payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ee5d8bd

package/dist/uploads/endpoints/getFile.js

@@ -1,14 +1,20 @@
 import { fileTypeFromFile } from 'file-type';
 import fsPromises from 'fs/promises';
-import { status as httpStatus } from 'http-status';
 import path from 'path';
 import { APIError } from '../../errors/APIError.js';
-import { checkFileAccess } from '../../uploads/checkFileAccess.js';
-import { streamFile } from '../../uploads/fetchAPI-stream-file/index.js';
-import { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js';
-import { parseRangeHeader } from '../../uploads/parseRangeHeader.js';
+import { NotFound } from '../../errors/NotFound.js';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
+import { checkFileAccess } from '../checkFileAccess.js';
+import { streamFile } from '../fetchAPI-stream-file/index.js';
+import { resolveHistoricalFile } from '../fileVersioning/resolveHistoricalFile.js';
+import { getFileTypeFallback } from '../getFileTypeFallback.js';
+import { getFileExtension, isXmlMimeType } from '../getFileTypeIdentity.js';
+import { parseRangeHeader } from '../parseRangeHeader.js';
+import { handleDynamicFileRequest } from '../transformers/handleDynamicFileRequest.js';
+import { resolveUploadDocument } from '../transformers/resolveUploadDocument.js';
+import { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js';
 export const getFileHandler = async (req)=>{
     const collection = getRequestCollection(req);
     const filename = req.routeParams?.filename;
@@ -16,6 +22,31 @@ export const getFileHandler = async (req)=>{
     if (!collection.config.upload) {
         throw new APIError(`This collection is not an upload collection: ${collection.config.slug}`, httpStatus.BAD_REQUEST);
     }
+    const versionID = req.searchParams?.get('version');
+    if (collection.config.versions && versionID) {
+        const historical = await resolveHistoricalFile({
+            collection,
+            filename,
+            prefix,
+            req,
+            versionID
+        });
+        return retrieveFileResponse({
+            collection,
+            doc: historical,
+            filename,
+            prefix,
+            req
+        });
+    }
+    if (req.payload.config.upload.transformers.length > 0) {
+        return handleDynamicFileRequest({
+            collection,
+            filename,
+            prefix,
+            req
+        });
+    }
     const accessResult = await checkFileAccess({
         collection,
         filename,
@@ -25,16 +56,40 @@ export const getFileHandler = async (req)=>{
     if (accessResult instanceof Response) {
         return accessResult;
     }
-    if (collection.config.upload.handlers?.length) {
+    const current = collection.config.versions ? accessResult ?? await resolveUploadDocument({
+        collection,
+        filename,
+        prefix,
+        req
+    }) : undefined;
+    if (collection.config.versions && !current) {
+        throw new NotFound(req.t);
+    }
+    return retrieveFileResponse({
+        collection,
+        doc: accessResult ?? current,
+        filename,
+        prefix,
+        req
+    });
+};
+/**
+ * Shared by the ordinary `read` endpoint and, via `operation: 'transform'`, by
+ * `getSourceFileResponse` for internal source retrieval. `transform` ignores the
+ * `Range` header and skips `modifyResponseHeaders`/CORS wrapping, since those are
+ * applied once, later, to the transformer pipeline's final response.
+ */ export async function retrieveFileResponse({ collection, doc, filename, operation = 'read', prefix, req }) {
+    if (collection.config.upload && collection.config.upload.handlers?.length) {
         let customResponse = null;
         const headers = new Headers();
         for (const handler of collection.config.upload.handlers){
             customResponse = await handler(req, {
-                doc: accessResult,
+                doc: doc,
                 headers,
                 params: {
                     collection: collection.config.slug,
                     filename,
+                    operation,
                     prefix
                 }
             });
@@ -80,11 +135,13 @@ export const getFileHandler = async (req)=>{
     }
     const fileTypeResult = await fileTypeFromFile(filePath) || getFileTypeFallback(filePath);
     let mimeType = fileTypeResult.mime;
-    if (filePath.endsWith('.svg') && fileTypeResult.mime === 'application/xml') {
+    if (getFileExtension(filePath).toLowerCase() === 'svg' && fileTypeResult.mime === 'application/xml') {
         mimeType = 'image/svg+xml';
     }
-    // Parse Range header for byte range requests
-    const rangeHeader = req.headers.get('range');
+    const isTransformSource = operation === 'transform';
+    // The client's Range header must never leak into an internal source retrieval —
+    // a transformer needs the complete original bytes to decode.
+    const rangeHeader = isTransformSource ? null : req.headers.get('range');
     const rangeResult = parseRangeHeader({
         fileSize: stats.size,
         rangeHeader
@@ -106,8 +163,8 @@ export const getFileHandler = async (req)=>{
     let headers = new Headers();
     headers.set('Content-Type', mimeType);
     headers.set('Accept-Ranges', 'bytes');
-    if (mimeType === 'image/svg+xml') {
-        headers.set('Content-Security-Policy', "script-src 'none'");
+    if (isXmlMimeType(mimeType)) {
+        headers.set('Content-Security-Policy', uploadContentSecurityPolicy);
     }
     let data;
     let status;
@@ -132,6 +189,12 @@ export const getFileHandler = async (req)=>{
         });
         status = httpStatus.OK;
     }
+    if (isTransformSource) {
+        return new Response(data, {
+            headers,
+            status
+        });
+    }
     headers = collection.config.upload?.modifyResponseHeaders ? collection.config.upload.modifyResponseHeaders({
         headers
     }) || headers : headers;
@@ -142,6 +205,6 @@ export const getFileHandler = async (req)=>{
         }),
         status
     });
-};
+}
 
 //# sourceMappingURL=getFile.js.map

package/dist/uploads/endpoints/getFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/getFile.ts"],"sourcesContent":["import type { Stats } from 'fs'\n\nimport { fileTypeFromFile } from 'file-type'\nimport fsPromises from 'fs/promises'\nimport { status as httpStatus } from 'http-status'\nimport path from 'path'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { checkFileAccess } from '../../uploads/checkFileAccess.js'\nimport { streamFile } from '../../uploads/fetchAPI-stream-file/index.js'\nimport { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js'\nimport { parseRangeHeader } from '../../uploads/parseRangeHeader.js'\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\n\nexport const getFileHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n\n  const filename = req.routeParams?.filename as string\n  const prefix = req.searchParams?.get('prefix') ?? undefined\n\n  if (!collection.config.upload) {\n    throw new APIError(\n      `This collection is not an upload collection: ${collection.config.slug}`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  const accessResult = (await checkFileAccess({\n    collection,\n    filename,\n    prefix,\n    req,\n  }))!\n\n  if (accessResult instanceof Response) {\n    return accessResult\n  }\n\n  if (collection.config.upload.handlers?.length) {\n    let customResponse: null | Response | void = null\n    const headers = new Headers()\n\n    for (const handler of collection.config.upload.handlers) {\n      customResponse = await handler(req, {\n        doc: accessResult,\n        headers,\n        params: {\n          collection: collection.config.slug,\n          filename,\n          prefix,\n        },\n      })\n      if (customResponse && customResponse instanceof Response) {\n        break\n      }\n    }\n\n    if (customResponse instanceof Response) {\n      return customResponse\n    }\n  }\n\n  // Local filesystem fallback — cloud storage handlers return a Response above\n  // and have their own filename validation via sanitizeFilename.\n  const fileDir = collection.config.upload?.staticDir || collection.config.slug\n  const resolvedDir = path.resolve(fileDir)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!filePath.startsWith(resolvedDir + path.sep)) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  let stats: Stats\n\n  try {\n    stats = await fsPromises.stat(filePath)\n  } catch (err) {\n    if ((err as { code?: string }).code === 'ENOENT') {\n      req.payload.logger.error(\n        `File ${filename} for collection ${collection.config.slug} is missing on the disk. Expected path: ${filePath}`,\n      )\n\n      // Omit going to the routeError handler by returning response instead of\n      // throwing an error to cut down log noise. The response still matches what you get with APIError to not leak details to the user.\n      return Response.json(\n        {\n          errors: [\n            {\n              message: 'Something went wrong.',\n            },\n          ],\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: 500,\n        },\n      )\n    }\n\n    throw err\n  }\n\n  const fileTypeResult = (await fileTypeFromFile(filePath)) || getFileTypeFallback(filePath)\n  let mimeType = fileTypeResult.mime\n\n  if (filePath.endsWith('.svg') && fileTypeResult.mime === 'application/xml') {\n    mimeType = 'image/svg+xml'\n  }\n\n  // Parse Range header for byte range requests\n  const rangeHeader = req.headers.get('range')\n  const rangeResult = parseRangeHeader({\n    fileSize: stats.size,\n    rangeHeader,\n  })\n\n  if (rangeResult.type === 'invalid') {\n    let headers = new Headers()\n    headers.set('Content-Range', `bytes */${stats.size}`)\n    headers = collection.config.upload?.modifyResponseHeaders\n      ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n      : headers\n\n    return new Response(null, {\n      headers: headersWithCors({\n        headers,\n        req,\n      }),\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    })\n  }\n\n  let headers = new Headers()\n  headers.set('Content-Type', mimeType)\n  headers.set('Accept-Ranges', 'bytes')\n\n  if (mimeType === 'image/svg+xml') {\n    headers.set('Content-Security-Policy', \"script-src 'none'\")\n  }\n\n  let data: ReadableStream\n  let status: number\n  const isPartial = rangeResult.type === 'partial'\n  const range = rangeResult.range\n\n  if (isPartial && range) {\n    const contentLength = range.end - range.start + 1\n    headers.set('Content-Length', String(contentLength))\n    headers.set('Content-Range', `bytes ${range.start}-${range.end}/${stats.size}`)\n    data = streamFile({ filePath, options: { end: range.end, start: range.start } })\n    status = httpStatus.PARTIAL_CONTENT\n  } else {\n    headers.set('Content-Length', String(stats.size))\n    data = streamFile({ filePath })\n    status = httpStatus.OK\n  }\n\n  headers = collection.config.upload?.modifyResponseHeaders\n    ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n    : headers\n\n  return new Response(data, {\n    headers: headersWithCors({\n      headers,\n      req,\n    }),\n    status,\n  })\n}\n"],"names":["fileTypeFromFile","fsPromises","status","httpStatus","path","APIError","checkFileAccess","streamFile","getFileTypeFallback","parseRangeHeader","getRequestCollection","headersWithCors","getFileHandler","req","collection","filename","routeParams","prefix","searchParams","get","undefined","config","upload","slug","BAD_REQUEST","accessResult","Response","handlers","length","customResponse","headers","Headers","handler","doc","params","fileDir","staticDir","resolvedDir","resolve","filePath","startsWith","sep","stats","stat","err","code","payload","logger","error","json","errors","message","fileTypeResult","mimeType","mime","endsWith","rangeHeader","rangeResult","fileSize","size","type","set","modifyResponseHeaders","REQUESTED_RANGE_NOT_SATISFIABLE","data","isPartial","range","contentLength","end","start","String","options","PARTIAL_CONTENT","OK"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,YAAW;AAC5C,OAAOC,gBAAgB,cAAa;AACpC,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAClD,OAAOC,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,UAAU,QAAQ,8CAA6C;AACxE,SAASC,mBAAmB,QAAQ,uCAAsC;AAC1E,SAASC,gBAAgB,QAAQ,oCAAmC;AACpE,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AAEpE,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaJ,qBAAqBG;IAExC,MAAME,WAAWF,IAAIG,WAAW,EAAED;IAClC,MAAME,SAASJ,IAAIK,YAAY,EAAEC,IAAI,aAAaC;IAElD,IAAI,CAACN,WAAWO,MAAM,CAACC,MAAM,EAAE;QAC7B,MAAM,IAAIjB,SACR,CAAC,6CAA6C,EAAES,WAAWO,MAAM,CAACE,IAAI,EAAE,EACxEpB,WAAWqB,WAAW;IAE1B;IAEA,MAAMC,eAAgB,MAAMnB,gBAAgB;QAC1CQ;QACAC;QACAE;QACAJ;IACF;IAEA,IAAIY,wBAAwBC,UAAU;QACpC,OAAOD;IACT;IAEA,IAAIX,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,EAAEC,QAAQ;QAC7C,IAAIC,iBAAyC;QAC7C,MAAMC,UAAU,IAAIC;QAEpB,KAAK,MAAMC,WAAWlB,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,CAAE;YACvDE,iBAAiB,MAAMG,QAAQnB,KAAK;gBAClCoB,KAAKR;gBACLK;gBACAI,QAAQ;oBACNpB,YAAYA,WAAWO,MAAM,CAACE,IAAI;oBAClCR;oBACAE;gBACF;YACF;YACA,IAAIY,kBAAkBA,0BAA0BH,UAAU;gBACxD;YACF;QACF;QAEA,IAAIG,0BAA0BH,UAAU;YACtC,OAAOG;QACT;IACF;IAEA,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAMM,UAAUrB,WAAWO,MAAM,CAACC,MAAM,EAAEc,aAAatB,WAAWO,MAAM,CAACE,IAAI;IAC7E,MAAMc,cAAcjC,KAAKkC,OAAO,CAACH;IACjC,MAAMI,WAAWnC,KAAKkC,OAAO,CAACD,aAAatB;IAE3C,IAAI,CAACwB,SAASC,UAAU,CAACH,cAAcjC,KAAKqC,GAAG,GAAG;QAChD,MAAM,IAAIpC,SAAS,qBAAqBF,WAAWqB,WAAW;IAChE;IAEA,IAAIkB;IAEJ,IAAI;QACFA,QAAQ,MAAMzC,WAAW0C,IAAI,CAACJ;IAChC,EAAE,OAAOK,KAAK;QACZ,IAAI,AAACA,IAA0BC,IAAI,KAAK,UAAU;YAChDhC,IAAIiC,OAAO,CAACC,MAAM,CAACC,KAAK,CACtB,CAAC,KAAK,EAAEjC,SAAS,gBAAgB,EAAED,WAAWO,MAAM,CAACE,IAAI,CAAC,wCAAwC,EAAEgB,UAAU;YAGhH,wEAAwE;YACxE,kIAAkI;YAClI,OAAOb,SAASuB,IAAI,CAClB;gBACEC,QAAQ;oBACN;wBACEC,SAAS;oBACX;iBACD;YACH,GACA;gBACErB,SAASnB,gBAAgB;oBACvBmB,SAAS,IAAIC;oBACblB;gBACF;gBACAX,QAAQ;YACV;QAEJ;QAEA,MAAM0C;IACR;IAEA,MAAMQ,iBAAiB,AAAC,MAAMpD,iBAAiBuC,aAAc/B,oBAAoB+B;IACjF,IAAIc,WAAWD,eAAeE,IAAI;IAElC,IAAIf,SAASgB,QAAQ,CAAC,WAAWH,eAAeE,IAAI,KAAK,mBAAmB;QAC1ED,WAAW;IACb;IAEA,6CAA6C;IAC7C,MAAMG,cAAc3C,IAAIiB,OAAO,CAACX,GAAG,CAAC;IACpC,MAAMsC,cAAchD,iBAAiB;QACnCiD,UAAUhB,MAAMiB,IAAI;QACpBH;IACF;IAEA,IAAIC,YAAYG,IAAI,KAAK,WAAW;QAClC,IAAI9B,UAAU,IAAIC;QAClBD,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAEnB,MAAMiB,IAAI,EAAE;QACpD7B,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;YAAEhC;QAAQ,MAAMA,UAC/DA;QAEJ,OAAO,IAAIJ,SAAS,MAAM;YACxBI,SAASnB,gBAAgB;gBACvBmB;gBACAjB;YACF;YACAX,QAAQC,WAAW4D,+BAA+B;QACpD;IACF;IAEA,IAAIjC,UAAU,IAAIC;IAClBD,QAAQ+B,GAAG,CAAC,gBAAgBR;IAC5BvB,QAAQ+B,GAAG,CAAC,iBAAiB;IAE7B,IAAIR,aAAa,iBAAiB;QAChCvB,QAAQ+B,GAAG,CAAC,2BAA2B;IACzC;IAEA,IAAIG;IACJ,IAAI9D;IACJ,MAAM+D,YAAYR,YAAYG,IAAI,KAAK;IACvC,MAAMM,QAAQT,YAAYS,KAAK;IAE/B,IAAID,aAAaC,OAAO;QACtB,MAAMC,gBAAgBD,MAAME,GAAG,GAAGF,MAAMG,KAAK,GAAG;QAChDvC,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAOH;QACrCrC,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAEK,MAAMG,KAAK,CAAC,CAAC,EAAEH,MAAME,GAAG,CAAC,CAAC,EAAE1B,MAAMiB,IAAI,EAAE;QAC9EK,OAAOzD,WAAW;YAAEgC;YAAUgC,SAAS;gBAAEH,KAAKF,MAAME,GAAG;gBAAEC,OAAOH,MAAMG,KAAK;YAAC;QAAE;QAC9EnE,SAASC,WAAWqE,eAAe;IACrC,OAAO;QACL1C,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAO5B,MAAMiB,IAAI;QAC/CK,OAAOzD,WAAW;YAAEgC;QAAS;QAC7BrC,SAASC,WAAWsE,EAAE;IACxB;IAEA3C,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;QAAEhC;IAAQ,MAAMA,UAC/DA;IAEJ,OAAO,IAAIJ,SAASsC,MAAM;QACxBlC,SAASnB,gBAAgB;YACvBmB;YACAjB;QACF;QACAX;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../src/uploads/endpoints/getFile.ts"],"sourcesContent":["import type { Stats } from 'fs'\n\nimport { fileTypeFromFile } from 'file-type'\nimport fsPromises from 'fs/promises'\nimport path from 'path'\n\nimport type { Collection, TypeWithID } from '../../collections/config/types.js'\nimport type { PayloadHandler } from '../../config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { FileHandlerOperation } from '../types.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { NotFound } from '../../errors/NotFound.js'\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { checkFileAccess } from '../checkFileAccess.js'\nimport { streamFile } from '../fetchAPI-stream-file/index.js'\nimport { resolveHistoricalFile } from '../fileVersioning/resolveHistoricalFile.js'\nimport { getFileTypeFallback } from '../getFileTypeFallback.js'\nimport { getFileExtension, isXmlMimeType } from '../getFileTypeIdentity.js'\nimport { parseRangeHeader } from '../parseRangeHeader.js'\nimport { handleDynamicFileRequest } from '../transformers/handleDynamicFileRequest.js'\nimport { resolveUploadDocument } from '../transformers/resolveUploadDocument.js'\nimport { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js'\n\nexport const getFileHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n\n  const filename = req.routeParams?.filename as string\n  const prefix = req.searchParams?.get('prefix') ?? undefined\n\n  if (!collection.config.upload) {\n    throw new APIError(\n      `This collection is not an upload collection: ${collection.config.slug}`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  const versionID = req.searchParams?.get('version')\n\n  if (collection.config.versions && versionID) {\n    const historical = await resolveHistoricalFile({\n      collection,\n      filename,\n      prefix,\n      req,\n      versionID,\n    })\n\n    return retrieveFileResponse({ collection, doc: historical, filename, prefix, req })\n  }\n\n  if (req.payload.config.upload.transformers.length > 0) {\n    return handleDynamicFileRequest({ collection, filename, prefix, req })\n  }\n\n  const accessResult = (await checkFileAccess({\n    collection,\n    filename,\n    prefix,\n    req,\n  }))!\n\n  if (accessResult instanceof Response) {\n    return accessResult\n  }\n\n  const current = collection.config.versions\n    ? (accessResult ?? (await resolveUploadDocument({ collection, filename, prefix, req })))\n    : undefined\n\n  if (collection.config.versions && !current) {\n    throw new NotFound(req.t)\n  }\n\n  return retrieveFileResponse({ collection, doc: accessResult ?? current, filename, prefix, req })\n}\n\n/**\n * Shared by the ordinary `read` endpoint and, via `operation: 'transform'`, by\n * `getSourceFileResponse` for internal source retrieval. `transform` ignores the\n * `Range` header and skips `modifyResponseHeaders`/CORS wrapping, since those are\n * applied once, later, to the transformer pipeline's final response.\n */\nexport async function retrieveFileResponse({\n  collection,\n  doc,\n  filename,\n  operation = 'read',\n  prefix,\n  req,\n}: {\n  collection: Collection\n  doc?: TypeWithID\n  filename: string\n  operation?: FileHandlerOperation\n  prefix?: string\n  req: PayloadRequest\n}): Promise<Response> {\n  if (collection.config.upload && collection.config.upload.handlers?.length) {\n    let customResponse: null | Response | void = null\n    const headers = new Headers()\n\n    for (const handler of collection.config.upload.handlers) {\n      customResponse = await handler(req, {\n        doc: doc!,\n        headers,\n        params: {\n          collection: collection.config.slug,\n          filename,\n          operation,\n          prefix,\n        },\n      })\n      if (customResponse && customResponse instanceof Response) {\n        break\n      }\n    }\n\n    if (customResponse instanceof Response) {\n      return customResponse\n    }\n  }\n\n  // Local filesystem fallback — cloud storage handlers return a Response above\n  // and have their own filename validation via sanitizeFilename.\n  const fileDir = collection.config.upload?.staticDir || collection.config.slug\n  const resolvedDir = path.resolve(fileDir)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!filePath.startsWith(resolvedDir + path.sep)) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  let stats: Stats\n\n  try {\n    stats = await fsPromises.stat(filePath)\n  } catch (err) {\n    if ((err as { code?: string }).code === 'ENOENT') {\n      req.payload.logger.error(\n        `File ${filename} for collection ${collection.config.slug} is missing on the disk. Expected path: ${filePath}`,\n      )\n\n      // Omit going to the routeError handler by returning response instead of\n      // throwing an error to cut down log noise. The response still matches what you get with APIError to not leak details to the user.\n      return Response.json(\n        {\n          errors: [\n            {\n              message: 'Something went wrong.',\n            },\n          ],\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: 500,\n        },\n      )\n    }\n\n    throw err\n  }\n\n  const fileTypeResult = (await fileTypeFromFile(filePath)) || getFileTypeFallback(filePath)\n  let mimeType = fileTypeResult.mime\n\n  if (\n    getFileExtension(filePath).toLowerCase() === 'svg' &&\n    fileTypeResult.mime === 'application/xml'\n  ) {\n    mimeType = 'image/svg+xml'\n  }\n\n  const isTransformSource = operation === 'transform'\n\n  // The client's Range header must never leak into an internal source retrieval —\n  // a transformer needs the complete original bytes to decode.\n  const rangeHeader = isTransformSource ? null : req.headers.get('range')\n  const rangeResult = parseRangeHeader({\n    fileSize: stats.size,\n    rangeHeader,\n  })\n\n  if (rangeResult.type === 'invalid') {\n    let headers = new Headers()\n    headers.set('Content-Range', `bytes */${stats.size}`)\n    headers = collection.config.upload?.modifyResponseHeaders\n      ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n      : headers\n\n    return new Response(null, {\n      headers: headersWithCors({\n        headers,\n        req,\n      }),\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    })\n  }\n\n  let headers = new Headers()\n  headers.set('Content-Type', mimeType)\n  headers.set('Accept-Ranges', 'bytes')\n\n  if (isXmlMimeType(mimeType)) {\n    headers.set('Content-Security-Policy', uploadContentSecurityPolicy)\n  }\n\n  let data: ReadableStream\n  let status: number\n  const isPartial = rangeResult.type === 'partial'\n  const range = rangeResult.range\n\n  if (isPartial && range) {\n    const contentLength = range.end - range.start + 1\n    headers.set('Content-Length', String(contentLength))\n    headers.set('Content-Range', `bytes ${range.start}-${range.end}/${stats.size}`)\n    data = streamFile({ filePath, options: { end: range.end, start: range.start } })\n    status = httpStatus.PARTIAL_CONTENT\n  } else {\n    headers.set('Content-Length', String(stats.size))\n    data = streamFile({ filePath })\n    status = httpStatus.OK\n  }\n\n  if (isTransformSource) {\n    return new Response(data, { headers, status })\n  }\n\n  headers = collection.config.upload?.modifyResponseHeaders\n    ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n    : headers\n\n  return new Response(data, {\n    headers: headersWithCors({\n      headers,\n      req,\n    }),\n    status,\n  })\n}\n"],"names":["fileTypeFromFile","fsPromises","path","APIError","NotFound","getRequestCollection","headersWithCors","httpStatus","checkFileAccess","streamFile","resolveHistoricalFile","getFileTypeFallback","getFileExtension","isXmlMimeType","parseRangeHeader","handleDynamicFileRequest","resolveUploadDocument","uploadContentSecurityPolicy","getFileHandler","req","collection","filename","routeParams","prefix","searchParams","get","undefined","config","upload","slug","BAD_REQUEST","versionID","versions","historical","retrieveFileResponse","doc","payload","transformers","length","accessResult","Response","current","t","operation","handlers","customResponse","headers","Headers","handler","params","fileDir","staticDir","resolvedDir","resolve","filePath","startsWith","sep","stats","stat","err","code","logger","error","json","errors","message","status","fileTypeResult","mimeType","mime","toLowerCase","isTransformSource","rangeHeader","rangeResult","fileSize","size","type","set","modifyResponseHeaders","REQUESTED_RANGE_NOT_SATISFIABLE","data","isPartial","range","contentLength","end","start","String","options","PARTIAL_CONTENT","OK"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,YAAW;AAC5C,OAAOC,gBAAgB,cAAa;AACpC,OAAOC,UAAU,OAAM;AAOvB,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,UAAU,QAAQ,mCAAkC;AAC7D,SAASC,qBAAqB,QAAQ,6CAA4C;AAClF,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,4BAA2B;AAC3E,SAASC,gBAAgB,QAAQ,yBAAwB;AACzD,SAASC,wBAAwB,QAAQ,8CAA6C;AACtF,SAASC,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,2BAA2B,QAAQ,oCAAmC;AAE/E,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaf,qBAAqBc;IAExC,MAAME,WAAWF,IAAIG,WAAW,EAAED;IAClC,MAAME,SAASJ,IAAIK,YAAY,EAAEC,IAAI,aAAaC;IAElD,IAAI,CAACN,WAAWO,MAAM,CAACC,MAAM,EAAE;QAC7B,MAAM,IAAIzB,SACR,CAAC,6CAA6C,EAAEiB,WAAWO,MAAM,CAACE,IAAI,EAAE,EACxEtB,WAAWuB,WAAW;IAE1B;IAEA,MAAMC,YAAYZ,IAAIK,YAAY,EAAEC,IAAI;IAExC,IAAIL,WAAWO,MAAM,CAACK,QAAQ,IAAID,WAAW;QAC3C,MAAME,aAAa,MAAMvB,sBAAsB;YAC7CU;YACAC;YACAE;YACAJ;YACAY;QACF;QAEA,OAAOG,qBAAqB;YAAEd;YAAYe,KAAKF;YAAYZ;YAAUE;YAAQJ;QAAI;IACnF;IAEA,IAAIA,IAAIiB,OAAO,CAACT,MAAM,CAACC,MAAM,CAACS,YAAY,CAACC,MAAM,GAAG,GAAG;QACrD,OAAOvB,yBAAyB;YAAEK;YAAYC;YAAUE;YAAQJ;QAAI;IACtE;IAEA,MAAMoB,eAAgB,MAAM/B,gBAAgB;QAC1CY;QACAC;QACAE;QACAJ;IACF;IAEA,IAAIoB,wBAAwBC,UAAU;QACpC,OAAOD;IACT;IAEA,MAAME,UAAUrB,WAAWO,MAAM,CAACK,QAAQ,GACrCO,gBAAiB,MAAMvB,sBAAsB;QAAEI;QAAYC;QAAUE;QAAQJ;IAAI,KAClFO;IAEJ,IAAIN,WAAWO,MAAM,CAACK,QAAQ,IAAI,CAACS,SAAS;QAC1C,MAAM,IAAIrC,SAASe,IAAIuB,CAAC;IAC1B;IAEA,OAAOR,qBAAqB;QAAEd;QAAYe,KAAKI,gBAAgBE;QAASpB;QAAUE;QAAQJ;IAAI;AAChG,EAAC;AAED;;;;;CAKC,GACD,OAAO,eAAee,qBAAqB,EACzCd,UAAU,EACVe,GAAG,EACHd,QAAQ,EACRsB,YAAY,MAAM,EAClBpB,MAAM,EACNJ,GAAG,EAQJ;IACC,IAAIC,WAAWO,MAAM,CAACC,MAAM,IAAIR,WAAWO,MAAM,CAACC,MAAM,CAACgB,QAAQ,EAAEN,QAAQ;QACzE,IAAIO,iBAAyC;QAC7C,MAAMC,UAAU,IAAIC;QAEpB,KAAK,MAAMC,WAAW5B,WAAWO,MAAM,CAACC,MAAM,CAACgB,QAAQ,CAAE;YACvDC,iBAAiB,MAAMG,QAAQ7B,KAAK;gBAClCgB,KAAKA;gBACLW;gBACAG,QAAQ;oBACN7B,YAAYA,WAAWO,MAAM,CAACE,IAAI;oBAClCR;oBACAsB;oBACApB;gBACF;YACF;YACA,IAAIsB,kBAAkBA,0BAA0BL,UAAU;gBACxD;YACF;QACF;QAEA,IAAIK,0BAA0BL,UAAU;YACtC,OAAOK;QACT;IACF;IAEA,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAMK,UAAU9B,WAAWO,MAAM,CAACC,MAAM,EAAEuB,aAAa/B,WAAWO,MAAM,CAACE,IAAI;IAC7E,MAAMuB,cAAclD,KAAKmD,OAAO,CAACH;IACjC,MAAMI,WAAWpD,KAAKmD,OAAO,CAACD,aAAa/B;IAE3C,IAAI,CAACiC,SAASC,UAAU,CAACH,cAAclD,KAAKsD,GAAG,GAAG;QAChD,MAAM,IAAIrD,SAAS,qBAAqBI,WAAWuB,WAAW;IAChE;IAEA,IAAI2B;IAEJ,IAAI;QACFA,QAAQ,MAAMxD,WAAWyD,IAAI,CAACJ;IAChC,EAAE,OAAOK,KAAK;QACZ,IAAI,AAACA,IAA0BC,IAAI,KAAK,UAAU;YAChDzC,IAAIiB,OAAO,CAACyB,MAAM,CAACC,KAAK,CACtB,CAAC,KAAK,EAAEzC,SAAS,gBAAgB,EAAED,WAAWO,MAAM,CAACE,IAAI,CAAC,wCAAwC,EAAEyB,UAAU;YAGhH,wEAAwE;YACxE,kIAAkI;YAClI,OAAOd,SAASuB,IAAI,CAClB;gBACEC,QAAQ;oBACN;wBACEC,SAAS;oBACX;iBACD;YACH,GACA;gBACEnB,SAASxC,gBAAgB;oBACvBwC,SAAS,IAAIC;oBACb5B;gBACF;gBACA+C,QAAQ;YACV;QAEJ;QAEA,MAAMP;IACR;IAEA,MAAMQ,iBAAiB,AAAC,MAAMnE,iBAAiBsD,aAAc3C,oBAAoB2C;IACjF,IAAIc,WAAWD,eAAeE,IAAI;IAElC,IACEzD,iBAAiB0C,UAAUgB,WAAW,OAAO,SAC7CH,eAAeE,IAAI,KAAK,mBACxB;QACAD,WAAW;IACb;IAEA,MAAMG,oBAAoB5B,cAAc;IAExC,gFAAgF;IAChF,6DAA6D;IAC7D,MAAM6B,cAAcD,oBAAoB,OAAOpD,IAAI2B,OAAO,CAACrB,GAAG,CAAC;IAC/D,MAAMgD,cAAc3D,iBAAiB;QACnC4D,UAAUjB,MAAMkB,IAAI;QACpBH;IACF;IAEA,IAAIC,YAAYG,IAAI,KAAK,WAAW;QAClC,IAAI9B,UAAU,IAAIC;QAClBD,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAEpB,MAAMkB,IAAI,EAAE;QACpD7B,UAAU1B,WAAWO,MAAM,CAACC,MAAM,EAAEkD,wBAChC1D,WAAWO,MAAM,CAACC,MAAM,CAACkD,qBAAqB,CAAC;YAAEhC;QAAQ,MAAMA,UAC/DA;QAEJ,OAAO,IAAIN,SAAS,MAAM;YACxBM,SAASxC,gBAAgB;gBACvBwC;gBACA3B;YACF;YACA+C,QAAQ3D,WAAWwE,+BAA+B;QACpD;IACF;IAEA,IAAIjC,UAAU,IAAIC;IAClBD,QAAQ+B,GAAG,CAAC,gBAAgBT;IAC5BtB,QAAQ+B,GAAG,CAAC,iBAAiB;IAE7B,IAAIhE,cAAcuD,WAAW;QAC3BtB,QAAQ+B,GAAG,CAAC,2BAA2B5D;IACzC;IAEA,IAAI+D;IACJ,IAAId;IACJ,MAAMe,YAAYR,YAAYG,IAAI,KAAK;IACvC,MAAMM,QAAQT,YAAYS,KAAK;IAE/B,IAAID,aAAaC,OAAO;QACtB,MAAMC,gBAAgBD,MAAME,GAAG,GAAGF,MAAMG,KAAK,GAAG;QAChDvC,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAOH;QACrCrC,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAEK,MAAMG,KAAK,CAAC,CAAC,EAAEH,MAAME,GAAG,CAAC,CAAC,EAAE3B,MAAMkB,IAAI,EAAE;QAC9EK,OAAOvE,WAAW;YAAE6C;YAAUiC,SAAS;gBAAEH,KAAKF,MAAME,GAAG;gBAAEC,OAAOH,MAAMG,KAAK;YAAC;QAAE;QAC9EnB,SAAS3D,WAAWiF,eAAe;IACrC,OAAO;QACL1C,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAO7B,MAAMkB,IAAI;QAC/CK,OAAOvE,WAAW;YAAE6C;QAAS;QAC7BY,SAAS3D,WAAWkF,EAAE;IACxB;IAEA,IAAIlB,mBAAmB;QACrB,OAAO,IAAI/B,SAASwC,MAAM;YAAElC;YAASoB;QAAO;IAC9C;IAEApB,UAAU1B,WAAWO,MAAM,CAACC,MAAM,EAAEkD,wBAChC1D,WAAWO,MAAM,CAACC,MAAM,CAACkD,qBAAqB,CAAC;QAAEhC;IAAQ,MAAMA,UAC/DA;IAEJ,OAAO,IAAIN,SAASwC,MAAM;QACxBlC,SAASxC,gBAAgB;YACvBwC;YACA3B;QACF;QACA+C;IACF;AACF"}

package/dist/uploads/endpoints/index.js

@@ -1,9 +1,9 @@
 import { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js';
 import { getFileHandler } from './getFile.js';
-import { getFileFromURLHandler } from './getFileFromURL.js';
+import { pasteURLHandler } from './pasteURL.js';
 export const uploadCollectionEndpoints = wrapInternalEndpoints([
     {
-        handler: getFileFromURLHandler,
+        handler: pasteURLHandler,
         method: 'get',
         path: '/paste-url/:id?'
     },

package/dist/uploads/endpoints/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { getFileHandler } from './getFile.js'\nimport { getFileFromURLHandler } from './getFileFromURL.js'\n\nexport const uploadCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: getFileFromURLHandler,\n    method: 'get',\n    path: '/paste-url/:id?',\n  },\n  {\n    handler: getFileHandler,\n    method: 'get',\n    path: '/file/:filename',\n  },\n])\n"],"names":["wrapInternalEndpoints","getFileHandler","getFileFromURLHandler","uploadCollectionEndpoints","handler","method","path"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,qBAAqB,QAAQ,sBAAqB;AAE3D,OAAO,MAAMC,4BAAwCH,sBAAsB;IACzE;QACEI,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}
+{"version":3,"sources":["../../../src/uploads/endpoints/index.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\n\nimport { wrapInternalEndpoints } from '../../utilities/wrapInternalEndpoints.js'\nimport { getFileHandler } from './getFile.js'\nimport { pasteURLHandler } from './pasteURL.js'\n\nexport const uploadCollectionEndpoints: Endpoint[] = wrapInternalEndpoints([\n  {\n    handler: pasteURLHandler,\n    method: 'get',\n    path: '/paste-url/:id?',\n  },\n  {\n    handler: getFileHandler,\n    method: 'get',\n    path: '/file/:filename',\n  },\n])\n"],"names":["wrapInternalEndpoints","getFileHandler","pasteURLHandler","uploadCollectionEndpoints","handler","method","path"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,cAAc,QAAQ,eAAc;AAC7C,SAASC,eAAe,QAAQ,gBAAe;AAE/C,OAAO,MAAMC,4BAAwCH,sBAAsB;IACzE;QACEI,SAASF;QACTG,QAAQ;QACRC,MAAM;IACR;IACA;QACEF,SAASH;QACTI,QAAQ;QACRC,MAAM;IACR;CACD,EAAC"}

package/dist/uploads/endpoints/pasteURL.d.ts

@@ -0,0 +1,3 @@
+import type { PayloadHandler } from '../../config/types.js';
+export declare const pasteURLHandler: PayloadHandler;
+//# sourceMappingURL=pasteURL.d.ts.map

package/dist/uploads/endpoints/pasteURL.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pasteURL.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/pasteURL.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAgB3D,eAAO,MAAM,eAAe,EAAE,cAmE7B,CAAA"}

package/dist/uploads/endpoints/pasteURL.js

@@ -0,0 +1,80 @@
+import { executeAccess } from '../../auth/executeAccess.js';
+import { APIError } from '../../errors/APIError.js';
+import { Forbidden } from '../../errors/Forbidden.js';
+import { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js';
+import { sanitizeFilename } from '../../utilities/sanitizeFilename.js';
+import { fetchWithRedirects } from '../fetchWithRedirects.js';
+import { validateUploadURL } from '../validateUploadURL.js';
+// If doc id is provided, it means we are updating the doc
+// /:collectionSlug/paste-url/:doc-id?src=:fileUrl
+// If doc id is not provided, it means we are creating a new doc
+// /:collectionSlug/paste-url?src=:fileUrl
+export const pasteURLHandler = async (req)=>{
+    const { id, collection } = getRequestCollectionWithID(req, {
+        optionalID: true
+    });
+    if (!req.user) {
+        throw new Forbidden(req.t);
+    }
+    const config = collection?.config;
+    if (id) {
+        // updating doc
+        const accessResult = await executeAccess({
+            slug: config.slug,
+            req
+        }, config.access.update);
+        if (!accessResult) {
+            throw new Forbidden(req.t);
+        }
+    } else {
+        // creating doc
+        const accessResult = await executeAccess({
+            slug: config.slug,
+            req
+        }, config.access?.create);
+        if (!accessResult) {
+            throw new Forbidden(req.t);
+        }
+    }
+    if (!req.url) {
+        throw new APIError('Request URL is missing.', 400);
+    }
+    const { searchParams } = new URL(req.url);
+    const src = searchParams.get('src');
+    if (!src || typeof src !== 'string') {
+        throw new APIError('A valid URL string is required.', 400);
+    }
+    const url = validateUploadURL({
+        uploadConfig: config.upload,
+        url: src
+    });
+    const { response, url: resolvedURL } = await fetchWithRedirects({
+        allowList: config.upload.pasteURL ? config.upload.pasteURL.allowList : undefined,
+        headers: {
+            'Accept-Encoding': 'identity'
+        },
+        timeout: 30_000,
+        url: url.href
+    });
+    if (!response.ok) {
+        throw new APIError('Failed to fetch the file from the provided URL.', response.status);
+    }
+    const rawFileName = decodeURIComponent(new URL(resolvedURL).pathname.split('/').pop() || '');
+    const safeFileName = sanitizeFilename(rawFileName);
+    const encodedFileName = encodeURIComponent(safeFileName).replace(/['()]/g, (c)=>`%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+    // Strip quotes, backslashes, and control chars from the ASCII fallback
+    const asciiFileName = safeFileName.replace(/["\\\r\n]/g, '_');
+    const headers = {
+        'Content-Disposition': `attachment; filename="${asciiFileName}"; filename*=UTF-8''${encodedFileName}`,
+        'Content-Type': response.headers.get('content-type') || 'application/octet-stream'
+    };
+    const contentLength = response.headers.get('content-length');
+    if (contentLength) {
+        headers['Content-Length'] = contentLength;
+    }
+    return new Response(response.body, {
+        headers
+    });
+};
+
+//# sourceMappingURL=pasteURL.js.map

package/dist/uploads/endpoints/pasteURL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/endpoints/pasteURL.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { APIError } from '../../errors/APIError.js'\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { sanitizeFilename } from '../../utilities/sanitizeFilename.js'\nimport { fetchWithRedirects } from '../fetchWithRedirects.js'\nimport { validateUploadURL } from '../validateUploadURL.js'\n\n// If doc id is provided, it means we are updating the doc\n// /:collectionSlug/paste-url/:doc-id?src=:fileUrl\n\n// If doc id is not provided, it means we are creating a new doc\n// /:collectionSlug/paste-url?src=:fileUrl\n\nexport const pasteURLHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })\n\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const config = collection?.config\n\n  if (id) {\n    // updating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access.update)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  } else {\n    // creating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access?.create)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  if (!req.url) {\n    throw new APIError('Request URL is missing.', 400)\n  }\n\n  const { searchParams } = new URL(req.url)\n  const src = searchParams.get('src')\n\n  if (!src || typeof src !== 'string') {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  const url = validateUploadURL({ uploadConfig: config.upload, url: src })\n\n  const { response, url: resolvedURL } = await fetchWithRedirects({\n    allowList: config.upload.pasteURL ? config.upload.pasteURL.allowList : undefined,\n    headers: { 'Accept-Encoding': 'identity' },\n    timeout: 30_000,\n    url: url.href,\n  })\n\n  if (!response.ok) {\n    throw new APIError('Failed to fetch the file from the provided URL.', response.status)\n  }\n\n  const rawFileName = decodeURIComponent(new URL(resolvedURL).pathname.split('/').pop() || '')\n  const safeFileName = sanitizeFilename(rawFileName)\n  const encodedFileName = encodeURIComponent(safeFileName).replace(\n    /['()]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n  // Strip quotes, backslashes, and control chars from the ASCII fallback\n  const asciiFileName = safeFileName.replace(/[\"\\\\\\r\\n]/g, '_')\n\n  const headers: Record<string, string> = {\n    'Content-Disposition': `attachment; filename=\"${asciiFileName}\"; filename*=UTF-8''${encodedFileName}`,\n    'Content-Type': response.headers.get('content-type') || 'application/octet-stream',\n  }\n\n  const contentLength = response.headers.get('content-length')\n  if (contentLength) {\n    headers['Content-Length'] = contentLength\n  }\n\n  return new Response(response.body, { headers })\n}\n"],"names":["executeAccess","APIError","Forbidden","getRequestCollectionWithID","sanitizeFilename","fetchWithRedirects","validateUploadURL","pasteURLHandler","req","id","collection","optionalID","user","t","config","accessResult","slug","access","update","create","url","searchParams","URL","src","get","uploadConfig","upload","response","resolvedURL","allowList","pasteURL","undefined","headers","timeout","href","ok","status","rawFileName","decodeURIComponent","pathname","split","pop","safeFileName","encodedFileName","encodeURIComponent","replace","c","charCodeAt","toString","toUpperCase","asciiFileName","contentLength","Response","body"],"mappings":"AAEA,SAASA,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,SAAS,QAAQ,4BAA2B;AACrD,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,kBAAkB,QAAQ,2BAA0B;AAC7D,SAASC,iBAAiB,QAAQ,0BAAyB;AAE3D,0DAA0D;AAC1D,kDAAkD;AAElD,gEAAgE;AAChE,0CAA0C;AAE1C,OAAO,MAAMC,kBAAkC,OAAOC;IACpD,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGP,2BAA2BK,KAAK;QAAEG,YAAY;IAAK;IAE9E,IAAI,CAACH,IAAII,IAAI,EAAE;QACb,MAAM,IAAIV,UAAUM,IAAIK,CAAC;IAC3B;IAEA,MAAMC,SAASJ,YAAYI;IAE3B,IAAIL,IAAI;QACN,eAAe;QACf,MAAMM,eAAe,MAAMf,cAAc;YAAEgB,MAAMF,OAAOE,IAAI;YAAER;QAAI,GAAGM,OAAOG,MAAM,CAACC,MAAM;QACzF,IAAI,CAACH,cAAc;YACjB,MAAM,IAAIb,UAAUM,IAAIK,CAAC;QAC3B;IACF,OAAO;QACL,eAAe;QACf,MAAME,eAAe,MAAMf,cAAc;YAAEgB,MAAMF,OAAOE,IAAI;YAAER;QAAI,GAAGM,OAAOG,MAAM,EAAEE;QACpF,IAAI,CAACJ,cAAc;YACjB,MAAM,IAAIb,UAAUM,IAAIK,CAAC;QAC3B;IACF;IAEA,IAAI,CAACL,IAAIY,GAAG,EAAE;QACZ,MAAM,IAAInB,SAAS,2BAA2B;IAChD;IAEA,MAAM,EAAEoB,YAAY,EAAE,GAAG,IAAIC,IAAId,IAAIY,GAAG;IACxC,MAAMG,MAAMF,aAAaG,GAAG,CAAC;IAE7B,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU;QACnC,MAAM,IAAItB,SAAS,mCAAmC;IACxD;IAEA,MAAMmB,MAAMd,kBAAkB;QAAEmB,cAAcX,OAAOY,MAAM;QAAEN,KAAKG;IAAI;IAEtE,MAAM,EAAEI,QAAQ,EAAEP,KAAKQ,WAAW,EAAE,GAAG,MAAMvB,mBAAmB;QAC9DwB,WAAWf,OAAOY,MAAM,CAACI,QAAQ,GAAGhB,OAAOY,MAAM,CAACI,QAAQ,CAACD,SAAS,GAAGE;QACvEC,SAAS;YAAE,mBAAmB;QAAW;QACzCC,SAAS;QACTb,KAAKA,IAAIc,IAAI;IACf;IAEA,IAAI,CAACP,SAASQ,EAAE,EAAE;QAChB,MAAM,IAAIlC,SAAS,mDAAmD0B,SAASS,MAAM;IACvF;IAEA,MAAMC,cAAcC,mBAAmB,IAAIhB,IAAIM,aAAaW,QAAQ,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;IACzF,MAAMC,eAAetC,iBAAiBiC;IACtC,MAAMM,kBAAkBC,mBAAmBF,cAAcG,OAAO,CAC9D,UACA,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAEC,UAAU,CAAC,GAAGC,QAAQ,CAAC,IAAIC,WAAW,IAAI;IAEzD,uEAAuE;IACvE,MAAMC,gBAAgBR,aAAaG,OAAO,CAAC,cAAc;IAEzD,MAAMb,UAAkC;QACtC,uBAAuB,CAAC,sBAAsB,EAAEkB,cAAc,oBAAoB,EAAEP,iBAAiB;QACrG,gBAAgBhB,SAASK,OAAO,CAACR,GAAG,CAAC,mBAAmB;IAC1D;IAEA,MAAM2B,gBAAgBxB,SAASK,OAAO,CAACR,GAAG,CAAC;IAC3C,IAAI2B,eAAe;QACjBnB,OAAO,CAAC,iBAAiB,GAAGmB;IAC9B;IAEA,OAAO,IAAIC,SAASzB,SAAS0B,IAAI,EAAE;QAAErB;IAAQ;AAC/C,EAAC"}

package/dist/uploads/endpoints/uploadInstructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploadInstructions.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/uploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AA8BhF,eAAO,MAAM,qBAAqB,uCAI/B;IACD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,yBAAyB,KAAG,OAAO,CAAC,kBAAkB,CA+CzD,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,QAexC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,EAW3C,CAAA"}
+{"version":3,"file":"uploadInstructions.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/uploadInstructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AA+BhF,eAAO,MAAM,qBAAqB,uCAI/B;IACD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,yBAAyB,KAAG,OAAO,CAAC,kBAAkB,CA0CzD,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,QAwBxC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,EAW3C,CAAA"}

package/dist/uploads/endpoints/uploadInstructions.js

@@ -1,42 +1,41 @@
-import { getAccessResults } from '../../auth/getAccessResults.js';
-import { APIError, Forbidden } from '../../errors/index.js';
-import { checkFileRestrictions } from '../checkFileRestrictions.js';
+import { APIError } from '../../errors/index.js';
+import { assertClientUploadAccess } from '../assertClientUploadAccess.js';
+import { checkFileMetadataRestrictions } from '../checkFileRestrictions.js';
+import { uploadRequiresServerValidation } from '../getFileTypeIdentity.js';
 import { deleteStagedFile, generateStagedUploadInstructions, uploadStagedFile } from '../stagedUpload.js';
 const bytesToMB = (bytes)=>bytes / 1024 / 1024;
 const isUploadInstructionsRequest = (upload)=>typeof upload === 'object' && upload !== null && 'collectionSlug' in upload && typeof upload.collectionSlug === 'string' && (!('docPrefix' in upload) || upload.docPrefix === undefined || typeof upload.docPrefix === 'string') && 'filename' in upload && typeof upload.filename === 'string' && 'filesize' in upload && typeof upload.filesize === 'number' && Number.isSafeInteger(upload.filesize) && upload.filesize >= 0 && 'mimeType' in upload && typeof upload.mimeType === 'string';
 export const getUploadInstructions = async ({ overrideAccess = false, req, ...upload })=>{
     const collection = req.payload.collections[upload.collectionSlug];
-    const uploadInstructions = collection?.config?.upload?.uploadInstructions;
-    if (!collection?.config?.upload) {
+    const uploadConfig = collection?.config?.upload;
+    if (!overrideAccess) {
+        await assertClientUploadAccess({
+            collectionSlug: upload.collectionSlug,
+            req
+        });
+    }
+    if (!uploadConfig) {
         throw new APIError(`Upload collection ${upload.collectionSlug} was not found`, 400);
     }
     const filesizeLimit = req.payload.config.upload.limits?.fileSize;
     if (filesizeLimit && upload.filesize > filesizeLimit) {
         throw new APIError(`Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit).toFixed(2)}MB, got: ${bytesToMB(upload.filesize).toFixed(2)}MB`, 400);
     }
-    await checkFileRestrictions({
-        checkFileContents: false,
+    const uploadInstructions = uploadConfig.uploadInstructions;
+    const requiresServerValidation = uploadRequiresServerValidation({
+        allowRestrictedFileTypes: uploadConfig.allowRestrictedFileTypes,
+        filename: upload.filename,
+        mimeType: upload.mimeType
+    });
+    await checkFileMetadataRestrictions({
         collection: collection.config,
-        file: {
-            name: upload.filename,
-            data: Buffer.alloc(0),
-            mimetype: upload.mimeType,
-            size: upload.filesize
-        },
+        filename: upload.filename,
+        filesize: upload.filesize,
+        mimeType: upload.mimeType,
         req
     });
-    if (!uploadInstructions && !overrideAccess) {
-        // Staged uploads write to Payload before a document is saved. Require a signed-in user who
-        // can create or update documents in this collection.
-        if (!req.user) {
-            throw new Forbidden(req.t);
-        }
-        const collectionPermissions = (await getAccessResults({
-            req
-        })).collections?.[upload.collectionSlug];
-        if (!collectionPermissions?.create && !collectionPermissions?.update) {
-            throw new Forbidden(req.t);
-        }
+    if (uploadInstructions && requiresServerValidation) {
+        throw new APIError('SVG and XML files must be uploaded with the document through Payload.', 400);
     }
     return uploadInstructions ? uploadInstructions.generate({
         ...upload,
@@ -57,7 +56,11 @@ export const uploadInstructionsEndpoint = {
             throw new APIError('Invalid upload instructions request', 400);
         }
         return Response.json(await getUploadInstructions({
-            ...upload,
+            collectionSlug: upload.collectionSlug,
+            docPrefix: upload.docPrefix,
+            filename: upload.filename,
+            filesize: upload.filesize,
+            mimeType: upload.mimeType,
             req
         }));
     },

package/dist/uploads/endpoints/uploadInstructions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/uploadInstructions.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { UploadInstructions, UploadInstructionsRequest } from '../types.js'\n\nimport { getAccessResults } from '../../auth/getAccessResults.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { checkFileRestrictions } from '../checkFileRestrictions.js'\nimport {\n  deleteStagedFile,\n  generateStagedUploadInstructions,\n  uploadStagedFile,\n} from '../stagedUpload.js'\n\nconst bytesToMB = (bytes: number) => bytes / 1024 / 1024\n\nconst isUploadInstructionsRequest = (upload: unknown): upload is UploadInstructionsRequest =>\n  typeof upload === 'object' &&\n  upload !== null &&\n  'collectionSlug' in upload &&\n  typeof upload.collectionSlug === 'string' &&\n  (!('docPrefix' in upload) ||\n    upload.docPrefix === undefined ||\n    typeof upload.docPrefix === 'string') &&\n  'filename' in upload &&\n  typeof upload.filename === 'string' &&\n  'filesize' in upload &&\n  typeof upload.filesize === 'number' &&\n  Number.isSafeInteger(upload.filesize) &&\n  upload.filesize >= 0 &&\n  'mimeType' in upload &&\n  typeof upload.mimeType === 'string'\n\nexport const getUploadInstructions = async ({\n  overrideAccess = false,\n  req,\n  ...upload\n}: {\n  overrideAccess?: boolean\n  req: PayloadRequest\n} & UploadInstructionsRequest): Promise<UploadInstructions> => {\n  const collection = req.payload.collections[upload.collectionSlug]\n  const uploadInstructions = collection?.config?.upload?.uploadInstructions\n\n  if (!collection?.config?.upload) {\n    throw new APIError(`Upload collection ${upload.collectionSlug} was not found`, 400)\n  }\n\n  const filesizeLimit = req.payload.config.upload.limits?.fileSize\n  if (filesizeLimit && upload.filesize > filesizeLimit) {\n    throw new APIError(\n      `Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit).toFixed(2)}MB, got: ${bytesToMB(upload.filesize).toFixed(2)}MB`,\n      400,\n    )\n  }\n\n  await checkFileRestrictions({\n    checkFileContents: false,\n    collection: collection.config,\n    file: {\n      name: upload.filename,\n      data: Buffer.alloc(0),\n      mimetype: upload.mimeType,\n      size: upload.filesize,\n    },\n    req,\n  })\n\n  if (!uploadInstructions && !overrideAccess) {\n    // Staged uploads write to Payload before a document is saved. Require a signed-in user who\n    // can create or update documents in this collection.\n    if (!req.user) {\n      throw new Forbidden(req.t)\n    }\n\n    const collectionPermissions = (await getAccessResults({ req })).collections?.[\n      upload.collectionSlug\n    ]\n\n    if (!collectionPermissions?.create && !collectionPermissions?.update) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  return uploadInstructions\n    ? uploadInstructions.generate({ ...upload, overrideAccess, req })\n    : generateStagedUploadInstructions({ ...upload, req })\n}\n\nexport const uploadInstructionsEndpoint: Endpoint = {\n  handler: async (req) => {\n    if (!req.json) {\n      throw new APIError('Content-Type expected to be application/json', 400)\n    }\n\n    const upload: unknown = await req.json()\n    if (!isUploadInstructionsRequest(upload)) {\n      throw new APIError('Invalid upload instructions request', 400)\n    }\n\n    return Response.json(await getUploadInstructions({ ...upload, req }))\n  },\n  method: 'post',\n  path: '/upload-instructions',\n}\n\n/**\n * Stores or removes temporary files when no adapter-specific upload instructions are available.\n * PUT keeps the file until it is used in a document request.\n * DELETE removes a file the client no longer needs.\n */\nexport const stagedUploadEndpoints: Endpoint[] = [\n  {\n    handler: uploadStagedFile,\n    method: 'put',\n    path: '/upload-instructions/:uploadId',\n  },\n  {\n    handler: deleteStagedFile,\n    method: 'delete',\n    path: '/upload-instructions/:uploadId',\n  },\n]\n"],"names":["getAccessResults","APIError","Forbidden","checkFileRestrictions","deleteStagedFile","generateStagedUploadInstructions","uploadStagedFile","bytesToMB","bytes","isUploadInstructionsRequest","upload","collectionSlug","docPrefix","undefined","filename","filesize","Number","isSafeInteger","mimeType","getUploadInstructions","overrideAccess","req","collection","payload","collections","uploadInstructions","config","filesizeLimit","limits","fileSize","toFixed","checkFileContents","file","name","data","Buffer","alloc","mimetype","size","user","t","collectionPermissions","create","update","generate","uploadInstructionsEndpoint","handler","json","Response","method","path","stagedUploadEndpoints"],"mappings":"AAIA,SAASA,gBAAgB,QAAQ,iCAAgC;AACjE,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,qBAAqB,QAAQ,8BAA6B;AACnE,SACEC,gBAAgB,EAChBC,gCAAgC,EAChCC,gBAAgB,QACX,qBAAoB;AAE3B,MAAMC,YAAY,CAACC,QAAkBA,QAAQ,OAAO;AAEpD,MAAMC,8BAA8B,CAACC,SACnC,OAAOA,WAAW,YAClBA,WAAW,QACX,oBAAoBA,UACpB,OAAOA,OAAOC,cAAc,KAAK,YAChC,CAAA,CAAE,CAAA,eAAeD,MAAK,KACrBA,OAAOE,SAAS,KAAKC,aACrB,OAAOH,OAAOE,SAAS,KAAK,QAAO,KACrC,cAAcF,UACd,OAAOA,OAAOI,QAAQ,KAAK,YAC3B,cAAcJ,UACd,OAAOA,OAAOK,QAAQ,KAAK,YAC3BC,OAAOC,aAAa,CAACP,OAAOK,QAAQ,KACpCL,OAAOK,QAAQ,IAAI,KACnB,cAAcL,UACd,OAAOA,OAAOQ,QAAQ,KAAK;AAE7B,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,iBAAiB,KAAK,EACtBC,GAAG,EACH,GAAGX,QAIwB;IAC3B,MAAMY,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACd,OAAOC,cAAc,CAAC;IACjE,MAAMc,qBAAqBH,YAAYI,QAAQhB,QAAQe;IAEvD,IAAI,CAACH,YAAYI,QAAQhB,QAAQ;QAC/B,MAAM,IAAIT,SAAS,CAAC,kBAAkB,EAAES,OAAOC,cAAc,CAAC,cAAc,CAAC,EAAE;IACjF;IAEA,MAAMgB,gBAAgBN,IAAIE,OAAO,CAACG,MAAM,CAAChB,MAAM,CAACkB,MAAM,EAAEC;IACxD,IAAIF,iBAAiBjB,OAAOK,QAAQ,GAAGY,eAAe;QACpD,MAAM,IAAI1B,SACR,CAAC,iCAAiC,EAAEM,UAAUoB,eAAeG,OAAO,CAAC,GAAG,SAAS,EAAEvB,UAAUG,OAAOK,QAAQ,EAAEe,OAAO,CAAC,GAAG,EAAE,CAAC,EAC5H;IAEJ;IAEA,MAAM3B,sBAAsB;QAC1B4B,mBAAmB;QACnBT,YAAYA,WAAWI,MAAM;QAC7BM,MAAM;YACJC,MAAMvB,OAAOI,QAAQ;YACrBoB,MAAMC,OAAOC,KAAK,CAAC;YACnBC,UAAU3B,OAAOQ,QAAQ;YACzBoB,MAAM5B,OAAOK,QAAQ;QACvB;QACAM;IACF;IAEA,IAAI,CAACI,sBAAsB,CAACL,gBAAgB;QAC1C,2FAA2F;QAC3F,qDAAqD;QACrD,IAAI,CAACC,IAAIkB,IAAI,EAAE;YACb,MAAM,IAAIrC,UAAUmB,IAAImB,CAAC;QAC3B;QAEA,MAAMC,wBAAwB,AAAC,CAAA,MAAMzC,iBAAiB;YAAEqB;QAAI,EAAC,EAAGG,WAAW,EAAE,CAC3Ed,OAAOC,cAAc,CACtB;QAED,IAAI,CAAC8B,uBAAuBC,UAAU,CAACD,uBAAuBE,QAAQ;YACpE,MAAM,IAAIzC,UAAUmB,IAAImB,CAAC;QAC3B;IACF;IAEA,OAAOf,qBACHA,mBAAmBmB,QAAQ,CAAC;QAAE,GAAGlC,MAAM;QAAEU;QAAgBC;IAAI,KAC7DhB,iCAAiC;QAAE,GAAGK,MAAM;QAAEW;IAAI;AACxD,EAAC;AAED,OAAO,MAAMwB,6BAAuC;IAClDC,SAAS,OAAOzB;QACd,IAAI,CAACA,IAAI0B,IAAI,EAAE;YACb,MAAM,IAAI9C,SAAS,gDAAgD;QACrE;QAEA,MAAMS,SAAkB,MAAMW,IAAI0B,IAAI;QACtC,IAAI,CAACtC,4BAA4BC,SAAS;YACxC,MAAM,IAAIT,SAAS,uCAAuC;QAC5D;QAEA,OAAO+C,SAASD,IAAI,CAAC,MAAM5B,sBAAsB;YAAE,GAAGT,MAAM;YAAEW;QAAI;IACpE;IACA4B,QAAQ;IACRC,MAAM;AACR,EAAC;AAED;;;;CAIC,GACD,OAAO,MAAMC,wBAAoC;IAC/C;QACEL,SAASxC;QACT2C,QAAQ;QACRC,MAAM;IACR;IACA;QACEJ,SAAS1C;QACT6C,QAAQ;QACRC,MAAM;IACR;CACD,CAAA"}
+{"version":3,"sources":["../../../src/uploads/endpoints/uploadInstructions.ts"],"sourcesContent":["import type { Endpoint } from '../../config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { UploadInstructions, UploadInstructionsRequest } from '../types.js'\n\nimport { APIError } from '../../errors/index.js'\nimport { assertClientUploadAccess } from '../assertClientUploadAccess.js'\nimport { checkFileMetadataRestrictions } from '../checkFileRestrictions.js'\nimport { uploadRequiresServerValidation } from '../getFileTypeIdentity.js'\nimport {\n  deleteStagedFile,\n  generateStagedUploadInstructions,\n  uploadStagedFile,\n} from '../stagedUpload.js'\n\nconst bytesToMB = (bytes: number) => bytes / 1024 / 1024\n\nconst isUploadInstructionsRequest = (upload: unknown): upload is UploadInstructionsRequest =>\n  typeof upload === 'object' &&\n  upload !== null &&\n  'collectionSlug' in upload &&\n  typeof upload.collectionSlug === 'string' &&\n  (!('docPrefix' in upload) ||\n    upload.docPrefix === undefined ||\n    typeof upload.docPrefix === 'string') &&\n  'filename' in upload &&\n  typeof upload.filename === 'string' &&\n  'filesize' in upload &&\n  typeof upload.filesize === 'number' &&\n  Number.isSafeInteger(upload.filesize) &&\n  upload.filesize >= 0 &&\n  'mimeType' in upload &&\n  typeof upload.mimeType === 'string'\n\nexport const getUploadInstructions = async ({\n  overrideAccess = false,\n  req,\n  ...upload\n}: {\n  overrideAccess?: boolean\n  req: PayloadRequest\n} & UploadInstructionsRequest): Promise<UploadInstructions> => {\n  const collection = req.payload.collections[upload.collectionSlug]\n  const uploadConfig = collection?.config?.upload\n\n  if (!overrideAccess) {\n    await assertClientUploadAccess({ collectionSlug: upload.collectionSlug, req })\n  }\n\n  if (!uploadConfig) {\n    throw new APIError(`Upload collection ${upload.collectionSlug} was not found`, 400)\n  }\n\n  const filesizeLimit = req.payload.config.upload.limits?.fileSize\n  if (filesizeLimit && upload.filesize > filesizeLimit) {\n    throw new APIError(\n      `Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit).toFixed(2)}MB, got: ${bytesToMB(upload.filesize).toFixed(2)}MB`,\n      400,\n    )\n  }\n\n  const uploadInstructions = uploadConfig.uploadInstructions\n  const requiresServerValidation = uploadRequiresServerValidation({\n    allowRestrictedFileTypes: uploadConfig.allowRestrictedFileTypes,\n    filename: upload.filename,\n    mimeType: upload.mimeType,\n  })\n\n  await checkFileMetadataRestrictions({\n    collection: collection.config,\n    filename: upload.filename,\n    filesize: upload.filesize,\n    mimeType: upload.mimeType,\n    req,\n  })\n\n  if (uploadInstructions && requiresServerValidation) {\n    throw new APIError('SVG and XML files must be uploaded with the document through Payload.', 400)\n  }\n\n  return uploadInstructions\n    ? uploadInstructions.generate({ ...upload, overrideAccess, req })\n    : generateStagedUploadInstructions({ ...upload, req })\n}\n\nexport const uploadInstructionsEndpoint: Endpoint = {\n  handler: async (req) => {\n    if (!req.json) {\n      throw new APIError('Content-Type expected to be application/json', 400)\n    }\n\n    const upload: unknown = await req.json()\n    if (!isUploadInstructionsRequest(upload)) {\n      throw new APIError('Invalid upload instructions request', 400)\n    }\n\n    return Response.json(\n      await getUploadInstructions({\n        collectionSlug: upload.collectionSlug,\n        docPrefix: upload.docPrefix,\n        filename: upload.filename,\n        filesize: upload.filesize,\n        mimeType: upload.mimeType,\n        req,\n      }),\n    )\n  },\n  method: 'post',\n  path: '/upload-instructions',\n}\n\n/**\n * Stores or removes temporary files when no adapter-specific upload instructions are available.\n * PUT keeps the file until it is used in a document request.\n * DELETE removes a file the client no longer needs.\n */\nexport const stagedUploadEndpoints: Endpoint[] = [\n  {\n    handler: uploadStagedFile,\n    method: 'put',\n    path: '/upload-instructions/:uploadId',\n  },\n  {\n    handler: deleteStagedFile,\n    method: 'delete',\n    path: '/upload-instructions/:uploadId',\n  },\n]\n"],"names":["APIError","assertClientUploadAccess","checkFileMetadataRestrictions","uploadRequiresServerValidation","deleteStagedFile","generateStagedUploadInstructions","uploadStagedFile","bytesToMB","bytes","isUploadInstructionsRequest","upload","collectionSlug","docPrefix","undefined","filename","filesize","Number","isSafeInteger","mimeType","getUploadInstructions","overrideAccess","req","collection","payload","collections","uploadConfig","config","filesizeLimit","limits","fileSize","toFixed","uploadInstructions","requiresServerValidation","allowRestrictedFileTypes","generate","uploadInstructionsEndpoint","handler","json","Response","method","path","stagedUploadEndpoints"],"mappings":"AAIA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,wBAAwB,QAAQ,iCAAgC;AACzE,SAASC,6BAA6B,QAAQ,8BAA6B;AAC3E,SAASC,8BAA8B,QAAQ,4BAA2B;AAC1E,SACEC,gBAAgB,EAChBC,gCAAgC,EAChCC,gBAAgB,QACX,qBAAoB;AAE3B,MAAMC,YAAY,CAACC,QAAkBA,QAAQ,OAAO;AAEpD,MAAMC,8BAA8B,CAACC,SACnC,OAAOA,WAAW,YAClBA,WAAW,QACX,oBAAoBA,UACpB,OAAOA,OAAOC,cAAc,KAAK,YAChC,CAAA,CAAE,CAAA,eAAeD,MAAK,KACrBA,OAAOE,SAAS,KAAKC,aACrB,OAAOH,OAAOE,SAAS,KAAK,QAAO,KACrC,cAAcF,UACd,OAAOA,OAAOI,QAAQ,KAAK,YAC3B,cAAcJ,UACd,OAAOA,OAAOK,QAAQ,KAAK,YAC3BC,OAAOC,aAAa,CAACP,OAAOK,QAAQ,KACpCL,OAAOK,QAAQ,IAAI,KACnB,cAAcL,UACd,OAAOA,OAAOQ,QAAQ,KAAK;AAE7B,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,iBAAiB,KAAK,EACtBC,GAAG,EACH,GAAGX,QAIwB;IAC3B,MAAMY,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACd,OAAOC,cAAc,CAAC;IACjE,MAAMc,eAAeH,YAAYI,QAAQhB;IAEzC,IAAI,CAACU,gBAAgB;QACnB,MAAMnB,yBAAyB;YAAEU,gBAAgBD,OAAOC,cAAc;YAAEU;QAAI;IAC9E;IAEA,IAAI,CAACI,cAAc;QACjB,MAAM,IAAIzB,SAAS,CAAC,kBAAkB,EAAEU,OAAOC,cAAc,CAAC,cAAc,CAAC,EAAE;IACjF;IAEA,MAAMgB,gBAAgBN,IAAIE,OAAO,CAACG,MAAM,CAAChB,MAAM,CAACkB,MAAM,EAAEC;IACxD,IAAIF,iBAAiBjB,OAAOK,QAAQ,GAAGY,eAAe;QACpD,MAAM,IAAI3B,SACR,CAAC,iCAAiC,EAAEO,UAAUoB,eAAeG,OAAO,CAAC,GAAG,SAAS,EAAEvB,UAAUG,OAAOK,QAAQ,EAAEe,OAAO,CAAC,GAAG,EAAE,CAAC,EAC5H;IAEJ;IAEA,MAAMC,qBAAqBN,aAAaM,kBAAkB;IAC1D,MAAMC,2BAA2B7B,+BAA+B;QAC9D8B,0BAA0BR,aAAaQ,wBAAwB;QAC/DnB,UAAUJ,OAAOI,QAAQ;QACzBI,UAAUR,OAAOQ,QAAQ;IAC3B;IAEA,MAAMhB,8BAA8B;QAClCoB,YAAYA,WAAWI,MAAM;QAC7BZ,UAAUJ,OAAOI,QAAQ;QACzBC,UAAUL,OAAOK,QAAQ;QACzBG,UAAUR,OAAOQ,QAAQ;QACzBG;IACF;IAEA,IAAIU,sBAAsBC,0BAA0B;QAClD,MAAM,IAAIhC,SAAS,yEAAyE;IAC9F;IAEA,OAAO+B,qBACHA,mBAAmBG,QAAQ,CAAC;QAAE,GAAGxB,MAAM;QAAEU;QAAgBC;IAAI,KAC7DhB,iCAAiC;QAAE,GAAGK,MAAM;QAAEW;IAAI;AACxD,EAAC;AAED,OAAO,MAAMc,6BAAuC;IAClDC,SAAS,OAAOf;QACd,IAAI,CAACA,IAAIgB,IAAI,EAAE;YACb,MAAM,IAAIrC,SAAS,gDAAgD;QACrE;QAEA,MAAMU,SAAkB,MAAMW,IAAIgB,IAAI;QACtC,IAAI,CAAC5B,4BAA4BC,SAAS;YACxC,MAAM,IAAIV,SAAS,uCAAuC;QAC5D;QAEA,OAAOsC,SAASD,IAAI,CAClB,MAAMlB,sBAAsB;YAC1BR,gBAAgBD,OAAOC,cAAc;YACrCC,WAAWF,OAAOE,SAAS;YAC3BE,UAAUJ,OAAOI,QAAQ;YACzBC,UAAUL,OAAOK,QAAQ;YACzBG,UAAUR,OAAOQ,QAAQ;YACzBG;QACF;IAEJ;IACAkB,QAAQ;IACRC,MAAM;AACR,EAAC;AAED;;;;CAIC,GACD,OAAO,MAAMC,wBAAoC;IAC/C;QACEL,SAAS9B;QACTiC,QAAQ;QACRC,MAAM;IACR;IACA;QACEJ,SAAShC;QACTmC,QAAQ;QACRC,MAAM;IACR;CACD,CAAA"}

package/dist/uploads/fetchAPI-multipart/handlers.d.ts

@@ -1,8 +1,8 @@
 import type { FetchAPIFileUploadOptions } from '../../config/types.js';
 type Handler = (options: FetchAPIFileUploadOptions, fieldname: string, filename: string) => {
-    cleanup: () => void;
+    cleanup: () => Promise<void> | void;
     complete: () => Buffer;
-    dataHandler: (data: Buffer) => void;
+    dataHandler: (data: Buffer) => Promise<void> | void;
     getFilePath: () => string;
     getFileSize: () => number;
     getHash: () => string;

package/dist/uploads/fetchAPI-multipart/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAItE,KAAK,OAAO,GAAG,CACb,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,KACb;IACH,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,QAAQ,EAAE,MAAM,MAAM,CAAA;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,OAAO,EAAE,MAAM,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,OAuD7B,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,OAgCxB,CAAA"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAItE,KAAK,OAAO,GAAG,CACb,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,KACb;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACnC,QAAQ,EAAE,MAAM,MAAM,CAAA;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACnD,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,OAAO,EAAE,MAAM,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,OA6D7B,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,OAmCxB,CAAA"}

package/dist/uploads/fetchAPI-multipart/handlers.js

@@ -15,6 +15,7 @@ export const tempFileHandler = (options, fieldname, filename)=>{
     const writeStream = fs.createWriteStream(tempFilePath);
     const writePromise = new Promise((resolve, reject)=>{
         writeStream.on('finish', ()=>resolve(true));
+        writeStream.on('close', ()=>resolve(false));
         writeStream.on('error', (err)=>{
             debugLog(options, `Error write temp file: ${err}`);
             reject(err);
@@ -23,9 +24,15 @@ export const tempFileHandler = (options, fieldname, filename)=>{
     return {
         cleanup: ()=>{
             completed = true;
-            debugLog(options, `Cleaning up temporary file ${tempFilePath}...`);
-            writeStream.end();
-            deleteFile(tempFilePath, (err)=>err ? debugLog(options, `Cleaning up temporary file ${tempFilePath} failed: ${err}`) : debugLog(options, `Cleaning up temporary file ${tempFilePath} done.`));
+            return new Promise((resolve)=>{
+                const remove = ()=>deleteFile(tempFilePath, ()=>resolve());
+                if (writeStream.closed) {
+                    remove();
+                } else {
+                    writeStream.once('close', remove);
+                    writeStream.destroy();
+                }
+            });
         },
         complete: ()=>{
             completed = true;
@@ -41,10 +48,13 @@ export const tempFileHandler = (options, fieldname, filename)=>{
                 debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`);
                 return;
             }
-            writeStream.write(data);
+            const ready = writeStream.write(data);
             hash.update(data);
             fileSize += data.length;
             debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`);
+            if (!ready) {
+                return new Promise((resolve)=>writeStream.once('drain', resolve));
+            }
         },
         getFilePath: ()=>tempFilePath,
         getFileSize: ()=>fileSize,
@@ -61,11 +71,14 @@ export const memHandler = (options, fieldname, filename)=>{
     return {
         cleanup: ()=>{
             completed = true;
+            buffers.length = 0;
         },
         complete: ()=>{
             debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`);
             completed = true;
-            return getBuffer();
+            const buffer = getBuffer();
+            buffers.length = 0;
+            return buffer;
         },
         dataHandler: (data)=>{
             if (completed === true) {

package/dist/uploads/fetchAPI-multipart/handlers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"sourcesContent":["import crypto from 'crypto'\nimport fs, { WriteStream } from 'fs'\nimport path from 'path'\n\nimport type { FetchAPIFileUploadOptions } from '../../config/types.js'\n\nimport { checkAndMakeDir, debugLog, deleteFile, getTempFilename } from './utilities.js'\n\ntype Handler = (\n  options: FetchAPIFileUploadOptions,\n  fieldname: string,\n  filename: string,\n) => {\n  cleanup: () => void\n  complete: () => Buffer\n  dataHandler: (data: Buffer) => void\n  getFilePath: () => string\n  getFileSize: () => number\n  getHash: () => string\n  getWritePromise: () => Promise<boolean>\n}\n\nexport const tempFileHandler: Handler = (options, fieldname, filename) => {\n  const tempFilePath = path.resolve(options.tempFileDir!, getTempFilename())\n  checkAndMakeDir({ createParentPath: true }, tempFilePath)\n\n  debugLog(options, `Temporary file path is ${tempFilePath}`)\n\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  debugLog(options, `Opening write stream for ${fieldname}->${filename}...`)\n  const writeStream = fs.createWriteStream(tempFilePath)\n  const writePromise = new Promise<boolean>((resolve, reject) => {\n    writeStream.on('finish', () => resolve(true))\n    writeStream.on('error', (err) => {\n      debugLog(options, `Error write temp file: ${err}`)\n      reject(err)\n    })\n  })\n\n  return {\n    cleanup: () => {\n      completed = true\n      debugLog(options, `Cleaning up temporary file ${tempFilePath}...`)\n      writeStream.end()\n      deleteFile(tempFilePath, (err) =>\n        err\n          ? debugLog(options, `Cleaning up temporary file ${tempFilePath} failed: ${err}`)\n          : debugLog(options, `Cleaning up temporary file ${tempFilePath} done.`),\n      )\n    },\n    complete: () => {\n      completed = true\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      if (writeStream instanceof WriteStream) {\n        writeStream.end()\n      }\n      // Return empty buff since data was uploaded into a temp file.\n      return Buffer.concat([])\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      writeStream.write(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n    },\n    getFilePath: () => tempFilePath,\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => writePromise,\n  }\n}\n\nexport const memHandler: Handler = (options, fieldname, filename) => {\n  const buffers: Buffer[] = []\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  const getBuffer = () => Buffer.concat(buffers, fileSize)\n\n  return {\n    cleanup: () => {\n      completed = true\n    },\n    complete: () => {\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      completed = true\n      return getBuffer()\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      buffers.push(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n    },\n    getFilePath: () => '',\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => Promise.resolve(true),\n  }\n}\n"],"names":["crypto","fs","WriteStream","path","checkAndMakeDir","debugLog","deleteFile","getTempFilename","tempFileHandler","options","fieldname","filename","tempFilePath","resolve","tempFileDir","createParentPath","hash","createHash","fileSize","completed","writeStream","createWriteStream","writePromise","Promise","reject","on","err","cleanup","end","complete","Buffer","concat","dataHandler","data","write","update","length","getFilePath","getFileSize","getHash","digest","getWritePromise","memHandler","buffers","getBuffer","push"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,OAAOC,MAAMC,WAAW,QAAQ,KAAI;AACpC,OAAOC,UAAU,OAAM;AAIvB,SAASC,eAAe,EAAEC,QAAQ,EAAEC,UAAU,EAAEC,eAAe,QAAQ,iBAAgB;AAgBvF,OAAO,MAAMC,kBAA2B,CAACC,SAASC,WAAWC;IAC3D,MAAMC,eAAeT,KAAKU,OAAO,CAACJ,QAAQK,WAAW,EAAGP;IACxDH,gBAAgB;QAAEW,kBAAkB;IAAK,GAAGH;IAE5CP,SAASI,SAAS,CAAC,uBAAuB,EAAEG,cAAc;IAE1D,MAAMI,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhBd,SAASI,SAAS,CAAC,yBAAyB,EAAEC,UAAU,EAAE,EAAEC,SAAS,GAAG,CAAC;IACzE,MAAMS,cAAcnB,GAAGoB,iBAAiB,CAACT;IACzC,MAAMU,eAAe,IAAIC,QAAiB,CAACV,SAASW;QAClDJ,YAAYK,EAAE,CAAC,UAAU,IAAMZ,QAAQ;QACvCO,YAAYK,EAAE,CAAC,SAAS,CAACC;YACvBrB,SAASI,SAAS,CAAC,uBAAuB,EAAEiB,KAAK;YACjDF,OAAOE;QACT;IACF;IAEA,OAAO;QACLC,SAAS;YACPR,YAAY;YACZd,SAASI,SAAS,CAAC,2BAA2B,EAAEG,aAAa,GAAG,CAAC;YACjEQ,YAAYQ,GAAG;YACftB,WAAWM,cAAc,CAACc,MACxBA,MACIrB,SAASI,SAAS,CAAC,2BAA2B,EAAEG,aAAa,SAAS,EAAEc,KAAK,IAC7ErB,SAASI,SAAS,CAAC,2BAA2B,EAAEG,aAAa,MAAM,CAAC;QAE5E;QACAiB,UAAU;YACRV,YAAY;YACZd,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClF,IAAIE,uBAAuBlB,aAAa;gBACtCkB,YAAYQ,GAAG;YACjB;YACA,8DAA8D;YAC9D,OAAOE,OAAOC,MAAM,CAAC,EAAE;QACzB;QACAC,aAAa,CAACC;YACZ,IAAId,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACAS,YAAYc,KAAK,CAACD;YAClBjB,KAAKmB,MAAM,CAACF;YACZf,YAAYe,KAAKG,MAAM;YACvB/B,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;QAC/E;QACAmB,aAAa,IAAMzB;QACnB0B,aAAa,IAAMpB;QACnBqB,SAAS,IAAMvB,KAAKwB,MAAM,CAAC;QAC3BC,iBAAiB,IAAMnB;IACzB;AACF,EAAC;AAED,OAAO,MAAMoB,aAAsB,CAACjC,SAASC,WAAWC;IACtD,MAAMgC,UAAoB,EAAE;IAC5B,MAAM3B,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhB,MAAMyB,YAAY,IAAMd,OAAOC,MAAM,CAACY,SAASzB;IAE/C,OAAO;QACLS,SAAS;YACPR,YAAY;QACd;QACAU,UAAU;YACRxB,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClFC,YAAY;YACZ,OAAOyB;QACT;QACAZ,aAAa,CAACC;YACZ,IAAId,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACAgC,QAAQE,IAAI,CAACZ;YACbjB,KAAKmB,MAAM,CAACF;YACZf,YAAYe,KAAKG,MAAM;YACvB/B,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;QAC/E;QACAmB,aAAa,IAAM;QACnBC,aAAa,IAAMpB;QACnBqB,SAAS,IAAMvB,KAAKwB,MAAM,CAAC;QAC3BC,iBAAiB,IAAMlB,QAAQV,OAAO,CAAC;IACzC;AACF,EAAC"}
+{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"sourcesContent":["import crypto from 'crypto'\nimport fs, { WriteStream } from 'fs'\nimport path from 'path'\n\nimport type { FetchAPIFileUploadOptions } from '../../config/types.js'\n\nimport { checkAndMakeDir, debugLog, deleteFile, getTempFilename } from './utilities.js'\n\ntype Handler = (\n  options: FetchAPIFileUploadOptions,\n  fieldname: string,\n  filename: string,\n) => {\n  cleanup: () => Promise<void> | void\n  complete: () => Buffer\n  dataHandler: (data: Buffer) => Promise<void> | void\n  getFilePath: () => string\n  getFileSize: () => number\n  getHash: () => string\n  getWritePromise: () => Promise<boolean>\n}\n\nexport const tempFileHandler: Handler = (options, fieldname, filename) => {\n  const tempFilePath = path.resolve(options.tempFileDir!, getTempFilename())\n  checkAndMakeDir({ createParentPath: true }, tempFilePath)\n\n  debugLog(options, `Temporary file path is ${tempFilePath}`)\n\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  debugLog(options, `Opening write stream for ${fieldname}->${filename}...`)\n  const writeStream = fs.createWriteStream(tempFilePath)\n  const writePromise = new Promise<boolean>((resolve, reject) => {\n    writeStream.on('finish', () => resolve(true))\n    writeStream.on('close', () => resolve(false))\n    writeStream.on('error', (err) => {\n      debugLog(options, `Error write temp file: ${err}`)\n      reject(err)\n    })\n  })\n\n  return {\n    cleanup: () => {\n      completed = true\n      return new Promise<void>((resolve) => {\n        const remove = () => deleteFile(tempFilePath, () => resolve())\n        if (writeStream.closed) {\n          remove()\n        } else {\n          writeStream.once('close', remove)\n          writeStream.destroy()\n        }\n      })\n    },\n    complete: () => {\n      completed = true\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      if (writeStream instanceof WriteStream) {\n        writeStream.end()\n      }\n      // Return empty buff since data was uploaded into a temp file.\n      return Buffer.concat([])\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      const ready = writeStream.write(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n      if (!ready) {\n        return new Promise<void>((resolve) => writeStream.once('drain', resolve))\n      }\n    },\n    getFilePath: () => tempFilePath,\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => writePromise,\n  }\n}\n\nexport const memHandler: Handler = (options, fieldname, filename) => {\n  const buffers: Buffer[] = []\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  const getBuffer = () => Buffer.concat(buffers, fileSize)\n\n  return {\n    cleanup: () => {\n      completed = true\n      buffers.length = 0\n    },\n    complete: () => {\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      completed = true\n      const buffer = getBuffer()\n      buffers.length = 0\n      return buffer\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      buffers.push(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n    },\n    getFilePath: () => '',\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => Promise.resolve(true),\n  }\n}\n"],"names":["crypto","fs","WriteStream","path","checkAndMakeDir","debugLog","deleteFile","getTempFilename","tempFileHandler","options","fieldname","filename","tempFilePath","resolve","tempFileDir","createParentPath","hash","createHash","fileSize","completed","writeStream","createWriteStream","writePromise","Promise","reject","on","err","cleanup","remove","closed","once","destroy","complete","end","Buffer","concat","dataHandler","data","ready","write","update","length","getFilePath","getFileSize","getHash","digest","getWritePromise","memHandler","buffers","getBuffer","buffer","push"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,OAAOC,MAAMC,WAAW,QAAQ,KAAI;AACpC,OAAOC,UAAU,OAAM;AAIvB,SAASC,eAAe,EAAEC,QAAQ,EAAEC,UAAU,EAAEC,eAAe,QAAQ,iBAAgB;AAgBvF,OAAO,MAAMC,kBAA2B,CAACC,SAASC,WAAWC;IAC3D,MAAMC,eAAeT,KAAKU,OAAO,CAACJ,QAAQK,WAAW,EAAGP;IACxDH,gBAAgB;QAAEW,kBAAkB;IAAK,GAAGH;IAE5CP,SAASI,SAAS,CAAC,uBAAuB,EAAEG,cAAc;IAE1D,MAAMI,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhBd,SAASI,SAAS,CAAC,yBAAyB,EAAEC,UAAU,EAAE,EAAEC,SAAS,GAAG,CAAC;IACzE,MAAMS,cAAcnB,GAAGoB,iBAAiB,CAACT;IACzC,MAAMU,eAAe,IAAIC,QAAiB,CAACV,SAASW;QAClDJ,YAAYK,EAAE,CAAC,UAAU,IAAMZ,QAAQ;QACvCO,YAAYK,EAAE,CAAC,SAAS,IAAMZ,QAAQ;QACtCO,YAAYK,EAAE,CAAC,SAAS,CAACC;YACvBrB,SAASI,SAAS,CAAC,uBAAuB,EAAEiB,KAAK;YACjDF,OAAOE;QACT;IACF;IAEA,OAAO;QACLC,SAAS;YACPR,YAAY;YACZ,OAAO,IAAII,QAAc,CAACV;gBACxB,MAAMe,SAAS,IAAMtB,WAAWM,cAAc,IAAMC;gBACpD,IAAIO,YAAYS,MAAM,EAAE;oBACtBD;gBACF,OAAO;oBACLR,YAAYU,IAAI,CAAC,SAASF;oBAC1BR,YAAYW,OAAO;gBACrB;YACF;QACF;QACAC,UAAU;YACRb,YAAY;YACZd,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClF,IAAIE,uBAAuBlB,aAAa;gBACtCkB,YAAYa,GAAG;YACjB;YACA,8DAA8D;YAC9D,OAAOC,OAAOC,MAAM,CAAC,EAAE;QACzB;QACAC,aAAa,CAACC;YACZ,IAAIlB,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACA,MAAM2B,QAAQlB,YAAYmB,KAAK,CAACF;YAChCrB,KAAKwB,MAAM,CAACH;YACZnB,YAAYmB,KAAKI,MAAM;YACvBpC,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;YAC7E,IAAI,CAACoB,OAAO;gBACV,OAAO,IAAIf,QAAc,CAACV,UAAYO,YAAYU,IAAI,CAAC,SAASjB;YAClE;QACF;QACA6B,aAAa,IAAM9B;QACnB+B,aAAa,IAAMzB;QACnB0B,SAAS,IAAM5B,KAAK6B,MAAM,CAAC;QAC3BC,iBAAiB,IAAMxB;IACzB;AACF,EAAC;AAED,OAAO,MAAMyB,aAAsB,CAACtC,SAASC,WAAWC;IACtD,MAAMqC,UAAoB,EAAE;IAC5B,MAAMhC,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhB,MAAM8B,YAAY,IAAMf,OAAOC,MAAM,CAACa,SAAS9B;IAE/C,OAAO;QACLS,SAAS;YACPR,YAAY;YACZ6B,QAAQP,MAAM,GAAG;QACnB;QACAT,UAAU;YACR3B,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClFC,YAAY;YACZ,MAAM+B,SAASD;YACfD,QAAQP,MAAM,GAAG;YACjB,OAAOS;QACT;QACAd,aAAa,CAACC;YACZ,IAAIlB,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACAqC,QAAQG,IAAI,CAACd;YACbrB,KAAKwB,MAAM,CAACH;YACZnB,YAAYmB,KAAKI,MAAM;YACvBpC,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;QAC/E;QACAwB,aAAa,IAAM;QACnBC,aAAa,IAAMzB;QACnB0B,SAAS,IAAM5B,KAAK6B,MAAM,CAAC;QAC3BC,iBAAiB,IAAMvB,QAAQV,OAAO,CAAC;IACzC;AACF,EAAC"}

package/dist/uploads/fetchAPI-multipart/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAqBnD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;CACnB,CAAA;AAED,KAAK,8BAA8B,GAAG;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAA;CACtD,CAAA;AAED,KAAK,kBAAkB,GAAG,CAAC,IAAI,EAAE;IAC/B,OAAO,CAAC,EAAE,yBAAyB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;AAEzC,eAAO,MAAM,wBAAwB,EAAE,kBAiBtC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAyBnD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;CACnB,CAAA;AAED,KAAK,8BAA8B,GAAG;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAA;CACtD,CAAA;AAED,KAAK,kBAAkB,GAAG,CAAC,IAAI,EAAE;IAC/B,OAAO,CAAC,EAAE,yBAAyB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;AAEzC,eAAO,MAAM,wBAAwB,EAAE,kBA2CtC,CAAA"}