payload 4.0.0-internal.ea6e8f8 → 4.0.0-internal.ee5d8bd

package/dist/branching/preflight.js

@@ -1,757 +0,0 @@
-import { executeAccess } from '../auth/executeAccess.js';
-import { hasWhereAccessResult } from '../auth/types.js';
-import { traverseForLocalizedFields } from '../utilities/traverseForLocalizedFields.js';
-import { getLatestCollectionVersion } from '../versions/getLatestCollectionVersion.js';
-import { getLatestGlobalVersion } from '../versions/getLatestGlobalVersion.js';
-import { getPossibleRelationshipCollectionSlugs, hasBranchCreatedDocumentReference, hasConfiguredRelationshipValue } from './assertBranchCreatedDocumentsUnreferenced.js';
-import { checkFieldAccess } from './checkFieldAccess.js';
-import { getGlobalMergeLocales, readBranchGlobalWrite, resolveGlobalMergeWrites } from './globalMergeWrites.js';
-import { readLocalizedBranchWrite } from './readLocalizedBranchWrite.js';
-import { isolateBranchState } from './resolveBranch.js';
-import { stripBranchMergeData, stripBranchMergeGlobalData } from './stripBranchMergeData.js';
-import { branchChangesCollectionSlug, branchDocIDField, branchField, MAIN_BRANCH } from './types.js';
-/**
- * Flattens resolved changes into the operations each one performs.
- *
- * A content change has one latest source-state operation. A separate Trash
- * transition can add another permission check for the same change.
- */ const toPendingOperations = (pending)=>pending.flatMap((resolved)=>resolved.writes.map((write, index)=>({
-                collectionSlug: resolved.collectionSlug,
-                operation: write.operation,
-                previousWrite: resolved.writes[index - 1],
-                resolved,
-                write
-            })));
-/**
- * Checks the merging user's production permission for every change.
- *
- * A branch is a proposal; nothing on it is real until merge, which is what
- * makes permissive branch writes safe. This is therefore the enforcement
- * boundary, not a second check layered on top of one.
- *
- * Access functions receive the exact data each effective write proposes. A
- * data-dependent result cannot be shared between documents, so each write is
- * evaluated separately.
- */ export const runMergePreflight = async ({ payload, pending, req })=>{
-    const blocked = [];
-    const blockedChangeIDs = new Set();
-    for (const item of toPendingOperations(pending)){
-        const { collectionSlug, operation, resolved } = item;
-        const changeID = String(resolved.change.id);
-        const collectionConfig = payload.collections[collectionSlug]?.config;
-        if (!collectionConfig || blockedChangeIDs.has(changeID)) {
-            continue;
-        }
-        // Publishing is not a distinct access type in Payload — it is `update`
-        // evaluated against published data, which is how the admin UI derives
-        // whether the publish button is available.
-        const accessType = operation === 'publish' ? 'update' : operation;
-        const accessFn = collectionConfig.access?.[accessType];
-        const deny = ()=>{
-            if (blockedChangeIDs.has(changeID)) {
-                return;
-            }
-            blockedChangeIDs.add(changeID);
-            blocked.push({
-                changeID: resolved.change.id,
-                collectionSlug,
-                docID: resolved.docID,
-                docTitle: String(resolved.docID),
-                message: `You don't have permission to ${operation} "${collectionSlug}" document ${resolved.docID}.`,
-                operation,
-                reason: 'access'
-            });
-        };
-        const proposedWrites = await getProposedWrites({
-            collectionSlug,
-            item,
-            payload,
-            req
-        });
-        for (const proposed of proposedWrites){
-            const result = accessFn ? await executeAccess({
-                id: operation === 'create' ? undefined : resolved.docID,
-                slug: collectionSlug,
-                data: proposed.data,
-                disableErrors: true,
-                req: proposed.req
-            }, accessFn) : true;
-            if (!result) {
-                deny();
-                break;
-            }
-            let currentDoc = {};
-            if (operation !== 'create') {
-                const where = {
-                    and: [
-                        ...hasWhereAccessResult(result) ? [
-                            result
-                        ] : [],
-                        {
-                            [branchField]: {
-                                equals: MAIN_BRANCH
-                            }
-                        },
-                        {
-                            id: {
-                                equals: resolved.docID
-                            }
-                        }
-                    ]
-                };
-                if (proposed.previousData) {
-                    currentDoc = proposed.previousData;
-                    if (hasWhereAccessResult(result)) {
-                        if (whereReferencesBranchMetadata(result)) {
-                            deny();
-                            break;
-                        }
-                        const precedingRowID = item.previousWrite?.data.id;
-                        const permittedPreviousState = precedingRowID === undefined ? null : await payload.db.findOne({
-                            branch: false,
-                            collection: collectionSlug,
-                            locale: proposed.locale,
-                            req: proposed.req,
-                            where: {
-                                and: [
-                                    result,
-                                    {
-                                        [branchField]: {
-                                            equals: resolved.change.branch
-                                        }
-                                    },
-                                    {
-                                        id: {
-                                            equals: precedingRowID
-                                        }
-                                    }
-                                ]
-                            }
-                        });
-                        if (!permittedPreviousState) {
-                            deny();
-                            break;
-                        }
-                    }
-                } else {
-                    const mainDoc = operation === 'delete' ? await payload.db.findOne({
-                        branch: false,
-                        collection: collectionSlug,
-                        locale: proposed.locale,
-                        req: proposed.req,
-                        where
-                    }) : await getLatestCollectionVersion({
-                        id: resolved.docID,
-                        config: collectionConfig,
-                        payload,
-                        query: {
-                            branch: false,
-                            collection: collectionSlug,
-                            locale: proposed.locale,
-                            where
-                        },
-                        req: proposed.req
-                    });
-                    currentDoc = mainDoc ?? {};
-                    if (hasWhereAccessResult(result) && !mainDoc) {
-                        deny();
-                        break;
-                    }
-                }
-            }
-            if (proposed.data && operation !== 'delete' && !await checkFieldAccess({
-                id: operation === 'create' ? undefined : resolved.docID,
-                collection: collectionConfig,
-                data: proposed.data,
-                doc: currentDoc,
-                global: null,
-                operation: operation === 'create' ? 'create' : 'update',
-                req: proposed.req
-            })) {
-                deny();
-                break;
-            }
-        }
-    }
-    return blocked;
-};
-/**
- * Returns the same logical data shapes that merge submits for one write.
- *
- * Localized updates are applied once per locale, so their access checks must
- * receive those per-locale values instead of the adapter's raw all-locale row.
- */ const getProposedWrites = async ({ collectionSlug, item, payload, req })=>{
-    if (item.operation === 'delete') {
-        return [
-            {
-                dataShape: 'flattened',
-                req
-            }
-        ];
-    }
-    const fields = payload.collections[collectionSlug].config.fields;
-    const localeCodes = payload.config.localization ? traverseForLocalizedFields(fields) ? payload.config.localization.localeCodes : undefined : undefined;
-    if (!localeCodes?.length) {
-        return [
-            {
-                data: stripBranchMergeData({
-                    data: item.write.data,
-                    fields
-                }),
-                dataShape: 'withLocales',
-                previousData: item.previousWrite ? stripBranchMergeData({
-                    data: item.previousWrite.data,
-                    fields
-                }) : undefined,
-                req
-            }
-        ];
-    }
-    const proposedWrites = [];
-    for (const locale of localeCodes){
-        const localeReq = withLocale({
-            locale,
-            req
-        });
-        const data = await readLocalizedBranchWrite({
-            branch: item.resolved.change.branch,
-            collectionSlug,
-            docID: item.resolved.docID,
-            draft: item.write.draft,
-            locale,
-            payload,
-            req: localeReq
-        });
-        if (!data) {
-            continue;
-        }
-        const previousData = item.previousWrite ? await readLocalizedBranchWrite({
-            branch: item.resolved.change.branch,
-            collectionSlug,
-            docID: item.resolved.docID,
-            draft: item.previousWrite.draft,
-            locale,
-            payload,
-            req: localeReq
-        }) : undefined;
-        proposedWrites.push({
-            data: stripBranchMergeData({
-                data,
-                fields
-            }),
-            dataShape: 'flattened',
-            locale,
-            previousData: previousData ? stripBranchMergeData({
-                data: previousData,
-                fields
-            }) : undefined,
-            req: localeReq
-        });
-    }
-    return proposedWrites;
-};
-const withLocale = ({ locale, req })=>{
-    const isolated = isolateBranchState(req);
-    isolated.locale = locale;
-    return isolated;
-};
-/**
- * The same enforcement boundary for globals.
- *
- * The branch copy is the exact data the merge will submit. A `Where` result is
- * applied to the current main global in the same way as an ordinary global update.
- */ export const runGlobalMergePreflight = async ({ payload, pending, req })=>{
-    const blocked = [];
-    for (const change of pending){
-        const branch = change.branch;
-        const globalSlug = change.globalSlug;
-        const globalConfig = payload.globals?.config?.find((each)=>each.slug === globalSlug);
-        if (!globalConfig) {
-            continue;
-        }
-        const writes = await resolveGlobalMergeWrites({
-            branch,
-            globalSlug,
-            payload,
-            req
-        });
-        const locales = getGlobalMergeLocales({
-            globalSlug,
-            payload,
-            req
-        });
-        const previousDataByLocale = new Map();
-        let hasAccess = writes.length > 0;
-        for (const write of writes){
-            for (const locale of locales){
-                const localeReq = withLocale({
-                    locale,
-                    req
-                });
-                const storedData = await readBranchGlobalWrite({
-                    branch,
-                    draft: write.draft,
-                    globalSlug,
-                    locale,
-                    payload,
-                    req: localeReq
-                });
-                if (!storedData) {
-                    hasAccess = false;
-                    break;
-                }
-                const data = stripBranchMergeGlobalData({
-                    data: storedData,
-                    fields: globalConfig.fields
-                });
-                const result = await executeAccess({
-                    slug: globalSlug,
-                    data,
-                    disableErrors: true,
-                    req: localeReq
-                }, globalConfig.access.update);
-                if (!result) {
-                    hasAccess = false;
-                    break;
-                }
-                const previousData = previousDataByLocale.get(locale);
-                let currentGlobal;
-                if (previousData) {
-                    currentGlobal = previousData;
-                    if (hasWhereAccessResult(result)) {
-                        if (whereReferencesBranchMetadata(result)) {
-                            hasAccess = false;
-                            break;
-                        }
-                        const permittedPreviousState = await payload.db.findGlobal({
-                            slug: globalSlug,
-                            branch: false,
-                            locale,
-                            req: localeReq,
-                            where: {
-                                and: [
-                                    result,
-                                    {
-                                        [branchField]: {
-                                            equals: branch
-                                        }
-                                    }
-                                ]
-                            }
-                        });
-                        if (!permittedPreviousState || Object.keys(permittedPreviousState).length === 0) {
-                            hasAccess = false;
-                            break;
-                        }
-                    }
-                } else {
-                    const { global, globalExists } = await getLatestGlobalVersion({
-                        slug: globalSlug,
-                        config: globalConfig,
-                        locale,
-                        payload,
-                        published: !write.draft,
-                        req: localeReq,
-                        storageWhere: {
-                            [branchField]: {
-                                equals: MAIN_BRANCH
-                            }
-                        },
-                        where: hasWhereAccessResult(result) ? result : undefined
-                    });
-                    currentGlobal = global ?? {};
-                    if (hasWhereAccessResult(result) && globalExists && Object.keys(currentGlobal).length === 0) {
-                        hasAccess = false;
-                        break;
-                    }
-                }
-                if (!await checkFieldAccess({
-                    collection: null,
-                    data,
-                    doc: currentGlobal,
-                    global: globalConfig,
-                    operation: 'update',
-                    req: localeReq
-                })) {
-                    hasAccess = false;
-                    break;
-                }
-                previousDataByLocale.set(locale, data);
-            }
-            if (!hasAccess) {
-                break;
-            }
-        }
-        if (!hasAccess) {
-            const label = typeof globalConfig.label === 'string' ? globalConfig.label : globalConfig.slug;
-            blocked.push({
-                changeID: change.id,
-                docTitle: label,
-                globalSlug,
-                message: `You do not have permission to update ${label}.`,
-                operation: 'update',
-                reason: 'access'
-            });
-        }
-    }
-    return blocked;
-};
-/**
- * Blocks selected changes that would make main refer to content which only exists on a branch.
- *
- * Dependencies are resolved as a group. This also handles chains: if one selected create is
- * blocked, every selected change which depends on that create becomes blocked in turn.
- */ export const runMergeDependencyPreflight = async ({ availableChangeIDs, initiallyBlocked, payload, pending, pendingGlobals, req })=>(await resolveMergeDependencies({
-        availableChangeIDs,
-        initiallyBlocked,
-        payload,
-        pending,
-        pendingGlobals,
-        req
-    })).blocked;
-export const hasUnavailableBranchCreatedDependency = async ({ availableChangeIDs, collectionSlug, data, globalSlug, payload, req })=>{
-    const fields = collectionSlug ? payload.collections[collectionSlug]?.config.flattenedFields : payload.globals.config.find(({ slug })=>slug === globalSlug)?.flattenedFields;
-    if (!fields) {
-        return false;
-    }
-    if (!hasConfiguredRelationshipValue({
-        data,
-        dataShape: 'withLocales',
-        fields,
-        payloadBlocks: payload.blocks
-    })) {
-        return false;
-    }
-    const collectionSlugs = getPossibleRelationshipCollectionSlugs({
-        fields,
-        payloadBlocks: payload.blocks
-    });
-    const branchCreates = await findPendingBranchCreates({
-        collectionSlugs,
-        payload,
-        req
-    });
-    return branchCreates.some((target)=>!availableChangeIDs?.has(String(target.changeID)) && hasBranchCreatedDocumentReference({
-            data,
-            dataShape: 'withLocales',
-            fields,
-            payloadBlocks: payload.blocks,
-            req,
-            target
-        }));
-};
-export const resolveMergeDependencies = async ({ availableChangeIDs, initiallyBlocked, payload, pending, pendingGlobals, req })=>{
-    if (!hasPendingRelationshipValues({
-        payload,
-        pending,
-        pendingGlobals
-    })) {
-        return {
-            blocked: [],
-            dependencyChangeIDsByChangeID: new Map()
-        };
-    }
-    // Deliberately spans every branch. A stored relationship can name a document
-    // created on another branch, and that target is unavailable on main too.
-    const collectionSlugs = getDependencyCollectionSlugs({
-        payload,
-        pending,
-        pendingGlobals
-    });
-    const branchCreates = await findPendingBranchCreates({
-        collectionSlugs,
-        payload,
-        req
-    });
-    if (!branchCreates.length) {
-        return {
-            blocked: [],
-            dependencyChangeIDsByChangeID: new Map()
-        };
-    }
-    const blockedChangeIDs = new Set(initiallyBlocked.map(({ changeID })=>String(changeID)));
-    const selectedChangeIDs = new Set([
-        ...availableChangeIDs ?? [],
-        ...pending.map(({ change })=>String(change.id)),
-        ...pendingGlobals.map(({ id })=>String(id))
-    ]);
-    const candidates = [];
-    for (const resolved of pending){
-        if (blockedChangeIDs.has(String(resolved.change.id))) {
-            continue;
-        }
-        const collectionConfig = payload.collections[resolved.collectionSlug]?.config;
-        if (!collectionConfig) {
-            continue;
-        }
-        const dependencyChangeIDs = new Set();
-        for (const item of toPendingOperations([
-            resolved
-        ])){
-            if (item.operation === 'delete') {
-                continue;
-            }
-            const proposedWrites = await getProposedWrites({
-                collectionSlug: resolved.collectionSlug,
-                item,
-                payload,
-                req
-            });
-            for (const proposed of proposedWrites){
-                if (!proposed.data) {
-                    continue;
-                }
-                addReferencedBranchCreates({
-                    branchCreates,
-                    data: proposed.data,
-                    dataShape: proposed.dataShape,
-                    dependencyChangeIDs,
-                    fields: collectionConfig.flattenedFields,
-                    payload,
-                    req: proposed.req
-                });
-            }
-        }
-        if (dependencyChangeIDs.size) {
-            candidates.push({
-                blockedChange: {
-                    changeID: resolved.change.id,
-                    collectionSlug: resolved.collectionSlug,
-                    docID: resolved.docID,
-                    docTitle: String(resolved.docID),
-                    message: 'This change refers to branch-created content that will not be available on main.',
-                    operation: resolved.writes.find((write)=>!write.trashState)?.operation ?? resolved.writes[0]?.operation ?? 'update',
-                    reason: 'dependency'
-                },
-                dependencyChangeIDs
-            });
-        }
-    }
-    for (const change of pendingGlobals){
-        if (blockedChangeIDs.has(String(change.id))) {
-            continue;
-        }
-        const branch = change.branch;
-        const globalSlug = change.globalSlug;
-        const globalConfig = payload.globals.config.find(({ slug })=>slug === globalSlug);
-        if (!globalConfig) {
-            continue;
-        }
-        const dependencyChangeIDs = new Set();
-        const writes = await resolveGlobalMergeWrites({
-            branch,
-            globalSlug,
-            payload,
-            req
-        });
-        const locales = getGlobalMergeLocales({
-            globalSlug,
-            payload,
-            req
-        });
-        for (const write of writes){
-            for (const locale of locales){
-                const localeReq = withLocale({
-                    locale,
-                    req
-                });
-                const storedData = await readBranchGlobalWrite({
-                    branch,
-                    draft: write.draft,
-                    globalSlug,
-                    locale,
-                    payload,
-                    req: localeReq
-                });
-                if (!storedData) {
-                    continue;
-                }
-                addReferencedBranchCreates({
-                    branchCreates,
-                    data: stripBranchMergeGlobalData({
-                        data: storedData,
-                        fields: globalConfig.fields
-                    }),
-                    dataShape: 'flattened',
-                    dependencyChangeIDs,
-                    fields: globalConfig.flattenedFields,
-                    payload,
-                    req: localeReq
-                });
-            }
-        }
-        if (dependencyChangeIDs.size) {
-            candidates.push({
-                blockedChange: {
-                    changeID: change.id,
-                    docTitle: globalSlug,
-                    globalSlug,
-                    message: 'This change refers to branch-created content that will not be available on main.',
-                    operation: 'update',
-                    reason: 'dependency'
-                },
-                dependencyChangeIDs
-            });
-        }
-    }
-    const dependencyBlocked = [];
-    const dependencyChangeIDsByChangeID = new Map(candidates.map(({ blockedChange, dependencyChangeIDs })=>[
-            String(blockedChange.changeID),
-            dependencyChangeIDs
-        ]));
-    let hasNewlyBlockedChange = true;
-    while(hasNewlyBlockedChange){
-        hasNewlyBlockedChange = false;
-        for (const candidate of candidates){
-            const changeID = String(candidate.blockedChange.changeID);
-            if (blockedChangeIDs.has(changeID)) {
-                continue;
-            }
-            const hasUnavailableDependency = [
-                ...candidate.dependencyChangeIDs
-            ].some((dependencyChangeID)=>!selectedChangeIDs.has(dependencyChangeID) || blockedChangeIDs.has(dependencyChangeID));
-            if (hasUnavailableDependency) {
-                blockedChangeIDs.add(changeID);
-                dependencyBlocked.push(candidate.blockedChange);
-                hasNewlyBlockedChange = true;
-            }
-        }
-    }
-    return {
-        blocked: dependencyBlocked,
-        dependencyChangeIDsByChangeID
-    };
-};
-const hasPendingRelationshipValues = ({ payload, pending, pendingGlobals })=>{
-    if (pendingGlobals.length) {
-        return true;
-    }
-    return pending.some((resolved)=>{
-        const fields = payload.collections[resolved.collectionSlug]?.config.flattenedFields;
-        if (!fields) {
-            return false;
-        }
-        return resolved.writes.some((write)=>write.operation !== 'delete' && hasConfiguredRelationshipValue({
-                data: write.data,
-                dataShape: 'withLocales',
-                fields,
-                payloadBlocks: payload.blocks
-            }));
-    });
-};
-const findPendingBranchCreates = async ({ collectionSlugs, payload, req })=>{
-    if (collectionSlugs?.size === 0) {
-        return [];
-    }
-    const pendingBranchCreates = await payload.find({
-        collection: branchChangesCollectionSlug,
-        depth: 0,
-        limit: 0,
-        overrideAccess: true,
-        pagination: false,
-        req,
-        where: {
-            and: [
-                {
-                    entityType: {
-                        equals: 'collection'
-                    }
-                },
-                {
-                    operation: {
-                        equals: 'create'
-                    }
-                },
-                ...collectionSlugs ? [
-                    {
-                        collectionSlug: {
-                            in: [
-                                ...collectionSlugs
-                            ]
-                        }
-                    }
-                ] : []
-            ]
-        }
-    });
-    return getBranchCreateChanges({
-        changes: pendingBranchCreates.docs
-    });
-};
-const getDependencyCollectionSlugs = ({ payload, pending, pendingGlobals })=>{
-    const collectionSlugs = new Set();
-    const fieldTrees = [
-        ...pending.map(({ collectionSlug })=>payload.collections[collectionSlug]?.config.flattenedFields),
-        ...pendingGlobals.map((change)=>payload.globals.config.find(({ slug })=>slug === change.globalSlug)?.flattenedFields)
-    ];
-    for (const fields of fieldTrees){
-        if (!fields) {
-            continue;
-        }
-        const possibleCollectionSlugs = getPossibleRelationshipCollectionSlugs({
-            fields,
-            payloadBlocks: payload.blocks
-        });
-        if (!possibleCollectionSlugs) {
-            return undefined;
-        }
-        for (const collectionSlug of possibleCollectionSlugs){
-            collectionSlugs.add(collectionSlug);
-        }
-    }
-    return collectionSlugs;
-};
-const getBranchCreateChanges = ({ changes })=>changes.flatMap((change)=>{
-        if (change.entityType === 'global' || change.operation !== 'create') {
-            return [];
-        }
-        const collectionSlug = change.collectionSlug;
-        const docID = getChangeDocumentID({
-            change
-        });
-        if (typeof collectionSlug !== 'string' || typeof docID !== 'number' && typeof docID !== 'string' || typeof change.id !== 'number' && typeof change.id !== 'string') {
-            return [];
-        }
-        return [
-            {
-                changeID: change.id,
-                collectionSlug,
-                docID
-            }
-        ];
-    });
-const getChangeDocumentID = ({ change })=>{
-    const doc = change.doc;
-    if (doc && typeof doc === 'object' && 'value' in doc) {
-        return doc.value;
-    }
-    return doc;
-};
-const addReferencedBranchCreates = ({ branchCreates, data, dataShape, dependencyChangeIDs, fields, payload, req })=>{
-    for (const target of branchCreates){
-        if (hasBranchCreatedDocumentReference({
-            data,
-            dataShape,
-            fields,
-            payloadBlocks: payload.blocks,
-            req,
-            target
-        })) {
-            dependencyChangeIDs.add(String(target.changeID));
-        }
-    }
-};
-const whereReferencesBranchMetadata = (value)=>{
-    if (Array.isArray(value)) {
-        return value.some(whereReferencesBranchMetadata);
-    }
-    if (!value || typeof value !== 'object') {
-        return false;
-    }
-    return Object.entries(value).some(([key, nestedValue])=>[
-            branchDocIDField,
-            branchField
-        ].includes(key.split('.')[0]) || whereReferencesBranchMetadata(nestedValue));
-};
-
-//# sourceMappingURL=preflight.js.map