payload 4.0.0-internal.fa345ef → 4.0.0-internal.fec2230

package/dist/admin/views/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/admin/views/index.ts"],"sourcesContent":["import type { ClientTranslationsObject } from '@payloadcms/translations'\n\nimport type { SanitizedPermissions } from '../../auth/index.js'\nimport type { ImportMap } from '../../bin/generateImportMap/index.js'\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { ClientConfig } from '../../config/client.js'\nimport type {\n  CustomComponent,\n  Locale,\n  MetaConfig,\n  PayloadComponent,\n  SanitizedConfig,\n  ServerProps,\n} from '../../config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { LanguageOptions } from '../LanguageOptions.js'\nimport type { Data, StaticDescription } from '../types.js'\nimport type { DocumentSubViewTypes } from './document.js'\n\nexport type AdminViewConfig = {\n  Component: PayloadComponent\n  /** Whether the path should be matched exactly or as a prefix */\n  exact?: boolean\n  meta?: MetaConfig\n  /**\n   * Any valid URL path or array of paths that [`path-to-regexp`](https://www.npmjs.com/package/path-to-regex) understands. Must begin with a forward slash (`/`).\n   */\n  path?: `/${string}`\n  sensitive?: boolean\n  strict?: boolean\n}\n\nexport type AdminViewClientProps = {\n  clientConfig: ClientConfig\n  collectionSlug?: SanitizedCollectionConfig['slug']\n  docID?: number | string\n  documentSubViewType?: DocumentSubViewTypes\n  folderID?: number | string\n  globalSlug?: SanitizedGlobalConfig['slug']\n  viewType: ViewTypes\n}\n\nexport type AdminViewServerPropsOnly = {\n  readonly clientConfig: ClientConfig\n  readonly collectionConfig?: SanitizedCollectionConfig\n  readonly disableActions?: boolean\n  /**\n   * @todo remove `docID` here as it is already contained in `initPageResult`\n   */\n  readonly docID?: number | string\n  readonly globalConfig?: SanitizedGlobalConfig\n  readonly importMap: ImportMap\n  readonly initialData?: Data\n  readonly initPageResult: InitPageResult\n  readonly params?: { [key: string]: string | string[] | undefined }\n  readonly redirectAfterCreate?: boolean\n  readonly redirectAfterDelete?: boolean\n  readonly redirectAfterDuplicate?: boolean\n  readonly redirectAfterRestore?: boolean\n  readonly viewActions?: CustomComponent[]\n} & ServerProps\n\nexport type AdminViewServerProps = AdminViewClientProps & AdminViewServerPropsOnly\n\n/**\n * @deprecated This should be removed in favor of direct props\n */\nexport type AdminViewComponent = PayloadComponent<AdminViewServerProps>\n\nexport type VisibleEntities = {\n  collections: SanitizedCollectionConfig['slug'][]\n  globals: SanitizedGlobalConfig['slug'][]\n}\n\nexport type InitPageResult = {\n  collectionConfig?: SanitizedCollectionConfig\n  cookies: Map<string, string>\n  docID?: number | string\n  globalConfig?: SanitizedGlobalConfig\n  languageOptions: LanguageOptions\n  locale?: Locale\n  permissions: SanitizedPermissions\n  redirectTo?: string\n  req: PayloadRequest\n  translations: ClientTranslationsObject\n  visibleEntities: VisibleEntities\n}\n\n/**\n * @todo This should be renamed to `ViewType` (singular)\n */\nexport type ViewTypes =\n  | 'account'\n  | 'createFirstUser'\n  | 'dashboard'\n  | 'document'\n  | 'hierarchy'\n  | 'list'\n  | 'reset'\n  | 'trash'\n  | 'verify'\n  | 'version'\n  | ({} & string)\n\nexport type ServerPropsFromView = {\n  collectionConfig?: SanitizedConfig['collections'][number]\n  globalConfig?: SanitizedConfig['globals'][number]\n  viewActions: CustomComponent[]\n}\n\n// Description\nexport type ViewDescriptionClientProps = {\n  collectionSlug?: SanitizedCollectionConfig['slug']\n  description: StaticDescription\n}\n\nexport type ViewDescriptionServerPropsOnly = {} & ServerProps\n\nexport type ViewDescriptionServerProps = ViewDescriptionClientProps & ViewDescriptionServerPropsOnly\n"],"names":[],"mappings":"AAuHA,WAAoG"}
+{"version":3,"sources":["../../../src/admin/views/index.ts"],"sourcesContent":["import type { ClientTranslationsObject } from '@payloadcms/translations'\n\nimport type { SanitizedPermissions } from '../../auth/index.js'\nimport type { ImportMap } from '../../cli/commands/generateImportMap/generateImportMap.js'\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { ClientConfig } from '../../config/client.js'\nimport type {\n  CustomComponent,\n  Locale,\n  MetaConfig,\n  PayloadComponent,\n  SanitizedConfig,\n  ServerProps,\n} from '../../config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { LanguageOptions } from '../LanguageOptions.js'\nimport type { Data, StaticDescription } from '../types.js'\nimport type { DocumentSubViewTypes } from './document.js'\n\nexport type AdminViewConfig = {\n  Component: PayloadComponent<AdminViewServerProps>\n  /** Whether the path should be matched exactly or as a prefix */\n  exact?: boolean\n  meta?: MetaConfig\n  /**\n   * Any valid URL path or array of paths that [`path-to-regexp`](https://www.npmjs.com/package/path-to-regex) understands. Must begin with a forward slash (`/`).\n   */\n  path?: `/${string}`\n  sensitive?: boolean\n  strict?: boolean\n}\n\nexport type AdminViewClientProps = {\n  clientConfig: ClientConfig\n  collectionSlug?: SanitizedCollectionConfig['slug']\n  docID?: number | string\n  documentSubViewType?: DocumentSubViewTypes\n  folderID?: number | string\n  globalSlug?: SanitizedGlobalConfig['slug']\n  viewType: ViewTypes\n}\n\nexport type AdminViewServerPropsOnly = {\n  readonly clientConfig: ClientConfig\n  readonly collectionConfig?: SanitizedCollectionConfig\n  readonly disableActions?: boolean\n  /**\n   * @todo remove `docID` here as it is already contained in `initPageResult`\n   */\n  readonly docID?: number | string\n  readonly globalConfig?: SanitizedGlobalConfig\n  readonly importMap: ImportMap\n  readonly initialData?: Data\n  readonly initPageResult: InitPageResult\n  readonly params?: { [key: string]: string | string[] | undefined }\n  readonly redirectAfterCreate?: boolean\n  readonly redirectAfterDelete?: boolean\n  readonly redirectAfterDuplicate?: boolean\n  readonly redirectAfterRestore?: boolean\n  readonly viewActions?: CustomComponent[]\n} & ServerProps\n\nexport type AdminViewServerProps = AdminViewClientProps & AdminViewServerPropsOnly\n\n/**\n * @deprecated This should be removed in favor of direct props\n */\nexport type AdminViewComponent = PayloadComponent<AdminViewServerProps>\n\nexport type VisibleEntities = {\n  collections: SanitizedCollectionConfig['slug'][]\n  globals: SanitizedGlobalConfig['slug'][]\n}\n\nexport type InitPageResult = {\n  collectionConfig?: SanitizedCollectionConfig\n  cookies: Map<string, string>\n  docID?: number | string\n  globalConfig?: SanitizedGlobalConfig\n  languageOptions: LanguageOptions\n  locale?: Locale\n  permissions: SanitizedPermissions\n  redirectTo?: string\n  req: PayloadRequest\n  translations: ClientTranslationsObject\n  visibleEntities: VisibleEntities\n}\n\n/**\n * @todo This should be renamed to `ViewType` (singular)\n */\nexport type ViewTypes =\n  | 'account'\n  | 'createFirstUser'\n  | 'dashboard'\n  | 'document'\n  | 'hierarchy'\n  | 'list'\n  | 'reset'\n  | 'trash'\n  | 'verify'\n  | 'version'\n  | ({} & string)\n\nexport type ServerPropsFromView = {\n  collectionConfig?: SanitizedConfig['collections'][number]\n  globalConfig?: SanitizedConfig['globals'][number]\n  viewActions: CustomComponent[]\n}\n\n// Description\nexport type ViewDescriptionClientProps = {\n  collectionSlug?: SanitizedCollectionConfig['slug']\n  description: StaticDescription\n}\n\nexport type ViewDescriptionServerPropsOnly = {} & ServerProps\n\nexport type ViewDescriptionServerProps = ViewDescriptionClientProps & ViewDescriptionServerPropsOnly\n"],"names":[],"mappings":"AAuHA,WAAoG"}

package/dist/auth/baseFields/apiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/baseFields/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,KAAK,EAAa,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAO9F,KAAK,2BAA2B,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;AAChF,KAAK,uBAAuB,GAAG,IAAI,CACjC,OAAO,CAAC,SAAS,CAAC,EAClB,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACjE,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,6EAKhC;IACD,WAAW,CAAC,EAAE,uBAAuB,CAAA;IACrC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAC1C,iBAAiB,CAAC,EAAE,2BAA2B,CAAA;IAC/C,mBAAmB,CAAC,EAAE,OAAO,CAAA;CACzB,KAAG,KAAK,EAwEb,CAAA"}
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/baseFields/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,KAAK,EAAa,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAqB9F,KAAK,2BAA2B,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;AAChF,KAAK,uBAAuB,GAAG,IAAI,CACjC,OAAO,CAAC,SAAS,CAAC,EAClB,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACjE,CAAA;AAED,eAAO,MAAM,kBAAkB,gFAK5B;IACD,WAAW,CAAC,EAAE,uBAAuB,CAAA;IACrC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAC1C,iBAAiB,CAAC,EAAE,2BAA2B,CAAA;IAC/C,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,KAAQ,KAAK,EAwEb,CAAA"}

package/dist/auth/baseFields/apiKey.js

@@ -1,6 +1,21 @@
 import crypto from 'crypto';
 const encryptKey = ({ req, value })=>value ? req.payload.encrypt(value) : null;
-const decryptKey = ({ req, value })=>value ? req.payload.decrypt(value) : undefined;
+const decryptKey = ({ req, value })=>{
+    if (!value) {
+        return undefined;
+    }
+    try {
+        return req.payload.decrypt(value);
+    } catch  {
+        // The value was encrypted under a secret no longer in the keyring (e.g. a
+        // previousSecret was removed before rotateSecret re-keyed this row). Mask the
+        // field (return null, since an undefined afterRead result is treated as "no
+        // change" and would leak the ciphertext) rather than failing the whole
+        // document read; API key auth is unaffected (it matches the apiKeyIndex), and
+        // running rotateSecret restores the displayed value.
+        return null;
+    }
+};
 export const createAPIKeyFields = ({ apiKeyField, apiKeyIndexField, enableAPIKeyField, includeEnableAPIKey = true } = {})=>{
     const fields = [];
     if (includeEnableAPIKey) {

package/dist/auth/baseFields/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/baseFields/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { CheckboxField, Field, FieldHook, TextField } from '../../fields/config/types.js'\n\nconst encryptKey: FieldHook = ({ req, value }) =>\n  value ? req.payload.encrypt(value as string) : null\nconst decryptKey: FieldHook = ({ req, value }) =>\n  value ? req.payload.decrypt(value as string) : undefined\n\ntype APIKeyCheckboxFieldOverride = Omit<Partial<CheckboxField>, 'name' | 'type'>\ntype APIKeyTextFieldOverride = Omit<\n  Partial<TextField>,\n  'hasMany' | 'maxRows' | 'minRows' | 'name' | 'type' | 'validate'\n>\n\nexport const createAPIKeyFields = ({\n  apiKeyField,\n  apiKeyIndexField,\n  enableAPIKeyField,\n  includeEnableAPIKey = true,\n}: {\n  apiKeyField?: APIKeyTextFieldOverride\n  apiKeyIndexField?: APIKeyTextFieldOverride\n  enableAPIKeyField?: APIKeyCheckboxFieldOverride\n  includeEnableAPIKey?: boolean\n} = {}): Field[] => {\n  const fields: Field[] = []\n\n  if (includeEnableAPIKey) {\n    fields.push({\n      name: 'enableAPIKey',\n      type: 'checkbox',\n      ...enableAPIKeyField,\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...enableAPIKeyField?.admin,\n      },\n      label: enableAPIKeyField?.label ?? (({ t }) => t('authentication:enableAPIKey')),\n    })\n  }\n\n  fields.push(\n    {\n      name: 'apiKey',\n      type: 'text',\n      ...apiKeyField,\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...apiKeyField?.admin,\n      },\n      hooks: {\n        afterRead: [decryptKey],\n        beforeChange: [encryptKey],\n        ...apiKeyField?.hooks,\n      },\n      label: apiKeyField?.label ?? (({ t }) => t('authentication:apiKey')),\n    },\n    {\n      name: 'apiKeyIndex',\n      type: 'text',\n      ...apiKeyIndexField,\n      admin: {\n        disabled: true,\n        ...apiKeyIndexField?.admin,\n      },\n      hidden: apiKeyIndexField?.hidden ?? true,\n      hooks: {\n        beforeValidate: [\n          ({ data, req, value }) => {\n            if (data?.apiKey === false || data?.apiKey === null || data?.apiKey === '') {\n              return null\n            }\n            if (\n              includeEnableAPIKey &&\n              (data?.enableAPIKey === false || data?.enableAPIKey === null)\n            ) {\n              return null\n            }\n            if (data?.apiKey) {\n              return crypto\n                .createHmac('sha256', req.payload.secret)\n                .update(data.apiKey as string)\n                .digest('hex')\n            }\n            return value\n          },\n        ],\n        ...apiKeyIndexField?.hooks,\n      },\n    },\n  )\n\n  return fields\n}\n"],"names":["crypto","encryptKey","req","value","payload","encrypt","decryptKey","decrypt","undefined","createAPIKeyFields","apiKeyField","apiKeyIndexField","enableAPIKeyField","includeEnableAPIKey","fields","push","name","type","admin","components","Field","label","t","hooks","afterRead","beforeChange","disabled","hidden","beforeValidate","data","apiKey","enableAPIKey","createHmac","secret","update","digest"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAI3B,MAAMC,aAAwB,CAAC,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAC3CA,QAAQD,IAAIE,OAAO,CAACC,OAAO,CAACF,SAAmB;AACjD,MAAMG,aAAwB,CAAC,EAAEJ,GAAG,EAAEC,KAAK,EAAE,GAC3CA,QAAQD,IAAIE,OAAO,CAACG,OAAO,CAACJ,SAAmBK;AAQjD,OAAO,MAAMC,qBAAqB,CAAC,EACjCC,WAAW,EACXC,gBAAgB,EAChBC,iBAAiB,EACjBC,sBAAsB,IAAI,EAM3B,GAAG,CAAC,CAAC;IACJ,MAAMC,SAAkB,EAAE;IAE1B,IAAID,qBAAqB;QACvBC,OAAOC,IAAI,CAAC;YACVC,MAAM;YACNC,MAAM;YACN,GAAGL,iBAAiB;YACpBM,OAAO;gBACLC,YAAY;oBACVC,OAAO;gBACT;gBACA,GAAGR,mBAAmBM,KAAK;YAC7B;YACAG,OAAOT,mBAAmBS,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,8BAA6B;QAChF;IACF;IAEAR,OAAOC,IAAI,CACT;QACEC,MAAM;QACNC,MAAM;QACN,GAAGP,WAAW;QACdQ,OAAO;YACLC,YAAY;gBACVC,OAAO;YACT;YACA,GAAGV,aAAaQ,KAAK;QACvB;QACAK,OAAO;YACLC,WAAW;gBAAClB;aAAW;YACvBmB,cAAc;gBAACxB;aAAW;YAC1B,GAAGS,aAAaa,KAAK;QACvB;QACAF,OAAOX,aAAaW,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,wBAAuB;IACpE,GACA;QACEN,MAAM;QACNC,MAAM;QACN,GAAGN,gBAAgB;QACnBO,OAAO;YACLQ,UAAU;YACV,GAAGf,kBAAkBO,KAAK;QAC5B;QACAS,QAAQhB,kBAAkBgB,UAAU;QACpCJ,OAAO;YACLK,gBAAgB;gBACd,CAAC,EAAEC,IAAI,EAAE3B,GAAG,EAAEC,KAAK,EAAE;oBACnB,IAAI0B,MAAMC,WAAW,SAASD,MAAMC,WAAW,QAAQD,MAAMC,WAAW,IAAI;wBAC1E,OAAO;oBACT;oBACA,IACEjB,uBACCgB,CAAAA,MAAME,iBAAiB,SAASF,MAAME,iBAAiB,IAAG,GAC3D;wBACA,OAAO;oBACT;oBACA,IAAIF,MAAMC,QAAQ;wBAChB,OAAO9B,OACJgC,UAAU,CAAC,UAAU9B,IAAIE,OAAO,CAAC6B,MAAM,EACvCC,MAAM,CAACL,KAAKC,MAAM,EAClBK,MAAM,CAAC;oBACZ;oBACA,OAAOhC;gBACT;aACD;YACD,GAAGQ,kBAAkBY,KAAK;QAC5B;IACF;IAGF,OAAOT;AACT,EAAC"}
+{"version":3,"sources":["../../../src/auth/baseFields/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { CheckboxField, Field, FieldHook, TextField } from '../../fields/config/types.js'\n\nconst encryptKey: FieldHook = ({ req, value }) =>\n  value ? req.payload.encrypt(value as string) : null\nconst decryptKey: FieldHook = ({ req, value }) => {\n  if (!value) {\n    return undefined\n  }\n  try {\n    return req.payload.decrypt(value as string)\n  } catch {\n    // The value was encrypted under a secret no longer in the keyring (e.g. a\n    // previousSecret was removed before rotateSecret re-keyed this row). Mask the\n    // field (return null, since an undefined afterRead result is treated as \"no\n    // change\" and would leak the ciphertext) rather than failing the whole\n    // document read; API key auth is unaffected (it matches the apiKeyIndex), and\n    // running rotateSecret restores the displayed value.\n    return null\n  }\n}\n\ntype APIKeyCheckboxFieldOverride = Omit<Partial<CheckboxField>, 'name' | 'type'>\ntype APIKeyTextFieldOverride = Omit<\n  Partial<TextField>,\n  'hasMany' | 'maxRows' | 'minRows' | 'name' | 'type' | 'validate'\n>\n\nexport const createAPIKeyFields = ({\n  apiKeyField,\n  apiKeyIndexField,\n  enableAPIKeyField,\n  includeEnableAPIKey = true,\n}: {\n  apiKeyField?: APIKeyTextFieldOverride\n  apiKeyIndexField?: APIKeyTextFieldOverride\n  enableAPIKeyField?: APIKeyCheckboxFieldOverride\n  includeEnableAPIKey?: boolean\n} = {}): Field[] => {\n  const fields: Field[] = []\n\n  if (includeEnableAPIKey) {\n    fields.push({\n      name: 'enableAPIKey',\n      type: 'checkbox',\n      ...enableAPIKeyField,\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...enableAPIKeyField?.admin,\n      },\n      label: enableAPIKeyField?.label ?? (({ t }) => t('authentication:enableAPIKey')),\n    })\n  }\n\n  fields.push(\n    {\n      name: 'apiKey',\n      type: 'text',\n      ...apiKeyField,\n      admin: {\n        components: {\n          Field: false,\n        },\n        ...apiKeyField?.admin,\n      },\n      hooks: {\n        afterRead: [decryptKey],\n        beforeChange: [encryptKey],\n        ...apiKeyField?.hooks,\n      },\n      label: apiKeyField?.label ?? (({ t }) => t('authentication:apiKey')),\n    },\n    {\n      name: 'apiKeyIndex',\n      type: 'text',\n      ...apiKeyIndexField,\n      admin: {\n        disabled: true,\n        ...apiKeyIndexField?.admin,\n      },\n      hidden: apiKeyIndexField?.hidden ?? true,\n      hooks: {\n        beforeValidate: [\n          ({ data, req, value }) => {\n            if (data?.apiKey === false || data?.apiKey === null || data?.apiKey === '') {\n              return null\n            }\n            if (\n              includeEnableAPIKey &&\n              (data?.enableAPIKey === false || data?.enableAPIKey === null)\n            ) {\n              return null\n            }\n            if (data?.apiKey) {\n              return crypto\n                .createHmac('sha256', req.payload.secret)\n                .update(data.apiKey as string)\n                .digest('hex')\n            }\n            return value\n          },\n        ],\n        ...apiKeyIndexField?.hooks,\n      },\n    },\n  )\n\n  return fields\n}\n"],"names":["crypto","encryptKey","req","value","payload","encrypt","decryptKey","undefined","decrypt","createAPIKeyFields","apiKeyField","apiKeyIndexField","enableAPIKeyField","includeEnableAPIKey","fields","push","name","type","admin","components","Field","label","t","hooks","afterRead","beforeChange","disabled","hidden","beforeValidate","data","apiKey","enableAPIKey","createHmac","secret","update","digest"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAI3B,MAAMC,aAAwB,CAAC,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAC3CA,QAAQD,IAAIE,OAAO,CAACC,OAAO,CAACF,SAAmB;AACjD,MAAMG,aAAwB,CAAC,EAAEJ,GAAG,EAAEC,KAAK,EAAE;IAC3C,IAAI,CAACA,OAAO;QACV,OAAOI;IACT;IACA,IAAI;QACF,OAAOL,IAAIE,OAAO,CAACI,OAAO,CAACL;IAC7B,EAAE,OAAM;QACN,0EAA0E;QAC1E,8EAA8E;QAC9E,4EAA4E;QAC5E,uEAAuE;QACvE,8EAA8E;QAC9E,qDAAqD;QACrD,OAAO;IACT;AACF;AAQA,OAAO,MAAMM,qBAAqB,CAAC,EACjCC,WAAW,EACXC,gBAAgB,EAChBC,iBAAiB,EACjBC,sBAAsB,IAAI,EAM3B,GAAG,CAAC,CAAC;IACJ,MAAMC,SAAkB,EAAE;IAE1B,IAAID,qBAAqB;QACvBC,OAAOC,IAAI,CAAC;YACVC,MAAM;YACNC,MAAM;YACN,GAAGL,iBAAiB;YACpBM,OAAO;gBACLC,YAAY;oBACVC,OAAO;gBACT;gBACA,GAAGR,mBAAmBM,KAAK;YAC7B;YACAG,OAAOT,mBAAmBS,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,8BAA6B;QAChF;IACF;IAEAR,OAAOC,IAAI,CACT;QACEC,MAAM;QACNC,MAAM;QACN,GAAGP,WAAW;QACdQ,OAAO;YACLC,YAAY;gBACVC,OAAO;YACT;YACA,GAAGV,aAAaQ,KAAK;QACvB;QACAK,OAAO;YACLC,WAAW;gBAAClB;aAAW;YACvBmB,cAAc;gBAACxB;aAAW;YAC1B,GAAGS,aAAaa,KAAK;QACvB;QACAF,OAAOX,aAAaW,SAAU,CAAA,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE,wBAAuB;IACpE,GACA;QACEN,MAAM;QACNC,MAAM;QACN,GAAGN,gBAAgB;QACnBO,OAAO;YACLQ,UAAU;YACV,GAAGf,kBAAkBO,KAAK;QAC5B;QACAS,QAAQhB,kBAAkBgB,UAAU;QACpCJ,OAAO;YACLK,gBAAgB;gBACd,CAAC,EAAEC,IAAI,EAAE3B,GAAG,EAAEC,KAAK,EAAE;oBACnB,IAAI0B,MAAMC,WAAW,SAASD,MAAMC,WAAW,QAAQD,MAAMC,WAAW,IAAI;wBAC1E,OAAO;oBACT;oBACA,IACEjB,uBACCgB,CAAAA,MAAME,iBAAiB,SAASF,MAAME,iBAAiB,IAAG,GAC3D;wBACA,OAAO;oBACT;oBACA,IAAIF,MAAMC,QAAQ;wBAChB,OAAO9B,OACJgC,UAAU,CAAC,UAAU9B,IAAIE,OAAO,CAAC6B,MAAM,EACvCC,MAAM,CAACL,KAAKC,MAAM,EAClBK,MAAM,CAAC;oBACZ;oBACA,OAAOhC;gBACT;aACD;YACD,GAAGQ,kBAAkBY,KAAK;QAC5B;IACF;IAGF,OAAOT;AACT,EAAC"}

package/dist/auth/cookies.d.ts

@@ -33,8 +33,8 @@ type GeneratePayloadCookieArgs = {
     returnCookieAsObject?: boolean;
     token: string;
 };
-export declare const generatePayloadCookie: <T extends GeneratePayloadCookieArgs>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, token, }: T) => T["returnCookieAsObject"] extends true ? CookieObject : string;
-export declare const generateExpiredPayloadCookie: <T extends Omit<GeneratePayloadCookieArgs, "token">>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, }: T) => T["returnCookieAsObject"] extends true ? CookieObject : string;
+export declare const generatePayloadCookie: <T extends GeneratePayloadCookieArgs>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, token, }: T) => T['returnCookieAsObject'] extends true ? CookieObject : string;
+export declare const generateExpiredPayloadCookie: <T extends Omit<GeneratePayloadCookieArgs, 'token'>>({ collectionAuthConfig, cookiePrefix, returnCookieAsObject, }: T) => T['returnCookieAsObject'] extends true ? CookieObject : string;
 export declare function parseCookies(headers: Request['headers']): Map<string, string>;
 export {};
 //# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAEjF,KAAK,aAAa,GAAG;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,KAAK,YAAY,GAAG;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,oBAAoB,GAAG,OAAO,EAC3D,MAAM,aAAa,KAClB,oBAAoB,SAAS,IAAI,GAAG,YAAY,GAAG,MAiFrD,CAAA;AACD,KAAK,uBAAuB,GAAG;IAK7B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,eAAO,MAAM,mBAAmB,GAAI,aAAoB,uBAAuB,SAI9E,CAAA;AAED,KAAK,yBAAyB,GAAG;IAE/B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAEvD,YAAY,EAAE,MAAM,CAAA;IAEpB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,yBAAyB,EAAE,sEAKxE,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAmB9D,CAAA;AAED,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,EAAE,+DAI9F,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAoB9D,CAAA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,uBA8CvD"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAEjF,KAAK,aAAa,GAAG;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,KAAK,YAAY,GAAG;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,oBAAoB,GAAG,OAAO,QACrD,aAAa,KAClB,oBAAoB,SAAS,IAAI,GAAG,YAAY,GAAG,MAiFrD,CAAA;AACD,KAAK,uBAAuB,GAAG;IAK7B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,eAAO,MAAM,mBAAmB,gBAAwB,uBAAuB,SAI9E,CAAA;AAED,KAAK,yBAAyB,GAAG;IAE/B,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAEvD,YAAY,EAAE,MAAM,CAAA;IAEpB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,yBAAyB,wEAKtE,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAmB9D,CAAA;AAED,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,iEAI5F,CAAC,KAAG,CAAC,CAAC,sBAAsB,CAAC,SAAS,IAAI,GAAG,YAAY,GAAG,MAoB9D,CAAA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,uBA8CvD"}

package/dist/auth/crypto.d.ts

@@ -1,3 +1,74 @@
-export declare function encrypt(text: string): string;
-export declare function decrypt(hash: string): string;
+/**
+ * A single secret in the keyring, with its derived keys precomputed.
+ */
+export type EncryptionKey = {
+    /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */
+    keyId: string;
+    /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */
+    legacyKey: string;
+    /** The raw `PAYLOAD_SECRET` string. */
+    secret: string;
+    /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */
+    v1Key: Buffer;
+};
+/**
+ * The set of secrets Payload accepts. `active` is used for all writes; every
+ * entry (active + `previousSecrets`) is accepted for reads.
+ */
+export type EncryptionKeyring = {
+    /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */
+    active: EncryptionKey;
+    all: EncryptionKey[];
+    /** keyId -> entry, for O(1) v1 key selection. */
+    byId: Record<string, EncryptionKey>;
+};
+type CryptoContext = {
+    encryptionKeyring: EncryptionKeyring;
+    secret: string;
+};
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */
+export declare const deriveSecretKey: (secret: string) => string;
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */
+export declare const deriveKeyV1: (secret: string) => Buffer;
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */
+export declare const keyIdFor: (v1Key: Buffer) => string;
+export declare const buildEncryptionKey: (secret: string) => EncryptionKey;
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */
+export declare const buildEncryptionKeyring: (secrets: string[]) => EncryptionKeyring;
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */
+export declare function encrypt(this: CryptoContext, text: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */
+export declare function decrypt(this: CryptoContext, hash: string, options?: {
+    secret?: string;
+}): string;
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */
+export declare function reencrypt(this: CryptoContext, hash: string, options: {
+    oldSecret: string;
+}): string;
+export {};
 //# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAIA,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5C;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS5C"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oEAAoE;IACpE,MAAM,EAAE,aAAa,CAAA;IACrB,GAAG,EAAE,aAAa,EAAE,CAAA;IACpB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CACpC,CAAA;AAED,KAAK,aAAa,GAAG;IACnB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAMD;;;GAGG;AACH,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,MACsB,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,MACgC,CAAA;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MAC6B,CAAA;AAEtE,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,aAQnD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,YAAa,MAAM,EAAE,KAAG,iBAU1D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAUhG;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAuChG;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7B,MAAM,CAGR"}

package/dist/auth/crypto.js

@@ -1,21 +1,98 @@
 import crypto from 'crypto';
-const algorithm = 'aes-256-ctr';
-export function encrypt(text) {
-    const iv = crypto.randomBytes(16);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const cipher = crypto.createCipheriv(algorithm, secret, iv);
-    const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
-    const ivString = iv.toString('hex');
-    return `${ivString}${encrypted}`;
+const legacyAlgorithm = 'aes-256-ctr';
+const v1Algorithm = 'aes-256-gcm';
+const v1Prefix = 'v1';
+/**
+ * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).
+ * Kept in sync with `BasePayload.secret`.
+ */ export const deriveSecretKey = (secret)=>crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32);
+/**
+ * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced
+ * effective entropy of the legacy derivation.
+ */ export const deriveKeyV1 = (secret)=>Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32));
+/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */ export const keyIdFor = (v1Key)=>crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16);
+export const buildEncryptionKey = (secret)=>{
+    const v1Key = deriveKeyV1(secret);
+    return {
+        keyId: keyIdFor(v1Key),
+        legacyKey: deriveSecretKey(secret),
+        secret,
+        v1Key
+    };
+};
+/**
+ * Builds the keyring from the active secret followed by any previous secrets.
+ * The first entry is the active (writing) key.
+ */ export const buildEncryptionKeyring = (secrets)=>{
+    const all = secrets.map(buildEncryptionKey);
+    const byId = {};
+    for (const key of all){
+        // First writer wins if two secrets somehow share a keyId.
+        if (!byId[key.keyId]) {
+            byId[key.keyId] = key;
+        }
+    }
+    return {
+        active: all[0],
+        all,
+        byId
+    };
+};
+/**
+ * Encrypts `text` under the active secret using the versioned aes-256-gcm
+ * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the
+ * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.
+ */ export function encrypt(text, options) {
+    const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active;
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv);
+    const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`;
 }
-export function decrypt(hash) {
+/**
+ * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1
+ * envelopes are authenticated (aes-256-gcm) and select their key by keyId from
+ * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to
+ * decrypt under a specific secret (e.g. to read data encrypted under a previous
+ * secret during a rotation).
+ */ export function decrypt(hash, options) {
+    if (hash.startsWith(`${v1Prefix}:`)) {
+        const parts = hash.split(':');
+        if (parts.length !== 5) {
+            throw new Error('decrypt: malformed v1 envelope, expected "v1:keyId:iv:authTag:ciphertext".');
+        }
+        const [, keyId, ivHex, authTagHex, ciphertext] = parts;
+        const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.byId[keyId];
+        if (!key) {
+            throw new Error(`decrypt: no secret in the keyring matches key id "${keyId}". Add the secret that encrypted this value to config.previousSecrets.`);
+        }
+        const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex, 'hex'));
+        decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
+        // final() throws on a wrong key or tampered ciphertext.
+        return decipher.update(ciphertext, 'hex', 'utf8') + decipher.final('utf8');
+    }
+    // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong
+    // key returns garbage instead of throwing. We therefore intentionally use only
+    // the explicit or active key here (never trial the keyring): a legacy value
+    // written under a previous secret decrypts to garbage until rotateSecret
+    // upgrades it to the authenticated v1 envelope. API key auth is unaffected
+    // (it matches the HMAC apiKeyIndex, which is keyring-aware).
+    const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret;
     const iv = hash.slice(0, 32);
     const content = hash.slice(32);
-    // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-    const secret = this.secret;
-    const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'));
+    const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'));
     return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8');
 }
+/**
+ * Re-encrypts a value that was encrypted under a previous secret: decrypts it
+ * with `options.oldSecret`, then re-encrypts it with the active secret. Also
+ * upgrades a legacy aes-256-ctr value to the v1 envelope.
+ */ export function reencrypt(hash, options) {
+    const plaintext = decrypt.call(this, hash, {
+        secret: options.oldSecret
+    });
+    return encrypt.call(this, plaintext);
+}
 
 //# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\nconst algorithm = 'aes-256-ctr'\n\nexport function encrypt(text: string): string {\n  const iv = crypto.randomBytes(16)\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const cipher = crypto.createCipheriv(algorithm, secret, iv)\n\n  const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const ivString = iv.toString('hex')\n\n  return `${ivString}${encrypted}`\n}\n\nexport function decrypt(hash: string): string {\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n\n  // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n  const secret = this.secret\n  const decipher = crypto.createDecipheriv(algorithm, secret, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n"],"names":["crypto","algorithm","encrypt","text","iv","randomBytes","secret","cipher","createCipheriv","encrypted","update","final","ivString","toString","decrypt","hash","slice","content","decipher","createDecipheriv","Buffer","from"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAE3B,MAAMC,YAAY;AAElB,OAAO,SAASC,QAAQC,IAAY;IAClC,MAAMC,KAAKJ,OAAOK,WAAW,CAAC;IAC9B,oFAAoF;IACpF,MAAMC,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMC,SAASP,OAAOQ,cAAc,CAACP,WAAWK,QAAQF;IAExD,MAAMK,YAAYF,OAAOG,MAAM,CAACP,MAAM,QAAQ,SAASI,OAAOI,KAAK,CAAC;IACpE,MAAMC,WAAWR,GAAGS,QAAQ,CAAC;IAE7B,OAAO,GAAGD,WAAWH,WAAW;AAClC;AAEA,OAAO,SAASK,QAAQC,IAAY;IAClC,MAAMX,KAAKW,KAAKC,KAAK,CAAC,GAAG;IACzB,MAAMC,UAAUF,KAAKC,KAAK,CAAC;IAE3B,oFAAoF;IACpF,MAAMV,SAAS,IAAI,CAACA,MAAM;IAC1B,MAAMY,WAAWlB,OAAOmB,gBAAgB,CAAClB,WAAWK,QAAQc,OAAOC,IAAI,CAACjB,IAAI;IAE5E,OAAOc,SAASR,MAAM,CAACO,SAAS,OAAO,UAAUC,SAASP,KAAK,CAAC;AAClE"}
+{"version":3,"sources":["../../src/auth/crypto.ts"],"sourcesContent":["import crypto from 'crypto'\n\n/**\n * A single secret in the keyring, with its derived keys precomputed.\n */\nexport type EncryptionKey = {\n  /** One-way fingerprint of `v1Key` (16 hex chars), stored in the v1 envelope. */\n  keyId: string\n  /** Legacy 32-char key for aes-256-ctr and the apiKey HMAC index. */\n  legacyKey: string\n  /** The raw `PAYLOAD_SECRET` string. */\n  secret: string\n  /** True 32-byte key (HKDF) for the aes-256-gcm v1 envelope. */\n  v1Key: Buffer\n}\n\n/**\n * The set of secrets Payload accepts. `active` is used for all writes; every\n * entry (active + `previousSecrets`) is accepted for reads.\n */\nexport type EncryptionKeyring = {\n  /** Entry used for all new writes (the current `PAYLOAD_SECRET`). */\n  active: EncryptionKey\n  all: EncryptionKey[]\n  /** keyId -> entry, for O(1) v1 key selection. */\n  byId: Record<string, EncryptionKey>\n}\n\ntype CryptoContext = {\n  encryptionKeyring: EncryptionKeyring\n  secret: string\n}\n\nconst legacyAlgorithm = 'aes-256-ctr'\nconst v1Algorithm = 'aes-256-gcm'\nconst v1Prefix = 'v1'\n\n/**\n * Legacy key derivation (pre-v1 aes-256-ctr values and the apiKey HMAC index).\n * Kept in sync with `BasePayload.secret`.\n */\nexport const deriveSecretKey = (secret: string): string =>\n  crypto.createHash('sha256').update(secret).digest('hex').slice(0, 32)\n\n/**\n * v1 key derivation: a true 32-byte key via HKDF, correcting the reduced\n * effective entropy of the legacy derivation.\n */\nexport const deriveKeyV1 = (secret: string): Buffer =>\n  Buffer.from(crypto.hkdfSync('sha256', secret, '', 'payload-secret-v1', 32))\n\n/** Non-secret fingerprint of a v1 key, used to select the key on decrypt. */\nexport const keyIdFor = (v1Key: Buffer): string =>\n  crypto.createHash('sha256').update(v1Key).digest('hex').slice(0, 16)\n\nexport const buildEncryptionKey = (secret: string): EncryptionKey => {\n  const v1Key = deriveKeyV1(secret)\n  return {\n    keyId: keyIdFor(v1Key),\n    legacyKey: deriveSecretKey(secret),\n    secret,\n    v1Key,\n  }\n}\n\n/**\n * Builds the keyring from the active secret followed by any previous secrets.\n * The first entry is the active (writing) key.\n */\nexport const buildEncryptionKeyring = (secrets: string[]): EncryptionKeyring => {\n  const all = secrets.map(buildEncryptionKey)\n  const byId: Record<string, EncryptionKey> = {}\n  for (const key of all) {\n    // First writer wins if two secrets somehow share a keyId.\n    if (!byId[key.keyId]) {\n      byId[key.keyId] = key\n    }\n  }\n  return { active: all[0]!, all, byId }\n}\n\n/**\n * Encrypts `text` under the active secret using the versioned aes-256-gcm\n * envelope `v1:<keyId>:<iv>:<authTag>:<ciphertext>`. Pass `options.secret` (the\n * raw `PAYLOAD_SECRET`) to encrypt under a specific secret instead.\n */\nexport function encrypt(this: CryptoContext, text: string, options?: { secret?: string }): string {\n  const key = options?.secret ? buildEncryptionKey(options.secret) : this.encryptionKeyring.active\n\n  const iv = crypto.randomBytes(12)\n  const cipher = crypto.createCipheriv(v1Algorithm, key.v1Key, iv)\n\n  const ciphertext = cipher.update(text, 'utf8', 'hex') + cipher.final('hex')\n  const authTag = cipher.getAuthTag().toString('hex')\n\n  return `${v1Prefix}:${key.keyId}:${iv.toString('hex')}:${authTag}:${ciphertext}`\n}\n\n/**\n * Decrypts a value produced by {@link encrypt}. Dispatches on format: v1\n * envelopes are authenticated (aes-256-gcm) and select their key by keyId from\n * the keyring; pre-v1 values fall back to aes-256-ctr. Pass `options.secret` to\n * decrypt under a specific secret (e.g. to read data encrypted under a previous\n * secret during a rotation).\n */\nexport function decrypt(this: CryptoContext, hash: string, options?: { secret?: string }): string {\n  if (hash.startsWith(`${v1Prefix}:`)) {\n    const parts = hash.split(':')\n\n    if (parts.length !== 5) {\n      throw new Error('decrypt: malformed v1 envelope, expected \"v1:keyId:iv:authTag:ciphertext\".')\n    }\n\n    const [, keyId, ivHex, authTagHex, ciphertext] = parts\n\n    const key = options?.secret\n      ? buildEncryptionKey(options.secret)\n      : this.encryptionKeyring.byId[keyId!]\n\n    if (!key) {\n      throw new Error(\n        `decrypt: no secret in the keyring matches key id \"${keyId}\". Add the secret that encrypted this value to config.previousSecrets.`,\n      )\n    }\n\n    const decipher = crypto.createDecipheriv(v1Algorithm, key.v1Key, Buffer.from(ivHex!, 'hex'))\n    decipher.setAuthTag(Buffer.from(authTagHex!, 'hex'))\n\n    // final() throws on a wrong key or tampered ciphertext.\n    return decipher.update(ciphertext!, 'hex', 'utf8') + decipher.final('utf8')\n  }\n\n  // Legacy aes-256-ctr is unauthenticated, so it cannot verify a key and a wrong\n  // key returns garbage instead of throwing. We therefore intentionally use only\n  // the explicit or active key here (never trial the keyring): a legacy value\n  // written under a previous secret decrypts to garbage until rotateSecret\n  // upgrades it to the authenticated v1 envelope. API key auth is unaffected\n  // (it matches the HMAC apiKeyIndex, which is keyring-aware).\n  const legacyKey = options?.secret ? deriveSecretKey(options.secret) : this.secret\n  const iv = hash.slice(0, 32)\n  const content = hash.slice(32)\n  const decipher = crypto.createDecipheriv(legacyAlgorithm, legacyKey, Buffer.from(iv, 'hex'))\n\n  return decipher.update(content, 'hex', 'utf8') + decipher.final('utf8')\n}\n\n/**\n * Re-encrypts a value that was encrypted under a previous secret: decrypts it\n * with `options.oldSecret`, then re-encrypts it with the active secret. Also\n * upgrades a legacy aes-256-ctr value to the v1 envelope.\n */\nexport function reencrypt(\n  this: CryptoContext,\n  hash: string,\n  options: { oldSecret: string },\n): string {\n  const plaintext = decrypt.call(this, hash, { secret: options.oldSecret })\n  return encrypt.call(this, plaintext)\n}\n"],"names":["crypto","legacyAlgorithm","v1Algorithm","v1Prefix","deriveSecretKey","secret","createHash","update","digest","slice","deriveKeyV1","Buffer","from","hkdfSync","keyIdFor","v1Key","buildEncryptionKey","keyId","legacyKey","buildEncryptionKeyring","secrets","all","map","byId","key","active","encrypt","text","options","encryptionKeyring","iv","randomBytes","cipher","createCipheriv","ciphertext","final","authTag","getAuthTag","toString","decrypt","hash","startsWith","parts","split","length","Error","ivHex","authTagHex","decipher","createDecipheriv","setAuthTag","content","reencrypt","plaintext","call","oldSecret"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAiC3B,MAAMC,kBAAkB;AACxB,MAAMC,cAAc;AACpB,MAAMC,WAAW;AAEjB;;;CAGC,GACD,OAAO,MAAMC,kBAAkB,CAACC,SAC9BL,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACF,QAAQG,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEvE;;;CAGC,GACD,OAAO,MAAMC,cAAc,CAACL,SAC1BM,OAAOC,IAAI,CAACZ,OAAOa,QAAQ,CAAC,UAAUR,QAAQ,IAAI,qBAAqB,KAAI;AAE7E,2EAA2E,GAC3E,OAAO,MAAMS,WAAW,CAACC,QACvBf,OAAOM,UAAU,CAAC,UAAUC,MAAM,CAACQ,OAAOP,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,IAAG;AAEtE,OAAO,MAAMO,qBAAqB,CAACX;IACjC,MAAMU,QAAQL,YAAYL;IAC1B,OAAO;QACLY,OAAOH,SAASC;QAChBG,WAAWd,gBAAgBC;QAC3BA;QACAU;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMI,yBAAyB,CAACC;IACrC,MAAMC,MAAMD,QAAQE,GAAG,CAACN;IACxB,MAAMO,OAAsC,CAAC;IAC7C,KAAK,MAAMC,OAAOH,IAAK;QACrB,0DAA0D;QAC1D,IAAI,CAACE,IAAI,CAACC,IAAIP,KAAK,CAAC,EAAE;YACpBM,IAAI,CAACC,IAAIP,KAAK,CAAC,GAAGO;QACpB;IACF;IACA,OAAO;QAAEC,QAAQJ,GAAG,CAAC,EAAE;QAAGA;QAAKE;IAAK;AACtC,EAAC;AAED;;;;CAIC,GACD,OAAO,SAASG,QAA6BC,IAAY,EAAEC,OAA6B;IACtF,MAAMJ,MAAMI,SAASvB,SAASW,mBAAmBY,QAAQvB,MAAM,IAAI,IAAI,CAACwB,iBAAiB,CAACJ,MAAM;IAEhG,MAAMK,KAAK9B,OAAO+B,WAAW,CAAC;IAC9B,MAAMC,SAAShC,OAAOiC,cAAc,CAAC/B,aAAasB,IAAIT,KAAK,EAAEe;IAE7D,MAAMI,aAAaF,OAAOzB,MAAM,CAACoB,MAAM,QAAQ,SAASK,OAAOG,KAAK,CAAC;IACrE,MAAMC,UAAUJ,OAAOK,UAAU,GAAGC,QAAQ,CAAC;IAE7C,OAAO,GAAGnC,SAAS,CAAC,EAAEqB,IAAIP,KAAK,CAAC,CAAC,EAAEa,GAAGQ,QAAQ,CAAC,OAAO,CAAC,EAAEF,QAAQ,CAAC,EAAEF,YAAY;AAClF;AAEA;;;;;;CAMC,GACD,OAAO,SAASK,QAA6BC,IAAY,EAAEZ,OAA6B;IACtF,IAAIY,KAAKC,UAAU,CAAC,GAAGtC,SAAS,CAAC,CAAC,GAAG;QACnC,MAAMuC,QAAQF,KAAKG,KAAK,CAAC;QAEzB,IAAID,MAAME,MAAM,KAAK,GAAG;YACtB,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAM,GAAG5B,OAAO6B,OAAOC,YAAYb,WAAW,GAAGQ;QAEjD,MAAMlB,MAAMI,SAASvB,SACjBW,mBAAmBY,QAAQvB,MAAM,IACjC,IAAI,CAACwB,iBAAiB,CAACN,IAAI,CAACN,MAAO;QAEvC,IAAI,CAACO,KAAK;YACR,MAAM,IAAIqB,MACR,CAAC,kDAAkD,EAAE5B,MAAM,sEAAsE,CAAC;QAEtI;QAEA,MAAM+B,WAAWhD,OAAOiD,gBAAgB,CAAC/C,aAAasB,IAAIT,KAAK,EAAEJ,OAAOC,IAAI,CAACkC,OAAQ;QACrFE,SAASE,UAAU,CAACvC,OAAOC,IAAI,CAACmC,YAAa;QAE7C,wDAAwD;QACxD,OAAOC,SAASzC,MAAM,CAAC2B,YAAa,OAAO,UAAUc,SAASb,KAAK,CAAC;IACtE;IAEA,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAMjB,YAAYU,SAASvB,SAASD,gBAAgBwB,QAAQvB,MAAM,IAAI,IAAI,CAACA,MAAM;IACjF,MAAMyB,KAAKU,KAAK/B,KAAK,CAAC,GAAG;IACzB,MAAM0C,UAAUX,KAAK/B,KAAK,CAAC;IAC3B,MAAMuC,WAAWhD,OAAOiD,gBAAgB,CAAChD,iBAAiBiB,WAAWP,OAAOC,IAAI,CAACkB,IAAI;IAErF,OAAOkB,SAASzC,MAAM,CAAC4C,SAAS,OAAO,UAAUH,SAASb,KAAK,CAAC;AAClE;AAEA;;;;CAIC,GACD,OAAO,SAASiB,UAEdZ,IAAY,EACZZ,OAA8B;IAE9B,MAAMyB,YAAYd,QAAQe,IAAI,CAAC,IAAI,EAAEd,MAAM;QAAEnC,QAAQuB,QAAQ2B,SAAS;IAAC;IACvE,OAAO7B,QAAQ4B,IAAI,CAAC,IAAI,EAAED;AAC5B"}

package/dist/auth/defaultAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultAccess.d.ts","sourceRoot":"","sources":["../../src/auth/defaultAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,eAAO,MAAM,aAAa,GAAI,4BAA4B;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,KAAG,OACnB,CAAA"}
+{"version":3,"file":"defaultAccess.d.ts","sourceRoot":"","sources":["../../src/auth/defaultAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,eAAO,MAAM,aAAa,+BAAgC;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,KAAG,OACnB,CAAA"}

package/dist/auth/endpoints/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D,eAAO,MAAM,YAAY,EAAE,cAgD1B,CAAA"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,YAAY,EAAE,cAsC1B,CAAA"}

package/dist/auth/endpoints/login.js

@@ -2,8 +2,7 @@ import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
 import { isNumber } from '../../utilities/isNumber.js';
-import { generatePayloadCookie } from '../cookies.js';
-import { loginOperation } from '../operations/login.js';
+import { loginWithCookie } from '../loginWithCookie.js';
 export const loginHandler = async (req)=>{
     const collection = getRequestCollection(req);
     const { searchParams, t } = req;
@@ -16,20 +15,12 @@ export const loginHandler = async (req)=>{
         email: typeof req.data?.email === 'string' ? req.data.email : '',
         password: typeof req.data?.password === 'string' ? req.data.password : ''
     };
-    const result = await loginOperation({
+    const { cookie, result } = await loginWithCookie({
         collection,
         data: authData,
         depth: isNumber(depth) ? Number(depth) : undefined,
         req
     });
-    const cookie = generatePayloadCookie({
-        collectionAuthConfig: collection.config.auth,
-        cookiePrefix: req.payload.config.cookiePrefix,
-        token: result.token
-    });
-    if (collection.config.auth.removeTokenFromResponses) {
-        delete result.token;
-    }
     return Response.json({
         message: t('authentication:passed'),
         ...result

package/dist/auth/endpoints/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/login.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { isNumber } from '../../utilities/isNumber.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { loginOperation } from '../operations/login.js'\n\nexport const loginHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const result = await loginOperation({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token!,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","isNumber","generatePayloadCookie","loginOperation","loginHandler","req","collection","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","result","Number","undefined","cookie","collectionAuthConfig","cookiePrefix","payload","token","removeTokenFromResponses","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,QAAQ,QAAQ,8BAA6B;AACtD,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,cAAc,QAAQ,yBAAwB;AAEvD,OAAO,MAAMC,eAA+B,OAAOC;IACjD,MAAMC,aAAaP,qBAAqBM;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAC/B,MAAMC,WACJL,WAAWM,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;QACvEC,UAAU,OAAOb,IAAIW,IAAI,EAAEE,aAAa,WAAWb,IAAIW,IAAI,CAACE,QAAQ,GAAG;IACzE,IACA;QACEH,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;IACzE;IAEN,MAAME,SAAS,MAAMhB,eAAe;QAClCG;QACAU,MAAML;QACNF,OAAOR,SAASQ,SAASW,OAAOX,SAASY;QACzChB;IACF;IAEA,MAAMiB,SAASpB,sBAAsB;QACnCqB,sBAAsBjB,WAAWM,MAAM,CAACC,IAAI;QAC5CW,cAAcnB,IAAIoB,OAAO,CAACb,MAAM,CAACY,YAAY;QAC7CE,OAAOP,OAAOO,KAAK;IACrB;IAEA,IAAIpB,WAAWM,MAAM,CAACC,IAAI,CAACc,wBAAwB,EAAE;QACnD,OAAOR,OAAOO,KAAK;IACrB;IAEA,OAAOE,SAASC,IAAI,CAClB;QACEC,SAAStB,EAAE;QACX,GAAGW,MAAM;IACX,GACA;QACEY,SAAS/B,gBAAgB;YACvB+B,SAAS,IAAIC,QAAQ;gBACnB,cAAcV;YAChB;YACAjB;QACF;QACAR,QAAQC,WAAWmC,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/login.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { isNumber } from '../../utilities/isNumber.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\n\nexport const loginHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          password: typeof req.data?.password === 'string' ? req.data.password : '',\n        }\n\n  const { cookie, result } = await loginWithCookie({\n    collection,\n    data: authData,\n    depth: isNumber(depth) ? Number(depth) : undefined,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('authentication:passed'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","isNumber","loginWithCookie","loginHandler","req","collection","searchParams","t","depth","get","authData","config","auth","loginWithUsername","email","data","password","username","cookie","result","Number","undefined","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,QAAQ,QAAQ,8BAA6B;AACtD,SAASC,eAAe,QAAQ,wBAAuB;AAEvD,OAAO,MAAMC,eAA+B,OAAOC;IACjD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAC/B,MAAMC,WACJL,WAAWM,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;QACvEC,UAAU,OAAOb,IAAIW,IAAI,EAAEE,aAAa,WAAWb,IAAIW,IAAI,CAACE,QAAQ,GAAG;IACzE,IACA;QACEH,OAAO,OAAOV,IAAIW,IAAI,EAAED,UAAU,WAAWV,IAAIW,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOZ,IAAIW,IAAI,EAAEC,aAAa,WAAWZ,IAAIW,IAAI,CAACC,QAAQ,GAAG;IACzE;IAEN,MAAM,EAAEE,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMjB,gBAAgB;QAC/CG;QACAU,MAAML;QACNF,OAAOP,SAASO,SAASY,OAAOZ,SAASa;QACzCjB;IACF;IAEA,OAAOkB,SAASC,IAAI,CAClB;QACEC,SAASjB,EAAE;QACX,GAAGY,MAAM;IACX,GACA;QACEM,SAASzB,gBAAgB;YACvByB,SAAS,IAAIC,QAAQ;gBACnB,cAAcR;YAChB;YACAd;QACF;QACAP,QAAQC,WAAW6B,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,cAAc,EAAE,cAuC5B,CAAA"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,cAAc,EAAE,cAwC5B,CAAA"}

package/dist/auth/endpoints/refresh.js

@@ -14,21 +14,19 @@ export const refreshHandler = async (req)=>{
         collection,
         req
     });
+    const { refreshedToken, ...resultWithoutToken } = result;
     if (result.setCookie) {
         const cookie = generatePayloadCookie({
             collectionAuthConfig: collection.config.auth,
             cookiePrefix: req.payload.config.cookiePrefix,
-            token: result.refreshedToken
+            token: refreshedToken
         });
-        if (collection.config.auth.removeTokenFromResponses) {
-            // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve
-            delete result.refreshedToken;
-        }
         headers.set('Set-Cookie', cookie);
     }
+    const responseResult = collection.config.auth.removeTokenFromResponses ? resultWithoutToken : result;
     return Response.json({
         message: t('authentication:tokenRefreshSuccessful'),
-        ...result
+        ...responseResult
     }, {
         headers,
         status: httpStatus.OK

package/dist/auth/endpoints/refresh.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/refresh.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { refreshOperation } from '../operations/refresh.js'\n\nexport const refreshHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { t } = req\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  const result = await refreshOperation({\n    collection,\n    req,\n  })\n\n  if (result.setCookie) {\n    const cookie = generatePayloadCookie({\n      collectionAuthConfig: collection.config.auth,\n      cookiePrefix: req.payload.config.cookiePrefix,\n      token: result.refreshedToken,\n    })\n\n    if (collection.config.auth.removeTokenFromResponses) {\n      // @ts-expect-error - vestiges of when tsconfig was not strict. Feel free to improve\n      delete result.refreshedToken\n    }\n\n    headers.set('Set-Cookie', cookie)\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:tokenRefreshSuccessful'),\n      ...result,\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","generatePayloadCookie","refreshOperation","refreshHandler","req","collection","t","headers","Headers","result","setCookie","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","token","refreshedToken","removeTokenFromResponses","set","Response","json","message","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,gBAAgB,QAAQ,2BAA0B;AAE3D,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,CAAC,EAAE,GAAGF;IAEd,MAAMG,UAAUP,gBAAgB;QAC9BO,SAAS,IAAIC;QACbJ;IACF;IAEA,MAAMK,SAAS,MAAMP,iBAAiB;QACpCG;QACAD;IACF;IAEA,IAAIK,OAAOC,SAAS,EAAE;QACpB,MAAMC,SAASV,sBAAsB;YACnCW,sBAAsBP,WAAWQ,MAAM,CAACC,IAAI;YAC5CC,cAAcX,IAAIY,OAAO,CAACH,MAAM,CAACE,YAAY;YAC7CE,OAAOR,OAAOS,cAAc;QAC9B;QAEA,IAAIb,WAAWQ,MAAM,CAACC,IAAI,CAACK,wBAAwB,EAAE;YACnD,oFAAoF;YACpF,OAAOV,OAAOS,cAAc;QAC9B;QAEAX,QAAQa,GAAG,CAAC,cAAcT;IAC5B;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASjB,EAAE;QACX,GAAGG,MAAM;IACX,GACA;QACEF;QACAV,QAAQC,WAAW0B,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/refresh.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { refreshOperation } from '../operations/refresh.js'\n\nexport const refreshHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { t } = req\n\n  const headers = headersWithCors({\n    headers: new Headers(),\n    req,\n  })\n\n  const result = await refreshOperation({\n    collection,\n    req,\n  })\n\n  const { refreshedToken, ...resultWithoutToken } = result\n\n  if (result.setCookie) {\n    const cookie = generatePayloadCookie({\n      collectionAuthConfig: collection.config.auth,\n      cookiePrefix: req.payload.config.cookiePrefix,\n      token: refreshedToken,\n    })\n\n    headers.set('Set-Cookie', cookie)\n  }\n\n  const responseResult = collection.config.auth.removeTokenFromResponses\n    ? resultWithoutToken\n    : result\n\n  return Response.json(\n    {\n      message: t('authentication:tokenRefreshSuccessful'),\n      ...responseResult,\n    },\n    {\n      headers,\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","generatePayloadCookie","refreshOperation","refreshHandler","req","collection","t","headers","Headers","result","refreshedToken","resultWithoutToken","setCookie","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","token","set","responseResult","removeTokenFromResponses","Response","json","message","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,gBAAgB,QAAQ,2BAA0B;AAE3D,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,CAAC,EAAE,GAAGF;IAEd,MAAMG,UAAUP,gBAAgB;QAC9BO,SAAS,IAAIC;QACbJ;IACF;IAEA,MAAMK,SAAS,MAAMP,iBAAiB;QACpCG;QACAD;IACF;IAEA,MAAM,EAAEM,cAAc,EAAE,GAAGC,oBAAoB,GAAGF;IAElD,IAAIA,OAAOG,SAAS,EAAE;QACpB,MAAMC,SAASZ,sBAAsB;YACnCa,sBAAsBT,WAAWU,MAAM,CAACC,IAAI;YAC5CC,cAAcb,IAAIc,OAAO,CAACH,MAAM,CAACE,YAAY;YAC7CE,OAAOT;QACT;QAEAH,QAAQa,GAAG,CAAC,cAAcP;IAC5B;IAEA,MAAMQ,iBAAiBhB,WAAWU,MAAM,CAACC,IAAI,CAACM,wBAAwB,GAClEX,qBACAF;IAEJ,OAAOc,SAASC,IAAI,CAClB;QACEC,SAASnB,EAAE;QACX,GAAGe,cAAc;IACnB,GACA;QACEd;QACAV,QAAQC,WAAW4B,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/ensureUsernameOrEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensureUsernameOrEmail.d.ts","sourceRoot":"","sources":["../../src/auth/ensureUsernameOrEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAA;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjF,KAAK,2BAA2B,CAAC,KAAK,SAAS,cAAc,IAAI;IAC/D,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;IAC7C,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,CAAC,EAAE,KAAK,CAAA;CACpB,GACD;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;CACnD,CACJ,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,KAAK,SAAS,cAAc,EAAE,kHAOjE,2BAA2B,CAAC,KAAK,CAAC,SAiDpC,CAAA"}
+{"version":3,"file":"ensureUsernameOrEmail.d.ts","sourceRoot":"","sources":["../../src/auth/ensureUsernameOrEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAA;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjF,KAAK,2BAA2B,CAAC,KAAK,SAAS,cAAc,IAAI;IAC/D,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;IAC7C,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,CAAC,EAAE,KAAK,CAAA;CACpB,GACD;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;CACnD,CACJ,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,KAAK,SAAS,cAAc,oHAO/D,2BAA2B,CAAC,KAAK,CAAC,SAiDpC,CAAA"}

package/dist/auth/executeAccess.d.ts

@@ -6,7 +6,8 @@ type OperationArgs = {
     id?: number | string;
     isReadingStaticFile?: boolean;
     req: PayloadRequest;
+    slug: string;
 };
-export declare const executeAccess: ({ id, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access: Access) => Promise<AccessResult>;
+export declare const executeAccess: ({ id, slug, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access?: Access) => Promise<AccessResult>;
 export {};
 //# sourceMappingURL=executeAccess.d.ts.map

package/dist/auth/executeAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,eAAO,MAAM,aAAa,GACxB,uDAA+D,aAAa,EAC5E,QAAQ,MAAM,KACb,OAAO,CAAC,YAAY,CA0BtB,CAAA"}
+{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AACD,eAAO,MAAM,aAAa,gEAC6C,aAAa,WACzE,MAAM,KACd,OAAO,CAAC,YAAY,CA2BtB,CAAA"}

package/dist/auth/executeAccess.js

@@ -1,8 +1,9 @@
 import { Forbidden } from '../errors/index.js';
-export const executeAccess = async ({ id, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
+export const executeAccess = async ({ id, slug, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
     if (access) {
         const resolvedConstraint = await access({
             id,
+            slug,
             data,
             isReadingStaticFile,
             req

package/dist/auth/executeAccess.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/executeAccess.ts"],"sourcesContent":["import type { Access, AccessResult } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { Forbidden } from '../errors/index.js'\n\ntype OperationArgs = {\n  data?: any\n  disableErrors?: boolean\n  id?: number | string\n  isReadingStaticFile?: boolean\n  req: PayloadRequest\n}\nexport const executeAccess = async (\n  { id, data, disableErrors, isReadingStaticFile = false, req }: OperationArgs,\n  access: Access,\n): Promise<AccessResult> => {\n  if (access) {\n    const resolvedConstraint = await access({\n      id,\n      data,\n      isReadingStaticFile,\n      req,\n    })\n\n    if (!resolvedConstraint) {\n      if (!disableErrors) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    return resolvedConstraint\n  }\n\n  if (req.user) {\n    return true\n  }\n\n  if (!disableErrors) {\n    throw new Forbidden(req.t)\n  }\n  return false\n}\n"],"names":["Forbidden","executeAccess","id","data","disableErrors","isReadingStaticFile","req","access","resolvedConstraint","t","user"],"mappings":"AAGA,SAASA,SAAS,QAAQ,qBAAoB;AAS9C,OAAO,MAAMC,gBAAgB,OAC3B,EAAEC,EAAE,EAAEC,IAAI,EAAEC,aAAa,EAAEC,sBAAsB,KAAK,EAAEC,GAAG,EAAiB,EAC5EC;IAEA,IAAIA,QAAQ;QACV,MAAMC,qBAAqB,MAAMD,OAAO;YACtCL;YACAC;YACAE;YACAC;QACF;QAEA,IAAI,CAACE,oBAAoB;YACvB,IAAI,CAACJ,eAAe;gBAClB,MAAM,IAAIJ,UAAUM,IAAIG,CAAC;YAC3B;QACF;QAEA,OAAOD;IACT;IAEA,IAAIF,IAAII,IAAI,EAAE;QACZ,OAAO;IACT;IAEA,IAAI,CAACN,eAAe;QAClB,MAAM,IAAIJ,UAAUM,IAAIG,CAAC;IAC3B;IACA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/executeAccess.ts"],"sourcesContent":["import type { Access, AccessResult } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { Forbidden } from '../errors/index.js'\n\ntype OperationArgs = {\n  data?: any\n  disableErrors?: boolean\n  id?: number | string\n  isReadingStaticFile?: boolean\n  req: PayloadRequest\n  slug: string\n}\nexport const executeAccess = async (\n  { id, slug, data, disableErrors, isReadingStaticFile = false, req }: OperationArgs,\n  access?: Access,\n): Promise<AccessResult> => {\n  if (access) {\n    const resolvedConstraint = await access({\n      id,\n      slug,\n      data,\n      isReadingStaticFile,\n      req,\n    })\n\n    if (!resolvedConstraint) {\n      if (!disableErrors) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    return resolvedConstraint\n  }\n\n  if (req.user) {\n    return true\n  }\n\n  if (!disableErrors) {\n    throw new Forbidden(req.t)\n  }\n  return false\n}\n"],"names":["Forbidden","executeAccess","id","slug","data","disableErrors","isReadingStaticFile","req","access","resolvedConstraint","t","user"],"mappings":"AAGA,SAASA,SAAS,QAAQ,qBAAoB;AAU9C,OAAO,MAAMC,gBAAgB,OAC3B,EAAEC,EAAE,EAAEC,IAAI,EAAEC,IAAI,EAAEC,aAAa,EAAEC,sBAAsB,KAAK,EAAEC,GAAG,EAAiB,EAClFC;IAEA,IAAIA,QAAQ;QACV,MAAMC,qBAAqB,MAAMD,OAAO;YACtCN;YACAC;YACAC;YACAE;YACAC;QACF;QAEA,IAAI,CAACE,oBAAoB;YACvB,IAAI,CAACJ,eAAe;gBAClB,MAAM,IAAIL,UAAUO,IAAIG,CAAC;YAC3B;QACF;QAEA,OAAOD;IACT;IAEA,IAAIF,IAAII,IAAI,EAAE;QACZ,OAAO;IACT;IAEA,IAAI,CAACN,eAAe;QAClB,MAAM,IAAIL,UAAUO,IAAIG,CAAC;IAC3B;IACA,OAAO;AACT,EAAC"}

package/dist/auth/executeAuthStrategies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeAuthStrategies.d.ts","sourceRoot":"","sources":["../../src/auth/executeAuthStrategies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAI9E,eAAO,MAAM,qBAAqB,GAChC,MAAM,wBAAwB,KAC7B,OAAO,CAAC,kBAAkB,CA+B5B,CAAA"}
+{"version":3,"file":"executeAuthStrategies.d.ts","sourceRoot":"","sources":["../../src/auth/executeAuthStrategies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAI9E,eAAO,MAAM,qBAAqB,SAC1B,wBAAwB,KAC7B,OAAO,CAAC,kBAAkB,CA+B5B,CAAA"}

package/dist/auth/extractAccessFromPermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractAccessFromPermission.d.ts","sourceRoot":"","sources":["../../src/auth/extractAccessFromPermission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,eAAO,MAAM,2BAA2B,GAAI,eAAe,OAAO,GAAG,UAAU,KAAG,YAajF,CAAA"}
+{"version":3,"file":"extractAccessFromPermission.d.ts","sourceRoot":"","sources":["../../src/auth/extractAccessFromPermission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,eAAO,MAAM,2BAA2B,kBAAmB,OAAO,GAAG,UAAU,KAAG,YAajF,CAAA"}

package/dist/auth/extractJWT.d.ts

@@ -1,3 +1,3 @@
 import type { AuthStrategyFunctionArgs } from './index.js';
-export declare const extractJWT: (args: Omit<AuthStrategyFunctionArgs, "strategyName">) => null | string;
+export declare const extractJWT: (args: Omit<AuthStrategyFunctionArgs, 'strategyName'>) => null | string;
 //# sourceMappingURL=extractJWT.d.ts.map

package/dist/auth/extractJWT.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractJWT.d.ts","sourceRoot":"","sources":["../../src/auth/extractJWT.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AA+D1D,eAAO,MAAM,UAAU,GAAI,MAAM,IAAI,CAAC,wBAAwB,EAAE,cAAc,CAAC,KAAG,IAAI,GAAG,MAcxF,CAAA"}
+{"version":3,"file":"extractJWT.d.ts","sourceRoot":"","sources":["../../src/auth/extractJWT.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AA+D1D,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,wBAAwB,EAAE,cAAc,CAAC,KAAG,IAAI,GAAG,MAcxF,CAAA"}

package/dist/auth/getAccessResults.js

@@ -10,6 +10,7 @@ export async function getAccessResults({ req }) {
     const userCollectionConfig = user && user.collection ? payload?.collections?.[user.collection]?.config : null;
     if (userCollectionConfig && payload.config.admin.user === user?.collection) {
         results.canAccessAdmin = userCollectionConfig.access.admin ? await userCollectionConfig.access.admin({
+            slug: userCollectionConfig.slug,
             req
         }) : isLoggedIn;
     } else {

package/dist/auth/getAccessResults.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getAccessResults.ts"],"sourcesContent":["import type { AllOperations, PayloadRequest } from '../types/index.js'\nimport type { Permissions, SanitizedPermissions } from './types.js'\n\nimport { getEntityPermissions } from '../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { sanitizePermissions } from '../utilities/sanitizePermissions.js'\n\ntype GetAccessResultsArgs = {\n  req: PayloadRequest\n}\nexport async function getAccessResults({\n  req,\n}: GetAccessResultsArgs): Promise<SanitizedPermissions> {\n  const results = {\n    collections: {},\n    globals: {},\n  } as Permissions\n  const { payload, user } = req\n\n  const isLoggedIn = !!user\n  const userCollectionConfig =\n    user && user.collection ? payload?.collections?.[user.collection]?.config : null\n\n  if (userCollectionConfig && payload.config.admin.user === user?.collection) {\n    results.canAccessAdmin = userCollectionConfig.access.admin\n      ? await userCollectionConfig.access.admin({ req })\n      : isLoggedIn\n  } else {\n    results.canAccessAdmin = false\n  }\n  const blockReferencesPermissions = {}\n\n  await Promise.all(\n    payload.config.collections.map(async (collection) => {\n      const collectionOperations: AllOperations[] = ['create', 'read', 'update', 'delete']\n\n      if (\n        collection.auth &&\n        typeof collection.auth.maxLoginAttempts !== 'undefined' &&\n        collection.auth.maxLoginAttempts !== 0\n      ) {\n        collectionOperations.push('unlock')\n      }\n\n      if (collection.versions) {\n        collectionOperations.push('readVersions')\n      }\n\n      const collectionPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: collection,\n        entityType: 'collection',\n        fetchData: false,\n        operations: collectionOperations,\n        req,\n      })\n      results.collections![collection.slug] = collectionPermissions\n    }),\n  )\n\n  await Promise.all(\n    payload.config.globals.map(async (global) => {\n      const globalOperations: AllOperations[] = ['read', 'update']\n\n      if (global.versions) {\n        globalOperations.push('readVersions')\n      }\n\n      const globalPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: global,\n        entityType: 'global',\n        fetchData: false,\n        operations: globalOperations,\n        req,\n      })\n      results.globals![global.slug] = globalPermissions\n    }),\n  )\n\n  return sanitizePermissions(results)\n}\n"],"names":["getEntityPermissions","sanitizePermissions","getAccessResults","req","results","collections","globals","payload","user","isLoggedIn","userCollectionConfig","collection","config","admin","canAccessAdmin","access","blockReferencesPermissions","Promise","all","map","collectionOperations","auth","maxLoginAttempts","push","versions","collectionPermissions","entity","entityType","fetchData","operations","slug","global","globalOperations","globalPermissions"],"mappings":"AAGA,SAASA,oBAAoB,QAAQ,4DAA2D;AAChG,SAASC,mBAAmB,QAAQ,sCAAqC;AAKzE,OAAO,eAAeC,iBAAiB,EACrCC,GAAG,EACkB;IACrB,MAAMC,UAAU;QACdC,aAAa,CAAC;QACdC,SAAS,CAAC;IACZ;IACA,MAAM,EAAEC,OAAO,EAAEC,IAAI,EAAE,GAAGL;IAE1B,MAAMM,aAAa,CAAC,CAACD;IACrB,MAAME,uBACJF,QAAQA,KAAKG,UAAU,GAAGJ,SAASF,aAAa,CAACG,KAAKG,UAAU,CAAC,EAAEC,SAAS;IAE9E,IAAIF,wBAAwBH,QAAQK,MAAM,CAACC,KAAK,CAACL,IAAI,KAAKA,MAAMG,YAAY;QAC1EP,QAAQU,cAAc,GAAGJ,qBAAqBK,MAAM,CAACF,KAAK,GACtD,MAAMH,qBAAqBK,MAAM,CAACF,KAAK,CAAC;YAAEV;QAAI,KAC9CM;IACN,OAAO;QACLL,QAAQU,cAAc,GAAG;IAC3B;IACA,MAAME,6BAA6B,CAAC;IAEpC,MAAMC,QAAQC,GAAG,CACfX,QAAQK,MAAM,CAACP,WAAW,CAACc,GAAG,CAAC,OAAOR;QACpC,MAAMS,uBAAwC;YAAC;YAAU;YAAQ;YAAU;SAAS;QAEpF,IACET,WAAWU,IAAI,IACf,OAAOV,WAAWU,IAAI,CAACC,gBAAgB,KAAK,eAC5CX,WAAWU,IAAI,CAACC,gBAAgB,KAAK,GACrC;YACAF,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,IAAIZ,WAAWa,QAAQ,EAAE;YACvBJ,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,MAAME,wBAAwB,MAAMzB,qBAAqB;YACvDgB;YACAU,QAAQf;YACRgB,YAAY;YACZC,WAAW;YACXC,YAAYT;YACZjB;QACF;QACAC,QAAQC,WAAW,AAAC,CAACM,WAAWmB,IAAI,CAAC,GAAGL;IAC1C;IAGF,MAAMR,QAAQC,GAAG,CACfX,QAAQK,MAAM,CAACN,OAAO,CAACa,GAAG,CAAC,OAAOY;QAChC,MAAMC,mBAAoC;YAAC;YAAQ;SAAS;QAE5D,IAAID,OAAOP,QAAQ,EAAE;YACnBQ,iBAAiBT,IAAI,CAAC;QACxB;QAEA,MAAMU,oBAAoB,MAAMjC,qBAAqB;YACnDgB;YACAU,QAAQK;YACRJ,YAAY;YACZC,WAAW;YACXC,YAAYG;YACZ7B;QACF;QACAC,QAAQE,OAAO,AAAC,CAACyB,OAAOD,IAAI,CAAC,GAAGG;IAClC;IAGF,OAAOhC,oBAAoBG;AAC7B"}
+{"version":3,"sources":["../../src/auth/getAccessResults.ts"],"sourcesContent":["import type { AllOperations, PayloadRequest } from '../types/index.js'\nimport type { Permissions, SanitizedPermissions } from './types.js'\n\nimport { getEntityPermissions } from '../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { sanitizePermissions } from '../utilities/sanitizePermissions.js'\n\ntype GetAccessResultsArgs = {\n  req: PayloadRequest\n}\nexport async function getAccessResults({\n  req,\n}: GetAccessResultsArgs): Promise<SanitizedPermissions> {\n  const results = {\n    collections: {},\n    globals: {},\n  } as Permissions\n  const { payload, user } = req\n\n  const isLoggedIn = !!user\n  const userCollectionConfig =\n    user && user.collection ? payload?.collections?.[user.collection]?.config : null\n\n  if (userCollectionConfig && payload.config.admin.user === user?.collection) {\n    results.canAccessAdmin = userCollectionConfig.access.admin\n      ? await userCollectionConfig.access.admin({ slug: userCollectionConfig.slug, req })\n      : isLoggedIn\n  } else {\n    results.canAccessAdmin = false\n  }\n  const blockReferencesPermissions = {}\n\n  await Promise.all(\n    payload.config.collections.map(async (collection) => {\n      const collectionOperations: AllOperations[] = ['create', 'read', 'update', 'delete']\n\n      if (\n        collection.auth &&\n        typeof collection.auth.maxLoginAttempts !== 'undefined' &&\n        collection.auth.maxLoginAttempts !== 0\n      ) {\n        collectionOperations.push('unlock')\n      }\n\n      if (collection.versions) {\n        collectionOperations.push('readVersions')\n      }\n\n      const collectionPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: collection,\n        entityType: 'collection',\n        fetchData: false,\n        operations: collectionOperations,\n        req,\n      })\n      results.collections![collection.slug] = collectionPermissions\n    }),\n  )\n\n  await Promise.all(\n    payload.config.globals.map(async (global) => {\n      const globalOperations: AllOperations[] = ['read', 'update']\n\n      if (global.versions) {\n        globalOperations.push('readVersions')\n      }\n\n      const globalPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: global,\n        entityType: 'global',\n        fetchData: false,\n        operations: globalOperations,\n        req,\n      })\n      results.globals![global.slug] = globalPermissions\n    }),\n  )\n\n  return sanitizePermissions(results)\n}\n"],"names":["getEntityPermissions","sanitizePermissions","getAccessResults","req","results","collections","globals","payload","user","isLoggedIn","userCollectionConfig","collection","config","admin","canAccessAdmin","access","slug","blockReferencesPermissions","Promise","all","map","collectionOperations","auth","maxLoginAttempts","push","versions","collectionPermissions","entity","entityType","fetchData","operations","global","globalOperations","globalPermissions"],"mappings":"AAGA,SAASA,oBAAoB,QAAQ,4DAA2D;AAChG,SAASC,mBAAmB,QAAQ,sCAAqC;AAKzE,OAAO,eAAeC,iBAAiB,EACrCC,GAAG,EACkB;IACrB,MAAMC,UAAU;QACdC,aAAa,CAAC;QACdC,SAAS,CAAC;IACZ;IACA,MAAM,EAAEC,OAAO,EAAEC,IAAI,EAAE,GAAGL;IAE1B,MAAMM,aAAa,CAAC,CAACD;IACrB,MAAME,uBACJF,QAAQA,KAAKG,UAAU,GAAGJ,SAASF,aAAa,CAACG,KAAKG,UAAU,CAAC,EAAEC,SAAS;IAE9E,IAAIF,wBAAwBH,QAAQK,MAAM,CAACC,KAAK,CAACL,IAAI,KAAKA,MAAMG,YAAY;QAC1EP,QAAQU,cAAc,GAAGJ,qBAAqBK,MAAM,CAACF,KAAK,GACtD,MAAMH,qBAAqBK,MAAM,CAACF,KAAK,CAAC;YAAEG,MAAMN,qBAAqBM,IAAI;YAAEb;QAAI,KAC/EM;IACN,OAAO;QACLL,QAAQU,cAAc,GAAG;IAC3B;IACA,MAAMG,6BAA6B,CAAC;IAEpC,MAAMC,QAAQC,GAAG,CACfZ,QAAQK,MAAM,CAACP,WAAW,CAACe,GAAG,CAAC,OAAOT;QACpC,MAAMU,uBAAwC;YAAC;YAAU;YAAQ;YAAU;SAAS;QAEpF,IACEV,WAAWW,IAAI,IACf,OAAOX,WAAWW,IAAI,CAACC,gBAAgB,KAAK,eAC5CZ,WAAWW,IAAI,CAACC,gBAAgB,KAAK,GACrC;YACAF,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,IAAIb,WAAWc,QAAQ,EAAE;YACvBJ,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,MAAME,wBAAwB,MAAM1B,qBAAqB;YACvDiB;YACAU,QAAQhB;YACRiB,YAAY;YACZC,WAAW;YACXC,YAAYT;YACZlB;QACF;QACAC,QAAQC,WAAW,AAAC,CAACM,WAAWK,IAAI,CAAC,GAAGU;IAC1C;IAGF,MAAMR,QAAQC,GAAG,CACfZ,QAAQK,MAAM,CAACN,OAAO,CAACc,GAAG,CAAC,OAAOW;QAChC,MAAMC,mBAAoC;YAAC;YAAQ;SAAS;QAE5D,IAAID,OAAON,QAAQ,EAAE;YACnBO,iBAAiBR,IAAI,CAAC;QACxB;QAEA,MAAMS,oBAAoB,MAAMjC,qBAAqB;YACnDiB;YACAU,QAAQI;YACRH,YAAY;YACZC,WAAW;YACXC,YAAYE;YACZ7B;QACF;QACAC,QAAQE,OAAO,AAAC,CAACyB,OAAOf,IAAI,CAAC,GAAGiB;IAClC;IAGF,OAAOhC,oBAAoBG;AAC7B"}

package/dist/auth/getAuthFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getAuthFields.d.ts","sourceRoot":"","sources":["../../src/auth/getAuthFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAUlD,eAAO,MAAM,iBAAiB,GAAI,YAAY,gBAAgB,KAAG,KAAK,EAmDrE,CAAA"}
+{"version":3,"file":"getAuthFields.d.ts","sourceRoot":"","sources":["../../src/auth/getAuthFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAUlD,eAAO,MAAM,iBAAiB,eAAgB,gBAAgB,KAAG,KAAK,EAmDrE,CAAA"}

package/dist/auth/getFieldsToSign.d.ts

@@ -4,6 +4,6 @@ export declare const getFieldsToSign: (args: {
     collectionConfig: CollectionConfig;
     email: string;
     sid?: string;
-    user: PayloadRequest["user"];
+    user: PayloadRequest['user'];
 }) => Record<string, unknown>;
 //# sourceMappingURL=getFieldsToSign.d.ts.map

package/dist/auth/getFieldsToSign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAiHvD,eAAO,MAAM,eAAe,GAAI,MAAM;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoBzB,CAAA"}
+{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAiHvD,eAAO,MAAM,eAAe,SAAU;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoBzB,CAAA"}

package/dist/auth/getLoginOptions.d.ts

@@ -1,5 +1,5 @@
 import type { Auth } from './types.js';
-export declare const getLoginOptions: (loginWithUsername: Auth["loginWithUsername"]) => {
+export declare const getLoginOptions: (loginWithUsername: Auth['loginWithUsername']) => {
     canLoginWithEmail: boolean;
     canLoginWithUsername: boolean;
 };