payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ea6e8f8

package/dist/uploads/sanitizeUploadData.js

@@ -0,0 +1,166 @@
+import path from 'path';
+import { APIError } from '../errors/APIError.js';
+const hasOwnProperty = (value, key)=>Object.prototype.hasOwnProperty.call(value, key);
+const isRecord = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+export const getExternalUploadSource = (data)=>{
+    if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {
+        return undefined;
+    }
+    return {
+        filename: data.filename,
+        url: data.url
+    };
+};
+// Resolves the server-owned upload destination for a document write. For provider uploads the
+// prefix and key segment come from the verified upload reference; for server uploads (including
+// staged uploads) the prefix falls back to the submitted document data and there is no key segment.
+export const getUploadDestination = ({ data, file })=>{
+    if (!file) {
+        return {};
+    }
+    const submittedPrefix = isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined;
+    const { uploadReference } = file;
+    // A staged upload only identifies server-owned temporary bytes, so its final destination still
+    // comes from the accompanying document data, the same as a plain server upload.
+    if (!isRecord(uploadReference) || 'uploadId' in uploadReference) {
+        return {
+            prefix: submittedPrefix
+        };
+    }
+    return {
+        objectKey: typeof uploadReference._objectKey === 'string' ? uploadReference._objectKey : undefined,
+        prefix: typeof uploadReference.prefix === 'string' ? uploadReference.prefix : undefined
+    };
+};
+const getDocumentProperty = (document, property, { locale, localizedProperties })=>{
+    const value = document[property];
+    return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value;
+};
+// Accepts flattened fields so localized identity fields declared inside presentational
+// containers (row/collapsible/unnamed tabs) are still detected — those live at the document
+// root data level but are nested in the config tree, so walking `fields` alone would miss them.
+export const getLocalizedUploadProperties = (fields)=>{
+    const localizedProperties = new Set();
+    for (const field of fields){
+        if ('name' in field && field.localized) {
+            localizedProperties.add(field.name);
+        }
+    }
+    return localizedProperties;
+};
+// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to
+// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string
+// values are ignored here because they are removed by the caller anyway.
+const validateFilename = (filename)=>{
+    if (typeof filename !== 'string') {
+        return;
+    }
+    const pathSegments = filename.replace(/\\/g, '/').split('/');
+    if (path.posix.isAbsolute(filename) || path.win32.isAbsolute(filename) || pathSegments.includes('..')) {
+        throw new APIError('Invalid filename.', 400);
+    }
+};
+export const sanitizeUploadData = (data, operation)=>{
+    if (!isRecord(data)) {
+        return data;
+    }
+    validateFilename(data.filename);
+    if (isRecord(data.variants)) {
+        for (const sizeData of Object.values(data.variants)){
+            if (isRecord(sizeData)) {
+                validateFilename(sizeData.filename);
+            }
+        }
+    }
+    const sanitizedData = {
+        ...data
+    };
+    delete sanitizedData.filename;
+    delete sanitizedData.variants;
+    delete sanitizedData.url;
+    // Server-owned; never accepted from the caller.
+    delete sanitizedData._objectKey;
+    delete sanitizedData.original;
+    // On update, `prefix` is restored from the stored document (file identity); kept on create.
+    if (operation === 'update') {
+        delete sanitizedData.prefix;
+    }
+    return sanitizedData;
+};
+// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,
+// `url`, `variants`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,
+// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`
+// are user-editable crop input, and the rest are regenerated by generateFileData when a file is
+// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full
+// tuple below.
+export const mergeUploadDataWithDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const mergedData = {
+        ...data
+    };
+    for (const property of [
+        '_objectKey',
+        'filename',
+        'original',
+        'prefix',
+        'url'
+    ]){
+        if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {
+            mergedData[property] = getDocumentProperty(document, property, options);
+        }
+    }
+    const documentSizes = getDocumentProperty(document, 'variants', options);
+    if (!hasOwnProperty(data, 'variants') && hasOwnProperty(document, 'variants')) {
+        mergedData.variants = documentSizes;
+    } else if (isRecord(data.variants) && isRecord(documentSizes)) {
+        const mergedSizes = {
+            ...documentSizes
+        };
+        for (const [sizeName, sizeData] of Object.entries(data.variants)){
+            const documentSize = documentSizes[sizeName];
+            mergedSizes[sizeName] = isRecord(sizeData) && isRecord(documentSize) ? {
+                ...documentSize,
+                ...sizeData
+            } : sizeData;
+        }
+        mergedData.variants = mergedSizes;
+    }
+    return mergedData;
+};
+const uploadDerivedProperties = [
+    '_objectKey',
+    'filename',
+    'filesize',
+    'focalX',
+    'focalY',
+    'height',
+    'mimeType',
+    'original',
+    'prefix',
+    'variants',
+    'thumbnailURL',
+    'url',
+    'width'
+];
+export const restoreUploadDataFromDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const restoredData = {
+        ...data
+    };
+    for (const property of uploadDerivedProperties){
+        if (hasOwnProperty(document, property)) {
+            restoredData[property] = getDocumentProperty(document, property, options);
+        } else if (options.clearMissing) {
+            restoredData[property] = null;
+        } else {
+            delete restoredData[property];
+        }
+    }
+    return restoredData;
+};
+
+//# sourceMappingURL=sanitizeUploadData.js.map

package/dist/uploads/sanitizeUploadData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/sanitizeUploadData.ts"],"sourcesContent":["import path from 'path'\n\nimport type { FlattenedField } from '../fields/config/types.js'\n\nimport { APIError } from '../errors/APIError.js'\n\ntype Operation = 'create' | 'update'\n\nexport type ExternalUploadSource = {\n  filename: string\n  url: string\n}\n\ntype UploadDataOptions = {\n  clearMissing?: boolean\n  locale?: string\n  localizedProperties?: Set<string>\n}\n\nconst hasOwnProperty = (value: Record<string, unknown>, key: string): boolean =>\n  Object.prototype.hasOwnProperty.call(value, key)\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\nexport const getExternalUploadSource = (data: unknown): ExternalUploadSource | undefined => {\n  if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {\n    return undefined\n  }\n\n  return {\n    filename: data.filename,\n    url: data.url,\n  }\n}\n\n// Resolves the server-owned upload destination for a document write. For provider uploads the\n// prefix and key segment come from the verified upload reference; for server uploads (including\n// staged uploads) the prefix falls back to the submitted document data and there is no key segment.\nexport const getUploadDestination = ({\n  data,\n  file,\n}: {\n  data: unknown\n  file: { uploadReference?: unknown } | null | undefined\n}): { objectKey?: string; prefix?: string } => {\n  if (!file) {\n    return {}\n  }\n\n  const submittedPrefix =\n    isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined\n  const { uploadReference } = file\n\n  // A staged upload only identifies server-owned temporary bytes, so its final destination still\n  // comes from the accompanying document data, the same as a plain server upload.\n  if (!isRecord(uploadReference) || 'uploadId' in uploadReference) {\n    return { prefix: submittedPrefix }\n  }\n\n  return {\n    objectKey:\n      typeof uploadReference._objectKey === 'string' ? uploadReference._objectKey : undefined,\n    prefix: typeof uploadReference.prefix === 'string' ? uploadReference.prefix : undefined,\n  }\n}\n\nconst getDocumentProperty = (\n  document: Record<string, unknown>,\n  property: string,\n  { locale, localizedProperties }: UploadDataOptions,\n): unknown => {\n  const value = document[property]\n  return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value\n}\n\n// Accepts flattened fields so localized identity fields declared inside presentational\n// containers (row/collapsible/unnamed tabs) are still detected — those live at the document\n// root data level but are nested in the config tree, so walking `fields` alone would miss them.\nexport const getLocalizedUploadProperties = (fields: FlattenedField[]): Set<string> => {\n  const localizedProperties = new Set<string>()\n\n  for (const field of fields) {\n    if ('name' in field && (field as { localized?: boolean }).localized) {\n      localizedProperties.add(field.name)\n    }\n  }\n\n  return localizedProperties\n}\n\n// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to\n// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string\n// values are ignored here because they are removed by the caller anyway.\nconst validateFilename = (filename: unknown): void => {\n  if (typeof filename !== 'string') {\n    return\n  }\n\n  const pathSegments = filename.replace(/\\\\/g, '/').split('/')\n\n  if (\n    path.posix.isAbsolute(filename) ||\n    path.win32.isAbsolute(filename) ||\n    pathSegments.includes('..')\n  ) {\n    throw new APIError('Invalid filename.', 400)\n  }\n}\n\nexport const sanitizeUploadData = <T>(data: T, operation: Operation): T => {\n  if (!isRecord(data)) {\n    return data\n  }\n\n  validateFilename(data.filename)\n\n  if (isRecord(data.variants)) {\n    for (const sizeData of Object.values(data.variants)) {\n      if (isRecord(sizeData)) {\n        validateFilename(sizeData.filename)\n      }\n    }\n  }\n\n  const sanitizedData: Record<string, unknown> = { ...data }\n  delete sanitizedData.filename\n  delete sanitizedData.variants\n  delete sanitizedData.url\n  // Server-owned; never accepted from the caller.\n  delete sanitizedData._objectKey\n  delete sanitizedData.original\n\n  // On update, `prefix` is restored from the stored document (file identity); kept on create.\n  if (operation === 'update') {\n    delete sanitizedData.prefix\n  }\n\n  return sanitizedData as T\n}\n\n// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,\n// `url`, `variants`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,\n// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`\n// are user-editable crop input, and the rest are regenerated by generateFileData when a file is\n// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full\n// tuple below.\nexport const mergeUploadDataWithDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const mergedData: Record<string, unknown> = { ...data }\n\n  for (const property of ['_objectKey', 'filename', 'original', 'prefix', 'url']) {\n    if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {\n      mergedData[property] = getDocumentProperty(document, property, options)\n    }\n  }\n\n  const documentSizes = getDocumentProperty(document, 'variants', options)\n  if (!hasOwnProperty(data, 'variants') && hasOwnProperty(document, 'variants')) {\n    mergedData.variants = documentSizes\n  } else if (isRecord(data.variants) && isRecord(documentSizes)) {\n    const mergedSizes: Record<string, unknown> = { ...documentSizes }\n\n    for (const [sizeName, sizeData] of Object.entries(data.variants)) {\n      const documentSize = documentSizes[sizeName]\n\n      mergedSizes[sizeName] =\n        isRecord(sizeData) && isRecord(documentSize) ? { ...documentSize, ...sizeData } : sizeData\n    }\n\n    mergedData.variants = mergedSizes\n  }\n\n  return mergedData as T\n}\n\nconst uploadDerivedProperties = [\n  '_objectKey',\n  'filename',\n  'filesize',\n  'focalX',\n  'focalY',\n  'height',\n  'mimeType',\n  'original',\n  'prefix',\n  'variants',\n  'thumbnailURL',\n  'url',\n  'width',\n] as const\n\nexport const restoreUploadDataFromDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const restoredData: Record<string, unknown> = { ...data }\n  for (const property of uploadDerivedProperties) {\n    if (hasOwnProperty(document, property)) {\n      restoredData[property] = getDocumentProperty(document, property, options)\n    } else if (options.clearMissing) {\n      restoredData[property] = null\n    } else {\n      delete restoredData[property]\n    }\n  }\n\n  return restoredData as T\n}\n"],"names":["path","APIError","hasOwnProperty","value","key","Object","prototype","call","isRecord","Array","isArray","getExternalUploadSource","data","filename","url","undefined","getUploadDestination","file","submittedPrefix","prefix","uploadReference","objectKey","_objectKey","getDocumentProperty","document","property","locale","localizedProperties","has","getLocalizedUploadProperties","fields","Set","field","localized","add","name","validateFilename","pathSegments","replace","split","posix","isAbsolute","win32","includes","sanitizeUploadData","operation","variants","sizeData","values","sanitizedData","original","mergeUploadDataWithDocument","options","mergedData","documentSizes","mergedSizes","sizeName","entries","documentSize","uploadDerivedProperties","restoreUploadDataFromDocument","restoredData","clearMissing"],"mappings":"AAAA,OAAOA,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,wBAAuB;AAehD,MAAMC,iBAAiB,CAACC,OAAgCC,MACtDC,OAAOC,SAAS,CAACJ,cAAc,CAACK,IAAI,CAACJ,OAAOC;AAE9C,MAAMI,WAAW,CAACL,QAChB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACM,MAAMC,OAAO,CAACP;AAEhE,OAAO,MAAMQ,0BAA0B,CAACC;IACtC,IAAI,CAACJ,SAASI,SAAS,OAAOA,KAAKC,QAAQ,KAAK,YAAY,OAAOD,KAAKE,GAAG,KAAK,UAAU;QACxF,OAAOC;IACT;IAEA,OAAO;QACLF,UAAUD,KAAKC,QAAQ;QACvBC,KAAKF,KAAKE,GAAG;IACf;AACF,EAAC;AAED,8FAA8F;AAC9F,gGAAgG;AAChG,oGAAoG;AACpG,OAAO,MAAME,uBAAuB,CAAC,EACnCJ,IAAI,EACJK,IAAI,EAIL;IACC,IAAI,CAACA,MAAM;QACT,OAAO,CAAC;IACV;IAEA,MAAMC,kBACJV,SAASI,SAAS,OAAOA,KAAKO,MAAM,KAAK,WAAWP,KAAKO,MAAM,GAAGJ;IACpE,MAAM,EAAEK,eAAe,EAAE,GAAGH;IAE5B,+FAA+F;IAC/F,gFAAgF;IAChF,IAAI,CAACT,SAASY,oBAAoB,cAAcA,iBAAiB;QAC/D,OAAO;YAAED,QAAQD;QAAgB;IACnC;IAEA,OAAO;QACLG,WACE,OAAOD,gBAAgBE,UAAU,KAAK,WAAWF,gBAAgBE,UAAU,GAAGP;QAChFI,QAAQ,OAAOC,gBAAgBD,MAAM,KAAK,WAAWC,gBAAgBD,MAAM,GAAGJ;IAChF;AACF,EAAC;AAED,MAAMQ,sBAAsB,CAC1BC,UACAC,UACA,EAAEC,MAAM,EAAEC,mBAAmB,EAAqB;IAElD,MAAMxB,QAAQqB,QAAQ,CAACC,SAAS;IAChC,OAAOC,UAAUC,qBAAqBC,IAAIH,aAAajB,SAASL,SAASA,KAAK,CAACuB,OAAO,GAAGvB;AAC3F;AAEA,uFAAuF;AACvF,4FAA4F;AAC5F,gGAAgG;AAChG,OAAO,MAAM0B,+BAA+B,CAACC;IAC3C,MAAMH,sBAAsB,IAAII;IAEhC,KAAK,MAAMC,SAASF,OAAQ;QAC1B,IAAI,UAAUE,SAAS,AAACA,MAAkCC,SAAS,EAAE;YACnEN,oBAAoBO,GAAG,CAACF,MAAMG,IAAI;QACpC;IACF;IAEA,OAAOR;AACT,EAAC;AAED,8FAA8F;AAC9F,4FAA4F;AAC5F,yEAAyE;AACzE,MAAMS,mBAAmB,CAACvB;IACxB,IAAI,OAAOA,aAAa,UAAU;QAChC;IACF;IAEA,MAAMwB,eAAexB,SAASyB,OAAO,CAAC,OAAO,KAAKC,KAAK,CAAC;IAExD,IACEvC,KAAKwC,KAAK,CAACC,UAAU,CAAC5B,aACtBb,KAAK0C,KAAK,CAACD,UAAU,CAAC5B,aACtBwB,aAAaM,QAAQ,CAAC,OACtB;QACA,MAAM,IAAI1C,SAAS,qBAAqB;IAC1C;AACF;AAEA,OAAO,MAAM2C,qBAAqB,CAAIhC,MAASiC;IAC7C,IAAI,CAACrC,SAASI,OAAO;QACnB,OAAOA;IACT;IAEAwB,iBAAiBxB,KAAKC,QAAQ;IAE9B,IAAIL,SAASI,KAAKkC,QAAQ,GAAG;QAC3B,KAAK,MAAMC,YAAY1C,OAAO2C,MAAM,CAACpC,KAAKkC,QAAQ,EAAG;YACnD,IAAItC,SAASuC,WAAW;gBACtBX,iBAAiBW,SAASlC,QAAQ;YACpC;QACF;IACF;IAEA,MAAMoC,gBAAyC;QAAE,GAAGrC,IAAI;IAAC;IACzD,OAAOqC,cAAcpC,QAAQ;IAC7B,OAAOoC,cAAcH,QAAQ;IAC7B,OAAOG,cAAcnC,GAAG;IACxB,gDAAgD;IAChD,OAAOmC,cAAc3B,UAAU;IAC/B,OAAO2B,cAAcC,QAAQ;IAE7B,4FAA4F;IAC5F,IAAIL,cAAc,UAAU;QAC1B,OAAOI,cAAc9B,MAAM;IAC7B;IAEA,OAAO8B;AACT,EAAC;AAED,6FAA6F;AAC7F,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,eAAe;AACf,OAAO,MAAME,8BAA8B,CACzCvC,MACAY,UACA4B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC5C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMyC,aAAsC;QAAE,GAAGzC,IAAI;IAAC;IAEtD,KAAK,MAAMa,YAAY;QAAC;QAAc;QAAY;QAAY;QAAU;KAAM,CAAE;QAC9E,IAAI,CAACvB,eAAeU,MAAMa,aAAavB,eAAesB,UAAUC,WAAW;YACzE4B,UAAU,CAAC5B,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU2B;QACjE;IACF;IAEA,MAAME,gBAAgB/B,oBAAoBC,UAAU,YAAY4B;IAChE,IAAI,CAAClD,eAAeU,MAAM,eAAeV,eAAesB,UAAU,aAAa;QAC7E6B,WAAWP,QAAQ,GAAGQ;IACxB,OAAO,IAAI9C,SAASI,KAAKkC,QAAQ,KAAKtC,SAAS8C,gBAAgB;QAC7D,MAAMC,cAAuC;YAAE,GAAGD,aAAa;QAAC;QAEhE,KAAK,MAAM,CAACE,UAAUT,SAAS,IAAI1C,OAAOoD,OAAO,CAAC7C,KAAKkC,QAAQ,EAAG;YAChE,MAAMY,eAAeJ,aAAa,CAACE,SAAS;YAE5CD,WAAW,CAACC,SAAS,GACnBhD,SAASuC,aAAavC,SAASkD,gBAAgB;gBAAE,GAAGA,YAAY;gBAAE,GAAGX,QAAQ;YAAC,IAAIA;QACtF;QAEAM,WAAWP,QAAQ,GAAGS;IACxB;IAEA,OAAOF;AACT,EAAC;AAED,MAAMM,0BAA0B;IAC9B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,MAAMC,gCAAgC,CAC3ChD,MACAY,UACA4B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC5C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMiD,eAAwC;QAAE,GAAGjD,IAAI;IAAC;IACxD,KAAK,MAAMa,YAAYkC,wBAAyB;QAC9C,IAAIzD,eAAesB,UAAUC,WAAW;YACtCoC,YAAY,CAACpC,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU2B;QACnE,OAAO,IAAIA,QAAQU,YAAY,EAAE;YAC/BD,YAAY,CAACpC,SAAS,GAAG;QAC3B,OAAO;YACL,OAAOoC,YAAY,CAACpC,SAAS;QAC/B;IACF;IAEA,OAAOoC;AACT,EAAC"}

package/dist/uploads/stagedUpload.js

@@ -1,4 +1,4 @@
-import { jwtVerify } from 'jose';
+import { jwtVerify } from 'jose/jwt/verify';
 import { randomUUID } from 'node:crypto';
 import fs from 'node:fs/promises';
 import os from 'node:os';

package/dist/uploads/stagedUpload.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/stagedUpload.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\nimport { randomUUID } from 'node:crypto'\nimport fs from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\n\nimport type { PayloadHandler } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { File, UploadInstructions, UploadInstructionsRequest } from './types.js'\n\nimport { jwtSign } from '../auth/jwt.js'\nimport { APIError, Forbidden } from '../errors/index.js'\nimport { formatAdminURL } from '../utilities/formatAdminURL.js'\nimport { checkFileRestrictions } from './checkFileRestrictions.js'\n\n/**\n * Creates a signed, one-hour URL where the client can send the file bytes. The returned file value\n * is later passed to a document create or update request.\n */\nexport const generateStagedUploadInstructions = async ({\n  collectionSlug,\n  docPrefix,\n  filename,\n  filesize,\n  mimeType,\n  req,\n}: { req: PayloadRequest } & UploadInstructionsRequest): Promise<UploadInstructions> => {\n  await removeExpiredUploads(req, collectionSlug)\n\n  const { token: uploadId } = await jwtSign({\n    fieldsToSign: {\n      id: randomUUID(),\n      collectionSlug,\n      docPrefix,\n      filename,\n      filesize,\n      mimeType,\n      user: getUser(req),\n    },\n    secret: req.payload.secret,\n    tokenExpiration,\n  })\n\n  return {\n    type: 'http',\n    file: {\n      filename,\n      mimeType,\n      size: filesize,\n      uploadReference: { uploadId },\n    },\n    request: {\n      headers: {\n        'Content-Length': String(filesize),\n        'Content-Type': mimeType,\n      },\n      method: 'PUT',\n      url: formatAdminURL({\n        apiRoute: req.payload.config.routes.api,\n        path: `/upload-instructions/${uploadId}`,\n        serverURL: req.payload.config.serverURL,\n      }),\n    },\n  }\n}\n\n/**\n * Saves the bytes sent to a signed upload URL. The file is written as a partial file first and only\n * becomes available when its size exactly matches the size in the upload ID.\n */\nexport const uploadStagedFile: PayloadHandler = async (req) => {\n  const upload = await verifyUploadID(req, req.routeParams?.uploadId)\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n  const uploadPath = path.join(directory, upload.id)\n  const temporaryPath = `${uploadPath}.${randomUUID()}.part`\n  const file = await fs.open(temporaryPath, 'wx')\n  let uploadedSize = 0\n\n  try {\n    try {\n      const reader = req.body?.getReader()\n\n      while (reader) {\n        const { done, value } = await reader.read()\n\n        if (done) {\n          break\n        }\n\n        uploadedSize += value.byteLength\n        if (uploadedSize > upload.filesize) {\n          throw new APIError('Uploaded file is larger than expected.', 400)\n        }\n\n        let offset = 0\n        while (offset < value.byteLength) {\n          const { bytesWritten } = await file.write(value, offset)\n          offset += bytesWritten\n        }\n      }\n\n      if (uploadedSize !== upload.filesize) {\n        throw new APIError('Uploaded file size does not match the expected size.', 400)\n      }\n    } finally {\n      await file.close()\n    }\n\n    const collection = req.payload.collections[upload.collectionSlug]!.config\n    await checkFileRestrictions({\n      collection,\n      file: {\n        name: upload.filename,\n        data: Buffer.alloc(0),\n        mimetype: upload.mimeType,\n        size: upload.filesize,\n        tempFilePath: temporaryPath,\n      },\n      req,\n    })\n\n    await fs.rename(temporaryPath, uploadPath)\n  } catch (error) {\n    await fs.rm(temporaryPath, { force: true })\n    throw error\n  }\n\n  return new Response(null, { status: 204 })\n}\n\n/** Removes a temporary upload that the client no longer needs. */\nexport const deleteStagedFile: PayloadHandler = async (req) => {\n  const upload = await verifyUploadID(req, req.routeParams?.uploadId)\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n\n  await fs.rm(path.join(directory, upload.id), { force: true })\n\n  return new Response(null, { status: 204 })\n}\n\n/**\n * Loads a completed staged file for a document request. Only the same user and collection can use\n * it, and the temporary file is deleted after it is read.\n */\nexport const getStagedFile = async ({\n  collectionSlug,\n  req,\n  uploadReference,\n}: {\n  collectionSlug: string\n  req: PayloadRequest\n  uploadReference: unknown\n}): Promise<File> => {\n  if (\n    !uploadReference ||\n    typeof uploadReference !== 'object' ||\n    Array.isArray(uploadReference) ||\n    !('uploadId' in uploadReference) ||\n    typeof uploadReference.uploadId !== 'string'\n  ) {\n    throw new APIError('Invalid staged upload.', 400)\n  }\n\n  const { uploadId } = uploadReference\n  const upload = await verifyUploadID(req, uploadId)\n\n  if (upload.collectionSlug !== collectionSlug || upload.user !== getUser(req)) {\n    throw new Forbidden(req.t)\n  }\n\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n  const tempFilePath = path.join(directory, upload.id)\n  let data: Buffer\n\n  try {\n    data = await fs.readFile(tempFilePath)\n  } catch {\n    throw new APIError('Staged upload was not found.', 400)\n  }\n\n  if (data.length !== upload.filesize) {\n    await fs.rm(tempFilePath, { force: true })\n    throw new APIError('Staged upload is incomplete.', 400)\n  }\n\n  await fs.rm(tempFilePath, { force: true })\n\n  return {\n    name: upload.filename,\n    data,\n    mimetype: upload.mimeType,\n    size: data.length,\n  }\n}\n\n/**\n * Staged uploads hold a file temporarily until a document create or update uses it. The signed\n * upload ID remembers which file and user the upload belongs to.\n */\nconst tokenExpiration = 60 * 60\n\n/** The file details stored inside the signed upload ID. */\ntype StagedUploadToken = {\n  id: string\n  user: null | string\n} & UploadInstructionsRequest\n\nconst getUser = (req: PayloadRequest) =>\n  req.user ? `${req.user.collection}:${String(req.user.id)}` : null\n\n/** Returns the hidden folder where temporary uploads for this collection are stored. */\nconst getUploadDirectory = async (req: PayloadRequest, collectionSlug: string) => {\n  const upload = req.payload.collections[collectionSlug]?.config.upload\n  const directory = path.resolve(\n    upload && !upload.disableLocalStorage\n      ? upload.staticDir || collectionSlug\n      : req.payload.config.upload.tempFileDir || os.tmpdir(),\n    '.payload-staged-uploads',\n  )\n\n  await fs.mkdir(directory, { recursive: true })\n\n  return directory\n}\n\n/** Removes temporary files older than the one-hour upload window. */\nconst removeExpiredUploads = async (req: PayloadRequest, collectionSlug: string) => {\n  const directory = await getUploadDirectory(req, collectionSlug)\n  const expiresBefore = Date.now() - tokenExpiration * 1000\n\n  for (const filename of await fs.readdir(directory)) {\n    const filePath = path.join(directory, filename)\n    const stats = await fs.stat(filePath).catch(() => null)\n\n    if (stats && stats.mtimeMs < expiresBefore) {\n      await fs.rm(filePath, { force: true })\n    }\n  }\n}\n\n/** Verifies that an upload ID was signed by Payload, has not expired, and contains valid details. */\nconst verifyUploadID = async (\n  req: PayloadRequest,\n  uploadID: unknown,\n): Promise<StagedUploadToken> => {\n  try {\n    if (typeof uploadID !== 'string') {\n      throw new Error()\n    }\n\n    const secret = new TextEncoder().encode(req.payload.secret)\n    const { payload } = await jwtVerify<StagedUploadToken>(uploadID, secret)\n\n    if (\n      typeof payload.id !== 'string' ||\n      !/^[\\da-f-]{36}$/i.test(payload.id) ||\n      typeof payload.collectionSlug !== 'string' ||\n      typeof payload.filename !== 'string' ||\n      !Number.isSafeInteger(payload.filesize) ||\n      payload.filesize < 0 ||\n      typeof payload.mimeType !== 'string' ||\n      (payload.user !== null && typeof payload.user !== 'string')\n    ) {\n      throw new Error()\n    }\n\n    return payload as StagedUploadToken\n  } catch {\n    throw new APIError('Invalid or expired staged upload.', 400)\n  }\n}\n"],"names":["jwtVerify","randomUUID","fs","os","path","jwtSign","APIError","Forbidden","formatAdminURL","checkFileRestrictions","generateStagedUploadInstructions","collectionSlug","docPrefix","filename","filesize","mimeType","req","removeExpiredUploads","token","uploadId","fieldsToSign","id","user","getUser","secret","payload","tokenExpiration","type","file","size","uploadReference","request","headers","String","method","url","apiRoute","config","routes","api","serverURL","uploadStagedFile","upload","verifyUploadID","routeParams","directory","getUploadDirectory","uploadPath","join","temporaryPath","open","uploadedSize","reader","body","getReader","done","value","read","byteLength","offset","bytesWritten","write","close","collection","collections","name","data","Buffer","alloc","mimetype","tempFilePath","rename","error","rm","force","Response","status","deleteStagedFile","getStagedFile","Array","isArray","t","readFile","length","resolve","disableLocalStorage","staticDir","tempFileDir","tmpdir","mkdir","recursive","expiresBefore","Date","now","readdir","filePath","stats","stat","catch","mtimeMs","uploadID","Error","TextEncoder","encode","test","Number","isSafeInteger"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAChC,SAASC,UAAU,QAAQ,cAAa;AACxC,OAAOC,QAAQ,mBAAkB;AACjC,OAAOC,QAAQ,UAAS;AACxB,OAAOC,UAAU,YAAW;AAM5B,SAASC,OAAO,QAAQ,iBAAgB;AACxC,SAASC,QAAQ,EAAEC,SAAS,QAAQ,qBAAoB;AACxD,SAASC,cAAc,QAAQ,iCAAgC;AAC/D,SAASC,qBAAqB,QAAQ,6BAA4B;AAElE;;;CAGC,GACD,OAAO,MAAMC,mCAAmC,OAAO,EACrDC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,QAAQ,EACRC,GAAG,EACiD;IACpD,MAAMC,qBAAqBD,KAAKL;IAEhC,MAAM,EAAEO,OAAOC,QAAQ,EAAE,GAAG,MAAMd,QAAQ;QACxCe,cAAc;YACZC,IAAIpB;YACJU;YACAC;YACAC;YACAC;YACAC;YACAO,MAAMC,QAAQP;QAChB;QACAQ,QAAQR,IAAIS,OAAO,CAACD,MAAM;QAC1BE;IACF;IAEA,OAAO;QACLC,MAAM;QACNC,MAAM;YACJf;YACAE;YACAc,MAAMf;YACNgB,iBAAiB;gBAAEX;YAAS;QAC9B;QACAY,SAAS;YACPC,SAAS;gBACP,kBAAkBC,OAAOnB;gBACzB,gBAAgBC;YAClB;YACAmB,QAAQ;YACRC,KAAK3B,eAAe;gBAClB4B,UAAUpB,IAAIS,OAAO,CAACY,MAAM,CAACC,MAAM,CAACC,GAAG;gBACvCnC,MAAM,CAAC,qBAAqB,EAAEe,UAAU;gBACxCqB,WAAWxB,IAAIS,OAAO,CAACY,MAAM,CAACG,SAAS;YACzC;QACF;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,mBAAmC,OAAOzB;IACrD,MAAM0B,SAAS,MAAMC,eAAe3B,KAAKA,IAAI4B,WAAW,EAAEzB;IAC1D,MAAM0B,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IACrE,MAAMoC,aAAa3C,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE;IACjD,MAAM4B,gBAAgB,GAAGF,WAAW,CAAC,EAAE9C,aAAa,KAAK,CAAC;IAC1D,MAAM2B,OAAO,MAAM1B,GAAGgD,IAAI,CAACD,eAAe;IAC1C,IAAIE,eAAe;IAEnB,IAAI;QACF,IAAI;YACF,MAAMC,SAASpC,IAAIqC,IAAI,EAAEC;YAEzB,MAAOF,OAAQ;gBACb,MAAM,EAAEG,IAAI,EAAEC,KAAK,EAAE,GAAG,MAAMJ,OAAOK,IAAI;gBAEzC,IAAIF,MAAM;oBACR;gBACF;gBAEAJ,gBAAgBK,MAAME,UAAU;gBAChC,IAAIP,eAAeT,OAAO5B,QAAQ,EAAE;oBAClC,MAAM,IAAIR,SAAS,0CAA0C;gBAC/D;gBAEA,IAAIqD,SAAS;gBACb,MAAOA,SAASH,MAAME,UAAU,CAAE;oBAChC,MAAM,EAAEE,YAAY,EAAE,GAAG,MAAMhC,KAAKiC,KAAK,CAACL,OAAOG;oBACjDA,UAAUC;gBACZ;YACF;YAEA,IAAIT,iBAAiBT,OAAO5B,QAAQ,EAAE;gBACpC,MAAM,IAAIR,SAAS,wDAAwD;YAC7E;QACF,SAAU;YACR,MAAMsB,KAAKkC,KAAK;QAClB;QAEA,MAAMC,aAAa/C,IAAIS,OAAO,CAACuC,WAAW,CAACtB,OAAO/B,cAAc,CAAC,CAAE0B,MAAM;QACzE,MAAM5B,sBAAsB;YAC1BsD;YACAnC,MAAM;gBACJqC,MAAMvB,OAAO7B,QAAQ;gBACrBqD,MAAMC,OAAOC,KAAK,CAAC;gBACnBC,UAAU3B,OAAO3B,QAAQ;gBACzBc,MAAMa,OAAO5B,QAAQ;gBACrBwD,cAAcrB;YAChB;YACAjC;QACF;QAEA,MAAMd,GAAGqE,MAAM,CAACtB,eAAeF;IACjC,EAAE,OAAOyB,OAAO;QACd,MAAMtE,GAAGuE,EAAE,CAACxB,eAAe;YAAEyB,OAAO;QAAK;QACzC,MAAMF;IACR;IAEA,OAAO,IAAIG,SAAS,MAAM;QAAEC,QAAQ;IAAI;AAC1C,EAAC;AAED,gEAAgE,GAChE,OAAO,MAAMC,mBAAmC,OAAO7D;IACrD,MAAM0B,SAAS,MAAMC,eAAe3B,KAAKA,IAAI4B,WAAW,EAAEzB;IAC1D,MAAM0B,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IAErE,MAAMT,GAAGuE,EAAE,CAACrE,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE,GAAG;QAAEqD,OAAO;IAAK;IAE3D,OAAO,IAAIC,SAAS,MAAM;QAAEC,QAAQ;IAAI;AAC1C,EAAC;AAED;;;CAGC,GACD,OAAO,MAAME,gBAAgB,OAAO,EAClCnE,cAAc,EACdK,GAAG,EACHc,eAAe,EAKhB;IACC,IACE,CAACA,mBACD,OAAOA,oBAAoB,YAC3BiD,MAAMC,OAAO,CAAClD,oBACd,CAAE,CAAA,cAAcA,eAAc,KAC9B,OAAOA,gBAAgBX,QAAQ,KAAK,UACpC;QACA,MAAM,IAAIb,SAAS,0BAA0B;IAC/C;IAEA,MAAM,EAAEa,QAAQ,EAAE,GAAGW;IACrB,MAAMY,SAAS,MAAMC,eAAe3B,KAAKG;IAEzC,IAAIuB,OAAO/B,cAAc,KAAKA,kBAAkB+B,OAAOpB,IAAI,KAAKC,QAAQP,MAAM;QAC5E,MAAM,IAAIT,UAAUS,IAAIiE,CAAC;IAC3B;IAEA,MAAMpC,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IACrE,MAAM2D,eAAelE,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE;IACnD,IAAI6C;IAEJ,IAAI;QACFA,OAAO,MAAMhE,GAAGgF,QAAQ,CAACZ;IAC3B,EAAE,OAAM;QACN,MAAM,IAAIhE,SAAS,gCAAgC;IACrD;IAEA,IAAI4D,KAAKiB,MAAM,KAAKzC,OAAO5B,QAAQ,EAAE;QACnC,MAAMZ,GAAGuE,EAAE,CAACH,cAAc;YAAEI,OAAO;QAAK;QACxC,MAAM,IAAIpE,SAAS,gCAAgC;IACrD;IAEA,MAAMJ,GAAGuE,EAAE,CAACH,cAAc;QAAEI,OAAO;IAAK;IAExC,OAAO;QACLT,MAAMvB,OAAO7B,QAAQ;QACrBqD;QACAG,UAAU3B,OAAO3B,QAAQ;QACzBc,MAAMqC,KAAKiB,MAAM;IACnB;AACF,EAAC;AAED;;;CAGC,GACD,MAAMzD,kBAAkB,KAAK;AAQ7B,MAAMH,UAAU,CAACP,MACfA,IAAIM,IAAI,GAAG,GAAGN,IAAIM,IAAI,CAACyC,UAAU,CAAC,CAAC,EAAE9B,OAAOjB,IAAIM,IAAI,CAACD,EAAE,GAAG,GAAG;AAE/D,sFAAsF,GACtF,MAAMyB,qBAAqB,OAAO9B,KAAqBL;IACrD,MAAM+B,SAAS1B,IAAIS,OAAO,CAACuC,WAAW,CAACrD,eAAe,EAAE0B,OAAOK;IAC/D,MAAMG,YAAYzC,KAAKgF,OAAO,CAC5B1C,UAAU,CAACA,OAAO2C,mBAAmB,GACjC3C,OAAO4C,SAAS,IAAI3E,iBACpBK,IAAIS,OAAO,CAACY,MAAM,CAACK,MAAM,CAAC6C,WAAW,IAAIpF,GAAGqF,MAAM,IACtD;IAGF,MAAMtF,GAAGuF,KAAK,CAAC5C,WAAW;QAAE6C,WAAW;IAAK;IAE5C,OAAO7C;AACT;AAEA,mEAAmE,GACnE,MAAM5B,uBAAuB,OAAOD,KAAqBL;IACvD,MAAMkC,YAAY,MAAMC,mBAAmB9B,KAAKL;IAChD,MAAMgF,gBAAgBC,KAAKC,GAAG,KAAKnE,kBAAkB;IAErD,KAAK,MAAMb,YAAY,CAAA,MAAMX,GAAG4F,OAAO,CAACjD,UAAS,EAAG;QAClD,MAAMkD,WAAW3F,KAAK4C,IAAI,CAACH,WAAWhC;QACtC,MAAMmF,QAAQ,MAAM9F,GAAG+F,IAAI,CAACF,UAAUG,KAAK,CAAC,IAAM;QAElD,IAAIF,SAASA,MAAMG,OAAO,GAAGR,eAAe;YAC1C,MAAMzF,GAAGuE,EAAE,CAACsB,UAAU;gBAAErB,OAAO;YAAK;QACtC;IACF;AACF;AAEA,mGAAmG,GACnG,MAAM/B,iBAAiB,OACrB3B,KACAoF;IAEA,IAAI;QACF,IAAI,OAAOA,aAAa,UAAU;YAChC,MAAM,IAAIC;QACZ;QAEA,MAAM7E,SAAS,IAAI8E,cAAcC,MAAM,CAACvF,IAAIS,OAAO,CAACD,MAAM;QAC1D,MAAM,EAAEC,OAAO,EAAE,GAAG,MAAMzB,UAA6BoG,UAAU5E;QAEjE,IACE,OAAOC,QAAQJ,EAAE,KAAK,YACtB,CAAC,kBAAkBmF,IAAI,CAAC/E,QAAQJ,EAAE,KAClC,OAAOI,QAAQd,cAAc,KAAK,YAClC,OAAOc,QAAQZ,QAAQ,KAAK,YAC5B,CAAC4F,OAAOC,aAAa,CAACjF,QAAQX,QAAQ,KACtCW,QAAQX,QAAQ,GAAG,KACnB,OAAOW,QAAQV,QAAQ,KAAK,YAC3BU,QAAQH,IAAI,KAAK,QAAQ,OAAOG,QAAQH,IAAI,KAAK,UAClD;YACA,MAAM,IAAI+E;QACZ;QAEA,OAAO5E;IACT,EAAE,OAAM;QACN,MAAM,IAAInB,SAAS,qCAAqC;IAC1D;AACF"}
+{"version":3,"sources":["../../src/uploads/stagedUpload.ts"],"sourcesContent":["import { jwtVerify } from 'jose/jwt/verify'\nimport { randomUUID } from 'node:crypto'\nimport fs from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\n\nimport type { PayloadHandler } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { File, UploadInstructions, UploadInstructionsRequest } from './types.js'\n\nimport { jwtSign } from '../auth/jwt.js'\nimport { APIError, Forbidden } from '../errors/index.js'\nimport { formatAdminURL } from '../utilities/formatAdminURL.js'\nimport { checkFileRestrictions } from './checkFileRestrictions.js'\n\n/**\n * Creates a signed, one-hour URL where the client can send the file bytes. The returned file value\n * is later passed to a document create or update request.\n */\nexport const generateStagedUploadInstructions = async ({\n  collectionSlug,\n  docPrefix,\n  filename,\n  filesize,\n  mimeType,\n  req,\n}: { req: PayloadRequest } & UploadInstructionsRequest): Promise<UploadInstructions> => {\n  await removeExpiredUploads(req, collectionSlug)\n\n  const { token: uploadId } = await jwtSign({\n    fieldsToSign: {\n      id: randomUUID(),\n      collectionSlug,\n      docPrefix,\n      filename,\n      filesize,\n      mimeType,\n      user: getUser(req),\n    },\n    secret: req.payload.secret,\n    tokenExpiration,\n  })\n\n  return {\n    type: 'http',\n    file: {\n      filename,\n      mimeType,\n      size: filesize,\n      uploadReference: { uploadId },\n    },\n    request: {\n      headers: {\n        'Content-Length': String(filesize),\n        'Content-Type': mimeType,\n      },\n      method: 'PUT',\n      url: formatAdminURL({\n        apiRoute: req.payload.config.routes.api,\n        path: `/upload-instructions/${uploadId}`,\n        serverURL: req.payload.config.serverURL,\n      }),\n    },\n  }\n}\n\n/**\n * Saves the bytes sent to a signed upload URL. The file is written as a partial file first and only\n * becomes available when its size exactly matches the size in the upload ID.\n */\nexport const uploadStagedFile: PayloadHandler = async (req) => {\n  const upload = await verifyUploadID(req, req.routeParams?.uploadId)\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n  const uploadPath = path.join(directory, upload.id)\n  const temporaryPath = `${uploadPath}.${randomUUID()}.part`\n  const file = await fs.open(temporaryPath, 'wx')\n  let uploadedSize = 0\n\n  try {\n    try {\n      const reader = req.body?.getReader()\n\n      while (reader) {\n        const { done, value } = await reader.read()\n\n        if (done) {\n          break\n        }\n\n        uploadedSize += value.byteLength\n        if (uploadedSize > upload.filesize) {\n          throw new APIError('Uploaded file is larger than expected.', 400)\n        }\n\n        let offset = 0\n        while (offset < value.byteLength) {\n          const { bytesWritten } = await file.write(value, offset)\n          offset += bytesWritten\n        }\n      }\n\n      if (uploadedSize !== upload.filesize) {\n        throw new APIError('Uploaded file size does not match the expected size.', 400)\n      }\n    } finally {\n      await file.close()\n    }\n\n    const collection = req.payload.collections[upload.collectionSlug]!.config\n    await checkFileRestrictions({\n      collection,\n      file: {\n        name: upload.filename,\n        data: Buffer.alloc(0),\n        mimetype: upload.mimeType,\n        size: upload.filesize,\n        tempFilePath: temporaryPath,\n      },\n      req,\n    })\n\n    await fs.rename(temporaryPath, uploadPath)\n  } catch (error) {\n    await fs.rm(temporaryPath, { force: true })\n    throw error\n  }\n\n  return new Response(null, { status: 204 })\n}\n\n/** Removes a temporary upload that the client no longer needs. */\nexport const deleteStagedFile: PayloadHandler = async (req) => {\n  const upload = await verifyUploadID(req, req.routeParams?.uploadId)\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n\n  await fs.rm(path.join(directory, upload.id), { force: true })\n\n  return new Response(null, { status: 204 })\n}\n\n/**\n * Loads a completed staged file for a document request. Only the same user and collection can use\n * it, and the temporary file is deleted after it is read.\n */\nexport const getStagedFile = async ({\n  collectionSlug,\n  req,\n  uploadReference,\n}: {\n  collectionSlug: string\n  req: PayloadRequest\n  uploadReference: unknown\n}): Promise<File> => {\n  if (\n    !uploadReference ||\n    typeof uploadReference !== 'object' ||\n    Array.isArray(uploadReference) ||\n    !('uploadId' in uploadReference) ||\n    typeof uploadReference.uploadId !== 'string'\n  ) {\n    throw new APIError('Invalid staged upload.', 400)\n  }\n\n  const { uploadId } = uploadReference\n  const upload = await verifyUploadID(req, uploadId)\n\n  if (upload.collectionSlug !== collectionSlug || upload.user !== getUser(req)) {\n    throw new Forbidden(req.t)\n  }\n\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n  const tempFilePath = path.join(directory, upload.id)\n  let data: Buffer\n\n  try {\n    data = await fs.readFile(tempFilePath)\n  } catch {\n    throw new APIError('Staged upload was not found.', 400)\n  }\n\n  if (data.length !== upload.filesize) {\n    await fs.rm(tempFilePath, { force: true })\n    throw new APIError('Staged upload is incomplete.', 400)\n  }\n\n  await fs.rm(tempFilePath, { force: true })\n\n  return {\n    name: upload.filename,\n    data,\n    mimetype: upload.mimeType,\n    size: data.length,\n  }\n}\n\n/**\n * Staged uploads hold a file temporarily until a document create or update uses it. The signed\n * upload ID remembers which file and user the upload belongs to.\n */\nconst tokenExpiration = 60 * 60\n\n/** The file details stored inside the signed upload ID. */\ntype StagedUploadToken = {\n  id: string\n  user: null | string\n} & UploadInstructionsRequest\n\nconst getUser = (req: PayloadRequest) =>\n  req.user ? `${req.user.collection}:${String(req.user.id)}` : null\n\n/** Returns the hidden folder where temporary uploads for this collection are stored. */\nconst getUploadDirectory = async (req: PayloadRequest, collectionSlug: string) => {\n  const upload = req.payload.collections[collectionSlug]?.config.upload\n  const directory = path.resolve(\n    upload && !upload.disableLocalStorage\n      ? upload.staticDir || collectionSlug\n      : req.payload.config.upload.tempFileDir || os.tmpdir(),\n    '.payload-staged-uploads',\n  )\n\n  await fs.mkdir(directory, { recursive: true })\n\n  return directory\n}\n\n/** Removes temporary files older than the one-hour upload window. */\nconst removeExpiredUploads = async (req: PayloadRequest, collectionSlug: string) => {\n  const directory = await getUploadDirectory(req, collectionSlug)\n  const expiresBefore = Date.now() - tokenExpiration * 1000\n\n  for (const filename of await fs.readdir(directory)) {\n    const filePath = path.join(directory, filename)\n    const stats = await fs.stat(filePath).catch(() => null)\n\n    if (stats && stats.mtimeMs < expiresBefore) {\n      await fs.rm(filePath, { force: true })\n    }\n  }\n}\n\n/** Verifies that an upload ID was signed by Payload, has not expired, and contains valid details. */\nconst verifyUploadID = async (\n  req: PayloadRequest,\n  uploadID: unknown,\n): Promise<StagedUploadToken> => {\n  try {\n    if (typeof uploadID !== 'string') {\n      throw new Error()\n    }\n\n    const secret = new TextEncoder().encode(req.payload.secret)\n    const { payload } = await jwtVerify<StagedUploadToken>(uploadID, secret)\n\n    if (\n      typeof payload.id !== 'string' ||\n      !/^[\\da-f-]{36}$/i.test(payload.id) ||\n      typeof payload.collectionSlug !== 'string' ||\n      typeof payload.filename !== 'string' ||\n      !Number.isSafeInteger(payload.filesize) ||\n      payload.filesize < 0 ||\n      typeof payload.mimeType !== 'string' ||\n      (payload.user !== null && typeof payload.user !== 'string')\n    ) {\n      throw new Error()\n    }\n\n    return payload as StagedUploadToken\n  } catch {\n    throw new APIError('Invalid or expired staged upload.', 400)\n  }\n}\n"],"names":["jwtVerify","randomUUID","fs","os","path","jwtSign","APIError","Forbidden","formatAdminURL","checkFileRestrictions","generateStagedUploadInstructions","collectionSlug","docPrefix","filename","filesize","mimeType","req","removeExpiredUploads","token","uploadId","fieldsToSign","id","user","getUser","secret","payload","tokenExpiration","type","file","size","uploadReference","request","headers","String","method","url","apiRoute","config","routes","api","serverURL","uploadStagedFile","upload","verifyUploadID","routeParams","directory","getUploadDirectory","uploadPath","join","temporaryPath","open","uploadedSize","reader","body","getReader","done","value","read","byteLength","offset","bytesWritten","write","close","collection","collections","name","data","Buffer","alloc","mimetype","tempFilePath","rename","error","rm","force","Response","status","deleteStagedFile","getStagedFile","Array","isArray","t","readFile","length","resolve","disableLocalStorage","staticDir","tempFileDir","tmpdir","mkdir","recursive","expiresBefore","Date","now","readdir","filePath","stats","stat","catch","mtimeMs","uploadID","Error","TextEncoder","encode","test","Number","isSafeInteger"],"mappings":"AAAA,SAASA,SAAS,QAAQ,kBAAiB;AAC3C,SAASC,UAAU,QAAQ,cAAa;AACxC,OAAOC,QAAQ,mBAAkB;AACjC,OAAOC,QAAQ,UAAS;AACxB,OAAOC,UAAU,YAAW;AAM5B,SAASC,OAAO,QAAQ,iBAAgB;AACxC,SAASC,QAAQ,EAAEC,SAAS,QAAQ,qBAAoB;AACxD,SAASC,cAAc,QAAQ,iCAAgC;AAC/D,SAASC,qBAAqB,QAAQ,6BAA4B;AAElE;;;CAGC,GACD,OAAO,MAAMC,mCAAmC,OAAO,EACrDC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,QAAQ,EACRC,GAAG,EACiD;IACpD,MAAMC,qBAAqBD,KAAKL;IAEhC,MAAM,EAAEO,OAAOC,QAAQ,EAAE,GAAG,MAAMd,QAAQ;QACxCe,cAAc;YACZC,IAAIpB;YACJU;YACAC;YACAC;YACAC;YACAC;YACAO,MAAMC,QAAQP;QAChB;QACAQ,QAAQR,IAAIS,OAAO,CAACD,MAAM;QAC1BE;IACF;IAEA,OAAO;QACLC,MAAM;QACNC,MAAM;YACJf;YACAE;YACAc,MAAMf;YACNgB,iBAAiB;gBAAEX;YAAS;QAC9B;QACAY,SAAS;YACPC,SAAS;gBACP,kBAAkBC,OAAOnB;gBACzB,gBAAgBC;YAClB;YACAmB,QAAQ;YACRC,KAAK3B,eAAe;gBAClB4B,UAAUpB,IAAIS,OAAO,CAACY,MAAM,CAACC,MAAM,CAACC,GAAG;gBACvCnC,MAAM,CAAC,qBAAqB,EAAEe,UAAU;gBACxCqB,WAAWxB,IAAIS,OAAO,CAACY,MAAM,CAACG,SAAS;YACzC;QACF;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,mBAAmC,OAAOzB;IACrD,MAAM0B,SAAS,MAAMC,eAAe3B,KAAKA,IAAI4B,WAAW,EAAEzB;IAC1D,MAAM0B,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IACrE,MAAMoC,aAAa3C,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE;IACjD,MAAM4B,gBAAgB,GAAGF,WAAW,CAAC,EAAE9C,aAAa,KAAK,CAAC;IAC1D,MAAM2B,OAAO,MAAM1B,GAAGgD,IAAI,CAACD,eAAe;IAC1C,IAAIE,eAAe;IAEnB,IAAI;QACF,IAAI;YACF,MAAMC,SAASpC,IAAIqC,IAAI,EAAEC;YAEzB,MAAOF,OAAQ;gBACb,MAAM,EAAEG,IAAI,EAAEC,KAAK,EAAE,GAAG,MAAMJ,OAAOK,IAAI;gBAEzC,IAAIF,MAAM;oBACR;gBACF;gBAEAJ,gBAAgBK,MAAME,UAAU;gBAChC,IAAIP,eAAeT,OAAO5B,QAAQ,EAAE;oBAClC,MAAM,IAAIR,SAAS,0CAA0C;gBAC/D;gBAEA,IAAIqD,SAAS;gBACb,MAAOA,SAASH,MAAME,UAAU,CAAE;oBAChC,MAAM,EAAEE,YAAY,EAAE,GAAG,MAAMhC,KAAKiC,KAAK,CAACL,OAAOG;oBACjDA,UAAUC;gBACZ;YACF;YAEA,IAAIT,iBAAiBT,OAAO5B,QAAQ,EAAE;gBACpC,MAAM,IAAIR,SAAS,wDAAwD;YAC7E;QACF,SAAU;YACR,MAAMsB,KAAKkC,KAAK;QAClB;QAEA,MAAMC,aAAa/C,IAAIS,OAAO,CAACuC,WAAW,CAACtB,OAAO/B,cAAc,CAAC,CAAE0B,MAAM;QACzE,MAAM5B,sBAAsB;YAC1BsD;YACAnC,MAAM;gBACJqC,MAAMvB,OAAO7B,QAAQ;gBACrBqD,MAAMC,OAAOC,KAAK,CAAC;gBACnBC,UAAU3B,OAAO3B,QAAQ;gBACzBc,MAAMa,OAAO5B,QAAQ;gBACrBwD,cAAcrB;YAChB;YACAjC;QACF;QAEA,MAAMd,GAAGqE,MAAM,CAACtB,eAAeF;IACjC,EAAE,OAAOyB,OAAO;QACd,MAAMtE,GAAGuE,EAAE,CAACxB,eAAe;YAAEyB,OAAO;QAAK;QACzC,MAAMF;IACR;IAEA,OAAO,IAAIG,SAAS,MAAM;QAAEC,QAAQ;IAAI;AAC1C,EAAC;AAED,gEAAgE,GAChE,OAAO,MAAMC,mBAAmC,OAAO7D;IACrD,MAAM0B,SAAS,MAAMC,eAAe3B,KAAKA,IAAI4B,WAAW,EAAEzB;IAC1D,MAAM0B,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IAErE,MAAMT,GAAGuE,EAAE,CAACrE,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE,GAAG;QAAEqD,OAAO;IAAK;IAE3D,OAAO,IAAIC,SAAS,MAAM;QAAEC,QAAQ;IAAI;AAC1C,EAAC;AAED;;;CAGC,GACD,OAAO,MAAME,gBAAgB,OAAO,EAClCnE,cAAc,EACdK,GAAG,EACHc,eAAe,EAKhB;IACC,IACE,CAACA,mBACD,OAAOA,oBAAoB,YAC3BiD,MAAMC,OAAO,CAAClD,oBACd,CAAE,CAAA,cAAcA,eAAc,KAC9B,OAAOA,gBAAgBX,QAAQ,KAAK,UACpC;QACA,MAAM,IAAIb,SAAS,0BAA0B;IAC/C;IAEA,MAAM,EAAEa,QAAQ,EAAE,GAAGW;IACrB,MAAMY,SAAS,MAAMC,eAAe3B,KAAKG;IAEzC,IAAIuB,OAAO/B,cAAc,KAAKA,kBAAkB+B,OAAOpB,IAAI,KAAKC,QAAQP,MAAM;QAC5E,MAAM,IAAIT,UAAUS,IAAIiE,CAAC;IAC3B;IAEA,MAAMpC,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IACrE,MAAM2D,eAAelE,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE;IACnD,IAAI6C;IAEJ,IAAI;QACFA,OAAO,MAAMhE,GAAGgF,QAAQ,CAACZ;IAC3B,EAAE,OAAM;QACN,MAAM,IAAIhE,SAAS,gCAAgC;IACrD;IAEA,IAAI4D,KAAKiB,MAAM,KAAKzC,OAAO5B,QAAQ,EAAE;QACnC,MAAMZ,GAAGuE,EAAE,CAACH,cAAc;YAAEI,OAAO;QAAK;QACxC,MAAM,IAAIpE,SAAS,gCAAgC;IACrD;IAEA,MAAMJ,GAAGuE,EAAE,CAACH,cAAc;QAAEI,OAAO;IAAK;IAExC,OAAO;QACLT,MAAMvB,OAAO7B,QAAQ;QACrBqD;QACAG,UAAU3B,OAAO3B,QAAQ;QACzBc,MAAMqC,KAAKiB,MAAM;IACnB;AACF,EAAC;AAED;;;CAGC,GACD,MAAMzD,kBAAkB,KAAK;AAQ7B,MAAMH,UAAU,CAACP,MACfA,IAAIM,IAAI,GAAG,GAAGN,IAAIM,IAAI,CAACyC,UAAU,CAAC,CAAC,EAAE9B,OAAOjB,IAAIM,IAAI,CAACD,EAAE,GAAG,GAAG;AAE/D,sFAAsF,GACtF,MAAMyB,qBAAqB,OAAO9B,KAAqBL;IACrD,MAAM+B,SAAS1B,IAAIS,OAAO,CAACuC,WAAW,CAACrD,eAAe,EAAE0B,OAAOK;IAC/D,MAAMG,YAAYzC,KAAKgF,OAAO,CAC5B1C,UAAU,CAACA,OAAO2C,mBAAmB,GACjC3C,OAAO4C,SAAS,IAAI3E,iBACpBK,IAAIS,OAAO,CAACY,MAAM,CAACK,MAAM,CAAC6C,WAAW,IAAIpF,GAAGqF,MAAM,IACtD;IAGF,MAAMtF,GAAGuF,KAAK,CAAC5C,WAAW;QAAE6C,WAAW;IAAK;IAE5C,OAAO7C;AACT;AAEA,mEAAmE,GACnE,MAAM5B,uBAAuB,OAAOD,KAAqBL;IACvD,MAAMkC,YAAY,MAAMC,mBAAmB9B,KAAKL;IAChD,MAAMgF,gBAAgBC,KAAKC,GAAG,KAAKnE,kBAAkB;IAErD,KAAK,MAAMb,YAAY,CAAA,MAAMX,GAAG4F,OAAO,CAACjD,UAAS,EAAG;QAClD,MAAMkD,WAAW3F,KAAK4C,IAAI,CAACH,WAAWhC;QACtC,MAAMmF,QAAQ,MAAM9F,GAAG+F,IAAI,CAACF,UAAUG,KAAK,CAAC,IAAM;QAElD,IAAIF,SAASA,MAAMG,OAAO,GAAGR,eAAe;YAC1C,MAAMzF,GAAGuE,EAAE,CAACsB,UAAU;gBAAErB,OAAO;YAAK;QACtC;IACF;AACF;AAEA,mGAAmG,GACnG,MAAM/B,iBAAiB,OACrB3B,KACAoF;IAEA,IAAI;QACF,IAAI,OAAOA,aAAa,UAAU;YAChC,MAAM,IAAIC;QACZ;QAEA,MAAM7E,SAAS,IAAI8E,cAAcC,MAAM,CAACvF,IAAIS,OAAO,CAACD,MAAM;QAC1D,MAAM,EAAEC,OAAO,EAAE,GAAG,MAAMzB,UAA6BoG,UAAU5E;QAEjE,IACE,OAAOC,QAAQJ,EAAE,KAAK,YACtB,CAAC,kBAAkBmF,IAAI,CAAC/E,QAAQJ,EAAE,KAClC,OAAOI,QAAQd,cAAc,KAAK,YAClC,OAAOc,QAAQZ,QAAQ,KAAK,YAC5B,CAAC4F,OAAOC,aAAa,CAACjF,QAAQX,QAAQ,KACtCW,QAAQX,QAAQ,GAAG,KACnB,OAAOW,QAAQV,QAAQ,KAAK,YAC3BU,QAAQH,IAAI,KAAK,QAAQ,OAAOG,QAAQH,IAAI,KAAK,UAClD;YACA,MAAM,IAAI+E;QACZ;QAEA,OAAO5E;IACT,EAAE,OAAM;QACN,MAAM,IAAInB,SAAS,qCAAqC;IAC1D;AACF"}

package/dist/uploads/transformers/createLazySourceGetter.d.ts

@@ -0,0 +1,15 @@
+export type LazySourceGetter = {
+    get: () => Promise<Response>;
+    wasCalled: () => boolean;
+};
+/**
+ * Wraps a source-retrieval function so it runs at most once: the first `get()`
+ * call performs the retrieval, and every later call rejects with a
+ * `TransformerContractError` — including while the first call is still pending,
+ * or after it has rejected. Deliberately doesn't memoize a reusable `Response`,
+ * since the underlying body is normally a single-use stream.
+ */
+export declare function createLazySourceGetter({ retrieve, }: {
+    retrieve: () => Promise<Response>;
+}): LazySourceGetter;
+//# sourceMappingURL=createLazySourceGetter.d.ts.map

package/dist/uploads/transformers/createLazySourceGetter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createLazySourceGetter.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/createLazySourceGetter.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5B,SAAS,EAAE,MAAM,OAAO,CAAA;CACzB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClC,GAAG,gBAAgB,CAiBnB"}

package/dist/uploads/transformers/createLazySourceGetter.js

@@ -0,0 +1,22 @@
+import { TransformerContractError } from '../../errors/TransformerContractError.js';
+/**
+ * Wraps a source-retrieval function so it runs at most once: the first `get()`
+ * call performs the retrieval, and every later call rejects with a
+ * `TransformerContractError` — including while the first call is still pending,
+ * or after it has rejected. Deliberately doesn't memoize a reusable `Response`,
+ * since the underlying body is normally a single-use stream.
+ */ export function createLazySourceGetter({ retrieve }) {
+    let wasCalled = false;
+    return {
+        get: async ()=>{
+            if (wasCalled) {
+                throw new TransformerContractError('A transformer stage attempted to call getSourceFile more than once.');
+            }
+            wasCalled = true;
+            return retrieve();
+        },
+        wasCalled: ()=>wasCalled
+    };
+}
+
+//# sourceMappingURL=createLazySourceGetter.js.map

package/dist/uploads/transformers/createLazySourceGetter.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/createLazySourceGetter.ts"],"sourcesContent":["import { TransformerContractError } from '../../errors/TransformerContractError.js'\n\nexport type LazySourceGetter = {\n  get: () => Promise<Response>\n  wasCalled: () => boolean\n}\n\n/**\n * Wraps a source-retrieval function so it runs at most once: the first `get()`\n * call performs the retrieval, and every later call rejects with a\n * `TransformerContractError` — including while the first call is still pending,\n * or after it has rejected. Deliberately doesn't memoize a reusable `Response`,\n * since the underlying body is normally a single-use stream.\n */\nexport function createLazySourceGetter({\n  retrieve,\n}: {\n  retrieve: () => Promise<Response>\n}): LazySourceGetter {\n  let wasCalled = false\n\n  return {\n    get: async () => {\n      if (wasCalled) {\n        throw new TransformerContractError(\n          'A transformer stage attempted to call getSourceFile more than once.',\n        )\n      }\n\n      wasCalled = true\n\n      return retrieve()\n    },\n    wasCalled: () => wasCalled,\n  }\n}\n"],"names":["TransformerContractError","createLazySourceGetter","retrieve","wasCalled","get"],"mappings":"AAAA,SAASA,wBAAwB,QAAQ,2CAA0C;AAOnF;;;;;;CAMC,GACD,OAAO,SAASC,uBAAuB,EACrCC,QAAQ,EAGT;IACC,IAAIC,YAAY;IAEhB,OAAO;QACLC,KAAK;YACH,IAAID,WAAW;gBACb,MAAM,IAAIH,yBACR;YAEJ;YAEAG,YAAY;YAEZ,OAAOD;QACT;QACAC,WAAW,IAAMA;IACnB;AACF"}

package/dist/uploads/transformers/finalizeFileResponse.d.ts

@@ -0,0 +1,14 @@
+import type { Collection } from '../../collections/config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+/**
+ * The single header pass for the dynamic-transform response path. Unlike the
+ * existing `serve` path — where a collection's `modifyResponseHeaders` can still
+ * win on any header it touches, including CORS — mandatory CORS and security
+ * headers are asserted last here, so they are never overridable.
+ */
+export declare function finalizeFileResponse({ collection, req, response, }: {
+    collection: Collection;
+    req: PayloadRequest;
+    response: Response;
+}): Response;
+//# sourceMappingURL=finalizeFileResponse.d.ts.map

package/dist/uploads/transformers/finalizeFileResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalizeFileResponse.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/finalizeFileResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAa1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,UAAU,EACV,GAAG,EACH,QAAQ,GACT,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,QAAQ,EAAE,QAAQ,CAAA;CACnB,GAAG,QAAQ,CA2CX"}

package/dist/uploads/transformers/finalizeFileResponse.js

@@ -0,0 +1,49 @@
+import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { isXmlMimeType } from '../getFileTypeIdentity.js';
+import { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js';
+const MANDATORY_CORS_HEADER_NAMES = [
+    'Access-Control-Allow-Methods',
+    'Access-Control-Allow-Headers',
+    'Access-Control-Allow-Origin',
+    'Access-Control-Allow-Credentials'
+];
+/**
+ * The single header pass for the dynamic-transform response path. Unlike the
+ * existing `serve` path — where a collection's `modifyResponseHeaders` can still
+ * win on any header it touches, including CORS — mandatory CORS and security
+ * headers are asserted last here, so they are never overridable.
+ */ export function finalizeFileResponse({ collection, req, response }) {
+    const headers = new Headers(response.headers);
+    const sourceContentType = headers.get('Content-Type');
+    const modifyResponseHeaders = collection.config.upload ? collection.config.upload.modifyResponseHeaders : undefined;
+    const modifiedHeaders = typeof modifyResponseHeaders === 'function' ? modifyResponseHeaders({
+        headers
+    }) || headers : headers;
+    // Check the content type both before and after `modifyResponseHeaders`, so the hook
+    // can neither introduce an XML type nor relabel one to escape the policy.
+    const isXml = isXmlMimeType(sourceContentType) || isXmlMimeType(modifiedHeaders.get('Content-Type'));
+    if (isXml) {
+        modifiedHeaders.set('Content-Security-Policy', uploadContentSecurityPolicy);
+    }
+    for (const corsHeaderName of MANDATORY_CORS_HEADER_NAMES){
+        modifiedHeaders.delete(corsHeaderName);
+    }
+    const finalHeaders = headersWithCors({
+        headers: modifiedHeaders,
+        req
+    });
+    const isHeadRequest = req.method === 'HEAD';
+    if (isHeadRequest && response.body && !response.body.locked) {
+        void response.body.cancel().catch(()=>{
+        // A clean-up failure must not prevent the HEAD response.
+        });
+    }
+    const body = isHeadRequest ? null : response.body;
+    return new Response(body, {
+        headers: finalHeaders,
+        status: response.status,
+        statusText: response.statusText
+    });
+}
+
+//# sourceMappingURL=finalizeFileResponse.js.map

package/dist/uploads/transformers/finalizeFileResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/finalizeFileResponse.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { isXmlMimeType } from '../getFileTypeIdentity.js'\nimport { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js'\n\nconst MANDATORY_CORS_HEADER_NAMES = [\n  'Access-Control-Allow-Methods',\n  'Access-Control-Allow-Headers',\n  'Access-Control-Allow-Origin',\n  'Access-Control-Allow-Credentials',\n]\n\n/**\n * The single header pass for the dynamic-transform response path. Unlike the\n * existing `serve` path — where a collection's `modifyResponseHeaders` can still\n * win on any header it touches, including CORS — mandatory CORS and security\n * headers are asserted last here, so they are never overridable.\n */\nexport function finalizeFileResponse({\n  collection,\n  req,\n  response,\n}: {\n  collection: Collection\n  req: PayloadRequest\n  response: Response\n}): Response {\n  const headers = new Headers(response.headers)\n  const sourceContentType = headers.get('Content-Type')\n\n  const modifyResponseHeaders = collection.config.upload\n    ? collection.config.upload.modifyResponseHeaders\n    : undefined\n\n  const modifiedHeaders =\n    typeof modifyResponseHeaders === 'function'\n      ? modifyResponseHeaders({ headers }) || headers\n      : headers\n\n  // Check the content type both before and after `modifyResponseHeaders`, so the hook\n  // can neither introduce an XML type nor relabel one to escape the policy.\n  const isXml =\n    isXmlMimeType(sourceContentType) || isXmlMimeType(modifiedHeaders.get('Content-Type'))\n\n  if (isXml) {\n    modifiedHeaders.set('Content-Security-Policy', uploadContentSecurityPolicy)\n  }\n\n  for (const corsHeaderName of MANDATORY_CORS_HEADER_NAMES) {\n    modifiedHeaders.delete(corsHeaderName)\n  }\n\n  const finalHeaders = headersWithCors({ headers: modifiedHeaders, req })\n\n  const isHeadRequest = req.method === 'HEAD'\n\n  if (isHeadRequest && response.body && !response.body.locked) {\n    void response.body.cancel().catch(() => {\n      // A clean-up failure must not prevent the HEAD response.\n    })\n  }\n\n  const body = isHeadRequest ? null : response.body\n\n  return new Response(body, {\n    headers: finalHeaders,\n    status: response.status,\n    statusText: response.statusText,\n  })\n}\n"],"names":["headersWithCors","isXmlMimeType","uploadContentSecurityPolicy","MANDATORY_CORS_HEADER_NAMES","finalizeFileResponse","collection","req","response","headers","Headers","sourceContentType","get","modifyResponseHeaders","config","upload","undefined","modifiedHeaders","isXml","set","corsHeaderName","delete","finalHeaders","isHeadRequest","method","body","locked","cancel","catch","Response","status","statusText"],"mappings":"AAGA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,4BAA2B;AACzD,SAASC,2BAA2B,QAAQ,oCAAmC;AAE/E,MAAMC,8BAA8B;IAClC;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,OAAO,SAASC,qBAAqB,EACnCC,UAAU,EACVC,GAAG,EACHC,QAAQ,EAKT;IACC,MAAMC,UAAU,IAAIC,QAAQF,SAASC,OAAO;IAC5C,MAAME,oBAAoBF,QAAQG,GAAG,CAAC;IAEtC,MAAMC,wBAAwBP,WAAWQ,MAAM,CAACC,MAAM,GAClDT,WAAWQ,MAAM,CAACC,MAAM,CAACF,qBAAqB,GAC9CG;IAEJ,MAAMC,kBACJ,OAAOJ,0BAA0B,aAC7BA,sBAAsB;QAAEJ;IAAQ,MAAMA,UACtCA;IAEN,oFAAoF;IACpF,0EAA0E;IAC1E,MAAMS,QACJhB,cAAcS,sBAAsBT,cAAce,gBAAgBL,GAAG,CAAC;IAExE,IAAIM,OAAO;QACTD,gBAAgBE,GAAG,CAAC,2BAA2BhB;IACjD;IAEA,KAAK,MAAMiB,kBAAkBhB,4BAA6B;QACxDa,gBAAgBI,MAAM,CAACD;IACzB;IAEA,MAAME,eAAerB,gBAAgB;QAAEQ,SAASQ;QAAiBV;IAAI;IAErE,MAAMgB,gBAAgBhB,IAAIiB,MAAM,KAAK;IAErC,IAAID,iBAAiBf,SAASiB,IAAI,IAAI,CAACjB,SAASiB,IAAI,CAACC,MAAM,EAAE;QAC3D,KAAKlB,SAASiB,IAAI,CAACE,MAAM,GAAGC,KAAK,CAAC;QAChC,yDAAyD;QAC3D;IACF;IAEA,MAAMH,OAAOF,gBAAgB,OAAOf,SAASiB,IAAI;IAEjD,OAAO,IAAII,SAASJ,MAAM;QACxBhB,SAASa;QACTQ,QAAQtB,SAASsB,MAAM;QACvBC,YAAYvB,SAASuB,UAAU;IACjC;AACF"}

package/dist/uploads/transformers/getSourceFileResponse.d.ts

@@ -0,0 +1,16 @@
+import type { Collection } from '../../collections/config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+import type { ResolvedUploadDocument } from './resolveUploadDocument.js';
+/**
+ * Payload's internal source-retrieval used by a request transformer's lazy
+ * `getSourceFile` getter. A thin wrapper over the same handler-loop/local-fs
+ * logic the ordinary `read` endpoint uses, called with `operation: 'transform'`.
+ */
+export declare function getSourceFileResponse({ collection, document, filename, prefix, req, }: {
+    collection: Collection;
+    document: ResolvedUploadDocument;
+    filename: string;
+    prefix?: string;
+    req: PayloadRequest;
+}): Promise<Response>;
+//# sourceMappingURL=getSourceFileResponse.d.ts.map

package/dist/uploads/transformers/getSourceFileResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSourceFileResponse.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/getSourceFileResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAIxE;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,GAAG,GACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,sBAAsB,CAAA;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CASpB"}

package/dist/uploads/transformers/getSourceFileResponse.js

@@ -0,0 +1,17 @@
+import { retrieveFileResponse } from '../endpoints/getFile.js';
+/**
+ * Payload's internal source-retrieval used by a request transformer's lazy
+ * `getSourceFile` getter. A thin wrapper over the same handler-loop/local-fs
+ * logic the ordinary `read` endpoint uses, called with `operation: 'transform'`.
+ */ export async function getSourceFileResponse({ collection, document, filename, prefix, req }) {
+    return retrieveFileResponse({
+        collection,
+        doc: document,
+        filename,
+        operation: 'transform',
+        prefix,
+        req
+    });
+}
+
+//# sourceMappingURL=getSourceFileResponse.js.map

package/dist/uploads/transformers/getSourceFileResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/getSourceFileResponse.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { ResolvedUploadDocument } from './resolveUploadDocument.js'\n\nimport { retrieveFileResponse } from '../endpoints/getFile.js'\n\n/**\n * Payload's internal source-retrieval used by a request transformer's lazy\n * `getSourceFile` getter. A thin wrapper over the same handler-loop/local-fs\n * logic the ordinary `read` endpoint uses, called with `operation: 'transform'`.\n */\nexport async function getSourceFileResponse({\n  collection,\n  document,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  document: ResolvedUploadDocument\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<Response> {\n  return retrieveFileResponse({\n    collection,\n    doc: document,\n    filename,\n    operation: 'transform',\n    prefix,\n    req,\n  })\n}\n"],"names":["retrieveFileResponse","getSourceFileResponse","collection","document","filename","prefix","req","doc","operation"],"mappings":"AAIA,SAASA,oBAAoB,QAAQ,0BAAyB;AAE9D;;;;CAIC,GACD,OAAO,eAAeC,sBAAsB,EAC1CC,UAAU,EACVC,QAAQ,EACRC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAOJ;IACC,OAAON,qBAAqB;QAC1BE;QACAK,KAAKJ;QACLC;QACAI,WAAW;QACXH;QACAC;IACF;AACF"}

package/dist/uploads/transformers/handleDynamicFileRequest.d.ts

@@ -0,0 +1,18 @@
+import type { Collection } from '../../collections/config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+/**
+ * Orchestrates a dynamic file request end to end: resolve the document, plan the
+ * request-capable transformer pipeline from the requested file's authoritative
+ * MIME type (the primary file or the matched image size), enforce
+ * transform-aware read access, then run every eligible transformer in declaration
+ * order against a lazily-fetched source. Called from `getFileHandler` only when at
+ * least one transformer is configured — the zero-transformer path never reaches
+ * this function.
+ */
+export declare function handleDynamicFileRequest({ collection, filename, prefix, req, }: {
+    collection: Collection;
+    filename: string;
+    prefix?: string;
+    req: PayloadRequest;
+}): Promise<Response>;
+//# sourceMappingURL=handleDynamicFileRequest.d.ts.map

package/dist/uploads/transformers/handleDynamicFileRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleDynamicFileRequest.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/handleDynamicFileRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAgB1D;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,UAAU,EACV,QAAQ,EACR,MAAM,EACN,GAAG,GACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyHpB"}