payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ea6e8f8

package/dist/utilities/formatAdminURL.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/formatAdminURL.ts"],"sourcesContent":["import type { Config } from '../config/types.js'\n\n/**\n * Builds correct URLs for admin panel and API routing.\n * Use this for both admin routes (`adminRoute`) and API routes (`apiRoute`).\n *\n * Its primary responsibilities are:\n * 1. Read from your `routes.admin` or `routes.api` config and appropriately handle `\"/\"` paths\n * 2. Prepend the `basePath` from your Next.js config, if specified\n * 3. Return relative or absolute URLs, as needed\n *\n * @example\n * // Admin route\n * formatAdminURL({ adminRoute, path: `/collections/${slug}` })\n *\n * @example\n * // API route with query params\n * const queryString = qs.stringify({ where, limit, page }, { addQueryPrefix: true })\n * formatAdminURL({ apiRoute: api, path: `/${slug}${queryString}`, serverURL })\n */\ntype BaseFormatURLArgs = {\n  /**\n   * The subpath of your application, if specified.\n   * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/basePath\n   * @example '/docs'\n   */\n  basePath?: string\n  includeBasePath?: boolean\n  path?: '' | `/${string}` | null\n  /**\n   * Return a relative URL, e.g. ignore `serverURL`.\n   * Useful for route-matching, etc.\n   */\n  relative?: boolean\n} & Pick<Config, 'serverURL'>\n\ntype FormatURLArgs =\n  | ({\n      adminRoute: NonNullable<Config['routes']>['admin']\n      apiRoute?: never\n    } & BaseFormatURLArgs)\n  | ({\n      adminRoute?: never\n      apiRoute: NonNullable<Config['routes']>['api']\n    } & BaseFormatURLArgs)\n\nexport const formatAdminURL = (args: FormatURLArgs): string => {\n  const {\n    adminRoute,\n    apiRoute,\n    includeBasePath: includeBasePathArg,\n    path = '',\n    relative = false,\n    serverURL,\n  } = args\n  const basePath = process.env.NEXT_BASE_PATH || args.basePath || ''\n  const routePath = adminRoute || apiRoute\n  const segments = [routePath && routePath !== '/' && routePath, path && path].filter(Boolean)\n  const pathname = segments.join('') || '/'\n  const pathnameWithBase = (basePath + pathname).replace(/\\/$/, '') || '/'\n  const includeBasePath = includeBasePathArg ?? (adminRoute ? false : true)\n\n  if (relative || !serverURL) {\n    if (includeBasePath && basePath) {\n      return pathnameWithBase\n    }\n    return pathname\n  }\n\n  const serverURLObj = new URL(serverURL)\n  return new URL(pathnameWithBase, serverURLObj.origin).toString()\n}\n"],"names":["formatAdminURL","args","adminRoute","apiRoute","includeBasePath","includeBasePathArg","path","relative","serverURL","basePath","process","env","NEXT_BASE_PATH","routePath","segments","filter","Boolean","pathname","join","pathnameWithBase","replace","serverURLObj","URL","origin","toString"],"mappings":"AA8CA,OAAO,MAAMA,iBAAiB,CAACC;IAC7B,MAAM,EACJC,UAAU,EACVC,QAAQ,EACRC,iBAAiBC,kBAAkB,EACnCC,OAAO,EAAE,EACTC,WAAW,KAAK,EAChBC,SAAS,EACV,GAAGP;IACJ,MAAMQ,WAAWC,QAAQC,GAAG,CAACC,cAAc,IAAIX,KAAKQ,QAAQ,IAAI;IAChE,MAAMI,YAAYX,cAAcC;IAChC,MAAMW,WAAW;QAACD,aAAaA,cAAc,OAAOA;QAAWP,QAAQA;KAAK,CAACS,MAAM,CAACC;IACpF,MAAMC,WAAWH,SAASI,IAAI,CAAC,OAAO;IACtC,MAAMC,mBAAmB,AAACV,CAAAA,WAAWQ,QAAO,EAAGG,OAAO,CAAC,OAAO,OAAO;IACrE,MAAMhB,kBAAkBC,sBAAuBH,CAAAA,aAAa,QAAQ,IAAG;IAEvE,IAAIK,YAAY,CAACC,WAAW;QAC1B,IAAIJ,mBAAmBK,UAAU;YAC/B,OAAOU;QACT;QACA,OAAOF;IACT;IAEA,MAAMI,eAAe,IAAIC,IAAId;IAC7B,OAAO,IAAIc,IAAIH,kBAAkBE,aAAaE,MAAM,EAAEC,QAAQ;AAChE,EAAC"}
+{"version":3,"sources":["../../src/utilities/formatAdminURL.ts"],"sourcesContent":["import type { Config } from '../config/types.js'\n\n/**\n * Builds correct URLs for admin panel and API routing.\n * Use this for both admin routes (`adminRoute`) and API routes (`apiRoute`).\n *\n * Its primary responsibilities are:\n * 1. Read from your `routes.admin` or `routes.api` config and appropriately handle `\"/\"` paths\n * 2. Prepend the `basePath` from your Next.js config, if specified\n * 3. Return relative or absolute URLs, as needed\n *\n * @example\n * // Admin route\n * formatAdminURL({ adminRoute, path: `/collections/${slug}` })\n *\n * @example\n * // API route with query params\n * const queryString = qs.stringify({ where, limit, page }, { addQueryPrefix: true })\n * formatAdminURL({ apiRoute: api, path: `/${slug}${queryString}`, serverURL })\n */\ntype BaseFormatURLArgs = {\n  /**\n   * The subpath of your application, if specified.\n   * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/basePath\n   * @example '/docs'\n   */\n  basePath?: string\n  includeBasePath?: boolean\n  path?: '' | `/${string}` | null\n  /**\n   * Return a relative URL, e.g. ignore `serverURL`.\n   * Useful for route-matching, etc.\n   */\n  relative?: boolean\n} & Pick<Config, 'serverURL'>\n\ntype FormatURLArgs =\n  | ({\n      adminRoute: NonNullable<Config['routes']>['admin']\n      apiRoute?: never\n    } & BaseFormatURLArgs)\n  | ({\n      adminRoute?: never\n      apiRoute: NonNullable<Config['routes']>['api']\n    } & BaseFormatURLArgs)\n\nexport const formatAdminURL = (args: FormatURLArgs): string => {\n  const {\n    adminRoute,\n    apiRoute,\n    includeBasePath: includeBasePathArg,\n    path = '',\n    relative = false,\n    serverURL,\n  } = args\n  const basePath = process.env.NEXT_BASE_PATH || args.basePath || ''\n  const routePath = adminRoute || apiRoute\n  const segments = [routePath && routePath !== '/' && routePath, path && path].filter(Boolean)\n  const pathname = segments.join('') || '/'\n  const pathnameWithBase = stripTrailingSlash(basePath + pathname) || '/'\n  const includeBasePath = includeBasePathArg ?? (adminRoute ? false : true)\n\n  if (relative || !serverURL) {\n    if (includeBasePath && basePath) {\n      return applyTrailingSlash(pathnameWithBase)\n    }\n    return applyTrailingSlash(pathname)\n  }\n\n  const serverURLObj = new URL(serverURL)\n  return applyTrailingSlash(new URL(pathnameWithBase, serverURLObj.origin).toString())\n}\n\nexport const stripTrailingSlash = (path: string): string => {\n  if (path.length > 1 && path.endsWith('/')) {\n    return path.slice(0, -1)\n  }\n\n  return path\n}\n\nconst applyTrailingSlash = (url: string): string => {\n  if (process.env.NEXT_TRAILING_SLASH !== 'true') {\n    return url\n  }\n  const queryIndex = url.search(/[?#]/)\n  const pathPart = queryIndex === -1 ? url : url.slice(0, queryIndex)\n  const queryPart = queryIndex === -1 ? '' : url.slice(queryIndex)\n  if (pathPart.endsWith('/')) {\n    return url\n  }\n  return `${pathPart}/${queryPart}`\n}\n"],"names":["formatAdminURL","args","adminRoute","apiRoute","includeBasePath","includeBasePathArg","path","relative","serverURL","basePath","process","env","NEXT_BASE_PATH","routePath","segments","filter","Boolean","pathname","join","pathnameWithBase","stripTrailingSlash","applyTrailingSlash","serverURLObj","URL","origin","toString","length","endsWith","slice","url","NEXT_TRAILING_SLASH","queryIndex","search","pathPart","queryPart"],"mappings":"AA8CA,OAAO,MAAMA,iBAAiB,CAACC;IAC7B,MAAM,EACJC,UAAU,EACVC,QAAQ,EACRC,iBAAiBC,kBAAkB,EACnCC,OAAO,EAAE,EACTC,WAAW,KAAK,EAChBC,SAAS,EACV,GAAGP;IACJ,MAAMQ,WAAWC,QAAQC,GAAG,CAACC,cAAc,IAAIX,KAAKQ,QAAQ,IAAI;IAChE,MAAMI,YAAYX,cAAcC;IAChC,MAAMW,WAAW;QAACD,aAAaA,cAAc,OAAOA;QAAWP,QAAQA;KAAK,CAACS,MAAM,CAACC;IACpF,MAAMC,WAAWH,SAASI,IAAI,CAAC,OAAO;IACtC,MAAMC,mBAAmBC,mBAAmBX,WAAWQ,aAAa;IACpE,MAAMb,kBAAkBC,sBAAuBH,CAAAA,aAAa,QAAQ,IAAG;IAEvE,IAAIK,YAAY,CAACC,WAAW;QAC1B,IAAIJ,mBAAmBK,UAAU;YAC/B,OAAOY,mBAAmBF;QAC5B;QACA,OAAOE,mBAAmBJ;IAC5B;IAEA,MAAMK,eAAe,IAAIC,IAAIf;IAC7B,OAAOa,mBAAmB,IAAIE,IAAIJ,kBAAkBG,aAAaE,MAAM,EAAEC,QAAQ;AACnF,EAAC;AAED,OAAO,MAAML,qBAAqB,CAACd;IACjC,IAAIA,KAAKoB,MAAM,GAAG,KAAKpB,KAAKqB,QAAQ,CAAC,MAAM;QACzC,OAAOrB,KAAKsB,KAAK,CAAC,GAAG,CAAC;IACxB;IAEA,OAAOtB;AACT,EAAC;AAED,MAAMe,qBAAqB,CAACQ;IAC1B,IAAInB,QAAQC,GAAG,CAACmB,mBAAmB,KAAK,QAAQ;QAC9C,OAAOD;IACT;IACA,MAAME,aAAaF,IAAIG,MAAM,CAAC;IAC9B,MAAMC,WAAWF,eAAe,CAAC,IAAIF,MAAMA,IAAID,KAAK,CAAC,GAAGG;IACxD,MAAMG,YAAYH,eAAe,CAAC,IAAI,KAAKF,IAAID,KAAK,CAACG;IACrD,IAAIE,SAASN,QAAQ,CAAC,MAAM;QAC1B,OAAOE;IACT;IACA,OAAO,GAAGI,SAAS,CAAC,EAAEC,WAAW;AACnC"}

package/dist/utilities/formatErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formatErrors.d.ts","sourceRoot":"","sources":["../../src/utilities/formatErrors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAGhD,eAAO,MAAM,YAAY,aAAc;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,QAAQ,KAAG,WAmE9E,CAAA"}
+{"version":3,"file":"formatErrors.d.ts","sourceRoot":"","sources":["../../src/utilities/formatErrors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAGhD,eAAO,MAAM,YAAY,aAAc;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,QAAQ,KAAG,WAyE9E,CAAA"}

package/dist/utilities/formatErrors.js

@@ -5,7 +5,17 @@ export const formatErrors = (incoming)=>{
         // Payload 'ValidationError' and 'APIError'
         // Use duck-typing fallback alongside instanceof to handle bundlers (e.g. Vite)
         // that may load duplicate module instances, causing instanceof to fail.
-        if ((incoming instanceof ValidationError || incoming instanceof APIError || 'isOperational' in incoming && incoming.isOperational === true) && incoming.data) {
+        const isPayloadError = incoming instanceof ValidationError || incoming instanceof APIError || 'isOperational' in incoming && incoming.isOperational === true;
+        if (isPayloadError) {
+            if (!incoming.data) {
+                return {
+                    errors: [
+                        {
+                            message: incoming.message
+                        }
+                    ]
+                };
+            }
             return {
                 errors: [
                     {

package/dist/utilities/formatErrors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/formatErrors.ts"],"sourcesContent":["import type { ErrorResult } from '../config/types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { ValidationError } from '../errors/ValidationError.js'\n\nexport const formatErrors = (incoming: { [key: string]: unknown } | APIError): ErrorResult => {\n  if (incoming) {\n    // Payload 'ValidationError' and 'APIError'\n    // Use duck-typing fallback alongside instanceof to handle bundlers (e.g. Vite)\n    // that may load duplicate module instances, causing instanceof to fail.\n    if (\n      (incoming instanceof ValidationError ||\n        incoming instanceof APIError ||\n        ('isOperational' in incoming && incoming.isOperational === true)) &&\n      incoming.data\n    ) {\n      return {\n        errors: [\n          {\n            name: incoming.name as string | undefined,\n            data: incoming.data as Record<string, unknown>,\n            message: incoming.message as string | undefined,\n          },\n        ],\n      }\n    }\n\n    // Mongoose 'ValidationError': https://mongoosejs.com/docs/api/error.html#Error.ValidationError\n    if (\n      'name' in incoming &&\n      incoming.name === 'ValidationError' &&\n      'errors' in incoming &&\n      incoming.errors\n    ) {\n      return {\n        errors: Object.keys(incoming.errors).reduce(\n          (acc, key) => {\n            acc.push({\n              field: (incoming.errors as any)[key].path,\n              message: (incoming.errors as any)[key].message,\n            })\n            return acc\n          },\n          [] as { field: string; message: string }[],\n        ),\n      }\n    }\n\n    if (Array.isArray(incoming.message)) {\n      return {\n        errors: incoming.message,\n      }\n    }\n\n    if (incoming.name) {\n      return {\n        errors: [\n          {\n            message: incoming.message as string,\n          },\n        ],\n      }\n    }\n  }\n\n  return {\n    errors: [\n      {\n        message: 'An unknown error occurred.',\n      },\n    ],\n  }\n}\n"],"names":["APIError","ValidationError","formatErrors","incoming","isOperational","data","errors","name","message","Object","keys","reduce","acc","key","push","field","path","Array","isArray"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,eAAe,QAAQ,+BAA8B;AAE9D,OAAO,MAAMC,eAAe,CAACC;IAC3B,IAAIA,UAAU;QACZ,2CAA2C;QAC3C,+EAA+E;QAC/E,wEAAwE;QACxE,IACE,AAACA,CAAAA,oBAAoBF,mBACnBE,oBAAoBH,YACnB,mBAAmBG,YAAYA,SAASC,aAAa,KAAK,IAAI,KACjED,SAASE,IAAI,EACb;YACA,OAAO;gBACLC,QAAQ;oBACN;wBACEC,MAAMJ,SAASI,IAAI;wBACnBF,MAAMF,SAASE,IAAI;wBACnBG,SAASL,SAASK,OAAO;oBAC3B;iBACD;YACH;QACF;QAEA,+FAA+F;QAC/F,IACE,UAAUL,YACVA,SAASI,IAAI,KAAK,qBAClB,YAAYJ,YACZA,SAASG,MAAM,EACf;YACA,OAAO;gBACLA,QAAQG,OAAOC,IAAI,CAACP,SAASG,MAAM,EAAEK,MAAM,CACzC,CAACC,KAAKC;oBACJD,IAAIE,IAAI,CAAC;wBACPC,OAAO,AAACZ,SAASG,MAAM,AAAQ,CAACO,IAAI,CAACG,IAAI;wBACzCR,SAAS,AAACL,SAASG,MAAM,AAAQ,CAACO,IAAI,CAACL,OAAO;oBAChD;oBACA,OAAOI;gBACT,GACA,EAAE;YAEN;QACF;QAEA,IAAIK,MAAMC,OAAO,CAACf,SAASK,OAAO,GAAG;YACnC,OAAO;gBACLF,QAAQH,SAASK,OAAO;YAC1B;QACF;QAEA,IAAIL,SAASI,IAAI,EAAE;YACjB,OAAO;gBACLD,QAAQ;oBACN;wBACEE,SAASL,SAASK,OAAO;oBAC3B;iBACD;YACH;QACF;IACF;IAEA,OAAO;QACLF,QAAQ;YACN;gBACEE,SAAS;YACX;SACD;IACH;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/formatErrors.ts"],"sourcesContent":["import type { ErrorResult } from '../config/types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { ValidationError } from '../errors/ValidationError.js'\n\nexport const formatErrors = (incoming: { [key: string]: unknown } | APIError): ErrorResult => {\n  if (incoming) {\n    // Payload 'ValidationError' and 'APIError'\n    // Use duck-typing fallback alongside instanceof to handle bundlers (e.g. Vite)\n    // that may load duplicate module instances, causing instanceof to fail.\n    const isPayloadError =\n      incoming instanceof ValidationError ||\n      incoming instanceof APIError ||\n      ('isOperational' in incoming && incoming.isOperational === true)\n\n    if (isPayloadError) {\n      if (!incoming.data) {\n        return {\n          errors: [{ message: incoming.message as string | undefined }],\n        }\n      }\n\n      return {\n        errors: [\n          {\n            name: incoming.name as string | undefined,\n            data: incoming.data as Record<string, unknown>,\n            message: incoming.message as string | undefined,\n          },\n        ],\n      }\n    }\n\n    // Mongoose 'ValidationError': https://mongoosejs.com/docs/api/error.html#Error.ValidationError\n    if (\n      'name' in incoming &&\n      incoming.name === 'ValidationError' &&\n      'errors' in incoming &&\n      incoming.errors\n    ) {\n      return {\n        errors: Object.keys(incoming.errors).reduce(\n          (acc, key) => {\n            acc.push({\n              field: (incoming.errors as any)[key].path,\n              message: (incoming.errors as any)[key].message,\n            })\n            return acc\n          },\n          [] as { field: string; message: string }[],\n        ),\n      }\n    }\n\n    if (Array.isArray(incoming.message)) {\n      return {\n        errors: incoming.message,\n      }\n    }\n\n    if (incoming.name) {\n      return {\n        errors: [\n          {\n            message: incoming.message as string,\n          },\n        ],\n      }\n    }\n  }\n\n  return {\n    errors: [\n      {\n        message: 'An unknown error occurred.',\n      },\n    ],\n  }\n}\n"],"names":["APIError","ValidationError","formatErrors","incoming","isPayloadError","isOperational","data","errors","message","name","Object","keys","reduce","acc","key","push","field","path","Array","isArray"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,eAAe,QAAQ,+BAA8B;AAE9D,OAAO,MAAMC,eAAe,CAACC;IAC3B,IAAIA,UAAU;QACZ,2CAA2C;QAC3C,+EAA+E;QAC/E,wEAAwE;QACxE,MAAMC,iBACJD,oBAAoBF,mBACpBE,oBAAoBH,YACnB,mBAAmBG,YAAYA,SAASE,aAAa,KAAK;QAE7D,IAAID,gBAAgB;YAClB,IAAI,CAACD,SAASG,IAAI,EAAE;gBAClB,OAAO;oBACLC,QAAQ;wBAAC;4BAAEC,SAASL,SAASK,OAAO;wBAAuB;qBAAE;gBAC/D;YACF;YAEA,OAAO;gBACLD,QAAQ;oBACN;wBACEE,MAAMN,SAASM,IAAI;wBACnBH,MAAMH,SAASG,IAAI;wBACnBE,SAASL,SAASK,OAAO;oBAC3B;iBACD;YACH;QACF;QAEA,+FAA+F;QAC/F,IACE,UAAUL,YACVA,SAASM,IAAI,KAAK,qBAClB,YAAYN,YACZA,SAASI,MAAM,EACf;YACA,OAAO;gBACLA,QAAQG,OAAOC,IAAI,CAACR,SAASI,MAAM,EAAEK,MAAM,CACzC,CAACC,KAAKC;oBACJD,IAAIE,IAAI,CAAC;wBACPC,OAAO,AAACb,SAASI,MAAM,AAAQ,CAACO,IAAI,CAACG,IAAI;wBACzCT,SAAS,AAACL,SAASI,MAAM,AAAQ,CAACO,IAAI,CAACN,OAAO;oBAChD;oBACA,OAAOK;gBACT,GACA,EAAE;YAEN;QACF;QAEA,IAAIK,MAAMC,OAAO,CAAChB,SAASK,OAAO,GAAG;YACnC,OAAO;gBACLD,QAAQJ,SAASK,OAAO;YAC1B;QACF;QAEA,IAAIL,SAASM,IAAI,EAAE;YACjB,OAAO;gBACLF,QAAQ;oBACN;wBACEC,SAASL,SAASK,OAAO;oBAC3B;iBACD;YACH;QACF;IACF;IAEA,OAAO;QACLD,QAAQ;YACN;gBACEC,SAAS;YACX;SACD;IACH;AACF,EAAC"}

package/dist/utilities/getAccessOperationRequest.d.ts

@@ -0,0 +1,10 @@
+import type { Operation, PayloadRequest } from '../types/index.js';
+/**
+ * Returns a request view whose active operation is isolated from the caller and sibling access
+ * policies. Runtime services and transaction identity remain shared with the original request.
+ */
+export declare function getAccessOperationRequest({ operation, req, }: {
+    operation: Operation;
+    req: PayloadRequest;
+}): PayloadRequest;
+//# sourceMappingURL=getAccessOperationRequest.d.ts.map

package/dist/utilities/getAccessOperationRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAccessOperationRequest.d.ts","sourceRoot":"","sources":["../../src/utilities/getAccessOperationRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIlE;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,SAAS,EACT,GAAG,GACJ,EAAE;IACD,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,cAAc,CAMjB"}

package/dist/utilities/getAccessOperationRequest.js

@@ -0,0 +1,11 @@
+import { isolateObjectProperty } from './isolateObjectProperty.js';
+/**
+ * Returns a request view whose active operation is isolated from the caller and sibling access
+ * policies. Runtime services and transaction identity remain shared with the original request.
+ */ export function getAccessOperationRequest({ operation, req }) {
+    const operationRequest = isolateObjectProperty(req, 'operation');
+    operationRequest.operation = operation;
+    return operationRequest;
+}
+
+//# sourceMappingURL=getAccessOperationRequest.js.map

package/dist/utilities/getAccessOperationRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getAccessOperationRequest.ts"],"sourcesContent":["import type { Operation, PayloadRequest } from '../types/index.js'\n\nimport { isolateObjectProperty } from './isolateObjectProperty.js'\n\n/**\n * Returns a request view whose active operation is isolated from the caller and sibling access\n * policies. Runtime services and transaction identity remain shared with the original request.\n */\nexport function getAccessOperationRequest({\n  operation,\n  req,\n}: {\n  operation: Operation\n  req: PayloadRequest\n}): PayloadRequest {\n  const operationRequest = isolateObjectProperty(req, 'operation')\n\n  operationRequest.operation = operation\n\n  return operationRequest\n}\n"],"names":["isolateObjectProperty","getAccessOperationRequest","operation","req","operationRequest"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,6BAA4B;AAElE;;;CAGC,GACD,OAAO,SAASC,0BAA0B,EACxCC,SAAS,EACTC,GAAG,EAIJ;IACC,MAAMC,mBAAmBJ,sBAAsBG,KAAK;IAEpDC,iBAAiBF,SAAS,GAAGA;IAE7B,OAAOE;AACT"}

package/dist/utilities/getEntityPermissions/entityDocExists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entityDocExists.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/entityDocExists.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,KAAK,EACX,MAAM,gBAAgB,CAAA;AAEvB;;GAEG;AACH,wBAAsB,eAAe,CAAC,EACpC,EAAE,EACF,IAAI,EACJ,UAAU,EACV,MAAM,EACN,SAAS,EACT,GAAG,EACH,KAAK,GACN,EAAE;IACD,UAAU,EAAE,YAAY,GAAG,QAAQ,CAAA;IACnC,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,KAAK,CAAA;CACb,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCnB"}
+{"version":3,"file":"entityDocExists.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/entityDocExists.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,KAAK,EACX,MAAM,gBAAgB,CAAA;AAIvB;;GAEG;AACH,wBAAsB,eAAe,CAAC,EACpC,EAAE,EACF,IAAI,EACJ,UAAU,EACV,MAAM,EACN,SAAS,EACT,GAAG,EACH,KAAK,GACN,EAAE;IACD,UAAU,EAAE,YAAY,GAAG,QAAQ,CAAA;IACnC,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,KAAK,CAAA;CACb,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}

package/dist/utilities/getEntityPermissions/entityDocExists.js

@@ -1,8 +1,29 @@
+import { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js';
 import { combineQueries } from '../../index.js';
+import { buildVersionCollectionFields } from '../../versions/buildCollectionFields.js';
+import { buildVersionGlobalFields } from '../../versions/buildGlobalFields.js';
 /**
  * Returns whether or not the entity doc exists based on the where query.
  */ export async function entityDocExists({ id, slug, entityType, locale, operation, req, where }) {
     if (entityType === 'global') {
+        if (operation === 'readVersions') {
+            const global = req.payload.globals.config.find(({ slug: globalSlug })=>globalSlug === slug);
+            if (!global) {
+                return false;
+            }
+            sanitizeWhereQuery({
+                fields: buildVersionGlobalFields(req.payload.config, global, true),
+                payload: req.payload,
+                where
+            });
+            const count = await req.payload.db.countGlobalVersions({
+                global: slug,
+                locale,
+                req,
+                where
+            });
+            return count.totalDocs > 0;
+        }
         const global = await req.payload.db.findGlobal({
             slug,
             locale,
@@ -15,15 +36,25 @@ import { combineQueries } from '../../index.js';
     }
     if (entityType === 'collection' && id) {
         if (operation === 'readVersions') {
+            const collection = req.payload.collections[slug]?.config;
+            if (!collection) {
+                return false;
+            }
+            const fullWhere = combineQueries(where, {
+                parent: {
+                    equals: id
+                }
+            });
+            sanitizeWhereQuery({
+                fields: buildVersionCollectionFields(req.payload.config, collection, true),
+                payload: req.payload,
+                where: fullWhere
+            });
             const count = await req.payload.db.countVersions({
                 collection: slug,
                 locale,
                 req,
-                where: combineQueries(where, {
-                    parent: {
-                        equals: id
-                    }
-                })
+                where: fullWhere
             });
             return count.totalDocs > 0;
         }

package/dist/utilities/getEntityPermissions/entityDocExists.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utilities/getEntityPermissions/entityDocExists.ts"],"sourcesContent":["import {\n  type AllOperations,\n  combineQueries,\n  type DefaultDocumentIDType,\n  type PayloadRequest,\n  type Where,\n} from '../../index.js'\n\n/**\n * Returns whether or not the entity doc exists based on the where query.\n */\nexport async function entityDocExists({\n  id,\n  slug,\n  entityType,\n  locale,\n  operation,\n  req,\n  where,\n}: {\n  entityType: 'collection' | 'global'\n  id?: DefaultDocumentIDType\n  locale?: string\n  operation?: AllOperations\n  req: PayloadRequest\n  slug: string\n  where: Where\n}): Promise<boolean> {\n  if (entityType === 'global') {\n    const global = await req.payload.db.findGlobal({\n      slug,\n      locale,\n      req,\n      select: {},\n      where,\n    })\n\n    const hasGlobalDoc = Boolean(global && Object.keys(global).length > 0)\n\n    return hasGlobalDoc\n  }\n\n  if (entityType === 'collection' && id) {\n    if (operation === 'readVersions') {\n      const count = await req.payload.db.countVersions({\n        collection: slug,\n        locale,\n        req,\n        where: combineQueries(where, { parent: { equals: id } }),\n      })\n      return count.totalDocs > 0\n    }\n\n    const count = await req.payload.db.count({\n      collection: slug,\n      locale,\n      req,\n      where: combineQueries(where, { id: { equals: id } }),\n    })\n\n    return count.totalDocs > 0\n  }\n\n  return false\n}\n"],"names":["combineQueries","entityDocExists","id","slug","entityType","locale","operation","req","where","global","payload","db","findGlobal","select","hasGlobalDoc","Boolean","Object","keys","length","count","countVersions","collection","parent","equals","totalDocs"],"mappings":"AAAA,SAEEA,cAAc,QAIT,iBAAgB;AAEvB;;CAEC,GACD,OAAO,eAAeC,gBAAgB,EACpCC,EAAE,EACFC,IAAI,EACJC,UAAU,EACVC,MAAM,EACNC,SAAS,EACTC,GAAG,EACHC,KAAK,EASN;IACC,IAAIJ,eAAe,UAAU;QAC3B,MAAMK,SAAS,MAAMF,IAAIG,OAAO,CAACC,EAAE,CAACC,UAAU,CAAC;YAC7CT;YACAE;YACAE;YACAM,QAAQ,CAAC;YACTL;QACF;QAEA,MAAMM,eAAeC,QAAQN,UAAUO,OAAOC,IAAI,CAACR,QAAQS,MAAM,GAAG;QAEpE,OAAOJ;IACT;IAEA,IAAIV,eAAe,gBAAgBF,IAAI;QACrC,IAAII,cAAc,gBAAgB;YAChC,MAAMa,QAAQ,MAAMZ,IAAIG,OAAO,CAACC,EAAE,CAACS,aAAa,CAAC;gBAC/CC,YAAYlB;gBACZE;gBACAE;gBACAC,OAAOR,eAAeQ,OAAO;oBAAEc,QAAQ;wBAAEC,QAAQrB;oBAAG;gBAAE;YACxD;YACA,OAAOiB,MAAMK,SAAS,GAAG;QAC3B;QAEA,MAAML,QAAQ,MAAMZ,IAAIG,OAAO,CAACC,EAAE,CAACQ,KAAK,CAAC;YACvCE,YAAYlB;YACZE;YACAE;YACAC,OAAOR,eAAeQ,OAAO;gBAAEN,IAAI;oBAAEqB,QAAQrB;gBAAG;YAAE;QACpD;QAEA,OAAOiB,MAAMK,SAAS,GAAG;IAC3B;IAEA,OAAO;AACT"}
+{"version":3,"sources":["../../../src/utilities/getEntityPermissions/entityDocExists.ts"],"sourcesContent":["import { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js'\nimport {\n  type AllOperations,\n  combineQueries,\n  type DefaultDocumentIDType,\n  type PayloadRequest,\n  type Where,\n} from '../../index.js'\nimport { buildVersionCollectionFields } from '../../versions/buildCollectionFields.js'\nimport { buildVersionGlobalFields } from '../../versions/buildGlobalFields.js'\n\n/**\n * Returns whether or not the entity doc exists based on the where query.\n */\nexport async function entityDocExists({\n  id,\n  slug,\n  entityType,\n  locale,\n  operation,\n  req,\n  where,\n}: {\n  entityType: 'collection' | 'global'\n  id?: DefaultDocumentIDType\n  locale?: string\n  operation?: AllOperations\n  req: PayloadRequest\n  slug: string\n  where: Where\n}): Promise<boolean> {\n  if (entityType === 'global') {\n    if (operation === 'readVersions') {\n      const global = req.payload.globals.config.find(({ slug: globalSlug }) => globalSlug === slug)\n\n      if (!global) {\n        return false\n      }\n\n      sanitizeWhereQuery({\n        fields: buildVersionGlobalFields(req.payload.config, global, true),\n        payload: req.payload,\n        where,\n      })\n\n      const count = await req.payload.db.countGlobalVersions({\n        global: slug,\n        locale,\n        req,\n        where,\n      })\n\n      return count.totalDocs > 0\n    }\n\n    const global = await req.payload.db.findGlobal({\n      slug,\n      locale,\n      req,\n      select: {},\n      where,\n    })\n\n    const hasGlobalDoc = Boolean(global && Object.keys(global).length > 0)\n\n    return hasGlobalDoc\n  }\n\n  if (entityType === 'collection' && id) {\n    if (operation === 'readVersions') {\n      const collection = req.payload.collections[slug]?.config\n\n      if (!collection) {\n        return false\n      }\n\n      const fullWhere = combineQueries(where, { parent: { equals: id } })\n\n      sanitizeWhereQuery({\n        fields: buildVersionCollectionFields(req.payload.config, collection, true),\n        payload: req.payload,\n        where: fullWhere,\n      })\n\n      const count = await req.payload.db.countVersions({\n        collection: slug,\n        locale,\n        req,\n        where: fullWhere,\n      })\n      return count.totalDocs > 0\n    }\n\n    const count = await req.payload.db.count({\n      collection: slug,\n      locale,\n      req,\n      where: combineQueries(where, { id: { equals: id } }),\n    })\n\n    return count.totalDocs > 0\n  }\n\n  return false\n}\n"],"names":["sanitizeWhereQuery","combineQueries","buildVersionCollectionFields","buildVersionGlobalFields","entityDocExists","id","slug","entityType","locale","operation","req","where","global","payload","globals","config","find","globalSlug","fields","count","db","countGlobalVersions","totalDocs","findGlobal","select","hasGlobalDoc","Boolean","Object","keys","length","collection","collections","fullWhere","parent","equals","countVersions"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,uCAAsC;AACzE,SAEEC,cAAc,QAIT,iBAAgB;AACvB,SAASC,4BAA4B,QAAQ,0CAAyC;AACtF,SAASC,wBAAwB,QAAQ,sCAAqC;AAE9E;;CAEC,GACD,OAAO,eAAeC,gBAAgB,EACpCC,EAAE,EACFC,IAAI,EACJC,UAAU,EACVC,MAAM,EACNC,SAAS,EACTC,GAAG,EACHC,KAAK,EASN;IACC,IAAIJ,eAAe,UAAU;QAC3B,IAAIE,cAAc,gBAAgB;YAChC,MAAMG,SAASF,IAAIG,OAAO,CAACC,OAAO,CAACC,MAAM,CAACC,IAAI,CAAC,CAAC,EAAEV,MAAMW,UAAU,EAAE,GAAKA,eAAeX;YAExF,IAAI,CAACM,QAAQ;gBACX,OAAO;YACT;YAEAZ,mBAAmB;gBACjBkB,QAAQf,yBAAyBO,IAAIG,OAAO,CAACE,MAAM,EAAEH,QAAQ;gBAC7DC,SAASH,IAAIG,OAAO;gBACpBF;YACF;YAEA,MAAMQ,QAAQ,MAAMT,IAAIG,OAAO,CAACO,EAAE,CAACC,mBAAmB,CAAC;gBACrDT,QAAQN;gBACRE;gBACAE;gBACAC;YACF;YAEA,OAAOQ,MAAMG,SAAS,GAAG;QAC3B;QAEA,MAAMV,SAAS,MAAMF,IAAIG,OAAO,CAACO,EAAE,CAACG,UAAU,CAAC;YAC7CjB;YACAE;YACAE;YACAc,QAAQ,CAAC;YACTb;QACF;QAEA,MAAMc,eAAeC,QAAQd,UAAUe,OAAOC,IAAI,CAAChB,QAAQiB,MAAM,GAAG;QAEpE,OAAOJ;IACT;IAEA,IAAIlB,eAAe,gBAAgBF,IAAI;QACrC,IAAII,cAAc,gBAAgB;YAChC,MAAMqB,aAAapB,IAAIG,OAAO,CAACkB,WAAW,CAACzB,KAAK,EAAES;YAElD,IAAI,CAACe,YAAY;gBACf,OAAO;YACT;YAEA,MAAME,YAAY/B,eAAeU,OAAO;gBAAEsB,QAAQ;oBAAEC,QAAQ7B;gBAAG;YAAE;YAEjEL,mBAAmB;gBACjBkB,QAAQhB,6BAA6BQ,IAAIG,OAAO,CAACE,MAAM,EAAEe,YAAY;gBACrEjB,SAASH,IAAIG,OAAO;gBACpBF,OAAOqB;YACT;YAEA,MAAMb,QAAQ,MAAMT,IAAIG,OAAO,CAACO,EAAE,CAACe,aAAa,CAAC;gBAC/CL,YAAYxB;gBACZE;gBACAE;gBACAC,OAAOqB;YACT;YACA,OAAOb,MAAMG,SAAS,GAAG;QAC3B;QAEA,MAAMH,QAAQ,MAAMT,IAAIG,OAAO,CAACO,EAAE,CAACD,KAAK,CAAC;YACvCW,YAAYxB;YACZE;YACAE;YACAC,OAAOV,eAAeU,OAAO;gBAAEN,IAAI;oBAAE6B,QAAQ7B;gBAAG;YAAE;QACpD;QAEA,OAAOc,MAAMG,SAAS,GAAG;IAC3B;IAEA,OAAO;AACT"}

package/dist/utilities/getEntityPermissions/getEntityPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getEntityPermissions.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EAEpB,gBAAgB,EAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAO5F,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAC7C,SAAS,EACT,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAC7C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAE/C,KAAK,UAAU,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI,WAAW,SAAS,QAAQ,GACvF,gBAAgB,GAChB,oBAAoB,CAAA;AAExB,KAAK,IAAI,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI;IACvD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,WAAW,SAAS,YAAY,GAAG,yBAAyB,GAAG,qBAAqB,CAAA;IAC5F,UAAU,EAAE,WAAW,CAAA;IACvB;;OAEG;IACH,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,KAAK,CAAA;IAChB,EAAE,CAAC,EAAE,KAAK,CAAA;CACX,GACD;IACE,SAAS,EAAE,IAAI,CAAA;IACf,EAAE,EAAE,WAAW,SAAS,YAAY,GAAG,qBAAqB,GAAG,SAAS,CAAA;CACzE,CACJ,CAAA;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,EACpF,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GACtB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CA0JlC"}
+{"version":3,"file":"getEntityPermissions.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EAEpB,gBAAgB,EAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAQ5F,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAC7C,SAAS,EACT,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAC7C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAE/C,KAAK,UAAU,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI,WAAW,SAAS,QAAQ,GACvF,gBAAgB,GAChB,oBAAoB,CAAA;AAExB,KAAK,IAAI,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,IAAI;IACvD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,WAAW,SAAS,YAAY,GAAG,yBAAyB,GAAG,qBAAqB,CAAA;IAC5F,UAAU,EAAE,WAAW,CAAA;IACvB;;OAEG;IACH,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,KAAK,CAAA;IAChB,EAAE,CAAC,EAAE,KAAK,CAAA;CACX,GACD;IACE,SAAS,EAAE,IAAI,CAAA;IACf,EAAE,EAAE,WAAW,SAAS,YAAY,GAAG,qBAAqB,GAAG,SAAS,CAAA;CACzE,CACJ,CAAA;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,SAAS,YAAY,GAAG,QAAQ,EACpF,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GACtB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAuKlC"}

package/dist/utilities/getEntityPermissions/getEntityPermissions.js

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from 'util';
+import { getAccessOperationRequest } from '../getAccessOperationRequest.js';
 import { entityDocExists } from './entityDocExists.js';
 import { populateFieldPermissions } from './populateFieldPermissions.js';
 const topLevelCollectionPermissions = [
@@ -7,12 +8,14 @@ const topLevelCollectionPermissions = [
     'read',
     'readVersions',
     'update',
+    'validate',
     'unlock'
 ];
 const topLevelGlobalPermissions = [
     'read',
     'readVersions',
-    'update'
+    'update',
+    'validate'
 ];
 /**
  * Build up permissions object for an entity (collection or global).
@@ -83,8 +86,12 @@ const topLevelGlobalPermissions = [
                     operation,
                     result: Promise.resolve(accessFunction({
                         id,
+                        slug: entity.slug,
                         data,
-                        req
+                        req: _operation === 'readVersions' || _operation === 'unlock' ? req : getAccessOperationRequest({
+                            operation: _operation,
+                            req
+                        })
                     }))
                 });
             } else {

package/dist/utilities/getEntityPermissions/getEntityPermissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"sourcesContent":["import { isDeepStrictEqual } from 'util'\n\nimport type {\n  BlockPermissions,\n  CollectionPermission,\n  FieldsPermissions,\n  GlobalPermission,\n  Permission,\n} from '../../auth/types.js'\nimport type { SanitizedCollectionConfig, TypeWithID } from '../../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { BlockSlug, DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest, Where } from '../../types/index.js'\n\nimport { entityDocExists } from './entityDocExists.js'\nimport { populateFieldPermissions } from './populateFieldPermissions.js'\n\ntype WhereQueryCache = { result: Promise<boolean>; where: Where }[]\n\nexport type BlockReferencesPermissions = Record<\n  BlockSlug,\n  BlockPermissions | Promise<BlockPermissions>\n>\n\nexport type EntityDoc = JsonObject | TypeWithID\n\ntype ReturnType<TEntityType extends 'collection' | 'global'> = TEntityType extends 'global'\n  ? GlobalPermission\n  : CollectionPermission\n\ntype Args<TEntityType extends 'collection' | 'global'> = {\n  blockReferencesPermissions: BlockReferencesPermissions\n  /**\n   * If the document data is passed, it will be used to check access instead of fetching the document from the database.\n   */\n  data?: JsonObject\n  entity: TEntityType extends 'collection' ? SanitizedCollectionConfig : SanitizedGlobalConfig\n  entityType: TEntityType\n  /**\n   * Operations to check access for\n   */\n  operations: AllOperations[]\n  req: PayloadRequest\n} & (\n  | {\n      fetchData: false\n      id?: never\n    }\n  | {\n      fetchData: true\n      id: TEntityType extends 'collection' ? DefaultDocumentIDType : undefined\n    }\n)\n\nconst topLevelCollectionPermissions = [\n  'create',\n  'delete',\n  'read',\n  'readVersions',\n  'update',\n  'unlock',\n]\nconst topLevelGlobalPermissions = ['read', 'readVersions', 'update']\n\n/**\n * Build up permissions object for an entity (collection or global).\n * This is not run during any update and reflects the current state of the entity data => doc and data is the same.\n *\n * When `fetchData` is false:\n * - returned `Where` are not run and evaluated as \"does not have permission\".\n * - If req.data is passed: `data` and `doc` is passed to access functions.\n * - If req.data is not passed: `data` and `doc` is not passed to access functions.\n *\n * When `fetchData` is true:\n * - `Where` are run and evaluated as \"has permission\" or \"does not have permission\".\n * - `data` and `doc` are always passed to access functions.\n * - Error is thrown if `entityType` is 'collection' and `id` is not passed.\n *\n * In both cases:\n * We cannot include siblingData or blockData here, as we do not have siblingData available once we reach block or array\n * rows, as we're calculating schema permissions, which do not include individual rows.\n * For consistency, it's thus better to never include the siblingData and blockData\n *\n * @internal\n */\nexport async function getEntityPermissions<TEntityType extends 'collection' | 'global'>(\n  args: Args<TEntityType>,\n): Promise<ReturnType<TEntityType>> {\n  const {\n    id,\n    blockReferencesPermissions,\n    data: _data,\n    entity,\n    entityType,\n    fetchData,\n    operations,\n    req,\n  } = args\n  const { locale: _locale, user } = req\n\n  const locale = _locale ? _locale : undefined\n\n  if (fetchData && entityType === 'collection' && !id) {\n    throw new Error('ID is required when fetching data for a collection')\n  }\n\n  const hasData = _data && Object.keys(_data).length > 0\n  const data: JsonObject | undefined = hasData\n    ? _data\n    : fetchData\n      ? await (async () => {\n          if (entityType === 'global') {\n            return req.payload.findGlobal({\n              slug: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n            })\n          }\n\n          if (entityType === 'collection') {\n            return req.payload.findByID({\n              id: id!,\n              collection: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n              trash: true,\n            })\n          }\n        })()\n      : undefined\n\n  const isLoggedIn = !!user\n\n  const fieldsPermissions: FieldsPermissions = {}\n\n  const entityPermissions: ReturnType<TEntityType> = {\n    fields: fieldsPermissions,\n  } as ReturnType<TEntityType>\n\n  const promises: Promise<void>[] = []\n\n  // Phase 1: Resolve all access functions to get where queries\n  const accessResults: {\n    operation: keyof typeof entity.access\n    result: Promise<boolean | Where>\n  }[] = []\n\n  for (const _operation of operations) {\n    const operation = _operation as keyof typeof entity.access\n    const accessFunction = entity.access[operation]\n\n    if (\n      (entityType === 'collection' && topLevelCollectionPermissions.includes(operation)) ||\n      (entityType === 'global' && topLevelGlobalPermissions.includes(operation))\n    ) {\n      if (typeof accessFunction === 'function') {\n        accessResults.push({\n          operation,\n          result: Promise.resolve(accessFunction({ id, data, req })) as Promise<boolean | Where>,\n        })\n      } else {\n        entityPermissions[operation] = {\n          permission: isLoggedIn,\n        }\n      }\n    }\n  }\n\n  // Await all access functions in parallel\n  const resolvedAccessResults = await Promise.all(\n    accessResults.map(async (item) => ({\n      operation: item.operation,\n      result: await item.result,\n    })),\n  )\n\n  // Phase 2: Process where queries with cache and resolve in parallel\n  const whereQueryCache: WhereQueryCache = []\n  const wherePromises: Promise<void>[] = []\n\n  for (const { operation, result: accessResult } of resolvedAccessResults) {\n    if (typeof accessResult === 'object') {\n      processWhereQuery({\n        id,\n        slug: entity.slug,\n        accessResult,\n        entityPermissions,\n        entityType,\n        fetchData,\n        locale,\n        operation,\n        req,\n        wherePromises,\n        whereQueryCache,\n      })\n    } else if (entityPermissions[operation]?.permission !== false) {\n      entityPermissions[operation] = { permission: !!accessResult }\n    }\n  }\n\n  // Await all where query DB calls in parallel\n  await Promise.all(wherePromises)\n\n  populateFieldPermissions({\n    blockReferencesPermissions,\n    collection: entityType === 'collection' ? (entity as SanitizedCollectionConfig) : null,\n    data,\n    fields: entity.fields,\n    global: entityType === 'global' ? (entity as SanitizedGlobalConfig) : null,\n    operations,\n    parentPermissionsObject: entityPermissions,\n    permissionsObject: fieldsPermissions,\n    promises,\n    req,\n  })\n\n  /**\n   * Await all promises in parallel.\n   * A promise can add more promises to the promises array (group of fields calls populateFieldPermissions again in their own promise), which will not be\n   * awaited in the first run.\n   * This is why we need to loop again to process the new promises, until there are no more promises left.\n   */\n  let iterations = 0\n  while (promises.length > 0) {\n    const currentPromises = promises.splice(0, promises.length)\n\n    await Promise.all(currentPromises)\n\n    iterations++\n    if (iterations >= 100) {\n      throw new Error('Infinite getEntityPermissions promise loop detected.')\n    }\n  }\n\n  return entityPermissions\n}\n\nconst processWhereQuery = ({\n  id,\n  slug,\n  accessResult,\n  entityPermissions,\n  entityType,\n  fetchData,\n  locale,\n  operation,\n  req,\n  wherePromises,\n  whereQueryCache,\n}: {\n  accessResult: Where\n  entityPermissions: CollectionPermission | GlobalPermission\n  entityType: 'collection' | 'global'\n  fetchData: boolean\n  id?: DefaultDocumentIDType\n  locale?: string\n  operation: Extract<keyof (CollectionPermission | GlobalPermission), AllOperations>\n  req: PayloadRequest\n  slug: string\n  wherePromises: Promise<void>[]\n  whereQueryCache: WhereQueryCache\n}): void => {\n  if (fetchData) {\n    // Check cache for identical where query using deep comparison\n    let cached = whereQueryCache.find((entry) => isDeepStrictEqual(entry.where, accessResult))\n\n    if (!cached) {\n      // Cache miss - start DB query (don't await)\n      cached = {\n        result: entityDocExists({\n          id,\n          slug,\n          entityType,\n          locale,\n          operation,\n          req,\n          where: accessResult,\n        }),\n        where: accessResult,\n      }\n      whereQueryCache.push(cached)\n    }\n\n    // Defer resolution to Promise.all (cache hits reuse same promise)\n    wherePromises.push(\n      cached.result.then((hasPermission) => {\n        entityPermissions[operation] = {\n          permission: hasPermission,\n          where: accessResult,\n        } as Permission\n      }),\n    )\n  } else {\n    // TODO: 4.0: Investigate defaulting to `false` here, if where query is returned but ignored as we don't\n    // have the document data available. This seems more secure.\n    // Alternatively, we could set permission to a third state, like 'unknown'.\n    // Even after calling sanitizePermissions, the permissions will still be true if the where query is returned but ignored as we don't have the document data available.\n    entityPermissions[operation] = { permission: true, where: accessResult } as Permission\n  }\n}\n"],"names":["isDeepStrictEqual","entityDocExists","populateFieldPermissions","topLevelCollectionPermissions","topLevelGlobalPermissions","getEntityPermissions","args","id","blockReferencesPermissions","data","_data","entity","entityType","fetchData","operations","req","locale","_locale","user","undefined","Error","hasData","Object","keys","length","payload","findGlobal","slug","depth","fallbackLocale","overrideAccess","findByID","collection","trash","isLoggedIn","fieldsPermissions","entityPermissions","fields","promises","accessResults","_operation","operation","accessFunction","access","includes","push","result","Promise","resolve","permission","resolvedAccessResults","all","map","item","whereQueryCache","wherePromises","accessResult","processWhereQuery","global","parentPermissionsObject","permissionsObject","iterations","currentPromises","splice","cached","find","entry","where","then","hasPermission"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,OAAM;AAcxC,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,wBAAwB,QAAQ,gCAA+B;AAuCxE,MAAMC,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;CACD;AACD,MAAMC,4BAA4B;IAAC;IAAQ;IAAgB;CAAS;AAEpE;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,eAAeC,qBACpBC,IAAuB;IAEvB,MAAM,EACJC,EAAE,EACFC,0BAA0B,EAC1BC,MAAMC,KAAK,EACXC,MAAM,EACNC,UAAU,EACVC,SAAS,EACTC,UAAU,EACVC,GAAG,EACJ,GAAGT;IACJ,MAAM,EAAEU,QAAQC,OAAO,EAAEC,IAAI,EAAE,GAAGH;IAElC,MAAMC,SAASC,UAAUA,UAAUE;IAEnC,IAAIN,aAAaD,eAAe,gBAAgB,CAACL,IAAI;QACnD,MAAM,IAAIa,MAAM;IAClB;IAEA,MAAMC,UAAUX,SAASY,OAAOC,IAAI,CAACb,OAAOc,MAAM,GAAG;IACrD,MAAMf,OAA+BY,UACjCX,QACAG,YACE,MAAM,AAAC,CAAA;QACL,IAAID,eAAe,UAAU;YAC3B,OAAOG,IAAIU,OAAO,CAACC,UAAU,CAAC;gBAC5BC,MAAMhB,OAAOgB,IAAI;gBACjBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;YACF;QACF;QAEA,IAAIH,eAAe,cAAc;YAC/B,OAAOG,IAAIU,OAAO,CAACM,QAAQ,CAAC;gBAC1BxB,IAAIA;gBACJyB,YAAYrB,OAAOgB,IAAI;gBACvBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;gBACAkB,OAAO;YACT;QACF;IACF,CAAA,MACAd;IAEN,MAAMe,aAAa,CAAC,CAAChB;IAErB,MAAMiB,oBAAuC,CAAC;IAE9C,MAAMC,oBAA6C;QACjDC,QAAQF;IACV;IAEA,MAAMG,WAA4B,EAAE;IAEpC,6DAA6D;IAC7D,MAAMC,gBAGA,EAAE;IAER,KAAK,MAAMC,cAAc1B,WAAY;QACnC,MAAM2B,YAAYD;QAClB,MAAME,iBAAiB/B,OAAOgC,MAAM,CAACF,UAAU;QAE/C,IACE,AAAC7B,eAAe,gBAAgBT,8BAA8ByC,QAAQ,CAACH,cACtE7B,eAAe,YAAYR,0BAA0BwC,QAAQ,CAACH,YAC/D;YACA,IAAI,OAAOC,mBAAmB,YAAY;gBACxCH,cAAcM,IAAI,CAAC;oBACjBJ;oBACAK,QAAQC,QAAQC,OAAO,CAACN,eAAe;wBAAEnC;wBAAIE;wBAAMM;oBAAI;gBACzD;YACF,OAAO;gBACLqB,iBAAiB,CAACK,UAAU,GAAG;oBAC7BQ,YAAYf;gBACd;YACF;QACF;IACF;IAEA,yCAAyC;IACzC,MAAMgB,wBAAwB,MAAMH,QAAQI,GAAG,CAC7CZ,cAAca,GAAG,CAAC,OAAOC,OAAU,CAAA;YACjCZ,WAAWY,KAAKZ,SAAS;YACzBK,QAAQ,MAAMO,KAAKP,MAAM;QAC3B,CAAA;IAGF,oEAAoE;IACpE,MAAMQ,kBAAmC,EAAE;IAC3C,MAAMC,gBAAiC,EAAE;IAEzC,KAAK,MAAM,EAAEd,SAAS,EAAEK,QAAQU,YAAY,EAAE,IAAIN,sBAAuB;QACvE,IAAI,OAAOM,iBAAiB,UAAU;YACpCC,kBAAkB;gBAChBlD;gBACAoB,MAAMhB,OAAOgB,IAAI;gBACjB6B;gBACApB;gBACAxB;gBACAC;gBACAG;gBACAyB;gBACA1B;gBACAwC;gBACAD;YACF;QACF,OAAO,IAAIlB,iBAAiB,CAACK,UAAU,EAAEQ,eAAe,OAAO;YAC7Db,iBAAiB,CAACK,UAAU,GAAG;gBAAEQ,YAAY,CAAC,CAACO;YAAa;QAC9D;IACF;IAEA,6CAA6C;IAC7C,MAAMT,QAAQI,GAAG,CAACI;IAElBrD,yBAAyB;QACvBM;QACAwB,YAAYpB,eAAe,eAAgBD,SAAuC;QAClFF;QACA4B,QAAQ1B,OAAO0B,MAAM;QACrBqB,QAAQ9C,eAAe,WAAYD,SAAmC;QACtEG;QACA6C,yBAAyBvB;QACzBwB,mBAAmBzB;QACnBG;QACAvB;IACF;IAEA;;;;;GAKC,GACD,IAAI8C,aAAa;IACjB,MAAOvB,SAASd,MAAM,GAAG,EAAG;QAC1B,MAAMsC,kBAAkBxB,SAASyB,MAAM,CAAC,GAAGzB,SAASd,MAAM;QAE1D,MAAMuB,QAAQI,GAAG,CAACW;QAElBD;QACA,IAAIA,cAAc,KAAK;YACrB,MAAM,IAAIzC,MAAM;QAClB;IACF;IAEA,OAAOgB;AACT;AAEA,MAAMqB,oBAAoB,CAAC,EACzBlD,EAAE,EACFoB,IAAI,EACJ6B,YAAY,EACZpB,iBAAiB,EACjBxB,UAAU,EACVC,SAAS,EACTG,MAAM,EACNyB,SAAS,EACT1B,GAAG,EACHwC,aAAa,EACbD,eAAe,EAahB;IACC,IAAIzC,WAAW;QACb,8DAA8D;QAC9D,IAAImD,SAASV,gBAAgBW,IAAI,CAAC,CAACC,QAAUlE,kBAAkBkE,MAAMC,KAAK,EAAEX;QAE5E,IAAI,CAACQ,QAAQ;YACX,4CAA4C;YAC5CA,SAAS;gBACPlB,QAAQ7C,gBAAgB;oBACtBM;oBACAoB;oBACAf;oBACAI;oBACAyB;oBACA1B;oBACAoD,OAAOX;gBACT;gBACAW,OAAOX;YACT;YACAF,gBAAgBT,IAAI,CAACmB;QACvB;QAEA,kEAAkE;QAClET,cAAcV,IAAI,CAChBmB,OAAOlB,MAAM,CAACsB,IAAI,CAAC,CAACC;YAClBjC,iBAAiB,CAACK,UAAU,GAAG;gBAC7BQ,YAAYoB;gBACZF,OAAOX;YACT;QACF;IAEJ,OAAO;QACL,wGAAwG;QACxG,4DAA4D;QAC5D,2EAA2E;QAC3E,sKAAsK;QACtKpB,iBAAiB,CAACK,UAAU,GAAG;YAAEQ,YAAY;YAAMkB,OAAOX;QAAa;IACzE;AACF"}
+{"version":3,"sources":["../../../src/utilities/getEntityPermissions/getEntityPermissions.ts"],"sourcesContent":["import { isDeepStrictEqual } from 'util'\n\nimport type {\n  BlockPermissions,\n  CollectionPermission,\n  FieldsPermissions,\n  GlobalPermission,\n  Permission,\n} from '../../auth/types.js'\nimport type { SanitizedCollectionConfig, TypeWithID } from '../../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { BlockSlug, DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest, Where } from '../../types/index.js'\n\nimport { getAccessOperationRequest } from '../getAccessOperationRequest.js'\nimport { entityDocExists } from './entityDocExists.js'\nimport { populateFieldPermissions } from './populateFieldPermissions.js'\n\ntype WhereQueryCache = { result: Promise<boolean>; where: Where }[]\n\nexport type BlockReferencesPermissions = Record<\n  BlockSlug,\n  BlockPermissions | Promise<BlockPermissions>\n>\n\nexport type EntityDoc = JsonObject | TypeWithID\n\ntype ReturnType<TEntityType extends 'collection' | 'global'> = TEntityType extends 'global'\n  ? GlobalPermission\n  : CollectionPermission\n\ntype Args<TEntityType extends 'collection' | 'global'> = {\n  blockReferencesPermissions: BlockReferencesPermissions\n  /**\n   * If the document data is passed, it will be used to check access instead of fetching the document from the database.\n   */\n  data?: JsonObject\n  entity: TEntityType extends 'collection' ? SanitizedCollectionConfig : SanitizedGlobalConfig\n  entityType: TEntityType\n  /**\n   * Operations to check access for\n   */\n  operations: AllOperations[]\n  req: PayloadRequest\n} & (\n  | {\n      fetchData: false\n      id?: never\n    }\n  | {\n      fetchData: true\n      id: TEntityType extends 'collection' ? DefaultDocumentIDType : undefined\n    }\n)\n\nconst topLevelCollectionPermissions = [\n  'create',\n  'delete',\n  'read',\n  'readVersions',\n  'update',\n  'validate',\n  'unlock',\n]\nconst topLevelGlobalPermissions = ['read', 'readVersions', 'update', 'validate']\n\n/**\n * Build up permissions object for an entity (collection or global).\n * This is not run during any update and reflects the current state of the entity data => doc and data is the same.\n *\n * When `fetchData` is false:\n * - returned `Where` are not run and evaluated as \"does not have permission\".\n * - If req.data is passed: `data` and `doc` is passed to access functions.\n * - If req.data is not passed: `data` and `doc` is not passed to access functions.\n *\n * When `fetchData` is true:\n * - `Where` are run and evaluated as \"has permission\" or \"does not have permission\".\n * - `data` and `doc` are always passed to access functions.\n * - Error is thrown if `entityType` is 'collection' and `id` is not passed.\n *\n * In both cases:\n * We cannot include siblingData or blockData here, as we do not have siblingData available once we reach block or array\n * rows, as we're calculating schema permissions, which do not include individual rows.\n * For consistency, it's thus better to never include the siblingData and blockData\n *\n * @internal\n */\nexport async function getEntityPermissions<TEntityType extends 'collection' | 'global'>(\n  args: Args<TEntityType>,\n): Promise<ReturnType<TEntityType>> {\n  const {\n    id,\n    blockReferencesPermissions,\n    data: _data,\n    entity,\n    entityType,\n    fetchData,\n    operations,\n    req,\n  } = args\n  const { locale: _locale, user } = req\n\n  const locale = _locale ? _locale : undefined\n\n  if (fetchData && entityType === 'collection' && !id) {\n    throw new Error('ID is required when fetching data for a collection')\n  }\n\n  const hasData = _data && Object.keys(_data).length > 0\n  const data: JsonObject | undefined = hasData\n    ? _data\n    : fetchData\n      ? await (async () => {\n          if (entityType === 'global') {\n            return req.payload.findGlobal({\n              slug: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n            })\n          }\n\n          if (entityType === 'collection') {\n            return req.payload.findByID({\n              id: id!,\n              collection: entity.slug,\n              depth: 0,\n              fallbackLocale: null,\n              locale,\n              overrideAccess: true,\n              req,\n              trash: true,\n            })\n          }\n        })()\n      : undefined\n\n  const isLoggedIn = !!user\n\n  const fieldsPermissions: FieldsPermissions = {}\n\n  const entityPermissions: ReturnType<TEntityType> = {\n    fields: fieldsPermissions,\n  } as ReturnType<TEntityType>\n\n  const promises: Promise<void>[] = []\n\n  // Phase 1: Resolve all access functions to get where queries\n  const accessResults: {\n    operation: keyof typeof entity.access\n    result: Promise<boolean | Where>\n  }[] = []\n\n  for (const _operation of operations) {\n    const operation = _operation as keyof typeof entity.access\n    const accessFunction = entity.access[operation]\n\n    if (\n      (entityType === 'collection' && topLevelCollectionPermissions.includes(operation)) ||\n      (entityType === 'global' && topLevelGlobalPermissions.includes(operation))\n    ) {\n      if (typeof accessFunction === 'function') {\n        accessResults.push({\n          operation,\n          result: Promise.resolve(\n            accessFunction({\n              id,\n              slug: entity.slug,\n              data,\n              req:\n                _operation === 'readVersions' || _operation === 'unlock'\n                  ? req\n                  : getAccessOperationRequest({\n                      operation: _operation,\n                      req,\n                    }),\n            }),\n          ) as Promise<boolean | Where>,\n        })\n      } else {\n        entityPermissions[operation] = {\n          permission: isLoggedIn,\n        }\n      }\n    }\n  }\n\n  // Await all access functions in parallel\n  const resolvedAccessResults = await Promise.all(\n    accessResults.map(async (item) => ({\n      operation: item.operation,\n      result: await item.result,\n    })),\n  )\n\n  // Phase 2: Process where queries with cache and resolve in parallel\n  const whereQueryCache: WhereQueryCache = []\n  const wherePromises: Promise<void>[] = []\n\n  for (const { operation, result: accessResult } of resolvedAccessResults) {\n    if (typeof accessResult === 'object') {\n      processWhereQuery({\n        id,\n        slug: entity.slug,\n        accessResult,\n        entityPermissions,\n        entityType,\n        fetchData,\n        locale,\n        operation,\n        req,\n        wherePromises,\n        whereQueryCache,\n      })\n    } else if (entityPermissions[operation]?.permission !== false) {\n      entityPermissions[operation] = { permission: !!accessResult }\n    }\n  }\n\n  // Await all where query DB calls in parallel\n  await Promise.all(wherePromises)\n\n  populateFieldPermissions({\n    blockReferencesPermissions,\n    collection: entityType === 'collection' ? (entity as SanitizedCollectionConfig) : null,\n    data,\n    fields: entity.fields,\n    global: entityType === 'global' ? (entity as SanitizedGlobalConfig) : null,\n    operations,\n    parentPermissionsObject: entityPermissions,\n    permissionsObject: fieldsPermissions,\n    promises,\n    req,\n  })\n\n  /**\n   * Await all promises in parallel.\n   * A promise can add more promises to the promises array (group of fields calls populateFieldPermissions again in their own promise), which will not be\n   * awaited in the first run.\n   * This is why we need to loop again to process the new promises, until there are no more promises left.\n   */\n  let iterations = 0\n  while (promises.length > 0) {\n    const currentPromises = promises.splice(0, promises.length)\n\n    await Promise.all(currentPromises)\n\n    iterations++\n    if (iterations >= 100) {\n      throw new Error('Infinite getEntityPermissions promise loop detected.')\n    }\n  }\n\n  return entityPermissions\n}\n\nconst processWhereQuery = ({\n  id,\n  slug,\n  accessResult,\n  entityPermissions,\n  entityType,\n  fetchData,\n  locale,\n  operation,\n  req,\n  wherePromises,\n  whereQueryCache,\n}: {\n  accessResult: Where\n  entityPermissions: CollectionPermission | GlobalPermission\n  entityType: 'collection' | 'global'\n  fetchData: boolean\n  id?: DefaultDocumentIDType\n  locale?: string\n  operation: Extract<keyof (CollectionPermission | GlobalPermission), AllOperations>\n  req: PayloadRequest\n  slug: string\n  wherePromises: Promise<void>[]\n  whereQueryCache: WhereQueryCache\n}): void => {\n  if (fetchData) {\n    // Check cache for identical where query using deep comparison\n    let cached = whereQueryCache.find((entry) => isDeepStrictEqual(entry.where, accessResult))\n\n    if (!cached) {\n      // Cache miss - start DB query (don't await)\n      cached = {\n        result: entityDocExists({\n          id,\n          slug,\n          entityType,\n          locale,\n          operation,\n          req,\n          where: accessResult,\n        }),\n        where: accessResult,\n      }\n      whereQueryCache.push(cached)\n    }\n\n    // Defer resolution to Promise.all (cache hits reuse same promise)\n    wherePromises.push(\n      cached.result.then((hasPermission) => {\n        entityPermissions[operation] = {\n          permission: hasPermission,\n          where: accessResult,\n        } as Permission\n      }),\n    )\n  } else {\n    // TODO: 4.0: Investigate defaulting to `false` here, if where query is returned but ignored as we don't\n    // have the document data available. This seems more secure.\n    // Alternatively, we could set permission to a third state, like 'unknown'.\n    // Even after calling sanitizePermissions, the permissions will still be true if the where query is returned but ignored as we don't have the document data available.\n    entityPermissions[operation] = { permission: true, where: accessResult } as Permission\n  }\n}\n"],"names":["isDeepStrictEqual","getAccessOperationRequest","entityDocExists","populateFieldPermissions","topLevelCollectionPermissions","topLevelGlobalPermissions","getEntityPermissions","args","id","blockReferencesPermissions","data","_data","entity","entityType","fetchData","operations","req","locale","_locale","user","undefined","Error","hasData","Object","keys","length","payload","findGlobal","slug","depth","fallbackLocale","overrideAccess","findByID","collection","trash","isLoggedIn","fieldsPermissions","entityPermissions","fields","promises","accessResults","_operation","operation","accessFunction","access","includes","push","result","Promise","resolve","permission","resolvedAccessResults","all","map","item","whereQueryCache","wherePromises","accessResult","processWhereQuery","global","parentPermissionsObject","permissionsObject","iterations","currentPromises","splice","cached","find","entry","where","then","hasPermission"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,OAAM;AAcxC,SAASC,yBAAyB,QAAQ,kCAAiC;AAC3E,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,wBAAwB,QAAQ,gCAA+B;AAuCxE,MAAMC,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AACD,MAAMC,4BAA4B;IAAC;IAAQ;IAAgB;IAAU;CAAW;AAEhF;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,eAAeC,qBACpBC,IAAuB;IAEvB,MAAM,EACJC,EAAE,EACFC,0BAA0B,EAC1BC,MAAMC,KAAK,EACXC,MAAM,EACNC,UAAU,EACVC,SAAS,EACTC,UAAU,EACVC,GAAG,EACJ,GAAGT;IACJ,MAAM,EAAEU,QAAQC,OAAO,EAAEC,IAAI,EAAE,GAAGH;IAElC,MAAMC,SAASC,UAAUA,UAAUE;IAEnC,IAAIN,aAAaD,eAAe,gBAAgB,CAACL,IAAI;QACnD,MAAM,IAAIa,MAAM;IAClB;IAEA,MAAMC,UAAUX,SAASY,OAAOC,IAAI,CAACb,OAAOc,MAAM,GAAG;IACrD,MAAMf,OAA+BY,UACjCX,QACAG,YACE,MAAM,AAAC,CAAA;QACL,IAAID,eAAe,UAAU;YAC3B,OAAOG,IAAIU,OAAO,CAACC,UAAU,CAAC;gBAC5BC,MAAMhB,OAAOgB,IAAI;gBACjBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;YACF;QACF;QAEA,IAAIH,eAAe,cAAc;YAC/B,OAAOG,IAAIU,OAAO,CAACM,QAAQ,CAAC;gBAC1BxB,IAAIA;gBACJyB,YAAYrB,OAAOgB,IAAI;gBACvBC,OAAO;gBACPC,gBAAgB;gBAChBb;gBACAc,gBAAgB;gBAChBf;gBACAkB,OAAO;YACT;QACF;IACF,CAAA,MACAd;IAEN,MAAMe,aAAa,CAAC,CAAChB;IAErB,MAAMiB,oBAAuC,CAAC;IAE9C,MAAMC,oBAA6C;QACjDC,QAAQF;IACV;IAEA,MAAMG,WAA4B,EAAE;IAEpC,6DAA6D;IAC7D,MAAMC,gBAGA,EAAE;IAER,KAAK,MAAMC,cAAc1B,WAAY;QACnC,MAAM2B,YAAYD;QAClB,MAAME,iBAAiB/B,OAAOgC,MAAM,CAACF,UAAU;QAE/C,IACE,AAAC7B,eAAe,gBAAgBT,8BAA8ByC,QAAQ,CAACH,cACtE7B,eAAe,YAAYR,0BAA0BwC,QAAQ,CAACH,YAC/D;YACA,IAAI,OAAOC,mBAAmB,YAAY;gBACxCH,cAAcM,IAAI,CAAC;oBACjBJ;oBACAK,QAAQC,QAAQC,OAAO,CACrBN,eAAe;wBACbnC;wBACAoB,MAAMhB,OAAOgB,IAAI;wBACjBlB;wBACAM,KACEyB,eAAe,kBAAkBA,eAAe,WAC5CzB,MACAf,0BAA0B;4BACxByC,WAAWD;4BACXzB;wBACF;oBACR;gBAEJ;YACF,OAAO;gBACLqB,iBAAiB,CAACK,UAAU,GAAG;oBAC7BQ,YAAYf;gBACd;YACF;QACF;IACF;IAEA,yCAAyC;IACzC,MAAMgB,wBAAwB,MAAMH,QAAQI,GAAG,CAC7CZ,cAAca,GAAG,CAAC,OAAOC,OAAU,CAAA;YACjCZ,WAAWY,KAAKZ,SAAS;YACzBK,QAAQ,MAAMO,KAAKP,MAAM;QAC3B,CAAA;IAGF,oEAAoE;IACpE,MAAMQ,kBAAmC,EAAE;IAC3C,MAAMC,gBAAiC,EAAE;IAEzC,KAAK,MAAM,EAAEd,SAAS,EAAEK,QAAQU,YAAY,EAAE,IAAIN,sBAAuB;QACvE,IAAI,OAAOM,iBAAiB,UAAU;YACpCC,kBAAkB;gBAChBlD;gBACAoB,MAAMhB,OAAOgB,IAAI;gBACjB6B;gBACApB;gBACAxB;gBACAC;gBACAG;gBACAyB;gBACA1B;gBACAwC;gBACAD;YACF;QACF,OAAO,IAAIlB,iBAAiB,CAACK,UAAU,EAAEQ,eAAe,OAAO;YAC7Db,iBAAiB,CAACK,UAAU,GAAG;gBAAEQ,YAAY,CAAC,CAACO;YAAa;QAC9D;IACF;IAEA,6CAA6C;IAC7C,MAAMT,QAAQI,GAAG,CAACI;IAElBrD,yBAAyB;QACvBM;QACAwB,YAAYpB,eAAe,eAAgBD,SAAuC;QAClFF;QACA4B,QAAQ1B,OAAO0B,MAAM;QACrBqB,QAAQ9C,eAAe,WAAYD,SAAmC;QACtEG;QACA6C,yBAAyBvB;QACzBwB,mBAAmBzB;QACnBG;QACAvB;IACF;IAEA;;;;;GAKC,GACD,IAAI8C,aAAa;IACjB,MAAOvB,SAASd,MAAM,GAAG,EAAG;QAC1B,MAAMsC,kBAAkBxB,SAASyB,MAAM,CAAC,GAAGzB,SAASd,MAAM;QAE1D,MAAMuB,QAAQI,GAAG,CAACW;QAElBD;QACA,IAAIA,cAAc,KAAK;YACrB,MAAM,IAAIzC,MAAM;QAClB;IACF;IAEA,OAAOgB;AACT;AAEA,MAAMqB,oBAAoB,CAAC,EACzBlD,EAAE,EACFoB,IAAI,EACJ6B,YAAY,EACZpB,iBAAiB,EACjBxB,UAAU,EACVC,SAAS,EACTG,MAAM,EACNyB,SAAS,EACT1B,GAAG,EACHwC,aAAa,EACbD,eAAe,EAahB;IACC,IAAIzC,WAAW;QACb,8DAA8D;QAC9D,IAAImD,SAASV,gBAAgBW,IAAI,CAAC,CAACC,QAAUnE,kBAAkBmE,MAAMC,KAAK,EAAEX;QAE5E,IAAI,CAACQ,QAAQ;YACX,4CAA4C;YAC5CA,SAAS;gBACPlB,QAAQ7C,gBAAgB;oBACtBM;oBACAoB;oBACAf;oBACAI;oBACAyB;oBACA1B;oBACAoD,OAAOX;gBACT;gBACAW,OAAOX;YACT;YACAF,gBAAgBT,IAAI,CAACmB;QACvB;QAEA,kEAAkE;QAClET,cAAcV,IAAI,CAChBmB,OAAOlB,MAAM,CAACsB,IAAI,CAAC,CAACC;YAClBjC,iBAAiB,CAACK,UAAU,GAAG;gBAC7BQ,YAAYoB;gBACZF,OAAOX;YACT;QACF;IAEJ,OAAO;QACL,wGAAwG;QACxG,4DAA4D;QAC5D,2EAA2E;QAC3E,sKAAsK;QACtKpB,iBAAiB,CAACK,UAAU,GAAG;YAAEQ,YAAY;YAAMkB,OAAOX;QAAa;IACzE;AACF"}

package/dist/utilities/getEntityPermissions/populateFieldPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"populateFieldPermissions.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/populateFieldPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AAE3E,OAAO,EAAE,KAAK,KAAK,EAAc,MAAM,8BAA8B,CAAA;AAkCrE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,iJAYlC;IACD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,sGAAsG;IACtG,UAAU,EAAE,IAAI,GAAG,yBAAyB,CAAA;IAC5C,IAAI,EAAE,UAAU,GAAG,SAAS,CAAA;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,sGAAsG;IACtG,MAAM,EAAE,IAAI,GAAG,qBAAqB,CAAA;IACpC,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B;;OAEG;IACH,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,uBAAuB,EAAE,oBAAoB,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;IACnF,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,IA2QH,CAAA"}
+{"version":3,"file":"populateFieldPermissions.d.ts","sourceRoot":"","sources":["../../../src/utilities/getEntityPermissions/populateFieldPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAEjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AAE3E,OAAO,EAAE,KAAK,KAAK,EAAc,MAAM,8BAA8B,CAAA;AAmCrE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,iJAYlC;IACD,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,sGAAsG;IACtG,UAAU,EAAE,IAAI,GAAG,yBAAyB,CAAA;IAC5C,IAAI,EAAE,UAAU,GAAG,SAAS,CAAA;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,sGAAsG;IACtG,MAAM,EAAE,IAAI,GAAG,qBAAqB,CAAA;IACpC,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B;;OAEG;IACH,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,uBAAuB,EAAE,oBAAoB,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;IACnF,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,IAiRH,CAAA"}

package/dist/utilities/getEntityPermissions/populateFieldPermissions.js

@@ -1,4 +1,5 @@
 import { tabHasName } from '../../fields/config/types.js';
+import { getAccessOperationRequest } from '../getAccessOperationRequest.js';
 const isThenable = (value)=>value != null && typeof value.then === 'function';
 /**
  * Helper to set a permission value that might be a promise.
@@ -47,13 +48,19 @@ target, operation, value, promises)=>{
                         collection,
                         data,
                         doc: data,
-                        req
+                        req: getAccessOperationRequest({
+                            operation,
+                            req
+                        })
                     } : {
                         id,
                         data,
                         doc: data,
                         global: global,
-                        req
+                        req: getAccessOperationRequest({
+                            operation,
+                            req
+                        })
                     });
                     // Handle both sync and async access results
                     if (isThenable(accessResult)) {

package/dist/utilities/getEntityPermissions/populateFieldPermissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utilities/getEntityPermissions/populateFieldPermissions.ts"],"sourcesContent":["import type {\n  BlockPermissions,\n  BlocksPermissions,\n  CollectionPermission,\n  FieldPermissions,\n  FieldsPermissions,\n  GlobalPermission,\n  Permission,\n} from '../../auth/types.js'\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest } from '../../types/index.js'\nimport type { BlockReferencesPermissions } from './getEntityPermissions.js'\n\nimport { type Field, tabHasName } from '../../fields/config/types.js'\n\nconst isThenable = (value: unknown): value is Promise<unknown> =>\n  value != null && typeof (value as { then?: unknown }).then === 'function'\n\n/**\n * Helper to set a permission value that might be a promise.\n * If it's a promise, creates a chained promise that resolves to update the target,\n * stores the promise temporarily, and adds it to the promises array for later resolution.\n */\nconst setPermission = (\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  target: any,\n  operation: AllOperations,\n  value: boolean | Promise<boolean> | undefined,\n  promises: Promise<void>[],\n): void => {\n  if (isThenable(value)) {\n    // Create a single permission object that will be mutated in place\n    // This ensures all references (including cached blocks) see the resolved value\n    const permissionObj = { permission: value as any }\n    target[operation] = permissionObj\n\n    const permissionPromise = value.then((result) => {\n      // Mutate the permission property in place so all references see the update\n      permissionObj.permission = result\n    })\n\n    promises.push(permissionPromise)\n  } else {\n    target[operation] = { permission: value }\n  }\n}\n\n/**\n * Build up permissions object and run access functions for each field of an entity\n * This function is synchronous and collects all async work into the promises array\n */\nexport const populateFieldPermissions = ({\n  id,\n  blockReferencesPermissions,\n  collection,\n  data,\n  fields,\n  global,\n  operations,\n  parentPermissionsObject,\n  permissionsObject,\n  promises,\n  req,\n}: {\n  blockReferencesPermissions: BlockReferencesPermissions\n  /** The collection which the fields belong to. If the fields belong to a global, this will be null. */\n  collection: null | SanitizedCollectionConfig\n  data: JsonObject | undefined\n  fields: Field[]\n  /** The global which the fields belong to. If the fields belong to a collection, this will be null. */\n  global: null | SanitizedGlobalConfig\n  id?: DefaultDocumentIDType\n  /**\n   * Operations to check access for\n   */\n  operations: AllOperations[]\n  parentPermissionsObject: CollectionPermission | FieldPermissions | GlobalPermission\n  permissionsObject: FieldsPermissions\n  promises: Promise<void>[]\n  req: PayloadRequest\n}): void => {\n  for (const field of fields) {\n    // Set up permissions for all operations\n    for (const operation of operations) {\n      const parentPermissionForOperation = (\n        parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n      )?.permission\n\n      // Fields don't have all operations of a collection\n      if (operation === 'delete' || operation === 'readVersions' || operation === 'unlock') {\n        continue\n      }\n\n      if ('name' in field && field.name) {\n        if (!permissionsObject[field.name]) {\n          permissionsObject[field.name] = {} as FieldPermissions\n        }\n        const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n        if ('access' in field && field.access && typeof field.access[operation] === 'function') {\n          const accessResult = field.access[operation](\n            collection\n              ? {\n                  id,\n                  collection,\n                  data,\n                  doc: data,\n                  req,\n                  // We cannot include siblingData or blockData here, as we do not have siblingData/blockData available once we reach block or array\n                  // rows, as we're calculating schema permissions, which do not include individual rows.\n                  // For consistency, it's thus better to never include the siblingData and blockData\n                }\n              : {\n                  id,\n                  data,\n                  doc: data,\n                  global: global!,\n                  req,\n                  // We cannot include siblingData or blockData here, as we do not have siblingData/blockData available once we reach block or array\n                  // rows, as we're calculating schema permissions, which do not include individual rows.\n                  // For consistency, it's thus better to never include the siblingData and blockData\n                },\n          )\n\n          // Handle both sync and async access results\n          if (isThenable(accessResult)) {\n            const booleanPromise = accessResult.then((result) => Boolean(result))\n            setPermission(fieldPermissions, operation, booleanPromise, promises)\n          } else {\n            setPermission(fieldPermissions, operation, Boolean(accessResult), promises)\n          }\n        } else {\n          // Inherit from parent (which might be a promise)\n          setPermission(fieldPermissions, operation, parentPermissionForOperation, promises)\n        }\n      }\n    }\n\n    // Handle named fields with nested content\n    if ('name' in field && field.name) {\n      const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n      if ('fields' in field && field.fields) {\n        if (!fieldPermissions.fields) {\n          fieldPermissions.fields = {}\n        }\n\n        populateFieldPermissions({\n          id,\n          blockReferencesPermissions,\n          collection,\n          data,\n          fields: field.fields,\n          global,\n          operations,\n          parentPermissionsObject: fieldPermissions,\n          permissionsObject: fieldPermissions.fields,\n          promises,\n          req,\n        })\n      }\n\n      if ('blocks' in field && field.blocks?.length) {\n        if (!fieldPermissions.blocks) {\n          fieldPermissions.blocks = {}\n        }\n        const blocksPermissions: BlocksPermissions = fieldPermissions.blocks\n\n        // Set up permissions for all operations for all blocks\n        for (const operation of operations) {\n          // Fields don't have all operations of a collection\n          if (operation === 'delete' || operation === 'readVersions' || operation === 'unlock') {\n            continue\n          }\n\n          const parentPermissionForOperation = (\n            parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n          )?.permission\n\n          for (const _block of field.blocks) {\n            const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n            // Skip if block doesn't exist (invalid block reference)\n            if (!block) {\n              continue\n            }\n\n            // Handle block references - check if we've seen this block before\n            if (typeof _block === 'string') {\n              const blockReferencePermissions = blockReferencesPermissions[_block]\n              if (blockReferencePermissions) {\n                // Reference the cached permissions (may be a promise or resolved object)\n                blocksPermissions[block.slug] = blockReferencePermissions as BlockPermissions\n                continue\n              }\n            }\n\n            // Initialize block permissions object if needed\n            if (!blocksPermissions[block.slug]) {\n              blocksPermissions[block.slug] = {} as BlockPermissions\n            }\n\n            const blockPermission = blocksPermissions[block.slug]!\n\n            // Set permission for this operation\n            if (!blockPermission[operation]) {\n              const fieldPermission =\n                fieldPermissions[operation]?.permission ?? parentPermissionForOperation\n\n              // Inherit from field permission (which might be a promise)\n              setPermission(blockPermission, operation, fieldPermission, promises)\n            }\n          }\n        }\n\n        // Process nested content for each unique block (once per block, not once per operation)\n        const processedBlocks = new Set<string>()\n        for (const _block of field.blocks) {\n          const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n          // Skip if block doesn't exist (invalid block reference)\n          if (!block || processedBlocks.has(block.slug)) {\n            continue\n          }\n          processedBlocks.add(block.slug)\n\n          const blockPermission = blocksPermissions[block.slug]\n          if (!blockPermission) {\n            continue\n          }\n\n          if (!blockPermission.fields) {\n            blockPermission.fields = {}\n          }\n\n          // Handle block references with caching - store as promise that will be resolved later\n          if (typeof _block === 'string' && !blockReferencesPermissions[_block]) {\n            // Mark this block as being processed by storing a reference\n            blockReferencesPermissions[_block] = blockPermission\n          }\n\n          // Recursively process block fields synchronously\n          populateFieldPermissions({\n            id,\n            blockReferencesPermissions,\n            collection,\n            data,\n            fields: block.fields,\n            global,\n            operations,\n            parentPermissionsObject: blockPermission,\n            permissionsObject: blockPermission.fields,\n            promises,\n            req,\n          })\n        }\n      }\n    }\n\n    // Handle unnamed group fields\n    if ('fields' in field && field.fields && !('name' in field && field.name)) {\n      // Field does not have a name => same parentPermissionsObject\n      populateFieldPermissions({\n        id,\n        collection,\n        data,\n        fields: field.fields,\n        global,\n        operations,\n        // Field does not have a name here => use parent permissions object\n        blockReferencesPermissions,\n        parentPermissionsObject,\n        permissionsObject,\n        promises,\n        req,\n      })\n    }\n\n    // Handle tabs fields\n    if (field.type === 'tabs') {\n      // Process tabs for all operations\n      for (const operation of operations) {\n        // Fields don't have all operations of a collection\n        if (operation === 'delete' || operation === 'readVersions' || operation === 'unlock') {\n          continue\n        }\n\n        const parentPermissionForOperation = (\n          parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n        )?.permission\n\n        for (const tab of field.tabs) {\n          if (tabHasName(tab)) {\n            if (!permissionsObject[tab.name]) {\n              permissionsObject[tab.name] = { fields: {} } as FieldPermissions\n            }\n\n            const tabPermissions = permissionsObject[tab.name]!\n            if (!tabPermissions[operation]) {\n              // Inherit from parent (which might be a promise)\n              setPermission(tabPermissions, operation, parentPermissionForOperation, promises)\n            }\n          }\n        }\n      }\n\n      for (const tab of field.tabs) {\n        if (tabHasName(tab)) {\n          const tabPermissions: FieldPermissions = permissionsObject[tab.name]!\n\n          if (!tabPermissions.fields) {\n            tabPermissions.fields = {}\n          }\n\n          populateFieldPermissions({\n            id,\n            blockReferencesPermissions,\n            collection,\n            data,\n            fields: tab.fields,\n            global,\n            operations,\n            parentPermissionsObject: tabPermissions,\n            permissionsObject: tabPermissions.fields,\n            promises,\n            req,\n          })\n        } else {\n          // Tab does not have a name => same parentPermissionsObject\n          populateFieldPermissions({\n            id,\n            collection,\n            data,\n            fields: tab.fields,\n            global,\n            operations,\n            // Tab does not have a name here => use parent permissions object\n            blockReferencesPermissions,\n            parentPermissionsObject,\n            permissionsObject,\n            promises,\n            req,\n          })\n        }\n      }\n    }\n  }\n}\n"],"names":["tabHasName","isThenable","value","then","setPermission","target","operation","promises","permissionObj","permission","permissionPromise","result","push","populateFieldPermissions","id","blockReferencesPermissions","collection","data","fields","global","operations","parentPermissionsObject","permissionsObject","req","field","parentPermissionForOperation","name","fieldPermissions","access","accessResult","doc","booleanPromise","Boolean","blocks","length","blocksPermissions","_block","block","payload","blockReferencePermissions","slug","blockPermission","fieldPermission","processedBlocks","Set","has","add","type","tab","tabs","tabPermissions"],"mappings":"AAeA,SAAqBA,UAAU,QAAQ,+BAA8B;AAErE,MAAMC,aAAa,CAACC,QAClBA,SAAS,QAAQ,OAAO,AAACA,MAA6BC,IAAI,KAAK;AAEjE;;;;CAIC,GACD,MAAMC,gBAAgB,CACpB,8DAA8D;AAC9DC,QACAC,WACAJ,OACAK;IAEA,IAAIN,WAAWC,QAAQ;QACrB,kEAAkE;QAClE,+EAA+E;QAC/E,MAAMM,gBAAgB;YAAEC,YAAYP;QAAa;QACjDG,MAAM,CAACC,UAAU,GAAGE;QAEpB,MAAME,oBAAoBR,MAAMC,IAAI,CAAC,CAACQ;YACpC,2EAA2E;YAC3EH,cAAcC,UAAU,GAAGE;QAC7B;QAEAJ,SAASK,IAAI,CAACF;IAChB,OAAO;QACLL,MAAM,CAACC,UAAU,GAAG;YAAEG,YAAYP;QAAM;IAC1C;AACF;AAEA;;;CAGC,GACD,OAAO,MAAMW,2BAA2B,CAAC,EACvCC,EAAE,EACFC,0BAA0B,EAC1BC,UAAU,EACVC,IAAI,EACJC,MAAM,EACNC,MAAM,EACNC,UAAU,EACVC,uBAAuB,EACvBC,iBAAiB,EACjBf,QAAQ,EACRgB,GAAG,EAkBJ;IACC,KAAK,MAAMC,SAASN,OAAQ;QAC1B,wCAAwC;QACxC,KAAK,MAAMZ,aAAac,WAAY;YAClC,MAAMK,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;YAEH,mDAAmD;YACnD,IAAIH,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;gBACpF;YACF;YAEA,IAAI,UAAUkB,SAASA,MAAME,IAAI,EAAE;gBACjC,IAAI,CAACJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,EAAE;oBAClCJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,GAAG,CAAC;gBACnC;gBACA,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;gBAExE,IAAI,YAAYF,SAASA,MAAMI,MAAM,IAAI,OAAOJ,MAAMI,MAAM,CAACtB,UAAU,KAAK,YAAY;oBACtF,MAAMuB,eAAeL,MAAMI,MAAM,CAACtB,UAAU,CAC1CU,aACI;wBACEF;wBACAE;wBACAC;wBACAa,KAAKb;wBACLM;oBAIF,IACA;wBACET;wBACAG;wBACAa,KAAKb;wBACLE,QAAQA;wBACRI;oBAIF;oBAGN,4CAA4C;oBAC5C,IAAItB,WAAW4B,eAAe;wBAC5B,MAAME,iBAAiBF,aAAa1B,IAAI,CAAC,CAACQ,SAAWqB,QAAQrB;wBAC7DP,cAAcuB,kBAAkBrB,WAAWyB,gBAAgBxB;oBAC7D,OAAO;wBACLH,cAAcuB,kBAAkBrB,WAAW0B,QAAQH,eAAetB;oBACpE;gBACF,OAAO;oBACL,iDAAiD;oBACjDH,cAAcuB,kBAAkBrB,WAAWmB,8BAA8BlB;gBAC3E;YACF;QACF;QAEA,0CAA0C;QAC1C,IAAI,UAAUiB,SAASA,MAAME,IAAI,EAAE;YACjC,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;YAExE,IAAI,YAAYF,SAASA,MAAMN,MAAM,EAAE;gBACrC,IAAI,CAACS,iBAAiBT,MAAM,EAAE;oBAC5BS,iBAAiBT,MAAM,GAAG,CAAC;gBAC7B;gBAEAL,yBAAyB;oBACvBC;oBACAC;oBACAC;oBACAC;oBACAC,QAAQM,MAAMN,MAAM;oBACpBC;oBACAC;oBACAC,yBAAyBM;oBACzBL,mBAAmBK,iBAAiBT,MAAM;oBAC1CX;oBACAgB;gBACF;YACF;YAEA,IAAI,YAAYC,SAASA,MAAMS,MAAM,EAAEC,QAAQ;gBAC7C,IAAI,CAACP,iBAAiBM,MAAM,EAAE;oBAC5BN,iBAAiBM,MAAM,GAAG,CAAC;gBAC7B;gBACA,MAAME,oBAAuCR,iBAAiBM,MAAM;gBAEpE,uDAAuD;gBACvD,KAAK,MAAM3B,aAAac,WAAY;oBAClC,mDAAmD;oBACnD,IAAId,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;wBACpF;oBACF;oBAEA,MAAMmB,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;oBAEH,KAAK,MAAM2B,UAAUZ,MAAMS,MAAM,CAAE;wBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;wBAExE,wDAAwD;wBACxD,IAAI,CAACC,OAAO;4BACV;wBACF;wBAEA,kEAAkE;wBAClE,IAAI,OAAOD,WAAW,UAAU;4BAC9B,MAAMG,4BAA4BxB,0BAA0B,CAACqB,OAAO;4BACpE,IAAIG,2BAA2B;gCAC7B,yEAAyE;gCACzEJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAGD;gCAChC;4BACF;wBACF;wBAEA,gDAAgD;wBAChD,IAAI,CAACJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,EAAE;4BAClCL,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAG,CAAC;wBACnC;wBAEA,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;wBAErD,oCAAoC;wBACpC,IAAI,CAACC,eAAe,CAACnC,UAAU,EAAE;4BAC/B,MAAMoC,kBACJf,gBAAgB,CAACrB,UAAU,EAAEG,cAAcgB;4BAE7C,2DAA2D;4BAC3DrB,cAAcqC,iBAAiBnC,WAAWoC,iBAAiBnC;wBAC7D;oBACF;gBACF;gBAEA,wFAAwF;gBACxF,MAAMoC,kBAAkB,IAAIC;gBAC5B,KAAK,MAAMR,UAAUZ,MAAMS,MAAM,CAAE;oBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;oBAExE,wDAAwD;oBACxD,IAAI,CAACC,SAASM,gBAAgBE,GAAG,CAACR,MAAMG,IAAI,GAAG;wBAC7C;oBACF;oBACAG,gBAAgBG,GAAG,CAACT,MAAMG,IAAI;oBAE9B,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;oBACrD,IAAI,CAACC,iBAAiB;wBACpB;oBACF;oBAEA,IAAI,CAACA,gBAAgBvB,MAAM,EAAE;wBAC3BuB,gBAAgBvB,MAAM,GAAG,CAAC;oBAC5B;oBAEA,sFAAsF;oBACtF,IAAI,OAAOkB,WAAW,YAAY,CAACrB,0BAA0B,CAACqB,OAAO,EAAE;wBACrE,4DAA4D;wBAC5DrB,0BAA0B,CAACqB,OAAO,GAAGK;oBACvC;oBAEA,iDAAiD;oBACjD5B,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC;wBACAC,QAAQmB,MAAMnB,MAAM;wBACpBC;wBACAC;wBACAC,yBAAyBoB;wBACzBnB,mBAAmBmB,gBAAgBvB,MAAM;wBACzCX;wBACAgB;oBACF;gBACF;YACF;QACF;QAEA,8BAA8B;QAC9B,IAAI,YAAYC,SAASA,MAAMN,MAAM,IAAI,CAAE,CAAA,UAAUM,SAASA,MAAME,IAAI,AAAD,GAAI;YACzE,6DAA6D;YAC7Db,yBAAyB;gBACvBC;gBACAE;gBACAC;gBACAC,QAAQM,MAAMN,MAAM;gBACpBC;gBACAC;gBACA,mEAAmE;gBACnEL;gBACAM;gBACAC;gBACAf;gBACAgB;YACF;QACF;QAEA,qBAAqB;QACrB,IAAIC,MAAMuB,IAAI,KAAK,QAAQ;YACzB,kCAAkC;YAClC,KAAK,MAAMzC,aAAac,WAAY;gBAClC,mDAAmD;gBACnD,IAAId,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;oBACpF;gBACF;gBAEA,MAAMmB,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;gBAEH,KAAK,MAAMuC,OAAOxB,MAAMyB,IAAI,CAAE;oBAC5B,IAAIjD,WAAWgD,MAAM;wBACnB,IAAI,CAAC1B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,EAAE;4BAChCJ,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,GAAG;gCAAER,QAAQ,CAAC;4BAAE;wBAC7C;wBAEA,MAAMgC,iBAAiB5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;wBAClD,IAAI,CAACwB,cAAc,CAAC5C,UAAU,EAAE;4BAC9B,iDAAiD;4BACjDF,cAAc8C,gBAAgB5C,WAAWmB,8BAA8BlB;wBACzE;oBACF;gBACF;YACF;YAEA,KAAK,MAAMyC,OAAOxB,MAAMyB,IAAI,CAAE;gBAC5B,IAAIjD,WAAWgD,MAAM;oBACnB,MAAME,iBAAmC5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;oBAEpE,IAAI,CAACwB,eAAehC,MAAM,EAAE;wBAC1BgC,eAAehC,MAAM,GAAG,CAAC;oBAC3B;oBAEAL,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC;wBACAC,QAAQ8B,IAAI9B,MAAM;wBAClBC;wBACAC;wBACAC,yBAAyB6B;wBACzB5B,mBAAmB4B,eAAehC,MAAM;wBACxCX;wBACAgB;oBACF;gBACF,OAAO;oBACL,2DAA2D;oBAC3DV,yBAAyB;wBACvBC;wBACAE;wBACAC;wBACAC,QAAQ8B,IAAI9B,MAAM;wBAClBC;wBACAC;wBACA,iEAAiE;wBACjEL;wBACAM;wBACAC;wBACAf;wBACAgB;oBACF;gBACF;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../src/utilities/getEntityPermissions/populateFieldPermissions.ts"],"sourcesContent":["import type {\n  BlockPermissions,\n  BlocksPermissions,\n  CollectionPermission,\n  FieldPermissions,\n  FieldsPermissions,\n  GlobalPermission,\n  Permission,\n} from '../../auth/types.js'\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { DefaultDocumentIDType } from '../../index.js'\nimport type { AllOperations, JsonObject, PayloadRequest } from '../../types/index.js'\nimport type { BlockReferencesPermissions } from './getEntityPermissions.js'\n\nimport { type Field, tabHasName } from '../../fields/config/types.js'\nimport { getAccessOperationRequest } from '../getAccessOperationRequest.js'\n\nconst isThenable = (value: unknown): value is Promise<unknown> =>\n  value != null && typeof (value as { then?: unknown }).then === 'function'\n\n/**\n * Helper to set a permission value that might be a promise.\n * If it's a promise, creates a chained promise that resolves to update the target,\n * stores the promise temporarily, and adds it to the promises array for later resolution.\n */\nconst setPermission = (\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  target: any,\n  operation: AllOperations,\n  value: boolean | Promise<boolean> | undefined,\n  promises: Promise<void>[],\n): void => {\n  if (isThenable(value)) {\n    // Create a single permission object that will be mutated in place\n    // This ensures all references (including cached blocks) see the resolved value\n    const permissionObj = { permission: value as any }\n    target[operation] = permissionObj\n\n    const permissionPromise = value.then((result) => {\n      // Mutate the permission property in place so all references see the update\n      permissionObj.permission = result\n    })\n\n    promises.push(permissionPromise)\n  } else {\n    target[operation] = { permission: value }\n  }\n}\n\n/**\n * Build up permissions object and run access functions for each field of an entity\n * This function is synchronous and collects all async work into the promises array\n */\nexport const populateFieldPermissions = ({\n  id,\n  blockReferencesPermissions,\n  collection,\n  data,\n  fields,\n  global,\n  operations,\n  parentPermissionsObject,\n  permissionsObject,\n  promises,\n  req,\n}: {\n  blockReferencesPermissions: BlockReferencesPermissions\n  /** The collection which the fields belong to. If the fields belong to a global, this will be null. */\n  collection: null | SanitizedCollectionConfig\n  data: JsonObject | undefined\n  fields: Field[]\n  /** The global which the fields belong to. If the fields belong to a collection, this will be null. */\n  global: null | SanitizedGlobalConfig\n  id?: DefaultDocumentIDType\n  /**\n   * Operations to check access for\n   */\n  operations: AllOperations[]\n  parentPermissionsObject: CollectionPermission | FieldPermissions | GlobalPermission\n  permissionsObject: FieldsPermissions\n  promises: Promise<void>[]\n  req: PayloadRequest\n}): void => {\n  for (const field of fields) {\n    // Set up permissions for all operations\n    for (const operation of operations) {\n      const parentPermissionForOperation = (\n        parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n      )?.permission\n\n      // Fields don't have all operations of a collection\n      if (operation === 'delete' || operation === 'readVersions' || operation === 'unlock') {\n        continue\n      }\n\n      if ('name' in field && field.name) {\n        if (!permissionsObject[field.name]) {\n          permissionsObject[field.name] = {} as FieldPermissions\n        }\n        const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n        if ('access' in field && field.access && typeof field.access[operation] === 'function') {\n          const accessResult = field.access[operation](\n            collection\n              ? {\n                  id,\n                  collection,\n                  data,\n                  doc: data,\n                  req: getAccessOperationRequest({\n                    operation,\n                    req,\n                  }),\n                  // We cannot include siblingData or blockData here, as we do not have siblingData/blockData available once we reach block or array\n                  // rows, as we're calculating schema permissions, which do not include individual rows.\n                  // For consistency, it's thus better to never include the siblingData and blockData\n                }\n              : {\n                  id,\n                  data,\n                  doc: data,\n                  global: global!,\n                  req: getAccessOperationRequest({\n                    operation,\n                    req,\n                  }),\n                  // We cannot include siblingData or blockData here, as we do not have siblingData/blockData available once we reach block or array\n                  // rows, as we're calculating schema permissions, which do not include individual rows.\n                  // For consistency, it's thus better to never include the siblingData and blockData\n                },\n          )\n\n          // Handle both sync and async access results\n          if (isThenable(accessResult)) {\n            const booleanPromise = accessResult.then((result) => Boolean(result))\n            setPermission(fieldPermissions, operation, booleanPromise, promises)\n          } else {\n            setPermission(fieldPermissions, operation, Boolean(accessResult), promises)\n          }\n        } else {\n          // Inherit from parent (which might be a promise)\n          setPermission(fieldPermissions, operation, parentPermissionForOperation, promises)\n        }\n      }\n    }\n\n    // Handle named fields with nested content\n    if ('name' in field && field.name) {\n      const fieldPermissions: FieldPermissions = permissionsObject[field.name]!\n\n      if ('fields' in field && field.fields) {\n        if (!fieldPermissions.fields) {\n          fieldPermissions.fields = {}\n        }\n\n        populateFieldPermissions({\n          id,\n          blockReferencesPermissions,\n          collection,\n          data,\n          fields: field.fields,\n          global,\n          operations,\n          parentPermissionsObject: fieldPermissions,\n          permissionsObject: fieldPermissions.fields,\n          promises,\n          req,\n        })\n      }\n\n      if ('blocks' in field && field.blocks?.length) {\n        if (!fieldPermissions.blocks) {\n          fieldPermissions.blocks = {}\n        }\n        const blocksPermissions: BlocksPermissions = fieldPermissions.blocks\n\n        // Set up permissions for all operations for all blocks\n        for (const operation of operations) {\n          // Fields don't have all operations of a collection\n          if (operation === 'delete' || operation === 'readVersions' || operation === 'unlock') {\n            continue\n          }\n\n          const parentPermissionForOperation = (\n            parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n          )?.permission\n\n          for (const _block of field.blocks) {\n            const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n            // Skip if block doesn't exist (invalid block reference)\n            if (!block) {\n              continue\n            }\n\n            // Handle block references - check if we've seen this block before\n            if (typeof _block === 'string') {\n              const blockReferencePermissions = blockReferencesPermissions[_block]\n              if (blockReferencePermissions) {\n                // Reference the cached permissions (may be a promise or resolved object)\n                blocksPermissions[block.slug] = blockReferencePermissions as BlockPermissions\n                continue\n              }\n            }\n\n            // Initialize block permissions object if needed\n            if (!blocksPermissions[block.slug]) {\n              blocksPermissions[block.slug] = {} as BlockPermissions\n            }\n\n            const blockPermission = blocksPermissions[block.slug]!\n\n            // Set permission for this operation\n            if (!blockPermission[operation]) {\n              const fieldPermission =\n                fieldPermissions[operation]?.permission ?? parentPermissionForOperation\n\n              // Inherit from field permission (which might be a promise)\n              setPermission(blockPermission, operation, fieldPermission, promises)\n            }\n          }\n        }\n\n        // Process nested content for each unique block (once per block, not once per operation)\n        const processedBlocks = new Set<string>()\n        for (const _block of field.blocks) {\n          const block = typeof _block === 'string' ? req.payload.blocks[_block] : _block\n\n          // Skip if block doesn't exist (invalid block reference)\n          if (!block || processedBlocks.has(block.slug)) {\n            continue\n          }\n          processedBlocks.add(block.slug)\n\n          const blockPermission = blocksPermissions[block.slug]\n          if (!blockPermission) {\n            continue\n          }\n\n          if (!blockPermission.fields) {\n            blockPermission.fields = {}\n          }\n\n          // Handle block references with caching - store as promise that will be resolved later\n          if (typeof _block === 'string' && !blockReferencesPermissions[_block]) {\n            // Mark this block as being processed by storing a reference\n            blockReferencesPermissions[_block] = blockPermission\n          }\n\n          // Recursively process block fields synchronously\n          populateFieldPermissions({\n            id,\n            blockReferencesPermissions,\n            collection,\n            data,\n            fields: block.fields,\n            global,\n            operations,\n            parentPermissionsObject: blockPermission,\n            permissionsObject: blockPermission.fields,\n            promises,\n            req,\n          })\n        }\n      }\n    }\n\n    // Handle unnamed group fields\n    if ('fields' in field && field.fields && !('name' in field && field.name)) {\n      // Field does not have a name => same parentPermissionsObject\n      populateFieldPermissions({\n        id,\n        collection,\n        data,\n        fields: field.fields,\n        global,\n        operations,\n        // Field does not have a name here => use parent permissions object\n        blockReferencesPermissions,\n        parentPermissionsObject,\n        permissionsObject,\n        promises,\n        req,\n      })\n    }\n\n    // Handle tabs fields\n    if (field.type === 'tabs') {\n      // Process tabs for all operations\n      for (const operation of operations) {\n        // Fields don't have all operations of a collection\n        if (operation === 'delete' || operation === 'readVersions' || operation === 'unlock') {\n          continue\n        }\n\n        const parentPermissionForOperation = (\n          parentPermissionsObject[operation as keyof typeof parentPermissionsObject] as Permission\n        )?.permission\n\n        for (const tab of field.tabs) {\n          if (tabHasName(tab)) {\n            if (!permissionsObject[tab.name]) {\n              permissionsObject[tab.name] = { fields: {} } as FieldPermissions\n            }\n\n            const tabPermissions = permissionsObject[tab.name]!\n            if (!tabPermissions[operation]) {\n              // Inherit from parent (which might be a promise)\n              setPermission(tabPermissions, operation, parentPermissionForOperation, promises)\n            }\n          }\n        }\n      }\n\n      for (const tab of field.tabs) {\n        if (tabHasName(tab)) {\n          const tabPermissions: FieldPermissions = permissionsObject[tab.name]!\n\n          if (!tabPermissions.fields) {\n            tabPermissions.fields = {}\n          }\n\n          populateFieldPermissions({\n            id,\n            blockReferencesPermissions,\n            collection,\n            data,\n            fields: tab.fields,\n            global,\n            operations,\n            parentPermissionsObject: tabPermissions,\n            permissionsObject: tabPermissions.fields,\n            promises,\n            req,\n          })\n        } else {\n          // Tab does not have a name => same parentPermissionsObject\n          populateFieldPermissions({\n            id,\n            collection,\n            data,\n            fields: tab.fields,\n            global,\n            operations,\n            // Tab does not have a name here => use parent permissions object\n            blockReferencesPermissions,\n            parentPermissionsObject,\n            permissionsObject,\n            promises,\n            req,\n          })\n        }\n      }\n    }\n  }\n}\n"],"names":["tabHasName","getAccessOperationRequest","isThenable","value","then","setPermission","target","operation","promises","permissionObj","permission","permissionPromise","result","push","populateFieldPermissions","id","blockReferencesPermissions","collection","data","fields","global","operations","parentPermissionsObject","permissionsObject","req","field","parentPermissionForOperation","name","fieldPermissions","access","accessResult","doc","booleanPromise","Boolean","blocks","length","blocksPermissions","_block","block","payload","blockReferencePermissions","slug","blockPermission","fieldPermission","processedBlocks","Set","has","add","type","tab","tabs","tabPermissions"],"mappings":"AAeA,SAAqBA,UAAU,QAAQ,+BAA8B;AACrE,SAASC,yBAAyB,QAAQ,kCAAiC;AAE3E,MAAMC,aAAa,CAACC,QAClBA,SAAS,QAAQ,OAAO,AAACA,MAA6BC,IAAI,KAAK;AAEjE;;;;CAIC,GACD,MAAMC,gBAAgB,CACpB,8DAA8D;AAC9DC,QACAC,WACAJ,OACAK;IAEA,IAAIN,WAAWC,QAAQ;QACrB,kEAAkE;QAClE,+EAA+E;QAC/E,MAAMM,gBAAgB;YAAEC,YAAYP;QAAa;QACjDG,MAAM,CAACC,UAAU,GAAGE;QAEpB,MAAME,oBAAoBR,MAAMC,IAAI,CAAC,CAACQ;YACpC,2EAA2E;YAC3EH,cAAcC,UAAU,GAAGE;QAC7B;QAEAJ,SAASK,IAAI,CAACF;IAChB,OAAO;QACLL,MAAM,CAACC,UAAU,GAAG;YAAEG,YAAYP;QAAM;IAC1C;AACF;AAEA;;;CAGC,GACD,OAAO,MAAMW,2BAA2B,CAAC,EACvCC,EAAE,EACFC,0BAA0B,EAC1BC,UAAU,EACVC,IAAI,EACJC,MAAM,EACNC,MAAM,EACNC,UAAU,EACVC,uBAAuB,EACvBC,iBAAiB,EACjBf,QAAQ,EACRgB,GAAG,EAkBJ;IACC,KAAK,MAAMC,SAASN,OAAQ;QAC1B,wCAAwC;QACxC,KAAK,MAAMZ,aAAac,WAAY;YAClC,MAAMK,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;YAEH,mDAAmD;YACnD,IAAIH,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;gBACpF;YACF;YAEA,IAAI,UAAUkB,SAASA,MAAME,IAAI,EAAE;gBACjC,IAAI,CAACJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,EAAE;oBAClCJ,iBAAiB,CAACE,MAAME,IAAI,CAAC,GAAG,CAAC;gBACnC;gBACA,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;gBAExE,IAAI,YAAYF,SAASA,MAAMI,MAAM,IAAI,OAAOJ,MAAMI,MAAM,CAACtB,UAAU,KAAK,YAAY;oBACtF,MAAMuB,eAAeL,MAAMI,MAAM,CAACtB,UAAU,CAC1CU,aACI;wBACEF;wBACAE;wBACAC;wBACAa,KAAKb;wBACLM,KAAKvB,0BAA0B;4BAC7BM;4BACAiB;wBACF;oBAIF,IACA;wBACET;wBACAG;wBACAa,KAAKb;wBACLE,QAAQA;wBACRI,KAAKvB,0BAA0B;4BAC7BM;4BACAiB;wBACF;oBAIF;oBAGN,4CAA4C;oBAC5C,IAAItB,WAAW4B,eAAe;wBAC5B,MAAME,iBAAiBF,aAAa1B,IAAI,CAAC,CAACQ,SAAWqB,QAAQrB;wBAC7DP,cAAcuB,kBAAkBrB,WAAWyB,gBAAgBxB;oBAC7D,OAAO;wBACLH,cAAcuB,kBAAkBrB,WAAW0B,QAAQH,eAAetB;oBACpE;gBACF,OAAO;oBACL,iDAAiD;oBACjDH,cAAcuB,kBAAkBrB,WAAWmB,8BAA8BlB;gBAC3E;YACF;QACF;QAEA,0CAA0C;QAC1C,IAAI,UAAUiB,SAASA,MAAME,IAAI,EAAE;YACjC,MAAMC,mBAAqCL,iBAAiB,CAACE,MAAME,IAAI,CAAC;YAExE,IAAI,YAAYF,SAASA,MAAMN,MAAM,EAAE;gBACrC,IAAI,CAACS,iBAAiBT,MAAM,EAAE;oBAC5BS,iBAAiBT,MAAM,GAAG,CAAC;gBAC7B;gBAEAL,yBAAyB;oBACvBC;oBACAC;oBACAC;oBACAC;oBACAC,QAAQM,MAAMN,MAAM;oBACpBC;oBACAC;oBACAC,yBAAyBM;oBACzBL,mBAAmBK,iBAAiBT,MAAM;oBAC1CX;oBACAgB;gBACF;YACF;YAEA,IAAI,YAAYC,SAASA,MAAMS,MAAM,EAAEC,QAAQ;gBAC7C,IAAI,CAACP,iBAAiBM,MAAM,EAAE;oBAC5BN,iBAAiBM,MAAM,GAAG,CAAC;gBAC7B;gBACA,MAAME,oBAAuCR,iBAAiBM,MAAM;gBAEpE,uDAAuD;gBACvD,KAAK,MAAM3B,aAAac,WAAY;oBAClC,mDAAmD;oBACnD,IAAId,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;wBACpF;oBACF;oBAEA,MAAMmB,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;oBAEH,KAAK,MAAM2B,UAAUZ,MAAMS,MAAM,CAAE;wBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;wBAExE,wDAAwD;wBACxD,IAAI,CAACC,OAAO;4BACV;wBACF;wBAEA,kEAAkE;wBAClE,IAAI,OAAOD,WAAW,UAAU;4BAC9B,MAAMG,4BAA4BxB,0BAA0B,CAACqB,OAAO;4BACpE,IAAIG,2BAA2B;gCAC7B,yEAAyE;gCACzEJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAGD;gCAChC;4BACF;wBACF;wBAEA,gDAAgD;wBAChD,IAAI,CAACJ,iBAAiB,CAACE,MAAMG,IAAI,CAAC,EAAE;4BAClCL,iBAAiB,CAACE,MAAMG,IAAI,CAAC,GAAG,CAAC;wBACnC;wBAEA,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;wBAErD,oCAAoC;wBACpC,IAAI,CAACC,eAAe,CAACnC,UAAU,EAAE;4BAC/B,MAAMoC,kBACJf,gBAAgB,CAACrB,UAAU,EAAEG,cAAcgB;4BAE7C,2DAA2D;4BAC3DrB,cAAcqC,iBAAiBnC,WAAWoC,iBAAiBnC;wBAC7D;oBACF;gBACF;gBAEA,wFAAwF;gBACxF,MAAMoC,kBAAkB,IAAIC;gBAC5B,KAAK,MAAMR,UAAUZ,MAAMS,MAAM,CAAE;oBACjC,MAAMI,QAAQ,OAAOD,WAAW,WAAWb,IAAIe,OAAO,CAACL,MAAM,CAACG,OAAO,GAAGA;oBAExE,wDAAwD;oBACxD,IAAI,CAACC,SAASM,gBAAgBE,GAAG,CAACR,MAAMG,IAAI,GAAG;wBAC7C;oBACF;oBACAG,gBAAgBG,GAAG,CAACT,MAAMG,IAAI;oBAE9B,MAAMC,kBAAkBN,iBAAiB,CAACE,MAAMG,IAAI,CAAC;oBACrD,IAAI,CAACC,iBAAiB;wBACpB;oBACF;oBAEA,IAAI,CAACA,gBAAgBvB,MAAM,EAAE;wBAC3BuB,gBAAgBvB,MAAM,GAAG,CAAC;oBAC5B;oBAEA,sFAAsF;oBACtF,IAAI,OAAOkB,WAAW,YAAY,CAACrB,0BAA0B,CAACqB,OAAO,EAAE;wBACrE,4DAA4D;wBAC5DrB,0BAA0B,CAACqB,OAAO,GAAGK;oBACvC;oBAEA,iDAAiD;oBACjD5B,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC;wBACAC,QAAQmB,MAAMnB,MAAM;wBACpBC;wBACAC;wBACAC,yBAAyBoB;wBACzBnB,mBAAmBmB,gBAAgBvB,MAAM;wBACzCX;wBACAgB;oBACF;gBACF;YACF;QACF;QAEA,8BAA8B;QAC9B,IAAI,YAAYC,SAASA,MAAMN,MAAM,IAAI,CAAE,CAAA,UAAUM,SAASA,MAAME,IAAI,AAAD,GAAI;YACzE,6DAA6D;YAC7Db,yBAAyB;gBACvBC;gBACAE;gBACAC;gBACAC,QAAQM,MAAMN,MAAM;gBACpBC;gBACAC;gBACA,mEAAmE;gBACnEL;gBACAM;gBACAC;gBACAf;gBACAgB;YACF;QACF;QAEA,qBAAqB;QACrB,IAAIC,MAAMuB,IAAI,KAAK,QAAQ;YACzB,kCAAkC;YAClC,KAAK,MAAMzC,aAAac,WAAY;gBAClC,mDAAmD;gBACnD,IAAId,cAAc,YAAYA,cAAc,kBAAkBA,cAAc,UAAU;oBACpF;gBACF;gBAEA,MAAMmB,+BACJJ,uBAAuB,CAACf,UAAkD,EACzEG;gBAEH,KAAK,MAAMuC,OAAOxB,MAAMyB,IAAI,CAAE;oBAC5B,IAAIlD,WAAWiD,MAAM;wBACnB,IAAI,CAAC1B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,EAAE;4BAChCJ,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC,GAAG;gCAAER,QAAQ,CAAC;4BAAE;wBAC7C;wBAEA,MAAMgC,iBAAiB5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;wBAClD,IAAI,CAACwB,cAAc,CAAC5C,UAAU,EAAE;4BAC9B,iDAAiD;4BACjDF,cAAc8C,gBAAgB5C,WAAWmB,8BAA8BlB;wBACzE;oBACF;gBACF;YACF;YAEA,KAAK,MAAMyC,OAAOxB,MAAMyB,IAAI,CAAE;gBAC5B,IAAIlD,WAAWiD,MAAM;oBACnB,MAAME,iBAAmC5B,iBAAiB,CAAC0B,IAAItB,IAAI,CAAC;oBAEpE,IAAI,CAACwB,eAAehC,MAAM,EAAE;wBAC1BgC,eAAehC,MAAM,GAAG,CAAC;oBAC3B;oBAEAL,yBAAyB;wBACvBC;wBACAC;wBACAC;wBACAC;wBACAC,QAAQ8B,IAAI9B,MAAM;wBAClBC;wBACAC;wBACAC,yBAAyB6B;wBACzB5B,mBAAmB4B,eAAehC,MAAM;wBACxCX;wBACAgB;oBACF;gBACF,OAAO;oBACL,2DAA2D;oBAC3DV,yBAAyB;wBACvBC;wBACAE;wBACAC;wBACAC,QAAQ8B,IAAI9B,MAAM;wBAClBC;wBACAC;wBACA,iEAAiE;wBACjEL;wBACAM;wBACAC;wBACAf;wBACAgB;oBACF;gBACF;YACF;QACF;IACF;AACF,EAAC"}

package/dist/utilities/getFieldPermissions.d.ts

@@ -4,7 +4,7 @@ import type { Operation } from '../types/index.js';
 /**
  * Gets read and operation-level permissions for a given field based on cascading field permissions.
  * @returns An object with the following properties:
- * - `operation`: Whether the user has permission to perform the operation on the field (`create` or `update`).
+ * - `operation`: Whether the user has permission to perform the operation on the field.
  * - `permissions`: The field-level permissions.
  * - `read`: Whether the user has permission to read the field.
  */

package/dist/utilities/getFieldPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFieldPermissions.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,0EAM7B;IACD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IAC7D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;CAC7E,KAAG;IACF,SAAS,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;IACnE,IAAI,EAAE,OAAO,CAAA;CA6Dd,CAAA"}
+{"version":3,"file":"getFieldPermissions.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,0EAM7B;IACD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IAC7D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;CAC7E,KAAG;IACF,SAAS,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;IACnE,IAAI,EAAE,OAAO,CAAA;CA+Dd,CAAA"}

package/dist/utilities/getFieldPermissions.js

@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */ /**
  * Gets read and operation-level permissions for a given field based on cascading field permissions.
  * @returns An object with the following properties:
- * - `operation`: Whether the user has permission to perform the operation on the field (`create` or `update`).
+ * - `operation`: Whether the user has permission to perform the operation on the field.
  * - `permissions`: The field-level permissions.
  * - `read`: Whether the user has permission to read the field.
  */ export const getFieldPermissions = ({ collectionPermissions, field, operation, parentName, permissions })=>{
@@ -20,6 +20,8 @@
             collectionOperation = Boolean(collectionPermissions.create);
         } else if (operation === 'update') {
             collectionOperation = Boolean(collectionPermissions.update);
+        } else if (operation === 'validate') {
+            collectionOperation = Boolean(collectionPermissions.validate);
         }
         return {
             operation: collectionOperation,

package/dist/utilities/getFieldPermissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getFieldPermissions.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type {\n  SanitizedDocumentPermissions,\n  SanitizedFieldPermissions,\n  SanitizedFieldsPermissions,\n} from '../auth/types.js'\nimport type { ClientField, Field } from '../fields/config/types.js'\nimport type { Operation } from '../types/index.js'\n\n/**\n * Gets read and operation-level permissions for a given field based on cascading field permissions.\n * @returns An object with the following properties:\n * - `operation`: Whether the user has permission to perform the operation on the field (`create` or `update`).\n * - `permissions`: The field-level permissions.\n * - `read`: Whether the user has permission to read the field.\n */\nexport const getFieldPermissions = ({\n  collectionPermissions,\n  field,\n  operation,\n  parentName,\n  permissions,\n}: {\n  readonly collectionPermissions?: SanitizedDocumentPermissions\n  readonly field: ClientField | Field\n  readonly operation: Operation\n  readonly parentName: string\n  readonly permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n}): {\n  operation: boolean\n  /**\n   * The field-level permissions. This can be equal to the permissions passed to the\n   * `getFieldPermissions` function if the field has no name.\n   */\n  permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n  read: boolean\n} => {\n  // First, calculate permissions using the existing logic\n  const fieldOperation =\n    permissions === true ||\n    permissions?.[operation as keyof typeof permissions] === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      (permissions[field.name as keyof typeof permissions] === true ||\n        (operation in (permissions as any)[field.name] &&\n          (permissions as any)[field.name][operation])))\n\n  const fieldPermissions =\n    permissions === undefined || permissions === null || permissions === true\n      ? true\n      : 'name' in field\n        ? (permissions as any)[field.name]\n        : permissions\n\n  const fieldRead =\n    permissions === true ||\n    permissions?.read === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      ((permissions as any)[field.name] === true ||\n        ('read' in (permissions as any)[field.name] && (permissions as any)[field.name].read)))\n\n  // Check if field permissions are effectively empty/missing\n  const hasFieldPermissions =\n    permissions === true ||\n    (typeof permissions === 'object' && permissions !== null && Object.keys(permissions).length > 0)\n\n  // If no field permissions are defined, fallback to collection permissions\n  if (!hasFieldPermissions && collectionPermissions) {\n    const collectionRead = Boolean(collectionPermissions.read)\n    let collectionOperation = false\n\n    // Check operation-specific permission on collection\n    if (operation === 'create' && 'create' in collectionPermissions) {\n      collectionOperation = Boolean(collectionPermissions.create)\n    } else if (operation === 'update') {\n      collectionOperation = Boolean(collectionPermissions.update)\n    }\n\n    return {\n      operation: collectionOperation,\n      permissions: { read: collectionRead } as SanitizedFieldPermissions,\n      read: collectionRead,\n    }\n  }\n\n  // Return the calculated permissions\n  return {\n    operation: Boolean(fieldOperation),\n    permissions: fieldPermissions,\n    read: Boolean(fieldRead),\n  }\n}\n"],"names":["getFieldPermissions","collectionPermissions","field","operation","parentName","permissions","fieldOperation","name","fieldPermissions","undefined","fieldRead","read","hasFieldPermissions","Object","keys","length","collectionRead","Boolean","collectionOperation","create","update"],"mappings":"AAAA,qDAAqD,GASrD;;;;;;CAMC,GACD,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,qBAAqB,EACrBC,KAAK,EACLC,SAAS,EACTC,UAAU,EACVC,WAAW,EAOZ;IASC,wDAAwD;IACxD,MAAMC,iBACJD,gBAAgB,QAChBA,aAAa,CAACF,UAAsC,KAAK,QACzDE,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpDF,CAAAA,WAAW,CAACH,MAAMK,IAAI,CAA6B,KAAK,QACtDJ,aAAa,AAACE,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAC5C,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACJ,UAAU;IAEnD,MAAMK,mBACJH,gBAAgBI,aAAaJ,gBAAgB,QAAQA,gBAAgB,OACjE,OACA,UAAUH,QACR,AAACG,WAAmB,CAACH,MAAMK,IAAI,CAAC,GAChCF;IAER,MAAMK,YACJL,gBAAgB,QAChBA,aAAaM,SAAS,QACtBN,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpD,CAAA,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,KAAK,QACnC,UAAU,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAAI,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACI,IAAI;IAE1F,2DAA2D;IAC3D,MAAMC,sBACJP,gBAAgB,QACf,OAAOA,gBAAgB,YAAYA,gBAAgB,QAAQQ,OAAOC,IAAI,CAACT,aAAaU,MAAM,GAAG;IAEhG,0EAA0E;IAC1E,IAAI,CAACH,uBAAuBX,uBAAuB;QACjD,MAAMe,iBAAiBC,QAAQhB,sBAAsBU,IAAI;QACzD,IAAIO,sBAAsB;QAE1B,oDAAoD;QACpD,IAAIf,cAAc,YAAY,YAAYF,uBAAuB;YAC/DiB,sBAAsBD,QAAQhB,sBAAsBkB,MAAM;QAC5D,OAAO,IAAIhB,cAAc,UAAU;YACjCe,sBAAsBD,QAAQhB,sBAAsBmB,MAAM;QAC5D;QAEA,OAAO;YACLjB,WAAWe;YACXb,aAAa;gBAAEM,MAAMK;YAAe;YACpCL,MAAMK;QACR;IACF;IAEA,oCAAoC;IACpC,OAAO;QACLb,WAAWc,QAAQX;QACnBD,aAAaG;QACbG,MAAMM,QAAQP;IAChB;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/getFieldPermissions.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type {\n  SanitizedDocumentPermissions,\n  SanitizedFieldPermissions,\n  SanitizedFieldsPermissions,\n} from '../auth/types.js'\nimport type { ClientField, Field } from '../fields/config/types.js'\nimport type { Operation } from '../types/index.js'\n\n/**\n * Gets read and operation-level permissions for a given field based on cascading field permissions.\n * @returns An object with the following properties:\n * - `operation`: Whether the user has permission to perform the operation on the field.\n * - `permissions`: The field-level permissions.\n * - `read`: Whether the user has permission to read the field.\n */\nexport const getFieldPermissions = ({\n  collectionPermissions,\n  field,\n  operation,\n  parentName,\n  permissions,\n}: {\n  readonly collectionPermissions?: SanitizedDocumentPermissions\n  readonly field: ClientField | Field\n  readonly operation: Operation\n  readonly parentName: string\n  readonly permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n}): {\n  operation: boolean\n  /**\n   * The field-level permissions. This can be equal to the permissions passed to the\n   * `getFieldPermissions` function if the field has no name.\n   */\n  permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n  read: boolean\n} => {\n  // First, calculate permissions using the existing logic\n  const fieldOperation =\n    permissions === true ||\n    permissions?.[operation as keyof typeof permissions] === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      (permissions[field.name as keyof typeof permissions] === true ||\n        (operation in (permissions as any)[field.name] &&\n          (permissions as any)[field.name][operation])))\n\n  const fieldPermissions =\n    permissions === undefined || permissions === null || permissions === true\n      ? true\n      : 'name' in field\n        ? (permissions as any)[field.name]\n        : permissions\n\n  const fieldRead =\n    permissions === true ||\n    permissions?.read === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      ((permissions as any)[field.name] === true ||\n        ('read' in (permissions as any)[field.name] && (permissions as any)[field.name].read)))\n\n  // Check if field permissions are effectively empty/missing\n  const hasFieldPermissions =\n    permissions === true ||\n    (typeof permissions === 'object' && permissions !== null && Object.keys(permissions).length > 0)\n\n  // If no field permissions are defined, fallback to collection permissions\n  if (!hasFieldPermissions && collectionPermissions) {\n    const collectionRead = Boolean(collectionPermissions.read)\n    let collectionOperation = false\n\n    // Check operation-specific permission on collection\n    if (operation === 'create' && 'create' in collectionPermissions) {\n      collectionOperation = Boolean(collectionPermissions.create)\n    } else if (operation === 'update') {\n      collectionOperation = Boolean(collectionPermissions.update)\n    } else if (operation === 'validate') {\n      collectionOperation = Boolean(collectionPermissions.validate)\n    }\n\n    return {\n      operation: collectionOperation,\n      permissions: { read: collectionRead } as SanitizedFieldPermissions,\n      read: collectionRead,\n    }\n  }\n\n  // Return the calculated permissions\n  return {\n    operation: Boolean(fieldOperation),\n    permissions: fieldPermissions,\n    read: Boolean(fieldRead),\n  }\n}\n"],"names":["getFieldPermissions","collectionPermissions","field","operation","parentName","permissions","fieldOperation","name","fieldPermissions","undefined","fieldRead","read","hasFieldPermissions","Object","keys","length","collectionRead","Boolean","collectionOperation","create","update","validate"],"mappings":"AAAA,qDAAqD,GASrD;;;;;;CAMC,GACD,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,qBAAqB,EACrBC,KAAK,EACLC,SAAS,EACTC,UAAU,EACVC,WAAW,EAOZ;IASC,wDAAwD;IACxD,MAAMC,iBACJD,gBAAgB,QAChBA,aAAa,CAACF,UAAsC,KAAK,QACzDE,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpDF,CAAAA,WAAW,CAACH,MAAMK,IAAI,CAA6B,KAAK,QACtDJ,aAAa,AAACE,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAC5C,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACJ,UAAU;IAEnD,MAAMK,mBACJH,gBAAgBI,aAAaJ,gBAAgB,QAAQA,gBAAgB,OACjE,OACA,UAAUH,QACR,AAACG,WAAmB,CAACH,MAAMK,IAAI,CAAC,GAChCF;IAER,MAAMK,YACJL,gBAAgB,QAChBA,aAAaM,SAAS,QACtBN,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpD,CAAA,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,KAAK,QACnC,UAAU,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAAI,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACI,IAAI;IAE1F,2DAA2D;IAC3D,MAAMC,sBACJP,gBAAgB,QACf,OAAOA,gBAAgB,YAAYA,gBAAgB,QAAQQ,OAAOC,IAAI,CAACT,aAAaU,MAAM,GAAG;IAEhG,0EAA0E;IAC1E,IAAI,CAACH,uBAAuBX,uBAAuB;QACjD,MAAMe,iBAAiBC,QAAQhB,sBAAsBU,IAAI;QACzD,IAAIO,sBAAsB;QAE1B,oDAAoD;QACpD,IAAIf,cAAc,YAAY,YAAYF,uBAAuB;YAC/DiB,sBAAsBD,QAAQhB,sBAAsBkB,MAAM;QAC5D,OAAO,IAAIhB,cAAc,UAAU;YACjCe,sBAAsBD,QAAQhB,sBAAsBmB,MAAM;QAC5D,OAAO,IAAIjB,cAAc,YAAY;YACnCe,sBAAsBD,QAAQhB,sBAAsBoB,QAAQ;QAC9D;QAEA,OAAO;YACLlB,WAAWe;YACXb,aAAa;gBAAEM,MAAMK;YAAe;YACpCL,MAAMK;QACR;IACF;IAEA,oCAAoC;IACpC,OAAO;QACLb,WAAWc,QAAQX;QACnBD,aAAaG;QACbG,MAAMM,QAAQP;IAChB;AACF,EAAC"}

package/dist/utilities/getNextVersion.d.ts

@@ -0,0 +1,10 @@
+/**
+ * TODO: Only used to pick the dev HMR path for Next.js versions older than the minimum supported
+ * one, to make migrating easier. Remove together with the legacy path in `nextJsDevReloadStrategy`.
+ *
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */
+export declare const getNextVersion: () => string | undefined;
+//# sourceMappingURL=getNextVersion.d.ts.map

package/dist/utilities/getNextVersion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getNextVersion.d.ts","sourceRoot":"","sources":["../../src/utilities/getNextVersion.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,MAAM,GAAG,SAc1C,CAAA"}

package/dist/utilities/getNextVersion.js

@@ -0,0 +1,23 @@
+import { readFileSync } from 'fs';
+import { resolveFrom } from './dependencies/resolveFrom.js';
+/**
+ * TODO: Only used to pick the dev HMR path for Next.js versions older than the minimum supported
+ * one, to make migrating easier. Remove together with the legacy path in `nextJsDevReloadStrategy`.
+ *
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */ export const getNextVersion = ()=>{
+    try {
+        const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true);
+        if (!packageJSONPath) {
+            return undefined;
+        }
+        const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'));
+        return typeof version === 'string' ? version : undefined;
+    } catch (_) {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=getNextVersion.js.map

package/dist/utilities/getNextVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getNextVersion.ts"],"sourcesContent":["import { readFileSync } from 'fs'\n\nimport { resolveFrom } from './dependencies/resolveFrom.js'\n\n/**\n * TODO: Only used to pick the dev HMR path for Next.js versions older than the minimum supported\n * one, to make migrating easier. Remove together with the legacy path in `nextJsDevReloadStrategy`.\n *\n * Reads the version of the Next.js installed alongside the running app.\n * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs\n * outside of Next.js or from a directory the app's dependencies are not visible from.\n */\nexport const getNextVersion = (): string | undefined => {\n  try {\n    const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true)\n\n    if (!packageJSONPath) {\n      return undefined\n    }\n\n    const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'))\n\n    return typeof version === 'string' ? version : undefined\n  } catch (_) {\n    return undefined\n  }\n}\n"],"names":["readFileSync","resolveFrom","getNextVersion","packageJSONPath","process","cwd","undefined","version","JSON","parse","_"],"mappings":"AAAA,SAASA,YAAY,QAAQ,KAAI;AAEjC,SAASC,WAAW,QAAQ,gCAA+B;AAE3D;;;;;;;CAOC,GACD,OAAO,MAAMC,iBAAiB;IAC5B,IAAI;QACF,MAAMC,kBAAkBF,YAAYG,QAAQC,GAAG,IAAI,qBAAqB;QAExE,IAAI,CAACF,iBAAiB;YACpB,OAAOG;QACT;QAEA,MAAM,EAAEC,OAAO,EAAE,GAAGC,KAAKC,KAAK,CAACT,aAAaG,iBAAiB;QAE7D,OAAO,OAAOI,YAAY,WAAWA,UAAUD;IACjD,EAAE,OAAOI,GAAG;QACV,OAAOJ;IACT;AACF,EAAC"}

package/dist/utilities/getObjectDotNotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAMF,CAAA"}
+{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAgBF,CAAA"}

package/dist/utilities/getObjectDotNotation.js

@@ -15,7 +15,13 @@
     if (!path || !obj) {
         return defaultValue;
     }
-    const result = path.split('.').reduce((o, i)=>o?.[i], obj);
+    let result = obj;
+    for (const segment of path.split('.')){
+        if (result === null || typeof result !== 'object' || !Object.hasOwn(result, segment)) {
+            return defaultValue;
+        }
+        result = result[segment];
+    }
     return result === undefined ? defaultValue : result;
 };