payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ee5d8bd

package/dist/types/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/types/operations.ts"],"sourcesContent":["export type SharedLocalAPIOptions = {\n  /**\n   * Set to `true` to skip access control for this operation.\n   *\n   * @default false\n   */\n  overrideAccess?: boolean\n}\n"],"names":[],"mappings":"AAAA,WAOC"}

package/dist/types/validation.d.ts

@@ -0,0 +1,18 @@
+import type { ValidationFieldError } from '../errors/ValidationError.js';
+/**
+ * The result of validating a collection or global document candidate without persisting it.
+ *
+ * Field validation failures are returned in this result. Access denials, invalid arguments,
+ * missing documents, and other lifecycle errors throw instead.
+ */
+export type ValidationResult = {
+    /**
+     * Field validation errors. Errors from localized passes are tagged with the locale that failed;
+     * non-localized validation may omit the locale.
+     * Empty when {@link valid} is `true`.
+     */
+    errors: ValidationFieldError[];
+    /** Whether the candidate passed field validation in every selected locale. */
+    valid: boolean;
+};
+//# sourceMappingURL=validation.d.ts.map

package/dist/types/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/types/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAExE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC9B,8EAA8E;IAC9E,KAAK,EAAE,OAAO,CAAA;CACf,CAAA"}

package/dist/types/validation.js

@@ -0,0 +1,8 @@
+/**
+ * The result of validating a collection or global document candidate without persisting it.
+ *
+ * Field validation failures are returned in this result. Access denials, invalid arguments,
+ * missing documents, and other lifecycle errors throw instead.
+ */ export { };
+
+//# sourceMappingURL=validation.js.map

package/dist/types/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/types/validation.ts"],"sourcesContent":["import type { ValidationFieldError } from '../errors/ValidationError.js'\n\n/**\n * The result of validating a collection or global document candidate without persisting it.\n *\n * Field validation failures are returned in this result. Access denials, invalid arguments,\n * missing documents, and other lifecycle errors throw instead.\n */\nexport type ValidationResult = {\n  /**\n   * Field validation errors. Errors from localized passes are tagged with the locale that failed;\n   * non-localized validation may omit the locale.\n   * Empty when {@link valid} is `true`.\n   */\n  errors: ValidationFieldError[]\n  /** Whether the candidate passed field validation in every selected locale. */\n  valid: boolean\n}\n"],"names":[],"mappings":"AAEA;;;;;CAKC,GACD,WASC"}

package/dist/uploads/assertClientUploadAccess.d.ts

@@ -0,0 +1,7 @@
+import type { PayloadRequest } from '../types/index.js';
+/** Checks collection write permissions before an adapter grants access to upload file bytes. */
+export declare const assertClientUploadAccess: ({ collectionSlug, req, }: {
+    collectionSlug: string;
+    req: PayloadRequest;
+}) => Promise<void>;
+//# sourceMappingURL=assertClientUploadAccess.d.ts.map

package/dist/uploads/assertClientUploadAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertClientUploadAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/assertClientUploadAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAKvD,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,6BAGlC;IACD,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,IAAI,CA4Bf,CAAA"}

package/dist/uploads/assertClientUploadAccess.js

@@ -0,0 +1,29 @@
+import { executeAccess } from '../auth/executeAccess.js';
+import { Forbidden } from '../errors/Forbidden.js';
+/** Checks collection write permissions before an adapter grants access to upload file bytes. */ export const assertClientUploadAccess = async ({ collectionSlug, req })=>{
+    if (!req.user) {
+        throw new Forbidden(req.t);
+    }
+    const collectionConfig = req.payload.collections[collectionSlug]?.config;
+    if (!collectionConfig) {
+        throw new Forbidden(req.t);
+    }
+    const canCreate = await executeAccess({
+        slug: collectionSlug,
+        disableErrors: true,
+        req
+    }, collectionConfig.access.create);
+    if (canCreate) {
+        return;
+    }
+    const canUpdate = await executeAccess({
+        slug: collectionSlug,
+        disableErrors: true,
+        req
+    }, collectionConfig.access.update);
+    if (!canUpdate) {
+        throw new Forbidden(req.t);
+    }
+};
+
+//# sourceMappingURL=assertClientUploadAccess.js.map

package/dist/uploads/assertClientUploadAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/assertClientUploadAccess.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\n\n/** Checks collection write permissions before an adapter grants access to upload file bytes. */\nexport const assertClientUploadAccess = async ({\n  collectionSlug,\n  req,\n}: {\n  collectionSlug: string\n  req: PayloadRequest\n}): Promise<void> => {\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const collectionConfig = req.payload.collections[collectionSlug]?.config\n\n  if (!collectionConfig) {\n    throw new Forbidden(req.t)\n  }\n\n  const canCreate = await executeAccess(\n    { slug: collectionSlug, disableErrors: true, req },\n    collectionConfig.access.create,\n  )\n\n  if (canCreate) {\n    return\n  }\n\n  const canUpdate = await executeAccess(\n    { slug: collectionSlug, disableErrors: true, req },\n    collectionConfig.access.update,\n  )\n\n  if (!canUpdate) {\n    throw new Forbidden(req.t)\n  }\n}\n"],"names":["executeAccess","Forbidden","assertClientUploadAccess","collectionSlug","req","user","t","collectionConfig","payload","collections","config","canCreate","slug","disableErrors","access","create","canUpdate","update"],"mappings":"AAEA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAElD,8FAA8F,GAC9F,OAAO,MAAMC,2BAA2B,OAAO,EAC7CC,cAAc,EACdC,GAAG,EAIJ;IACC,IAAI,CAACA,IAAIC,IAAI,EAAE;QACb,MAAM,IAAIJ,UAAUG,IAAIE,CAAC;IAC3B;IAEA,MAAMC,mBAAmBH,IAAII,OAAO,CAACC,WAAW,CAACN,eAAe,EAAEO;IAElE,IAAI,CAACH,kBAAkB;QACrB,MAAM,IAAIN,UAAUG,IAAIE,CAAC;IAC3B;IAEA,MAAMK,YAAY,MAAMX,cACtB;QAAEY,MAAMT;QAAgBU,eAAe;QAAMT;IAAI,GACjDG,iBAAiBO,MAAM,CAACC,MAAM;IAGhC,IAAIJ,WAAW;QACb;IACF;IAEA,MAAMK,YAAY,MAAMhB,cACtB;QAAEY,MAAMT;QAAgBU,eAAe;QAAMT;IAAI,GACjDG,iBAAiBO,MAAM,CAACG,MAAM;IAGhC,IAAI,CAACD,WAAW;QACd,MAAM,IAAIf,UAAUG,IAAIE,CAAC;IAC3B;AACF,EAAC"}

package/dist/uploads/assertClientUploadAllowed.d.ts

@@ -0,0 +1,10 @@
+export declare const assertClientUploadAllowed: ({ collection, filename, mimeType, }: {
+    collection?: {
+        upload?: {
+            allowRestrictedFileTypes?: boolean;
+        } | boolean;
+    };
+    filename: unknown;
+    mimeType?: unknown;
+}) => void;
+//# sourceMappingURL=assertClientUploadAllowed.d.ts.map

package/dist/uploads/assertClientUploadAllowed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertClientUploadAllowed.d.ts","sourceRoot":"","sources":["../../src/uploads/assertClientUploadAllowed.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,yBAAyB,wCAInC;IACD,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE;YAAE,wBAAwB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAA;KAC1D,CAAA;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB,KAAG,IA+BH,CAAA"}

package/dist/uploads/assertClientUploadAllowed.js

@@ -0,0 +1,41 @@
+import { APIError } from '../errors/APIError.js';
+import { getSanitizedUploadFilename, uploadRequiresServerValidation } from './getFileTypeIdentity.js';
+const MIME_TYPE_PATTERN = /^[!#$%&'*+.^`|~\w-]+\/[!#$%&'*+.^`|~\w-]+$/;
+const isValidMimeType = (mimeType)=>{
+    if (typeof mimeType !== 'string' || mimeType.length === 0 || mimeType !== mimeType.trim() || [
+        ...mimeType
+    ].some((character)=>{
+        const codePoint = character.codePointAt(0);
+        return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f);
+    })) {
+        return false;
+    }
+    const [essence, ...parameters] = mimeType.split(';');
+    return MIME_TYPE_PATTERN.test(essence ?? '') && parameters.every((parameter)=>parameter.trim().length > 0);
+};
+export const assertClientUploadAllowed = ({ collection, filename, mimeType })=>{
+    if (typeof filename !== 'string' || filename.length === 0 || filename.trim().length === 0 || !getSanitizedUploadFilename(filename)) {
+        throw new APIError('A valid filename is required for client uploads.', 400);
+    }
+    const allowRestrictedFileTypes = collection && typeof collection.upload === 'object' ? collection.upload.allowRestrictedFileTypes : false;
+    // The explicit restricted-file opt-out also preserves legacy provider clients that did not
+    // send MIME metadata. Secure-default collections always require a bindable MIME identity.
+    if (mimeType === undefined || mimeType === null || mimeType === '') {
+        if (allowRestrictedFileTypes) {
+            return;
+        }
+        throw new APIError('A valid MIME type is required for client uploads.', 400);
+    }
+    if (!isValidMimeType(mimeType)) {
+        throw new APIError('A valid MIME type is required for client uploads.', 400);
+    }
+    if (uploadRequiresServerValidation({
+        allowRestrictedFileTypes,
+        filename,
+        mimeType
+    })) {
+        throw new APIError('SVG and XML files must be uploaded through Payload.', 400);
+    }
+};
+
+//# sourceMappingURL=assertClientUploadAllowed.js.map

package/dist/uploads/assertClientUploadAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/assertClientUploadAllowed.ts"],"sourcesContent":["import { APIError } from '../errors/APIError.js'\nimport {\n  getSanitizedUploadFilename,\n  uploadRequiresServerValidation,\n} from './getFileTypeIdentity.js'\n\nconst MIME_TYPE_PATTERN = /^[!#$%&'*+.^`|~\\w-]+\\/[!#$%&'*+.^`|~\\w-]+$/\n\nconst isValidMimeType = (mimeType: unknown): mimeType is string => {\n  if (\n    typeof mimeType !== 'string' ||\n    mimeType.length === 0 ||\n    mimeType !== mimeType.trim() ||\n    [...mimeType].some((character) => {\n      const codePoint = character.codePointAt(0)\n      return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)\n    })\n  ) {\n    return false\n  }\n\n  const [essence, ...parameters] = mimeType.split(';')\n  return (\n    MIME_TYPE_PATTERN.test(essence ?? '') &&\n    parameters.every((parameter) => parameter.trim().length > 0)\n  )\n}\n\nexport const assertClientUploadAllowed = ({\n  collection,\n  filename,\n  mimeType,\n}: {\n  collection?: {\n    upload?: { allowRestrictedFileTypes?: boolean } | boolean\n  }\n  filename: unknown\n  mimeType?: unknown\n}): void => {\n  if (\n    typeof filename !== 'string' ||\n    filename.length === 0 ||\n    filename.trim().length === 0 ||\n    !getSanitizedUploadFilename(filename)\n  ) {\n    throw new APIError('A valid filename is required for client uploads.', 400)\n  }\n\n  const allowRestrictedFileTypes =\n    collection && typeof collection.upload === 'object'\n      ? collection.upload.allowRestrictedFileTypes\n      : false\n\n  // The explicit restricted-file opt-out also preserves legacy provider clients that did not\n  // send MIME metadata. Secure-default collections always require a bindable MIME identity.\n  if (mimeType === undefined || mimeType === null || mimeType === '') {\n    if (allowRestrictedFileTypes) {\n      return\n    }\n    throw new APIError('A valid MIME type is required for client uploads.', 400)\n  }\n\n  if (!isValidMimeType(mimeType)) {\n    throw new APIError('A valid MIME type is required for client uploads.', 400)\n  }\n\n  if (uploadRequiresServerValidation({ allowRestrictedFileTypes, filename, mimeType })) {\n    throw new APIError('SVG and XML files must be uploaded through Payload.', 400)\n  }\n}\n"],"names":["APIError","getSanitizedUploadFilename","uploadRequiresServerValidation","MIME_TYPE_PATTERN","isValidMimeType","mimeType","length","trim","some","character","codePoint","codePointAt","undefined","essence","parameters","split","test","every","parameter","assertClientUploadAllowed","collection","filename","allowRestrictedFileTypes","upload"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SACEC,0BAA0B,EAC1BC,8BAA8B,QACzB,2BAA0B;AAEjC,MAAMC,oBAAoB;AAE1B,MAAMC,kBAAkB,CAACC;IACvB,IACE,OAAOA,aAAa,YACpBA,SAASC,MAAM,KAAK,KACpBD,aAAaA,SAASE,IAAI,MAC1B;WAAIF;KAAS,CAACG,IAAI,CAAC,CAACC;QAClB,MAAMC,YAAYD,UAAUE,WAAW,CAAC;QACxC,OAAOD,cAAcE,aAAcF,CAAAA,aAAa,QAAQA,cAAc,IAAG;IAC3E,IACA;QACA,OAAO;IACT;IAEA,MAAM,CAACG,SAAS,GAAGC,WAAW,GAAGT,SAASU,KAAK,CAAC;IAChD,OACEZ,kBAAkBa,IAAI,CAACH,WAAW,OAClCC,WAAWG,KAAK,CAAC,CAACC,YAAcA,UAAUX,IAAI,GAAGD,MAAM,GAAG;AAE9D;AAEA,OAAO,MAAMa,4BAA4B,CAAC,EACxCC,UAAU,EACVC,QAAQ,EACRhB,QAAQ,EAOT;IACC,IACE,OAAOgB,aAAa,YACpBA,SAASf,MAAM,KAAK,KACpBe,SAASd,IAAI,GAAGD,MAAM,KAAK,KAC3B,CAACL,2BAA2BoB,WAC5B;QACA,MAAM,IAAIrB,SAAS,oDAAoD;IACzE;IAEA,MAAMsB,2BACJF,cAAc,OAAOA,WAAWG,MAAM,KAAK,WACvCH,WAAWG,MAAM,CAACD,wBAAwB,GAC1C;IAEN,2FAA2F;IAC3F,0FAA0F;IAC1F,IAAIjB,aAAaO,aAAaP,aAAa,QAAQA,aAAa,IAAI;QAClE,IAAIiB,0BAA0B;YAC5B;QACF;QACA,MAAM,IAAItB,SAAS,qDAAqD;IAC1E;IAEA,IAAI,CAACI,gBAAgBC,WAAW;QAC9B,MAAM,IAAIL,SAAS,qDAAqD;IAC1E;IAEA,IAAIE,+BAA+B;QAAEoB;QAA0BD;QAAUhB;IAAS,IAAI;QACpF,MAAM,IAAIL,SAAS,uDAAuD;IAC5E;AACF,EAAC"}

package/dist/uploads/checkFileAccess.d.ts

@@ -1,7 +1,8 @@
 import type { Collection, TypeWithID } from '../collections/config/types.js';
 import type { PayloadRequest } from '../types/index.js';
-export declare const checkFileAccess: ({ collection, filename, prefix, req, }: {
+export declare const checkFileAccess: ({ collection, documentID, filename, prefix, req, }: {
     collection: Collection;
+    documentID?: number | string;
     filename: string;
     prefix?: string;
     req: PayloadRequest;

package/dist/uploads/checkFileAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAK9D,eAAO,MAAM,eAAe,2CAKzB;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CA8CjC,CAAA"}
+{"version":3,"file":"checkFileAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAM9D,eAAO,MAAM,eAAe,uDAMzB;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CA2CjC,CAAA"}

package/dist/uploads/checkFileAccess.js

@@ -1,11 +1,14 @@
 import { executeAccess } from '../auth/executeAccess.js';
 import { Forbidden } from '../errors/Forbidden.js';
-export const checkFileAccess = async ({ collection, filename, prefix, req })=>{
+import { resolveUploadDocument } from './transformers/resolveUploadDocument.js';
+export const checkFileAccess = async ({ collection, documentID, filename, prefix, req })=>{
     if (filename.includes('../') || filename.includes('..\\')) {
         throw new Forbidden(req.t);
     }
     const { config } = collection;
     const accessResult = await executeAccess({
+        id: documentID,
+        slug: config.slug,
         data: {
             filename
         },
@@ -23,31 +26,23 @@ export const checkFileAccess = async ({ collection, filename, prefix, req })=>{
             }
         });
     }
-    if (constraints.length > 0) {
-        const filenameCondition = {
-            or: [
-                {
-                    filename: {
-                        equals: filename
-                    }
-                }
-            ]
-        };
-        if (config.upload.imageSizes) {
-            config.upload.imageSizes.forEach(({ name })=>{
-                filenameCondition.or.push({
-                    [`sizes.${name}.filename`]: {
-                        equals: filename
-                    }
-                });
-            });
-        }
-        const doc = await req.payload.db.findOne({
+    if (constraints.length > 0 || documentID !== undefined) {
+        const doc = documentID === undefined ? await resolveUploadDocument({
+            collection,
+            filename,
+            prefix,
+            req,
+            where: typeof accessResult === 'object' ? accessResult : undefined
+        }) : await req.payload.db.findOne({
             collection: config.slug,
             req,
             where: {
                 and: [
-                    filenameCondition,
+                    {
+                        id: {
+                            equals: documentID
+                        }
+                    },
                     ...constraints
                 ]
             }

package/dist/uploads/checkFileAccess.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileAccess.ts"],"sourcesContent":["import type { Collection, TypeWithID } from '../collections/config/types.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\n\nexport const checkFileAccess = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<TypeWithID | undefined> => {\n  if (filename.includes('../') || filename.includes('..\\\\')) {\n    throw new Forbidden(req.t)\n  }\n  const { config } = collection\n\n  const accessResult = await executeAccess(\n    { data: { filename }, isReadingStaticFile: true, req },\n    config.access.read,\n  )\n\n  const constraints: Where[] = []\n\n  if (typeof accessResult === 'object') {\n    constraints.push(accessResult)\n  }\n\n  if (typeof prefix === 'string') {\n    constraints.push({ prefix: { equals: prefix } })\n  }\n\n  if (constraints.length > 0) {\n    const filenameCondition: Where = {\n      or: [{ filename: { equals: filename } }],\n    }\n\n    if (config.upload.imageSizes) {\n      config.upload.imageSizes.forEach(({ name }) => {\n        filenameCondition.or!.push({\n          [`sizes.${name}.filename`]: { equals: filename },\n        })\n      })\n    }\n\n    const doc = await req.payload.db.findOne({\n      collection: config.slug,\n      req,\n      where: { and: [filenameCondition, ...constraints] },\n    })\n\n    if (!doc) {\n      throw new Forbidden(req.t)\n    }\n\n    return doc\n  }\n}\n"],"names":["executeAccess","Forbidden","checkFileAccess","collection","filename","prefix","req","includes","t","config","accessResult","data","isReadingStaticFile","access","read","constraints","push","equals","length","filenameCondition","or","upload","imageSizes","forEach","name","doc","payload","db","findOne","slug","where","and"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAElD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,IAAIF,SAASG,QAAQ,CAAC,UAAUH,SAASG,QAAQ,CAAC,SAAS;QACzD,MAAM,IAAIN,UAAUK,IAAIE,CAAC;IAC3B;IACA,MAAM,EAAEC,MAAM,EAAE,GAAGN;IAEnB,MAAMO,eAAe,MAAMV,cACzB;QAAEW,MAAM;YAAEP;QAAS;QAAGQ,qBAAqB;QAAMN;IAAI,GACrDG,OAAOI,MAAM,CAACC,IAAI;IAGpB,MAAMC,cAAuB,EAAE;IAE/B,IAAI,OAAOL,iBAAiB,UAAU;QACpCK,YAAYC,IAAI,CAACN;IACnB;IAEA,IAAI,OAAOL,WAAW,UAAU;QAC9BU,YAAYC,IAAI,CAAC;YAAEX,QAAQ;gBAAEY,QAAQZ;YAAO;QAAE;IAChD;IAEA,IAAIU,YAAYG,MAAM,GAAG,GAAG;QAC1B,MAAMC,oBAA2B;YAC/BC,IAAI;gBAAC;oBAAEhB,UAAU;wBAAEa,QAAQb;oBAAS;gBAAE;aAAE;QAC1C;QAEA,IAAIK,OAAOY,MAAM,CAACC,UAAU,EAAE;YAC5Bb,OAAOY,MAAM,CAACC,UAAU,CAACC,OAAO,CAAC,CAAC,EAAEC,IAAI,EAAE;gBACxCL,kBAAkBC,EAAE,CAAEJ,IAAI,CAAC;oBACzB,CAAC,CAAC,MAAM,EAAEQ,KAAK,SAAS,CAAC,CAAC,EAAE;wBAAEP,QAAQb;oBAAS;gBACjD;YACF;QACF;QAEA,MAAMqB,MAAM,MAAMnB,IAAIoB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACvCzB,YAAYM,OAAOoB,IAAI;YACvBvB;YACAwB,OAAO;gBAAEC,KAAK;oBAACZ;uBAAsBJ;iBAAY;YAAC;QACpD;QAEA,IAAI,CAACU,KAAK;YACR,MAAM,IAAIxB,UAAUK,IAAIE,CAAC;QAC3B;QAEA,OAAOiB;IACT;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileAccess.ts"],"sourcesContent":["import type { Collection, TypeWithID } from '../collections/config/types.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\nimport { resolveUploadDocument } from './transformers/resolveUploadDocument.js'\n\nexport const checkFileAccess = async ({\n  collection,\n  documentID,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  documentID?: number | string\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<TypeWithID | undefined> => {\n  if (filename.includes('../') || filename.includes('..\\\\')) {\n    throw new Forbidden(req.t)\n  }\n  const { config } = collection\n\n  const accessResult = await executeAccess(\n    { id: documentID, slug: config.slug, data: { filename }, isReadingStaticFile: true, req },\n    config.access.read,\n  )\n\n  const constraints: Where[] = []\n\n  if (typeof accessResult === 'object') {\n    constraints.push(accessResult)\n  }\n\n  if (typeof prefix === 'string') {\n    constraints.push({ prefix: { equals: prefix } })\n  }\n\n  if (constraints.length > 0 || documentID !== undefined) {\n    const doc =\n      documentID === undefined\n        ? await resolveUploadDocument({\n            collection,\n            filename,\n            prefix,\n            req,\n            where: typeof accessResult === 'object' ? accessResult : undefined,\n          })\n        : await req.payload.db.findOne({\n            collection: config.slug,\n            req,\n            where: { and: [{ id: { equals: documentID } }, ...constraints] },\n          })\n\n    if (!doc) {\n      throw new Forbidden(req.t)\n    }\n\n    return doc\n  }\n}\n"],"names":["executeAccess","Forbidden","resolveUploadDocument","checkFileAccess","collection","documentID","filename","prefix","req","includes","t","config","accessResult","id","slug","data","isReadingStaticFile","access","read","constraints","push","equals","length","undefined","doc","where","payload","db","findOne","and"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAClD,SAASC,qBAAqB,QAAQ,0CAAyC;AAE/E,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,UAAU,EACVC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAOJ;IACC,IAAIF,SAASG,QAAQ,CAAC,UAAUH,SAASG,QAAQ,CAAC,SAAS;QACzD,MAAM,IAAIR,UAAUO,IAAIE,CAAC;IAC3B;IACA,MAAM,EAAEC,MAAM,EAAE,GAAGP;IAEnB,MAAMQ,eAAe,MAAMZ,cACzB;QAAEa,IAAIR;QAAYS,MAAMH,OAAOG,IAAI;QAAEC,MAAM;YAAET;QAAS;QAAGU,qBAAqB;QAAMR;IAAI,GACxFG,OAAOM,MAAM,CAACC,IAAI;IAGpB,MAAMC,cAAuB,EAAE;IAE/B,IAAI,OAAOP,iBAAiB,UAAU;QACpCO,YAAYC,IAAI,CAACR;IACnB;IAEA,IAAI,OAAOL,WAAW,UAAU;QAC9BY,YAAYC,IAAI,CAAC;YAAEb,QAAQ;gBAAEc,QAAQd;YAAO;QAAE;IAChD;IAEA,IAAIY,YAAYG,MAAM,GAAG,KAAKjB,eAAekB,WAAW;QACtD,MAAMC,MACJnB,eAAekB,YACX,MAAMrB,sBAAsB;YAC1BE;YACAE;YACAC;YACAC;YACAiB,OAAO,OAAOb,iBAAiB,WAAWA,eAAeW;QAC3D,KACA,MAAMf,IAAIkB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YAC3BxB,YAAYO,OAAOG,IAAI;YACvBN;YACAiB,OAAO;gBAAEI,KAAK;oBAAC;wBAAEhB,IAAI;4BAAEQ,QAAQhB;wBAAW;oBAAE;uBAAMc;iBAAY;YAAC;QACjE;QAEN,IAAI,CAACK,KAAK;YACR,MAAM,IAAIvB,UAAUO,IAAIE,CAAC;QAC3B;QAEA,OAAOc;IACT;AACF,EAAC"}

package/dist/uploads/checkFileRestrictions.d.ts

@@ -3,5 +3,15 @@ import type { checkFileRestrictionsParams, FileAllowList } from './types.js';
  * Restricted file types and their extensions.
  */
 export declare const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList;
-export declare const checkFileRestrictions: ({ checkFileContents, collection, file, req, }: checkFileRestrictionsParams) => Promise<void>;
+export declare const checkFileRestrictions: ({ checkFileContents, collection, file, req, }: checkFileRestrictionsParams) => Promise<{
+    ext: string;
+    mime: string;
+} | undefined>;
+export declare const checkFileMetadataRestrictions: ({ collection, filename, filesize, mimeType, req, }: {
+    collection: checkFileRestrictionsParams['collection'];
+    filename: string;
+    filesize?: number;
+    mimeType: string;
+    req: checkFileRestrictionsParams['req'];
+}) => Promise<void>;
 //# sourceMappingURL=checkFileRestrictions.d.ts.map

package/dist/uploads/checkFileRestrictions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAS5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAgC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,kDAK/B,2BAA2B,KAAG,OAAO,CAAC,IAAI,CA2K5C,CAAA"}
+{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAsB5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAiC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,kDAK/B,2BAA2B,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAgNjF,CAAA;AAED,eAAO,MAAM,6BAA6B,uDAMvC;IACD,UAAU,EAAE,2BAA2B,CAAC,YAAY,CAAC,CAAA;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAA;CACxC,KAAG,OAAO,CAAC,IAAI,CAYf,CAAA"}

package/dist/uploads/checkFileRestrictions.js

@@ -3,9 +3,12 @@ import fs from 'fs/promises';
 import { ValidationError } from '../errors/index.js';
 import { validateMimeType } from '../utilities/validateMimeType.js';
 import { validatePDF } from '../utilities/validatePDF.js';
-import { detectSvgFromXml } from './detectSvgFromXml.js';
 import { getFileTypeFallback } from './getFileTypeFallback.js';
-import { validateSvg } from './validateSvg.js';
+import { getFileExtension, getMimeTypeEssence, getSanitizedUploadFilename, isSvgUpload, isXmlUpload } from './getFileTypeIdentity.js';
+import { hasFullFileContents } from './hasFullFileContents.js';
+import { isProcessableImage } from './isProcessableImage.js';
+import { isISOBaseMediaMimeType, validateISOBaseMediaBuffer, validateISOBaseMediaFile } from './validateISOBaseMediaFile.js';
+import { inspectSvg, inspectSvgFile } from './validateSvg.js';
 /**
  * Restricted file types and their extensions.
  */ export const RESTRICTED_FILE_EXT_AND_TYPES = [
@@ -111,6 +114,10 @@ import { validateSvg } from './validateSvg.js';
         ],
         mimeType: 'text/html'
     },
+    {
+        extensions: [],
+        mimeType: 'application/xhtml+xml'
+    },
     {
         extensions: [
             'php',
@@ -236,12 +243,10 @@ export const checkFileRestrictions = async ({ checkFileContents = true, collecti
         }
         return mimeType.startsWith('image/') || mimeType.startsWith('video/') || mimeType.startsWith('audio/') || mimeType === 'application/pdf';
     };
-    // Skip validation if `allowRestrictedFileTypes` is true
-    if (allowRestrictedFileTypes) {
-        return;
-    }
+    const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name));
+    const mimeTypeEssence = getMimeTypeEssence(file.mimetype);
     if (!checkFileContents) {
-        const isAllowed = configMimeTypes.length ? validateMimeType(file.mimetype, configMimeTypes) : !RESTRICTED_FILE_EXT_AND_TYPES.some(({ extensions, mimeType })=>mimeType === file.mimetype || extensions.some((extension)=>file.name.toLowerCase().endsWith(extension)));
+        const isAllowed = configMimeTypes.length ? validateMimeType(file.mimetype, configMimeTypes) : !RESTRICTED_FILE_EXT_AND_TYPES.some(({ extensions, mimeType })=>mimeType === mimeTypeEssence || extensions.includes(typeFromExtension.toLowerCase()));
         if (!isAllowed) {
             throw new ValidationError({
                 errors: [
@@ -255,11 +260,11 @@ export const checkFileRestrictions = async ({ checkFileContents = true, collecti
         return;
     }
     // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory
-    // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is
-    // loaded lazily and only when the file type actually requires it.
+    // just for detection. Content validation streams SVG/XML temp files and only loads a full
+    // temp-file buffer for PDF integrity checks.
     const { tempFilePath } = file;
     const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0);
-    // Lazily reads the full file — only reached for small text-based types (SVG, PDF).
+    // Lazily reads the full file — only reached for PDF validation.
     let _fileBuffer;
     const getFileBuffer = async ()=>{
         if (_fileBuffer) {
@@ -282,12 +287,20 @@ export const checkFileRestrictions = async ({ checkFileContents = true, collecti
             });
         }
     };
-    // Secondary mimetype check to assess file type from buffer
-    if (configMimeTypes.length > 0) {
-        let detected;
-        try {
-            detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
-        } catch  {
+    let isSvg = isSvgUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    });
+    let svgInspection;
+    const getSvgInspection = async ()=>{
+        svgInspection ??= isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data);
+        return svgInspection;
+    };
+    let detected;
+    try {
+        detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
+    } catch  {
+        if (configMimeTypes.length > 0) {
             throw new ValidationError({
                 errors: [
                     {
@@ -297,10 +310,35 @@ export const checkFileRestrictions = async ({ checkFileContents = true, collecti
                 ]
             });
         }
-        const typeFromExtension = file.name.split('.').pop() || '';
+    }
+    if (isSvg || isXmlUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    }) || detected?.mime === 'application/xml' || !detected && isProcessableImage(file.mimetype)) {
+        const inspection = await getSvgInspection();
+        isSvg = inspection.isSvg;
+        if (inspection.isSvg) {
+            detected = {
+                ext: 'svg',
+                mime: 'image/svg+xml'
+            };
+        } else if (inspection.isValid && !detected) {
+            detected = {
+                ext: 'xml',
+                mime: 'application/xml'
+            };
+        }
+    }
+    if (detected && isISOBaseMediaMimeType(detected.mime) && (hasFullFileContents(file) || configMimeTypes.length > 0)) {
+        const isValidISOBaseMedia = isTempFile && tempFilePath ? await validateISOBaseMediaFile(tempFilePath) : await validateISOBaseMediaBuffer(file.data);
+        if (!isValidISOBaseMedia) {
+            errors.push('Invalid or corrupted ISO base media file.');
+        }
+    }
+    // Secondary mimetype check to assess file type from buffer
+    if (configMimeTypes.length > 0) {
         // Handle SVG files that are detected as XML due to <?xml declarations
         if (detected?.mime === 'application/xml' && configMimeTypes.some((type)=>type.includes('image/') && (type.includes('svg') || type === 'image/*'))) {
-            const isSvg = detectSvgFromXml(await getFileBuffer());
             if (isSvg) {
                 detected = {
                     ext: 'svg',
@@ -314,13 +352,6 @@ export const checkFileRestrictions = async ({ checkFileContents = true, collecti
             if (!extIsValid) {
                 errors.push(`File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`);
             } else {
-                // SVG security check (text-based files not detectable by buffer)
-                if (typeFromExtension.toLowerCase() === 'svg') {
-                    const isSafeSvg = validateSvg(await getFileBuffer());
-                    if (!isSafeSvg) {
-                        errors.push('SVG file contains potentially harmful content.');
-                    }
-                }
                 // PDF validation
                 if (mimeTypeFromExtension === 'application/pdf') {
                     const isValidPDF = validatePDF(await getFileBuffer());
@@ -343,16 +374,22 @@ export const checkFileRestrictions = async ({ checkFileContents = true, collecti
         if (detected && !passesMimeTypeCheck) {
             errors.push(`Invalid MIME type: ${detected.mime}.`);
         }
-    } else {
+    } else if (!allowRestrictedFileTypes) {
         const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type)=>{
-            const hasRestrictedExt = type.extensions.some((ext)=>file.name.toLowerCase().endsWith(ext));
-            const hasRestrictedMime = type.mimeType === file.mimetype;
+            const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase());
+            const hasRestrictedMime = type.mimeType === mimeTypeEssence;
             return hasRestrictedExt || hasRestrictedMime;
         });
         if (isRestricted) {
             errors.push(`File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`);
         }
     }
+    if (isSvg) {
+        const isSafeSvg = (await getSvgInspection()).isSafe;
+        if (!isSafeSvg) {
+            errors.push('SVG file contains potentially harmful content.');
+        }
+    }
     if (errors.length > 0) {
         req.payload.logger.error(errors.join(', '));
         throw new ValidationError({
@@ -364,6 +401,20 @@ export const checkFileRestrictions = async ({ checkFileContents = true, collecti
             ]
         });
     }
+    return detected;
+};
+export const checkFileMetadataRestrictions = async ({ collection, filename, filesize = 0, mimeType, req })=>{
+    await checkFileRestrictions({
+        checkFileContents: false,
+        collection,
+        file: {
+            name: filename,
+            data: Buffer.alloc(0),
+            mimetype: mimeType,
+            size: filesize
+        },
+        req
+    });
 };
 
 //# sourceMappingURL=checkFileRestrictions.js.map

package/dist/uploads/checkFileRestrictions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { detectSvgFromXml } from './detectSvgFromXml.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport { validateSvg } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  checkFileContents = true,\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<void> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // Skip validation if `allowRestrictedFileTypes` is true\n  if (allowRestrictedFileTypes) {\n    return\n  }\n\n  if (!checkFileContents) {\n    const isAllowed = configMimeTypes.length\n      ? validateMimeType(file.mimetype, configMimeTypes)\n      : !RESTRICTED_FILE_EXT_AND_TYPES.some(\n          ({ extensions, mimeType }) =>\n            mimeType === file.mimetype ||\n            extensions.some((extension) => file.name.toLowerCase().endsWith(extension)),\n        )\n\n    if (!isAllowed) {\n      throw new ValidationError({\n        errors: [{ message: `File type '${file.mimetype}' is not allowed.`, path: 'file' }],\n      })\n    }\n\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is\n  // loaded lazily and only when the file type actually requires it.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for small text-based types (SVG, PDF).\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    let detected\n    try {\n      detected =\n        isTempFile && tempFilePath\n          ? await fileTypeFromFile(tempFilePath)\n          : await fileTypeFromBuffer(file.data)\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n    const typeFromExtension = file.name.split('.').pop() || ''\n\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      const isSvg = detectSvgFromXml(await getFileBuffer())\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // SVG security check (text-based files not detectable by buffer)\n        if (typeFromExtension.toLowerCase() === 'svg') {\n          const isSafeSvg = validateSvg(await getFileBuffer())\n          if (!isSafeSvg) {\n            errors.push('SVG file contains potentially harmful content.')\n          }\n        }\n\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))\n      const hasRestrictedMime = type.mimeType === file.mimetype\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","detectSvgFromXml","getFileTypeFallback","validateSvg","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","checkFileContents","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","isAllowed","length","mimetype","some","extension","name","toLowerCase","endsWith","message","path","tempFilePath","isTempFile","data","_fileBuffer","getFileBuffer","readFile","detected","typeFromExtension","split","pop","mime","type","isSvg","ext","mimeTypeFromExtension","extIsValid","push","isSafeSvg","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","hasRestrictedMime","error","join"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,WAAW,QAAQ,mBAAkB;AAE9C;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,oBAAoB,IAAI,EACxBC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACd;QAC7B,MAAMe,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAAChB,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,aAAa;IAEjB;IAEA,wDAAwD;IACxD,IAAIa,0BAA0B;QAC5B;IACF;IAEA,IAAI,CAACX,mBAAmB;QACtB,MAAMgB,YAAYT,gBAAgBU,MAAM,GACpC1B,iBAAiBW,KAAKgB,QAAQ,EAAEX,mBAChC,CAACX,8BAA8BuB,IAAI,CACjC,CAAC,EAAEtB,UAAU,EAAEC,QAAQ,EAAE,GACvBA,aAAaI,KAAKgB,QAAQ,IAC1BrB,WAAWsB,IAAI,CAAC,CAACC,YAAclB,KAAKmB,IAAI,CAACC,WAAW,GAAGC,QAAQ,CAACH;QAGxE,IAAI,CAACJ,WAAW;YACd,MAAM,IAAI1B,gBAAgB;gBACxBc,QAAQ;oBAAC;wBAAEoB,SAAS,CAAC,WAAW,EAAEtB,KAAKgB,QAAQ,CAAC,iBAAiB,CAAC;wBAAEO,MAAM;oBAAO;iBAAE;YACrF;QACF;QAEA;IACF;IAEA,gGAAgG;IAChG,6FAA6F;IAC7F,kEAAkE;IAClE,MAAM,EAAEC,YAAY,EAAE,GAAGxB;IACzB,MAAMyB,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACxB,KAAK0B,IAAI,IAAI1B,KAAK0B,IAAI,CAACX,MAAM,KAAK,CAAA;IAEzE,mFAAmF;IACnF,IAAIY;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACF,cAAc,CAACD,cAAc;YAChC,OAAQG,cAAc3B,KAAK0B,IAAI;QACjC;QACA,IAAI;YACFC,cAAc,MAAMxC,GAAG0C,QAAQ,CAACL;YAChC,OAAOG;QACT,EAAE,OAAM;YACN,MAAM,IAAIvC,gBAAgB;gBACxBc,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,2DAA2D;IAC3D,IAAIlB,gBAAgBU,MAAM,GAAG,GAAG;QAC9B,IAAIe;QACJ,IAAI;YACFA,WACEL,cAAcD,eACV,MAAMtC,iBAAiBsC,gBACvB,MAAMvC,mBAAmBe,KAAK0B,IAAI;QAC1C,EAAE,OAAM;YACN,MAAM,IAAItC,gBAAgB;gBACxBc,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;QACA,MAAMQ,oBAAoB/B,KAAKmB,IAAI,CAACa,KAAK,CAAC,KAAKC,GAAG,MAAM;QAExD,sEAAsE;QACtE,IACEH,UAAUI,SAAS,qBACnB7B,gBAAgBY,IAAI,CAClB,CAACkB,OAASA,KAAKvB,QAAQ,CAAC,aAAcuB,CAAAA,KAAKvB,QAAQ,CAAC,UAAUuB,SAAS,SAAQ,IAEjF;YACA,MAAMC,QAAQ7C,iBAAiB,MAAMqC;YACrC,IAAIQ,OAAO;gBACTN,WAAW;oBAAEO,KAAK;oBAAOH,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACJ,UAAU;YACb,MAAMQ,wBAAwB9C,oBAAoBQ,KAAKmB,IAAI,EAAEe,IAAI;YACjE,MAAMK,aAAalD,iBAAiBiD,uBAAuBjC;YAE3D,IAAI,CAACkC,YAAY;gBACfrC,OAAOsC,IAAI,CACT,CAAC,UAAU,EAAEF,sBAAsB,iBAAiB,EAAEP,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iEAAiE;gBACjE,IAAIA,kBAAkBX,WAAW,OAAO,OAAO;oBAC7C,MAAMqB,YAAYhD,YAAY,MAAMmC;oBACpC,IAAI,CAACa,WAAW;wBACdvC,OAAOsC,IAAI,CAAC;oBACd;gBACF;gBAEA,iBAAiB;gBACjB,IAAIF,0BAA0B,mBAAmB;oBAC/C,MAAMI,aAAapD,YAAY,MAAMsC;oBACrC,IAAI,CAACc,YAAY;wBACfxC,OAAOsC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAI9B,sBAAsB4B,wBAAwB;gBAChDrC,IAAI0C,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAE7C,KAAKmB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAM2B,sBAAsBhB,UAAUI,QAAQ7C,iBAAiByC,SAASI,IAAI,EAAE7B;QAE9E,IAAIyC,uBAAuBhB,UAAUI,SAAS,mBAAmB;YAC/D,MAAMQ,aAAapD,YAAY,MAAMsC;YACrC,IAAI,CAACc,YAAY;gBACfxC,OAAOsC,IAAI,CAAC;YACd;QACF;QAEA,IAAIV,YAAY,CAACgB,qBAAqB;YACpC5C,OAAOsC,IAAI,CAAC,CAAC,mBAAmB,EAAEV,SAASI,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMa,eAAerD,8BAA8BuB,IAAI,CAAC,CAACkB;YACvD,MAAMa,mBAAmBb,KAAKxC,UAAU,CAACsB,IAAI,CAAC,CAACoB,MAAQrC,KAAKmB,IAAI,CAACC,WAAW,GAAGC,QAAQ,CAACgB;YACxF,MAAMY,oBAAoBd,KAAKvC,QAAQ,KAAKI,KAAKgB,QAAQ;YACzD,OAAOgC,oBAAoBC;QAC7B;QACA,IAAIF,cAAc;YAChB7C,OAAOsC,IAAI,CACT,CAAC,WAAW,EAAExC,KAAKgB,QAAQ,CAAC,cAAc,EAAEhB,KAAKmB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIjB,OAAOa,MAAM,GAAG,GAAG;QACrBd,IAAI0C,OAAO,CAACC,MAAM,CAACM,KAAK,CAAChD,OAAOiD,IAAI,CAAC;QACrC,MAAM,IAAI/D,gBAAgB;YACxBc,QAAQ;gBAAC;oBAAEoB,SAASpB,OAAOiD,IAAI,CAAC;oBAAO5B,MAAM;gBAAO;aAAE;QACxD;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport {\n  getFileExtension,\n  getMimeTypeEssence,\n  getSanitizedUploadFilename,\n  isSvgUpload,\n  isXmlUpload,\n} from './getFileTypeIdentity.js'\nimport { hasFullFileContents } from './hasFullFileContents.js'\nimport { isProcessableImage } from './isProcessableImage.js'\nimport {\n  isISOBaseMediaMimeType,\n  validateISOBaseMediaBuffer,\n  validateISOBaseMediaFile,\n} from './validateISOBaseMediaFile.js'\nimport { inspectSvg, inspectSvgFile } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: [], mimeType: 'application/xhtml+xml' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  checkFileContents = true,\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<{ ext: string; mime: string } | undefined> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name))\n  const mimeTypeEssence = getMimeTypeEssence(file.mimetype)\n\n  if (!checkFileContents) {\n    const isAllowed = configMimeTypes.length\n      ? validateMimeType(file.mimetype, configMimeTypes)\n      : !RESTRICTED_FILE_EXT_AND_TYPES.some(\n          ({ extensions, mimeType }) =>\n            mimeType === mimeTypeEssence || extensions.includes(typeFromExtension.toLowerCase()),\n        )\n\n    if (!isAllowed) {\n      throw new ValidationError({\n        errors: [{ message: `File type '${file.mimetype}' is not allowed.`, path: 'file' }],\n      })\n    }\n\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. Content validation streams SVG/XML temp files and only loads a full\n  // temp-file buffer for PDF integrity checks.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for PDF validation.\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  let isSvg = isSvgUpload({ filename: file.name, mimeType: file.mimetype })\n  let svgInspection: Awaited<ReturnType<typeof inspectSvgFile>> | undefined\n\n  const getSvgInspection = async () => {\n    svgInspection ??=\n      isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data)\n    return svgInspection\n  }\n\n  let detected\n  try {\n    detected =\n      isTempFile && tempFilePath\n        ? await fileTypeFromFile(tempFilePath)\n        : await fileTypeFromBuffer(file.data)\n  } catch {\n    if (configMimeTypes.length > 0) {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n  }\n\n  if (\n    isSvg ||\n    isXmlUpload({ filename: file.name, mimeType: file.mimetype }) ||\n    detected?.mime === 'application/xml' ||\n    (!detected && isProcessableImage(file.mimetype))\n  ) {\n    const inspection = await getSvgInspection()\n    isSvg = inspection.isSvg\n    if (inspection.isSvg) {\n      detected = { ext: 'svg', mime: 'image/svg+xml' }\n    } else if (inspection.isValid && !detected) {\n      detected = { ext: 'xml', mime: 'application/xml' }\n    }\n  }\n\n  if (\n    detected &&\n    isISOBaseMediaMimeType(detected.mime) &&\n    (hasFullFileContents(file) || configMimeTypes.length > 0)\n  ) {\n    const isValidISOBaseMedia =\n      isTempFile && tempFilePath\n        ? await validateISOBaseMediaFile(tempFilePath)\n        : await validateISOBaseMediaBuffer(file.data)\n\n    if (!isValidISOBaseMedia) {\n      errors.push('Invalid or corrupted ISO base media file.')\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else if (!allowRestrictedFileTypes) {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase())\n      const hasRestrictedMime = type.mimeType === mimeTypeEssence\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (isSvg) {\n    const isSafeSvg = (await getSvgInspection()).isSafe\n    if (!isSafeSvg) {\n      errors.push('SVG file contains potentially harmful content.')\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n\n  return detected\n}\n\nexport const checkFileMetadataRestrictions = async ({\n  collection,\n  filename,\n  filesize = 0,\n  mimeType,\n  req,\n}: {\n  collection: checkFileRestrictionsParams['collection']\n  filename: string\n  filesize?: number\n  mimeType: string\n  req: checkFileRestrictionsParams['req']\n}): Promise<void> => {\n  await checkFileRestrictions({\n    checkFileContents: false,\n    collection,\n    file: {\n      name: filename,\n      data: Buffer.alloc(0),\n      mimetype: mimeType,\n      size: filesize,\n    },\n    req,\n  })\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","getFileTypeFallback","getFileExtension","getMimeTypeEssence","getSanitizedUploadFilename","isSvgUpload","isXmlUpload","hasFullFileContents","isProcessableImage","isISOBaseMediaMimeType","validateISOBaseMediaBuffer","validateISOBaseMediaFile","inspectSvg","inspectSvgFile","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","checkFileContents","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","typeFromExtension","name","mimeTypeEssence","mimetype","isAllowed","length","some","toLowerCase","message","path","tempFilePath","isTempFile","data","_fileBuffer","getFileBuffer","readFile","isSvg","filename","svgInspection","getSvgInspection","detected","mime","inspection","ext","isValid","isValidISOBaseMedia","push","type","mimeTypeFromExtension","extIsValid","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","hasRestrictedMime","isSafeSvg","isSafe","error","join","checkFileMetadataRestrictions","filesize","Buffer","alloc","size"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SACEC,gBAAgB,EAChBC,kBAAkB,EAClBC,0BAA0B,EAC1BC,WAAW,EACXC,WAAW,QACN,2BAA0B;AACjC,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,wBAAwB,QACnB,gCAA+B;AACtC,SAASC,UAAU,EAAEC,cAAc,QAAQ,mBAAkB;AAE7D;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY,EAAE;QAAEC,UAAU;IAAwB;IACpD;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,oBAAoB,IAAI,EACxBC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACd;QAC7B,MAAMe,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAAChB,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,aAAa;IAEjB;IAEA,MAAMkB,oBAAoBhC,iBAAiBE,2BAA2BgB,KAAKe,IAAI;IAC/E,MAAMC,kBAAkBjC,mBAAmBiB,KAAKiB,QAAQ;IAExD,IAAI,CAACnB,mBAAmB;QACtB,MAAMoB,YAAYb,gBAAgBc,MAAM,GACpCxC,iBAAiBqB,KAAKiB,QAAQ,EAAEZ,mBAChC,CAACX,8BAA8B0B,IAAI,CACjC,CAAC,EAAEzB,UAAU,EAAEC,QAAQ,EAAE,GACvBA,aAAaoB,mBAAmBrB,WAAWiB,QAAQ,CAACE,kBAAkBO,WAAW;QAGzF,IAAI,CAACH,WAAW;YACd,MAAM,IAAIxC,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS,CAAC,WAAW,EAAEtB,KAAKiB,QAAQ,CAAC,iBAAiB,CAAC;wBAAEM,MAAM;oBAAO;iBAAE;YACrF;QACF;QAEA;IACF;IAEA,gGAAgG;IAChG,0FAA0F;IAC1F,6CAA6C;IAC7C,MAAM,EAAEC,YAAY,EAAE,GAAGxB;IACzB,MAAMyB,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACxB,KAAK0B,IAAI,IAAI1B,KAAK0B,IAAI,CAACP,MAAM,KAAK,CAAA;IAEzE,gEAAgE;IAChE,IAAIQ;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACF,cAAc,CAACD,cAAc;YAChC,OAAQG,cAAc3B,KAAK0B,IAAI;QACjC;QACA,IAAI;YACFC,cAAc,MAAMlD,GAAGoD,QAAQ,CAACL;YAChC,OAAOG;QACT,EAAE,OAAM;YACN,MAAM,IAAIjD,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,IAAIO,QAAQ7C,YAAY;QAAE8C,UAAU/B,KAAKe,IAAI;QAAEnB,UAAUI,KAAKiB,QAAQ;IAAC;IACvE,IAAIe;IAEJ,MAAMC,mBAAmB;QACvBD,kBACEP,cAAcD,eAAe,MAAM/B,eAAe+B,gBAAgBhC,WAAWQ,KAAK0B,IAAI;QACxF,OAAOM;IACT;IAEA,IAAIE;IACJ,IAAI;QACFA,WACET,cAAcD,eACV,MAAMhD,iBAAiBgD,gBACvB,MAAMjD,mBAAmByB,KAAK0B,IAAI;IAC1C,EAAE,OAAM;QACN,IAAIrB,gBAAgBc,MAAM,GAAG,GAAG;YAC9B,MAAM,IAAIzC,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;IACF;IAEA,IACEO,SACA5C,YAAY;QAAE6C,UAAU/B,KAAKe,IAAI;QAAEnB,UAAUI,KAAKiB,QAAQ;IAAC,MAC3DiB,UAAUC,SAAS,qBAClB,CAACD,YAAY9C,mBAAmBY,KAAKiB,QAAQ,GAC9C;QACA,MAAMmB,aAAa,MAAMH;QACzBH,QAAQM,WAAWN,KAAK;QACxB,IAAIM,WAAWN,KAAK,EAAE;YACpBI,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAgB;QACjD,OAAO,IAAIC,WAAWE,OAAO,IAAI,CAACJ,UAAU;YAC1CA,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAkB;QACnD;IACF;IAEA,IACED,YACA7C,uBAAuB6C,SAASC,IAAI,KACnChD,CAAAA,oBAAoBa,SAASK,gBAAgBc,MAAM,GAAG,CAAA,GACvD;QACA,MAAMoB,sBACJd,cAAcD,eACV,MAAMjC,yBAAyBiC,gBAC/B,MAAMlC,2BAA2BU,KAAK0B,IAAI;QAEhD,IAAI,CAACa,qBAAqB;YACxBrC,OAAOsC,IAAI,CAAC;QACd;IACF;IAEA,2DAA2D;IAC3D,IAAInC,gBAAgBc,MAAM,GAAG,GAAG;QAC9B,sEAAsE;QACtE,IACEe,UAAUC,SAAS,qBACnB9B,gBAAgBe,IAAI,CAClB,CAACqB,OAASA,KAAK7B,QAAQ,CAAC,aAAc6B,CAAAA,KAAK7B,QAAQ,CAAC,UAAU6B,SAAS,SAAQ,IAEjF;YACA,IAAIX,OAAO;gBACTI,WAAW;oBAAEG,KAAK;oBAAOF,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACD,UAAU;YACb,MAAMQ,wBAAwB7D,oBAAoBmB,KAAKe,IAAI,EAAEoB,IAAI;YACjE,MAAMQ,aAAahE,iBAAiB+D,uBAAuBrC;YAE3D,IAAI,CAACsC,YAAY;gBACfzC,OAAOsC,IAAI,CACT,CAAC,UAAU,EAAEE,sBAAsB,iBAAiB,EAAE5B,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iBAAiB;gBACjB,IAAI4B,0BAA0B,mBAAmB;oBAC/C,MAAME,aAAahE,YAAY,MAAMgD;oBACrC,IAAI,CAACgB,YAAY;wBACf1C,OAAOsC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAI9B,sBAAsBgC,wBAAwB;gBAChDzC,IAAI4C,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAE/C,KAAKe,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMiC,sBAAsBd,UAAUC,QAAQxD,iBAAiBuD,SAASC,IAAI,EAAE9B;QAE9E,IAAI2C,uBAAuBd,UAAUC,SAAS,mBAAmB;YAC/D,MAAMS,aAAahE,YAAY,MAAMgD;YACrC,IAAI,CAACgB,YAAY;gBACf1C,OAAOsC,IAAI,CAAC;YACd;QACF;QAEA,IAAIN,YAAY,CAACc,qBAAqB;YACpC9C,OAAOsC,IAAI,CAAC,CAAC,mBAAmB,EAAEN,SAASC,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO,IAAI,CAAC1B,0BAA0B;QACpC,MAAMwC,eAAevD,8BAA8B0B,IAAI,CAAC,CAACqB;YACvD,MAAMS,mBAAmBT,KAAK9C,UAAU,CAACiB,QAAQ,CAACE,kBAAkBO,WAAW;YAC/E,MAAM8B,oBAAoBV,KAAK7C,QAAQ,KAAKoB;YAC5C,OAAOkC,oBAAoBC;QAC7B;QACA,IAAIF,cAAc;YAChB/C,OAAOsC,IAAI,CACT,CAAC,WAAW,EAAExC,KAAKiB,QAAQ,CAAC,cAAc,EAAEjB,KAAKe,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIe,OAAO;QACT,MAAMsB,YAAY,AAAC,CAAA,MAAMnB,kBAAiB,EAAGoB,MAAM;QACnD,IAAI,CAACD,WAAW;YACdlD,OAAOsC,IAAI,CAAC;QACd;IACF;IAEA,IAAItC,OAAOiB,MAAM,GAAG,GAAG;QACrBlB,IAAI4C,OAAO,CAACC,MAAM,CAACQ,KAAK,CAACpD,OAAOqD,IAAI,CAAC;QACrC,MAAM,IAAI7E,gBAAgB;YACxBwB,QAAQ;gBAAC;oBAAEoB,SAASpB,OAAOqD,IAAI,CAAC;oBAAOhC,MAAM;gBAAO;aAAE;QACxD;IACF;IAEA,OAAOW;AACT,EAAC;AAED,OAAO,MAAMsB,gCAAgC,OAAO,EAClDzD,UAAU,EACVgC,QAAQ,EACR0B,WAAW,CAAC,EACZ7D,QAAQ,EACRK,GAAG,EAOJ;IACC,MAAMJ,sBAAsB;QAC1BC,mBAAmB;QACnBC;QACAC,MAAM;YACJe,MAAMgB;YACNL,MAAMgC,OAAOC,KAAK,CAAC;YACnB1C,UAAUrB;YACVgE,MAAMH;QACR;QACAxD;IACF;AACF,EAAC"}

package/dist/uploads/clientUploadReceipt.d.ts

@@ -0,0 +1,29 @@
+import type { PayloadRequest } from '../types/index.js';
+type ClientUploadReceipt = {
+    _objectKey?: string;
+    allowOverwrite?: boolean;
+    collectionSlug: string;
+    expiresAt: number;
+    filename: string;
+    filePrefix: string;
+    storageFilePath: string;
+    userCollection: null | string;
+    userID: null | number | string;
+};
+export declare const createClientUploadReceipt: ({ _objectKey, allowOverwrite, collectionSlug, filename, filePrefix, req, storageFilePath, }: {
+    _objectKey?: string;
+    allowOverwrite?: boolean;
+    collectionSlug: string;
+    filename: string;
+    filePrefix: string;
+    req: PayloadRequest;
+    storageFilePath: string;
+}) => `${string}.${string}`;
+export declare const verifyClientUploadReceipt: ({ collectionSlug, filename, req, signedReceipt, }: {
+    collectionSlug?: string;
+    filename?: string;
+    req: PayloadRequest;
+    signedReceipt: unknown;
+}) => ClientUploadReceipt;
+export {};
+//# sourceMappingURL=clientUploadReceipt.d.ts.map

package/dist/uploads/clientUploadReceipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientUploadReceipt.d.ts","sourceRoot":"","sources":["../../src/uploads/clientUploadReceipt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,mBAAmB,GAAG;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,IAAI,GAAG,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B,CAAA;AAOD,eAAO,MAAM,yBAAyB,gGAQnC;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;CACxB,KAAG,GAAG,MAAM,IAAI,MAAM,EActB,CAAA;AAED,eAAO,MAAM,yBAAyB,sDAKnC;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,OAAO,CAAA;CACvB,KAAG,mBA+BH,CAAA"}