npm - payload - Versions diffs - 4.0.0-internal.ea6e8f8 → 4.0.0-internal.ee5d8bd - Mend

payload 4.0.0-internal.ea6e8f8 → 4.0.0-internal.ee5d8bd

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (703) hide show

package/dist/auth/operations/login.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/auth/operations/login.ts"],"sourcesContent":["import type {\n AuthOperationsFromCollectionSlug,\n Collection,\n DataFromCollectionSlug,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, AuthenticatedUser, User } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\nimport type { AuthRuntimeFields } from '../types.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport {\n AuthenticationError,\n LockedAuth,\n UnverifiedEmail,\n ValidationError,\n} from '../../errors/index.js'\nimport { commitTransaction, Forbidden, initTransaction } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { isUserLocked } from '../isUserLocked.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\nimport { incrementLoginAttempts } from '../strategies/local/incrementLoginAttempts.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type LoginResult<TSlug extends AuthCollectionSlug> = {\n exp?: number\n token?: string\n user?: AuthRuntimeFields & DataFromCollectionSlug<TSlug>\n}\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n collection: Collection\n data: AuthOperationsFromCollectionSlug<TSlug>['login']\n depth?: number\n overrideAccess?: boolean\n req: PayloadRequest\n showHiddenFields?: boolean\n}\n\ntype CheckLoginPermissionArgs<TSlug extends AuthCollectionSlug> = {\n loggingInWithUsername?: boolean\n req: PayloadRequest\n user: DataFromCollectionSlug<TSlug>\n}\n\n/*\n Throws an error if the user is locked or does not exist.\n * This does not check the login attempts, only the lock status. Whoever increments login attempts\n * is responsible for locking the user properly, not whoever checks the login permission.\n /\nexport const checkLoginPermission = <TSlug extends AuthCollectionSlug>({\n loggingInWithUsername,\n req,\n user,\n}: CheckLoginPermissionArgs<TSlug>) => {\n if (!user) {\n throw new AuthenticationError(req.t, Boolean(loggingInWithUsername))\n }\n\n if (isUserLocked(new Date(user.lockUntil))) {\n throw new LockedAuth(req.t)\n }\n}\n\nexport const loginOperation = async <TSlug extends AuthCollectionSlug>(\n incomingArgs: Arguments<TSlug>,\n): Promise<LoginResult<TSlug>> => {\n let args = incomingArgs\n\n assertNoValidationWrite(args.req)\n\n if (args.collection.config.auth.disableLocalStrategy) {\n throw new Forbidden(args.req.t)\n }\n\n // /////////////////////////////////////\n // beforeOperation - Collection\n // /////////////////////////////////////\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'login',\n overrideAccess: args.overrideAccess!,\n })\n\n const {\n collection: { config: collectionConfig },\n data,\n depth,\n overrideAccess = false,\n req,\n req: {\n payload,\n payload: { secret },\n },\n showHiddenFields,\n } = args\n\n // /////////////////////////////////////\n // Login\n // /////////////////////////////////////\n\n const { email: unsanitizedEmail, password } = data\n const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n const sanitizedEmail =\n typeof unsanitizedEmail === 'string' ? unsanitizedEmail.toLowerCase().trim() : null\n const sanitizedUsername =\n 'username' in data && typeof data?.username === 'string'\n ? data.username.toLowerCase().trim()\n : null\n\n const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n // cannot login with email, did not provide username\n if (!canLoginWithEmail && !sanitizedUsername) {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [{ message: req.i18n.t('validation:required'), path: 'username' }],\n })\n }\n\n // cannot login with username, did not provide email\n if (!canLoginWithUsername && !sanitizedEmail) {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [{ message: req.i18n.t('validation:required'), path: 'email' }],\n })\n }\n\n // can login with either email or username, did not provide either\n if (!sanitizedUsername && !sanitizedEmail) {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [\n { message: req.i18n.t('validation:required'), path: 'email' },\n { message: req.i18n.t('validation:required'), path: 'username' },\n ],\n })\n }\n\n // did not provide password for login\n if (typeof password !== 'string' \|\| password.trim() === '') {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [{ message: req.i18n.t('validation:required'), path: 'password' }],\n })\n }\n\n let whereConstraint: Where = {}\n const emailConstraint: Where = {\n email: {\n equals: sanitizedEmail,\n },\n }\n const usernameConstraint: Where = {\n username: {\n equals: sanitizedUsername,\n },\n }\n\n if (canLoginWithEmail && canLoginWithUsername && (sanitizedUsername \|\| sanitizedEmail)) {\n if (sanitizedUsername) {\n whereConstraint = {\n or: [\n usernameConstraint,\n {\n email: {\n equals: sanitizedUsername,\n },\n },\n ],\n }\n } else {\n whereConstraint = {\n or: [\n emailConstraint,\n {\n username: {\n equals: sanitizedEmail,\n },\n },\n ],\n }\n }\n } else if (canLoginWithEmail && sanitizedEmail) {\n whereConstraint = emailConstraint\n } else if (canLoginWithUsername && sanitizedUsername) {\n whereConstraint = usernameConstraint\n }\n\n // Exclude trashed users\n whereConstraint = appendNonTrashedFilter({\n enableTrash: collectionConfig.trash,\n trash: false,\n where: whereConstraint,\n })\n\n let user = (await payload.db.findOne<User>({\n collection: collectionConfig.slug,\n req,\n where: whereConstraint,\n })) as AuthenticatedUser\n\n checkLoginPermission({\n loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n req,\n user,\n })\n\n user.collection = collectionConfig.slug\n user._strategy = 'local-jwt'\n\n const authenticatedHash = user.hash\n const authenticatedSalt = user.salt\n const authResult = await authenticateLocalStrategy({ doc: user, password })\n user = sanitizeInternalFields(user)\n\n const maxLoginAttemptsEnabled = args.collection.config.auth.maxLoginAttempts > 0\n\n if (!authResult) {\n if (maxLoginAttemptsEnabled) {\n await incrementLoginAttempts({\n collection: collectionConfig,\n payload: req.payload,\n user,\n })\n\n // Re-check login permissions and max attempts after incrementing attempts, in case parallel updates occurred\n checkLoginPermission({\n loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n req,\n user,\n })\n }\n\n throw new AuthenticationError(req.t)\n }\n\n if (collectionConfig.auth.verify && user._verified === false) {\n throw new UnverifiedEmail({ t: req.t })\n }\n\n // Authentication successful - start transaction for remaining operations\n const shouldCommit = await initTransaction(args.req)\n let sid: string \| undefined\n\n try {\n /\n * Correct password accepted - re‑check that the account didn't\n * get locked by parallel bad attempts in the meantime.\n */\n if (maxLoginAttemptsEnabled) {\n const { lockUntil, loginAttempts } = (await payload.db.findOne<User>({\n collection: collectionConfig.slug,\n req,\n select: {\n lockUntil: true,\n loginAttempts: true,\n },\n where: { id: { equals: user.id } },\n }))!\n\n user.lockUntil = lockUntil\n user.loginAttempts = loginAttempts\n\n checkLoginPermission({\n req,\n user,\n })\n }\n\n const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n collectionConfig,\n email: sanitizedEmail!,\n user,\n }\n\n const session = await addSessionToUser({\n collectionConfig,\n payload,\n req,\n user,\n })\n sid = session.sid\n\n if (sid) {\n fieldsToSignArgs.sid = sid\n }\n\n if (\n authResult.shouldUpdatePasswordHash &&\n typeof authenticatedHash === 'string' &&\n typeof authenticatedSalt === 'string'\n ) {\n try {\n const { hash, salt } = await generatePasswordSaltHash({\n collection: collectionConfig,\n isPasswordAuthenticated: true,\n password,\n req,\n })\n\n await payload.db.updateOne({\n collection: collectionConfig.slug,\n data: { hash, salt },\n req,\n select: { id: true },\n where: {\n id: { equals: user.id },\n hash: { equals: authenticatedHash },\n salt: { equals: authenticatedSalt },\n },\n })\n } catch (err) {\n // Rehashing is opportunistic and is retried on the next login, so a failure here\n // must not reject an otherwise valid login or discard the session already created\n payload.logger.error({ err, msg: 'Failed to update the stored password hash' })\n }\n }\n\n const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n if (maxLoginAttemptsEnabled) {\n await resetLoginAttempts({\n collection: collectionConfig,\n doc: user,\n payload: req.payload,\n req,\n })\n }\n\n // /////////////////////////////////////\n // beforeLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeLogin?.length) {\n for (const hook of collectionConfig.hooks.beforeLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n user,\n })) \|\| user\n }\n }\n\n const { exp, token } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n req.user = user\n\n // /////////////////////////////////////\n // afterLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterLogin?.length) {\n for (const hook of collectionConfig.hooks.afterLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n token,\n user,\n })) \|\| user\n }\n }\n\n // /////////////////////////////////////\n // afterRead - Fields\n // /////////////////////////////////////\n\n const userWithReadAccess = await applyUserReadAccess({\n collection: collectionConfig,\n depth: depth!,\n overrideAccess,\n req,\n showHiddenFields: showHiddenFields!,\n user,\n })\n\n let result: LoginResult<TSlug> = {\n exp,\n token,\n user: userWithReadAccess,\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'login',\n overrideAccess: args.overrideAccess!,\n result,\n })\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n // /////////////////////////////////////\n // Return results\n // /////////////////////////////////////\n\n return result\n } catch (error: unknown) {\n if (sid) {\n await revokeSession({\n collectionConfig,\n payload,\n req,\n sid,\n user,\n })\n }\n await killTransaction(args.req)\n throw error\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","AuthenticationError","LockedAuth","UnverifiedEmail","ValidationError","commitTransaction","Forbidden","initTransaction","appendNonTrashedFilter","assertNoValidationWrite","killTransaction","sanitizeInternalFields","applyUserReadAccess","getFieldsToSign","getLoginOptions","isUserLocked","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","incrementLoginAttempts","resetLoginAttempts","checkLoginPermission","loggingInWithUsername","req","user","t","Boolean","Date","lockUntil","loginOperation","incomingArgs","args","collection","config","auth","disableLocalStrategy","operation","overrideAccess","collectionConfig","data","depth","payload","secret","showHiddenFields","email","unsanitizedEmail","password","loginWithUsername","sanitizedEmail","toLowerCase","trim","sanitizedUsername","username","canLoginWithEmail","canLoginWithUsername","slug","errors","message","i18n","path","whereConstraint","emailConstraint","equals","usernameConstraint","or","enableTrash","trash","where","db","findOne","_strategy","authenticatedHash","hash","authenticatedSalt","salt","authResult","doc","maxLoginAttemptsEnabled","maxLoginAttempts","verify","_verified","shouldCommit","sid","loginAttempts","select","id","fieldsToSignArgs","session","shouldUpdatePasswordHash","isPasswordAuthenticated","updateOne","err","logger","error","msg","fieldsToSign","hooks","beforeLogin","length","hook","context","exp","token","tokenExpiration","afterLogin","userWithReadAccess","result"],"mappings":"AASA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SACEC,mBAAmB,EACnBC,UAAU,EACVC,eAAe,EACfC,eAAe,QACV,wBAAuB;AAC9B,SAASC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,QAAQ,iBAAgB;AAC9E,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,YAAY,QAAQ,qBAAoB;AACjD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAC1F,SAASC,sBAAsB,QAAQ,gDAA+C;AACtF,SAASC,kBAAkB,QAAQ,4CAA2C;AAuB9E;;;;CAIC,GACD,OAAO,MAAMC,uBAAuB,CAAmC,EACrEC,qBAAqB,EACrBC,GAAG,EACHC,IAAI,EAC4B;IAChC,IAAI,CAACA,MAAM;QACT,MAAM,IAAIzB,oBAAoBwB,IAAIE,CAAC,EAAEC,QAAQJ;IAC/C;IAEA,IAAIT,aAAa,IAAIc,KAAKH,KAAKI,SAAS,IAAI;QAC1C,MAAM,IAAI5B,WAAWuB,IAAIE,CAAC;IAC5B;AACF,EAAC;AAED,OAAO,MAAMI,iBAAiB,OAC5BC;IAEA,IAAIC,OAAOD;IAEXvB,wBAAwBwB,KAAKR,GAAG;IAEhC,IAAIQ,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAACC,oBAAoB,EAAE;QACpD,MAAM,IAAI/B,UAAU2B,KAAKR,GAAG,CAACE,CAAC;IAChC;IAEA,wCAAwC;IACxC,+BAA+B;IAC/B,wCAAwC;IAExCM,OAAO,MAAMjC,qBAAqB;QAChCiC;QACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;QAClCG,WAAW;QACXC,gBAAgBN,KAAKM,cAAc;IACrC;IAEA,MAAM,EACJL,YAAY,EAAEC,QAAQK,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLH,iBAAiB,KAAK,EACtBd,GAAG,EACHA,KAAK,EACHkB,OAAO,EACPA,SAAS,EAAEC,MAAM,EAAE,EACpB,EACDC,gBAAgB,EACjB,GAAGZ;IAEJ,wCAAwC;IACxC,QAAQ;IACR,wCAAwC;IAExC,MAAM,EAAEa,OAAOC,gBAAgB,EAAEC,QAAQ,EAAE,GAAGP;IAC9C,MAAMQ,oBAAoBT,iBAAiBJ,IAAI,CAACa,iBAAiB;IAEjE,MAAMC,iBACJ,OAAOH,qBAAqB,WAAWA,iBAAiBI,WAAW,GAAGC,IAAI,KAAK;IACjF,MAAMC,oBACJ,cAAcZ,QAAQ,OAAOA,MAAMa,aAAa,WAC5Cb,KAAKa,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IAEN,MAAM,EAAEG,iBAAiB,EAAEC,oBAAoB,EAAE,GAAG1C,gBAAgBmC;IAEpE,oDAAoD;IACpD,IAAI,CAACM,qBAAqB,CAACF,mBAAmB;QAC5C,MAAM,IAAIjD,gBAAgB;YACxB8B,YAAYM,iBAAiBiB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASlC,IAAImC,IAAI,CAACjC,CAAC,CAAC;oBAAwBkC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,oDAAoD;IACpD,IAAI,CAACL,wBAAwB,CAACN,gBAAgB;QAC5C,MAAM,IAAI9C,gBAAgB;YACxB8B,YAAYM,iBAAiBiB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASlC,IAAImC,IAAI,CAACjC,CAAC,CAAC;oBAAwBkC,MAAM;gBAAQ;aAAE;QACzE;IACF;IAEA,kEAAkE;IAClE,IAAI,CAACR,qBAAqB,CAACH,gBAAgB;QACzC,MAAM,IAAI9C,gBAAgB;YACxB8B,YAAYM,iBAAiBiB,IAAI;YACjCC,QAAQ;gBACN;oBAAEC,SAASlC,IAAImC,IAAI,CAACjC,CAAC,CAAC;oBAAwBkC,MAAM;gBAAQ;gBAC5D;oBAAEF,SAASlC,IAAImC,IAAI,CAACjC,CAAC,CAAC;oBAAwBkC,MAAM;gBAAW;aAChE;QACH;IACF;IAEA,qCAAqC;IACrC,IAAI,OAAOb,aAAa,YAAYA,SAASI,IAAI,OAAO,IAAI;QAC1D,MAAM,IAAIhD,gBAAgB;YACxB8B,YAAYM,iBAAiBiB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASlC,IAAImC,IAAI,CAACjC,CAAC,CAAC;oBAAwBkC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,IAAIC,kBAAyB,CAAC;IAC9B,MAAMC,kBAAyB;QAC7BjB,OAAO;YACLkB,QAAQd;QACV;IACF;IACA,MAAMe,qBAA4B;QAChCX,UAAU;YACRU,QAAQX;QACV;IACF;IAEA,IAAIE,qBAAqBC,wBAAyBH,CAAAA,qBAAqBH,cAAa,GAAI;QACtF,IAAIG,mBAAmB;YACrBS,kBAAkB;gBAChBI,IAAI;oBACFD;oBACA;wBACEnB,OAAO;4BACLkB,QAAQX;wBACV;oBACF;iBACD;YACH;QACF,OAAO;YACLS,kBAAkB;gBAChBI,IAAI;oBACFH;oBACA;wBACET,UAAU;4BACRU,QAAQd;wBACV;oBACF;iBACD;YACH;QACF;IACF,OAAO,IAAIK,qBAAqBL,gBAAgB;QAC9CY,kBAAkBC;IACpB,OAAO,IAAIP,wBAAwBH,mBAAmB;QACpDS,kBAAkBG;IACpB;IAEA,wBAAwB;IACxBH,kBAAkBtD,uBAAuB;QACvC2D,aAAa3B,iBAAiB4B,KAAK;QACnCA,OAAO;QACPC,OAAOP;IACT;IAEA,IAAIpC,OAAQ,MAAMiB,QAAQ2B,EAAE,CAACC,OAAO,CAAO;QACzCrC,YAAYM,iBAAiBiB,IAAI;QACjChC;QACA4C,OAAOP;IACT;IAEAvC,qBAAqB;QACnBC,uBAAuBI,QAAQ4B,wBAAwBH;QACvD5B;QACAC;IACF;IAEAA,KAAKQ,UAAU,GAAGM,iBAAiBiB,IAAI;IACvC/B,KAAK8C,SAAS,GAAG;IAEjB,MAAMC,oBAAoB/C,KAAKgD,IAAI;IACnC,MAAMC,oBAAoBjD,KAAKkD,IAAI;IACnC,MAAMC,aAAa,MAAM1D,0BAA0B;QAAE2D,KAAKpD;QAAMsB;IAAS;IACzEtB,OAAOf,uBAAuBe;IAE9B,MAAMqD,0BAA0B9C,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAAC4C,gBAAgB,GAAG;IAE/E,IAAI,CAACH,YAAY;QACf,IAAIE,yBAAyB;YAC3B,MAAM1D,uBAAuB;gBAC3Ba,YAAYM;gBACZG,SAASlB,IAAIkB,OAAO;gBACpBjB;YACF;YAEA,6GAA6G;YAC7GH,qBAAqB;gBACnBC,uBAAuBI,QAAQ4B,wBAAwBH;gBACvD5B;gBACAC;YACF;QACF;QAEA,MAAM,IAAIzB,oBAAoBwB,IAAIE,CAAC;IACrC;IAEA,IAAIa,iBAAiBJ,IAAI,CAAC6C,MAAM,IAAIvD,KAAKwD,SAAS,KAAK,OAAO;QAC5D,MAAM,IAAI/E,gBAAgB;YAAEwB,GAAGF,IAAIE,CAAC;QAAC;IACvC;IAEA,yEAAyE;IACzE,MAAMwD,eAAe,MAAM5E,gBAAgB0B,KAAKR,GAAG;IACnD,IAAI2D;IAEJ,IAAI;QACF;;;KAGC,GACD,IAAIL,yBAAyB;YAC3B,MAAM,EAAEjD,SAAS,EAAEuD,aAAa,EAAE,GAAI,MAAM1C,QAAQ2B,EAAE,CAACC,OAAO,CAAO;gBACnErC,YAAYM,iBAAiBiB,IAAI;gBACjChC;gBACA6D,QAAQ;oBACNxD,WAAW;oBACXuD,eAAe;gBACjB;gBACAhB,OAAO;oBAAEkB,IAAI;wBAAEvB,QAAQtC,KAAK6D,EAAE;oBAAC;gBAAE;YACnC;YAEA7D,KAAKI,SAAS,GAAGA;YACjBJ,KAAK2D,aAAa,GAAGA;YAErB9D,qBAAqB;gBACnBE;gBACAC;YACF;QACF;QAEA,MAAM8D,mBAA0D;YAC9DhD;YACAM,OAAOI;YACPxB;QACF;QAEA,MAAM+D,UAAU,MAAMxE,iBAAiB;YACrCuB;YACAG;YACAlB;YACAC;QACF;QACA0D,MAAMK,QAAQL,GAAG;QAEjB,IAAIA,KAAK;YACPI,iBAAiBJ,GAAG,GAAGA;QACzB;QAEA,IACEP,WAAWa,wBAAwB,IACnC,OAAOjB,sBAAsB,YAC7B,OAAOE,sBAAsB,UAC7B;YACA,IAAI;gBACF,MAAM,EAAED,IAAI,EAAEE,IAAI,EAAE,GAAG,MAAMxD,yBAAyB;oBACpDc,YAAYM;oBACZmD,yBAAyB;oBACzB3C;oBACAvB;gBACF;gBAEA,MAAMkB,QAAQ2B,EAAE,CAACsB,SAAS,CAAC;oBACzB1D,YAAYM,iBAAiBiB,IAAI;oBACjChB,MAAM;wBAAEiC;wBAAME;oBAAK;oBACnBnD;oBACA6D,QAAQ;wBAAEC,IAAI;oBAAK;oBACnBlB,OAAO;wBACLkB,IAAI;4BAAEvB,QAAQtC,KAAK6D,EAAE;wBAAC;wBACtBb,MAAM;4BAAEV,QAAQS;wBAAkB;wBAClCG,MAAM;4BAAEZ,QAAQW;wBAAkB;oBACpC;gBACF;YACF,EAAE,OAAOkB,KAAK;gBACZ,iFAAiF;gBACjF,kFAAkF;gBAClFlD,QAAQmD,MAAM,CAACC,KAAK,CAAC;oBAAEF;oBAAKG,KAAK;gBAA4C;YAC/E;QACF;QAEA,MAAMC,eAAepF,gBAAgB2E;QAErC,IAAIT,yBAAyB;YAC3B,MAAMzD,mBAAmB;gBACvBY,YAAYM;gBACZsC,KAAKpD;gBACLiB,SAASlB,IAAIkB,OAAO;gBACpBlB;YACF;QACF;QAEA,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAIe,iBAAiB0D,KAAK,EAAEC,aAAaC,QAAQ;YAC/C,KAAK,MAAMC,QAAQ7D,iBAAiB0D,KAAK,CAACC,WAAW,CAAE;gBACrDzE,OACE,AAAC,MAAM2E,KAAK;oBACVnE,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BmE,SAASrE,KAAKR,GAAG,CAAC6E,OAAO;oBACzB7E,KAAKQ,KAAKR,GAAG;oBACbC;gBACF,MAAOA;YACX;QACF;QAEA,MAAM,EAAE6E,GAAG,EAAEC,KAAK,EAAE,GAAG,MAAMxF,QAAQ;YACnCiF;YACArD;YACA6D,iBAAiBjE,iBAAiBJ,IAAI,CAACqE,eAAe;QACxD;QAEAhF,IAAIC,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIc,iBAAiB0D,KAAK,EAAEQ,YAAYN,QAAQ;YAC9C,KAAK,MAAMC,QAAQ7D,iBAAiB0D,KAAK,CAACQ,UAAU,CAAE;gBACpDhF,OACE,AAAC,MAAM2E,KAAK;oBACVnE,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BmE,SAASrE,KAAKR,GAAG,CAAC6E,OAAO;oBACzB7E,KAAKQ,KAAKR,GAAG;oBACb+E;oBACA9E;gBACF,MAAOA;YACX;QACF;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,MAAMiF,qBAAqB,MAAM/F,oBAAoB;YACnDsB,YAAYM;YACZE,OAAOA;YACPH;YACAd;YACAoB,kBAAkBA;YAClBnB;QACF;QAEA,IAAIkF,SAA6B;YAC/BL;YACAC;YACA9E,MAAMiF;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCC,SAAS,MAAM7G,oBAAoB;YACjCkC;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BG,WAAW;YACXC,gBAAgBN,KAAKM,cAAc;YACnCqE;QACF;QAEA,IAAIzB,cAAc;YAChB,MAAM9E,kBAAkBoB;QAC1B;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,OAAOmF;IACT,EAAE,OAAOb,OAAgB;QACvB,IAAIX,KAAK;YACP,MAAMlE,cAAc;gBAClBsB;gBACAG;gBACAlB;gBACA2D;gBACA1D;YACF;QACF;QACA,MAAMhB,gBAAgBuB,KAAKR,GAAG;QAC9B,MAAMsE;IACR;AACF,EAAC"}
1	+ {"version":3,"sources":["../../../src/auth/operations/login.ts"],"sourcesContent":["import type {\n AuthOperationsFromCollectionSlug,\n Collection,\n DataFromCollectionSlug,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, AuthenticatedUser, User } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\nimport type { AuthRuntimeFields } from '../types.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport {\n AuthenticationError,\n LockedAuth,\n UnverifiedEmail,\n ValidationError,\n} from '../../errors/index.js'\nimport { commitTransaction, Forbidden, initTransaction } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { createAuthToken } from '../createAuthToken.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { isUserLocked } from '../isUserLocked.js'\nimport { revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\nimport { incrementLoginAttempts } from '../strategies/local/incrementLoginAttempts.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type LoginResult<TSlug extends AuthCollectionSlug> = {\n exp?: number\n /** With `auth.refreshTokens`, trades for a new token after this one expires. /\n refreshToken?: string\n token?: string\n user?: AuthRuntimeFields & DataFromCollectionSlug<TSlug>\n}\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n collection: Collection\n data: AuthOperationsFromCollectionSlug<TSlug>['login']\n depth?: number\n overrideAccess?: boolean\n req: PayloadRequest\n showHiddenFields?: boolean\n}\n\ntype CheckLoginPermissionArgs<TSlug extends AuthCollectionSlug> = {\n loggingInWithUsername?: boolean\n req: PayloadRequest\n user: DataFromCollectionSlug<TSlug>\n}\n\n/\n Throws an error if the user is locked or does not exist.\n * This does not check the login attempts, only the lock status. Whoever increments login attempts\n * is responsible for locking the user properly, not whoever checks the login permission.\n /\nexport const checkLoginPermission = <TSlug extends AuthCollectionSlug>({\n loggingInWithUsername,\n req,\n user,\n}: CheckLoginPermissionArgs<TSlug>) => {\n if (!user) {\n throw new AuthenticationError(req.t, Boolean(loggingInWithUsername))\n }\n\n if (isUserLocked(new Date(user.lockUntil))) {\n throw new LockedAuth(req.t)\n }\n}\n\nexport const loginOperation = async <TSlug extends AuthCollectionSlug>(\n incomingArgs: Arguments<TSlug>,\n): Promise<LoginResult<TSlug>> => {\n let args = incomingArgs\n\n assertNoValidationWrite(args.req)\n\n if (args.collection.config.auth.disableLocalStrategy) {\n throw new Forbidden(args.req.t)\n }\n\n // /////////////////////////////////////\n // beforeOperation - Collection\n // /////////////////////////////////////\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'login',\n overrideAccess: args.overrideAccess!,\n })\n\n const {\n collection: { config: collectionConfig },\n data,\n depth,\n overrideAccess = false,\n req,\n req: { payload },\n showHiddenFields,\n } = args\n\n // /////////////////////////////////////\n // Login\n // /////////////////////////////////////\n\n const { email: unsanitizedEmail, password } = data\n const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n const sanitizedEmail =\n typeof unsanitizedEmail === 'string' ? unsanitizedEmail.toLowerCase().trim() : null\n const sanitizedUsername =\n 'username' in data && typeof data?.username === 'string'\n ? data.username.toLowerCase().trim()\n : null\n\n const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n // cannot login with email, did not provide username\n if (!canLoginWithEmail && !sanitizedUsername) {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [{ message: req.i18n.t('validation:required'), path: 'username' }],\n })\n }\n\n // cannot login with username, did not provide email\n if (!canLoginWithUsername && !sanitizedEmail) {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [{ message: req.i18n.t('validation:required'), path: 'email' }],\n })\n }\n\n // can login with either email or username, did not provide either\n if (!sanitizedUsername && !sanitizedEmail) {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [\n { message: req.i18n.t('validation:required'), path: 'email' },\n { message: req.i18n.t('validation:required'), path: 'username' },\n ],\n })\n }\n\n // did not provide password for login\n if (typeof password !== 'string' \|\| password.trim() === '') {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [{ message: req.i18n.t('validation:required'), path: 'password' }],\n })\n }\n\n let whereConstraint: Where = {}\n const emailConstraint: Where = {\n email: {\n equals: sanitizedEmail,\n },\n }\n const usernameConstraint: Where = {\n username: {\n equals: sanitizedUsername,\n },\n }\n\n if (canLoginWithEmail && canLoginWithUsername && (sanitizedUsername \|\| sanitizedEmail)) {\n if (sanitizedUsername) {\n whereConstraint = {\n or: [\n usernameConstraint,\n {\n email: {\n equals: sanitizedUsername,\n },\n },\n ],\n }\n } else {\n whereConstraint = {\n or: [\n emailConstraint,\n {\n username: {\n equals: sanitizedEmail,\n },\n },\n ],\n }\n }\n } else if (canLoginWithEmail && sanitizedEmail) {\n whereConstraint = emailConstraint\n } else if (canLoginWithUsername && sanitizedUsername) {\n whereConstraint = usernameConstraint\n }\n\n // Exclude trashed users\n whereConstraint = appendNonTrashedFilter({\n enableTrash: collectionConfig.trash,\n trash: false,\n where: whereConstraint,\n })\n\n let user = (await payload.db.findOne<User>({\n collection: collectionConfig.slug,\n req,\n where: whereConstraint,\n })) as AuthenticatedUser\n\n checkLoginPermission({\n loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n req,\n user,\n })\n\n user.collection = collectionConfig.slug\n user._strategy = 'local-jwt'\n\n const authenticatedHash = user.hash\n const authenticatedSalt = user.salt\n const authResult = await authenticateLocalStrategy({ doc: user, password })\n user = sanitizeInternalFields(user)\n\n const maxLoginAttemptsEnabled = args.collection.config.auth.maxLoginAttempts > 0\n\n if (!authResult) {\n if (maxLoginAttemptsEnabled) {\n await incrementLoginAttempts({\n collection: collectionConfig,\n payload: req.payload,\n user,\n })\n\n // Re-check login permissions and max attempts after incrementing attempts, in case parallel updates occurred\n checkLoginPermission({\n loggingInWithUsername: Boolean(canLoginWithUsername && sanitizedUsername),\n req,\n user,\n })\n }\n\n throw new AuthenticationError(req.t)\n }\n\n if (collectionConfig.auth.verify && user._verified === false) {\n throw new UnverifiedEmail({ t: req.t })\n }\n\n // Authentication successful - start transaction for remaining operations\n const shouldCommit = await initTransaction(args.req)\n let sid: string \| undefined\n\n try {\n /\n * Correct password accepted - re‑check that the account didn't\n * get locked by parallel bad attempts in the meantime.\n */\n if (maxLoginAttemptsEnabled) {\n const { lockUntil, loginAttempts } = (await payload.db.findOne<User>({\n collection: collectionConfig.slug,\n req,\n select: {\n lockUntil: true,\n loginAttempts: true,\n },\n where: { id: { equals: user.id } },\n }))!\n\n user.lockUntil = lockUntil\n user.loginAttempts = loginAttempts\n\n checkLoginPermission({\n req,\n user,\n })\n }\n\n const { exp, refreshToken, token, ...session } = await createAuthToken({\n collectionConfig,\n email: sanitizedEmail!,\n req,\n shouldCreateRefreshToken: Boolean(collectionConfig.auth.refreshTokens),\n user,\n })\n sid = session.sid\n\n if (\n authResult.shouldUpdatePasswordHash &&\n typeof authenticatedHash === 'string' &&\n typeof authenticatedSalt === 'string'\n ) {\n try {\n const { hash, salt } = await generatePasswordSaltHash({\n collection: collectionConfig,\n isPasswordAuthenticated: true,\n password,\n req,\n })\n\n await payload.db.updateOne({\n collection: collectionConfig.slug,\n data: { hash, salt },\n req,\n select: { id: true },\n where: {\n id: { equals: user.id },\n hash: { equals: authenticatedHash },\n salt: { equals: authenticatedSalt },\n },\n })\n } catch (err) {\n // Rehashing is opportunistic and is retried on the next login, so a failure here\n // must not reject an otherwise valid login or discard the session already created\n payload.logger.error({ err, msg: 'Failed to update the stored password hash' })\n }\n }\n\n if (maxLoginAttemptsEnabled) {\n await resetLoginAttempts({\n collection: collectionConfig,\n doc: user,\n payload: req.payload,\n req,\n })\n }\n\n // /////////////////////////////////////\n // beforeLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeLogin?.length) {\n for (const hook of collectionConfig.hooks.beforeLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n user,\n })) \|\| user\n }\n }\n\n req.user = user\n\n // /////////////////////////////////////\n // afterLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterLogin?.length) {\n for (const hook of collectionConfig.hooks.afterLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n token,\n user,\n })) \|\| user\n }\n }\n\n // /////////////////////////////////////\n // afterRead - Fields\n // /////////////////////////////////////\n\n const userWithReadAccess = await applyUserReadAccess({\n collection: collectionConfig,\n depth: depth!,\n overrideAccess,\n req,\n showHiddenFields: showHiddenFields!,\n user,\n })\n\n let result: LoginResult<TSlug> = {\n exp,\n refreshToken,\n token,\n user: userWithReadAccess,\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'login',\n overrideAccess: args.overrideAccess!,\n result,\n })\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n // /////////////////////////////////////\n // Return results\n // /////////////////////////////////////\n\n return result\n } catch (error: unknown) {\n if (sid) {\n await revokeSession({\n collectionConfig,\n payload,\n req,\n sid,\n user,\n })\n }\n await killTransaction(args.req)\n throw error\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","AuthenticationError","LockedAuth","UnverifiedEmail","ValidationError","commitTransaction","Forbidden","initTransaction","appendNonTrashedFilter","assertNoValidationWrite","killTransaction","sanitizeInternalFields","applyUserReadAccess","createAuthToken","getLoginOptions","isUserLocked","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","incrementLoginAttempts","resetLoginAttempts","checkLoginPermission","loggingInWithUsername","req","user","t","Boolean","Date","lockUntil","loginOperation","incomingArgs","args","collection","config","auth","disableLocalStrategy","operation","overrideAccess","collectionConfig","data","depth","payload","showHiddenFields","email","unsanitizedEmail","password","loginWithUsername","sanitizedEmail","toLowerCase","trim","sanitizedUsername","username","canLoginWithEmail","canLoginWithUsername","slug","errors","message","i18n","path","whereConstraint","emailConstraint","equals","usernameConstraint","or","enableTrash","trash","where","db","findOne","_strategy","authenticatedHash","hash","authenticatedSalt","salt","authResult","doc","maxLoginAttemptsEnabled","maxLoginAttempts","verify","_verified","shouldCommit","sid","loginAttempts","select","id","exp","refreshToken","token","session","shouldCreateRefreshToken","refreshTokens","shouldUpdatePasswordHash","isPasswordAuthenticated","updateOne","err","logger","error","msg","hooks","beforeLogin","length","hook","context","afterLogin","userWithReadAccess","result"],"mappings":"AASA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SACEC,mBAAmB,EACnBC,UAAU,EACVC,eAAe,EACfC,eAAe,QACV,wBAAuB;AAC9B,SAASC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,QAAQ,iBAAgB;AAC9E,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,YAAY,QAAQ,qBAAoB;AACjD,SAASC,aAAa,QAAQ,iBAAgB;AAC9C,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAC1F,SAASC,sBAAsB,QAAQ,gDAA+C;AACtF,SAASC,kBAAkB,QAAQ,4CAA2C;AAyB9E;;;;CAIC,GACD,OAAO,MAAMC,uBAAuB,CAAmC,EACrEC,qBAAqB,EACrBC,GAAG,EACHC,IAAI,EAC4B;IAChC,IAAI,CAACA,MAAM;QACT,MAAM,IAAIvB,oBAAoBsB,IAAIE,CAAC,EAAEC,QAAQJ;IAC/C;IAEA,IAAIP,aAAa,IAAIY,KAAKH,KAAKI,SAAS,IAAI;QAC1C,MAAM,IAAI1B,WAAWqB,IAAIE,CAAC;IAC5B;AACF,EAAC;AAED,OAAO,MAAMI,iBAAiB,OAC5BC;IAEA,IAAIC,OAAOD;IAEXrB,wBAAwBsB,KAAKR,GAAG;IAEhC,IAAIQ,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAACC,oBAAoB,EAAE;QACpD,MAAM,IAAI7B,UAAUyB,KAAKR,GAAG,CAACE,CAAC;IAChC;IAEA,wCAAwC;IACxC,+BAA+B;IAC/B,wCAAwC;IAExCM,OAAO,MAAM/B,qBAAqB;QAChC+B;QACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;QAClCG,WAAW;QACXC,gBAAgBN,KAAKM,cAAc;IACrC;IAEA,MAAM,EACJL,YAAY,EAAEC,QAAQK,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLH,iBAAiB,KAAK,EACtBd,GAAG,EACHA,KAAK,EAAEkB,OAAO,EAAE,EAChBC,gBAAgB,EACjB,GAAGX;IAEJ,wCAAwC;IACxC,QAAQ;IACR,wCAAwC;IAExC,MAAM,EAAEY,OAAOC,gBAAgB,EAAEC,QAAQ,EAAE,GAAGN;IAC9C,MAAMO,oBAAoBR,iBAAiBJ,IAAI,CAACY,iBAAiB;IAEjE,MAAMC,iBACJ,OAAOH,qBAAqB,WAAWA,iBAAiBI,WAAW,GAAGC,IAAI,KAAK;IACjF,MAAMC,oBACJ,cAAcX,QAAQ,OAAOA,MAAMY,aAAa,WAC5CZ,KAAKY,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IAEN,MAAM,EAAEG,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGvC,gBAAgBgC;IAEpE,oDAAoD;IACpD,IAAI,CAACM,qBAAqB,CAACF,mBAAmB;QAC5C,MAAM,IAAI9C,gBAAgB;YACxB4B,YAAYM,iBAAiBgB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASjC,IAAIkC,IAAI,CAAChC,CAAC,CAAC;oBAAwBiC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,oDAAoD;IACpD,IAAI,CAACL,wBAAwB,CAACN,gBAAgB;QAC5C,MAAM,IAAI3C,gBAAgB;YACxB4B,YAAYM,iBAAiBgB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASjC,IAAIkC,IAAI,CAAChC,CAAC,CAAC;oBAAwBiC,MAAM;gBAAQ;aAAE;QACzE;IACF;IAEA,kEAAkE;IAClE,IAAI,CAACR,qBAAqB,CAACH,gBAAgB;QACzC,MAAM,IAAI3C,gBAAgB;YACxB4B,YAAYM,iBAAiBgB,IAAI;YACjCC,QAAQ;gBACN;oBAAEC,SAASjC,IAAIkC,IAAI,CAAChC,CAAC,CAAC;oBAAwBiC,MAAM;gBAAQ;gBAC5D;oBAAEF,SAASjC,IAAIkC,IAAI,CAAChC,CAAC,CAAC;oBAAwBiC,MAAM;gBAAW;aAChE;QACH;IACF;IAEA,qCAAqC;IACrC,IAAI,OAAOb,aAAa,YAAYA,SAASI,IAAI,OAAO,IAAI;QAC1D,MAAM,IAAI7C,gBAAgB;YACxB4B,YAAYM,iBAAiBgB,IAAI;YACjCC,QAAQ;gBAAC;oBAAEC,SAASjC,IAAIkC,IAAI,CAAChC,CAAC,CAAC;oBAAwBiC,MAAM;gBAAW;aAAE;QAC5E;IACF;IAEA,IAAIC,kBAAyB,CAAC;IAC9B,MAAMC,kBAAyB;QAC7BjB,OAAO;YACLkB,QAAQd;QACV;IACF;IACA,MAAMe,qBAA4B;QAChCX,UAAU;YACRU,QAAQX;QACV;IACF;IAEA,IAAIE,qBAAqBC,wBAAyBH,CAAAA,qBAAqBH,cAAa,GAAI;QACtF,IAAIG,mBAAmB;YACrBS,kBAAkB;gBAChBI,IAAI;oBACFD;oBACA;wBACEnB,OAAO;4BACLkB,QAAQX;wBACV;oBACF;iBACD;YACH;QACF,OAAO;YACLS,kBAAkB;gBAChBI,IAAI;oBACFH;oBACA;wBACET,UAAU;4BACRU,QAAQd;wBACV;oBACF;iBACD;YACH;QACF;IACF,OAAO,IAAIK,qBAAqBL,gBAAgB;QAC9CY,kBAAkBC;IACpB,OAAO,IAAIP,wBAAwBH,mBAAmB;QACpDS,kBAAkBG;IACpB;IAEA,wBAAwB;IACxBH,kBAAkBnD,uBAAuB;QACvCwD,aAAa1B,iBAAiB2B,KAAK;QACnCA,OAAO;QACPC,OAAOP;IACT;IAEA,IAAInC,OAAQ,MAAMiB,QAAQ0B,EAAE,CAACC,OAAO,CAAO;QACzCpC,YAAYM,iBAAiBgB,IAAI;QACjC/B;QACA2C,OAAOP;IACT;IAEAtC,qBAAqB;QACnBC,uBAAuBI,QAAQ2B,wBAAwBH;QACvD3B;QACAC;IACF;IAEAA,KAAKQ,UAAU,GAAGM,iBAAiBgB,IAAI;IACvC9B,KAAK6C,SAAS,GAAG;IAEjB,MAAMC,oBAAoB9C,KAAK+C,IAAI;IACnC,MAAMC,oBAAoBhD,KAAKiD,IAAI;IACnC,MAAMC,aAAa,MAAMzD,0BAA0B;QAAE0D,KAAKnD;QAAMqB;IAAS;IACzErB,OAAOb,uBAAuBa;IAE9B,MAAMoD,0BAA0B7C,KAAKC,UAAU,CAACC,MAAM,CAACC,IAAI,CAAC2C,gBAAgB,GAAG;IAE/E,IAAI,CAACH,YAAY;QACf,IAAIE,yBAAyB;YAC3B,MAAMzD,uBAAuB;gBAC3Ba,YAAYM;gBACZG,SAASlB,IAAIkB,OAAO;gBACpBjB;YACF;YAEA,6GAA6G;YAC7GH,qBAAqB;gBACnBC,uBAAuBI,QAAQ2B,wBAAwBH;gBACvD3B;gBACAC;YACF;QACF;QAEA,MAAM,IAAIvB,oBAAoBsB,IAAIE,CAAC;IACrC;IAEA,IAAIa,iBAAiBJ,IAAI,CAAC4C,MAAM,IAAItD,KAAKuD,SAAS,KAAK,OAAO;QAC5D,MAAM,IAAI5E,gBAAgB;YAAEsB,GAAGF,IAAIE,CAAC;QAAC;IACvC;IAEA,yEAAyE;IACzE,MAAMuD,eAAe,MAAMzE,gBAAgBwB,KAAKR,GAAG;IACnD,IAAI0D;IAEJ,IAAI;QACF;;;KAGC,GACD,IAAIL,yBAAyB;YAC3B,MAAM,EAAEhD,SAAS,EAAEsD,aAAa,EAAE,GAAI,MAAMzC,QAAQ0B,EAAE,CAACC,OAAO,CAAO;gBACnEpC,YAAYM,iBAAiBgB,IAAI;gBACjC/B;gBACA4D,QAAQ;oBACNvD,WAAW;oBACXsD,eAAe;gBACjB;gBACAhB,OAAO;oBAAEkB,IAAI;wBAAEvB,QAAQrC,KAAK4D,EAAE;oBAAC;gBAAE;YACnC;YAEA5D,KAAKI,SAAS,GAAGA;YACjBJ,KAAK0D,aAAa,GAAGA;YAErB7D,qBAAqB;gBACnBE;gBACAC;YACF;QACF;QAEA,MAAM,EAAE6D,GAAG,EAAEC,YAAY,EAAEC,KAAK,EAAE,GAAGC,SAAS,GAAG,MAAM3E,gBAAgB;YACrEyB;YACAK,OAAOI;YACPxB;YACAkE,0BAA0B/D,QAAQY,iBAAiBJ,IAAI,CAACwD,aAAa;YACrElE;QACF;QACAyD,MAAMO,QAAQP,GAAG;QAEjB,IACEP,WAAWiB,wBAAwB,IACnC,OAAOrB,sBAAsB,YAC7B,OAAOE,sBAAsB,UAC7B;YACA,IAAI;gBACF,MAAM,EAAED,IAAI,EAAEE,IAAI,EAAE,GAAG,MAAMvD,yBAAyB;oBACpDc,YAAYM;oBACZsD,yBAAyB;oBACzB/C;oBACAtB;gBACF;gBAEA,MAAMkB,QAAQ0B,EAAE,CAAC0B,SAAS,CAAC;oBACzB7D,YAAYM,iBAAiBgB,IAAI;oBACjCf,MAAM;wBAAEgC;wBAAME;oBAAK;oBACnBlD;oBACA4D,QAAQ;wBAAEC,IAAI;oBAAK;oBACnBlB,OAAO;wBACLkB,IAAI;4BAAEvB,QAAQrC,KAAK4D,EAAE;wBAAC;wBACtBb,MAAM;4BAAEV,QAAQS;wBAAkB;wBAClCG,MAAM;4BAAEZ,QAAQW;wBAAkB;oBACpC;gBACF;YACF,EAAE,OAAOsB,KAAK;gBACZ,iFAAiF;gBACjF,kFAAkF;gBAClFrD,QAAQsD,MAAM,CAACC,KAAK,CAAC;oBAAEF;oBAAKG,KAAK;gBAA4C;YAC/E;QACF;QAEA,IAAIrB,yBAAyB;YAC3B,MAAMxD,mBAAmB;gBACvBY,YAAYM;gBACZqC,KAAKnD;gBACLiB,SAASlB,IAAIkB,OAAO;gBACpBlB;YACF;QACF;QAEA,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAIe,iBAAiB4D,KAAK,EAAEC,aAAaC,QAAQ;YAC/C,KAAK,MAAMC,QAAQ/D,iBAAiB4D,KAAK,CAACC,WAAW,CAAE;gBACrD3E,OACE,AAAC,MAAM6E,KAAK;oBACVrE,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BqE,SAASvE,KAAKR,GAAG,CAAC+E,OAAO;oBACzB/E,KAAKQ,KAAKR,GAAG;oBACbC;gBACF,MAAOA;YACX;QACF;QAEAD,IAAIC,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIc,iBAAiB4D,KAAK,EAAEK,YAAYH,QAAQ;YAC9C,KAAK,MAAMC,QAAQ/D,iBAAiB4D,KAAK,CAACK,UAAU,CAAE;gBACpD/E,OACE,AAAC,MAAM6E,KAAK;oBACVrE,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BqE,SAASvE,KAAKR,GAAG,CAAC+E,OAAO;oBACzB/E,KAAKQ,KAAKR,GAAG;oBACbgE;oBACA/D;gBACF,MAAOA;YACX;QACF;QAEA,wCAAwC;QACxC,qBAAqB;QACrB,wCAAwC;QAExC,MAAMgF,qBAAqB,MAAM5F,oBAAoB;YACnDoB,YAAYM;YACZE,OAAOA;YACPH;YACAd;YACAmB,kBAAkBA;YAClBlB;QACF;QAEA,IAAIiF,SAA6B;YAC/BpB;YACAC;YACAC;YACA/D,MAAMgF;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCC,SAAS,MAAM1G,oBAAoB;YACjCgC;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BG,WAAW;YACXC,gBAAgBN,KAAKM,cAAc;YACnCoE;QACF;QAEA,IAAIzB,cAAc;YAChB,MAAM3E,kBAAkBkB;QAC1B;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,OAAOkF;IACT,EAAE,OAAOT,OAAgB;QACvB,IAAIf,KAAK;YACP,MAAMjE,cAAc;gBAClBsB;gBACAG;gBACAlB;gBACA0D;gBACAzD;YACF;QACF;QACA,MAAMd,gBAAgBqB,KAAKR,GAAG;QAC9B,MAAMyE;IACR;AACF,EAAC"}

package/dist/auth/operations/refresh.d.ts CHANGED Viewed

@@ -3,11 +3,19 @@ import type { Document, PayloadRequest } from '../../types/index.js';
 export type Result = {
     exp: number;
     refreshedToken: string;
+    /** The next refresh token, when refreshing with a refresh token. */
+    refreshToken?: string;
     setCookie?: boolean;
     user: Document;
 };
 export type Arguments = {
     collection: Collection;
+    /**
+     * A refresh token from login to refresh with, instead of the request's token. Unlike the
+     * request's token, it still works after the token expired. Collection `refresh` hooks don't run
+     * for it, since they replace refreshing with the request's token.
+     */
+    refreshToken?: string;
     req: PayloadRequest;
 };
 export declare const refreshOperation: (incomingArgs: Arguments) => Promise<Result>;

package/dist/auth/operations/refresh.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;~~AAgBpE~~,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,iBAAwB,SAAS,KAAG,OAAO,CAAC,MAAM,~~CA6L9E~~,CAAA"}
1	+ {"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAiBpE,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,iBAAwB,SAAS,KAAG,OAAO,CAAC,MAAM,CAoO9E,CAAA"}

package/dist/auth/operations/refresh.js CHANGED Viewed

@@ -10,6 +10,7 @@ import { killTransaction } from '../../utilities/killTransaction.js';
 import { applyUserReadAccess } from '../applyUserReadAccess.js';
 import { getFieldsToSign } from '../getFieldsToSign.js';
 import { jwtSign } from '../jwt.js';
+import { refreshAuthToken } from '../refreshAuthToken.js';
 import { removeExpiredSessions } from '../sessions.js';
 export const refreshOperation = async (incomingArgs)=>{
     let args = incomingArgs;
@@ -29,11 +30,25 @@ export const refreshOperation = async (incomingArgs)=>{
         // Refresh
         // /////////////////////////////////////
         const { collection: { config: collectionConfig }, req, req: { payload: { config, secret } } } = args;
-        if (!args.req.user) {
+        const refreshed = args.refreshToken ? await refreshAuthToken({
+            collection: collectionConfig.slug,
+            refreshToken: args.refreshToken,
+            req
+        }) : undefined;
+        if (args.refreshToken && !refreshed) {
+            // Commit, so a reused refresh token's session stays logged out
+            if (shouldCommit) {
+                await commitTransaction(req);
+            }
             throw new Forbidden(args.req.t);
         }
-        if (args.req.user.collection !== collectionConfig.slug) {
-            throw new APIError('Incorrect collection', httpStatus.FORBIDDEN);
+        if (!refreshed) {
+            if (!args.req.user) {
+                throw new Forbidden(args.req.t);
+            }
+            if (args.req.user.collection !== collectionConfig.slug) {
+                throw new APIError('Incorrect collection', httpStatus.FORBIDDEN);
+            }
         }
         const pathname = new URL(args.req.url).pathname;
         const isGraphQL = pathname === config.routes.graphQL;
@@ -42,15 +57,16 @@ export const refreshOperation = async (incomingArgs)=>{
             req,
             where: {
                 id: {
-                    equals: args.req.user.id
+                    equals: refreshed?.user.id ?? args.req.user.id
                 }
             }
         });
         if (!user) {
             throw new Forbidden(args.req.t);
         }
-        const sid = args.req.user._sid;
-        if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {
+        const sid = args.req.user?._sid;
+        // refreshAuthToken already refreshed the refresh token's session
+        if (!refreshed && collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {
             if (!Array.isArray(user.sessions) || !sid) {
                 throw new Forbidden(args.req.t);
             }
@@ -60,7 +76,12 @@ export const refreshOperation = async (incomingArgs)=>{
             }
             const now = new Date();
             const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000;
-            existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs);
+            const tokenExpiresAt = new Date(now.getTime() + tokenExpInMs);
+            // Don't shorten sessions that outlast their tokens. Moving the expiry of a session with a
+            // refresh token would also make its refresh token look reused.
+            if (new Date(existingSession.expiresAt) < tokenExpiresAt) {
+                existingSession.expiresAt = tokenExpiresAt;
+            }
             await req.payload.db.updateOne({
                 id: user.id,
                 collection: collectionConfig.slug,
@@ -91,20 +112,30 @@ export const refreshOperation = async (incomingArgs)=>{
         if (!user) {
             throw new NotFound(req.t);
         }
-        user.collection = args.req.user.collection;
-        user._strategy = args.req.user._strategy;
+        user.collection = collectionConfig.slug;
+        user._strategy = refreshed ? 'local-jwt' : args.req.user._strategy;
         let result;
-        // /////////////////////////////////////
-        // refresh hook - Collection
-        // /////////////////////////////////////
-        for (const refreshHook of args.collection.config.hooks.refresh){
-            const hookResult = await refreshHook({
-                args,
+        if (refreshed) {
+            result = {
+                exp: refreshed.exp,
+                refreshedToken: refreshed.token,
+                refreshToken: refreshed.refreshToken,
+                setCookie: true,
                 user
-            });
-            if (hookResult) {
-                result = hookResult;
-                break;
+            };
+        } else {
+            // /////////////////////////////////////
+            // refresh hook - Collection
+            // /////////////////////////////////////
+            for (const refreshHook of args.collection.config.hooks.refresh){
+                const hookResult = await refreshHook({
+                    args,
+                    user
+                });
+                if (hookResult) {
+                    result = hookResult;
+                    break;
+                }
             }
         }
         if (!result) {

package/dist/auth/operations/refresh.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden, NotFound } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n exp: number\n refreshedToken: string\n setCookie?: boolean\n user: Document\n}\n\nexport type Arguments = {\n collection: Collection\n req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n let args = incomingArgs\n\n assertNoValidationWrite(args.req)\n\n try {\n const shouldCommit = await initTransaction(args.req)\n\n // /////////////////////////////////////\n // beforeOperation - Collection\n // /////////////////////////////////////\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'refresh',\n overrideAccess: false,\n })\n\n // /////////////////////////////////////\n // Refresh\n // /////////////////////////////////////\n\n const {\n collection: { config: collectionConfig },\n req,\n req: {\n payload: { config, secret },\n },\n } = args\n\n if (!args.req.user) {\n throw new Forbidden(args.req.t)\n }\n if (args.req.user.collection !== collectionConfig.slug) {\n throw new APIError('Incorrect collection', httpStatus.FORBIDDEN)\n }\n\n const pathname = new URL(args.req.url!).pathname\n\n const isGraphQL = pathname === config.routes.graphQL\n\n let user = await req.payload.db.findOne<AuthenticatedUser>({\n collection: collectionConfig.slug,\n req,\n where: { id: { equals: args.req.user.id } },\n })\n\n if (!user) {\n throw new Forbidden(args.req.t)\n }\n\n const sid = args.req.user._sid\n\n if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n if (!Array.isArray(user.sessions) \|\| !sid) {\n throw new Forbidden(args.req.t)\n }\n\n const existingSession = user.sessions.find(({ id }) => id === sid)\n\n if (!existingSession) {\n throw new Forbidden(args.req.t)\n }\n\n const now = new Date()\n const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n await req.payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: {\n ...user,\n // Prevent updatedAt from being updated when only refreshing a session\n sessions: removeExpiredSessions(user.sessions),\n updatedAt: null,\n },\n req,\n returning: false,\n })\n }\n\n user = await req.payload.db.findOne({\n collection: collectionConfig.slug,\n locale: req.locale ?? undefined,\n req,\n where: appendNonTrashedFilter({\n enableTrash: Boolean(collectionConfig.trash),\n trash: false,\n where: { id: { equals: user.id } },\n }),\n })\n\n if (!user) {\n throw new NotFound(req.t)\n }\n\n user.collection = args.req.user.collection\n user._strategy = args.req.user._strategy\n\n let result!: Result\n\n // /////////////////////////////////////\n // refresh hook - Collection\n // /////////////////////////////////////\n\n for (const refreshHook of args.collection.config.hooks.refresh) {\n const hookResult = await refreshHook({ args, user })\n\n if (hookResult) {\n result = hookResult\n break\n }\n }\n\n if (!result) {\n const fieldsToSign = getFieldsToSign({\n collectionConfig,\n email: user?.email as string,\n sid,\n user: args.req.user,\n })\n\n const { exp, token: refreshedToken } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n result = {\n exp,\n refreshedToken,\n setCookie: true,\n user,\n }\n }\n\n result.user = await applyUserReadAccess({\n collection: collectionConfig,\n depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n overrideAccess: false,\n req,\n showHiddenFields: false,\n user: result.user as AuthenticatedUser,\n })\n\n // /////////////////////////////////////\n // After Refresh - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterRefresh?.length) {\n for (const hook of collectionConfig.hooks.afterRefresh) {\n result =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n exp: result.exp,\n req: args.req,\n token: result.refreshedToken,\n })) \|\| result\n }\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'refresh',\n overrideAccess: false,\n result,\n })\n\n // /////////////////////////////////////\n // Return results\n // /////////////////////////////////////\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n return result\n } catch (error: unknown) {\n await killTransaction(args.req)\n throw error\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","APIError","Forbidden","NotFound","appendNonTrashedFilter","assertNoValidationWrite","commitTransaction","httpStatus","initTransaction","killTransaction","applyUserReadAccess","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","req","shouldCommit","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","slug","FORBIDDEN","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updateOne","data","updatedAt","returning","locale","undefined","enableTrash","Boolean","trash","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","depth","showHiddenFields","afterRefresh","length","hook","context","error"],"mappings":"AAIA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,EAAEC,QAAQ,QAAQ,wBAAuB;AACrE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AActD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEXV,wBAAwBW,KAAKC,GAAG;IAEhC,IAAI;QACF,MAAMC,eAAe,MAAMV,gBAAgBQ,KAAKC,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCD,OAAO,MAAMhB,qBAAqB;YAChCgB;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCN,GAAG,EACHA,KAAK,EACHO,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKC,GAAG,CAACS,IAAI,EAAE;YAClB,MAAM,IAAIxB,UAAUc,KAAKC,GAAG,CAACU,CAAC;QAChC;QACA,IAAIX,KAAKC,GAAG,CAACS,IAAI,CAACP,UAAU,KAAKI,iBAAiBK,IAAI,EAAE;YACtD,MAAM,IAAI3B,SAAS,wBAAwBM,WAAWsB,SAAS;QACjE;QAEA,MAAMC,WAAW,IAAIC,IAAIf,KAAKC,GAAG,CAACe,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaV,OAAOc,MAAM,CAACC,OAAO;QAEpD,IAAIT,OAAO,MAAMT,IAAIO,OAAO,CAACY,EAAE,CAACC,OAAO,CAAoB;YACzDlB,YAAYI,iBAAiBK,IAAI;YACjCX;YACAqB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQxB,KAAKC,GAAG,CAACS,IAAI,CAACa,EAAE;gBAAC;YAAE;QAC5C;QAEA,IAAI,CAACb,MAAM;YACT,MAAM,IAAIxB,UAAUc,KAAKC,GAAG,CAACU,CAAC;QAChC;QAEA,MAAMc,MAAMzB,KAAKC,GAAG,CAACS,IAAI,CAACgB,IAAI;QAE9B,IAAInB,iBAAiBoB,IAAI,CAACC,WAAW,IAAI,CAACrB,iBAAiBoB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACrB,KAAKsB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIvC,UAAUc,KAAKC,GAAG,CAACU,CAAC;YAChC;YAEA,MAAMsB,kBAAkBvB,KAAKsB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAE,GAAKA,OAAOE;YAE9D,IAAI,CAACQ,iBAAiB;gBACpB,MAAM,IAAI/C,UAAUc,KAAKC,GAAG,CAACU,CAAC;YAChC;YAEA,MAAMwB,MAAM,IAAIC;YAChB,MAAMC,eAAe9B,iBAAiBoB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,MAAMpC,IAAIO,OAAO,CAACY,EAAE,CAACqB,SAAS,CAAC;gBAC7BlB,IAAIb,KAAKa,EAAE;gBACXpB,YAAYI,iBAAiBK,IAAI;gBACjC8B,MAAM;oBACJ,GAAGhC,IAAI;oBACP,sEAAsE;oBACtEsB,UAAUnC,sBAAsBa,KAAKsB,QAAQ;oBAC7CW,WAAW;gBACb;gBACA1C;gBACA2C,WAAW;YACb;QACF;QAEAlC,OAAO,MAAMT,IAAIO,OAAO,CAACY,EAAE,CAACC,OAAO,CAAC;YAClClB,YAAYI,iBAAiBK,IAAI;YACjCiC,QAAQ5C,IAAI4C,MAAM,IAAIC;YACtB7C;YACAqB,OAAOlC,uBAAuB;gBAC5B2D,aAAaC,QAAQzC,iBAAiB0C,KAAK;gBAC3CA,OAAO;gBACP3B,OAAO;oBAAEC,IAAI;wBAAEC,QAAQd,KAAKa,EAAE;oBAAC;gBAAE;YACnC;QACF;QAEA,IAAI,CAACb,MAAM;YACT,MAAM,IAAIvB,SAASc,IAAIU,CAAC;QAC1B;QAEAD,KAAKP,UAAU,GAAGH,KAAKC,GAAG,CAACS,IAAI,CAACP,UAAU;QAC1CO,KAAKwC,SAAS,GAAGlD,KAAKC,GAAG,CAACS,IAAI,CAACwC,SAAS;QAExC,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAepD,KAAKG,UAAU,CAACC,MAAM,CAACiD,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEpD;gBAAMU;YAAK;YAElD,IAAI6C,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAe7D,gBAAgB;gBACnCY;gBACAkD,OAAO/C,MAAM+C;gBACbhC;gBACAf,MAAMV,KAAKC,GAAG,CAACS,IAAI;YACrB;YAEA,MAAM,EAAEgD,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAMhE,QAAQ;gBACnD4D;gBACA/C;gBACA6B,iBAAiB/B,iBAAiBoB,IAAI,CAACW,eAAe;YACxD;YAEAa,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACXnD;YACF;QACF;QAEAyC,OAAOzC,IAAI,GAAG,MAAMhB,oBAAoB;YACtCS,YAAYI;YACZuD,OAAO7C,YAAY,IAAIV,iBAAiBoB,IAAI,CAACmC,KAAK;YAClDxD,gBAAgB;YAChBL;YACA8D,kBAAkB;YAClBrD,MAAMyC,OAAOzC,IAAI;QACnB;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB8C,KAAK,EAAEW,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQ3D,iBAAiB8C,KAAK,CAACW,YAAY,CAAE;gBACtDb,SACE,AAAC,MAAMe,KAAK;oBACV/D,YAAYH,KAAKG,UAAU,EAAEC;oBAC7B+D,SAASnE,KAAKC,GAAG,CAACkE,OAAO;oBACzBT,KAAKP,OAAOO,GAAG;oBACfzD,KAAKD,KAAKC,GAAG;oBACb0D,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAMpE,oBAAoB;YACjCiB;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChB6C;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAIjD,cAAc;YAChB,MAAMZ,kBAAkBW;QAC1B;QAEA,OAAOkD;IACT,EAAE,OAAOiB,OAAgB;QACvB,MAAM3E,gBAAgBO,KAAKC,GAAG;QAC9B,MAAMmE;IACR;AACF,EAAC"}
1	+ {"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden, NotFound } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { refreshAuthToken } from '../refreshAuthToken.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n exp: number\n refreshedToken: string\n /** The next refresh token, when refreshing with a refresh token. /\n refreshToken?: string\n setCookie?: boolean\n user: Document\n}\n\nexport type Arguments = {\n collection: Collection\n /\n A refresh token from login to refresh with, instead of the request's token. Unlike the\n * request's token, it still works after the token expired. Collection `refresh` hooks don't run\n * for it, since they replace refreshing with the request's token.\n /\n refreshToken?: string\n req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n let args = incomingArgs\n\n assertNoValidationWrite(args.req)\n\n try {\n const shouldCommit = await initTransaction(args.req)\n\n // /////////////////////////////////////\n // beforeOperation - Collection\n // /////////////////////////////////////\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'refresh',\n overrideAccess: false,\n })\n\n // /////////////////////////////////////\n // Refresh\n // /////////////////////////////////////\n\n const {\n collection: { config: collectionConfig },\n req,\n req: {\n payload: { config, secret },\n },\n } = args\n\n const refreshed = args.refreshToken\n ? await refreshAuthToken({\n collection: collectionConfig.slug,\n refreshToken: args.refreshToken,\n req,\n })\n : undefined\n\n if (args.refreshToken && !refreshed) {\n // Commit, so a reused refresh token's session stays logged out\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n throw new Forbidden(args.req.t)\n }\n if (!refreshed) {\n if (!args.req.user) {\n throw new Forbidden(args.req.t)\n }\n if (args.req.user.collection !== collectionConfig.slug) {\n throw new APIError('Incorrect collection', httpStatus.FORBIDDEN)\n }\n }\n\n const pathname = new URL(args.req.url!).pathname\n\n const isGraphQL = pathname === config.routes.graphQL\n\n let user = await req.payload.db.findOne<AuthenticatedUser>({\n collection: collectionConfig.slug,\n req,\n where: { id: { equals: refreshed?.user.id ?? args.req.user!.id } },\n })\n\n if (!user) {\n throw new Forbidden(args.req.t)\n }\n\n const sid = args.req.user?._sid\n\n // refreshAuthToken already refreshed the refresh token's session\n if (\n !refreshed &&\n collectionConfig.auth.useSessions &&\n !collectionConfig.auth.disableLocalStrategy\n ) {\n if (!Array.isArray(user.sessions) \|\| !sid) {\n throw new Forbidden(args.req.t)\n }\n\n const existingSession = user.sessions.find(({ id }) => id === sid)\n\n if (!existingSession) {\n throw new Forbidden(args.req.t)\n }\n\n const now = new Date()\n const tokenExpInMs = collectionConfig.auth.tokenExpiration 1000\n const tokenExpiresAt = new Date(now.getTime() + tokenExpInMs)\n\n // Don't shorten sessions that outlast their tokens. Moving the expiry of a session with a\n // refresh token would also make its refresh token look reused.\n if (new Date(existingSession.expiresAt) < tokenExpiresAt) {\n existingSession.expiresAt = tokenExpiresAt\n }\n\n await req.payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: {\n ...user,\n // Prevent updatedAt from being updated when only refreshing a session\n sessions: removeExpiredSessions(user.sessions),\n updatedAt: null,\n },\n req,\n returning: false,\n })\n }\n\n user = await req.payload.db.findOne({\n collection: collectionConfig.slug,\n locale: req.locale ?? undefined,\n req,\n where: appendNonTrashedFilter({\n enableTrash: Boolean(collectionConfig.trash),\n trash: false,\n where: { id: { equals: user.id } },\n }),\n })\n\n if (!user) {\n throw new NotFound(req.t)\n }\n\n user.collection = collectionConfig.slug\n user._strategy = refreshed ? 'local-jwt' : args.req.user!._strategy\n\n let result!: Result\n\n if (refreshed) {\n result = {\n exp: refreshed.exp,\n refreshedToken: refreshed.token,\n refreshToken: refreshed.refreshToken,\n setCookie: true,\n user,\n }\n } else {\n // /////////////////////////////////////\n // refresh hook - Collection\n // /////////////////////////////////////\n\n for (const refreshHook of args.collection.config.hooks.refresh) {\n const hookResult = await refreshHook({ args, user })\n\n if (hookResult) {\n result = hookResult\n break\n }\n }\n }\n\n if (!result) {\n const fieldsToSign = getFieldsToSign({\n collectionConfig,\n email: user?.email as string,\n sid,\n user: args.req.user,\n })\n\n const { exp, token: refreshedToken } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n result = {\n exp,\n refreshedToken,\n setCookie: true,\n user,\n }\n }\n\n result.user = await applyUserReadAccess({\n collection: collectionConfig,\n depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n overrideAccess: false,\n req,\n showHiddenFields: false,\n user: result.user as AuthenticatedUser,\n })\n\n // /////////////////////////////////////\n // After Refresh - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterRefresh?.length) {\n for (const hook of collectionConfig.hooks.afterRefresh) {\n result =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n exp: result.exp,\n req: args.req,\n token: result.refreshedToken,\n })) \|\| result\n }\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'refresh',\n overrideAccess: false,\n result,\n })\n\n // /////////////////////////////////////\n // Return results\n // /////////////////////////////////////\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n return result\n } catch (error: unknown) {\n await killTransaction(args.req)\n throw error\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","APIError","Forbidden","NotFound","appendNonTrashedFilter","assertNoValidationWrite","commitTransaction","httpStatus","initTransaction","killTransaction","applyUserReadAccess","getFieldsToSign","jwtSign","refreshAuthToken","removeExpiredSessions","refreshOperation","incomingArgs","args","req","shouldCommit","collection","config","operation","overrideAccess","collectionConfig","payload","secret","refreshed","refreshToken","slug","undefined","t","user","FORBIDDEN","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","tokenExpiresAt","getTime","expiresAt","updateOne","data","updatedAt","returning","locale","enableTrash","Boolean","trash","_strategy","result","exp","refreshedToken","token","setCookie","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","depth","showHiddenFields","afterRefresh","length","hook","context","error"],"mappings":"AAIA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,EAAEC,QAAQ,QAAQ,wBAAuB;AACrE,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,QAAQ,yBAAwB;AACzD,SAASC,qBAAqB,QAAQ,iBAAgB;AAsBtD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEXX,wBAAwBY,KAAKC,GAAG;IAEhC,IAAI;QACF,MAAMC,eAAe,MAAMX,gBAAgBS,KAAKC,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCD,OAAO,MAAMjB,qBAAqB;YAChCiB;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCN,GAAG,EACHA,KAAK,EACHO,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,MAAMU,YAAYV,KAAKW,YAAY,GAC/B,MAAMf,iBAAiB;YACrBO,YAAYI,iBAAiBK,IAAI;YACjCD,cAAcX,KAAKW,YAAY;YAC/BV;QACF,KACAY;QAEJ,IAAIb,KAAKW,YAAY,IAAI,CAACD,WAAW;YACnC,+DAA+D;YAC/D,IAAIR,cAAc;gBAChB,MAAMb,kBAAkBY;YAC1B;YAEA,MAAM,IAAIhB,UAAUe,KAAKC,GAAG,CAACa,CAAC;QAChC;QACA,IAAI,CAACJ,WAAW;YACd,IAAI,CAACV,KAAKC,GAAG,CAACc,IAAI,EAAE;gBAClB,MAAM,IAAI9B,UAAUe,KAAKC,GAAG,CAACa,CAAC;YAChC;YACA,IAAId,KAAKC,GAAG,CAACc,IAAI,CAACZ,UAAU,KAAKI,iBAAiBK,IAAI,EAAE;gBACtD,MAAM,IAAI5B,SAAS,wBAAwBM,WAAW0B,SAAS;YACjE;QACF;QAEA,MAAMC,WAAW,IAAIC,IAAIlB,KAAKC,GAAG,CAACkB,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAab,OAAOiB,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMd,IAAIO,OAAO,CAACe,EAAE,CAACC,OAAO,CAAoB;YACzDrB,YAAYI,iBAAiBK,IAAI;YACjCX;YACAwB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQjB,WAAWK,KAAKW,MAAM1B,KAAKC,GAAG,CAACc,IAAI,CAAEW,EAAE;gBAAC;YAAE;QACnE;QAEA,IAAI,CAACX,MAAM;YACT,MAAM,IAAI9B,UAAUe,KAAKC,GAAG,CAACa,CAAC;QAChC;QAEA,MAAMc,MAAM5B,KAAKC,GAAG,CAACc,IAAI,EAAEc;QAE3B,iEAAiE;QACjE,IACE,CAACnB,aACDH,iBAAiBuB,IAAI,CAACC,WAAW,IACjC,CAACxB,iBAAiBuB,IAAI,CAACE,oBAAoB,EAC3C;YACA,IAAI,CAACC,MAAMC,OAAO,CAACnB,KAAKoB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAI3C,UAAUe,KAAKC,GAAG,CAACa,CAAC;YAChC;YAEA,MAAMsB,kBAAkBrB,KAAKoB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAE,GAAKA,OAAOE;YAE9D,IAAI,CAACQ,iBAAiB;gBACpB,MAAM,IAAInD,UAAUe,KAAKC,GAAG,CAACa,CAAC;YAChC;YAEA,MAAMwB,MAAM,IAAIC;YAChB,MAAMC,eAAejC,iBAAiBuB,IAAI,CAACW,eAAe,GAAG;YAC7D,MAAMC,iBAAiB,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAEhD,0FAA0F;YAC1F,+DAA+D;YAC/D,IAAI,IAAID,KAAKH,gBAAgBQ,SAAS,IAAIF,gBAAgB;gBACxDN,gBAAgBQ,SAAS,GAAGF;YAC9B;YAEA,MAAMzC,IAAIO,OAAO,CAACe,EAAE,CAACsB,SAAS,CAAC;gBAC7BnB,IAAIX,KAAKW,EAAE;gBACXvB,YAAYI,iBAAiBK,IAAI;gBACjCkC,MAAM;oBACJ,GAAG/B,IAAI;oBACP,sEAAsE;oBACtEoB,UAAUtC,sBAAsBkB,KAAKoB,QAAQ;oBAC7CY,WAAW;gBACb;gBACA9C;gBACA+C,WAAW;YACb;QACF;QAEAjC,OAAO,MAAMd,IAAIO,OAAO,CAACe,EAAE,CAACC,OAAO,CAAC;YAClCrB,YAAYI,iBAAiBK,IAAI;YACjCqC,QAAQhD,IAAIgD,MAAM,IAAIpC;YACtBZ;YACAwB,OAAOtC,uBAAuB;gBAC5B+D,aAAaC,QAAQ5C,iBAAiB6C,KAAK;gBAC3CA,OAAO;gBACP3B,OAAO;oBAAEC,IAAI;wBAAEC,QAAQZ,KAAKW,EAAE;oBAAC;gBAAE;YACnC;QACF;QAEA,IAAI,CAACX,MAAM;YACT,MAAM,IAAI7B,SAASe,IAAIa,CAAC;QAC1B;QAEAC,KAAKZ,UAAU,GAAGI,iBAAiBK,IAAI;QACvCG,KAAKsC,SAAS,GAAG3C,YAAY,cAAcV,KAAKC,GAAG,CAACc,IAAI,CAAEsC,SAAS;QAEnE,IAAIC;QAEJ,IAAI5C,WAAW;YACb4C,SAAS;gBACPC,KAAK7C,UAAU6C,GAAG;gBAClBC,gBAAgB9C,UAAU+C,KAAK;gBAC/B9C,cAAcD,UAAUC,YAAY;gBACpC+C,WAAW;gBACX3C;YACF;QACF,OAAO;YACL,wCAAwC;YACxC,4BAA4B;YAC5B,wCAAwC;YAExC,KAAK,MAAM4C,eAAe3D,KAAKG,UAAU,CAACC,MAAM,CAACwD,KAAK,CAACC,OAAO,CAAE;gBAC9D,MAAMC,aAAa,MAAMH,YAAY;oBAAE3D;oBAAMe;gBAAK;gBAElD,IAAI+C,YAAY;oBACdR,SAASQ;oBACT;gBACF;YACF;QACF;QAEA,IAAI,CAACR,QAAQ;YACX,MAAMS,eAAerE,gBAAgB;gBACnCa;gBACAyD,OAAOjD,MAAMiD;gBACbpC;gBACAb,MAAMf,KAAKC,GAAG,CAACc,IAAI;YACrB;YAEA,MAAM,EAAEwC,GAAG,EAAEE,OAAOD,cAAc,EAAE,GAAG,MAAM7D,QAAQ;gBACnDoE;gBACAtD;gBACAgC,iBAAiBlC,iBAAiBuB,IAAI,CAACW,eAAe;YACxD;YAEAa,SAAS;gBACPC;gBACAC;gBACAE,WAAW;gBACX3C;YACF;QACF;QAEAuC,OAAOvC,IAAI,GAAG,MAAMtB,oBAAoB;YACtCU,YAAYI;YACZ0D,OAAO7C,YAAY,IAAIb,iBAAiBuB,IAAI,CAACmC,KAAK;YAClD3D,gBAAgB;YAChBL;YACAiE,kBAAkB;YAClBnD,MAAMuC,OAAOvC,IAAI;QACnB;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIR,iBAAiBqD,KAAK,EAAEO,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQ9D,iBAAiBqD,KAAK,CAACO,YAAY,CAAE;gBACtDb,SACE,AAAC,MAAMe,KAAK;oBACVlE,YAAYH,KAAKG,UAAU,EAAEC;oBAC7BkE,SAAStE,KAAKC,GAAG,CAACqE,OAAO;oBACzBf,KAAKD,OAAOC,GAAG;oBACftD,KAAKD,KAAKC,GAAG;oBACbwD,OAAOH,OAAOE,cAAc;gBAC9B,MAAOF;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAMxE,oBAAoB;YACjCkB;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChBgD;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAIpD,cAAc;YAChB,MAAMb,kBAAkBY;QAC1B;QAEA,OAAOqD;IACT,EAAE,OAAOiB,OAAgB;QACvB,MAAM/E,gBAAgBQ,KAAKC,GAAG;QAC9B,MAAMsE;IACR;AACF,EAAC"}

package/dist/auth/operations/resetPassword.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,~~EAAE~~,UAAU,~~EAA0B~~,MAAM,mCAAmC,CAAA;~~AAC3F~~,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,gBAAgB,CAAA;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;~~AAkB1D~~,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,QACrE,SAAS,KACd,OAAO,CAAC,MAAM,~~CAyOhB~~,CAAA"}
1	+ {"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/resetPassword.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,mCAAmC,CAAA;AAE1C,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,gBAAgB,CAAA;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAiB1D,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,SAAS,kBAAkB,QACrE,SAAS,KACd,OAAO,CAAC,MAAM,CA4NhB,CAAA"}

package/dist/auth/operations/resetPassword.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js';
 import { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js';
-import { APIError, Forbidden } from '../../errors/index.js';
+import { APIError, Forbidden, ValidationError } from '../../errors/index.js';
 import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js';
 import { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js';
 import { commitTransaction } from '../../utilities/commitTransaction.js';
@@ -8,13 +8,12 @@ import { httpStatus } from '../../utilities/httpStatus.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 import { applyUserReadAccess } from '../applyUserReadAccess.js';
-import { getFieldsToSign } from '../getFieldsToSign.js';
-import { jwtSign } from '../jwt.js';
-import { addSessionToUser, revokeSession } from '../sessions.js';
+import { createAuthToken } from '../createAuthToken.js';
+import { revokeSession } from '../sessions.js';
 import { authenticateLocalStrategy } from '../strategies/local/authenticate.js';
 import { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js';
 export const resetPasswordOperation = async (args)=>{
-    const { collection: { config: collectionConfig }, data, depth, overrideAccess = false, req: { payload: { secret }, payload }, req } = args;
+    const { collection: { config: collectionConfig }, data, depth, overrideAccess = false, req: { payload }, req } = args;
     assertNoValidationWrite(req);
     if (!Object.prototype.hasOwnProperty.call(data, 'token') || !Object.prototype.hasOwnProperty.call(data, 'password')) {
         throw new APIError('Missing required data.', httpStatus.BAD_REQUEST);
@@ -55,6 +54,13 @@ export const resetPasswordOperation = async (args)=>{
         if (!user) {
             throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN);
         }
+        await validatePasswordField({
+            collectionConfig,
+            overrideAccess,
+            password: data.password,
+            req,
+            user
+        });
         // TODO: replace this method
         const { hash, salt } = await generatePasswordSaltHash({
             collection: collectionConfig,
@@ -106,23 +112,14 @@ export const resetPasswordOperation = async (args)=>{
         user = doc;
         user.collection = collectionConfig.slug;
         user._strategy = 'local-jwt';
-        const fieldsToSignArgs = {
+        const { token, ...session } = await createAuthToken({
             collectionConfig,
             email: user.email,
-            user
-        };
-        const session = await addSessionToUser({
-            collectionConfig,
-            payload,
             req,
             user
         });
         sessionUser = user;
         sid = session.sid;
-        if (sid) {
-            fieldsToSignArgs.sid = sid;
-        }
-        const fieldsToSign = getFieldsToSign(fieldsToSignArgs);
         // /////////////////////////////////////
         // beforeLogin - Collection
         // /////////////////////////////////////
@@ -136,11 +133,6 @@ export const resetPasswordOperation = async (args)=>{
                 }) || user;
             }
         }
-        const { token } = await jwtSign({
-            fieldsToSign,
-            secret,
-            tokenExpiration: collectionConfig.auth.tokenExpiration
-        });
         req.user = user;
         // /////////////////////////////////////
         // afterLogin - Collection
@@ -198,5 +190,47 @@ export const resetPasswordOperation = async (args)=>{
         throw error;
     }
 };
+/**
+ * Runs the `password` field override's validation, which `payload.db.updateOne` skips.
+ */ async function validatePasswordField({ collectionConfig, overrideAccess, password, req, user }) {
+    const passwordField = collectionConfig.flattenedFields.find((field)=>field.name === 'password');
+    if (!passwordField || !('validate' in passwordField) || !passwordField.validate) {
+        return;
+    }
+    const validate = passwordField.validate;
+    const dataToValidate = {
+        ...user,
+        password
+    };
+    const validationResult = await validate(password, {
+        ...passwordField,
+        id: user.id,
+        blockData: {},
+        collectionSlug: collectionConfig.slug,
+        data: dataToValidate,
+        event: 'submit',
+        operation: 'update',
+        overrideAccess,
+        path: [
+            'password'
+        ],
+        preferences: {
+            fields: {}
+        },
+        req,
+        siblingData: dataToValidate
+    });
+    if (typeof validationResult === 'string') {
+        throw new ValidationError({
+            collection: collectionConfig.slug,
+            errors: [
+                {
+                    message: validationResult,
+                    path: 'password'
+                }
+            ]
+        });
+    }
+}
 //# sourceMappingURL=resetPassword.js.map

package/dist/auth/operations/resetPassword.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, AuthenticatedUser } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n token?: string\n user: Record<string, unknown>\n}\n\nexport type Arguments = {\n collection: Collection\n data: {\n password: string\n token: string\n }\n depth?: number\n overrideAccess?: boolean\n req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n args: Arguments,\n): Promise<Result> => {\n const {\n collection: { config: collectionConfig },\n data,\n depth,\n overrideAccess = false,\n req: {\n payload: { secret },\n payload,\n },\n req,\n } = args\n\n assertNoValidationWrite(req)\n\n if (\n !Object.prototype.hasOwnProperty.call(data, 'token') \|\|\n !Object.prototype.hasOwnProperty.call(data, 'password')\n ) {\n throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n }\n\n if (collectionConfig.auth.disableLocalStrategy) {\n throw new Forbidden(req.t)\n }\n\n let sid: string \| undefined\n let sessionUser: AuthenticatedUser \| null = null\n\n try {\n const shouldCommit = await initTransaction(req)\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'resetPassword',\n overrideAccess,\n })\n\n // /////////////////////////////////////\n // Reset Password\n // /////////////////////////////////////\n\n const where = appendNonTrashedFilter({\n enableTrash: Boolean(collectionConfig.trash),\n trash: false,\n where: {\n resetPasswordExpiration: { greater_than: new Date().toISOString() },\n resetPasswordToken: { equals: data.token },\n },\n })\n\n let user = await payload.db.findOne<AuthenticatedUser>({\n collection: collectionConfig.slug,\n req,\n where,\n })\n\n if (!user) {\n throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n }\n\n // TODO: replace this method\n const { hash, salt } = await generatePasswordSaltHash({\n collection: collectionConfig,\n password: data.password,\n req,\n })\n\n user.salt = salt\n user.hash = hash\n\n user.resetPasswordExpiration = new Date().toISOString()\n\n if (collectionConfig.auth.maxLoginAttempts > 0) {\n user.lockUntil = null\n user.loginAttempts = 0\n }\n\n if (collectionConfig.auth.verify) {\n user._verified = Boolean(user._verified)\n }\n\n // /////////////////////////////////////\n // beforeValidate - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeValidate?.length) {\n for (const hook of collectionConfig.hooks.beforeValidate) {\n await hook({\n collection: args.collection?.config,\n context: req.context,\n data: user,\n operation: 'update',\n req,\n })\n }\n }\n\n // /////////////////////////////////////\n // Update new password\n // /////////////////////////////////////\n\n // Ensure updatedAt date is always updated\n user.updatedAt = new Date().toISOString()\n\n if (collectionConfig.auth.useSessions) {\n user.sessions = []\n }\n\n const doc = await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: user,\n req,\n })\n\n await authenticateLocalStrategy({ doc, password: data.password })\n\n user = doc as AuthenticatedUser\n user.collection = collectionConfig.slug\n user._strategy = 'local-jwt'\n\n const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n collectionConfig,\n email: user.email!,\n user,\n }\n\n const session = await addSessionToUser({\n collectionConfig,\n payload,\n req,\n user,\n })\n\n sessionUser = user\n sid = session.sid\n\n if (sid) {\n fieldsToSignArgs.sid = sid\n }\n\n const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n // /////////////////////////////////////\n // beforeLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeLogin?.length) {\n for (const hook of collectionConfig.hooks.beforeLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n user,\n })) \|\| user\n }\n }\n\n const { token } = await jwtSign({\n fieldsToSign,\n secret,\n tokenExpiration: collectionConfig.auth.tokenExpiration,\n })\n\n req.user = user\n\n // /////////////////////////////////////\n // afterLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterLogin?.length) {\n for (const hook of collectionConfig.hooks.afterLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n token,\n user,\n })) \|\| user\n }\n }\n\n user!.collection = collectionConfig.slug\n user!._strategy = 'local-jwt'\n\n const userWithReadAccess = await applyUserReadAccess({\n collection: collectionConfig,\n depth: depth!,\n overrideAccess,\n req,\n showHiddenFields: false,\n user: user!,\n })\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n token,\n user: userWithReadAccess,\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'resetPassword',\n overrideAccess,\n result,\n })\n\n return result\n } catch (error: unknown) {\n if (sid) {\n await revokeSession({\n collectionConfig,\n payload,\n req,\n sid,\n user: sessionUser,\n })\n }\n await killTransaction(req)\n throw error\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","assertNoValidationWrite","commitTransaction","httpStatus","initTransaction","killTransaction","applyUserReadAccess","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","sessionUser","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","user","db","findOne","slug","FORBIDDEN","hash","salt","password","maxLoginAttempts","lockUntil","loginAttempts","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","useSessions","sessions","doc","updateOne","id","_strategy","fieldsToSignArgs","email","session","fieldsToSign","beforeLogin","tokenExpiration","afterLogin","userWithReadAccess","showHiddenFields","result","error"],"mappings":"AAIA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,iBAAiB,KAAK,EACtBC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJb,wBAAwBoB;IAExB,IACE,CAACG,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIpB,SAAS,0BAA0BK,WAAWyB,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI/B,UAAUsB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,cAAwC;IAE5C,IAAI;QACF,MAAMC,eAAe,MAAM9B,gBAAgBiB;QAE3CP,OAAO,MAAMjB,qBAAqB;YAChCiB;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQpC,uBAAuB;YACnCqC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEA,IAAIC,OAAO,MAAMzB,QAAQ0B,EAAE,CAACC,OAAO,CAAoB;YACrDlC,YAAYE,iBAAiBiC,IAAI;YACjC7B;YACAe;QACF;QAEA,IAAI,CAACW,MAAM;YACT,MAAM,IAAIjD,SAAS,2CAA2CK,WAAWgD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMzC,yBAAyB;YACpDG,YAAYE;YACZqC,UAAUpC,KAAKoC,QAAQ;YACvBjC;QACF;QAEA0B,KAAKM,IAAI,GAAGA;QACZN,KAAKK,IAAI,GAAGA;QAEZL,KAAKP,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAAC0B,gBAAgB,GAAG,GAAG;YAC9CR,KAAKS,SAAS,GAAG;YACjBT,KAAKU,aAAa,GAAG;QACvB;QAEA,IAAIxC,iBAAiBY,IAAI,CAAC6B,MAAM,EAAE;YAChCX,KAAKY,SAAS,GAAGrB,QAAQS,KAAKY,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAI1C,iBAAiB2C,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACThD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAAS3C,IAAI2C,OAAO;oBACpB9C,MAAM6B;oBACNZ,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1C0B,KAAKkB,SAAS,GAAG,IAAIvB,OAAOC,WAAW;QAEvC,IAAI1B,iBAAiBY,IAAI,CAACqC,WAAW,EAAE;YACrCnB,KAAKoB,QAAQ,GAAG,EAAE;QACpB;QAEA,MAAMC,MAAM,MAAM9C,QAAQ0B,EAAE,CAACqB,SAAS,CAAC;YACrCC,IAAIvB,KAAKuB,EAAE;YACXvD,YAAYE,iBAAiBiC,IAAI;YACjChC,MAAM6B;YACN1B;QACF;QAEA,MAAMV,0BAA0B;YAAEyD;YAAKd,UAAUpC,KAAKoC,QAAQ;QAAC;QAE/DP,OAAOqB;QACPrB,KAAKhC,UAAU,GAAGE,iBAAiBiC,IAAI;QACvCH,KAAKwB,SAAS,GAAG;QAEjB,MAAMC,mBAA0D;YAC9DvD;YACAwD,OAAO1B,KAAK0B,KAAK;YACjB1B;QACF;QAEA,MAAM2B,UAAU,MAAMjE,iBAAiB;YACrCQ;YACAK;YACAD;YACA0B;QACF;QAEAd,cAAcc;QACdf,MAAM0C,QAAQ1C,GAAG;QAEjB,IAAIA,KAAK;YACPwC,iBAAiBxC,GAAG,GAAGA;QACzB;QAEA,MAAM2C,eAAepE,gBAAgBiE;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAIvD,iBAAiB2C,KAAK,EAAEgB,aAAad,QAAQ;YAC/C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACgB,WAAW,CAAE;gBACrD7B,OACE,AAAC,MAAMgB,KAAK;oBACVhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACb0B;gBACF,MAAOA;YACX;QACF;QAEA,MAAM,EAAED,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9BmE;YACApD;YACAsD,iBAAiB5D,iBAAiBY,IAAI,CAACgD,eAAe;QACxD;QAEAxD,IAAI0B,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAI9B,iBAAiB2C,KAAK,EAAEkB,YAAYhB,QAAQ;YAC9C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACkB,UAAU,CAAE;gBACpD/B,OACE,AAAC,MAAMgB,KAAK;oBACVhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACbyB;oBACAC;gBACF,MAAOA;YACX;QACF;QAEAA,KAAMhC,UAAU,GAAGE,iBAAiBiC,IAAI;QACxCH,KAAMwB,SAAS,GAAG;QAElB,MAAMQ,qBAAqB,MAAMzE,oBAAoB;YACnDS,YAAYE;YACZE,OAAOA;YACPC;YACAC;YACA2D,kBAAkB;YAClBjC,MAAMA;QACR;QAEA,IAAIb,cAAc;YAChB,MAAMhC,kBAAkBmB;QAC1B;QAEA,IAAI4D,SAA2D;YAC7DnC;YACAC,MAAMgC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCE,SAAS,MAAMrF,oBAAoB;YACjCkB;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACA6D;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAIlD,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAe,MAAMd;YACR;QACF;QACA,MAAM5B,gBAAgBgB;QACtB,MAAM6D;IACR;AACF,EAAC"}
1	+ {"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import type {\n Collection,\n DataFromCollectionSlug,\n SanitizedCollectionConfig,\n} from '../../collections/config/types.js'\nimport type { Validate } from '../../fields/config/types.js'\nimport type { AuthCollectionSlug, AuthenticatedUser } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden, ValidationError } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { createAuthToken } from '../createAuthToken.js'\nimport { revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n token?: string\n user: Record<string, unknown>\n}\n\nexport type Arguments = {\n collection: Collection\n data: {\n password: string\n token: string\n }\n depth?: number\n overrideAccess?: boolean\n req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n args: Arguments,\n): Promise<Result> => {\n const {\n collection: { config: collectionConfig },\n data,\n depth,\n overrideAccess = false,\n req: { payload },\n req,\n } = args\n\n assertNoValidationWrite(req)\n\n if (\n !Object.prototype.hasOwnProperty.call(data, 'token') \|\|\n !Object.prototype.hasOwnProperty.call(data, 'password')\n ) {\n throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n }\n\n if (collectionConfig.auth.disableLocalStrategy) {\n throw new Forbidden(req.t)\n }\n\n let sid: string \| undefined\n let sessionUser: AuthenticatedUser \| null = null\n\n try {\n const shouldCommit = await initTransaction(req)\n\n args = await buildBeforeOperation({\n args,\n collection: args.collection.config,\n operation: 'resetPassword',\n overrideAccess,\n })\n\n // /////////////////////////////////////\n // Reset Password\n // /////////////////////////////////////\n\n const where = appendNonTrashedFilter({\n enableTrash: Boolean(collectionConfig.trash),\n trash: false,\n where: {\n resetPasswordExpiration: { greater_than: new Date().toISOString() },\n resetPasswordToken: { equals: data.token },\n },\n })\n\n let user = await payload.db.findOne<AuthenticatedUser>({\n collection: collectionConfig.slug,\n req,\n where,\n })\n\n if (!user) {\n throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n }\n\n await validatePasswordField({\n collectionConfig,\n overrideAccess,\n password: data.password,\n req,\n user,\n })\n\n // TODO: replace this method\n const { hash, salt } = await generatePasswordSaltHash({\n collection: collectionConfig,\n password: data.password,\n req,\n })\n\n user.salt = salt\n user.hash = hash\n\n user.resetPasswordExpiration = new Date().toISOString()\n\n if (collectionConfig.auth.maxLoginAttempts > 0) {\n user.lockUntil = null\n user.loginAttempts = 0\n }\n\n if (collectionConfig.auth.verify) {\n user._verified = Boolean(user._verified)\n }\n\n // /////////////////////////////////////\n // beforeValidate - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeValidate?.length) {\n for (const hook of collectionConfig.hooks.beforeValidate) {\n await hook({\n collection: args.collection?.config,\n context: req.context,\n data: user,\n operation: 'update',\n req,\n })\n }\n }\n\n // /////////////////////////////////////\n // Update new password\n // /////////////////////////////////////\n\n // Ensure updatedAt date is always updated\n user.updatedAt = new Date().toISOString()\n\n if (collectionConfig.auth.useSessions) {\n user.sessions = []\n }\n\n const doc = await payload.db.updateOne({\n id: user.id,\n collection: collectionConfig.slug,\n data: user,\n req,\n })\n\n await authenticateLocalStrategy({ doc, password: data.password })\n\n user = doc as AuthenticatedUser\n user.collection = collectionConfig.slug\n user._strategy = 'local-jwt'\n\n const { token, ...session } = await createAuthToken({\n collectionConfig,\n email: user.email!,\n req,\n user,\n })\n\n sessionUser = user\n sid = session.sid\n\n // /////////////////////////////////////\n // beforeLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.beforeLogin?.length) {\n for (const hook of collectionConfig.hooks.beforeLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n user,\n })) \|\| user\n }\n }\n\n req.user = user\n\n // /////////////////////////////////////\n // afterLogin - Collection\n // /////////////////////////////////////\n\n if (collectionConfig.hooks?.afterLogin?.length) {\n for (const hook of collectionConfig.hooks.afterLogin) {\n user =\n (await hook({\n collection: args.collection?.config,\n context: args.req.context,\n req: args.req,\n token,\n user,\n })) \|\| user\n }\n }\n\n user!.collection = collectionConfig.slug\n user!._strategy = 'local-jwt'\n\n const userWithReadAccess = await applyUserReadAccess({\n collection: collectionConfig,\n depth: depth!,\n overrideAccess,\n req,\n showHiddenFields: false,\n user: user!,\n })\n\n if (shouldCommit) {\n await commitTransaction(req)\n }\n\n let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n token,\n user: userWithReadAccess,\n }\n\n // /////////////////////////////////////\n // afterOperation - Collection\n // /////////////////////////////////////\n\n result = await buildAfterOperation({\n args,\n collection: args.collection?.config,\n operation: 'resetPassword',\n overrideAccess,\n result,\n })\n\n return result\n } catch (error: unknown) {\n if (sid) {\n await revokeSession({\n collectionConfig,\n payload,\n req,\n sid,\n user: sessionUser,\n })\n }\n await killTransaction(req)\n throw error\n }\n}\n\n/*\n Runs the `password` field override's validation, which `payload.db.updateOne` skips.\n */\nasync function validatePasswordField({\n collectionConfig,\n overrideAccess,\n password,\n req,\n user,\n}: {\n collectionConfig: SanitizedCollectionConfig\n overrideAccess: boolean\n password: string\n req: PayloadRequest\n user: AuthenticatedUser\n}): Promise<void> {\n const passwordField = collectionConfig.flattenedFields.find((field) => field.name === 'password')\n\n if (!passwordField \|\| !('validate' in passwordField) \|\| !passwordField.validate) {\n return\n }\n\n const validate = passwordField.validate as Validate<string>\n const dataToValidate = { ...user, password }\n\n const validationResult = await validate(password, {\n ...passwordField,\n id: user.id,\n blockData: {},\n collectionSlug: collectionConfig.slug,\n data: dataToValidate,\n event: 'submit',\n operation: 'update',\n overrideAccess,\n path: ['password'],\n preferences: { fields: {} },\n req,\n siblingData: dataToValidate,\n })\n\n if (typeof validationResult === 'string') {\n throw new ValidationError({\n collection: collectionConfig.slug,\n errors: [{ message: validationResult, path: 'password' }],\n })\n }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","APIError","Forbidden","ValidationError","appendNonTrashedFilter","assertNoValidationWrite","commitTransaction","httpStatus","initTransaction","killTransaction","applyUserReadAccess","createAuthToken","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","sessionUser","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","user","db","findOne","slug","FORBIDDEN","validatePasswordField","password","hash","salt","maxLoginAttempts","lockUntil","loginAttempts","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","useSessions","sessions","doc","updateOne","id","_strategy","session","email","beforeLogin","afterLogin","userWithReadAccess","showHiddenFields","result","error","passwordField","flattenedFields","find","field","name","validate","dataToValidate","validationResult","blockData","collectionSlug","event","path","preferences","fields","siblingData","errors","message"],"mappings":"AASA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,EAAEC,eAAe,QAAQ,wBAAuB;AAC5E,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,aAAa,QAAQ,iBAAgB;AAC9C,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,iBAAiB,KAAK,EACtBC,KAAK,EAAEC,OAAO,EAAE,EAChBD,GAAG,EACJ,GAAGP;IAEJX,wBAAwBkB;IAExB,IACE,CAACE,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,MAAM,YAC5C,CAACK,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,MAAM,aAC5C;QACA,MAAM,IAAInB,SAAS,0BAA0BM,WAAWsB,WAAW;IACrE;IAEA,IAAIV,iBAAiBW,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI7B,UAAUqB,IAAIS,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,cAAwC;IAE5C,IAAI;QACF,MAAMC,eAAe,MAAM3B,gBAAgBe;QAE3CP,OAAO,MAAMhB,qBAAqB;YAChCgB;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCkB,WAAW;YACXd;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMe,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQpB,iBAAiBqB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ1B,KAAK2B,KAAK;gBAAC;YAC3C;QACF;QAEA,IAAIC,OAAO,MAAMxB,QAAQyB,EAAE,CAACC,OAAO,CAAoB;YACrDjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAc;QACF;QAEA,IAAI,CAACW,MAAM;YACT,MAAM,IAAI/C,SAAS,2CAA2CM,WAAW6C,SAAS;QACpF;QAEA,MAAMC,sBAAsB;YAC1BlC;YACAG;YACAgC,UAAUlC,KAAKkC,QAAQ;YACvB/B;YACAyB;QACF;QAEA,4BAA4B;QAC5B,MAAM,EAAEO,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAM1C,yBAAyB;YACpDG,YAAYE;YACZmC,UAAUlC,KAAKkC,QAAQ;YACvB/B;QACF;QAEAyB,KAAKQ,IAAI,GAAGA;QACZR,KAAKO,IAAI,GAAGA;QAEZP,KAAKP,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAIzB,iBAAiBW,IAAI,CAAC2B,gBAAgB,GAAG,GAAG;YAC9CT,KAAKU,SAAS,GAAG;YACjBV,KAAKW,aAAa,GAAG;QACvB;QAEA,IAAIxC,iBAAiBW,IAAI,CAAC8B,MAAM,EAAE;YAChCZ,KAAKa,SAAS,GAAGtB,QAAQS,KAAKa,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAI1C,iBAAiB2C,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACThD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAAS3C,IAAI2C,OAAO;oBACpB9C,MAAM4B;oBACNZ,WAAW;oBACXb;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CyB,KAAKmB,SAAS,GAAG,IAAIxB,OAAOC,WAAW;QAEvC,IAAIzB,iBAAiBW,IAAI,CAACsC,WAAW,EAAE;YACrCpB,KAAKqB,QAAQ,GAAG,EAAE;QACpB;QAEA,MAAMC,MAAM,MAAM9C,QAAQyB,EAAE,CAACsB,SAAS,CAAC;YACrCC,IAAIxB,KAAKwB,EAAE;YACXvD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAM4B;YACNzB;QACF;QAEA,MAAMV,0BAA0B;YAAEyD;YAAKhB,UAAUlC,KAAKkC,QAAQ;QAAC;QAE/DN,OAAOsB;QACPtB,KAAK/B,UAAU,GAAGE,iBAAiBgC,IAAI;QACvCH,KAAKyB,SAAS,GAAG;QAEjB,MAAM,EAAE1B,KAAK,EAAE,GAAG2B,SAAS,GAAG,MAAM/D,gBAAgB;YAClDQ;YACAwD,OAAO3B,KAAK2B,KAAK;YACjBpD;YACAyB;QACF;QAEAd,cAAcc;QACdf,MAAMyC,QAAQzC,GAAG;QAEjB,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAId,iBAAiB2C,KAAK,EAAEc,aAAaZ,QAAQ;YAC/C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACc,WAAW,CAAE;gBACrD5B,OACE,AAAC,MAAMiB,KAAK;oBACVhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACbyB;gBACF,MAAOA;YACX;QACF;QAEAzB,IAAIyB,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAI7B,iBAAiB2C,KAAK,EAAEe,YAAYb,QAAQ;YAC9C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACe,UAAU,CAAE;gBACpD7B,OACE,AAAC,MAAMiB,KAAK;oBACVhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACbwB;oBACAC;gBACF,MAAOA;YACX;QACF;QAEAA,KAAM/B,UAAU,GAAGE,iBAAiBgC,IAAI;QACxCH,KAAMyB,SAAS,GAAG;QAElB,MAAMK,qBAAqB,MAAMpE,oBAAoB;YACnDO,YAAYE;YACZE,OAAOA;YACPC;YACAC;YACAwD,kBAAkB;YAClB/B,MAAMA;QACR;QAEA,IAAIb,cAAc;YAChB,MAAM7B,kBAAkBiB;QAC1B;QAEA,IAAIyD,SAA2D;YAC7DjC;YACAC,MAAM8B;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCE,SAAS,MAAMjF,oBAAoB;YACjCiB;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BkB,WAAW;YACXd;YACA0D;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAIhD,KAAK;YACP,MAAMrB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAU;gBACAe,MAAMd;YACR;QACF;QACA,MAAMzB,gBAAgBc;QACtB,MAAM0D;IACR;AACF,EAAC;AAED;;CAEC,GACD,eAAe5B,sBAAsB,EACnClC,gBAAgB,EAChBG,cAAc,EACdgC,QAAQ,EACR/B,GAAG,EACHyB,IAAI,EAOL;IACC,MAAMkC,gBAAgB/D,iBAAiBgE,eAAe,CAACC,IAAI,CAAC,CAACC,QAAUA,MAAMC,IAAI,KAAK;IAEtF,IAAI,CAACJ,iBAAiB,CAAE,CAAA,cAAcA,aAAY,KAAM,CAACA,cAAcK,QAAQ,EAAE;QAC/E;IACF;IAEA,MAAMA,WAAWL,cAAcK,QAAQ;IACvC,MAAMC,iBAAiB;QAAE,GAAGxC,IAAI;QAAEM;IAAS;IAE3C,MAAMmC,mBAAmB,MAAMF,SAASjC,UAAU;QAChD,GAAG4B,aAAa;QAChBV,IAAIxB,KAAKwB,EAAE;QACXkB,WAAW,CAAC;QACZC,gBAAgBxE,iBAAiBgC,IAAI;QACrC/B,MAAMoE;QACNI,OAAO;QACPxD,WAAW;QACXd;QACAuE,MAAM;YAAC;SAAW;QAClBC,aAAa;YAAEC,QAAQ,CAAC;QAAE;QAC1BxE;QACAyE,aAAaR;IACf;IAEA,IAAI,OAAOC,qBAAqB,UAAU;QACxC,MAAM,IAAItF,gBAAgB;YACxBc,YAAYE,iBAAiBgC,IAAI;YACjC8C,QAAQ;gBAAC;oBAAEC,SAAST;oBAAkBI,MAAM;gBAAW;aAAE;QAC3D;IACF;AACF"}

package/dist/auth/refreshAuthToken.d.ts ADDED Viewed

@@ -0,0 +1,32 @@
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { AuthenticatedUser, UserSession } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+/**
+ * Trades a refresh token from `createAuthToken` or an earlier refresh for a new token and a new
+ * refresh token. Every refresh moves the session's `expiresAt`, which the refresh token remembers,
+ * so a refresh token with an outdated one was already used. That means it was copied, and its
+ * session is logged out.
+ *
+ * @returns `null` when the refresh token is invalid, its session ended, or it was reused
+ */
+export declare const refreshAuthToken: ({ collection, refreshToken, req, }: {
+    /** Only accept refresh tokens of this collection. */
+    collection?: string;
+    refreshToken: string;
+    req: PayloadRequest;
+}) => Promise<{
+    collectionConfig: SanitizedCollectionConfig;
+    exp: number;
+    refreshToken: string;
+    token: string;
+    user: AuthenticatedUser;
+} | null>;
+/** How many seconds a session with a refresh token lasts from each refresh. */
+export declare const getRefreshTokenExpiration: (collectionConfig: SanitizedCollectionConfig) => number;
+export declare const createRefreshToken: ({ collectionConfig, req, session, userID, }: {
+    collectionConfig: SanitizedCollectionConfig;
+    req: PayloadRequest;
+    session: UserSession;
+    userID: number | string;
+}) => string;
+//# sourceMappingURL=refreshAuthToken.d.ts.map

package/dist/auth/refreshAuthToken.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"refreshAuthToken.d.ts","sourceRoot":"","sources":["../../src/auth/refreshAuthToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAuBvD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,uCAI1B;IACD,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,iBAAiB,CAAA;CACxB,GAAG,IAAI,CA4DP,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,qBAAsB,yBAAyB,KAAG,MAGrD,CAAA;AAEnC,eAAO,MAAM,kBAAkB,gDAK5B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;IACnB,OAAO,EAAE,WAAW,CAAA;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;CACxB,KAAG,MAQD,CAAA"}