payload 4.0.0-internal.fa183d3 → 4.0.0-internal.fec2230

package/dist/auth/operations/auth.js

@@ -1,30 +1,24 @@
-import { killTransaction } from '../../utilities/killTransaction.js';
 import { executeAuthStrategies } from '../executeAuthStrategies.js';
 import { getAccessResults } from '../getAccessResults.js';
 export const auth = async (args)=>{
     const { canSetHeaders, headers } = args;
     const req = args.req;
     const { payload } = req;
-    try {
-        const { responseHeaders, user } = await executeAuthStrategies({
-            canSetHeaders,
-            headers,
-            payload
-        });
-        req.user = user;
-        req.responseHeaders = responseHeaders;
-        const permissions = await getAccessResults({
-            req
-        });
-        return {
-            permissions,
-            responseHeaders,
-            user
-        };
-    } catch (error) {
-        await killTransaction(req);
-        throw error;
-    }
+    const { responseHeaders, user } = await executeAuthStrategies({
+        canSetHeaders,
+        headers,
+        payload
+    });
+    req.user = user;
+    req.responseHeaders = responseHeaders;
+    const permissions = await getAccessResults({
+        req
+    });
+    return {
+        permissions,
+        responseHeaders,
+        user
+    };
 };
 
 //# sourceMappingURL=auth.js.map

package/dist/auth/operations/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/auth.ts"],"sourcesContent":["import type { AuthenticatedUser, SanitizedPermissions } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAuthStrategies } from '../executeAuthStrategies.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\nexport type AuthArgs = {\n  /**\n   * Specify if it's possible for auth strategies to set headers within this operation.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  req?: Omit<PayloadRequest, 'user'>\n}\n\nexport type AuthResult = {\n  permissions: SanitizedPermissions\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport const auth = async (args: Required<AuthArgs>): Promise<AuthResult> => {\n  const { canSetHeaders, headers } = args\n  const req = args.req as PayloadRequest\n  const { payload } = req\n\n  try {\n    const { responseHeaders, user } = await executeAuthStrategies({\n      canSetHeaders,\n      headers,\n      payload,\n    })\n\n    req.user = user\n    req.responseHeaders = responseHeaders\n\n    const permissions = await getAccessResults({\n      req,\n    })\n\n    return {\n      permissions,\n      responseHeaders,\n      user,\n    }\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["killTransaction","executeAuthStrategies","getAccessResults","auth","args","canSetHeaders","headers","req","payload","responseHeaders","user","permissions","error"],"mappings":"AAGA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,gBAAgB,QAAQ,yBAAwB;AAiBzD,OAAO,MAAMC,OAAO,OAAOC;IACzB,MAAM,EAAEC,aAAa,EAAEC,OAAO,EAAE,GAAGF;IACnC,MAAMG,MAAMH,KAAKG,GAAG;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAGD;IAEpB,IAAI;QACF,MAAM,EAAEE,eAAe,EAAEC,IAAI,EAAE,GAAG,MAAMT,sBAAsB;YAC5DI;YACAC;YACAE;QACF;QAEAD,IAAIG,IAAI,GAAGA;QACXH,IAAIE,eAAe,GAAGA;QAEtB,MAAME,cAAc,MAAMT,iBAAiB;YACzCK;QACF;QAEA,OAAO;YACLI;YACAF;YACAC;QACF;IACF,EAAE,OAAOE,OAAgB;QACvB,MAAMZ,gBAAgBO;QACtB,MAAMK;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/auth.ts"],"sourcesContent":["import type { AuthenticatedUser, SanitizedPermissions } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { executeAuthStrategies } from '../executeAuthStrategies.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\nexport type AuthArgs = {\n  /**\n   * Specify if it's possible for auth strategies to set headers within this operation.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  req?: Omit<PayloadRequest, 'user'>\n}\n\nexport type AuthResult = {\n  permissions: SanitizedPermissions\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport const auth = async (args: Required<AuthArgs>): Promise<AuthResult> => {\n  const { canSetHeaders, headers } = args\n  const req = args.req as PayloadRequest\n  const { payload } = req\n\n  const { responseHeaders, user } = await executeAuthStrategies({\n    canSetHeaders,\n    headers,\n    payload,\n  })\n\n  req.user = user\n  req.responseHeaders = responseHeaders\n\n  const permissions = await getAccessResults({\n    req,\n  })\n\n  return {\n    permissions,\n    responseHeaders,\n    user,\n  }\n}\n"],"names":["executeAuthStrategies","getAccessResults","auth","args","canSetHeaders","headers","req","payload","responseHeaders","user","permissions"],"mappings":"AAGA,SAASA,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,gBAAgB,QAAQ,yBAAwB;AAiBzD,OAAO,MAAMC,OAAO,OAAOC;IACzB,MAAM,EAAEC,aAAa,EAAEC,OAAO,EAAE,GAAGF;IACnC,MAAMG,MAAMH,KAAKG,GAAG;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAGD;IAEpB,MAAM,EAAEE,eAAe,EAAEC,IAAI,EAAE,GAAG,MAAMT,sBAAsB;QAC5DI;QACAC;QACAE;IACF;IAEAD,IAAIG,IAAI,GAAGA;IACXH,IAAIE,eAAe,GAAGA;IAEtB,MAAME,cAAc,MAAMT,iBAAiB;QACzCK;IACF;IAEA,OAAO;QACLI;QACAF;QACAC;IACF;AACF,EAAC"}

package/dist/auth/operations/me.d.ts

@@ -4,13 +4,6 @@ import type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../
 export type MeOperationResult = {
     collection?: string;
     exp?: number;
-    /** @deprecated
-     * use:
-     * ```ts
-     * user._strategy
-     * ```
-     */
-    strategy?: string;
     token?: string;
     user?: AuthenticatedUser | null;
 };

package/dist/auth/operations/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/me.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAE/F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,WAAW,SAAgB,SAAS,KAAG,OAAO,CAAC,iBAAiB,CA2F5E,CAAA"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/me.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAE/F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,WAAW,SAAgB,SAAS,KAAG,OAAO,CAAC,iBAAiB,CAoF5E,CAAA"}

package/dist/auth/operations/me.js

@@ -43,12 +43,6 @@ export const meOperation = async (args)=>{
             }
         }
         result.collection = req.user.collection;
-        /** @deprecated
-     * use:
-     * ```ts
-     * user._strategy
-     * ```
-     */ result.strategy = req.user._strategy;
         if (!result.user) {
             result.user = user;
             if (currentToken) {

package/dist/auth/operations/me.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/me.ts"],"sourcesContent":["import { decodeJwt } from 'jose'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../types/index.js'\n\nexport type MeOperationResult = {\n  collection?: string\n  exp?: number\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  token?: string\n  user?: AuthenticatedUser | null\n}\n\nexport type Arguments = {\n  collection: Collection\n  currentToken?: string\n  depth?: number\n  draft?: boolean\n  joins?: JoinQuery\n  populate?: PopulateType\n  req: PayloadRequest\n  select?: SelectType\n}\n\nexport const meOperation = async (args: Arguments): Promise<MeOperationResult> => {\n  const { collection, currentToken, depth, draft, joins, populate, req, select } = args\n\n  let result: MeOperationResult = {\n    user: null!,\n  }\n\n  if (req.user) {\n    if (req.user.collection !== collection.config.slug) {\n      return {\n        user: null!,\n      }\n    }\n\n    const { pathname } = req\n    const isGraphQL = pathname === `/api${req.payload.config.routes.graphQL}`\n\n    const user = (await req.payload.findByID({\n      id: req.user.id,\n      collection: collection.config.slug,\n      depth: isGraphQL ? 0 : (depth ?? collection.config.auth.depth),\n      draft,\n      joins,\n      overrideAccess: false,\n      populate,\n      req,\n      select,\n      showHiddenFields: false,\n    })) as AuthenticatedUser\n\n    if (user) {\n      user.collection = collection.config.slug\n      user._strategy = req.user._strategy\n    }\n\n    // /////////////////////////////////////\n    // me hook - Collection\n    // /////////////////////////////////////\n\n    for (const meHook of collection.config.hooks.me) {\n      const hookResult = await meHook({ args, user })\n\n      if (hookResult) {\n        result.user = hookResult.user\n        result.exp = hookResult.exp\n\n        break\n      }\n    }\n\n    result.collection = req.user.collection\n    /** @deprecated\n     * use:\n     * ```ts\n     * user._strategy\n     * ```\n     */\n    result.strategy = req.user._strategy\n\n    if (!result.user) {\n      result.user = user\n\n      if (currentToken) {\n        const decoded = decodeJwt(currentToken)\n        if (decoded) {\n          result.exp = decoded.exp\n        }\n        if (!collection.config.auth.removeTokenFromResponses) {\n          result.token = currentToken\n        }\n      }\n    }\n  }\n\n  // /////////////////////////////////////\n  // After Me - Collection\n  // /////////////////////////////////////\n\n  if (collection.config.hooks?.afterMe?.length) {\n    for (const hook of collection.config.hooks.afterMe) {\n      result =\n        (await hook({\n          collection: collection?.config,\n          context: req.context,\n          req,\n          response: result,\n        })) || result\n    }\n  }\n\n  return result\n}\n"],"names":["decodeJwt","meOperation","args","collection","currentToken","depth","draft","joins","populate","req","select","result","user","config","slug","pathname","isGraphQL","payload","routes","graphQL","findByID","id","auth","overrideAccess","showHiddenFields","_strategy","meHook","hooks","me","hookResult","exp","strategy","decoded","removeTokenFromResponses","token","afterMe","length","hook","context","response"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AA+BhC,OAAO,MAAMC,cAAc,OAAOC;IAChC,MAAM,EAAEC,UAAU,EAAEC,YAAY,EAAEC,KAAK,EAAEC,KAAK,EAAEC,KAAK,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,MAAM,EAAE,GAAGR;IAEjF,IAAIS,SAA4B;QAC9BC,MAAM;IACR;IAEA,IAAIH,IAAIG,IAAI,EAAE;QACZ,IAAIH,IAAIG,IAAI,CAACT,UAAU,KAAKA,WAAWU,MAAM,CAACC,IAAI,EAAE;YAClD,OAAO;gBACLF,MAAM;YACR;QACF;QAEA,MAAM,EAAEG,QAAQ,EAAE,GAAGN;QACrB,MAAMO,YAAYD,aAAa,CAAC,IAAI,EAAEN,IAAIQ,OAAO,CAACJ,MAAM,CAACK,MAAM,CAACC,OAAO,EAAE;QAEzE,MAAMP,OAAQ,MAAMH,IAAIQ,OAAO,CAACG,QAAQ,CAAC;YACvCC,IAAIZ,IAAIG,IAAI,CAACS,EAAE;YACflB,YAAYA,WAAWU,MAAM,CAACC,IAAI;YAClCT,OAAOW,YAAY,IAAKX,SAASF,WAAWU,MAAM,CAACS,IAAI,CAACjB,KAAK;YAC7DC;YACAC;YACAgB,gBAAgB;YAChBf;YACAC;YACAC;YACAc,kBAAkB;QACpB;QAEA,IAAIZ,MAAM;YACRA,KAAKT,UAAU,GAAGA,WAAWU,MAAM,CAACC,IAAI;YACxCF,KAAKa,SAAS,GAAGhB,IAAIG,IAAI,CAACa,SAAS;QACrC;QAEA,wCAAwC;QACxC,uBAAuB;QACvB,wCAAwC;QAExC,KAAK,MAAMC,UAAUvB,WAAWU,MAAM,CAACc,KAAK,CAACC,EAAE,CAAE;YAC/C,MAAMC,aAAa,MAAMH,OAAO;gBAAExB;gBAAMU;YAAK;YAE7C,IAAIiB,YAAY;gBACdlB,OAAOC,IAAI,GAAGiB,WAAWjB,IAAI;gBAC7BD,OAAOmB,GAAG,GAAGD,WAAWC,GAAG;gBAE3B;YACF;QACF;QAEAnB,OAAOR,UAAU,GAAGM,IAAIG,IAAI,CAACT,UAAU;QACvC;;;;;KAKC,GACDQ,OAAOoB,QAAQ,GAAGtB,IAAIG,IAAI,CAACa,SAAS;QAEpC,IAAI,CAACd,OAAOC,IAAI,EAAE;YAChBD,OAAOC,IAAI,GAAGA;YAEd,IAAIR,cAAc;gBAChB,MAAM4B,UAAUhC,UAAUI;gBAC1B,IAAI4B,SAAS;oBACXrB,OAAOmB,GAAG,GAAGE,QAAQF,GAAG;gBAC1B;gBACA,IAAI,CAAC3B,WAAWU,MAAM,CAACS,IAAI,CAACW,wBAAwB,EAAE;oBACpDtB,OAAOuB,KAAK,GAAG9B;gBACjB;YACF;QACF;IACF;IAEA,wCAAwC;IACxC,wBAAwB;IACxB,wCAAwC;IAExC,IAAID,WAAWU,MAAM,CAACc,KAAK,EAAEQ,SAASC,QAAQ;QAC5C,KAAK,MAAMC,QAAQlC,WAAWU,MAAM,CAACc,KAAK,CAACQ,OAAO,CAAE;YAClDxB,SACE,AAAC,MAAM0B,KAAK;gBACVlC,YAAYA,YAAYU;gBACxByB,SAAS7B,IAAI6B,OAAO;gBACpB7B;gBACA8B,UAAU5B;YACZ,MAAOA;QACX;IACF;IAEA,OAAOA;AACT,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/me.ts"],"sourcesContent":["import { decodeJwt } from 'jose'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { JoinQuery, PayloadRequest, PopulateType, SelectType } from '../../types/index.js'\n\nexport type MeOperationResult = {\n  collection?: string\n  exp?: number\n  token?: string\n  user?: AuthenticatedUser | null\n}\n\nexport type Arguments = {\n  collection: Collection\n  currentToken?: string\n  depth?: number\n  draft?: boolean\n  joins?: JoinQuery\n  populate?: PopulateType\n  req: PayloadRequest\n  select?: SelectType\n}\n\nexport const meOperation = async (args: Arguments): Promise<MeOperationResult> => {\n  const { collection, currentToken, depth, draft, joins, populate, req, select } = args\n\n  let result: MeOperationResult = {\n    user: null!,\n  }\n\n  if (req.user) {\n    if (req.user.collection !== collection.config.slug) {\n      return {\n        user: null!,\n      }\n    }\n\n    const { pathname } = req\n    const isGraphQL = pathname === `/api${req.payload.config.routes.graphQL}`\n\n    const user = (await req.payload.findByID({\n      id: req.user.id,\n      collection: collection.config.slug,\n      depth: isGraphQL ? 0 : (depth ?? collection.config.auth.depth),\n      draft,\n      joins,\n      overrideAccess: false,\n      populate,\n      req,\n      select,\n      showHiddenFields: false,\n    })) as AuthenticatedUser\n\n    if (user) {\n      user.collection = collection.config.slug\n      user._strategy = req.user._strategy\n    }\n\n    // /////////////////////////////////////\n    // me hook - Collection\n    // /////////////////////////////////////\n\n    for (const meHook of collection.config.hooks.me) {\n      const hookResult = await meHook({ args, user })\n\n      if (hookResult) {\n        result.user = hookResult.user\n        result.exp = hookResult.exp\n\n        break\n      }\n    }\n\n    result.collection = req.user.collection\n\n    if (!result.user) {\n      result.user = user\n\n      if (currentToken) {\n        const decoded = decodeJwt(currentToken)\n        if (decoded) {\n          result.exp = decoded.exp\n        }\n        if (!collection.config.auth.removeTokenFromResponses) {\n          result.token = currentToken\n        }\n      }\n    }\n  }\n\n  // /////////////////////////////////////\n  // After Me - Collection\n  // /////////////////////////////////////\n\n  if (collection.config.hooks?.afterMe?.length) {\n    for (const hook of collection.config.hooks.afterMe) {\n      result =\n        (await hook({\n          collection: collection?.config,\n          context: req.context,\n          req,\n          response: result,\n        })) || result\n    }\n  }\n\n  return result\n}\n"],"names":["decodeJwt","meOperation","args","collection","currentToken","depth","draft","joins","populate","req","select","result","user","config","slug","pathname","isGraphQL","payload","routes","graphQL","findByID","id","auth","overrideAccess","showHiddenFields","_strategy","meHook","hooks","me","hookResult","exp","decoded","removeTokenFromResponses","token","afterMe","length","hook","context","response"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAwBhC,OAAO,MAAMC,cAAc,OAAOC;IAChC,MAAM,EAAEC,UAAU,EAAEC,YAAY,EAAEC,KAAK,EAAEC,KAAK,EAAEC,KAAK,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,MAAM,EAAE,GAAGR;IAEjF,IAAIS,SAA4B;QAC9BC,MAAM;IACR;IAEA,IAAIH,IAAIG,IAAI,EAAE;QACZ,IAAIH,IAAIG,IAAI,CAACT,UAAU,KAAKA,WAAWU,MAAM,CAACC,IAAI,EAAE;YAClD,OAAO;gBACLF,MAAM;YACR;QACF;QAEA,MAAM,EAAEG,QAAQ,EAAE,GAAGN;QACrB,MAAMO,YAAYD,aAAa,CAAC,IAAI,EAAEN,IAAIQ,OAAO,CAACJ,MAAM,CAACK,MAAM,CAACC,OAAO,EAAE;QAEzE,MAAMP,OAAQ,MAAMH,IAAIQ,OAAO,CAACG,QAAQ,CAAC;YACvCC,IAAIZ,IAAIG,IAAI,CAACS,EAAE;YACflB,YAAYA,WAAWU,MAAM,CAACC,IAAI;YAClCT,OAAOW,YAAY,IAAKX,SAASF,WAAWU,MAAM,CAACS,IAAI,CAACjB,KAAK;YAC7DC;YACAC;YACAgB,gBAAgB;YAChBf;YACAC;YACAC;YACAc,kBAAkB;QACpB;QAEA,IAAIZ,MAAM;YACRA,KAAKT,UAAU,GAAGA,WAAWU,MAAM,CAACC,IAAI;YACxCF,KAAKa,SAAS,GAAGhB,IAAIG,IAAI,CAACa,SAAS;QACrC;QAEA,wCAAwC;QACxC,uBAAuB;QACvB,wCAAwC;QAExC,KAAK,MAAMC,UAAUvB,WAAWU,MAAM,CAACc,KAAK,CAACC,EAAE,CAAE;YAC/C,MAAMC,aAAa,MAAMH,OAAO;gBAAExB;gBAAMU;YAAK;YAE7C,IAAIiB,YAAY;gBACdlB,OAAOC,IAAI,GAAGiB,WAAWjB,IAAI;gBAC7BD,OAAOmB,GAAG,GAAGD,WAAWC,GAAG;gBAE3B;YACF;QACF;QAEAnB,OAAOR,UAAU,GAAGM,IAAIG,IAAI,CAACT,UAAU;QAEvC,IAAI,CAACQ,OAAOC,IAAI,EAAE;YAChBD,OAAOC,IAAI,GAAGA;YAEd,IAAIR,cAAc;gBAChB,MAAM2B,UAAU/B,UAAUI;gBAC1B,IAAI2B,SAAS;oBACXpB,OAAOmB,GAAG,GAAGC,QAAQD,GAAG;gBAC1B;gBACA,IAAI,CAAC3B,WAAWU,MAAM,CAACS,IAAI,CAACU,wBAAwB,EAAE;oBACpDrB,OAAOsB,KAAK,GAAG7B;gBACjB;YACF;QACF;IACF;IAEA,wCAAwC;IACxC,wBAAwB;IACxB,wCAAwC;IAExC,IAAID,WAAWU,MAAM,CAACc,KAAK,EAAEO,SAASC,QAAQ;QAC5C,KAAK,MAAMC,QAAQjC,WAAWU,MAAM,CAACc,KAAK,CAACO,OAAO,CAAE;YAClDvB,SACE,AAAC,MAAMyB,KAAK;gBACVjC,YAAYA,YAAYU;gBACxBwB,SAAS5B,IAAI4B,OAAO;gBACpB5B;gBACA6B,UAAU3B;YACZ,MAAOA;QACX;IACF;IAEA,OAAOA;AACT,EAAC"}

package/dist/auth/operations/refresh.d.ts

@@ -4,13 +4,6 @@ export type Result = {
     exp: number;
     refreshedToken: string;
     setCookie?: boolean;
-    /** @deprecated
-     * use:
-     * ```ts
-     * user._strategy
-     * ```
-     */
-    strategy?: string;
     user: Document;
 };
 export type Arguments = {

package/dist/auth/operations/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAYpE,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,iBAAwB,SAAS,KAAG,OAAO,CAAC,MAAM,CAgL9E,CAAA"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAYpE,MAAM,MAAM,MAAM,GAAG;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,EAAE,QAAQ,CAAA;CACf,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,gBAAgB,iBAAwB,SAAS,KAAG,OAAO,CAAC,MAAM,CAyK9E,CAAA"}

package/dist/auth/operations/refresh.js

@@ -106,12 +106,6 @@ export const refreshOperation = async (incomingArgs)=>{
                 exp,
                 refreshedToken,
                 setCookie: true,
-                /** @deprecated
-         * use:
-         * ```ts
-         * user._strategy
-         * ```
-         */ strategy: args.req.user._strategy,
                 user
             };
         }

package/dist/auth/operations/refresh.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { Forbidden } from '../../errors/index.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n  exp: number\n  refreshedToken: string\n  setCookie?: boolean\n  /** @deprecated\n   * use:\n   * ```ts\n   * user._strategy\n   * ```\n   */\n  strategy?: string\n  user: Document\n}\n\nexport type Arguments = {\n  collection: Collection\n  req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n  let args = incomingArgs\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'refresh',\n      overrideAccess: false,\n    })\n\n    // /////////////////////////////////////\n    // Refresh\n    // /////////////////////////////////////\n\n    const {\n      collection: { config: collectionConfig },\n      req,\n      req: {\n        payload: { config, secret },\n      },\n    } = args\n\n    if (!args.req.user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const pathname = new URL(args.req.url!).pathname\n\n    const isGraphQL = pathname === config.routes.graphQL\n\n    let user = await req.payload.db.findOne<AuthenticatedUser>({\n      collection: collectionConfig.slug,\n      req,\n      where: { id: { equals: args.req.user.id } },\n    })\n\n    if (!user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const sid = args.req.user._sid\n\n    if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n      if (!Array.isArray(user.sessions) || !sid) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const existingSession = user.sessions.find(({ id }) => id === sid)\n\n      if (!existingSession) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const now = new Date()\n      const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n      existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n      await req.payload.db.updateOne({\n        id: user.id,\n        collection: collectionConfig.slug,\n        data: {\n          ...user,\n          // Prevent updatedAt from being updated when only refreshing a session\n          sessions: removeExpiredSessions(user.sessions),\n          updatedAt: null,\n        },\n        req,\n        returning: false,\n      })\n    }\n\n    user = (await req.payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth: isGraphQL ? 0 : args.collection.config.auth.depth,\n      req: args.req,\n    })) as AuthenticatedUser\n\n    if (user) {\n      user.collection = args.req.user.collection\n      user._strategy = args.req.user._strategy\n    }\n\n    let result!: Result\n\n    // /////////////////////////////////////\n    // refresh hook - Collection\n    // /////////////////////////////////////\n\n    for (const refreshHook of args.collection.config.hooks.refresh) {\n      const hookResult = await refreshHook({ args, user })\n\n      if (hookResult) {\n        result = hookResult\n        break\n      }\n    }\n\n    if (!result) {\n      const fieldsToSign = getFieldsToSign({\n        collectionConfig,\n        email: user?.email as string,\n        sid,\n        user: args?.req?.user,\n      })\n\n      const { exp, token: refreshedToken } = await jwtSign({\n        fieldsToSign,\n        secret,\n        tokenExpiration: collectionConfig.auth.tokenExpiration,\n      })\n\n      result = {\n        exp,\n        refreshedToken,\n        setCookie: true,\n        /** @deprecated\n         * use:\n         * ```ts\n         * user._strategy\n         * ```\n         */\n        strategy: args.req.user._strategy,\n        user,\n      }\n    }\n\n    // /////////////////////////////////////\n    // After Refresh - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRefresh?.length) {\n      for (const hook of collectionConfig.hooks.afterRefresh) {\n        result =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            exp: result.exp,\n            req: args.req,\n            token: result.refreshedToken,\n          })) || result\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'refresh',\n      overrideAccess: false,\n      result,\n    })\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","Forbidden","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","slug","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updateOne","data","updatedAt","returning","findByID","depth","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","strategy","afterRefresh","length","hook","context","error"],"mappings":"AAIA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AAqBtD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMR,gBAAgBO,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMV,qBAAqB;YAChCU;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMC,WAAW,IAAIC,IAAIb,KAAKE,GAAG,CAACY,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaR,OAAOY,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMR,IAAIM,OAAO,CAACU,EAAE,CAACC,OAAO,CAAoB;YACzDhB,YAAYI,iBAAiBa,IAAI;YACjClB;YACAmB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQvB,KAAKE,GAAG,CAACQ,IAAI,CAACY,EAAE;gBAAC;YAAE;QAC5C;QAEA,IAAI,CAACZ,MAAM;YACT,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMa,MAAMxB,KAAKE,GAAG,CAACQ,IAAI,CAACe,IAAI;QAE9B,IAAIlB,iBAAiBmB,IAAI,CAACC,WAAW,IAAI,CAACpB,iBAAiBmB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACpB,KAAKqB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIjC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMqB,kBAAkBtB,KAAKqB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAE,GAAKA,OAAOE;YAE9D,IAAI,CAACQ,iBAAiB;gBACpB,MAAM,IAAIzC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMuB,MAAM,IAAIC;YAChB,MAAMC,eAAe7B,iBAAiBmB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,MAAMlC,IAAIM,OAAO,CAACU,EAAE,CAACsB,SAAS,CAAC;gBAC7BlB,IAAIZ,KAAKY,EAAE;gBACXnB,YAAYI,iBAAiBa,IAAI;gBACjCqB,MAAM;oBACJ,GAAG/B,IAAI;oBACP,sEAAsE;oBACtEqB,UAAUlC,sBAAsBa,KAAKqB,QAAQ;oBAC7CW,WAAW;gBACb;gBACAxC;gBACAyC,WAAW;YACb;QACF;QAEAjC,OAAQ,MAAMR,IAAIM,OAAO,CAACoC,QAAQ,CAAC;YACjCtB,IAAIZ,KAAKY,EAAE;YACXnB,YAAYI,iBAAiBa,IAAI;YACjCyB,OAAO9B,YAAY,IAAIf,KAAKG,UAAU,CAACC,MAAM,CAACsB,IAAI,CAACmB,KAAK;YACxD3C,KAAKF,KAAKE,GAAG;QACf;QAEA,IAAIQ,MAAM;YACRA,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;YAC1CO,KAAKoC,SAAS,GAAG9C,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;QAC1C;QAEA,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAehD,KAAKG,UAAU,CAACC,MAAM,CAAC6C,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEhD;gBAAMU;YAAK;YAElD,IAAIyC,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAezD,gBAAgB;gBACnCY;gBACA8C,OAAO3C,MAAM2C;gBACb7B;gBACAd,MAAMV,MAAME,KAAKQ;YACnB;YAEA,MAAM,EAAE4C,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAM5D,QAAQ;gBACnDwD;gBACA3C;gBACA4B,iBAAiB9B,iBAAiBmB,IAAI,CAACW,eAAe;YACxD;YAEAU,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX;;;;;SAKC,GACDC,UAAU1D,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;gBACjCpC;YACF;QACF;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB0C,KAAK,EAAEU,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQtD,iBAAiB0C,KAAK,CAACU,YAAY,CAAE;gBACtDZ,SACE,AAAC,MAAMc,KAAK;oBACV1D,YAAYH,KAAKG,UAAU,EAAEC;oBAC7B0D,SAAS9D,KAAKE,GAAG,CAAC4D,OAAO;oBACzBR,KAAKP,OAAOO,GAAG;oBACfpD,KAAKF,KAAKE,GAAG;oBACbqD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAM1D,oBAAoB;YACjCW;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChByC;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAI9C,cAAc;YAChB,MAAMT,kBAAkBU;QAC1B;QAEA,OAAO6C;IACT,EAAE,OAAOgB,OAAgB;QACvB,MAAMrE,gBAAgBM,KAAKE,GAAG;QAC9B,MAAM6D;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/refresh.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { AuthenticatedUser } from '../../index.js'\nimport type { Document, PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { Forbidden } from '../../errors/index.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { removeExpiredSessions } from '../sessions.js'\n\nexport type Result = {\n  exp: number\n  refreshedToken: string\n  setCookie?: boolean\n  user: Document\n}\n\nexport type Arguments = {\n  collection: Collection\n  req: PayloadRequest\n}\n\nexport const refreshOperation = async (incomingArgs: Arguments): Promise<Result> => {\n  let args = incomingArgs\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'refresh',\n      overrideAccess: false,\n    })\n\n    // /////////////////////////////////////\n    // Refresh\n    // /////////////////////////////////////\n\n    const {\n      collection: { config: collectionConfig },\n      req,\n      req: {\n        payload: { config, secret },\n      },\n    } = args\n\n    if (!args.req.user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const pathname = new URL(args.req.url!).pathname\n\n    const isGraphQL = pathname === config.routes.graphQL\n\n    let user = await req.payload.db.findOne<AuthenticatedUser>({\n      collection: collectionConfig.slug,\n      req,\n      where: { id: { equals: args.req.user.id } },\n    })\n\n    if (!user) {\n      throw new Forbidden(args.req.t)\n    }\n\n    const sid = args.req.user._sid\n\n    if (collectionConfig.auth.useSessions && !collectionConfig.auth.disableLocalStrategy) {\n      if (!Array.isArray(user.sessions) || !sid) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const existingSession = user.sessions.find(({ id }) => id === sid)\n\n      if (!existingSession) {\n        throw new Forbidden(args.req.t)\n      }\n\n      const now = new Date()\n      const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n      existingSession.expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n      await req.payload.db.updateOne({\n        id: user.id,\n        collection: collectionConfig.slug,\n        data: {\n          ...user,\n          // Prevent updatedAt from being updated when only refreshing a session\n          sessions: removeExpiredSessions(user.sessions),\n          updatedAt: null,\n        },\n        req,\n        returning: false,\n      })\n    }\n\n    user = (await req.payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth: isGraphQL ? 0 : args.collection.config.auth.depth,\n      req: args.req,\n    })) as AuthenticatedUser\n\n    if (user) {\n      user.collection = args.req.user.collection\n      user._strategy = args.req.user._strategy\n    }\n\n    let result!: Result\n\n    // /////////////////////////////////////\n    // refresh hook - Collection\n    // /////////////////////////////////////\n\n    for (const refreshHook of args.collection.config.hooks.refresh) {\n      const hookResult = await refreshHook({ args, user })\n\n      if (hookResult) {\n        result = hookResult\n        break\n      }\n    }\n\n    if (!result) {\n      const fieldsToSign = getFieldsToSign({\n        collectionConfig,\n        email: user?.email as string,\n        sid,\n        user: args?.req?.user,\n      })\n\n      const { exp, token: refreshedToken } = await jwtSign({\n        fieldsToSign,\n        secret,\n        tokenExpiration: collectionConfig.auth.tokenExpiration,\n      })\n\n      result = {\n        exp,\n        refreshedToken,\n        setCookie: true,\n        user,\n      }\n    }\n\n    // /////////////////////////////////////\n    // After Refresh - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterRefresh?.length) {\n      for (const hook of collectionConfig.hooks.afterRefresh) {\n        result =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            exp: result.exp,\n            req: args.req,\n            token: result.refreshedToken,\n          })) || result\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'refresh',\n      overrideAccess: false,\n      result,\n    })\n\n    // /////////////////////////////////////\n    // Return results\n    // /////////////////////////////////////\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return result\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","Forbidden","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","removeExpiredSessions","refreshOperation","incomingArgs","args","shouldCommit","req","collection","config","operation","overrideAccess","collectionConfig","payload","secret","user","t","pathname","URL","url","isGraphQL","routes","graphQL","db","findOne","slug","where","id","equals","sid","_sid","auth","useSessions","disableLocalStrategy","Array","isArray","sessions","existingSession","find","now","Date","tokenExpInMs","tokenExpiration","expiresAt","getTime","updateOne","data","updatedAt","returning","findByID","depth","_strategy","result","refreshHook","hooks","refresh","hookResult","fieldsToSign","email","exp","token","refreshedToken","setCookie","afterRefresh","length","hook","context","error"],"mappings":"AAIA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,qBAAqB,QAAQ,iBAAgB;AActD,OAAO,MAAMC,mBAAmB,OAAOC;IACrC,IAAIC,OAAOD;IAEX,IAAI;QACF,MAAME,eAAe,MAAMR,gBAAgBO,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QAExCF,OAAO,MAAMV,qBAAqB;YAChCU;YACAG,YAAYH,KAAKG,UAAU,CAACC,MAAM;YAClCC,WAAW;YACXC,gBAAgB;QAClB;QAEA,wCAAwC;QACxC,UAAU;QACV,wCAAwC;QAExC,MAAM,EACJH,YAAY,EAAEC,QAAQG,gBAAgB,EAAE,EACxCL,GAAG,EACHA,KAAK,EACHM,SAAS,EAAEJ,MAAM,EAAEK,MAAM,EAAE,EAC5B,EACF,GAAGT;QAEJ,IAAI,CAACA,KAAKE,GAAG,CAACQ,IAAI,EAAE;YAClB,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMC,WAAW,IAAIC,IAAIb,KAAKE,GAAG,CAACY,GAAG,EAAGF,QAAQ;QAEhD,MAAMG,YAAYH,aAAaR,OAAOY,MAAM,CAACC,OAAO;QAEpD,IAAIP,OAAO,MAAMR,IAAIM,OAAO,CAACU,EAAE,CAACC,OAAO,CAAoB;YACzDhB,YAAYI,iBAAiBa,IAAI;YACjClB;YACAmB,OAAO;gBAAEC,IAAI;oBAAEC,QAAQvB,KAAKE,GAAG,CAACQ,IAAI,CAACY,EAAE;gBAAC;YAAE;QAC5C;QAEA,IAAI,CAACZ,MAAM;YACT,MAAM,IAAInB,UAAUS,KAAKE,GAAG,CAACS,CAAC;QAChC;QAEA,MAAMa,MAAMxB,KAAKE,GAAG,CAACQ,IAAI,CAACe,IAAI;QAE9B,IAAIlB,iBAAiBmB,IAAI,CAACC,WAAW,IAAI,CAACpB,iBAAiBmB,IAAI,CAACE,oBAAoB,EAAE;YACpF,IAAI,CAACC,MAAMC,OAAO,CAACpB,KAAKqB,QAAQ,KAAK,CAACP,KAAK;gBACzC,MAAM,IAAIjC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMqB,kBAAkBtB,KAAKqB,QAAQ,CAACE,IAAI,CAAC,CAAC,EAAEX,EAAE,EAAE,GAAKA,OAAOE;YAE9D,IAAI,CAACQ,iBAAiB;gBACpB,MAAM,IAAIzC,UAAUS,KAAKE,GAAG,CAACS,CAAC;YAChC;YAEA,MAAMuB,MAAM,IAAIC;YAChB,MAAMC,eAAe7B,iBAAiBmB,IAAI,CAACW,eAAe,GAAG;YAC7DL,gBAAgBM,SAAS,GAAG,IAAIH,KAAKD,IAAIK,OAAO,KAAKH;YAErD,MAAMlC,IAAIM,OAAO,CAACU,EAAE,CAACsB,SAAS,CAAC;gBAC7BlB,IAAIZ,KAAKY,EAAE;gBACXnB,YAAYI,iBAAiBa,IAAI;gBACjCqB,MAAM;oBACJ,GAAG/B,IAAI;oBACP,sEAAsE;oBACtEqB,UAAUlC,sBAAsBa,KAAKqB,QAAQ;oBAC7CW,WAAW;gBACb;gBACAxC;gBACAyC,WAAW;YACb;QACF;QAEAjC,OAAQ,MAAMR,IAAIM,OAAO,CAACoC,QAAQ,CAAC;YACjCtB,IAAIZ,KAAKY,EAAE;YACXnB,YAAYI,iBAAiBa,IAAI;YACjCyB,OAAO9B,YAAY,IAAIf,KAAKG,UAAU,CAACC,MAAM,CAACsB,IAAI,CAACmB,KAAK;YACxD3C,KAAKF,KAAKE,GAAG;QACf;QAEA,IAAIQ,MAAM;YACRA,KAAKP,UAAU,GAAGH,KAAKE,GAAG,CAACQ,IAAI,CAACP,UAAU;YAC1CO,KAAKoC,SAAS,GAAG9C,KAAKE,GAAG,CAACQ,IAAI,CAACoC,SAAS;QAC1C;QAEA,IAAIC;QAEJ,wCAAwC;QACxC,4BAA4B;QAC5B,wCAAwC;QAExC,KAAK,MAAMC,eAAehD,KAAKG,UAAU,CAACC,MAAM,CAAC6C,KAAK,CAACC,OAAO,CAAE;YAC9D,MAAMC,aAAa,MAAMH,YAAY;gBAAEhD;gBAAMU;YAAK;YAElD,IAAIyC,YAAY;gBACdJ,SAASI;gBACT;YACF;QACF;QAEA,IAAI,CAACJ,QAAQ;YACX,MAAMK,eAAezD,gBAAgB;gBACnCY;gBACA8C,OAAO3C,MAAM2C;gBACb7B;gBACAd,MAAMV,MAAME,KAAKQ;YACnB;YAEA,MAAM,EAAE4C,GAAG,EAAEC,OAAOC,cAAc,EAAE,GAAG,MAAM5D,QAAQ;gBACnDwD;gBACA3C;gBACA4B,iBAAiB9B,iBAAiBmB,IAAI,CAACW,eAAe;YACxD;YAEAU,SAAS;gBACPO;gBACAE;gBACAC,WAAW;gBACX/C;YACF;QACF;QAEA,wCAAwC;QACxC,6BAA6B;QAC7B,wCAAwC;QAExC,IAAIH,iBAAiB0C,KAAK,EAAES,cAAcC,QAAQ;YAChD,KAAK,MAAMC,QAAQrD,iBAAiB0C,KAAK,CAACS,YAAY,CAAE;gBACtDX,SACE,AAAC,MAAMa,KAAK;oBACVzD,YAAYH,KAAKG,UAAU,EAAEC;oBAC7ByD,SAAS7D,KAAKE,GAAG,CAAC2D,OAAO;oBACzBP,KAAKP,OAAOO,GAAG;oBACfpD,KAAKF,KAAKE,GAAG;oBACbqD,OAAOR,OAAOS,cAAc;gBAC9B,MAAOT;YACX;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCA,SAAS,MAAM1D,oBAAoB;YACjCW;YACAG,YAAYH,KAAKG,UAAU,EAAEC;YAC7BC,WAAW;YACXC,gBAAgB;YAChByC;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,IAAI9C,cAAc;YAChB,MAAMT,kBAAkBU;QAC1B;QAEA,OAAO6C;IACT,EAAE,OAAOe,OAAgB;QACvB,MAAMpE,gBAAgBM,KAAKE,GAAG;QAC9B,MAAM4D;IACR;AACF,EAAC"}

package/dist/auth/operations/unlock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,QAC9D,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAqHjB,CAAA"}
+{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,QAC9D,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAwHjB,CAAA"}

package/dist/auth/operations/unlock.js

@@ -36,6 +36,7 @@ export const unlockOperation = async (args)=>{
         // /////////////////////////////////////
         if (!overrideAccess) {
             const accessResult = await executeAccess({
+                slug: collectionConfig.slug,
                 req
             }, collectionConfig.access.unlock);
             if (accessResult && typeof accessResult === 'object') {

package/dist/auth/operations/unlock.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess({ req }, collectionConfig.access.unlock)\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","slug","result","doc","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI3B,UAAUc,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEc,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5ErB,WAAWkC,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMZ,qBAAqB;YAChCY;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cAAc;gBAAES;YAAI,GAAGF,iBAAiBsB,MAAM,CAACC,MAAM;YAEhF,IAAIF,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBjC,eAAeiC,iBAAiB;gBAChDV,OAAO;oBACLc,QAAQhB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBjC,eAAeiC,iBAAiB;gBAChDN,UAAU;oBACRU,QAAQX;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkB/B,uBAAuB;YACvCoC,aAAaC,QAAQ1B,iBAAiB2B,KAAK;YAC3CA,OAAO;YACPC,OAAOR;QACT;QAEA,MAAMS,OAAO,MAAM3B,IAAI4B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxClC,YAAYE,iBAAiBiC,IAAI;YACjC9B,QAAQA;YACRD;YACA0B,OAAOR;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIL,MAAM;YACR,MAAMlC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKN;gBACLC,SAAS5B,IAAI4B,OAAO;gBACpB5B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI9C,UAAUc,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM7B,kBAAkBY;QAC1B;QAEAgC,SAAS,MAAMlD,oBAAoB;YACjCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOR,QAAQQ;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess(\n        { slug: collectionConfig.slug, req },\n        collectionConfig.access.unlock,\n      )\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","slug","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","result","doc","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI3B,UAAUc,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEc,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5ErB,WAAWkC,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMZ,qBAAqB;YAChCY;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cACzB;gBAAE6B,MAAMtB,iBAAiBsB,IAAI;gBAAEpB;YAAI,GACnCF,iBAAiBuB,MAAM,CAACC,MAAM;YAGhC,IAAIH,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBjC,eAAeiC,iBAAiB;gBAChDV,OAAO;oBACLe,QAAQjB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBjC,eAAeiC,iBAAiB;gBAChDN,UAAU;oBACRW,QAAQZ;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkB/B,uBAAuB;YACvCqC,aAAaC,QAAQ3B,iBAAiB4B,KAAK;YAC3CA,OAAO;YACPC,OAAOT;QACT;QAEA,MAAMU,OAAO,MAAM5B,IAAI6B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxCnC,YAAYE,iBAAiBsB,IAAI;YACjCnB,QAAQA;YACRD;YACA2B,OAAOT;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIJ,MAAM;YACR,MAAMnC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKL;gBACLC,SAAS7B,IAAI6B,OAAO;gBACpB7B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI9C,UAAUc,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM7B,kBAAkBY;QAC1B;QAEAgC,SAAS,MAAMlD,oBAAoB;YACjCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOP,QAAQO;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}

package/dist/auth/rotateSecret.d.ts

@@ -0,0 +1,51 @@
+import type { CollectionSlug, Payload } from '../index.js';
+export type RotateSecretArgs = {
+    /**
+     * Number of documents to process per batch.
+     * @default 100
+     */
+    batchSize?: number;
+    /**
+     * Limit rotation to these collection slugs. Defaults to every auth collection
+     * configured with `useAPIKey`.
+     */
+    collections?: CollectionSlug[];
+    /**
+     * When true, verifies every row against the old and current secrets without
+     * writing. Run this first to confirm `oldSecret` is correct.
+     * @default false
+     */
+    dryRun?: boolean;
+    /**
+     * The previous raw `PAYLOAD_SECRET` that existing data was encrypted under.
+     */
+    oldSecret: string;
+    payload: Payload;
+};
+export type RotateSecretResult = {
+    /** Documents re-keyed from the old secret to the current secret. */
+    migrated: number;
+    /** Documents already encrypted under the current secret (safe re-run). */
+    skipped: number;
+};
+/**
+ * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous
+ * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.
+ *
+ * Operates at the database-adapter layer to bypass the `apiKey` field's
+ * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).
+ *
+ * Each document is verified against the old and current secrets before it is
+ * written, so the run is:
+ * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC
+ *   index), so it is safe to run repeatedly;
+ * - **fail-closed** — a row that matches neither the old nor the current secret
+ *   throws and aborts the run before that row is written. Rows already migrated
+ *   earlier in the same run remain migrated and are safe to keep: fix the secret
+ *   and re-run.
+ *
+ * Password logins are unaffected by a secret rotation, and active JWT sessions
+ * are invalidated by design. See the "Rotating your PAYLOAD_SECRET" docs.
+ */
+export declare const rotateSecret: ({ batchSize, collections, dryRun, oldSecret, payload, }: RotateSecretArgs) => Promise<RotateSecretResult>;
+//# sourceMappingURL=rotateSecret.d.ts.map

package/dist/auth/rotateSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotateSecret.d.ts","sourceRoot":"","sources":["../../src/auth/rotateSecret.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAI1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,4DAMtB,gBAAgB,KAAG,OAAO,CAAC,kBAAkB,CA4F/C,CAAA"}

package/dist/auth/rotateSecret.js

@@ -0,0 +1,131 @@
+import crypto from 'crypto';
+import { deriveSecretKey } from './crypto.js';
+/**
+ * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous
+ * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.
+ *
+ * Operates at the database-adapter layer to bypass the `apiKey` field's
+ * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).
+ *
+ * Each document is verified against the old and current secrets before it is
+ * written, so the run is:
+ * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC
+ *   index), so it is safe to run repeatedly;
+ * - **fail-closed** — a row that matches neither the old nor the current secret
+ *   throws and aborts the run before that row is written. Rows already migrated
+ *   earlier in the same run remain migrated and are safe to keep: fix the secret
+ *   and re-run.
+ *
+ * Password logins are unaffected by a secret rotation, and active JWT sessions
+ * are invalidated by design. See the "Rotating your PAYLOAD_SECRET" docs.
+ */ export const rotateSecret = async ({ batchSize = 100, collections, dryRun = false, oldSecret, payload })=>{
+    const oldDerivedKey = deriveSecretKey(oldSecret);
+    const newDerivedKey = payload.secret;
+    const result = {
+        migrated: 0,
+        skipped: 0
+    };
+    if (oldDerivedKey === newDerivedKey) {
+        payload.logger.warn('rotateSecret: oldSecret matches the current secret - nothing to rotate. Did you forget to set the new PAYLOAD_SECRET?');
+        return result;
+    }
+    const targetSlugs = (collections ?? Object.keys(payload.collections)).filter((slug)=>payload.collections[slug]?.config.auth?.useAPIKey);
+    for (const slug of targetSlugs){
+        let page = 1;
+        let hasNextPage = true;
+        while(hasNextPage){
+            const { docs, hasNextPage: nextPage } = await payload.db.find({
+                collection: slug,
+                limit: batchSize,
+                page,
+                pagination: true,
+                sort: 'id',
+                // Only rows with a lookup index need re-keying. A row can have `apiKey`
+                // ciphertext but a null `apiKeyIndex` (e.g. after unchecking "Enable API
+                // Key"); those are never used for auth, so skip them.
+                where: {
+                    and: [
+                        {
+                            apiKey: {
+                                exists: true
+                            }
+                        },
+                        {
+                            apiKeyIndex: {
+                                exists: true
+                            }
+                        }
+                    ]
+                }
+            });
+            for (const doc of docs){
+                const storedApiKey = doc.apiKey;
+                const storedIndex = doc.apiKeyIndex;
+                if (!storedApiKey || !storedIndex) {
+                    continue;
+                }
+                // The v1 (aes-256-gcm) envelope throws on a wrong key; legacy aes-256-ctr
+                // returns garbage. Either way the HMAC-index check is the source of truth,
+                // so treat a decrypt failure as "does not match this secret".
+                const rawFromOld = tryDecrypt({
+                    hash: storedApiKey,
+                    payload,
+                    secret: oldSecret
+                });
+                if (rawFromOld !== undefined && apiKeyIndexHmac({
+                    derivedKey: oldDerivedKey,
+                    rawApiKey: rawFromOld
+                }) === storedIndex) {
+                    if (!dryRun) {
+                        await payload.db.updateOne({
+                            id: doc.id,
+                            collection: slug,
+                            data: {
+                                apiKey: payload.encrypt(rawFromOld),
+                                apiKeyIndex: apiKeyIndexHmac({
+                                    derivedKey: newDerivedKey,
+                                    rawApiKey: rawFromOld
+                                })
+                            },
+                            returning: false
+                        });
+                    }
+                    result.migrated++;
+                    continue;
+                }
+                // Confirm the row is already on the current secret (safe re-run).
+                const rawFromNew = tryDecrypt({
+                    hash: storedApiKey,
+                    payload
+                });
+                if (rawFromNew !== undefined && apiKeyIndexHmac({
+                    derivedKey: newDerivedKey,
+                    rawApiKey: rawFromNew
+                }) === storedIndex) {
+                    result.skipped++;
+                    continue;
+                }
+                throw new Error(`rotateSecret: could not verify apiKey for collection "${slug}" id "${String(doc.id)}" against the provided oldSecret or the current secret. Aborting; rows already migrated in this run are safe to keep - fix the secret and re-run.`);
+            }
+            hasNextPage = Boolean(nextPage);
+            page++;
+        }
+    }
+    return result;
+};
+const apiKeyIndexHmac = ({ derivedKey, rawApiKey })=>crypto.createHmac('sha256', derivedKey).update(rawApiKey).digest('hex');
+/**
+ * Decrypts with the given secret (or the active secret), returning `undefined`
+ * instead of throwing when the value cannot be decrypted (wrong-key v1 values
+ * throw; the caller relies on the HMAC index to decide correctness).
+ */ const tryDecrypt = ({ hash, payload, secret })=>{
+    try {
+        return secret ? payload.decrypt(hash, {
+            secret
+        }) : payload.decrypt(hash);
+    } catch  {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=rotateSecret.js.map

package/dist/auth/rotateSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/rotateSecret.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { CollectionSlug, Payload } from '../index.js'\n\nimport { deriveSecretKey } from './crypto.js'\n\nexport type RotateSecretArgs = {\n  /**\n   * Number of documents to process per batch.\n   * @default 100\n   */\n  batchSize?: number\n  /**\n   * Limit rotation to these collection slugs. Defaults to every auth collection\n   * configured with `useAPIKey`.\n   */\n  collections?: CollectionSlug[]\n  /**\n   * When true, verifies every row against the old and current secrets without\n   * writing. Run this first to confirm `oldSecret` is correct.\n   * @default false\n   */\n  dryRun?: boolean\n  /**\n   * The previous raw `PAYLOAD_SECRET` that existing data was encrypted under.\n   */\n  oldSecret: string\n  payload: Payload\n}\n\nexport type RotateSecretResult = {\n  /** Documents re-keyed from the old secret to the current secret. */\n  migrated: number\n  /** Documents already encrypted under the current secret (safe re-run). */\n  skipped: number\n}\n\n/**\n * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous\n * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.\n *\n * Operates at the database-adapter layer to bypass the `apiKey` field's\n * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).\n *\n * Each document is verified against the old and current secrets before it is\n * written, so the run is:\n * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC\n *   index), so it is safe to run repeatedly;\n * - **fail-closed** — a row that matches neither the old nor the current secret\n *   throws and aborts the run before that row is written. Rows already migrated\n *   earlier in the same run remain migrated and are safe to keep: fix the secret\n *   and re-run.\n *\n * Password logins are unaffected by a secret rotation, and active JWT sessions\n * are invalidated by design. See the \"Rotating your PAYLOAD_SECRET\" docs.\n */\nexport const rotateSecret = async ({\n  batchSize = 100,\n  collections,\n  dryRun = false,\n  oldSecret,\n  payload,\n}: RotateSecretArgs): Promise<RotateSecretResult> => {\n  const oldDerivedKey = deriveSecretKey(oldSecret)\n  const newDerivedKey = payload.secret\n\n  const result: RotateSecretResult = { migrated: 0, skipped: 0 }\n\n  if (oldDerivedKey === newDerivedKey) {\n    payload.logger.warn(\n      'rotateSecret: oldSecret matches the current secret - nothing to rotate. Did you forget to set the new PAYLOAD_SECRET?',\n    )\n    return result\n  }\n\n  const targetSlugs = (collections ?? Object.keys(payload.collections)).filter(\n    (slug) => payload.collections[slug]?.config.auth?.useAPIKey,\n  )\n\n  for (const slug of targetSlugs) {\n    let page = 1\n    let hasNextPage = true\n\n    while (hasNextPage) {\n      const { docs, hasNextPage: nextPage } = await payload.db.find({\n        collection: slug,\n        limit: batchSize,\n        page,\n        pagination: true,\n        sort: 'id',\n        // Only rows with a lookup index need re-keying. A row can have `apiKey`\n        // ciphertext but a null `apiKeyIndex` (e.g. after unchecking \"Enable API\n        // Key\"); those are never used for auth, so skip them.\n        where: {\n          and: [{ apiKey: { exists: true } }, { apiKeyIndex: { exists: true } }],\n        },\n      })\n\n      for (const doc of docs as Array<{ id: number | string } & Record<string, unknown>>) {\n        const storedApiKey = doc.apiKey as string | undefined\n        const storedIndex = doc.apiKeyIndex as string | undefined\n\n        if (!storedApiKey || !storedIndex) {\n          continue\n        }\n\n        // The v1 (aes-256-gcm) envelope throws on a wrong key; legacy aes-256-ctr\n        // returns garbage. Either way the HMAC-index check is the source of truth,\n        // so treat a decrypt failure as \"does not match this secret\".\n        const rawFromOld = tryDecrypt({ hash: storedApiKey, payload, secret: oldSecret })\n\n        if (\n          rawFromOld !== undefined &&\n          apiKeyIndexHmac({ derivedKey: oldDerivedKey, rawApiKey: rawFromOld }) === storedIndex\n        ) {\n          if (!dryRun) {\n            await payload.db.updateOne({\n              id: doc.id,\n              collection: slug,\n              data: {\n                apiKey: payload.encrypt(rawFromOld),\n                apiKeyIndex: apiKeyIndexHmac({ derivedKey: newDerivedKey, rawApiKey: rawFromOld }),\n              },\n              returning: false,\n            })\n          }\n          result.migrated++\n          continue\n        }\n\n        // Confirm the row is already on the current secret (safe re-run).\n        const rawFromNew = tryDecrypt({ hash: storedApiKey, payload })\n\n        if (\n          rawFromNew !== undefined &&\n          apiKeyIndexHmac({ derivedKey: newDerivedKey, rawApiKey: rawFromNew }) === storedIndex\n        ) {\n          result.skipped++\n          continue\n        }\n\n        throw new Error(\n          `rotateSecret: could not verify apiKey for collection \"${slug}\" id \"${String(\n            doc.id,\n          )}\" against the provided oldSecret or the current secret. Aborting; rows already migrated in this run are safe to keep - fix the secret and re-run.`,\n        )\n      }\n\n      hasNextPage = Boolean(nextPage)\n      page++\n    }\n  }\n\n  return result\n}\n\nconst apiKeyIndexHmac = ({\n  derivedKey,\n  rawApiKey,\n}: {\n  derivedKey: string\n  rawApiKey: string\n}): string => crypto.createHmac('sha256', derivedKey).update(rawApiKey).digest('hex')\n\n/**\n * Decrypts with the given secret (or the active secret), returning `undefined`\n * instead of throwing when the value cannot be decrypted (wrong-key v1 values\n * throw; the caller relies on the HMAC index to decide correctness).\n */\nconst tryDecrypt = ({\n  hash,\n  payload,\n  secret,\n}: {\n  hash: string\n  payload: Payload\n  secret?: string\n}): string | undefined => {\n  try {\n    return secret ? payload.decrypt(hash, { secret }) : payload.decrypt(hash)\n  } catch {\n    return undefined\n  }\n}\n"],"names":["crypto","deriveSecretKey","rotateSecret","batchSize","collections","dryRun","oldSecret","payload","oldDerivedKey","newDerivedKey","secret","result","migrated","skipped","logger","warn","targetSlugs","Object","keys","filter","slug","config","auth","useAPIKey","page","hasNextPage","docs","nextPage","db","find","collection","limit","pagination","sort","where","and","apiKey","exists","apiKeyIndex","doc","storedApiKey","storedIndex","rawFromOld","tryDecrypt","hash","undefined","apiKeyIndexHmac","derivedKey","rawApiKey","updateOne","id","data","encrypt","returning","rawFromNew","Error","String","Boolean","createHmac","update","digest","decrypt"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAI3B,SAASC,eAAe,QAAQ,cAAa;AAiC7C;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,eAAe,OAAO,EACjCC,YAAY,GAAG,EACfC,WAAW,EACXC,SAAS,KAAK,EACdC,SAAS,EACTC,OAAO,EACU;IACjB,MAAMC,gBAAgBP,gBAAgBK;IACtC,MAAMG,gBAAgBF,QAAQG,MAAM;IAEpC,MAAMC,SAA6B;QAAEC,UAAU;QAAGC,SAAS;IAAE;IAE7D,IAAIL,kBAAkBC,eAAe;QACnCF,QAAQO,MAAM,CAACC,IAAI,CACjB;QAEF,OAAOJ;IACT;IAEA,MAAMK,cAAc,AAACZ,CAAAA,eAAea,OAAOC,IAAI,CAACX,QAAQH,WAAW,CAAA,EAAGe,MAAM,CAC1E,CAACC,OAASb,QAAQH,WAAW,CAACgB,KAAK,EAAEC,OAAOC,MAAMC;IAGpD,KAAK,MAAMH,QAAQJ,YAAa;QAC9B,IAAIQ,OAAO;QACX,IAAIC,cAAc;QAElB,MAAOA,YAAa;YAClB,MAAM,EAAEC,IAAI,EAAED,aAAaE,QAAQ,EAAE,GAAG,MAAMpB,QAAQqB,EAAE,CAACC,IAAI,CAAC;gBAC5DC,YAAYV;gBACZW,OAAO5B;gBACPqB;gBACAQ,YAAY;gBACZC,MAAM;gBACN,wEAAwE;gBACxE,yEAAyE;gBACzE,sDAAsD;gBACtDC,OAAO;oBACLC,KAAK;wBAAC;4BAAEC,QAAQ;gCAAEC,QAAQ;4BAAK;wBAAE;wBAAG;4BAAEC,aAAa;gCAAED,QAAQ;4BAAK;wBAAE;qBAAE;gBACxE;YACF;YAEA,KAAK,MAAME,OAAOb,KAAkE;gBAClF,MAAMc,eAAeD,IAAIH,MAAM;gBAC/B,MAAMK,cAAcF,IAAID,WAAW;gBAEnC,IAAI,CAACE,gBAAgB,CAACC,aAAa;oBACjC;gBACF;gBAEA,0EAA0E;gBAC1E,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAMC,aAAaC,WAAW;oBAAEC,MAAMJ;oBAAcjC;oBAASG,QAAQJ;gBAAU;gBAE/E,IACEoC,eAAeG,aACfC,gBAAgB;oBAAEC,YAAYvC;oBAAewC,WAAWN;gBAAW,OAAOD,aAC1E;oBACA,IAAI,CAACpC,QAAQ;wBACX,MAAME,QAAQqB,EAAE,CAACqB,SAAS,CAAC;4BACzBC,IAAIX,IAAIW,EAAE;4BACVpB,YAAYV;4BACZ+B,MAAM;gCACJf,QAAQ7B,QAAQ6C,OAAO,CAACV;gCACxBJ,aAAaQ,gBAAgB;oCAAEC,YAAYtC;oCAAeuC,WAAWN;gCAAW;4BAClF;4BACAW,WAAW;wBACb;oBACF;oBACA1C,OAAOC,QAAQ;oBACf;gBACF;gBAEA,kEAAkE;gBAClE,MAAM0C,aAAaX,WAAW;oBAAEC,MAAMJ;oBAAcjC;gBAAQ;gBAE5D,IACE+C,eAAeT,aACfC,gBAAgB;oBAAEC,YAAYtC;oBAAeuC,WAAWM;gBAAW,OAAOb,aAC1E;oBACA9B,OAAOE,OAAO;oBACd;gBACF;gBAEA,MAAM,IAAI0C,MACR,CAAC,sDAAsD,EAAEnC,KAAK,MAAM,EAAEoC,OACpEjB,IAAIW,EAAE,EACN,iJAAiJ,CAAC;YAExJ;YAEAzB,cAAcgC,QAAQ9B;YACtBH;QACF;IACF;IAEA,OAAOb;AACT,EAAC;AAED,MAAMmC,kBAAkB,CAAC,EACvBC,UAAU,EACVC,SAAS,EAIV,GAAahD,OAAO0D,UAAU,CAAC,UAAUX,YAAYY,MAAM,CAACX,WAAWY,MAAM,CAAC;AAE/E;;;;CAIC,GACD,MAAMjB,aAAa,CAAC,EAClBC,IAAI,EACJrC,OAAO,EACPG,MAAM,EAKP;IACC,IAAI;QACF,OAAOA,SAASH,QAAQsD,OAAO,CAACjB,MAAM;YAAElC;QAAO,KAAKH,QAAQsD,OAAO,CAACjB;IACtE,EAAE,OAAM;QACN,OAAOC;IACT;AACF"}

package/dist/auth/serverFunctions/cookies.d.ts

@@ -0,0 +1,47 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { Auth } from '../types.js';
+/**
+ * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`
+ * when `returnCookieAsObject` is `true`.
+ */
+export type GeneratedCookie = {
+    domain?: string;
+    expires?: string;
+    httpOnly?: boolean;
+    maxAge?: number;
+    name: string;
+    path?: string;
+    sameSite?: 'Lax' | 'None' | 'Strict';
+    secure?: boolean;
+    value: string | undefined;
+};
+type AuthCookieArgs = {
+    authConfig: Auth;
+    cookiePrefix: string;
+    serverAdapter: ServerAdapter;
+};
+/** Writes an already-generated cookie through the framework's cookie API. */
+export declare function applyAuthCookie({ cookie, serverAdapter, }: {
+    cookie: GeneratedCookie;
+    serverAdapter: ServerAdapter;
+}): Promise<void>;
+/** Writes the Payload auth cookie for `token` through the framework's cookie API. */
+export declare function setAuthCookie({ authConfig, cookiePrefix, serverAdapter, token, }: {
+    token: string;
+} & AuthCookieArgs): Promise<void>;
+/**
+ * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`
+ * attributes it was set with — a mismatched `domain` leaves the original cookie
+ * in place.
+ */
+export declare function clearAuthCookie({ authConfig, cookiePrefix, serverAdapter, }: AuthCookieArgs): Promise<void>;
+/** Reads the request's existing Payload auth cookie, if any. */
+export declare function getExistingAuthToken({ cookiePrefix, serverAdapter, }: {
+    cookiePrefix: string;
+    serverAdapter: ServerAdapter;
+}): Promise<{
+    name: string;
+    value: string;
+} | undefined>;
+export {};
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/serverFunctions/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAIvC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAcD,KAAK,cAAc,GAAG;IACpB,UAAU,EAAE,IAAI,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,aAAa,GACd,EAAE;IACD,MAAM,EAAE,eAAe,CAAA;IACvB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,YAAY,EACZ,aAAa,EACb,KAAK,GACN,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CASpD;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,YAAY,EACZ,aAAa,GACd,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhC;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CAAC,EACzC,YAAY,EACZ,aAAa,GACd,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CASvD"}

package/dist/auth/serverFunctions/cookies.js

@@ -0,0 +1,52 @@
+import { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js';
+// `generateCookie` emits capitalized `SameSite` values (as they appear in the
+// header); `CookieOptions` takes the lowercase form.
+const toCookieOptions = (cookie)=>({
+        domain: cookie.domain,
+        expires: cookie.expires ? new Date(cookie.expires) : undefined,
+        httpOnly: cookie.httpOnly,
+        maxAge: cookie.maxAge,
+        path: cookie.path,
+        sameSite: cookie.sameSite?.toLowerCase(),
+        secure: cookie.secure
+    });
+/** Writes an already-generated cookie through the framework's cookie API. */ export async function applyAuthCookie({ cookie, serverAdapter }) {
+    if (!cookie.value) {
+        return;
+    }
+    await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie));
+}
+/** Writes the Payload auth cookie for `token` through the framework's cookie API. */ export async function setAuthCookie({ authConfig, cookiePrefix, serverAdapter, token }) {
+    const cookie = generatePayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        returnCookieAsObject: true,
+        token
+    });
+    await applyAuthCookie({
+        cookie,
+        serverAdapter
+    });
+}
+/**
+ * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`
+ * attributes it was set with — a mismatched `domain` leaves the original cookie
+ * in place.
+ */ export async function clearAuthCookie({ authConfig, cookiePrefix, serverAdapter }) {
+    const cookie = generateExpiredPayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        returnCookieAsObject: true
+    });
+    await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie));
+}
+/** Reads the request's existing Payload auth cookie, if any. */ export async function getExistingAuthToken({ cookiePrefix, serverAdapter }) {
+    const store = await serverAdapter.getCookies();
+    const allCookies = store.getAll?.();
+    if (allCookies) {
+        return allCookies.find((cookie)=>cookie.name.startsWith(cookiePrefix));
+    }
+    return store.get(`${cookiePrefix}-token`) ?? undefined;
+}
+
+//# sourceMappingURL=cookies.js.map

package/dist/auth/serverFunctions/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/cookies.ts"],"sourcesContent":["import type { CookieOptions } from '../../admin/adapters/cookies.js'\nimport type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { Auth } from '../types.js'\n\nimport { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js'\n\n/**\n * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`\n * when `returnCookieAsObject` is `true`.\n */\nexport type GeneratedCookie = {\n  domain?: string\n  expires?: string\n  httpOnly?: boolean\n  maxAge?: number\n  name: string\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n  value: string | undefined\n}\n\n// `generateCookie` emits capitalized `SameSite` values (as they appear in the\n// header); `CookieOptions` takes the lowercase form.\nconst toCookieOptions = (cookie: GeneratedCookie): CookieOptions => ({\n  domain: cookie.domain,\n  expires: cookie.expires ? new Date(cookie.expires) : undefined,\n  httpOnly: cookie.httpOnly,\n  maxAge: cookie.maxAge,\n  path: cookie.path,\n  sameSite: cookie.sameSite?.toLowerCase() as CookieOptions['sameSite'],\n  secure: cookie.secure,\n})\n\ntype AuthCookieArgs = {\n  authConfig: Auth\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}\n\n/** Writes an already-generated cookie through the framework's cookie API. */\nexport async function applyAuthCookie({\n  cookie,\n  serverAdapter,\n}: {\n  cookie: GeneratedCookie\n  serverAdapter: ServerAdapter\n}): Promise<void> {\n  if (!cookie.value) {\n    return\n  }\n\n  await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie))\n}\n\n/** Writes the Payload auth cookie for `token` through the framework's cookie API. */\nexport async function setAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n  token,\n}: { token: string } & AuthCookieArgs): Promise<void> {\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n    token,\n  }) as GeneratedCookie\n\n  await applyAuthCookie({ cookie, serverAdapter })\n}\n\n/**\n * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`\n * attributes it was set with — a mismatched `domain` leaves the original cookie\n * in place.\n */\nexport async function clearAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n}: AuthCookieArgs): Promise<void> {\n  const cookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n  }) as GeneratedCookie\n\n  await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie))\n}\n\n/** Reads the request's existing Payload auth cookie, if any. */\nexport async function getExistingAuthToken({\n  cookiePrefix,\n  serverAdapter,\n}: {\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}): Promise<{ name: string; value: string } | undefined> {\n  const store = await serverAdapter.getCookies()\n  const allCookies = store.getAll?.()\n\n  if (allCookies) {\n    return allCookies.find((cookie) => cookie.name.startsWith(cookiePrefix))\n  }\n\n  return store.get(`${cookiePrefix}-token`) ?? undefined\n}\n"],"names":["generateExpiredPayloadCookie","generatePayloadCookie","toCookieOptions","cookie","domain","expires","Date","undefined","httpOnly","maxAge","path","sameSite","toLowerCase","secure","applyAuthCookie","serverAdapter","value","setCookie","name","setAuthCookie","authConfig","cookiePrefix","token","collectionAuthConfig","returnCookieAsObject","clearAuthCookie","getExistingAuthToken","store","getCookies","allCookies","getAll","find","startsWith","get"],"mappings":"AAIA,SAASA,4BAA4B,EAAEC,qBAAqB,QAAQ,gBAAe;AAkBnF,8EAA8E;AAC9E,qDAAqD;AACrD,MAAMC,kBAAkB,CAACC,SAA4C,CAAA;QACnEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO,GAAG,IAAIC,KAAKH,OAAOE,OAAO,IAAIE;QACrDC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,MAAMP,OAAOO,IAAI;QACjBC,UAAUR,OAAOQ,QAAQ,EAAEC;QAC3BC,QAAQV,OAAOU,MAAM;IACvB,CAAA;AAQA,2EAA2E,GAC3E,OAAO,eAAeC,gBAAgB,EACpCX,MAAM,EACNY,aAAa,EAId;IACC,IAAI,CAACZ,OAAOa,KAAK,EAAE;QACjB;IACF;IAEA,MAAMD,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAEf,OAAOa,KAAK,EAAEd,gBAAgBC;AAC3E;AAEA,mFAAmF,GACnF,OAAO,eAAegB,cAAc,EAClCC,UAAU,EACVC,YAAY,EACZN,aAAa,EACbO,KAAK,EAC8B;IACnC,MAAMnB,SAASF,sBAAsB;QACnCsB,sBAAsBH;QACtBC;QACAG,sBAAsB;QACtBF;IACF;IAEA,MAAMR,gBAAgB;QAAEX;QAAQY;IAAc;AAChD;AAEA;;;;CAIC,GACD,OAAO,eAAeU,gBAAgB,EACpCL,UAAU,EACVC,YAAY,EACZN,aAAa,EACE;IACf,MAAMZ,SAASH,6BAA6B;QAC1CuB,sBAAsBH;QACtBC;QACAG,sBAAsB;IACxB;IAEA,MAAMT,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAE,IAAIhB,gBAAgBC;AACjE;AAEA,8DAA8D,GAC9D,OAAO,eAAeuB,qBAAqB,EACzCL,YAAY,EACZN,aAAa,EAId;IACC,MAAMY,QAAQ,MAAMZ,cAAca,UAAU;IAC5C,MAAMC,aAAaF,MAAMG,MAAM;IAE/B,IAAID,YAAY;QACd,OAAOA,WAAWE,IAAI,CAAC,CAAC5B,SAAWA,OAAOe,IAAI,CAACc,UAAU,CAACX;IAC5D;IAEA,OAAOM,MAAMM,GAAG,CAAC,GAAGZ,aAAa,MAAM,CAAC,KAAKd;AAC/C"}