, result } = await loginWithCookie({\n    collection: collectionConfig,\n    data: loginData as Parameters<typeof loginWithCookie>[0]['data'],\n    overrideAccess: true,\n    req: await createPayloadRequest({ payload }),\n    returnCookieAsObject: true,\n  })\n\n  await applyAuthCookie({ cookie, serverAdapter })\n\n  return result as LoginResult<TSlug>\n}\n"],"names":["getPayload","createPayloadRequest","loginWithCookie","applyAuthCookie","login","collection","config","email","password","serverAdapter","username","payload","cron","authConfig","collections","auth","Error","loginWithUsername","allowEmailLogin","loginData","collectionConfig","cookie","result","data","overrideAccess","req","returnCookieAsObject"],"mappings":"AAMA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,eAAc;AAqB9C;;;CAGC,GACD,OAAO,eAAeC,MAAwC,EAC5DC,UAAU,EACVC,MAAM,EACNC,KAAK,EACLC,QAAQ,EACRC,aAAa,EACbC,QAAQ,EACS;IACjB,MAAMC,UAAU,MAAMX,WAAW;QAAEM;QAAQM,MAAM;IAAK;IAEtD,MAAMC,aAAaF,QAAQG,WAAW,CAACT,WAAW,EAAEC,OAAOS;IAE3D,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM,CAAC,qCAAqC,EAAEX,YAAY;IACtE;IAEA,MAAMY,oBAAoBJ,WAAWI,iBAAiB,IAAI;IAE1D,IAAIA,mBAAmB;QACrB,IAAIA,kBAAkBC,eAAe,EAAE;YACrC,IAAI,CAACX,SAAS,CAACG,UAAU;gBACvB,MAAM,IAAIM,MAAM;YAClB;QACF,OAAO;YACL,IAAI,CAACN,UAAU;gBACb,MAAM,IAAIM,MAAM;YAClB;QACF;IACF,OAAO;QACL,IAAI,CAACT,OAAO;YACV,MAAM,IAAIS,MAAM;QAClB;IACF;IAEA,IAAIG;IAEJ,IAAIF,mBAAmB;QACrBE,YAAYT,WAAW;YAAEF;YAAUE;QAAS,IAAI;YAAEH;YAAOC;QAAS;IACpE,OAAO;QACLW,YAAY;YAAEZ;YAAOC;QAAS;IAChC;IAEA,MAAMY,mBAAmBT,QAAQG,WAAW,CAACT,WAAW;IAExD,MAAM,EAAEgB,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMpB,gBAAgB;QAC/CG,YAAYe;QACZG,MAAMJ;QACNK,gBAAgB;QAChBC,KAAK,MAAMxB,qBAAqB;YAAEU;QAAQ;QAC1Ce,sBAAsB;IACxB;IAEA,MAAMvB,gBAAgB;QAAEkB;QAAQZ;IAAc;IAE9C,OAAOa;AACT"}

package/dist/auth/serverFunctions/logout.d.ts

@@ -0,0 +1,17 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { MaybePromise } from '../../types/index.js';
+export type LogoutArgs = {
+    allSessions?: boolean;
+    config: MaybePromise<SanitizedConfig>;
+    serverAdapter: ServerAdapter;
+};
+/**
+ * Logs the current user out and expires the auth cookie through the supplied
+ * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.
+ */
+export declare function logout({ allSessions, config, serverAdapter, }: LogoutArgs): Promise<{
+    message: string;
+    success: boolean;
+}>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/auth/serverFunctions/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAOxD,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,EAC3B,WAAmB,EACnB,MAAM,EACN,aAAa,GACd,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC7D"}

package/dist/auth/serverFunctions/logout.js

@@ -0,0 +1,59 @@
+import { getPayload } from '../../index.js';
+import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
+import { logoutOperation } from '../operations/logout.js';
+import { clearAuthCookie } from './cookies.js';
+/**
+ * Logs the current user out and expires the auth cookie through the supplied
+ * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.
+ */ export async function logout({ allSessions = false, config, serverAdapter }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const headers = await serverAdapter.getHeaders();
+    const authResult = await payload.auth({
+        headers
+    });
+    if (!authResult.user) {
+        return {
+            message: 'User already logged out',
+            success: true
+        };
+    }
+    const { user } = authResult;
+    const req = await createPayloadRequest({
+        payload,
+        user
+    });
+    const collection = payload.collections[user.collection];
+    if (!collection) {
+        return {
+            message: 'Collection not found',
+            success: false
+        };
+    }
+    const logoutResult = await logoutOperation({
+        allSessions,
+        collection,
+        req
+    });
+    if (!logoutResult) {
+        return {
+            message: 'Logout failed',
+            success: false
+        };
+    }
+    if (collection.config.auth) {
+        await clearAuthCookie({
+            authConfig: collection.config.auth,
+            cookiePrefix: payload.config.cookiePrefix,
+            serverAdapter
+        });
+    }
+    return {
+        message: 'User logged out successfully',
+        success: true
+    };
+}
+
+//# sourceMappingURL=logout.js.map

package/dist/auth/serverFunctions/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/logout.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { MaybePromise } from '../../types/index.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { logoutOperation } from '../operations/logout.js'\nimport { clearAuthCookie } from './cookies.js'\n\nexport type LogoutArgs = {\n  allSessions?: boolean\n  config: MaybePromise<SanitizedConfig>\n  serverAdapter: ServerAdapter\n}\n\n/**\n * Logs the current user out and expires the auth cookie through the supplied\n * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function logout({\n  allSessions = false,\n  config,\n  serverAdapter,\n}: LogoutArgs): Promise<{ message: string; success: boolean }> {\n  const payload = await getPayload({ config, cron: true })\n  const headers = await serverAdapter.getHeaders()\n  const authResult = await payload.auth({ headers })\n\n  if (!authResult.user) {\n    return { message: 'User already logged out', success: true }\n  }\n\n  const { user } = authResult\n  const req = await createPayloadRequest({ payload, user })\n  const collection = payload.collections[user.collection]\n\n  if (!collection) {\n    return { message: 'Collection not found', success: false }\n  }\n\n  const logoutResult = await logoutOperation({\n    allSessions,\n    collection,\n    req,\n  })\n\n  if (!logoutResult) {\n    return { message: 'Logout failed', success: false }\n  }\n\n  if (collection.config.auth) {\n    await clearAuthCookie({\n      authConfig: collection.config.auth,\n      cookiePrefix: payload.config.cookiePrefix,\n      serverAdapter,\n    })\n  }\n\n  return { message: 'User logged out successfully', success: true }\n}\n"],"names":["getPayload","createPayloadRequest","logoutOperation","clearAuthCookie","logout","allSessions","config","serverAdapter","payload","cron","headers","getHeaders","authResult","auth","user","message","success","req","collection","collections","logoutResult","authConfig","cookiePrefix"],"mappings":"AAIA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,eAAe,QAAQ,0BAAyB;AACzD,SAASC,eAAe,QAAQ,eAAc;AAQ9C;;;CAGC,GACD,OAAO,eAAeC,OAAO,EAC3BC,cAAc,KAAK,EACnBC,MAAM,EACNC,aAAa,EACF;IACX,MAAMC,UAAU,MAAMR,WAAW;QAAEM;QAAQG,MAAM;IAAK;IACtD,MAAMC,UAAU,MAAMH,cAAcI,UAAU;IAC9C,MAAMC,aAAa,MAAMJ,QAAQK,IAAI,CAAC;QAAEH;IAAQ;IAEhD,IAAI,CAACE,WAAWE,IAAI,EAAE;QACpB,OAAO;YAAEC,SAAS;YAA2BC,SAAS;QAAK;IAC7D;IAEA,MAAM,EAAEF,IAAI,EAAE,GAAGF;IACjB,MAAMK,MAAM,MAAMhB,qBAAqB;QAAEO;QAASM;IAAK;IACvD,MAAMI,aAAaV,QAAQW,WAAW,CAACL,KAAKI,UAAU,CAAC;IAEvD,IAAI,CAACA,YAAY;QACf,OAAO;YAAEH,SAAS;YAAwBC,SAAS;QAAM;IAC3D;IAEA,MAAMI,eAAe,MAAMlB,gBAAgB;QACzCG;QACAa;QACAD;IACF;IAEA,IAAI,CAACG,cAAc;QACjB,OAAO;YAAEL,SAAS;YAAiBC,SAAS;QAAM;IACpD;IAEA,IAAIE,WAAWZ,MAAM,CAACO,IAAI,EAAE;QAC1B,MAAMV,gBAAgB;YACpBkB,YAAYH,WAAWZ,MAAM,CAACO,IAAI;YAClCS,cAAcd,QAAQF,MAAM,CAACgB,YAAY;YACzCf;QACF;IACF;IAEA,OAAO;QAAEQ,SAAS;QAAgCC,SAAS;IAAK;AAClE"}

package/dist/auth/serverFunctions/refresh.d.ts

@@ -0,0 +1,17 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { MaybePromise } from '../../types/index.js';
+export type RefreshArgs = {
+    config: MaybePromise<SanitizedConfig>;
+    serverAdapter: ServerAdapter;
+};
+/**
+ * Refreshes the current user's auth token and rewrites the cookie through the
+ * supplied `serverAdapter`, so the function is framework-agnostic; each adapter
+ * binds its own.
+ */
+export declare function refresh({ config, serverAdapter, }: RefreshArgs): Promise<{
+    message: string;
+    success: boolean;
+}>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/auth/serverFunctions/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAOxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,aAAa,GACd,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4C9D"}

package/dist/auth/serverFunctions/refresh.js

@@ -0,0 +1,62 @@
+import { getPayload } from '../../index.js';
+import { createPayloadRequest } from '../../utilities/createPayloadRequest.js';
+import { refreshOperation } from '../operations/refresh.js';
+import { getExistingAuthToken, setAuthCookie } from './cookies.js';
+/**
+ * Refreshes the current user's auth token and rewrites the cookie through the
+ * supplied `serverAdapter`, so the function is framework-agnostic; each adapter
+ * binds its own.
+ */ export async function refresh({ config, serverAdapter }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const headers = await serverAdapter.getHeaders();
+    const result = await payload.auth({
+        headers
+    });
+    if (!result.user) {
+        throw new Error('Cannot refresh token: user not authenticated');
+    }
+    const existingCookie = await getExistingAuthToken({
+        cookiePrefix: payload.config.cookiePrefix,
+        serverAdapter
+    });
+    if (!existingCookie) {
+        return {
+            message: 'No valid token found to refresh',
+            success: false
+        };
+    }
+    const collection = result.user.collection;
+    const collectionConfig = payload.collections[collection];
+    if (!collectionConfig?.config.auth) {
+        throw new Error(`No auth config found for collection: ${collection}`);
+    }
+    const req = await createPayloadRequest({
+        payload,
+        user: result.user
+    });
+    const refreshResult = await refreshOperation({
+        collection: collectionConfig,
+        req
+    });
+    if (!refreshResult) {
+        return {
+            message: 'Token refresh failed',
+            success: false
+        };
+    }
+    await setAuthCookie({
+        authConfig: collectionConfig.config.auth,
+        cookiePrefix: payload.config.cookiePrefix,
+        serverAdapter,
+        token: refreshResult.refreshedToken
+    });
+    return {
+        message: 'Token refreshed successfully',
+        success: true
+    };
+}
+
+//# sourceMappingURL=refresh.js.map

package/dist/auth/serverFunctions/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/refresh.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { CollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { refreshOperation } from '../operations/refresh.js'\nimport { getExistingAuthToken, setAuthCookie } from './cookies.js'\n\nexport type RefreshArgs = {\n  config: MaybePromise<SanitizedConfig>\n  serverAdapter: ServerAdapter\n}\n\n/**\n * Refreshes the current user's auth token and rewrites the cookie through the\n * supplied `serverAdapter`, so the function is framework-agnostic; each adapter\n * binds its own.\n */\nexport async function refresh({\n  config,\n  serverAdapter,\n}: RefreshArgs): Promise<{ message: string; success: boolean }> {\n  const payload = await getPayload({ config, cron: true })\n  const headers = await serverAdapter.getHeaders()\n  const result = await payload.auth({ headers })\n\n  if (!result.user) {\n    throw new Error('Cannot refresh token: user not authenticated')\n  }\n\n  const existingCookie = await getExistingAuthToken({\n    cookiePrefix: payload.config.cookiePrefix,\n    serverAdapter,\n  })\n\n  if (!existingCookie) {\n    return { message: 'No valid token found to refresh', success: false }\n  }\n\n  const collection: CollectionSlug | undefined = result.user.collection\n  const collectionConfig = payload.collections[collection]\n\n  if (!collectionConfig?.config.auth) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const req = await createPayloadRequest({ payload, user: result.user })\n\n  const refreshResult = await refreshOperation({\n    collection: collectionConfig,\n    req,\n  })\n\n  if (!refreshResult) {\n    return { message: 'Token refresh failed', success: false }\n  }\n\n  await setAuthCookie({\n    authConfig: collectionConfig.config.auth,\n    cookiePrefix: payload.config.cookiePrefix,\n    serverAdapter,\n    token: refreshResult.refreshedToken,\n  })\n\n  return { message: 'Token refreshed successfully', success: true }\n}\n"],"names":["getPayload","createPayloadRequest","refreshOperation","getExistingAuthToken","setAuthCookie","refresh","config","serverAdapter","payload","cron","headers","getHeaders","result","auth","user","Error","existingCookie","cookiePrefix","message","success","collection","collectionConfig","collections","req","refreshResult","authConfig","token","refreshedToken"],"mappings":"AAKA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,gBAAgB,QAAQ,2BAA0B;AAC3D,SAASC,oBAAoB,EAAEC,aAAa,QAAQ,eAAc;AAOlE;;;;CAIC,GACD,OAAO,eAAeC,QAAQ,EAC5BC,MAAM,EACNC,aAAa,EACD;IACZ,MAAMC,UAAU,MAAMR,WAAW;QAAEM;QAAQG,MAAM;IAAK;IACtD,MAAMC,UAAU,MAAMH,cAAcI,UAAU;IAC9C,MAAMC,SAAS,MAAMJ,QAAQK,IAAI,CAAC;QAAEH;IAAQ;IAE5C,IAAI,CAACE,OAAOE,IAAI,EAAE;QAChB,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,iBAAiB,MAAMb,qBAAqB;QAChDc,cAAcT,QAAQF,MAAM,CAACW,YAAY;QACzCV;IACF;IAEA,IAAI,CAACS,gBAAgB;QACnB,OAAO;YAAEE,SAAS;YAAmCC,SAAS;QAAM;IACtE;IAEA,MAAMC,aAAyCR,OAAOE,IAAI,CAACM,UAAU;IACrE,MAAMC,mBAAmBb,QAAQc,WAAW,CAACF,WAAW;IAExD,IAAI,CAACC,kBAAkBf,OAAOO,MAAM;QAClC,MAAM,IAAIE,MAAM,CAAC,qCAAqC,EAAEK,YAAY;IACtE;IAEA,MAAMG,MAAM,MAAMtB,qBAAqB;QAAEO;QAASM,MAAMF,OAAOE,IAAI;IAAC;IAEpE,MAAMU,gBAAgB,MAAMtB,iBAAiB;QAC3CkB,YAAYC;QACZE;IACF;IAEA,IAAI,CAACC,eAAe;QAClB,OAAO;YAAEN,SAAS;YAAwBC,SAAS;QAAM;IAC3D;IAEA,MAAMf,cAAc;QAClBqB,YAAYJ,iBAAiBf,MAAM,CAACO,IAAI;QACxCI,cAAcT,QAAQF,MAAM,CAACW,YAAY;QACzCV;QACAmB,OAAOF,cAAcG,cAAc;IACrC;IAEA,OAAO;QAAET,SAAS;QAAgCC,SAAS;IAAK;AAClE"}

package/dist/auth/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8CAK1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAqC3B,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAWf,CAAA"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8CAK1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAuC3B,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAaf,CAAA"}

package/dist/auth/sessions.js

@@ -1,4 +1,5 @@
 import { v4 as uuid } from 'uuid';
+import { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js';
 /**
  * Removes expired sessions from an array of sessions
  */ export const removeExpiredSessions = (sessions)=>{
@@ -12,6 +13,7 @@ import { v4 as uuid } from 'uuid';
  * Adds a session to the user and removes expired sessions
  * @returns The session ID (sid) if sessions are used
  */ export const addSessionToUser = async ({ collectionConfig, payload, req, user })=>{
+    assertNoValidationWrite(req);
     let sid;
     if (collectionConfig.auth.useSessions) {
         // Add session to user
@@ -51,6 +53,7 @@ import { v4 as uuid } from 'uuid';
     };
 };
 export const revokeSession = async ({ collectionConfig, payload, req, sid, user })=>{
+    assertNoValidationWrite(req);
     if (collectionConfig.auth.useSessions && user && user.sessions?.length) {
         user.sessions = user.sessions.filter((session)=>session.id !== sid);
         await payload.db.updateOne({

package/dist/auth/sessions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser, User, UserSession } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\n\n/**\n * Removes expired sessions from an array of sessions\n */\nexport const removeExpiredSessions = (sessions: UserSession[]): UserSession[] => {\n  const now = new Date()\n\n  return sessions.filter(({ expiresAt }) => {\n    const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n    return expiry > now\n  })\n}\n\n/**\n * Adds a session to the user and removes expired sessions\n * @returns The session ID (sid) if sessions are used\n */\nexport const addSessionToUser = async ({\n  collectionConfig,\n  payload,\n  req,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  user: AuthenticatedUser\n}): Promise<{ sid?: string }> => {\n  let sid: string | undefined\n  if (collectionConfig.auth.useSessions) {\n    // Add session to user\n    sid = uuid()\n    const now = new Date()\n    const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n    const expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n    const session = { id: sid, createdAt: now, expiresAt }\n\n    if (!user.sessions?.length) {\n      user.sessions = [session]\n    } else {\n      user.sessions = removeExpiredSessions(user.sessions)\n      user.sessions.push(session)\n    }\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        ...user,\n        // Prevent updatedAt from being updated when only adding a session\n        updatedAt: null,\n      },\n      req,\n      returning: false,\n    })\n\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n  }\n\n  return {\n    sid,\n  }\n}\n\nexport const revokeSession = async ({\n  collectionConfig,\n  payload,\n  req,\n  sid,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  sid: string\n  user: null | User\n}): Promise<void> => {\n  if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n    user.sessions = user.sessions.filter((session) => session.id !== sid)\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n      returning: false,\n    })\n  }\n}\n"],"names":["v4","uuid","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","user","sid","auth","useSessions","tokenExpInMs","tokenExpiration","getTime","session","id","createdAt","length","push","db","updateOne","collection","slug","data","updatedAt","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAMjC;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,IAAI,EAML;IACC,IAAIC;IACJ,IAAIJ,iBAAiBK,IAAI,CAACC,WAAW,EAAE;QACrC,sBAAsB;QACtBF,MAAMb;QACN,MAAMG,MAAM,IAAIC;QAChB,MAAMY,eAAeP,iBAAiBK,IAAI,CAACG,eAAe,GAAG;QAC7D,MAAMX,YAAY,IAAIF,KAAKD,IAAIe,OAAO,KAAKF;QAE3C,MAAMG,UAAU;YAAEC,IAAIP;YAAKQ,WAAWlB;YAAKG;QAAU;QAErD,IAAI,CAACM,KAAKV,QAAQ,EAAEoB,QAAQ;YAC1BV,KAAKV,QAAQ,GAAG;gBAACiB;aAAQ;QAC3B,OAAO;YACLP,KAAKV,QAAQ,GAAGD,sBAAsBW,KAAKV,QAAQ;YACnDU,KAAKV,QAAQ,CAACqB,IAAI,CAACJ;QACrB;QAEA,MAAMT,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAM;gBACJ,GAAGhB,IAAI;gBACP,kEAAkE;gBAClEiB,WAAW;YACb;YACAlB;YACAmB,WAAW;QACb;QAEAlB,KAAKc,UAAU,GAAGjB,iBAAiBkB,IAAI;QACvCf,KAAKmB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLlB;IACF;AACF,EAAC;AAED,OAAO,MAAMmB,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHE,GAAG,EACHD,IAAI,EAOL;IACC,IAAIH,iBAAiBK,IAAI,CAACC,WAAW,IAAIH,QAAQA,KAAKV,QAAQ,EAAEoB,QAAQ;QACtEV,KAAKV,QAAQ,GAAGU,KAAKV,QAAQ,CAACG,MAAM,CAAC,CAACc,UAAYA,QAAQC,EAAE,KAAKP;QACjE,MAAMH,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAMhB;YACND;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser, User, UserSession } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\n\nimport { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js'\n\n/**\n * Removes expired sessions from an array of sessions\n */\nexport const removeExpiredSessions = (sessions: UserSession[]): UserSession[] => {\n  const now = new Date()\n\n  return sessions.filter(({ expiresAt }) => {\n    const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n    return expiry > now\n  })\n}\n\n/**\n * Adds a session to the user and removes expired sessions\n * @returns The session ID (sid) if sessions are used\n */\nexport const addSessionToUser = async ({\n  collectionConfig,\n  payload,\n  req,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  user: AuthenticatedUser\n}): Promise<{ sid?: string }> => {\n  assertNoValidationWrite(req)\n\n  let sid: string | undefined\n  if (collectionConfig.auth.useSessions) {\n    // Add session to user\n    sid = uuid()\n    const now = new Date()\n    const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n    const expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n    const session = { id: sid, createdAt: now, expiresAt }\n\n    if (!user.sessions?.length) {\n      user.sessions = [session]\n    } else {\n      user.sessions = removeExpiredSessions(user.sessions)\n      user.sessions.push(session)\n    }\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        ...user,\n        // Prevent updatedAt from being updated when only adding a session\n        updatedAt: null,\n      },\n      req,\n      returning: false,\n    })\n\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n  }\n\n  return {\n    sid,\n  }\n}\n\nexport const revokeSession = async ({\n  collectionConfig,\n  payload,\n  req,\n  sid,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  sid: string\n  user: null | User\n}): Promise<void> => {\n  assertNoValidationWrite(req)\n\n  if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n    user.sessions = user.sessions.filter((session) => session.id !== sid)\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n      returning: false,\n    })\n  }\n}\n"],"names":["v4","uuid","assertNoValidationWrite","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","user","sid","auth","useSessions","tokenExpInMs","tokenExpiration","getTime","session","id","createdAt","length","push","db","updateOne","collection","slug","data","updatedAt","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAMjC,SAASC,uBAAuB,QAAQ,0CAAyC;AAEjF;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,IAAI,EAML;IACCZ,wBAAwBW;IAExB,IAAIE;IACJ,IAAIJ,iBAAiBK,IAAI,CAACC,WAAW,EAAE;QACrC,sBAAsB;QACtBF,MAAMd;QACN,MAAMI,MAAM,IAAIC;QAChB,MAAMY,eAAeP,iBAAiBK,IAAI,CAACG,eAAe,GAAG;QAC7D,MAAMX,YAAY,IAAIF,KAAKD,IAAIe,OAAO,KAAKF;QAE3C,MAAMG,UAAU;YAAEC,IAAIP;YAAKQ,WAAWlB;YAAKG;QAAU;QAErD,IAAI,CAACM,KAAKV,QAAQ,EAAEoB,QAAQ;YAC1BV,KAAKV,QAAQ,GAAG;gBAACiB;aAAQ;QAC3B,OAAO;YACLP,KAAKV,QAAQ,GAAGD,sBAAsBW,KAAKV,QAAQ;YACnDU,KAAKV,QAAQ,CAACqB,IAAI,CAACJ;QACrB;QAEA,MAAMT,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAM;gBACJ,GAAGhB,IAAI;gBACP,kEAAkE;gBAClEiB,WAAW;YACb;YACAlB;YACAmB,WAAW;QACb;QAEAlB,KAAKc,UAAU,GAAGjB,iBAAiBkB,IAAI;QACvCf,KAAKmB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLlB;IACF;AACF,EAAC;AAED,OAAO,MAAMmB,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHE,GAAG,EACHD,IAAI,EAOL;IACCZ,wBAAwBW;IAExB,IAAIF,iBAAiBK,IAAI,CAACC,WAAW,IAAIH,QAAQA,KAAKV,QAAQ,EAAEoB,QAAQ;QACtEV,KAAKV,QAAQ,GAAGU,KAAKV,QAAQ,CAACG,MAAM,CAAC,CAACc,UAAYA,QAAQC,EAAE,KAAKP;QACjE,MAAMH,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAMhB;YACND;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}

package/dist/auth/strategies/apiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAuD9C,CAAA"}
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAMvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAsG9C,CAAA"}

package/dist/auth/strategies/apiKey.js

@@ -1,16 +1,24 @@
 import crypto from 'crypto';
-export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGraphQL = false, payload })=>{
+import { stripTrailingSlash } from '../../utilities/formatAdminURL.js';
+import { getAPIKeyLast4 } from '../baseFields/apiKey/getAPIKeyLast4.js';
+import { legacyAPIKeyLast4 } from '../baseFields/apiKey/omitAPIKey.js';
+export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGraphQL = false, payload, req })=>{
         const authHeader = headers.get('Authorization');
         if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {
             const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '');
-            const sha256APIKeyIndex = crypto.createHmac('sha256', payload.secret).update(apiKey).digest('hex');
+            // The stored index was written under whichever secret was active at the
+            // time, so match against the index computed under every keyring secret.
+            const apiKeyIndexes = payload.encryptionKeyring.all.map((key)=>crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'));
+            const requestFallbackLocale = req?.fallbackLocale;
+            const requestLocale = req?.locale;
+            const requestDepth = req?.query?.depth;
             try {
                 const where = {};
                 if (collectionConfig.auth?.verify) {
                     where.and = [
                         {
                             apiKeyIndex: {
-                                equals: sha256APIKeyIndex
+                                in: apiKeyIndexes
                             }
                         },
                         {
@@ -21,19 +29,47 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                     ];
                 } else {
                     where.apiKeyIndex = {
-                        equals: sha256APIKeyIndex
+                        in: apiKeyIndexes
                     };
                 }
                 const userQuery = await payload.find({
                     collection: collectionConfig.slug,
                     depth: isGraphQL ? 0 : collectionConfig.auth.depth,
+                    fallbackLocale: requestFallbackLocale,
                     limit: 1,
+                    locale: requestLocale,
                     overrideAccess: true,
                     pagination: false,
+                    req,
                     where
                 });
                 if (userQuery.docs && userQuery.docs.length > 0) {
                     const user = userQuery.docs[0];
+                    const apiKeyLast4 = getAPIKeyLast4(apiKey);
+                    const requestPathname = req?.pathname ? stripTrailingSlash(req.pathname) : undefined;
+                    const isValidationRequest = req?.operation === 'validate' || requestPathname?.endsWith('/validate');
+                    // GraphQL authentication runs before the requested resolver is known, so it must remain
+                    // read-only to preserve validation's no-write guarantee.
+                    const canBackfillAPIKeyLast4 = !isGraphQL && !isValidationRequest;
+                    if (canBackfillAPIKeyLast4 && user?.apiKeyLast4 === legacyAPIKeyLast4 && apiKeyLast4 !== legacyAPIKeyLast4) {
+                        try {
+                            await payload.db.updateOne({
+                                id: user.id,
+                                collection: collectionConfig.slug,
+                                data: {
+                                    apiKeyLast4
+                                },
+                                req,
+                                returning: false
+                            });
+                            user.apiKeyLast4 = apiKeyLast4;
+                        } catch (err) {
+                            payload.logger.error({
+                                err,
+                                msg: `Failed to backfill API key last four for ${collectionConfig.slug} ${user.id}`
+                            });
+                        }
+                    }
                     user.collection = collectionConfig.slug;
                     user._strategy = 'api-key';
                     return {
@@ -44,6 +80,14 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                 return {
                     user: null
                 };
+            } finally{
+                if (req) {
+                    req.fallbackLocale = requestFallbackLocale;
+                    req.locale = requestLocale;
+                    if (req.query) {
+                        req.query.depth = requestDepth;
+                    }
+                }
             }
         }
         return {

package/dist/auth/strategies/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey)\n        .digest('hex')\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                equals: sha256APIKeyIndex,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { equals: sha256APIKeyIndex }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","sha256APIKeyIndex","createHmac","secret","update","digest","where","auth","verify","and","apiKeyIndex","equals","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,MAAMG,oBAAoBZ,OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAIf,iBAAiBgB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,QAAQV;4BACV;wBACF;wBACA;4BACEW,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,QAAQV;oBAAkB;gBAClD;gBAEA,MAAMa,YAAY,MAAMpB,QAAQqB,IAAI,CAAC;oBACnCC,YAAYzB,iBAAiBO,IAAI;oBACjCmB,OAAOxB,YAAY,IAAIF,iBAAiBgB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAGzB,iBAAiBO,IAAI;oBACxCyB,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nimport { stripTrailingSlash } from '../../utilities/formatAdminURL.js'\nimport { getAPIKeyLast4 } from '../baseFields/apiKey/getAPIKeyLast4.js'\nimport { legacyAPIKeyLast4 } from '../baseFields/apiKey/omitAPIKey.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload, req }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      // The stored index was written under whichever secret was active at the\n      // time, so match against the index computed under every keyring secret.\n      const apiKeyIndexes = payload.encryptionKeyring.all.map((key) =>\n        crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'),\n      )\n\n      const requestFallbackLocale = req?.fallbackLocale\n      const requestLocale = req?.locale\n      const requestDepth = req?.query?.depth\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                in: apiKeyIndexes,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { in: apiKeyIndexes }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          fallbackLocale: requestFallbackLocale,\n          limit: 1,\n          locale: requestLocale,\n          overrideAccess: true,\n          pagination: false,\n          req,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          const apiKeyLast4 = getAPIKeyLast4(apiKey)\n          const requestPathname = req?.pathname ? stripTrailingSlash(req.pathname) : undefined\n          const isValidationRequest =\n            req?.operation === 'validate' || requestPathname?.endsWith('/validate')\n          // GraphQL authentication runs before the requested resolver is known, so it must remain\n          // read-only to preserve validation's no-write guarantee.\n          const canBackfillAPIKeyLast4 = !isGraphQL && !isValidationRequest\n\n          if (\n            canBackfillAPIKeyLast4 &&\n            user?.apiKeyLast4 === legacyAPIKeyLast4 &&\n            apiKeyLast4 !== legacyAPIKeyLast4\n          ) {\n            try {\n              await payload.db.updateOne({\n                id: user.id,\n                collection: collectionConfig.slug,\n                data: { apiKeyLast4 },\n                req,\n                returning: false,\n              })\n              user.apiKeyLast4 = apiKeyLast4\n            } catch (err) {\n              payload.logger.error({\n                err,\n                msg: `Failed to backfill API key last four for ${collectionConfig.slug} ${user.id}`,\n              })\n            }\n          }\n\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      } finally {\n        if (req) {\n          req.fallbackLocale = requestFallbackLocale!\n          req.locale = requestLocale!\n\n          if (req.query) {\n            req.query.depth = requestDepth\n          }\n        }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","stripTrailingSlash","getAPIKeyLast4","legacyAPIKeyLast4","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","req","authHeader","get","startsWith","slug","apiKey","replace","apiKeyIndexes","encryptionKeyring","all","map","key","createHmac","legacyKey","update","digest","requestFallbackLocale","fallbackLocale","requestLocale","locale","requestDepth","query","depth","where","auth","verify","and","apiKeyIndex","in","_verified","not_equals","userQuery","find","collection","limit","overrideAccess","pagination","docs","length","user","apiKeyLast4","requestPathname","pathname","undefined","isValidationRequest","operation","endsWith","canBackfillAPIKeyLast4","db","updateOne","id","data","returning","err","logger","error","msg","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,SAASC,kBAAkB,QAAQ,oCAAmC;AACtE,SAASC,cAAc,QAAQ,yCAAwC;AACvE,SAASC,iBAAiB,QAAQ,qCAAoC;AAEtE,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAEC,GAAG,EAAE;QACjD,MAAMC,aAAaJ,QAAQK,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGP,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGV,iBAAiBQ,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAMG,gBAAgBR,QAAQS,iBAAiB,CAACC,GAAG,CAACC,GAAG,CAAC,CAACC,MACvDpB,OAAOqB,UAAU,CAAC,UAAUD,IAAIE,SAAS,EAAEC,MAAM,CAACT,QAAQU,MAAM,CAAC;YAGnE,MAAMC,wBAAwBhB,KAAKiB;YACnC,MAAMC,gBAAgBlB,KAAKmB;YAC3B,MAAMC,eAAepB,KAAKqB,OAAOC;YAEjC,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAI3B,iBAAiB4B,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,IAAIrB;4BACN;wBACF;wBACA;4BACEsB,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,IAAIrB;oBAAc;gBAC1C;gBAEA,MAAMwB,YAAY,MAAMhC,QAAQiC,IAAI,CAAC;oBACnCC,YAAYrC,iBAAiBQ,IAAI;oBACjCkB,OAAOxB,YAAY,IAAIF,iBAAiB4B,IAAI,CAACF,KAAK;oBAClDL,gBAAgBD;oBAChBkB,OAAO;oBACPf,QAAQD;oBACRiB,gBAAgB;oBAChBC,YAAY;oBACZpC;oBACAuB;gBACF;gBAEA,IAAIQ,UAAUM,IAAI,IAAIN,UAAUM,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOR,UAAUM,IAAI,CAAC,EAAE;oBAC9B,MAAMG,cAAc/C,eAAeY;oBACnC,MAAMoC,kBAAkBzC,KAAK0C,WAAWlD,mBAAmBQ,IAAI0C,QAAQ,IAAIC;oBAC3E,MAAMC,sBACJ5C,KAAK6C,cAAc,cAAcJ,iBAAiBK,SAAS;oBAC7D,wFAAwF;oBACxF,yDAAyD;oBACzD,MAAMC,yBAAyB,CAACjD,aAAa,CAAC8C;oBAE9C,IACEG,0BACAR,MAAMC,gBAAgB9C,qBACtB8C,gBAAgB9C,mBAChB;wBACA,IAAI;4BACF,MAAMK,QAAQiD,EAAE,CAACC,SAAS,CAAC;gCACzBC,IAAIX,KAAKW,EAAE;gCACXjB,YAAYrC,iBAAiBQ,IAAI;gCACjC+C,MAAM;oCAAEX;gCAAY;gCACpBxC;gCACAoD,WAAW;4BACb;4BACAb,KAAKC,WAAW,GAAGA;wBACrB,EAAE,OAAOa,KAAK;4BACZtD,QAAQuD,MAAM,CAACC,KAAK,CAAC;gCACnBF;gCACAG,KAAK,CAAC,yCAAyC,EAAE5D,iBAAiBQ,IAAI,CAAC,CAAC,EAAEmC,KAAKW,EAAE,EAAE;4BACrF;wBACF;oBACF;oBAEAX,KAAMN,UAAU,GAAGrC,iBAAiBQ,IAAI;oBACxCmC,KAAMkB,SAAS,GAAG;oBAElB,OAAO;wBACLlB,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOmB,QAAQ;gBACf,OAAO;oBAAEnB,MAAM;gBAAK;YACtB,SAAU;gBACR,IAAIvC,KAAK;oBACPA,IAAIiB,cAAc,GAAGD;oBACrBhB,IAAImB,MAAM,GAAGD;oBAEb,IAAIlB,IAAIqB,KAAK,EAAE;wBACbrB,IAAIqB,KAAK,CAACC,KAAK,GAAGF;oBACpB;gBACF;YACF;QACF;QAEA,OAAO;YAAEmB,MAAM;QAAK;IACtB,EAAC"}

package/dist/auth/strategies/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAsE3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAwD/B,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAA;AAwH3E;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,oBAuH/B,CAAA"}