payload 4.0.0-internal.fa345ef → 4.0.0-internal.fec2230

package/dist/auth/rotateSecret.js

@@ -0,0 +1,131 @@
+import crypto from 'crypto';
+import { deriveSecretKey } from './crypto.js';
+/**
+ * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous
+ * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.
+ *
+ * Operates at the database-adapter layer to bypass the `apiKey` field's
+ * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).
+ *
+ * Each document is verified against the old and current secrets before it is
+ * written, so the run is:
+ * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC
+ *   index), so it is safe to run repeatedly;
+ * - **fail-closed** — a row that matches neither the old nor the current secret
+ *   throws and aborts the run before that row is written. Rows already migrated
+ *   earlier in the same run remain migrated and are safe to keep: fix the secret
+ *   and re-run.
+ *
+ * Password logins are unaffected by a secret rotation, and active JWT sessions
+ * are invalidated by design. See the "Rotating your PAYLOAD_SECRET" docs.
+ */ export const rotateSecret = async ({ batchSize = 100, collections, dryRun = false, oldSecret, payload })=>{
+    const oldDerivedKey = deriveSecretKey(oldSecret);
+    const newDerivedKey = payload.secret;
+    const result = {
+        migrated: 0,
+        skipped: 0
+    };
+    if (oldDerivedKey === newDerivedKey) {
+        payload.logger.warn('rotateSecret: oldSecret matches the current secret - nothing to rotate. Did you forget to set the new PAYLOAD_SECRET?');
+        return result;
+    }
+    const targetSlugs = (collections ?? Object.keys(payload.collections)).filter((slug)=>payload.collections[slug]?.config.auth?.useAPIKey);
+    for (const slug of targetSlugs){
+        let page = 1;
+        let hasNextPage = true;
+        while(hasNextPage){
+            const { docs, hasNextPage: nextPage } = await payload.db.find({
+                collection: slug,
+                limit: batchSize,
+                page,
+                pagination: true,
+                sort: 'id',
+                // Only rows with a lookup index need re-keying. A row can have `apiKey`
+                // ciphertext but a null `apiKeyIndex` (e.g. after unchecking "Enable API
+                // Key"); those are never used for auth, so skip them.
+                where: {
+                    and: [
+                        {
+                            apiKey: {
+                                exists: true
+                            }
+                        },
+                        {
+                            apiKeyIndex: {
+                                exists: true
+                            }
+                        }
+                    ]
+                }
+            });
+            for (const doc of docs){
+                const storedApiKey = doc.apiKey;
+                const storedIndex = doc.apiKeyIndex;
+                if (!storedApiKey || !storedIndex) {
+                    continue;
+                }
+                // The v1 (aes-256-gcm) envelope throws on a wrong key; legacy aes-256-ctr
+                // returns garbage. Either way the HMAC-index check is the source of truth,
+                // so treat a decrypt failure as "does not match this secret".
+                const rawFromOld = tryDecrypt({
+                    hash: storedApiKey,
+                    payload,
+                    secret: oldSecret
+                });
+                if (rawFromOld !== undefined && apiKeyIndexHmac({
+                    derivedKey: oldDerivedKey,
+                    rawApiKey: rawFromOld
+                }) === storedIndex) {
+                    if (!dryRun) {
+                        await payload.db.updateOne({
+                            id: doc.id,
+                            collection: slug,
+                            data: {
+                                apiKey: payload.encrypt(rawFromOld),
+                                apiKeyIndex: apiKeyIndexHmac({
+                                    derivedKey: newDerivedKey,
+                                    rawApiKey: rawFromOld
+                                })
+                            },
+                            returning: false
+                        });
+                    }
+                    result.migrated++;
+                    continue;
+                }
+                // Confirm the row is already on the current secret (safe re-run).
+                const rawFromNew = tryDecrypt({
+                    hash: storedApiKey,
+                    payload
+                });
+                if (rawFromNew !== undefined && apiKeyIndexHmac({
+                    derivedKey: newDerivedKey,
+                    rawApiKey: rawFromNew
+                }) === storedIndex) {
+                    result.skipped++;
+                    continue;
+                }
+                throw new Error(`rotateSecret: could not verify apiKey for collection "${slug}" id "${String(doc.id)}" against the provided oldSecret or the current secret. Aborting; rows already migrated in this run are safe to keep - fix the secret and re-run.`);
+            }
+            hasNextPage = Boolean(nextPage);
+            page++;
+        }
+    }
+    return result;
+};
+const apiKeyIndexHmac = ({ derivedKey, rawApiKey })=>crypto.createHmac('sha256', derivedKey).update(rawApiKey).digest('hex');
+/**
+ * Decrypts with the given secret (or the active secret), returning `undefined`
+ * instead of throwing when the value cannot be decrypted (wrong-key v1 values
+ * throw; the caller relies on the HMAC index to decide correctness).
+ */ const tryDecrypt = ({ hash, payload, secret })=>{
+    try {
+        return secret ? payload.decrypt(hash, {
+            secret
+        }) : payload.decrypt(hash);
+    } catch  {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=rotateSecret.js.map

package/dist/auth/rotateSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/rotateSecret.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { CollectionSlug, Payload } from '../index.js'\n\nimport { deriveSecretKey } from './crypto.js'\n\nexport type RotateSecretArgs = {\n  /**\n   * Number of documents to process per batch.\n   * @default 100\n   */\n  batchSize?: number\n  /**\n   * Limit rotation to these collection slugs. Defaults to every auth collection\n   * configured with `useAPIKey`.\n   */\n  collections?: CollectionSlug[]\n  /**\n   * When true, verifies every row against the old and current secrets without\n   * writing. Run this first to confirm `oldSecret` is correct.\n   * @default false\n   */\n  dryRun?: boolean\n  /**\n   * The previous raw `PAYLOAD_SECRET` that existing data was encrypted under.\n   */\n  oldSecret: string\n  payload: Payload\n}\n\nexport type RotateSecretResult = {\n  /** Documents re-keyed from the old secret to the current secret. */\n  migrated: number\n  /** Documents already encrypted under the current secret (safe re-run). */\n  skipped: number\n}\n\n/**\n * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous\n * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.\n *\n * Operates at the database-adapter layer to bypass the `apiKey` field's\n * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).\n *\n * Each document is verified against the old and current secrets before it is\n * written, so the run is:\n * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC\n *   index), so it is safe to run repeatedly;\n * - **fail-closed** — a row that matches neither the old nor the current secret\n *   throws and aborts the run before that row is written. Rows already migrated\n *   earlier in the same run remain migrated and are safe to keep: fix the secret\n *   and re-run.\n *\n * Password logins are unaffected by a secret rotation, and active JWT sessions\n * are invalidated by design. See the \"Rotating your PAYLOAD_SECRET\" docs.\n */\nexport const rotateSecret = async ({\n  batchSize = 100,\n  collections,\n  dryRun = false,\n  oldSecret,\n  payload,\n}: RotateSecretArgs): Promise<RotateSecretResult> => {\n  const oldDerivedKey = deriveSecretKey(oldSecret)\n  const newDerivedKey = payload.secret\n\n  const result: RotateSecretResult = { migrated: 0, skipped: 0 }\n\n  if (oldDerivedKey === newDerivedKey) {\n    payload.logger.warn(\n      'rotateSecret: oldSecret matches the current secret - nothing to rotate. Did you forget to set the new PAYLOAD_SECRET?',\n    )\n    return result\n  }\n\n  const targetSlugs = (collections ?? Object.keys(payload.collections)).filter(\n    (slug) => payload.collections[slug]?.config.auth?.useAPIKey,\n  )\n\n  for (const slug of targetSlugs) {\n    let page = 1\n    let hasNextPage = true\n\n    while (hasNextPage) {\n      const { docs, hasNextPage: nextPage } = await payload.db.find({\n        collection: slug,\n        limit: batchSize,\n        page,\n        pagination: true,\n        sort: 'id',\n        // Only rows with a lookup index need re-keying. A row can have `apiKey`\n        // ciphertext but a null `apiKeyIndex` (e.g. after unchecking \"Enable API\n        // Key\"); those are never used for auth, so skip them.\n        where: {\n          and: [{ apiKey: { exists: true } }, { apiKeyIndex: { exists: true } }],\n        },\n      })\n\n      for (const doc of docs as Array<{ id: number | string } & Record<string, unknown>>) {\n        const storedApiKey = doc.apiKey as string | undefined\n        const storedIndex = doc.apiKeyIndex as string | undefined\n\n        if (!storedApiKey || !storedIndex) {\n          continue\n        }\n\n        // The v1 (aes-256-gcm) envelope throws on a wrong key; legacy aes-256-ctr\n        // returns garbage. Either way the HMAC-index check is the source of truth,\n        // so treat a decrypt failure as \"does not match this secret\".\n        const rawFromOld = tryDecrypt({ hash: storedApiKey, payload, secret: oldSecret })\n\n        if (\n          rawFromOld !== undefined &&\n          apiKeyIndexHmac({ derivedKey: oldDerivedKey, rawApiKey: rawFromOld }) === storedIndex\n        ) {\n          if (!dryRun) {\n            await payload.db.updateOne({\n              id: doc.id,\n              collection: slug,\n              data: {\n                apiKey: payload.encrypt(rawFromOld),\n                apiKeyIndex: apiKeyIndexHmac({ derivedKey: newDerivedKey, rawApiKey: rawFromOld }),\n              },\n              returning: false,\n            })\n          }\n          result.migrated++\n          continue\n        }\n\n        // Confirm the row is already on the current secret (safe re-run).\n        const rawFromNew = tryDecrypt({ hash: storedApiKey, payload })\n\n        if (\n          rawFromNew !== undefined &&\n          apiKeyIndexHmac({ derivedKey: newDerivedKey, rawApiKey: rawFromNew }) === storedIndex\n        ) {\n          result.skipped++\n          continue\n        }\n\n        throw new Error(\n          `rotateSecret: could not verify apiKey for collection \"${slug}\" id \"${String(\n            doc.id,\n          )}\" against the provided oldSecret or the current secret. Aborting; rows already migrated in this run are safe to keep - fix the secret and re-run.`,\n        )\n      }\n\n      hasNextPage = Boolean(nextPage)\n      page++\n    }\n  }\n\n  return result\n}\n\nconst apiKeyIndexHmac = ({\n  derivedKey,\n  rawApiKey,\n}: {\n  derivedKey: string\n  rawApiKey: string\n}): string => crypto.createHmac('sha256', derivedKey).update(rawApiKey).digest('hex')\n\n/**\n * Decrypts with the given secret (or the active secret), returning `undefined`\n * instead of throwing when the value cannot be decrypted (wrong-key v1 values\n * throw; the caller relies on the HMAC index to decide correctness).\n */\nconst tryDecrypt = ({\n  hash,\n  payload,\n  secret,\n}: {\n  hash: string\n  payload: Payload\n  secret?: string\n}): string | undefined => {\n  try {\n    return secret ? payload.decrypt(hash, { secret }) : payload.decrypt(hash)\n  } catch {\n    return undefined\n  }\n}\n"],"names":["crypto","deriveSecretKey","rotateSecret","batchSize","collections","dryRun","oldSecret","payload","oldDerivedKey","newDerivedKey","secret","result","migrated","skipped","logger","warn","targetSlugs","Object","keys","filter","slug","config","auth","useAPIKey","page","hasNextPage","docs","nextPage","db","find","collection","limit","pagination","sort","where","and","apiKey","exists","apiKeyIndex","doc","storedApiKey","storedIndex","rawFromOld","tryDecrypt","hash","undefined","apiKeyIndexHmac","derivedKey","rawApiKey","updateOne","id","data","encrypt","returning","rawFromNew","Error","String","Boolean","createHmac","update","digest","decrypt"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAI3B,SAASC,eAAe,QAAQ,cAAa;AAiC7C;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,eAAe,OAAO,EACjCC,YAAY,GAAG,EACfC,WAAW,EACXC,SAAS,KAAK,EACdC,SAAS,EACTC,OAAO,EACU;IACjB,MAAMC,gBAAgBP,gBAAgBK;IACtC,MAAMG,gBAAgBF,QAAQG,MAAM;IAEpC,MAAMC,SAA6B;QAAEC,UAAU;QAAGC,SAAS;IAAE;IAE7D,IAAIL,kBAAkBC,eAAe;QACnCF,QAAQO,MAAM,CAACC,IAAI,CACjB;QAEF,OAAOJ;IACT;IAEA,MAAMK,cAAc,AAACZ,CAAAA,eAAea,OAAOC,IAAI,CAACX,QAAQH,WAAW,CAAA,EAAGe,MAAM,CAC1E,CAACC,OAASb,QAAQH,WAAW,CAACgB,KAAK,EAAEC,OAAOC,MAAMC;IAGpD,KAAK,MAAMH,QAAQJ,YAAa;QAC9B,IAAIQ,OAAO;QACX,IAAIC,cAAc;QAElB,MAAOA,YAAa;YAClB,MAAM,EAAEC,IAAI,EAAED,aAAaE,QAAQ,EAAE,GAAG,MAAMpB,QAAQqB,EAAE,CAACC,IAAI,CAAC;gBAC5DC,YAAYV;gBACZW,OAAO5B;gBACPqB;gBACAQ,YAAY;gBACZC,MAAM;gBACN,wEAAwE;gBACxE,yEAAyE;gBACzE,sDAAsD;gBACtDC,OAAO;oBACLC,KAAK;wBAAC;4BAAEC,QAAQ;gCAAEC,QAAQ;4BAAK;wBAAE;wBAAG;4BAAEC,aAAa;gCAAED,QAAQ;4BAAK;wBAAE;qBAAE;gBACxE;YACF;YAEA,KAAK,MAAME,OAAOb,KAAkE;gBAClF,MAAMc,eAAeD,IAAIH,MAAM;gBAC/B,MAAMK,cAAcF,IAAID,WAAW;gBAEnC,IAAI,CAACE,gBAAgB,CAACC,aAAa;oBACjC;gBACF;gBAEA,0EAA0E;gBAC1E,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAMC,aAAaC,WAAW;oBAAEC,MAAMJ;oBAAcjC;oBAASG,QAAQJ;gBAAU;gBAE/E,IACEoC,eAAeG,aACfC,gBAAgB;oBAAEC,YAAYvC;oBAAewC,WAAWN;gBAAW,OAAOD,aAC1E;oBACA,IAAI,CAACpC,QAAQ;wBACX,MAAME,QAAQqB,EAAE,CAACqB,SAAS,CAAC;4BACzBC,IAAIX,IAAIW,EAAE;4BACVpB,YAAYV;4BACZ+B,MAAM;gCACJf,QAAQ7B,QAAQ6C,OAAO,CAACV;gCACxBJ,aAAaQ,gBAAgB;oCAAEC,YAAYtC;oCAAeuC,WAAWN;gCAAW;4BAClF;4BACAW,WAAW;wBACb;oBACF;oBACA1C,OAAOC,QAAQ;oBACf;gBACF;gBAEA,kEAAkE;gBAClE,MAAM0C,aAAaX,WAAW;oBAAEC,MAAMJ;oBAAcjC;gBAAQ;gBAE5D,IACE+C,eAAeT,aACfC,gBAAgB;oBAAEC,YAAYtC;oBAAeuC,WAAWM;gBAAW,OAAOb,aAC1E;oBACA9B,OAAOE,OAAO;oBACd;gBACF;gBAEA,MAAM,IAAI0C,MACR,CAAC,sDAAsD,EAAEnC,KAAK,MAAM,EAAEoC,OACpEjB,IAAIW,EAAE,EACN,iJAAiJ,CAAC;YAExJ;YAEAzB,cAAcgC,QAAQ9B;YACtBH;QACF;IACF;IAEA,OAAOb;AACT,EAAC;AAED,MAAMmC,kBAAkB,CAAC,EACvBC,UAAU,EACVC,SAAS,EAIV,GAAahD,OAAO0D,UAAU,CAAC,UAAUX,YAAYY,MAAM,CAACX,WAAWY,MAAM,CAAC;AAE/E;;;;CAIC,GACD,MAAMjB,aAAa,CAAC,EAClBC,IAAI,EACJrC,OAAO,EACPG,MAAM,EAKP;IACC,IAAI;QACF,OAAOA,SAASH,QAAQsD,OAAO,CAACjB,MAAM;YAAElC;QAAO,KAAKH,QAAQsD,OAAO,CAACjB;IACtE,EAAE,OAAM;QACN,OAAOC;IACT;AACF"}

package/dist/auth/serverFunctions/cookies.d.ts

@@ -0,0 +1,47 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { Auth } from '../types.js';
+/**
+ * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`
+ * when `returnCookieAsObject` is `true`.
+ */
+export type GeneratedCookie = {
+    domain?: string;
+    expires?: string;
+    httpOnly?: boolean;
+    maxAge?: number;
+    name: string;
+    path?: string;
+    sameSite?: 'Lax' | 'None' | 'Strict';
+    secure?: boolean;
+    value: string | undefined;
+};
+type AuthCookieArgs = {
+    authConfig: Auth;
+    cookiePrefix: string;
+    serverAdapter: ServerAdapter;
+};
+/** Writes an already-generated cookie through the framework's cookie API. */
+export declare function applyAuthCookie({ cookie, serverAdapter, }: {
+    cookie: GeneratedCookie;
+    serverAdapter: ServerAdapter;
+}): Promise<void>;
+/** Writes the Payload auth cookie for `token` through the framework's cookie API. */
+export declare function setAuthCookie({ authConfig, cookiePrefix, serverAdapter, token, }: {
+    token: string;
+} & AuthCookieArgs): Promise<void>;
+/**
+ * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`
+ * attributes it was set with — a mismatched `domain` leaves the original cookie
+ * in place.
+ */
+export declare function clearAuthCookie({ authConfig, cookiePrefix, serverAdapter, }: AuthCookieArgs): Promise<void>;
+/** Reads the request's existing Payload auth cookie, if any. */
+export declare function getExistingAuthToken({ cookiePrefix, serverAdapter, }: {
+    cookiePrefix: string;
+    serverAdapter: ServerAdapter;
+}): Promise<{
+    name: string;
+    value: string;
+} | undefined>;
+export {};
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/serverFunctions/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAIvC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAcD,KAAK,cAAc,GAAG;IACpB,UAAU,EAAE,IAAI,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,aAAa,GACd,EAAE;IACD,MAAM,EAAE,eAAe,CAAA;IACvB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,YAAY,EACZ,aAAa,EACb,KAAK,GACN,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CASpD;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,YAAY,EACZ,aAAa,GACd,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhC;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CAAC,EACzC,YAAY,EACZ,aAAa,GACd,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CASvD"}

package/dist/auth/serverFunctions/cookies.js

@@ -0,0 +1,52 @@
+import { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js';
+// `generateCookie` emits capitalized `SameSite` values (as they appear in the
+// header); `CookieOptions` takes the lowercase form.
+const toCookieOptions = (cookie)=>({
+        domain: cookie.domain,
+        expires: cookie.expires ? new Date(cookie.expires) : undefined,
+        httpOnly: cookie.httpOnly,
+        maxAge: cookie.maxAge,
+        path: cookie.path,
+        sameSite: cookie.sameSite?.toLowerCase(),
+        secure: cookie.secure
+    });
+/** Writes an already-generated cookie through the framework's cookie API. */ export async function applyAuthCookie({ cookie, serverAdapter }) {
+    if (!cookie.value) {
+        return;
+    }
+    await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie));
+}
+/** Writes the Payload auth cookie for `token` through the framework's cookie API. */ export async function setAuthCookie({ authConfig, cookiePrefix, serverAdapter, token }) {
+    const cookie = generatePayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        returnCookieAsObject: true,
+        token
+    });
+    await applyAuthCookie({
+        cookie,
+        serverAdapter
+    });
+}
+/**
+ * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`
+ * attributes it was set with — a mismatched `domain` leaves the original cookie
+ * in place.
+ */ export async function clearAuthCookie({ authConfig, cookiePrefix, serverAdapter }) {
+    const cookie = generateExpiredPayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        returnCookieAsObject: true
+    });
+    await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie));
+}
+/** Reads the request's existing Payload auth cookie, if any. */ export async function getExistingAuthToken({ cookiePrefix, serverAdapter }) {
+    const store = await serverAdapter.getCookies();
+    const allCookies = store.getAll?.();
+    if (allCookies) {
+        return allCookies.find((cookie)=>cookie.name.startsWith(cookiePrefix));
+    }
+    return store.get(`${cookiePrefix}-token`) ?? undefined;
+}
+
+//# sourceMappingURL=cookies.js.map

package/dist/auth/serverFunctions/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/cookies.ts"],"sourcesContent":["import type { CookieOptions } from '../../admin/adapters/cookies.js'\nimport type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { Auth } from '../types.js'\n\nimport { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js'\n\n/**\n * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`\n * when `returnCookieAsObject` is `true`.\n */\nexport type GeneratedCookie = {\n  domain?: string\n  expires?: string\n  httpOnly?: boolean\n  maxAge?: number\n  name: string\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n  value: string | undefined\n}\n\n// `generateCookie` emits capitalized `SameSite` values (as they appear in the\n// header); `CookieOptions` takes the lowercase form.\nconst toCookieOptions = (cookie: GeneratedCookie): CookieOptions => ({\n  domain: cookie.domain,\n  expires: cookie.expires ? new Date(cookie.expires) : undefined,\n  httpOnly: cookie.httpOnly,\n  maxAge: cookie.maxAge,\n  path: cookie.path,\n  sameSite: cookie.sameSite?.toLowerCase() as CookieOptions['sameSite'],\n  secure: cookie.secure,\n})\n\ntype AuthCookieArgs = {\n  authConfig: Auth\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}\n\n/** Writes an already-generated cookie through the framework's cookie API. */\nexport async function applyAuthCookie({\n  cookie,\n  serverAdapter,\n}: {\n  cookie: GeneratedCookie\n  serverAdapter: ServerAdapter\n}): Promise<void> {\n  if (!cookie.value) {\n    return\n  }\n\n  await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie))\n}\n\n/** Writes the Payload auth cookie for `token` through the framework's cookie API. */\nexport async function setAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n  token,\n}: { token: string } & AuthCookieArgs): Promise<void> {\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n    token,\n  }) as GeneratedCookie\n\n  await applyAuthCookie({ cookie, serverAdapter })\n}\n\n/**\n * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`\n * attributes it was set with — a mismatched `domain` leaves the original cookie\n * in place.\n */\nexport async function clearAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n}: AuthCookieArgs): Promise<void> {\n  const cookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n  }) as GeneratedCookie\n\n  await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie))\n}\n\n/** Reads the request's existing Payload auth cookie, if any. */\nexport async function getExistingAuthToken({\n  cookiePrefix,\n  serverAdapter,\n}: {\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}): Promise<{ name: string; value: string } | undefined> {\n  const store = await serverAdapter.getCookies()\n  const allCookies = store.getAll?.()\n\n  if (allCookies) {\n    return allCookies.find((cookie) => cookie.name.startsWith(cookiePrefix))\n  }\n\n  return store.get(`${cookiePrefix}-token`) ?? undefined\n}\n"],"names":["generateExpiredPayloadCookie","generatePayloadCookie","toCookieOptions","cookie","domain","expires","Date","undefined","httpOnly","maxAge","path","sameSite","toLowerCase","secure","applyAuthCookie","serverAdapter","value","setCookie","name","setAuthCookie","authConfig","cookiePrefix","token","collectionAuthConfig","returnCookieAsObject","clearAuthCookie","getExistingAuthToken","store","getCookies","allCookies","getAll","find","startsWith","get"],"mappings":"AAIA,SAASA,4BAA4B,EAAEC,qBAAqB,QAAQ,gBAAe;AAkBnF,8EAA8E;AAC9E,qDAAqD;AACrD,MAAMC,kBAAkB,CAACC,SAA4C,CAAA;QACnEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO,GAAG,IAAIC,KAAKH,OAAOE,OAAO,IAAIE;QACrDC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,MAAMP,OAAOO,IAAI;QACjBC,UAAUR,OAAOQ,QAAQ,EAAEC;QAC3BC,QAAQV,OAAOU,MAAM;IACvB,CAAA;AAQA,2EAA2E,GAC3E,OAAO,eAAeC,gBAAgB,EACpCX,MAAM,EACNY,aAAa,EAId;IACC,IAAI,CAACZ,OAAOa,KAAK,EAAE;QACjB;IACF;IAEA,MAAMD,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAEf,OAAOa,KAAK,EAAEd,gBAAgBC;AAC3E;AAEA,mFAAmF,GACnF,OAAO,eAAegB,cAAc,EAClCC,UAAU,EACVC,YAAY,EACZN,aAAa,EACbO,KAAK,EAC8B;IACnC,MAAMnB,SAASF,sBAAsB;QACnCsB,sBAAsBH;QACtBC;QACAG,sBAAsB;QACtBF;IACF;IAEA,MAAMR,gBAAgB;QAAEX;QAAQY;IAAc;AAChD;AAEA;;;;CAIC,GACD,OAAO,eAAeU,gBAAgB,EACpCL,UAAU,EACVC,YAAY,EACZN,aAAa,EACE;IACf,MAAMZ,SAASH,6BAA6B;QAC1CuB,sBAAsBH;QACtBC;QACAG,sBAAsB;IACxB;IAEA,MAAMT,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAE,IAAIhB,gBAAgBC;AACjE;AAEA,8DAA8D,GAC9D,OAAO,eAAeuB,qBAAqB,EACzCL,YAAY,EACZN,aAAa,EAId;IACC,MAAMY,QAAQ,MAAMZ,cAAca,UAAU;IAC5C,MAAMC,aAAaF,MAAMG,MAAM;IAE/B,IAAID,YAAY;QACd,OAAOA,WAAWE,IAAI,CAAC,CAAC5B,SAAWA,OAAOe,IAAI,CAACc,UAAU,CAACX;IAC5D;IAEA,OAAOM,MAAMM,GAAG,CAAC,GAAGZ,aAAa,MAAM,CAAC,KAAKd;AAC/C"}

package/dist/auth/serverFunctions/login.d.ts

@@ -0,0 +1,29 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { AuthCollectionSlug } from '../../index.js';
+import type { MaybePromise } from '../../types/index.js';
+import type { LoginResult } from '../operations/login.js';
+export type LoginArgs<TSlug extends AuthCollectionSlug> = {
+    collection: TSlug;
+    config: MaybePromise<SanitizedConfig>;
+    password: string;
+    serverAdapter: ServerAdapter;
+} & ({
+    email: string;
+    username?: never;
+} | {
+    email?: never;
+    username: string;
+});
+/**
+ * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.
+ * Distributes over the email/username union so the either-or survives; a plain
+ * `Omit` collapses the union and accepts both keys at once.
+ */
+export type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> = LoginArgs<TSlug> extends infer TArgs ? TArgs extends unknown ? Omit<TArgs, 'serverAdapter'> : never : never;
+/**
+ * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,
+ * so the function is framework-agnostic; each adapter binds its own.
+ */
+export declare function login<TSlug extends AuthCollectionSlug>({ collection, config, email, password, serverAdapter, username, }: LoginArgs<TSlug>): Promise<LoginResult<TSlug>>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/serverFunctions/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAOzD,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,KAAK,CAAA;IACjB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,aAAa,CAAA;CAC7B,GAAG,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAE/E;;;;GAIG;AACH,MAAM,MAAM,6BAA6B,CAAC,KAAK,SAAS,kBAAkB,IACxE,SAAS,CAAC,KAAK,CAAC,SAAS,MAAM,KAAK,GAChC,KAAK,SAAS,OAAO,GACnB,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,GAC5B,KAAK,GACP,KAAK,CAAA;AAEX;;;GAGG;AACH,wBAAsB,KAAK,CAAC,KAAK,SAAS,kBAAkB,EAAE,EAC5D,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,EACR,aAAa,EACb,QAAQ,GACT,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAgDhD"}

package/dist/auth/serverFunctions/login.js

@@ -0,0 +1,63 @@
+import { getPayload } from '../../index.js';
+import { createLocalReq } from '../../utilities/createLocalReq.js';
+import { loginWithCookie } from '../loginWithCookie.js';
+import { applyAuthCookie } from './cookies.js';
+/**
+ * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,
+ * so the function is framework-agnostic; each adapter binds its own.
+ */ export async function login({ collection, config, email, password, serverAdapter, username }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const authConfig = payload.collections[collection]?.config.auth;
+    if (!authConfig) {
+        throw new Error(`No auth config found for collection: ${collection}`);
+    }
+    const loginWithUsername = authConfig.loginWithUsername ?? false;
+    if (loginWithUsername) {
+        if (loginWithUsername.allowEmailLogin) {
+            if (!email && !username) {
+                throw new Error('Email or username is required.');
+            }
+        } else {
+            if (!username) {
+                throw new Error('Username is required.');
+            }
+        }
+    } else {
+        if (!email) {
+            throw new Error('Email is required.');
+        }
+    }
+    let loginData;
+    if (loginWithUsername) {
+        loginData = username ? {
+            password,
+            username
+        } : {
+            email,
+            password
+        };
+    } else {
+        loginData = {
+            email,
+            password
+        };
+    }
+    const collectionConfig = payload.collections[collection];
+    const { cookie, result } = await loginWithCookie({
+        collection: collectionConfig,
+        data: loginData,
+        overrideAccess: true,
+        req: await createLocalReq({}, payload),
+        returnCookieAsObject: true
+    });
+    await applyAuthCookie({
+        cookie,
+        serverAdapter
+    });
+    return result;
+}
+
+//# sourceMappingURL=login.js.map

package/dist/auth/serverFunctions/login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/login.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\nimport type { LoginResult } from '../operations/login.js'\n\nimport { getPayload } from '../../index.js'\nimport { createLocalReq } from '../../utilities/createLocalReq.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\nimport { applyAuthCookie } from './cookies.js'\n\nexport type LoginArgs<TSlug extends AuthCollectionSlug> = {\n  collection: TSlug\n  config: MaybePromise<SanitizedConfig>\n  password: string\n  serverAdapter: ServerAdapter\n} & ({ email: string; username?: never } | { email?: never; username: string })\n\n/**\n * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.\n * Distributes over the email/username union so the either-or survives; a plain\n * `Omit` collapses the union and accepts both keys at once.\n */\nexport type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> =\n  LoginArgs<TSlug> extends infer TArgs\n    ? TArgs extends unknown\n      ? Omit<TArgs, 'serverAdapter'>\n      : never\n    : never\n\n/**\n * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,\n * so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function login<TSlug extends AuthCollectionSlug>({\n  collection,\n  config,\n  email,\n  password,\n  serverAdapter,\n  username,\n}: LoginArgs<TSlug>): Promise<LoginResult<TSlug>> {\n  const payload = await getPayload({ config, cron: true })\n\n  const authConfig = payload.collections[collection]?.config.auth\n\n  if (!authConfig) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const loginWithUsername = authConfig.loginWithUsername ?? false\n\n  if (loginWithUsername) {\n    if (loginWithUsername.allowEmailLogin) {\n      if (!email && !username) {\n        throw new Error('Email or username is required.')\n      }\n    } else {\n      if (!username) {\n        throw new Error('Username is required.')\n      }\n    }\n  } else {\n    if (!email) {\n      throw new Error('Email is required.')\n    }\n  }\n\n  let loginData\n\n  if (loginWithUsername) {\n    loginData = username ? { password, username } : { email, password }\n  } else {\n    loginData = { email, password }\n  }\n\n  const collectionConfig = payload.collections[collection]!\n\n  const { cookie, result } = await loginWithCookie({\n    collection: collectionConfig,\n    data: loginData as Parameters<typeof loginWithCookie>[0]['data'],\n    overrideAccess: true,\n    req: await createLocalReq({}, payload),\n    returnCookieAsObject: true,\n  })\n\n  await applyAuthCookie({ cookie, serverAdapter })\n\n  return result as LoginResult<TSlug>\n}\n"],"names":["getPayload","createLocalReq","loginWithCookie","applyAuthCookie","login","collection","config","email","password","serverAdapter","username","payload","cron","authConfig","collections","auth","Error","loginWithUsername","allowEmailLogin","loginData","collectionConfig","cookie","result","data","overrideAccess","req","returnCookieAsObject"],"mappings":"AAMA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,eAAc;AAqB9C;;;CAGC,GACD,OAAO,eAAeC,MAAwC,EAC5DC,UAAU,EACVC,MAAM,EACNC,KAAK,EACLC,QAAQ,EACRC,aAAa,EACbC,QAAQ,EACS;IACjB,MAAMC,UAAU,MAAMX,WAAW;QAAEM;QAAQM,MAAM;IAAK;IAEtD,MAAMC,aAAaF,QAAQG,WAAW,CAACT,WAAW,EAAEC,OAAOS;IAE3D,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM,CAAC,qCAAqC,EAAEX,YAAY;IACtE;IAEA,MAAMY,oBAAoBJ,WAAWI,iBAAiB,IAAI;IAE1D,IAAIA,mBAAmB;QACrB,IAAIA,kBAAkBC,eAAe,EAAE;YACrC,IAAI,CAACX,SAAS,CAACG,UAAU;gBACvB,MAAM,IAAIM,MAAM;YAClB;QACF,OAAO;YACL,IAAI,CAACN,UAAU;gBACb,MAAM,IAAIM,MAAM;YAClB;QACF;IACF,OAAO;QACL,IAAI,CAACT,OAAO;YACV,MAAM,IAAIS,MAAM;QAClB;IACF;IAEA,IAAIG;IAEJ,IAAIF,mBAAmB;QACrBE,YAAYT,WAAW;YAAEF;YAAUE;QAAS,IAAI;YAAEH;YAAOC;QAAS;IACpE,OAAO;QACLW,YAAY;YAAEZ;YAAOC;QAAS;IAChC;IAEA,MAAMY,mBAAmBT,QAAQG,WAAW,CAACT,WAAW;IAExD,MAAM,EAAEgB,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMpB,gBAAgB;QAC/CG,YAAYe;QACZG,MAAMJ;QACNK,gBAAgB;QAChBC,KAAK,MAAMxB,eAAe,CAAC,GAAGU;QAC9Be,sBAAsB;IACxB;IAEA,MAAMvB,gBAAgB;QAAEkB;QAAQZ;IAAc;IAE9C,OAAOa;AACT"}

package/dist/auth/serverFunctions/logout.d.ts

@@ -0,0 +1,17 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { MaybePromise } from '../../types/index.js';
+export type LogoutArgs = {
+    allSessions?: boolean;
+    config: MaybePromise<SanitizedConfig>;
+    serverAdapter: ServerAdapter;
+};
+/**
+ * Logs the current user out and expires the auth cookie through the supplied
+ * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.
+ */
+export declare function logout({ allSessions, config, serverAdapter, }: LogoutArgs): Promise<{
+    message: string;
+    success: boolean;
+}>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/auth/serverFunctions/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAOxD,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,EAC3B,WAAmB,EACnB,MAAM,EACN,aAAa,GACd,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC7D"}

package/dist/auth/serverFunctions/logout.js

@@ -0,0 +1,58 @@
+import { getPayload } from '../../index.js';
+import { createLocalReq } from '../../utilities/createLocalReq.js';
+import { logoutOperation } from '../operations/logout.js';
+import { clearAuthCookie } from './cookies.js';
+/**
+ * Logs the current user out and expires the auth cookie through the supplied
+ * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.
+ */ export async function logout({ allSessions = false, config, serverAdapter }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const headers = await serverAdapter.getHeaders();
+    const authResult = await payload.auth({
+        headers
+    });
+    if (!authResult.user) {
+        return {
+            message: 'User already logged out',
+            success: true
+        };
+    }
+    const { user } = authResult;
+    const req = await createLocalReq({
+        user
+    }, payload);
+    const collection = payload.collections[user.collection];
+    if (!collection) {
+        return {
+            message: 'Collection not found',
+            success: false
+        };
+    }
+    const logoutResult = await logoutOperation({
+        allSessions,
+        collection,
+        req
+    });
+    if (!logoutResult) {
+        return {
+            message: 'Logout failed',
+            success: false
+        };
+    }
+    if (collection.config.auth) {
+        await clearAuthCookie({
+            authConfig: collection.config.auth,
+            cookiePrefix: payload.config.cookiePrefix,
+            serverAdapter
+        });
+    }
+    return {
+        message: 'User logged out successfully',
+        success: true
+    };
+}
+
+//# sourceMappingURL=logout.js.map

package/dist/auth/serverFunctions/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/logout.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { MaybePromise } from '../../types/index.js'\n\nimport { getPayload } from '../../index.js'\nimport { createLocalReq } from '../../utilities/createLocalReq.js'\nimport { logoutOperation } from '../operations/logout.js'\nimport { clearAuthCookie } from './cookies.js'\n\nexport type LogoutArgs = {\n  allSessions?: boolean\n  config: MaybePromise<SanitizedConfig>\n  serverAdapter: ServerAdapter\n}\n\n/**\n * Logs the current user out and expires the auth cookie through the supplied\n * `serverAdapter`, so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function logout({\n  allSessions = false,\n  config,\n  serverAdapter,\n}: LogoutArgs): Promise<{ message: string; success: boolean }> {\n  const payload = await getPayload({ config, cron: true })\n  const headers = await serverAdapter.getHeaders()\n  const authResult = await payload.auth({ headers })\n\n  if (!authResult.user) {\n    return { message: 'User already logged out', success: true }\n  }\n\n  const { user } = authResult\n  const req = await createLocalReq({ user }, payload)\n  const collection = payload.collections[user.collection]\n\n  if (!collection) {\n    return { message: 'Collection not found', success: false }\n  }\n\n  const logoutResult = await logoutOperation({\n    allSessions,\n    collection,\n    req,\n  })\n\n  if (!logoutResult) {\n    return { message: 'Logout failed', success: false }\n  }\n\n  if (collection.config.auth) {\n    await clearAuthCookie({\n      authConfig: collection.config.auth,\n      cookiePrefix: payload.config.cookiePrefix,\n      serverAdapter,\n    })\n  }\n\n  return { message: 'User logged out successfully', success: true }\n}\n"],"names":["getPayload","createLocalReq","logoutOperation","clearAuthCookie","logout","allSessions","config","serverAdapter","payload","cron","headers","getHeaders","authResult","auth","user","message","success","req","collection","collections","logoutResult","authConfig","cookiePrefix"],"mappings":"AAIA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,eAAe,QAAQ,0BAAyB;AACzD,SAASC,eAAe,QAAQ,eAAc;AAQ9C;;;CAGC,GACD,OAAO,eAAeC,OAAO,EAC3BC,cAAc,KAAK,EACnBC,MAAM,EACNC,aAAa,EACF;IACX,MAAMC,UAAU,MAAMR,WAAW;QAAEM;QAAQG,MAAM;IAAK;IACtD,MAAMC,UAAU,MAAMH,cAAcI,UAAU;IAC9C,MAAMC,aAAa,MAAMJ,QAAQK,IAAI,CAAC;QAAEH;IAAQ;IAEhD,IAAI,CAACE,WAAWE,IAAI,EAAE;QACpB,OAAO;YAAEC,SAAS;YAA2BC,SAAS;QAAK;IAC7D;IAEA,MAAM,EAAEF,IAAI,EAAE,GAAGF;IACjB,MAAMK,MAAM,MAAMhB,eAAe;QAAEa;IAAK,GAAGN;IAC3C,MAAMU,aAAaV,QAAQW,WAAW,CAACL,KAAKI,UAAU,CAAC;IAEvD,IAAI,CAACA,YAAY;QACf,OAAO;YAAEH,SAAS;YAAwBC,SAAS;QAAM;IAC3D;IAEA,MAAMI,eAAe,MAAMlB,gBAAgB;QACzCG;QACAa;QACAD;IACF;IAEA,IAAI,CAACG,cAAc;QACjB,OAAO;YAAEL,SAAS;YAAiBC,SAAS;QAAM;IACpD;IAEA,IAAIE,WAAWZ,MAAM,CAACO,IAAI,EAAE;QAC1B,MAAMV,gBAAgB;YACpBkB,YAAYH,WAAWZ,MAAM,CAACO,IAAI;YAClCS,cAAcd,QAAQF,MAAM,CAACgB,YAAY;YACzCf;QACF;IACF;IAEA,OAAO;QAAEQ,SAAS;QAAgCC,SAAS;IAAK;AAClE"}

package/dist/auth/serverFunctions/refresh.d.ts

@@ -0,0 +1,17 @@
+import type { ServerAdapter } from '../../admin/adapters/server.js';
+import type { SanitizedConfig } from '../../config/types.js';
+import type { MaybePromise } from '../../types/index.js';
+export type RefreshArgs = {
+    config: MaybePromise<SanitizedConfig>;
+    serverAdapter: ServerAdapter;
+};
+/**
+ * Refreshes the current user's auth token and rewrites the cookie through the
+ * supplied `serverAdapter`, so the function is framework-agnostic; each adapter
+ * binds its own.
+ */
+export declare function refresh({ config, serverAdapter, }: RefreshArgs): Promise<{
+    message: string;
+    success: boolean;
+}>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/auth/serverFunctions/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/serverFunctions/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAOxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IACrC,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,aAAa,GACd,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4C9D"}

package/dist/auth/serverFunctions/refresh.js

@@ -0,0 +1,61 @@
+import { getPayload } from '../../index.js';
+import { createLocalReq } from '../../utilities/createLocalReq.js';
+import { refreshOperation } from '../operations/refresh.js';
+import { getExistingAuthToken, setAuthCookie } from './cookies.js';
+/**
+ * Refreshes the current user's auth token and rewrites the cookie through the
+ * supplied `serverAdapter`, so the function is framework-agnostic; each adapter
+ * binds its own.
+ */ export async function refresh({ config, serverAdapter }) {
+    const payload = await getPayload({
+        config,
+        cron: true
+    });
+    const headers = await serverAdapter.getHeaders();
+    const result = await payload.auth({
+        headers
+    });
+    if (!result.user) {
+        throw new Error('Cannot refresh token: user not authenticated');
+    }
+    const existingCookie = await getExistingAuthToken({
+        cookiePrefix: payload.config.cookiePrefix,
+        serverAdapter
+    });
+    if (!existingCookie) {
+        return {
+            message: 'No valid token found to refresh',
+            success: false
+        };
+    }
+    const collection = result.user.collection;
+    const collectionConfig = payload.collections[collection];
+    if (!collectionConfig?.config.auth) {
+        throw new Error(`No auth config found for collection: ${collection}`);
+    }
+    const req = await createLocalReq({
+        user: result.user
+    }, payload);
+    const refreshResult = await refreshOperation({
+        collection: collectionConfig,
+        req
+    });
+    if (!refreshResult) {
+        return {
+            message: 'Token refresh failed',
+            success: false
+        };
+    }
+    await setAuthCookie({
+        authConfig: collectionConfig.config.auth,
+        cookiePrefix: payload.config.cookiePrefix,
+        serverAdapter,
+        token: refreshResult.refreshedToken
+    });
+    return {
+        message: 'Token refreshed successfully',
+        success: true
+    };
+}
+
+//# sourceMappingURL=refresh.js.map

package/dist/auth/serverFunctions/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/serverFunctions/refresh.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { CollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\n\nimport { getPayload } from '../../index.js'\nimport { createLocalReq } from '../../utilities/createLocalReq.js'\nimport { refreshOperation } from '../operations/refresh.js'\nimport { getExistingAuthToken, setAuthCookie } from './cookies.js'\n\nexport type RefreshArgs = {\n  config: MaybePromise<SanitizedConfig>\n  serverAdapter: ServerAdapter\n}\n\n/**\n * Refreshes the current user's auth token and rewrites the cookie through the\n * supplied `serverAdapter`, so the function is framework-agnostic; each adapter\n * binds its own.\n */\nexport async function refresh({\n  config,\n  serverAdapter,\n}: RefreshArgs): Promise<{ message: string; success: boolean }> {\n  const payload = await getPayload({ config, cron: true })\n  const headers = await serverAdapter.getHeaders()\n  const result = await payload.auth({ headers })\n\n  if (!result.user) {\n    throw new Error('Cannot refresh token: user not authenticated')\n  }\n\n  const existingCookie = await getExistingAuthToken({\n    cookiePrefix: payload.config.cookiePrefix,\n    serverAdapter,\n  })\n\n  if (!existingCookie) {\n    return { message: 'No valid token found to refresh', success: false }\n  }\n\n  const collection: CollectionSlug | undefined = result.user.collection\n  const collectionConfig = payload.collections[collection]\n\n  if (!collectionConfig?.config.auth) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const req = await createLocalReq({ user: result.user }, payload)\n\n  const refreshResult = await refreshOperation({\n    collection: collectionConfig,\n    req,\n  })\n\n  if (!refreshResult) {\n    return { message: 'Token refresh failed', success: false }\n  }\n\n  await setAuthCookie({\n    authConfig: collectionConfig.config.auth,\n    cookiePrefix: payload.config.cookiePrefix,\n    serverAdapter,\n    token: refreshResult.refreshedToken,\n  })\n\n  return { message: 'Token refreshed successfully', success: true }\n}\n"],"names":["getPayload","createLocalReq","refreshOperation","getExistingAuthToken","setAuthCookie","refresh","config","serverAdapter","payload","cron","headers","getHeaders","result","auth","user","Error","existingCookie","cookiePrefix","message","success","collection","collectionConfig","collections","req","refreshResult","authConfig","token","refreshedToken"],"mappings":"AAKA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,gBAAgB,QAAQ,2BAA0B;AAC3D,SAASC,oBAAoB,EAAEC,aAAa,QAAQ,eAAc;AAOlE;;;;CAIC,GACD,OAAO,eAAeC,QAAQ,EAC5BC,MAAM,EACNC,aAAa,EACD;IACZ,MAAMC,UAAU,MAAMR,WAAW;QAAEM;QAAQG,MAAM;IAAK;IACtD,MAAMC,UAAU,MAAMH,cAAcI,UAAU;IAC9C,MAAMC,SAAS,MAAMJ,QAAQK,IAAI,CAAC;QAAEH;IAAQ;IAE5C,IAAI,CAACE,OAAOE,IAAI,EAAE;QAChB,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,iBAAiB,MAAMb,qBAAqB;QAChDc,cAAcT,QAAQF,MAAM,CAACW,YAAY;QACzCV;IACF;IAEA,IAAI,CAACS,gBAAgB;QACnB,OAAO;YAAEE,SAAS;YAAmCC,SAAS;QAAM;IACtE;IAEA,MAAMC,aAAyCR,OAAOE,IAAI,CAACM,UAAU;IACrE,MAAMC,mBAAmBb,QAAQc,WAAW,CAACF,WAAW;IAExD,IAAI,CAACC,kBAAkBf,OAAOO,MAAM;QAClC,MAAM,IAAIE,MAAM,CAAC,qCAAqC,EAAEK,YAAY;IACtE;IAEA,MAAMG,MAAM,MAAMtB,eAAe;QAAEa,MAAMF,OAAOE,IAAI;IAAC,GAAGN;IAExD,MAAMgB,gBAAgB,MAAMtB,iBAAiB;QAC3CkB,YAAYC;QACZE;IACF;IAEA,IAAI,CAACC,eAAe;QAClB,OAAO;YAAEN,SAAS;YAAwBC,SAAS;QAAM;IAC3D;IAEA,MAAMf,cAAc;QAClBqB,YAAYJ,iBAAiBf,MAAM,CAACO,IAAI;QACxCI,cAAcT,QAAQF,MAAM,CAACW,YAAY;QACzCV;QACAmB,OAAOF,cAAcG,cAAc;IACrC;IAEA,OAAO;QAAET,SAAS;QAAgCC,SAAS;IAAK;AAClE"}

package/dist/auth/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAU,2CAKpC;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAqC3B,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,gDAMjC;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAWf,CAAA"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8CAK1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAqC3B,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAWf,CAAA"}

package/dist/auth/strategies/apiKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,GAC9B,kBAAkB,yBAAyB,KAAG,oBAuD9C,CAAA"}
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../src/auth/strategies/apiKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,eAAO,MAAM,oBAAoB,qBACZ,yBAAyB,KAAG,oBAwD9C,CAAA"}

package/dist/auth/strategies/apiKey.js

@@ -3,14 +3,16 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
         const authHeader = headers.get('Authorization');
         if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {
             const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '');
-            const sha256APIKeyIndex = crypto.createHmac('sha256', payload.secret).update(apiKey).digest('hex');
+            // The stored index was written under whichever secret was active at the
+            // time, so match against the index computed under every keyring secret.
+            const apiKeyIndexes = payload.encryptionKeyring.all.map((key)=>crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'));
             try {
                 const where = {};
                 if (collectionConfig.auth?.verify) {
                     where.and = [
                         {
                             apiKeyIndex: {
-                                equals: sha256APIKeyIndex
+                                in: apiKeyIndexes
                             }
                         },
                         {
@@ -21,7 +23,7 @@ export const APIKeyAuthentication = (collectionConfig)=>async ({ headers, isGrap
                     ];
                 } else {
                     where.apiKeyIndex = {
-                        equals: sha256APIKeyIndex
+                        in: apiKeyIndexes
                     };
                 }
                 const userQuery = await payload.find({

package/dist/auth/strategies/apiKey.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey)\n        .digest('hex')\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                equals: sha256APIKeyIndex,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { equals: sha256APIKeyIndex }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","sha256APIKeyIndex","createHmac","secret","update","digest","where","auth","verify","and","apiKeyIndex","equals","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,MAAMG,oBAAoBZ,OACvBa,UAAU,CAAC,UAAUR,QAAQS,MAAM,EACnCC,MAAM,CAACL,QACPM,MAAM,CAAC;YAEV,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAIf,iBAAiBgB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,QAAQV;4BACV;wBACF;wBACA;4BACEW,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,QAAQV;oBAAkB;gBAClD;gBAEA,MAAMa,YAAY,MAAMpB,QAAQqB,IAAI,CAAC;oBACnCC,YAAYzB,iBAAiBO,IAAI;oBACjCmB,OAAOxB,YAAY,IAAIF,iBAAiBgB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAGzB,iBAAiBO,IAAI;oBACxCyB,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}
+{"version":3,"sources":["../../../src/auth/strategies/apiKey.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { User } from '../../index.js'\nimport type { Where } from '../../types/index.js'\nimport type { AuthStrategyFunction } from '../index.js'\n\nexport const APIKeyAuthentication =\n  (collectionConfig: SanitizedCollectionConfig): AuthStrategyFunction =>\n  async ({ headers, isGraphQL = false, payload }) => {\n    const authHeader = headers.get('Authorization')\n\n    if (authHeader?.startsWith(`${collectionConfig.slug} API-Key `)) {\n      const apiKey = authHeader.replace(`${collectionConfig.slug} API-Key `, '')\n\n      // The stored index was written under whichever secret was active at the\n      // time, so match against the index computed under every keyring secret.\n      const apiKeyIndexes = payload.encryptionKeyring.all.map((key) =>\n        crypto.createHmac('sha256', key.legacyKey).update(apiKey).digest('hex'),\n      )\n\n      try {\n        const where: Where = {}\n        if (collectionConfig.auth?.verify) {\n          where.and = [\n            {\n              apiKeyIndex: {\n                in: apiKeyIndexes,\n              },\n            },\n            {\n              _verified: {\n                not_equals: false,\n              },\n            },\n          ]\n        } else {\n          where.apiKeyIndex = { in: apiKeyIndexes }\n        }\n\n        const userQuery = await payload.find({\n          collection: collectionConfig.slug,\n          depth: isGraphQL ? 0 : collectionConfig.auth.depth,\n          limit: 1,\n          overrideAccess: true,\n          pagination: false,\n          where,\n        })\n\n        if (userQuery.docs && userQuery.docs.length > 0) {\n          const user = userQuery.docs[0]\n          user!.collection = collectionConfig.slug\n          user!._strategy = 'api-key'\n\n          return {\n            user: user as User,\n          }\n        }\n      } catch (ignore) {\n        return { user: null }\n      }\n    }\n\n    return { user: null }\n  }\n"],"names":["crypto","APIKeyAuthentication","collectionConfig","headers","isGraphQL","payload","authHeader","get","startsWith","slug","apiKey","replace","apiKeyIndexes","encryptionKeyring","all","map","key","createHmac","legacyKey","update","digest","where","auth","verify","and","apiKeyIndex","in","_verified","not_equals","userQuery","find","collection","depth","limit","overrideAccess","pagination","docs","length","user","_strategy","ignore"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAO3B,OAAO,MAAMC,uBACX,CAACC,mBACD,OAAO,EAAEC,OAAO,EAAEC,YAAY,KAAK,EAAEC,OAAO,EAAE;QAC5C,MAAMC,aAAaH,QAAQI,GAAG,CAAC;QAE/B,IAAID,YAAYE,WAAW,GAAGN,iBAAiBO,IAAI,CAAC,SAAS,CAAC,GAAG;YAC/D,MAAMC,SAASJ,WAAWK,OAAO,CAAC,GAAGT,iBAAiBO,IAAI,CAAC,SAAS,CAAC,EAAE;YAEvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAMG,gBAAgBP,QAAQQ,iBAAiB,CAACC,GAAG,CAACC,GAAG,CAAC,CAACC,MACvDhB,OAAOiB,UAAU,CAAC,UAAUD,IAAIE,SAAS,EAAEC,MAAM,CAACT,QAAQU,MAAM,CAAC;YAGnE,IAAI;gBACF,MAAMC,QAAe,CAAC;gBACtB,IAAInB,iBAAiBoB,IAAI,EAAEC,QAAQ;oBACjCF,MAAMG,GAAG,GAAG;wBACV;4BACEC,aAAa;gCACXC,IAAId;4BACN;wBACF;wBACA;4BACEe,WAAW;gCACTC,YAAY;4BACd;wBACF;qBACD;gBACH,OAAO;oBACLP,MAAMI,WAAW,GAAG;wBAAEC,IAAId;oBAAc;gBAC1C;gBAEA,MAAMiB,YAAY,MAAMxB,QAAQyB,IAAI,CAAC;oBACnCC,YAAY7B,iBAAiBO,IAAI;oBACjCuB,OAAO5B,YAAY,IAAIF,iBAAiBoB,IAAI,CAACU,KAAK;oBAClDC,OAAO;oBACPC,gBAAgB;oBAChBC,YAAY;oBACZd;gBACF;gBAEA,IAAIQ,UAAUO,IAAI,IAAIP,UAAUO,IAAI,CAACC,MAAM,GAAG,GAAG;oBAC/C,MAAMC,OAAOT,UAAUO,IAAI,CAAC,EAAE;oBAC9BE,KAAMP,UAAU,GAAG7B,iBAAiBO,IAAI;oBACxC6B,KAAMC,SAAS,GAAG;oBAElB,OAAO;wBACLD,MAAMA;oBACR;gBACF;YACF,EAAE,OAAOE,QAAQ;gBACf,OAAO;oBAAEF,MAAM;gBAAK;YACtB;QACF;QAEA,OAAO;YAAEA,MAAM;QAAK;IACtB,EAAC"}