payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ea6e8f8

package/dist/collections/operations/utilities/update.js

@@ -1,15 +1,26 @@
 import { ensureUsernameOrEmail } from '../../../auth/ensureUsernameOrEmail.js';
+import { removeExpiredSessions } from '../../../auth/sessions.js';
 import { generatePasswordSaltHash } from '../../../auth/strategies/local/generatePasswordSaltHash.js';
+import { runBranchMergeWriteGuard } from '../../../branching/mergeWriteGuard.js';
+import { branchDocIDField, branchField, MAIN_BRANCH } from '../../../branching/types.js';
+import { ValidationError } from '../../../errors/index.js';
 import { afterChange } from '../../../fields/hooks/afterChange/index.js';
 import { afterRead } from '../../../fields/hooks/afterRead/index.js';
 import { beforeChange } from '../../../fields/hooks/beforeChange/index.js';
 import { beforeValidate } from '../../../fields/hooks/beforeValidate/index.js';
 import { deepCopyObjectSimple, saveVersion } from '../../../index.js';
 import { deleteAssociatedFiles } from '../../../uploads/deleteAssociatedFiles.js';
+import { deleteUploadFilesExclusiveToDocument } from '../../../uploads/deleteUploadFilesExclusiveToDocument.js';
+import { runLocalFileUpdate } from '../../../uploads/fileVersioning/archive.js';
 import { uploadFiles } from '../../../uploads/uploadFiles.js';
 import { checkDocumentLockStatus } from '../../../utilities/checkDocumentLockStatus.js';
+import { getTopLevelFieldNames } from '../../../utilities/getTopLevelFieldNames.js';
 import { hasDraftsEnabled, hasDraftValidationEnabled, hasLocalizeStatusEnabled } from '../../../utilities/getVersionsConfig.js';
+import { resolvePublishAllLocales } from '../../../utilities/resolvePublishAllLocales.js';
+import { markTransactionWrite } from '../../../utilities/transactionMutationTracker.js';
+import { buildAllLocalesPublicationHookDoc, getAllLocalesPublicationStatus, hasAuthorizedAllLocalesPublicationStatus, validateAllLocalesPublicationFlags } from '../../../versions/allLocalesPublicationStatus.js';
 import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePublishData.js';
+import { validateLocalWithLocaleKeyedData } from '../local/validate.js';
 /**
  * This function is used to update a document in the DB and return the result.
  *
@@ -22,14 +33,28 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
  * - afterRead - Collection
  * - afterChange - Fields
  * - afterChange - Collection
- */ export const updateDocument = async ({ id, autosave, collectionConfig, config, data, depth, docWithLocales, draftArg, fallbackLocale, filesToUpload, locale, overrideAccess, overrideLock, payload, populate, publishAllLocales: publishAllLocalesArg, req, select, showHiddenFields, unpublishAllLocales: unpublishAllLocalesArg })=>{
-    const password = data?.password;
-    const publishAllLocales = !draftArg && (publishAllLocalesArg ?? (hasLocalizeStatusEnabled(collectionConfig) && locale !== 'all' ? false : true));
+ */ export const updateDocument = async ({ id, autosave, collectionConfig, config, data, databaseReq, depth, docWithLocales, draftArg, fallbackLocale, filesToUpload, locale, onBeforeDocumentWrite, operation = 'update', overrideAccess, overrideLock, payload, populate, publishAllLocales: publishAllLocalesArg, req, select, shouldManageLocalFiles, showHiddenFields, unpublishAllLocales: unpublishAllLocalesArg, uploadFileRollbacks })=>{
+    const databaseRequest = databaseReq ?? req;
+    const nextFileData = collectionConfig.upload && shouldManageLocalFiles && !collectionConfig.upload.fileOperations ? deepCopyObjectSimple(data) : undefined;
+    validateAllLocalesPublicationFlags({
+        publishAllLocales: publishAllLocalesArg,
+        unpublishAllLocales: unpublishAllLocalesArg
+    });
+    const publishAllLocales = resolvePublishAllLocales({
+        draft: draftArg,
+        hasLocalizeStatusEnabled: hasLocalizeStatusEnabled(collectionConfig),
+        locale,
+        publishAllLocalesArg
+    });
     const unpublishAllLocales = typeof unpublishAllLocalesArg === 'string' ? unpublishAllLocalesArg === 'true' : !!unpublishAllLocalesArg;
+    const allLocalesPublicationStatus = getAllLocalesPublicationStatus({
+        hasLocalizedStatus: Boolean(config.localization && hasLocalizeStatusEnabled(collectionConfig)),
+        publishAllLocales,
+        unpublishAllLocales
+    });
     const isSavingDraft = Boolean(draftArg && hasDraftsEnabled(collectionConfig)) && data._status !== 'published' && !publishAllLocales;
-    const shouldSavePassword = Boolean(password && collectionConfig.auth && (!collectionConfig.auth.disableLocalStrategy || typeof collectionConfig.auth.disableLocalStrategy === 'object' && collectionConfig.auth.disableLocalStrategy.enableFields) && !isSavingDraft);
-    if (isSavingDraft) {
-        data._status = 'draft';
+    if (allLocalesPublicationStatus || isSavingDraft) {
+        data._status = allLocalesPublicationStatus ?? 'draft';
     }
     // /////////////////////////////////////
     // Handle potentially locked documents
@@ -39,7 +64,8 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
         collectionSlug: collectionConfig.slug,
         lockErrorMessage: `Document with ID ${id} is currently locked by another user and cannot be updated.`,
         overrideLock,
-        req
+        req,
+        shouldDeleteLock: false
     });
     const originalDoc = await afterRead({
         collection: collectionConfig,
@@ -55,6 +81,8 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
         showHiddenFields: true
     });
     const isRestoringDraftFromTrash = Boolean(originalDoc?.deletedAt) && data?._status !== 'published';
+    const shouldLimitValidationToSubmittedFields = collectionConfig.trash && (Boolean(data?.deletedAt) || isRestoringDraftFromTrash) || unpublishAllLocales;
+    const submittedTopLevelFieldNames = shouldLimitValidationToSubmittedFields ? getTopLevelFieldNames(data) : undefined;
     if (collectionConfig.auth) {
         ensureUsernameOrEmail({
             authOptions: collectionConfig.auth,
@@ -65,39 +93,46 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
             req
         });
     }
-    // /////////////////////////////////////
-    // Delete any associated files
-    // /////////////////////////////////////
     // When saving a draft on a document whose latest version is published, the file
     // referenced by docWithLocales is still actively used by the published main document.
-    // Deleting it here would break the published document's file even though no publish
+    // Deleting it during the update would break the published document's file even though no publish
     // is happening. Only skip deletion in this case; when the latest version is already a
     // draft, it is safe to delete the old draft file as it is being replaced.
     const isDraftOverPublished = isSavingDraft && docWithLocales._status === 'published';
-    if (!isDraftOverPublished) {
-        await deleteAssociatedFiles({
-            collectionConfig,
-            config,
-            doc: docWithLocales,
-            files: filesToUpload,
-            overrideDelete: false,
-            req
-        });
-    }
+    const hasManagedLocalUpload = filesToUpload.length > 0 && Boolean(data.original) && !collectionConfig.upload.disableLocalStorage;
     // /////////////////////////////////////
     // beforeValidate - Fields
     // /////////////////////////////////////
+    let statusFieldAccess = false;
+    const publicationFieldPolicyDoc = buildAllLocalesPublicationHookDoc({
+        doc: originalDoc,
+        docWithLocales,
+        status: data._status === allLocalesPublicationStatus ? allLocalesPublicationStatus : undefined
+    });
     data = await beforeValidate({
         id,
         collection: collectionConfig,
         context: req.context,
         data,
         doc: originalDoc,
+        docForHooks: publicationFieldPolicyDoc,
         global: null,
-        operation: 'update',
+        onFieldAccess: ({ accessResult, path })=>{
+            if (path === '_status') {
+                statusFieldAccess = accessResult;
+            }
+        },
+        operation,
         overrideAccess,
         req
     });
+    const password = data?.password;
+    const shouldSavePassword = Boolean(password && collectionConfig.auth && (!collectionConfig.auth.disableLocalStrategy || typeof collectionConfig.auth.disableLocalStrategy === 'object' && collectionConfig.auth.disableLocalStrategy.enableFields) && !isSavingDraft);
+    const publicationHookDoc = buildAllLocalesPublicationHookDoc({
+        doc: originalDoc,
+        docWithLocales,
+        status: statusFieldAccess && data._status === allLocalesPublicationStatus ? allLocalesPublicationStatus : undefined
+    });
     // /////////////////////////////////////
     // beforeValidate - Collection
     // /////////////////////////////////////
@@ -107,19 +142,13 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
                 collection: collectionConfig,
                 context: req.context,
                 data,
-                operation: 'update',
-                originalDoc,
+                operation,
+                originalDoc: publicationHookDoc,
                 req
             }) || data;
         }
     }
     // /////////////////////////////////////
-    // Write files to local storage
-    // /////////////////////////////////////
-    if (!collectionConfig.upload.disableLocalStorage) {
-        await uploadFiles(payload, filesToUpload, req);
-    }
-    // /////////////////////////////////////
     // beforeChange - Collection
     // /////////////////////////////////////
     if (collectionConfig.hooks?.beforeChange?.length) {
@@ -128,12 +157,15 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
                 collection: collectionConfig,
                 context: req.context,
                 data,
-                operation: 'update',
-                originalDoc,
+                operation,
+                originalDoc: publicationHookDoc,
                 req
             }) || data;
         }
     }
+    const publicationData = {
+        ...data
+    };
     // /////////////////////////////////////
     // beforeChange - Fields
     // /////////////////////////////////////
@@ -145,33 +177,57 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
             ...data,
             id
         },
-        doc: originalDoc,
+        doc: publicationHookDoc,
         docWithLocales,
+        fieldsToValidate: submittedTopLevelFieldNames,
         global: null,
-        operation: 'update',
+        operation,
         overrideAccess,
         req,
-        skipValidation: // only skip validation for drafts when draft validation is false
-        isSavingDraft && !hasDraftValidationEnabled(collectionConfig) || // Skip validation for trash operations since they're just metadata updates
-        collectionConfig.trash && (Boolean(data?.deletedAt) || isRestoringDraftFromTrash) || // Skip validation for unpublish operations — they only change _status, not document data
-        unpublishAllLocales
+        // only skip validation for drafts when draft validation is false
+        skipValidation: isSavingDraft && !hasDraftValidationEnabled(collectionConfig)
     };
     // /////////////////////////////////////
     // Handle Localized Data Merging
     // /////////////////////////////////////
-    let result = await beforeChange(beforeChangeArgs);
+    let statusFieldValue;
+    let result = await beforeChange({
+        ...beforeChangeArgs,
+        onDataProcessed: (processedData)=>{
+            statusFieldValue = processedData._status;
+        }
+    });
+    const hasAuthorizedPublicationStatus = hasAuthorizedAllLocalesPublicationStatus({
+        data: publicationData,
+        fieldAccessDenied: !statusFieldAccess,
+        fieldValue: statusFieldValue,
+        status: allLocalesPublicationStatus
+    });
+    if (allLocalesPublicationStatus && !hasAuthorizedPublicationStatus && typeof statusFieldValue === 'undefined' && typeof docWithLocales._status === 'object' && docWithLocales._status !== null) {
+        result._status = {
+            ...docWithLocales._status
+        };
+    }
     if (config.localization && hasLocalizeStatusEnabled(collectionConfig) && typeof result._status === 'string') {
         const statusStr = result._status;
-        result._status = {};
-        for (const localeCode of config.localization.localeCodes){
-            ;
-            result._status[localeCode] = statusStr;
+        if (hasAuthorizedPublicationStatus && typeof docWithLocales._status === 'object' && docWithLocales._status !== null) {
+            result._status = {
+                ...docWithLocales._status
+            };
+        } else {
+            result._status = {};
+        }
+        if (!hasAuthorizedPublicationStatus) {
+            for (const localeCode of config.localization.localeCodes){
+                ;
+                result._status[localeCode] = statusStr;
+            }
         }
     }
     let localizedPublishData = null;
     if (config.localization && collectionConfig.versions) {
         if (hasLocalizeStatusEnabled(collectionConfig)) {
-            if (publishAllLocales || unpublishAllLocales) {
+            if (hasAuthorizedPublicationStatus) {
                 let accessibleLocaleCodes = config.localization.localeCodes;
                 if (config.localization.filterAvailableLocales) {
                     const filteredLocales = await config.localization.filterAvailableLocales({
@@ -190,7 +246,7 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
                 const currentDoc = await payload.db.findOne({
                     collection: collectionConfig.slug,
                     locale: 'all',
-                    req,
+                    req: databaseRequest,
                     where: {
                         id: {
                             equals: id
@@ -207,133 +263,263 @@ import { buildLocalizedPublishData } from '../../../versions/buildSingleLocalePu
             }
         }
     }
-    const dataToUpdate = {
-        ...localizedPublishData ?? result
-    };
-    // /////////////////////////////////////
-    // Handle potential password update
-    // /////////////////////////////////////
-    if (shouldSavePassword && typeof password === 'string') {
-        const { hash, salt } = await generatePasswordSaltHash({
-            collection: collectionConfig,
-            password,
-            req
+    if (config.localization && hasDraftsEnabled(collectionConfig) && publishAllLocales && !unpublishAllLocales && (!hasLocalizeStatusEnabled(collectionConfig) || hasAuthorizedPublicationStatus)) {
+        const validationResult = await validateLocalWithLocaleKeyedData({
+            operation: 'update',
+            options: {
+                id,
+                collection: collectionConfig.slug,
+                data: result,
+                draft: true,
+                locale: 'all',
+                overrideAccess,
+                req
+            },
+            payload,
+            sourceData: {
+                docWithLocales,
+                originalDoc: publicationHookDoc,
+                originalLocale: locale
+            },
+            trash: Boolean(originalDoc?.deletedAt)
         });
-        dataToUpdate.salt = salt;
-        dataToUpdate.hash = hash;
-        delete dataToUpdate.password;
-        delete data.password;
-    }
-    // /////////////////////////////////////
-    // Update
-    // /////////////////////////////////////
-    let resultWithLocales = result;
-    if (!isSavingDraft) {
-        // Ensure updatedAt date is always updated
-        dataToUpdate.updatedAt = new Date().toISOString();
-        if (localizedPublishData) {
-            // Single-locale publish: save filtered data to main doc but keep full locale data for
-            // the version so draft fetches (replaceWithDraftIfAvailable) return complete data.
-            await req.payload.db.updateOne({
+        if (!validationResult.valid) {
+            throw new ValidationError({
                 id,
                 collection: collectionConfig.slug,
-                data: dataToUpdate,
-                locale,
+                errors: validationResult.errors,
                 req
+            }, req.t);
+        }
+    }
+    // File deletion and writes must occur after the final publish validation. Validation failures
+    // leave both the persisted upload and local files untouched.
+    if (!isDraftOverPublished && !hasManagedLocalUpload) {
+        const documentBranch = docWithLocales[branchField];
+        const isBranchUploadReplacement = filesToUpload.length > 0 && typeof documentBranch === 'string' && documentBranch !== MAIN_BRANCH;
+        if (isBranchUploadReplacement) {
+            const canonicalDocument = docWithLocales[branchDocIDField];
+            const canonicalDocumentID = canonicalDocument && typeof canonicalDocument === 'object' && 'value' in canonicalDocument ? canonicalDocument.value : canonicalDocument;
+            const retainedDoc = typeof canonicalDocumentID === 'number' || typeof canonicalDocumentID === 'string' ? await payload.db.findOne({
+                branch: false,
+                collection: collectionConfig.slug,
+                req,
+                where: {
+                    and: [
+                        {
+                            [branchField]: {
+                                equals: MAIN_BRANCH
+                            }
+                        },
+                        {
+                            id: {
+                                equals: canonicalDocumentID
+                            }
+                        }
+                    ]
+                }
+            }) : null;
+            await deleteUploadFilesExclusiveToDocument({
+                collectionConfig,
+                config,
+                deleteFromAdapter: false,
+                req,
+                retainedDoc,
+                sourceDoc: docWithLocales
             });
-            resultWithLocales = {
-                ...result,
-                updatedAt: dataToUpdate.updatedAt
-            };
         } else {
-            resultWithLocales = await req.payload.db.updateOne({
-                id,
-                collection: collectionConfig.slug,
-                data: dataToUpdate,
-                locale,
+            await deleteAssociatedFiles({
+                collectionConfig,
+                config,
+                doc: docWithLocales,
+                files: filesToUpload,
+                overrideDelete: false,
                 req
             });
         }
     }
-    // /////////////////////////////////////
-    // Create version
-    // /////////////////////////////////////
-    if (collectionConfig.versions) {
-        resultWithLocales = await saveVersion({
-            id,
-            autosave,
-            collection: collectionConfig,
-            docWithLocales: resultWithLocales,
-            draft: isSavingDraft,
-            operation: 'update',
-            payload,
-            req,
-            unpublish: unpublishAllLocales
+    if (!collectionConfig.upload.disableLocalStorage && !hasManagedLocalUpload) {
+        await uploadFiles(payload, filesToUpload, req, {
+            uploadFileRollbacks
         });
     }
-    // /////////////////////////////////////
-    // afterRead - Fields
-    // /////////////////////////////////////
-    result = await afterRead({
-        collection: collectionConfig,
-        context: req.context,
-        depth,
-        doc: resultWithLocales,
-        draft: draftArg,
-        fallbackLocale,
-        global: null,
-        locale,
-        overrideAccess,
-        populate,
-        req,
-        select,
-        showHiddenFields
-    });
-    // /////////////////////////////////////
-    // afterRead - Collection
-    // /////////////////////////////////////
-    if (collectionConfig.hooks?.afterRead?.length) {
-        for (const hook of collectionConfig.hooks.afterRead){
-            result = await hook({
+    const writeDocument = async ()=>{
+        const dataToUpdate = {
+            ...localizedPublishData ?? result
+        };
+        // /////////////////////////////////////
+        // Handle potential password update
+        // /////////////////////////////////////
+        if (shouldSavePassword && typeof password === 'string') {
+            const { hash, salt } = await generatePasswordSaltHash({
                 collection: collectionConfig,
-                context: req.context,
-                doc: result,
-                overrideAccess,
+                password,
                 req
-            }) || result;
+            });
+            dataToUpdate.salt = salt;
+            dataToUpdate.hash = hash;
+            delete dataToUpdate.password;
+            delete data.password;
+            if (collectionConfig.auth?.useSessions) {
+                const currentSid = req.user?.collection === collectionConfig.slug && String(req.user.id) === String(id) ? req.user._sid : undefined;
+                const existingSessions = removeExpiredSessions(docWithLocales.sessions ?? []);
+                dataToUpdate.sessions = currentSid ? existingSessions.filter((session)=>session.id === currentSid) : [];
+            }
         }
-    }
-    // /////////////////////////////////////
-    // afterChange - Fields
-    // /////////////////////////////////////
-    result = await afterChange({
-        collection: collectionConfig,
-        context: req.context,
-        data,
-        doc: result,
-        global: null,
-        operation: 'update',
-        previousDoc: originalDoc,
-        req
-    });
-    // /////////////////////////////////////
-    // afterChange - Collection
-    // /////////////////////////////////////
-    if (collectionConfig.hooks?.afterChange?.length) {
-        for (const hook of collectionConfig.hooks.afterChange){
-            result = await hook({
+        await runBranchMergeWriteGuard({
+            collectionSlug: collectionConfig.slug,
+            data: dataToUpdate,
+            req
+        });
+        if (localizedPublishData) {
+            await runBranchMergeWriteGuard({
+                collectionSlug: collectionConfig.slug,
+                data: result,
+                req
+            });
+        }
+        await checkDocumentLockStatus({
+            id,
+            collectionSlug: collectionConfig.slug,
+            lockErrorMessage: `Document with ID ${id} is currently locked by another user and cannot be updated.`,
+            overrideLock,
+            req
+        });
+        // /////////////////////////////////////
+        // Update
+        // /////////////////////////////////////
+        let resultWithLocales = result;
+        if (!isSavingDraft) {
+            // Ensure updatedAt date is always updated
+            dataToUpdate.updatedAt = new Date().toISOString();
+            onBeforeDocumentWrite?.();
+            if (localizedPublishData) {
+                // Single-locale publish: save filtered data to main doc but keep full locale data for
+                // the version so draft fetches (replaceWithDraftIfAvailable) return complete data.
+                await req.payload.db.updateOne({
+                    id,
+                    collection: collectionConfig.slug,
+                    data: dataToUpdate,
+                    locale,
+                    req: databaseRequest
+                });
+                markTransactionWrite({
+                    req
+                });
+                resultWithLocales = {
+                    ...result,
+                    updatedAt: dataToUpdate.updatedAt
+                };
+            } else {
+                resultWithLocales = await req.payload.db.updateOne({
+                    id,
+                    collection: collectionConfig.slug,
+                    data: dataToUpdate,
+                    locale,
+                    req: databaseRequest
+                });
+                markTransactionWrite({
+                    req
+                });
+            }
+        }
+        // /////////////////////////////////////
+        // Create version
+        // /////////////////////////////////////
+        if (collectionConfig.versions) {
+            onBeforeDocumentWrite?.();
+            resultWithLocales = await saveVersion({
+                id,
+                autosave,
                 collection: collectionConfig,
-                context: req.context,
-                data,
-                doc: result,
+                docWithLocales: resultWithLocales,
+                draft: isSavingDraft,
                 operation: 'update',
-                overrideAccess,
-                previousDoc: originalDoc,
+                payload,
+                req: databaseRequest,
+                unpublish: unpublishAllLocales
+            });
+            markTransactionWrite({
                 req
-            }) || result;
+            });
         }
+        // /////////////////////////////////////
+        // afterRead - Fields
+        // /////////////////////////////////////
+        result = await afterRead({
+            collection: collectionConfig,
+            context: req.context,
+            depth,
+            doc: resultWithLocales,
+            draft: draftArg,
+            fallbackLocale,
+            global: null,
+            locale,
+            overrideAccess,
+            populate,
+            req,
+            select,
+            showHiddenFields
+        });
+        // /////////////////////////////////////
+        // afterRead - Collection
+        // /////////////////////////////////////
+        if (collectionConfig.hooks?.afterRead?.length) {
+            for (const hook of collectionConfig.hooks.afterRead){
+                result = await hook({
+                    collection: collectionConfig,
+                    context: req.context,
+                    doc: result,
+                    overrideAccess,
+                    req
+                }) || result;
+            }
+        }
+        // /////////////////////////////////////
+        // afterChange - Fields
+        // /////////////////////////////////////
+        result = await afterChange({
+            collection: collectionConfig,
+            context: req.context,
+            data,
+            doc: result,
+            global: null,
+            operation,
+            previousDoc: originalDoc,
+            req
+        });
+        // /////////////////////////////////////
+        // afterChange - Collection
+        // /////////////////////////////////////
+        if (collectionConfig.hooks?.afterChange?.length) {
+            for (const hook of collectionConfig.hooks.afterChange){
+                result = await hook({
+                    collection: collectionConfig,
+                    context: req.context,
+                    data,
+                    doc: result,
+                    operation,
+                    overrideAccess,
+                    previousDoc: originalDoc,
+                    req,
+                    select
+                }) || result;
+            }
+        }
+        return result;
+    };
+    if (!nextFileData) {
+        return writeDocument();
     }
-    return result;
+    return runLocalFileUpdate({
+        id,
+        collection: collectionConfig,
+        current: docWithLocales,
+        files: hasManagedLocalUpload ? filesToUpload : [],
+        next: nextFileData,
+        req,
+        write: writeDocument
+    });
 };
 
 //# sourceMappingURL=update.js.map