payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ee5d8bd

package/dist/auth/baseFields/apiKey.js

@@ -1,70 +1,101 @@
-import crypto from 'crypto';
-const encryptKey = ({ req, value })=>value ? req.payload.encrypt(value) : null;
-const decryptKey = ({ req, value })=>value ? req.payload.decrypt(value) : undefined;
-export const createAPIKeyFields = ({ apiKeyField, apiKeyIndexField, enableAPIKeyField, includeEnableAPIKey = true } = {})=>{
-    const fields = [];
-    if (includeEnableAPIKey) {
-        fields.push({
-            name: 'enableAPIKey',
-            type: 'checkbox',
-            ...enableAPIKeyField,
+import { fieldAffectsData } from '../../fields/config/types.js';
+import { canCreateOrUpdateAPIKey } from './apiKey/canCreateOrUpdateAPIKey.js';
+import { encryptAPIKey } from './apiKey/encryptAPIKey.js';
+import { omitAPIKeyIndex } from './apiKey/omitAPIKeyIndex.js';
+import { omitEncryptedAPIKey } from './apiKey/omitEncryptedAPIKey.js';
+import { setAPIKeyIndex } from './apiKey/setAPIKeyIndex.js';
+import { setKeyLast4 } from './apiKey/setKeyLast4.js';
+export { omitAPIKey } from './apiKey/omitAPIKey.js';
+export const createAPIKeyFields = ({ apiKeyField, apiKeyIndexField, apiKeyLast4Field } = {})=>{
+    const customAccess = apiKeyField?.access;
+    return [
+        {
+            name: 'apiKey',
+            type: 'text',
+            ...apiKeyField,
+            access: {
+                create: canCreateOrUpdateAPIKey,
+                ...apiKeyField?.access,
+                read: ()=>false,
+                update: apiKeyField?.access?.update ?? canCreateOrUpdateAPIKey
+            },
             admin: {
                 components: {
                     Field: false
                 },
-                ...enableAPIKeyField?.admin
+                ...apiKeyField?.admin
             },
-            label: enableAPIKeyField?.label ?? (({ t })=>t('authentication:enableAPIKey'))
-        });
-    }
-    fields.push({
-        name: 'apiKey',
-        type: 'text',
-        ...apiKeyField,
-        admin: {
-            components: {
-                Field: false
+            hooks: {
+                ...apiKeyField?.hooks,
+                afterRead: [
+                    omitEncryptedAPIKey,
+                    ...apiKeyField?.hooks?.afterRead ?? []
+                ],
+                beforeChange: [
+                    encryptAPIKey,
+                    ...apiKeyField?.hooks?.beforeChange ?? []
+                ]
             },
-            ...apiKeyField?.admin
-        },
-        hooks: {
-            afterRead: [
-                decryptKey
-            ],
-            beforeChange: [
-                encryptKey
-            ],
-            ...apiKeyField?.hooks
+            label: apiKeyField?.label ?? (({ t })=>t('authentication:apiKey'))
         },
-        label: apiKeyField?.label ?? (({ t })=>t('authentication:apiKey'))
-    }, {
-        name: 'apiKeyIndex',
-        type: 'text',
-        ...apiKeyIndexField,
-        admin: {
-            disabled: true,
-            ...apiKeyIndexField?.admin
+        {
+            name: 'apiKeyLast4',
+            type: 'text',
+            ...apiKeyLast4Field,
+            access: {
+                ...apiKeyLast4Field?.access,
+                create: customAccess?.create ?? canCreateOrUpdateAPIKey,
+                read: customAccess?.update ?? canCreateOrUpdateAPIKey,
+                update: customAccess?.update ?? canCreateOrUpdateAPIKey
+            },
+            admin: {
+                components: {
+                    Field: false
+                },
+                ...apiKeyLast4Field?.admin
+            },
+            hooks: {
+                ...apiKeyLast4Field?.hooks,
+                beforeValidate: [
+                    setKeyLast4,
+                    ...apiKeyLast4Field?.hooks?.beforeValidate ?? []
+                ]
+            }
         },
-        hidden: apiKeyIndexField?.hidden ?? true,
-        hooks: {
-            beforeValidate: [
-                ({ data, req, value })=>{
-                    if (data?.apiKey === false || data?.apiKey === null || data?.apiKey === '') {
-                        return null;
-                    }
-                    if (includeEnableAPIKey && (data?.enableAPIKey === false || data?.enableAPIKey === null)) {
-                        return null;
-                    }
-                    if (data?.apiKey) {
-                        return crypto.createHmac('sha256', req.payload.secret).update(data.apiKey).digest('hex');
-                    }
-                    return value;
-                }
-            ],
-            ...apiKeyIndexField?.hooks
+        {
+            name: 'apiKeyIndex',
+            type: 'text',
+            ...apiKeyIndexField,
+            access: {
+                ...apiKeyIndexField?.access,
+                create: customAccess?.create ?? canCreateOrUpdateAPIKey,
+                read: ()=>false,
+                update: customAccess?.update ?? canCreateOrUpdateAPIKey
+            },
+            admin: {
+                disabled: true,
+                ...apiKeyIndexField?.admin
+            },
+            hidden: apiKeyIndexField?.hidden ?? true,
+            hooks: {
+                ...apiKeyIndexField?.hooks,
+                afterRead: [
+                    omitAPIKeyIndex,
+                    ...apiKeyIndexField?.hooks?.afterRead ?? []
+                ],
+                beforeValidate: [
+                    setAPIKeyIndex,
+                    ...apiKeyIndexField?.hooks?.beforeValidate ?? []
+                ]
+            }
         }
+    ];
+};
+/** Builds API key fields and safely merges custom overrides. */ export const getAPIKeyFields = (fields)=>{
+    const customAPIKeyField = fields.find((field)=>fieldAffectsData(field) && field.name === 'apiKey' && field.type === 'text');
+    return createAPIKeyFields({
+        apiKeyField: customAPIKeyField
     });
-    return fields;
 };
 
 //# sourceMappingURL=apiKey.js.map

package/dist/auth/baseFields/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/baseFields/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { CheckboxField, Field, FieldHook, TextField } from '../../fields/config/types.js'\n\nconst encryptKey: FieldHook = ({ req, value }) =>\n  value ? req.payload.encrypt(value as string) : null\nconst decryptKey: FieldHook = ({ req, value }) =>\n  value ? req.payload.decrypt(value as string) : undefined\n\ntype APIKeyCheckboxFieldOverride = Omit<Partial<CheckboxField>, 'name' | 'type'>\ntype APIKeyTextFieldOverride = Omit<\n  Partial<TextField>,\n  'hasMany' | 'maxRows' | 'minRows' | 'name' | 'type' | 'validate'\n>\n\nexport const createAPIKeyFields = ({\n  apiKeyField,\n  apiKeyIndexField,\n  enableAPIKeyField,\n  includeEnableAPIKey = true,\n}: {\n  apiKeyField?: APIKeyTextFieldOverride\n  apiKeyIndexField?: APIKeyTextFieldOverride\n  enableAPIKeyField?: APIKeyCheckboxFieldOverride\n  includeEnableAPIKey?: boolean\n} = {}): Field[] => {\n  const fields: Field[] = []\n\n  if (includeEnableAPIKey) {\n    fields.push({\n      name: 'enableAPIKey',\n      type: 'checkbox',\n      ...enableAPIKeyField,\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...enableAPIKeyField?.admin,\n      },\n      label: enableAPIKeyField?.label ?? (({ t }) => t('authentication:enableAPIKey')),\n    })\n  }\n\n  fields.push(\n    {\n      name: 'apiKey',\n      type: 'text',\n      ...apiKeyField,\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...apiKeyField?.admin,\n      },\n      hooks: {\n        afterRead: [decryptKey],\n        beforeChange: [encryptKey],\n        ...apiKeyField?.hooks,\n      },\n      label: apiKeyField?.label ?? (({ t }) => t('authentication:apiKey')),\n    },\n    {\n      name: 'apiKeyIndex',\n      type: 'text',\n      ...apiKeyIndexField,\n      admin: {\n        disabled: true,\n        ...apiKeyIndexField?.admin,\n      },\n      hidden: apiKeyIndexField?.hidden ?? true,\n      hooks: {\n        beforeValidate: [\n          ({ data, req, value }) => {\n            if (data?.apiKey === false || data?.apiKey === null || data?.apiKey === '') {\n              return null\n            }\n            if (\n              includeEnableAPIKey &&\n              (data?.enableAPIKey === false || data?.enableAPIKey === null)\n            ) {\n              return null\n            }\n            if (data?.apiKey) {\n              return crypto\n                .createHmac('sha256', req.payload.secret)\n                .update(data.apiKey as string)\n                .digest('hex')\n            }\n            return value\n          },\n        ],\n        ...apiKeyIndexField?.hooks,\n      },\n    },\n  )\n\n  return fields\n}\n"],"names":["crypto","encryptKey","req","value","payload","encrypt","decryptKey","decrypt","undefined","createAPIKeyFields","apiKeyField","apiKeyIndexField","enableAPIKeyField","includeEnableAPIKey","fields","push","name","type","admin","components","Field","label","t","hooks","afterRead","beforeChange","disabled","hidden","beforeValidate","data","apiKey","enableAPIKey","createHmac","secret","update","digest"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAI3B,MAAMC,aAAwB,CAAC,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAC3CA,QAAQD,IAAIE,OAAO,CAACC,OAAO,CAACF,SAAmB;AACjD,MAAMG,aAAwB,CAAC,EAAEJ,GAAG,EAAEC,KAAK,EAAE,GAC3CA,QAAQD,IAAIE,OAAO,CAACG,OAAO,CAACJ,SAAmBK;AAQjD,OAAO,MAAMC,qBAAqB,CAAC,EACjCC,WAAW,EACXC,gBAAgB,EAChBC,iBAAiB,EACjBC,sBAAsB,IAAI,EAM3B,GAAG,CAAC,CAAC;IACJ,MAAMC,SAAkB,EAAE;IAE1B,IAAID,qBAAqB;QACvBC,OAAOC,IAAI,CAAC;YACVC,MAAM;YACNC,MAAM;YACN,GAAGL,iBAAiB;YACpBM,OAAO;gBACLC,YAAY;oBACVC,OAAO;gBACT;gBACA,GAAGR,mBAAmBM,KAAK;YAC7B;YACAG,OAAOT,mBAAmBS,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,8BAA6B;QAChF;IACF;IAEAR,OAAOC,IAAI,CACT;QACEC,MAAM;QACNC,MAAM;QACN,GAAGP,WAAW;QACdQ,OAAO;YACLC,YAAY;gBACVC,OAAO;YACT;YACA,GAAGV,aAAaQ,KAAK;QACvB;QACAK,OAAO;YACLC,WAAW;gBAAClB;aAAW;YACvBmB,cAAc;gBAACxB;aAAW;YAC1B,GAAGS,aAAaa,KAAK;QACvB;QACAF,OAAOX,aAAaW,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,wBAAuB;IACpE,GACA;QACEN,MAAM;QACNC,MAAM;QACN,GAAGN,gBAAgB;QACnBO,OAAO;YACLQ,UAAU;YACV,GAAGf,kBAAkBO,KAAK;QAC5B;QACAS,QAAQhB,kBAAkBgB,UAAU;QACpCJ,OAAO;YACLK,gBAAgB;gBACd,CAAC,EAAEC,IAAI,EAAE3B,GAAG,EAAEC,KAAK,EAAE;oBACnB,IAAI0B,MAAMC,WAAW,SAASD,MAAMC,WAAW,QAAQD,MAAMC,WAAW,IAAI;wBAC1E,OAAO;oBACT;oBACA,IACEjB,uBACCgB,CAAAA,MAAME,iBAAiB,SAASF,MAAME,iBAAiB,IAAG,GAC3D;wBACA,OAAO;oBACT;oBACA,IAAIF,MAAMC,QAAQ;wBAChB,OAAO9B,OACJgC,UAAU,CAAC,UAAU9B,IAAIE,OAAO,CAAC6B,MAAM,EACvCC,MAAM,CAACL,KAAKC,MAAM,EAClBK,MAAM,CAAC;oBACZ;oBACA,OAAOhC;gBACT;aACD;YACD,GAAGQ,kBAAkBY,KAAK;QAC5B;IACF;IAGF,OAAOT;AACT,EAAC"}
+{"version":3,"sources":["../../../src/auth/baseFields/apiKey.ts"],"sourcesContent":["import type { Field, TextField } from '../../fields/config/types.js'\n\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { canCreateOrUpdateAPIKey } from './apiKey/canCreateOrUpdateAPIKey.js'\nimport { encryptAPIKey } from './apiKey/encryptAPIKey.js'\nimport { omitAPIKeyIndex } from './apiKey/omitAPIKeyIndex.js'\nimport { omitEncryptedAPIKey } from './apiKey/omitEncryptedAPIKey.js'\nimport { setAPIKeyIndex } from './apiKey/setAPIKeyIndex.js'\nimport { setKeyLast4 } from './apiKey/setKeyLast4.js'\n\nexport { omitAPIKey } from './apiKey/omitAPIKey.js'\n\ntype APIKeyTextFieldOverride = Omit<\n  Partial<TextField>,\n  'hasMany' | 'maxRows' | 'minRows' | 'name' | 'type' | 'validate'\n>\n\nexport const createAPIKeyFields = ({\n  apiKeyField,\n  apiKeyIndexField,\n  apiKeyLast4Field,\n}: {\n  apiKeyField?: APIKeyTextFieldOverride\n  apiKeyIndexField?: APIKeyTextFieldOverride\n  apiKeyLast4Field?: APIKeyTextFieldOverride\n} = {}): Field[] => {\n  const customAccess = apiKeyField?.access\n\n  return [\n    {\n      name: 'apiKey',\n      type: 'text',\n      ...apiKeyField,\n      access: {\n        create: canCreateOrUpdateAPIKey,\n        ...apiKeyField?.access,\n        read: () => false,\n        update: apiKeyField?.access?.update ?? canCreateOrUpdateAPIKey,\n      },\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...apiKeyField?.admin,\n      },\n      hooks: {\n        ...apiKeyField?.hooks,\n        afterRead: [omitEncryptedAPIKey, ...(apiKeyField?.hooks?.afterRead ?? [])],\n        beforeChange: [encryptAPIKey, ...(apiKeyField?.hooks?.beforeChange ?? [])],\n      },\n      label: apiKeyField?.label ?? (({ t }) => t('authentication:apiKey')),\n    },\n    {\n      name: 'apiKeyLast4',\n      type: 'text',\n      ...apiKeyLast4Field,\n      access: {\n        ...apiKeyLast4Field?.access,\n        create: customAccess?.create ?? canCreateOrUpdateAPIKey,\n        read: customAccess?.update ?? canCreateOrUpdateAPIKey,\n        update: customAccess?.update ?? canCreateOrUpdateAPIKey,\n      },\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...apiKeyLast4Field?.admin,\n      },\n      hooks: {\n        ...apiKeyLast4Field?.hooks,\n        beforeValidate: [setKeyLast4, ...(apiKeyLast4Field?.hooks?.beforeValidate ?? [])],\n      },\n    },\n    {\n      name: 'apiKeyIndex',\n      type: 'text',\n      ...apiKeyIndexField,\n      access: {\n        ...apiKeyIndexField?.access,\n        create: customAccess?.create ?? canCreateOrUpdateAPIKey,\n        read: () => false,\n        update: customAccess?.update ?? canCreateOrUpdateAPIKey,\n      },\n      admin: {\n        disabled: true,\n        ...apiKeyIndexField?.admin,\n      },\n      hidden: apiKeyIndexField?.hidden ?? true,\n      hooks: {\n        ...apiKeyIndexField?.hooks,\n        afterRead: [omitAPIKeyIndex, ...(apiKeyIndexField?.hooks?.afterRead ?? [])],\n        beforeValidate: [setAPIKeyIndex, ...(apiKeyIndexField?.hooks?.beforeValidate ?? [])],\n      },\n    },\n  ]\n}\n\n/** Builds API key fields and safely merges custom overrides. */\nexport const getAPIKeyFields = (fields: Field[]): Field[] => {\n  const customAPIKeyField = fields.find(\n    (field) => fieldAffectsData(field) && field.name === 'apiKey' && field.type === 'text',\n  )\n\n  return createAPIKeyFields({ apiKeyField: customAPIKeyField as TextField | undefined })\n}\n"],"names":["fieldAffectsData","canCreateOrUpdateAPIKey","encryptAPIKey","omitAPIKeyIndex","omitEncryptedAPIKey","setAPIKeyIndex","setKeyLast4","omitAPIKey","createAPIKeyFields","apiKeyField","apiKeyIndexField","apiKeyLast4Field","customAccess","access","name","type","create","read","update","admin","components","Field","hooks","afterRead","beforeChange","label","t","beforeValidate","disabled","hidden","getAPIKeyFields","fields","customAPIKeyField","find","field"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,uBAAuB,QAAQ,sCAAqC;AAC7E,SAASC,aAAa,QAAQ,4BAA2B;AACzD,SAASC,eAAe,QAAQ,8BAA6B;AAC7D,SAASC,mBAAmB,QAAQ,kCAAiC;AACrE,SAASC,cAAc,QAAQ,6BAA4B;AAC3D,SAASC,WAAW,QAAQ,0BAAyB;AAErD,SAASC,UAAU,QAAQ,yBAAwB;AAOnD,OAAO,MAAMC,qBAAqB,CAAC,EACjCC,WAAW,EACXC,gBAAgB,EAChBC,gBAAgB,EAKjB,GAAG,CAAC,CAAC;IACJ,MAAMC,eAAeH,aAAaI;IAElC,OAAO;QACL;YACEC,MAAM;YACNC,MAAM;YACN,GAAGN,WAAW;YACdI,QAAQ;gBACNG,QAAQf;gBACR,GAAGQ,aAAaI,MAAM;gBACtBI,MAAM,IAAM;gBACZC,QAAQT,aAAaI,QAAQK,UAAUjB;YACzC;YACAkB,OAAO;gBACLC,YAAY;oBACVC,OAAO;gBACT;gBACA,GAAGZ,aAAaU,KAAK;YACvB;YACAG,OAAO;gBACL,GAAGb,aAAaa,KAAK;gBACrBC,WAAW;oBAACnB;uBAAyBK,aAAaa,OAAOC,aAAa,EAAE;iBAAE;gBAC1EC,cAAc;oBAACtB;uBAAmBO,aAAaa,OAAOE,gBAAgB,EAAE;iBAAE;YAC5E;YACAC,OAAOhB,aAAagB,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,wBAAuB;QACpE;QACA;YACEZ,MAAM;YACNC,MAAM;YACN,GAAGJ,gBAAgB;YACnBE,QAAQ;gBACN,GAAGF,kBAAkBE,MAAM;gBAC3BG,QAAQJ,cAAcI,UAAUf;gBAChCgB,MAAML,cAAcM,UAAUjB;gBAC9BiB,QAAQN,cAAcM,UAAUjB;YAClC;YACAkB,OAAO;gBACLC,YAAY;oBACVC,OAAO;gBACT;gBACA,GAAGV,kBAAkBQ,KAAK;YAC5B;YACAG,OAAO;gBACL,GAAGX,kBAAkBW,KAAK;gBAC1BK,gBAAgB;oBAACrB;uBAAiBK,kBAAkBW,OAAOK,kBAAkB,EAAE;iBAAE;YACnF;QACF;QACA;YACEb,MAAM;YACNC,MAAM;YACN,GAAGL,gBAAgB;YACnBG,QAAQ;gBACN,GAAGH,kBAAkBG,MAAM;gBAC3BG,QAAQJ,cAAcI,UAAUf;gBAChCgB,MAAM,IAAM;gBACZC,QAAQN,cAAcM,UAAUjB;YAClC;YACAkB,OAAO;gBACLS,UAAU;gBACV,GAAGlB,kBAAkBS,KAAK;YAC5B;YACAU,QAAQnB,kBAAkBmB,UAAU;YACpCP,OAAO;gBACL,GAAGZ,kBAAkBY,KAAK;gBAC1BC,WAAW;oBAACpB;uBAAqBO,kBAAkBY,OAAOC,aAAa,EAAE;iBAAE;gBAC3EI,gBAAgB;oBAACtB;uBAAoBK,kBAAkBY,OAAOK,kBAAkB,EAAE;iBAAE;YACtF;QACF;KACD;AACH,EAAC;AAED,8DAA8D,GAC9D,OAAO,MAAMG,kBAAkB,CAACC;IAC9B,MAAMC,oBAAoBD,OAAOE,IAAI,CACnC,CAACC,QAAUlC,iBAAiBkC,UAAUA,MAAMpB,IAAI,KAAK,YAAYoB,MAAMnB,IAAI,KAAK;IAGlF,OAAOP,mBAAmB;QAAEC,aAAauB;IAA2C;AACtF,EAAC"}

package/dist/auth/baseFields/auth.d.ts

@@ -1,3 +1,4 @@
 import type { Field } from '../../fields/config/types.js';
 export declare const baseAuthFields: Field[];
+export declare const resetPasswordRequestedAtField: Field;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth/baseFields/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/baseFields/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD,eAAO,MAAM,cAAc,EAAE,KAAK,EAqCjC,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/baseFields/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD,eAAO,MAAM,cAAc,EAAE,KAAK,EAqCjC,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAE,KAQ3C,CAAA"}

package/dist/auth/baseFields/auth.js

@@ -36,5 +36,14 @@ export const baseAuthFields = [
         hidden: true
     }
 ];
+export const resetPasswordRequestedAtField = {
+    name: 'resetPasswordRequestedAt',
+    type: 'date',
+    access: {
+        create: ()=>false,
+        update: ()=>false
+    },
+    hidden: true
+};
 
 //# sourceMappingURL=auth.js.map

package/dist/auth/baseFields/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/baseFields/auth.ts"],"sourcesContent":["import type { Field } from '../../fields/config/types.js'\n\nexport const baseAuthFields: Field[] = [\n  {\n    name: 'resetPasswordToken',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'resetPasswordExpiration',\n    type: 'date',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'salt',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'hash',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n]\n"],"names":["baseAuthFields","name","type","access","create","update","hidden"],"mappings":"AAEA,OAAO,MAAMA,iBAA0B;IACrC;QACEC,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;CACD,CAAA"}
+{"version":3,"sources":["../../../src/auth/baseFields/auth.ts"],"sourcesContent":["import type { Field } from '../../fields/config/types.js'\n\nexport const baseAuthFields: Field[] = [\n  {\n    name: 'resetPasswordToken',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'resetPasswordExpiration',\n    type: 'date',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'salt',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n  {\n    name: 'hash',\n    type: 'text',\n    access: {\n      create: () => false,\n      update: () => false,\n    },\n    hidden: true,\n  },\n]\n\nexport const resetPasswordRequestedAtField: Field = {\n  name: 'resetPasswordRequestedAt',\n  type: 'date',\n  access: {\n    create: () => false,\n    update: () => false,\n  },\n  hidden: true,\n}\n"],"names":["baseAuthFields","name","type","access","create","update","hidden","resetPasswordRequestedAtField"],"mappings":"AAEA,OAAO,MAAMA,iBAA0B;IACrC;QACEC,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;IACA;QACEL,MAAM;QACNC,MAAM;QACNC,QAAQ;YACNC,QAAQ,IAAM;YACdC,QAAQ,IAAM;QAChB;QACAC,QAAQ;IACV;CACD,CAAA;AAED,OAAO,MAAMC,gCAAuC;IAClDN,MAAM;IACNC,MAAM;IACNC,QAAQ;QACNC,QAAQ,IAAM;QACdC,QAAQ,IAAM;IAChB;IACAC,QAAQ;AACV,EAAC"}

package/dist/auth/createAuthToken.d.ts

@@ -0,0 +1,26 @@
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { AuthenticatedUser } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+/**
+ * Starts a login session for the user and signs the JWT for it, the same token a password login
+ * returns. Payload's JWT strategy accepts it. Revoke `sid` if the login fails after this.
+ */
+export declare const createAuthToken: ({ collectionConfig, email, req, shouldCreateRefreshToken, user, }: {
+    collectionConfig: SanitizedCollectionConfig;
+    /** The `email` claim of the token. */
+    email: string;
+    req: PayloadRequest;
+    /**
+     * Also return a refresh token for the session, which `refreshAuthToken` trades for a new token.
+     * The session then lasts `auth.refreshTokens.expiration` from each refresh, or 30 days when the
+     * collection doesn't enable refresh tokens. Requires `auth.useSessions`.
+     */
+    shouldCreateRefreshToken?: boolean;
+    user: AuthenticatedUser;
+}) => Promise<{
+    exp: number;
+    refreshToken?: string;
+    sid?: string;
+    token: string;
+}>;
+//# sourceMappingURL=createAuthToken.d.ts.map

package/dist/auth/createAuthToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuthToken.d.ts","sourceRoot":"","sources":["../../src/auth/createAuthToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAOvD;;;GAGG;AACH,eAAO,MAAM,eAAe,sEAMzB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,cAAc,CAAA;IACnB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0B9E,CAAA"}

package/dist/auth/createAuthToken.js

@@ -0,0 +1,39 @@
+import { getFieldsToSign } from './getFieldsToSign.js';
+import { jwtSign } from './jwt.js';
+import { createRefreshToken, getRefreshTokenExpiration } from './refreshAuthToken.js';
+import { addSessionToUser } from './sessions.js';
+/**
+ * Starts a login session for the user and signs the JWT for it, the same token a password login
+ * returns. Payload's JWT strategy accepts it. Revoke `sid` if the login fails after this.
+ */ export const createAuthToken = async ({ collectionConfig, email, req, shouldCreateRefreshToken = false, user })=>{
+    const { session, sid } = await addSessionToUser({
+        collectionConfig,
+        payload: req.payload,
+        req,
+        sessionExpiration: shouldCreateRefreshToken ? getRefreshTokenExpiration(collectionConfig) : undefined,
+        user
+    });
+    const { exp, token } = await jwtSign({
+        fieldsToSign: getFieldsToSign({
+            collectionConfig,
+            email,
+            sid,
+            user
+        }),
+        secret: req.payload.secret,
+        tokenExpiration: collectionConfig.auth.tokenExpiration
+    });
+    return {
+        exp,
+        refreshToken: shouldCreateRefreshToken && session ? createRefreshToken({
+            collectionConfig,
+            req,
+            session,
+            userID: user.id
+        }) : undefined,
+        sid,
+        token
+    };
+};
+
+//# sourceMappingURL=createAuthToken.js.map

package/dist/auth/createAuthToken.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/createAuthToken.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { getFieldsToSign } from './getFieldsToSign.js'\nimport { jwtSign } from './jwt.js'\nimport { createRefreshToken, getRefreshTokenExpiration } from './refreshAuthToken.js'\nimport { addSessionToUser } from './sessions.js'\n\n/**\n * Starts a login session for the user and signs the JWT for it, the same token a password login\n * returns. Payload's JWT strategy accepts it. Revoke `sid` if the login fails after this.\n */\nexport const createAuthToken = async ({\n  collectionConfig,\n  email,\n  req,\n  shouldCreateRefreshToken = false,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  /** The `email` claim of the token. */\n  email: string\n  req: PayloadRequest\n  /**\n   * Also return a refresh token for the session, which `refreshAuthToken` trades for a new token.\n   * The session then lasts `auth.refreshTokens.expiration` from each refresh, or 30 days when the\n   * collection doesn't enable refresh tokens. Requires `auth.useSessions`.\n   */\n  shouldCreateRefreshToken?: boolean\n  user: AuthenticatedUser\n}): Promise<{ exp: number; refreshToken?: string; sid?: string; token: string }> => {\n  const { session, sid } = await addSessionToUser({\n    collectionConfig,\n    payload: req.payload,\n    req,\n    sessionExpiration: shouldCreateRefreshToken\n      ? getRefreshTokenExpiration(collectionConfig)\n      : undefined,\n    user,\n  })\n\n  const { exp, token } = await jwtSign({\n    fieldsToSign: getFieldsToSign({ collectionConfig, email, sid, user }),\n    secret: req.payload.secret,\n    tokenExpiration: collectionConfig.auth.tokenExpiration,\n  })\n\n  return {\n    exp,\n    refreshToken:\n      shouldCreateRefreshToken && session\n        ? createRefreshToken({ collectionConfig, req, session, userID: user.id })\n        : undefined,\n    sid,\n    token,\n  }\n}\n"],"names":["getFieldsToSign","jwtSign","createRefreshToken","getRefreshTokenExpiration","addSessionToUser","createAuthToken","collectionConfig","email","req","shouldCreateRefreshToken","user","session","sid","payload","sessionExpiration","undefined","exp","token","fieldsToSign","secret","tokenExpiration","auth","refreshToken","userID","id"],"mappings":"AAIA,SAASA,eAAe,QAAQ,uBAAsB;AACtD,SAASC,OAAO,QAAQ,WAAU;AAClC,SAASC,kBAAkB,EAAEC,yBAAyB,QAAQ,wBAAuB;AACrF,SAASC,gBAAgB,QAAQ,gBAAe;AAEhD;;;CAGC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,gBAAgB,EAChBC,KAAK,EACLC,GAAG,EACHC,2BAA2B,KAAK,EAChCC,IAAI,EAaL;IACC,MAAM,EAAEC,OAAO,EAAEC,GAAG,EAAE,GAAG,MAAMR,iBAAiB;QAC9CE;QACAO,SAASL,IAAIK,OAAO;QACpBL;QACAM,mBAAmBL,2BACfN,0BAA0BG,oBAC1BS;QACJL;IACF;IAEA,MAAM,EAAEM,GAAG,EAAEC,KAAK,EAAE,GAAG,MAAMhB,QAAQ;QACnCiB,cAAclB,gBAAgB;YAAEM;YAAkBC;YAAOK;YAAKF;QAAK;QACnES,QAAQX,IAAIK,OAAO,CAACM,MAAM;QAC1BC,iBAAiBd,iBAAiBe,IAAI,CAACD,eAAe;IACxD;IAEA,OAAO;QACLJ;QACAM,cACEb,4BAA4BE,UACxBT,mBAAmB;YAAEI;YAAkBE;YAAKG;YAASY,QAAQb,KAAKc,EAAE;QAAC,KACrET;QACNH;QACAK;IACF;AACF,EAAC"}

package/dist/auth/crypto.d.ts

@@ -1,3 +1,74 @@
-export declare function encrypt(text: string): string;
-export declare function decrypt(hash: string): string;
+/**
+ * A single secret in the keyring, with its derived keys precomputed.
+ */
+export type EncryptionKey = {
+    /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */
+    keyId: string;
+    /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */
+    legacyKey: string;
+    /** The raw `PAYLOAD_SECRET` string. */
+    secret: string;
+    /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */
+    v1Key: Buffer;
+};
+/**
+ * The set of secrets Payload accepts. `active` is used for all writes; every
+ * entry (active + `previousSecrets`) is accepted for reads.
+ */
+export type EncryptionKeyring = {
+    /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */
+    active: EncryptionKey;
+    all: EncryptionKey[];
+    /** keyId -> entry, for O(1) v1 key selection. */
+    byId: Record<string, EncryptionKey>;
+};
+type CryptoContext = {
+    encryptionKeyring: EncryptionKeyring;
+    secret: string;
+};
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */
+export declare const deriveSecretKey: (secret: string) => string;
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */
+export declare const deriveKeyV1: (secret: string) => Buffer;
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */
+export declare const keyIdFor: (v1Key: Buffer) => string;
+export declare const buildEncryptionKey: (secret: string) => EncryptionKey;
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */
+export declare const buildEncryptionKeyring: (secrets: string[]) => EncryptionKeyring;
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */
+export declare function encrypt(this: CryptoContext, text: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */
+export declare function decrypt(this: CryptoContext, hash: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */
+export declare function reencrypt(this: CryptoContext, hash: string, options: {
+    oldSecret: string;
+}): string;
+export {};
 //# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5C;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS5C"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oEAAoE;IACpE,MAAM,EAAE,aAAa,CAAA;IACrB,GAAG,EAAE,aAAa,EAAE,CAAA;IACpB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CACpC,CAAA;AAED,KAAK,aAAa,GAAG;IACnB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAMD;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,MACsB,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,MACgC,CAAA;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MAC6B,CAAA;AAEtE,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,aAQnD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,YAAa,MAAM,EAAE,KAAG,iBAU1D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAUhG;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAuChG;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7B,MAAM,CAGR"}

package/dist/auth/crypto.js

@@ -1,21 +1,98 @@
 import crypto from 'crypto';
-const algorithm = 'aes-256-ctr';
-export function encrypt(text) {
-    const iv = crypto.randomBytes(16);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const cipher = crypto.createCipheriv(algorithm, secret, iv);
-    const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
-    const ivString = iv.toString('hex');
-    return `${ivString}${encrypted}`;
+const legacyAlgorithm = 'aes-256-ctr';
+const v1Algorithm = 'aes-256-gcm';
+const v1Prefix = 'v1';
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */ export const deriveSecretKey = (secret)=>crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32);
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */ export const deriveKeyV1 = (secret)=>Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32));
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */ export const keyIdFor = (v1Key)=>crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16);
+export const buildEncryptionKey = (secret)=>{
+    const v1Key = deriveKeyV1(secret);
+    return {
+        keyId: keyIdFor(v1Key),
+        legacyKey: deriveSecretKey(secret),
+        secret,
+        v1Key
+    };
+};
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */ export const buildEncryptionKeyring = (secrets)=>{
+    const all = secrets.map(buildEncryptionKey);
+    const byId = {};
+    for (const key of all){
+        // First writer wins if two secrets somehow share a keyId.
+        if (!byId[key.keyId]) {
+            byId[key.keyId] = key;
+        }
+    }
+    return {
+        active: all[0],
+        all,
+        byId
+    };
+};
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */ export function encrypt(text, options) {
+    const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active;
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv);
+    const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`;
 }
-export function decrypt(hash) {
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */ export function decrypt(hash, options) {
+    if (hash.startsWith(`${v1Prefix}:`)) {
+        const parts = hash.split(':');
+        if (parts.length !== 5) {
+            throw new Error('decrypt: malformed v1 envelope, expected "v1:keyId:iv:authTag:ciphertext".');
+        }
+        const [, keyId, ivHex, authTagHex, ciphertext] = parts;
+        const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.byId[keyId];
+        if (!key) {
+            throw new Error(`decrypt: no secret in the keyring matches key id "${keyId}". Add the secret that encrypted this value to config.previousSecrets.`);
+        }
+        const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex, 'hex'));
+        decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
+        // final() throws on a wrong key or tampered ciphertext.
+        return decipher.update(ciphertext, 'hex', 'utf8') + decipher.final('utf8');
+    }
+    // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong
+    // key returns garbage instead of throwing. We therefore intentionally use only
+    // the explicit or active key here (never trial the keyring): a legacy value
+    // written under a previous secret decrypts to garbage until rotateSecret
+    // upgrades it to the authenticated v1 envelope. API key auth is unaffected
+    // (it matches the HMAC apiKeyIndex, which is keyring-aware).
+    const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret;
     const iv = hash.slice(0, 32);
     const content = hash.slice(32);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'));
+    const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'));
     return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8');
 }
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */ export function reencrypt(hash, options) {
+    const plaintext = decrypt.call(this, hash, {
+        secret: options.oldSecret
+    });
+    return encrypt.call(this, plaintext);
+}
 
 //# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\nconst algorithm = 'aes-256-ctr'\n\nexport function encrypt(text: string): string {\n  const iv = crypto.randomBytes(16)\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const cipher = crypto.createCipheriv(algorithm, secret, iv)\n\n  const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const ivString = iv.toString('hex')\n\n  return `${ivString}${encrypted}`\n}\n\nexport function decrypt(hash: string): string {\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n"],"names":["crypto","algorithm","encrypt","text","iv","randomBytes","secret","cipher","createCipheriv","encrypted","update","final","ivString","toString","decrypt","hash","slice","content","decipher","createDecipheriv","Buffer","from"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAE3B,MAAMC,YAAY;AAElB,OAAO,SAASC,QAAQC,IAAY;IAClC,MAAMC,KAAKJ,OAAOK,WAAW,CAAC;IAC9B,oFAAoF;IACpF,MAAMC,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMC,SAASP,OAAOQ,cAAc,CAACP,WAAWK,QAAQF;IAExD,MAAMK,YAAYF,OAAOG,MAAM,CAACP,MAAM,QAAQ,SAASI,OAAOI,KAAK,CAAC;IACpE,MAAMC,WAAWR,GAAGS,QAAQ,CAAC;IAE7B,OAAO,GAAGD,WAAWH,WAAW;AAClC;AAEA,OAAO,SAASK,QAAQC,IAAY;IAClC,MAAMX,KAAKW,KAAKC,KAAK,CAAC,GAAG;IACzB,MAAMC,UAAUF,KAAKC,KAAK,CAAC;IAE3B,oFAAoF;IACpF,MAAMV,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMY,WAAWlB,OAAOmB,gBAAgB,CAAClB,WAAWK,QAAQc,OAAOC,IAAI,CAACjB,IAAI;IAE5E,OAAOc,SAASR,MAAM,CAACO,SAAS,OAAO,UAAUC,SAASP,KAAK,CAAC;AAClE"}
+{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\n/**\n * A single secret in the keyring, with its derived keys precomputed.\n */\nexport type EncryptionKey = {\n  /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */\n  keyId: string\n  /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */\n  legacyKey: string\n  /** The raw `PAYLOAD_SECRET` string. */\n  secret: string\n  /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */\n  v1Key: Buffer\n}\n\n/**\n * The set of secrets Payload accepts. `active` is used for all writes; every\n * entry (active + `previousSecrets`) is accepted for reads.\n */\nexport type EncryptionKeyring = {\n  /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */\n  active: EncryptionKey\n  all: EncryptionKey[]\n  /** keyId -> entry, for O(1) v1 key selection. */\n  byId: Record<string, EncryptionKey>\n}\n\ntype CryptoContext = {\n  encryptionKeyring: EncryptionKeyring\n  secret: string\n}\n\nconst legacyAlgorithm = 'aes-256-ctr'\nconst v1Algorithm = 'aes-256-gcm'\nconst v1Prefix = 'v1'\n\n/**\n * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).\n * Kept in sync with `BasePayload.secret`.\n */\nexport const deriveSecretKey = (secret: string): string =>\n  crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32)\n\n/**\n * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced\n * effective entropy of the legacy derivation.\n */\nexport const deriveKeyV1 = (secret: string): Buffer =>\n  Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32))\n\n/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */\nexport const keyIdFor = (v1Key: Buffer): string =>\n  crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16)\n\nexport const buildEncryptionKey = (secret: string): EncryptionKey => {\n  const v1Key = deriveKeyV1(secret)\n  return {\n    keyId: keyIdFor(v1Key),\n    legacyKey: deriveSecretKey(secret),\n    secret,\n    v1Key,\n  }\n}\n\n/**\n * Builds the keyring from the active secret followed by any previous secrets.\n * The first entry is the active (writing) key.\n */\nexport const buildEncryptionKeyring = (secrets: string[]): EncryptionKeyring => {\n  const all = secrets.map(buildEncryptionKey)\n  const byId: Record<string, EncryptionKey> = {}\n  for (const key of all) {\n    // First writer wins if two secrets somehow share a keyId.\n    if (!byId[key.keyId]) {\n      byId[key.keyId] = key\n    }\n  }\n  return { active: all[0]!, all, byId }\n}\n\n/**\n * Encrypts `text` under the active secret using the versioned aes-256-gcm\n * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the\n * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.\n */\nexport function encrypt(this: CryptoContext, text: string, options?: { secret?: string }): string {\n  const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active\n\n  const iv = crypto.randomBytes(12)\n  const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv)\n\n  const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const authTag = cipher.getAuthTag().toString('hex')\n\n  return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`\n}\n\n/**\n * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1\n * envelopes are authenticated (aes-256-gcm) and select their key by keyId from\n * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to\n * decrypt under a specific secret (e.g. to read data encrypted under a previous\n * secret during a rotation).\n */\nexport function decrypt(this: CryptoContext, hash: string, options?: { secret?: string }): string {\n  if (hash.startsWith(`${v1Prefix}:`)) {\n    const parts = hash.split(':')\n\n    if (parts.length !== 5) {\n      throw new Error('decrypt: malformed v1 envelope, expected \"v1:keyId:iv:authTag:ciphertext\".')\n    }\n\n    const [, keyId, ivHex, authTagHex, ciphertext] = parts\n\n    const key = options?.secret\n      ? buildEncryptionKey(options.secret)\n      : this.encryptionKeyring.byId[keyId!]\n\n    if (!key) {\n      throw new Error(\n        `decrypt: no secret in the keyring matches key id \"${keyId}\". Add the secret that encrypted this value to config.previousSecrets.`,\n      )\n    }\n\n    const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex!, 'hex'))\n    decipher.setAuthTag(Buffer.from(authTagHex!, 'hex'))\n\n    // final() throws on a wrong key or tampered ciphertext.\n    return decipher.update(ciphertext!, 'hex', 'utf8') + decipher.final('utf8')\n  }\n\n  // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong\n  // key returns garbage instead of throwing. We therefore intentionally use only\n  // the explicit or active key here (never trial the keyring): a legacy value\n  // written under a previous secret decrypts to garbage until rotateSecret\n  // upgrades it to the authenticated v1 envelope. API key auth is unaffected\n  // (it matches the HMAC apiKeyIndex, which is keyring-aware).\n  const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n  const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n\n/**\n * Re-encrypts a value that was encrypted under a previous secret: decrypts it\n * with `options.oldSecret`, then re-encrypts it with the active secret. Also\n * upgrades a legacy aes-256-ctr value to the v1 envelope.\n */\nexport function reencrypt(\n  this: CryptoContext,\n  hash: string,\n  options: { oldSecret: string },\n): string {\n  const plaintext = decrypt.call(this, hash, { secret: options.oldSecret })\n  return encrypt.call(this, plaintext)\n}\n"],"names":["crypto","legacyAlgorithm","v1Algorithm","v1Prefix","deriveSecretKey","secret","createHash","update","digest","slice","deriveKeyV1","Buffer","from","hkdfSync","keyIdFor","v1Key","buildEncryptionKey","keyId","legacyKey","buildEncryptionKeyring","secrets","all","map","byId","key","active","encrypt","text","options","encryptionKeyring","iv","randomBytes","cipher","createCipheriv","ciphertext","final","authTag","getAuthTag","toString","decrypt","hash","startsWith","parts","split","length","Error","ivHex","authTagHex","decipher","createDecipheriv","setAuthTag","content","reencrypt","plaintext","call","oldSecret"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAiC3B,MAAMC,kBAAkB;AACxB,MAAMC,cAAc;AACpB,MAAMC,WAAW;AAEjB;;;CAGC,GACD,OAAO,MAAMC,kBAAkB,CAACC,SAC9BL,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACF,QAAQG,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEvE;;;CAGC,GACD,OAAO,MAAMC,cAAc,CAACL,SAC1BM,OAAOC,IAAI,CAACZ,OAAOa,QAAQ,CAAC,UAAUR,QAAQ,IAAI,qBAAqB,KAAI;AAE7E,2EAA2E,GAC3E,OAAO,MAAMS,WAAW,CAACC,QACvBf,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACQ,OAAOP,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEtE,OAAO,MAAMO,qBAAqB,CAACX;IACjC,MAAMU,QAAQL,YAAYL;IAC1B,OAAO;QACLY,OAAOH,SAASC;QAChBG,WAAWd,gBAAgBC;QAC3BA;QACAU;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMI,yBAAyB,CAACC;IACrC,MAAMC,MAAMD,QAAQE,GAAG,CAACN;IACxB,MAAMO,OAAsC,CAAC;IAC7C,KAAK,MAAMC,OAAOH,IAAK;QACrB,0DAA0D;QAC1D,IAAI,CAACE,IAAI,CAACC,IAAIP,KAAK,CAAC,EAAE;YACpBM,IAAI,CAACC,IAAIP,KAAK,CAAC,GAAGO;QACpB;IACF;IACA,OAAO;QAAEC,QAAQJ,GAAG,CAAC,EAAE;QAAGA;QAAKE;IAAK;AACtC,EAAC;AAED;;;;CAIC,GACD,OAAO,SAASG,QAA6BC,IAAY,EAAEC,OAA6B;IACtF,MAAMJ,MAAMI,SAASvB,SAASW,mBAAmBY,QAAQvB,MAAM,IAAI,IAAI,CAACwB,iBAAiB,CAACJ,MAAM;IAEhG,MAAMK,KAAK9B,OAAO+B,WAAW,CAAC;IAC9B,MAAMC,SAAShC,OAAOiC,cAAc,CAAC/B,aAAasB,IAAIT,KAAK,EAAEe;IAE7D,MAAMI,aAAaF,OAAOzB,MAAM,CAACoB,MAAM,QAAQ,SAASK,OAAOG,KAAK,CAAC;IACrE,MAAMC,UAAUJ,OAAOK,UAAU,GAAGC,QAAQ,CAAC;IAE7C,OAAO,GAAGnC,SAAS,CAAC,EAAEqB,IAAIP,KAAK,CAAC,CAAC,EAAEa,GAAGQ,QAAQ,CAAC,OAAO,CAAC,EAAEF,QAAQ,CAAC,EAAEF,YAAY;AAClF;AAEA;;;;;;CAMC,GACD,OAAO,SAASK,QAA6BC,IAAY,EAAEZ,OAA6B;IACtF,IAAIY,KAAKC,UAAU,CAAC,GAAGtC,SAAS,CAAC,CAAC,GAAG;QACnC,MAAMuC,QAAQF,KAAKG,KAAK,CAAC;QAEzB,IAAID,MAAME,MAAM,KAAK,GAAG;YACtB,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAM,GAAG5B,OAAO6B,OAAOC,YAAYb,WAAW,GAAGQ;QAEjD,MAAMlB,MAAMI,SAASvB,SACjBW,mBAAmBY,QAAQvB,MAAM,IACjC,IAAI,CAACwB,iBAAiB,CAACN,IAAI,CAACN,MAAO;QAEvC,IAAI,CAACO,KAAK;YACR,MAAM,IAAIqB,MACR,CAAC,kDAAkD,EAAE5B,MAAM,sEAAsE,CAAC;QAEtI;QAEA,MAAM+B,WAAWhD,OAAOiD,gBAAgB,CAAC/C,aAAasB,IAAIT,KAAK,EAAEJ,OAAOC,IAAI,CAACkC,OAAQ;QACrFE,SAASE,UAAU,CAACvC,OAAOC,IAAI,CAACmC,YAAa;QAE7C,wDAAwD;QACxD,OAAOC,SAASzC,MAAM,CAAC2B,YAAa,OAAO,UAAUc,SAASb,KAAK,CAAC;IACtE;IAEA,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMjB,YAAYU,SAASvB,SAASD,gBAAgBwB,QAAQvB,MAAM,IAAI,IAAI,CAACA,MAAM;IACjF,MAAMyB,KAAKU,KAAK/B,KAAK,CAAC,GAAG;IACzB,MAAM0C,UAAUX,KAAK/B,KAAK,CAAC;IAC3B,MAAMuC,WAAWhD,OAAOiD,gBAAgB,CAAChD,iBAAiBiB,WAAWP,OAAOC,IAAI,CAACkB,IAAI;IAErF,OAAOkB,SAASzC,MAAM,CAAC4C,SAAS,OAAO,UAAUH,SAASb,KAAK,CAAC;AAClE;AAEA;;;;CAIC,GACD,OAAO,SAASiB,UAEdZ,IAAY,EACZZ,OAA8B;IAE9B,MAAMyB,YAAYd,QAAQe,IAAI,CAAC,IAAI,EAAEd,MAAM;QAAEnC,QAAQuB,QAAQ2B,SAAS;IAAC;IACvE,OAAO7B,QAAQ4B,IAAI,CAAC,IAAI,EAAED;AAC5B"}

package/dist/auth/defaultUnlockAccess.d.ts

@@ -0,0 +1,3 @@
+import type { Access } from '../config/types.js';
+export declare const defaultUnlockAccess: Access;
+//# sourceMappingURL=defaultUnlockAccess.d.ts.map

package/dist/auth/defaultUnlockAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultUnlockAccess.d.ts","sourceRoot":"","sources":["../../src/auth/defaultUnlockAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,eAAO,MAAM,mBAAmB,EAAE,MAMjC,CAAA"}

package/dist/auth/defaultUnlockAccess.js

@@ -0,0 +1,8 @@
+export const defaultUnlockAccess = ({ req: { payload, user } })=>{
+    if (!user) {
+        return false;
+    }
+    return user.collection === payload.config.admin.user;
+};
+
+//# sourceMappingURL=defaultUnlockAccess.js.map

package/dist/auth/defaultUnlockAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/defaultUnlockAccess.ts"],"sourcesContent":["import type { Access } from '../config/types.js'\n\nexport const defaultUnlockAccess: Access = ({ req: { payload, user } }) => {\n  if (!user) {\n    return false\n  }\n\n  return user.collection === payload.config.admin.user\n}\n"],"names":["defaultUnlockAccess","req","payload","user","collection","config","admin"],"mappings":"AAEA,OAAO,MAAMA,sBAA8B,CAAC,EAAEC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE,EAAE;IACpE,IAAI,CAACA,MAAM;QACT,OAAO;IACT;IAEA,OAAOA,KAAKC,UAAU,KAAKF,QAAQG,MAAM,CAACC,KAAK,CAACH,IAAI;AACtD,EAAC"}

package/dist/auth/endpoints/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAK3D,eAAO,MAAM,aAAa,EAAE,cA0B3B,CAAA"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,aAAa,EAAE,cA0B3B,CAAA"}

package/dist/auth/endpoints/access.js

@@ -1,5 +1,5 @@
-import { status as httpStatus } from 'http-status';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { accessOperation } from '../operations/access.js';
 export const accessHandler = async (req)=>{
     const headers = headersWithCors({

package/dist/auth/endpoints/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/access.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { accessOperation } from '../operations/access.js'\n\nexport const accessHandler: PayloadHandler = async (req) => {\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  try {\n    const results = await accessOperation({\n      req,\n    })\n\n    return Response.json(results, {\n      headers,\n      status: httpStatus.OK,\n    })\n  } catch (e: unknown) {\n    return Response.json(\n      {\n        error: e,\n      },\n      {\n        headers,\n        status: httpStatus.INTERNAL_SERVER_ERROR,\n      },\n    )\n  }\n}\n"],"names":["status","httpStatus","headersWithCors","accessOperation","accessHandler","req","headers","Headers","results","Response","json","OK","e","error","INTERNAL_SERVER_ERROR"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,UAAUJ,gBAAgB;QAC9BI,SAAS,IAAIC;QACbF;IACF;IAEA,IAAI;QACF,MAAMG,UAAU,MAAML,gBAAgB;YACpCE;QACF;QAEA,OAAOI,SAASC,IAAI,CAACF,SAAS;YAC5BF;YACAN,QAAQC,WAAWU,EAAE;QACvB;IACF,EAAE,OAAOC,GAAY;QACnB,OAAOH,SAASC,IAAI,CAClB;YACEG,OAAOD;QACT,GACA;YACEN;YACAN,QAAQC,WAAWa,qBAAqB;QAC1C;IAEJ;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/access.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { accessOperation } from '../operations/access.js'\n\nexport const accessHandler: PayloadHandler = async (req) => {\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  try {\n    const results = await accessOperation({\n      req,\n    })\n\n    return Response.json(results, {\n      headers,\n      status: httpStatus.OK,\n    })\n  } catch (e: unknown) {\n    return Response.json(\n      {\n        error: e,\n      },\n      {\n        headers,\n        status: httpStatus.INTERNAL_SERVER_ERROR,\n      },\n    )\n  }\n}\n"],"names":["headersWithCors","httpStatus","accessOperation","accessHandler","req","headers","Headers","results","Response","json","status","OK","e","error","INTERNAL_SERVER_ERROR"],"mappings":"AAEA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,UAAUL,gBAAgB;QAC9BK,SAAS,IAAIC;QACbF;IACF;IAEA,IAAI;QACF,MAAMG,UAAU,MAAML,gBAAgB;YACpCE;QACF;QAEA,OAAOI,SAASC,IAAI,CAACF,SAAS;YAC5BF;YACAK,QAAQT,WAAWU,EAAE;QACvB;IACF,EAAE,OAAOC,GAAY;QACnB,OAAOJ,SAASC,IAAI,CAClB;YACEI,OAAOD;QACT,GACA;YACEP;YACAK,QAAQT,WAAWa,qBAAqB;QAC1C;IAEJ;AACF,EAAC"}

package/dist/auth/endpoints/forgotPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/forgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,qBAAqB,EAAE,cAgCnC,CAAA"}
+{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/forgotPassword.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,qBAAqB,EAAE,cAgCnC,CAAA"}

package/dist/auth/endpoints/forgotPassword.js

@@ -1,6 +1,6 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { forgotPasswordOperation } from '../operations/forgotPassword.js';
 export const forgotPasswordHandler = async (req)=>{
     const { t } = req;