payload 4.0.0-internal.fa345ef → 4.0.0-internal.ff27d6e

package/dist/auth/getFieldsToSign.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getFieldsToSign.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { Field, TabAsField } from '../fields/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldAffectsData, tabHasName } from '../fields/config/types.js'\n\ntype TraverseFieldsArgs = {\n  data: Record<string, unknown>\n  fields: (Field | TabAsField)[]\n  result: Record<string, unknown>\n}\nconst traverseFields = ({\n  data,\n  // parent,\n  fields,\n  result,\n}: TraverseFieldsArgs) => {\n  fields.forEach((field) => {\n    switch (field.type) {\n      case 'collapsible':\n      case 'row': {\n        traverseFields({\n          data,\n          fields: field.fields,\n          result,\n        })\n        break\n      }\n      case 'group': {\n        if (fieldAffectsData(field)) {\n          const groupData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = groupData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = groupData\n          }\n          const groupResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: groupData,\n            fields: field.fields,\n            result: groupResult,\n          })\n          break\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n\n          break\n        }\n      }\n      case 'tab': {\n        if (tabHasName(field)) {\n          const tabData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = tabData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = tabData\n          }\n          const tabResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: tabData,\n            fields: field.fields,\n            result: tabResult,\n          })\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n        }\n        break\n      }\n      case 'tabs': {\n        traverseFields({\n          data,\n          fields: field.tabs.map((tab) => ({ ...tab, type: 'tab' })),\n          result,\n        })\n        break\n      }\n      default:\n        if (fieldAffectsData(field)) {\n          if (field.saveToJWT) {\n            if (typeof field.saveToJWT === 'string') {\n              result[field.saveToJWT] = data[field.name]\n              delete result[field.name]\n            } else {\n              result[field.name] = data[field.name] as Record<string, unknown>\n            }\n          } else if (field.saveToJWT === false) {\n            delete result[field.name]\n          }\n        }\n    }\n  })\n  return result\n}\nexport const getFieldsToSign = (args: {\n  collectionConfig: CollectionConfig\n  email: string\n  sid?: string\n  user: PayloadRequest['user']\n}): Record<string, unknown> => {\n  const { collectionConfig, email, sid, user } = args\n\n  const result: Record<string, unknown> = {\n    id: user?.id,\n    collection: collectionConfig.slug,\n    email,\n  }\n\n  if (sid) {\n    result.sid = sid\n  }\n\n  traverseFields({\n    data: user!,\n    fields: collectionConfig.fields,\n    result,\n  })\n\n  return result\n}\n"],"names":["fieldAffectsData","tabHasName","traverseFields","data","fields","result","forEach","field","type","groupData","name","targetResult","saveToJWT","groupResult","tabData","tabResult","tabs","map","tab","getFieldsToSign","args","collectionConfig","email","sid","user","id","collection","slug"],"mappings":"AAIA,SAASA,gBAAgB,EAAEC,UAAU,QAAQ,4BAA2B;AAOxE,MAAMC,iBAAiB,CAAC,EACtBC,IAAI,EACJ,UAAU;AACVC,MAAM,EACNC,MAAM,EACa;IACnBD,OAAOE,OAAO,CAAC,CAACC;QACd,OAAQA,MAAMC,IAAI;YAChB,KAAK;YACL,KAAK;gBAAO;oBACVN,eAAe;wBACbC;wBACAC,QAAQG,MAAMH,MAAM;wBACpBC;oBACF;oBACA;gBACF;YACA,KAAK;gBAAS;oBACZ,IAAIL,iBAAiBO,QAAQ;wBAC3B,MAAME,YACJ,AAACN,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGH;wBAC5B,OAAO,IAAIF,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGD;wBACvB;wBACA,MAAMI,cAAeF,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAI3DH,eAAe;4BACbC,MAAMM;4BACNL,QAAQG,MAAMH,MAAM;4BACpBC,QAAQQ;wBACV;wBACA;oBACF,OAAO;wBACLX,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;wBAEA;oBACF;gBACF;YACA,KAAK;gBAAO;oBACV,IAAIJ,WAAWM,QAAQ;wBACrB,MAAMO,UACJ,AAACX,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGE;wBAC5B,OAAO,IAAIP,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGI;wBACvB;wBACA,MAAMC,YAAaJ,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAIzDH,eAAe;4BACbC,MAAMW;4BACNV,QAAQG,MAAMH,MAAM;4BACpBC,QAAQU;wBACV;oBACF,OAAO;wBACLb,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;oBACF;oBACA;gBACF;YACA,KAAK;gBAAQ;oBACXH,eAAe;wBACbC;wBACAC,QAAQG,MAAMS,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gCAAE,GAAGA,GAAG;gCAAEV,MAAM;4BAAM,CAAA;wBACvDH;oBACF;oBACA;gBACF;YACA;gBACE,IAAIL,iBAAiBO,QAAQ;oBAC3B,IAAIA,MAAMK,SAAS,EAAE;wBACnB,IAAI,OAAOL,MAAMK,SAAS,KAAK,UAAU;4BACvCP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGT,IAAI,CAACI,MAAMG,IAAI,CAAC;4BAC1C,OAAOL,MAAM,CAACE,MAAMG,IAAI,CAAC;wBAC3B,OAAO;4BACLL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGP,IAAI,CAACI,MAAMG,IAAI,CAAC;wBACvC;oBACF,OAAO,IAAIH,MAAMK,SAAS,KAAK,OAAO;wBACpC,OAAOP,MAAM,CAACE,MAAMG,IAAI,CAAC;oBAC3B;gBACF;QACJ;IACF;IACA,OAAOL;AACT;AACA,OAAO,MAAMc,kBAAkB,CAACC;IAM9B,MAAM,EAAEC,gBAAgB,EAAEC,KAAK,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGJ;IAE/C,MAAMf,SAAkC;QACtCoB,IAAID,MAAMC;QACVC,YAAYL,iBAAiBM,IAAI;QACjCL;IACF;IAEA,IAAIC,KAAK;QACPlB,OAAOkB,GAAG,GAAGA;IACf;IAEArB,eAAe;QACbC,MAAMqB;QACNpB,QAAQiB,iBAAiBjB,MAAM;QAC/BC;IACF;IAEA,OAAOA;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/getFieldsToSign.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { Field, TabAsField } from '../fields/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldAffectsData, tabHasName } from '../fields/config/types.js'\n\nconst reservedJWTFields = new Set(['collection', 'email', 'exp', 'iat', 'id', 'sid'])\n\ntype TraverseFieldsArgs = {\n  data: Record<string, unknown>\n  fields: (Field | TabAsField)[]\n  result: Record<string, unknown>\n}\nconst traverseFields = ({\n  data,\n  // parent,\n  fields,\n  result,\n}: TraverseFieldsArgs) => {\n  fields.forEach((field) => {\n    switch (field.type) {\n      case 'collapsible':\n      case 'row': {\n        traverseFields({\n          data,\n          fields: field.fields,\n          result,\n        })\n        break\n      }\n      case 'group': {\n        if (fieldAffectsData(field)) {\n          const groupData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = groupData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = groupData\n          }\n          const groupResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: groupData,\n            fields: field.fields,\n            result: groupResult,\n          })\n          break\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n\n          break\n        }\n      }\n      case 'tab': {\n        if (tabHasName(field)) {\n          const tabData: Record<string, unknown> =\n            (data[field.name] as Record<string, unknown>) ?? {}\n          let targetResult\n          if (typeof field.saveToJWT === 'string') {\n            targetResult = field.saveToJWT\n            result[field.saveToJWT] = tabData\n          } else if (field.saveToJWT) {\n            targetResult = field.name\n            result[field.name] = tabData\n          }\n          const tabResult = (targetResult ? result[targetResult] : result) as Record<\n            string,\n            unknown\n          >\n          traverseFields({\n            data: tabData,\n            fields: field.fields,\n            result: tabResult,\n          })\n        } else {\n          traverseFields({\n            data,\n            fields: field.fields,\n            result,\n          })\n        }\n        break\n      }\n      case 'tabs': {\n        traverseFields({\n          data,\n          fields: field.tabs.map((tab) => ({ ...tab, type: 'tab' })),\n          result,\n        })\n        break\n      }\n      default:\n        if (fieldAffectsData(field)) {\n          if (field.saveToJWT) {\n            if (typeof field.saveToJWT === 'string') {\n              result[field.saveToJWT] = data[field.name]\n              delete result[field.name]\n            } else {\n              result[field.name] = data[field.name]\n            }\n          } else if (field.saveToJWT === false) {\n            delete result[field.name]\n          }\n        }\n    }\n  })\n  return result\n}\nexport const getFieldsToSign = (args: {\n  collectionConfig: CollectionConfig\n  email: string\n  sid?: string\n  user: PayloadRequest['user']\n}): Record<string, unknown> => {\n  const { collectionConfig, email, sid, user } = args\n\n  const fieldsToSign = Object.create(null) as Record<string, unknown>\n\n  traverseFields({\n    data: user!,\n    fields: collectionConfig.fields,\n    result: fieldsToSign,\n  })\n\n  for (const fieldName of reservedJWTFields) {\n    delete fieldsToSign[fieldName]\n  }\n\n  fieldsToSign.id = user?.id\n  fieldsToSign.collection = collectionConfig.slug\n  fieldsToSign.email = email\n\n  if (sid) {\n    fieldsToSign.sid = sid\n  }\n\n  return fieldsToSign\n}\n"],"names":["fieldAffectsData","tabHasName","reservedJWTFields","Set","traverseFields","data","fields","result","forEach","field","type","groupData","name","targetResult","saveToJWT","groupResult","tabData","tabResult","tabs","map","tab","getFieldsToSign","args","collectionConfig","email","sid","user","fieldsToSign","Object","create","fieldName","id","collection","slug"],"mappings":"AAIA,SAASA,gBAAgB,EAAEC,UAAU,QAAQ,4BAA2B;AAExE,MAAMC,oBAAoB,IAAIC,IAAI;IAAC;IAAc;IAAS;IAAO;IAAO;IAAM;CAAM;AAOpF,MAAMC,iBAAiB,CAAC,EACtBC,IAAI,EACJ,UAAU;AACVC,MAAM,EACNC,MAAM,EACa;IACnBD,OAAOE,OAAO,CAAC,CAACC;QACd,OAAQA,MAAMC,IAAI;YAChB,KAAK;YACL,KAAK;gBAAO;oBACVN,eAAe;wBACbC;wBACAC,QAAQG,MAAMH,MAAM;wBACpBC;oBACF;oBACA;gBACF;YACA,KAAK;gBAAS;oBACZ,IAAIP,iBAAiBS,QAAQ;wBAC3B,MAAME,YACJ,AAACN,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGH;wBAC5B,OAAO,IAAIF,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGD;wBACvB;wBACA,MAAMI,cAAeF,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAI3DH,eAAe;4BACbC,MAAMM;4BACNL,QAAQG,MAAMH,MAAM;4BACpBC,QAAQQ;wBACV;wBACA;oBACF,OAAO;wBACLX,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;wBAEA;oBACF;gBACF;YACA,KAAK;gBAAO;oBACV,IAAIN,WAAWQ,QAAQ;wBACrB,MAAMO,UACJ,AAACX,IAAI,CAACI,MAAMG,IAAI,CAAC,IAAgC,CAAC;wBACpD,IAAIC;wBACJ,IAAI,OAAOJ,MAAMK,SAAS,KAAK,UAAU;4BACvCD,eAAeJ,MAAMK,SAAS;4BAC9BP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGE;wBAC5B,OAAO,IAAIP,MAAMK,SAAS,EAAE;4BAC1BD,eAAeJ,MAAMG,IAAI;4BACzBL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGI;wBACvB;wBACA,MAAMC,YAAaJ,eAAeN,MAAM,CAACM,aAAa,GAAGN;wBAIzDH,eAAe;4BACbC,MAAMW;4BACNV,QAAQG,MAAMH,MAAM;4BACpBC,QAAQU;wBACV;oBACF,OAAO;wBACLb,eAAe;4BACbC;4BACAC,QAAQG,MAAMH,MAAM;4BACpBC;wBACF;oBACF;oBACA;gBACF;YACA,KAAK;gBAAQ;oBACXH,eAAe;wBACbC;wBACAC,QAAQG,MAAMS,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gCAAE,GAAGA,GAAG;gCAAEV,MAAM;4BAAM,CAAA;wBACvDH;oBACF;oBACA;gBACF;YACA;gBACE,IAAIP,iBAAiBS,QAAQ;oBAC3B,IAAIA,MAAMK,SAAS,EAAE;wBACnB,IAAI,OAAOL,MAAMK,SAAS,KAAK,UAAU;4BACvCP,MAAM,CAACE,MAAMK,SAAS,CAAC,GAAGT,IAAI,CAACI,MAAMG,IAAI,CAAC;4BAC1C,OAAOL,MAAM,CAACE,MAAMG,IAAI,CAAC;wBAC3B,OAAO;4BACLL,MAAM,CAACE,MAAMG,IAAI,CAAC,GAAGP,IAAI,CAACI,MAAMG,IAAI,CAAC;wBACvC;oBACF,OAAO,IAAIH,MAAMK,SAAS,KAAK,OAAO;wBACpC,OAAOP,MAAM,CAACE,MAAMG,IAAI,CAAC;oBAC3B;gBACF;QACJ;IACF;IACA,OAAOL;AACT;AACA,OAAO,MAAMc,kBAAkB,CAACC;IAM9B,MAAM,EAAEC,gBAAgB,EAAEC,KAAK,EAAEC,GAAG,EAAEC,IAAI,EAAE,GAAGJ;IAE/C,MAAMK,eAAeC,OAAOC,MAAM,CAAC;IAEnCzB,eAAe;QACbC,MAAMqB;QACNpB,QAAQiB,iBAAiBjB,MAAM;QAC/BC,QAAQoB;IACV;IAEA,KAAK,MAAMG,aAAa5B,kBAAmB;QACzC,OAAOyB,YAAY,CAACG,UAAU;IAChC;IAEAH,aAAaI,EAAE,GAAGL,MAAMK;IACxBJ,aAAaK,UAAU,GAAGT,iBAAiBU,IAAI;IAC/CN,aAAaH,KAAK,GAAGA;IAErB,IAAIC,KAAK;QACPE,aAAaF,GAAG,GAAGA;IACrB;IAEA,OAAOE;AACT,EAAC"}

package/dist/auth/getLoginOptions.d.ts

@@ -1,5 +1,5 @@
 import type { Auth } from './types.js';
-export declare const getLoginOptions: (loginWithUsername: Auth["loginWithUsername"]) => {
+export declare const getLoginOptions: (loginWithUsername: Auth['loginWithUsername']) => {
     canLoginWithEmail: boolean;
     canLoginWithUsername: boolean;
 };

package/dist/auth/getLoginOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getLoginOptions.d.ts","sourceRoot":"","sources":["../../src/auth/getLoginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,eAAO,MAAM,eAAe,GAC1B,mBAAmB,IAAI,CAAC,mBAAmB,CAAC,KAC3C;IACD,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;CAM9B,CAAA"}
+{"version":3,"file":"getLoginOptions.d.ts","sourceRoot":"","sources":["../../src/auth/getLoginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,eAAO,MAAM,eAAe,sBACP,IAAI,CAAC,mBAAmB,CAAC,KAC3C;IACD,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;CAM9B,CAAA"}

package/dist/auth/getLoginOptions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getLoginOptions.ts"],"sourcesContent":["import type { Auth } from './types.js'\n\nexport const getLoginOptions = (\n  loginWithUsername: Auth['loginWithUsername'],\n): {\n  canLoginWithEmail: boolean\n  canLoginWithUsername: boolean\n} => {\n  return {\n    canLoginWithEmail: !loginWithUsername || loginWithUsername.allowEmailLogin!,\n    canLoginWithUsername: Boolean(loginWithUsername),\n  }\n}\n"],"names":["getLoginOptions","loginWithUsername","canLoginWithEmail","allowEmailLogin","canLoginWithUsername","Boolean"],"mappings":"AAEA,OAAO,MAAMA,kBAAkB,CAC7BC;IAKA,OAAO;QACLC,mBAAmB,CAACD,qBAAqBA,kBAAkBE,eAAe;QAC1EC,sBAAsBC,QAAQJ;IAChC;AACF,EAAC"}
+{"version":3,"sources":["../../src/auth/getLoginOptions.ts"],"sourcesContent":["import type { Auth } from './types.js'\n\nexport const getLoginOptions = (\n  loginWithUsername: Auth['loginWithUsername'],\n): {\n  canLoginWithEmail: boolean\n  canLoginWithUsername: boolean\n} => {\n  return {\n    canLoginWithEmail: !loginWithUsername || loginWithUsername.allowEmailLogin,\n    canLoginWithUsername: Boolean(loginWithUsername),\n  }\n}\n"],"names":["getLoginOptions","loginWithUsername","canLoginWithEmail","allowEmailLogin","canLoginWithUsername","Boolean"],"mappings":"AAEA,OAAO,MAAMA,kBAAkB,CAC7BC;IAKA,OAAO;QACLC,mBAAmB,CAACD,qBAAqBA,kBAAkBE,eAAe;QAC1EC,sBAAsBC,QAAQJ;IAChC;AACF,EAAC"}

package/dist/auth/isUserLocked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isUserLocked.d.ts","sourceRoot":"","sources":["../../src/auth/isUserLocked.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,GAAI,MAAM,IAAI,KAAG,OAKzC,CAAA"}
+{"version":3,"file":"isUserLocked.d.ts","sourceRoot":"","sources":["../../src/auth/isUserLocked.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,SAAU,IAAI,KAAG,OAKzC,CAAA"}

package/dist/auth/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,GAAU,4CAI3B;IACD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;;;EAUA,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,OAAO,+CAIjB;IACD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;;;EAUA,CAAA"}

package/dist/auth/jwt.js

@@ -1,10 +1,12 @@
-import { SignJWT } from 'jose';
+import { SignJWT } from 'jose/jwt/sign';
+import { JWT_AUTH_VERSION } from './jwtAuth.js';
 export const jwtSign = async ({ fieldsToSign, secret, tokenExpiration })=>{
     const secretKey = new TextEncoder().encode(secret);
     const issuedAt = Math.floor(Date.now() / 1000);
     const exp = issuedAt + tokenExpiration;
     const token = await new SignJWT(fieldsToSign).setProtectedHeader({
         alg: 'HS256',
+        authVersion: JWT_AUTH_VERSION,
         typ: 'JWT'
     }).setIssuedAt(issuedAt).setExpirationTime(exp).sign(secretKey);
     return {

package/dist/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/jwt.ts"],"sourcesContent":["import { SignJWT } from 'jose'\n\nexport const jwtSign = async ({\n  fieldsToSign,\n  secret,\n  tokenExpiration,\n}: {\n  fieldsToSign: Record<string, unknown>\n  secret: string\n  tokenExpiration: number\n}) => {\n  const secretKey = new TextEncoder().encode(secret)\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const exp = issuedAt + tokenExpiration\n  const token = await new SignJWT(fieldsToSign)\n    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })\n    .setIssuedAt(issuedAt)\n    .setExpirationTime(exp)\n    .sign(secretKey)\n  return { exp, token }\n}\n"],"names":["SignJWT","jwtSign","fieldsToSign","secret","tokenExpiration","secretKey","TextEncoder","encode","issuedAt","Math","floor","Date","now","exp","token","setProtectedHeader","alg","typ","setIssuedAt","setExpirationTime","sign"],"mappings":"AAAA,SAASA,OAAO,QAAQ,OAAM;AAE9B,OAAO,MAAMC,UAAU,OAAO,EAC5BC,YAAY,EACZC,MAAM,EACNC,eAAe,EAKhB;IACC,MAAMC,YAAY,IAAIC,cAAcC,MAAM,CAACJ;IAC3C,MAAMK,WAAWC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;IACzC,MAAMC,MAAML,WAAWJ;IACvB,MAAMU,QAAQ,MAAM,IAAId,QAAQE,cAC7Ba,kBAAkB,CAAC;QAAEC,KAAK;QAASC,KAAK;IAAM,GAC9CC,WAAW,CAACV,UACZW,iBAAiB,CAACN,KAClBO,IAAI,CAACf;IACR,OAAO;QAAEQ;QAAKC;IAAM;AACtB,EAAC"}
+{"version":3,"sources":["../../src/auth/jwt.ts"],"sourcesContent":["import { SignJWT } from 'jose/jwt/sign'\n\nimport { JWT_AUTH_VERSION } from './jwtAuth.js'\n\nexport const jwtSign = async ({\n  fieldsToSign,\n  secret,\n  tokenExpiration,\n}: {\n  fieldsToSign: Record<string, unknown>\n  secret: string\n  tokenExpiration: number\n}) => {\n  const secretKey = new TextEncoder().encode(secret)\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const exp = issuedAt + tokenExpiration\n  const token = await new SignJWT(fieldsToSign)\n    .setProtectedHeader({ alg: 'HS256', authVersion: JWT_AUTH_VERSION, typ: 'JWT' })\n    .setIssuedAt(issuedAt)\n    .setExpirationTime(exp)\n    .sign(secretKey)\n  return { exp, token }\n}\n"],"names":["SignJWT","JWT_AUTH_VERSION","jwtSign","fieldsToSign","secret","tokenExpiration","secretKey","TextEncoder","encode","issuedAt","Math","floor","Date","now","exp","token","setProtectedHeader","alg","authVersion","typ","setIssuedAt","setExpirationTime","sign"],"mappings":"AAAA,SAASA,OAAO,QAAQ,gBAAe;AAEvC,SAASC,gBAAgB,QAAQ,eAAc;AAE/C,OAAO,MAAMC,UAAU,OAAO,EAC5BC,YAAY,EACZC,MAAM,EACNC,eAAe,EAKhB;IACC,MAAMC,YAAY,IAAIC,cAAcC,MAAM,CAACJ;IAC3C,MAAMK,WAAWC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;IACzC,MAAMC,MAAML,WAAWJ;IACvB,MAAMU,QAAQ,MAAM,IAAIf,QAAQG,cAC7Ba,kBAAkB,CAAC;QAAEC,KAAK;QAASC,aAAajB;QAAkBkB,KAAK;IAAM,GAC7EC,WAAW,CAACX,UACZY,iBAAiB,CAACP,KAClBQ,IAAI,CAAChB;IACR,OAAO;QAAEQ;QAAKC;IAAM;AACtB,EAAC"}

package/dist/auth/jwtAuth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Version of Payload's JWT authentication format, stored in the signed protected header.
+ *
+ * The signer, verifier, and external validators must agree on this value. A mismatch
+ * rejects every token in the system, so they should import it rather than repeat the literal.
+ */
+export declare const JWT_AUTH_VERSION = 1;
+export type JWTAuthVersion = typeof JWT_AUTH_VERSION;
+//# sourceMappingURL=jwtAuth.d.ts.map

package/dist/auth/jwtAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtAuth.d.ts","sourceRoot":"","sources":["../../src/auth/jwtAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAEjC,MAAM,MAAM,cAAc,GAAG,OAAO,gBAAgB,CAAA"}

package/dist/auth/jwtAuth.js

@@ -0,0 +1,8 @@
+/**
+ * Version of Payload's JWT authentication format, stored in the signed protected header.
+ *
+ * The signer, verifier, and external validators must agree on this value. A mismatch
+ * rejects every token in the system, so they should import it rather than repeat the literal.
+ */ export const JWT_AUTH_VERSION = 1;
+
+//# sourceMappingURL=jwtAuth.js.map

package/dist/auth/jwtAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/jwtAuth.ts"],"sourcesContent":["/**\n * Version of Payload's JWT authentication format, stored in the signed protected header.\n *\n * The signer, verifier, and external validators must agree on this value. A mismatch\n * rejects every token in the system, so they should import it rather than repeat the literal.\n */\nexport const JWT_AUTH_VERSION = 1\n\nexport type JWTAuthVersion = typeof JWT_AUTH_VERSION\n"],"names":["JWT_AUTH_VERSION"],"mappings":"AAAA;;;;;CAKC,GACD,OAAO,MAAMA,mBAAmB,EAAC"}

package/dist/auth/loginWithCookie.d.ts

@@ -0,0 +1,33 @@
+import type { Collection } from '../collections/config/types.js';
+import type { AuthCollectionSlug } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+import type { generateCookie } from './cookies.js';
+import type { LoginResult } from './operations/login.js';
+import { loginOperation } from './operations/login.js';
+type CookieObject = Extract<ReturnType<typeof generateCookie<true>>, {
+    name: string;
+}>;
+type LoginWithCookieArgs<TReturnCookieAsObject extends boolean> = {
+    collection: Collection;
+    data: Parameters<typeof loginOperation>[0]['data'];
+    depth?: number;
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+    /** Return the cookie as parts rather than a serialized header string. */
+    returnCookieAsObject?: TReturnCookieAsObject;
+};
+/**
+ * Runs the login operation and builds the auth cookie from its token, then
+ * applies `auth.removeTokenFromResponses` to the returned result.
+ *
+ * The order matters: the token has to be read before the flag strips it, or the
+ * caller ends up returning a user with no way to establish a session. Shared by
+ * the REST login handler and the framework adapters' `login` server function so
+ * that ordering only exists in one place.
+ */
+export declare const loginWithCookie: <TSlug extends AuthCollectionSlug, TReturnCookieAsObject extends boolean = false>({ collection, data, depth, overrideAccess, req, returnCookieAsObject, }: LoginWithCookieArgs<TReturnCookieAsObject>) => Promise<{
+    cookie: TReturnCookieAsObject extends true ? CookieObject : string;
+    result: LoginResult<TSlug>;
+}>;
+export {};
+//# sourceMappingURL=loginWithCookie.d.ts.map

package/dist/auth/loginWithCookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginWithCookie.d.ts","sourceRoot":"","sources":["../../src/auth/loginWithCookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,KAAK,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAEtF,KAAK,mBAAmB,CAAC,qBAAqB,SAAS,OAAO,IAAI;IAChE,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,qBAAqB,CAAA;CAC7C,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAC1B,KAAK,SAAS,kBAAkB,EAChC,qBAAqB,SAAS,OAAO,GAAG,KAAK,2EAQ5C,mBAAmB,CAAC,qBAAqB,CAAC,KAAG,OAAO,CAAC;IACtD,MAAM,EAAE,qBAAqB,SAAS,IAAI,GAAG,YAAY,GAAG,MAAM,CAAA;IAClE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAA;CAC3B,CAqBA,CAAA"}

package/dist/auth/loginWithCookie.js

@@ -0,0 +1,34 @@
+import { generatePayloadCookie } from './cookies.js';
+import { loginOperation } from './operations/login.js';
+/**
+ * Runs the login operation and builds the auth cookie from its token, then
+ * applies `auth.removeTokenFromResponses` to the returned result.
+ *
+ * The order matters: the token has to be read before the flag strips it, or the
+ * caller ends up returning a user with no way to establish a session. Shared by
+ * the REST login handler and the framework adapters' `login` server function so
+ * that ordering only exists in one place.
+ */ export const loginWithCookie = async ({ collection, data, depth, overrideAccess, req, returnCookieAsObject })=>{
+    const result = await loginOperation({
+        collection,
+        data,
+        depth,
+        overrideAccess,
+        req
+    });
+    const cookie = generatePayloadCookie({
+        collectionAuthConfig: collection.config.auth,
+        cookiePrefix: req.payload.config.cookiePrefix,
+        returnCookieAsObject: returnCookieAsObject ?? false,
+        token: result.token
+    });
+    if (collection.config.auth.removeTokenFromResponses) {
+        delete result.token;
+    }
+    return {
+        cookie,
+        result
+    };
+};
+
+//# sourceMappingURL=loginWithCookie.js.map

package/dist/auth/loginWithCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/loginWithCookie.ts"],"sourcesContent":["import type { Collection } from '../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { generateCookie } from './cookies.js'\nimport type { LoginResult } from './operations/login.js'\n\nimport { generatePayloadCookie } from './cookies.js'\nimport { loginOperation } from './operations/login.js'\n\ntype CookieObject = Extract<ReturnType<typeof generateCookie<true>>, { name: string }>\n\ntype LoginWithCookieArgs<TReturnCookieAsObject extends boolean> = {\n  collection: Collection\n  data: Parameters<typeof loginOperation>[0]['data']\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n  /** Return the cookie as parts rather than a serialized header string. */\n  returnCookieAsObject?: TReturnCookieAsObject\n}\n\n/**\n * Runs the login operation and builds the auth cookie from its token, then\n * applies `auth.removeTokenFromResponses` to the returned result.\n *\n * The order matters: the token has to be read before the flag strips it, or the\n * caller ends up returning a user with no way to establish a session. Shared by\n * the REST login handler and the framework adapters' `login` server function so\n * that ordering only exists in one place.\n */\nexport const loginWithCookie = async <\n  TSlug extends AuthCollectionSlug,\n  TReturnCookieAsObject extends boolean = false,\n>({\n  collection,\n  data,\n  depth,\n  overrideAccess,\n  req,\n  returnCookieAsObject,\n}: LoginWithCookieArgs<TReturnCookieAsObject>): Promise<{\n  cookie: TReturnCookieAsObject extends true ? CookieObject : string\n  result: LoginResult<TSlug>\n}> => {\n  const result = await loginOperation({\n    collection,\n    data,\n    depth,\n    overrideAccess,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    returnCookieAsObject: returnCookieAsObject ?? false,\n    token: result.token!,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return { cookie, result }\n}\n"],"names":["generatePayloadCookie","loginOperation","loginWithCookie","collection","data","depth","overrideAccess","req","returnCookieAsObject","result","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","token","removeTokenFromResponses"],"mappings":"AAMA,SAASA,qBAAqB,QAAQ,eAAc;AACpD,SAASC,cAAc,QAAQ,wBAAuB;AActD;;;;;;;;CAQC,GACD,OAAO,MAAMC,kBAAkB,OAG7B,EACAC,UAAU,EACVC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,GAAG,EACHC,oBAAoB,EACuB;IAI3C,MAAMC,SAAS,MAAMR,eAAe;QAClCE;QACAC;QACAC;QACAC;QACAC;IACF;IAEA,MAAMG,SAASV,sBAAsB;QACnCW,sBAAsBR,WAAWS,MAAM,CAACC,IAAI;QAC5CC,cAAcP,IAAIQ,OAAO,CAACH,MAAM,CAACE,YAAY;QAC7CN,sBAAsBA,wBAAwB;QAC9CQ,OAAOP,OAAOO,KAAK;IACrB;IAEA,IAAIb,WAAWS,MAAM,CAACC,IAAI,CAACI,wBAAwB,EAAE;QACnD,OAAOR,OAAOO,KAAK;IACrB;IAEA,OAAO;QAAEN;QAAQD;IAAO;AAC1B,EAAC"}

package/dist/auth/operations/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAMvD,KAAK,SAAS,GAAG;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,oBAAoB,CAWnF,CAAA"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAKvD,KAAK,SAAS,GAAG;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,SAAgB,SAAS,KAAG,OAAO,CAAC,oBAAoB,CAMnF,CAAA"}

package/dist/auth/operations/access.js

@@ -1,17 +1,11 @@
-import { killTransaction } from '../../utilities/killTransaction.js';
 import { adminInit as adminInitTelemetry } from '../../utilities/telemetry/events/adminInit.js';
 import { getAccessResults } from '../getAccessResults.js';
 export const accessOperation = async (args)=>{
     const { req } = args;
     adminInitTelemetry(req);
-    try {
-        return getAccessResults({
-            req
-        });
-    } catch (e) {
-        await killTransaction(req);
-        throw e;
-    }
+    return getAccessResults({
+        req
+    });
 };
 
 //# sourceMappingURL=access.js.map

package/dist/auth/operations/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/access.ts"],"sourcesContent":["import type { PayloadRequest } from '../../types/index.js'\nimport type { SanitizedPermissions } from '../types.js'\n\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { adminInit as adminInitTelemetry } from '../../utilities/telemetry/events/adminInit.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\ntype Arguments = {\n  req: PayloadRequest\n}\n\nexport const accessOperation = async (args: Arguments): Promise<SanitizedPermissions> => {\n  const { req } = args\n\n  adminInitTelemetry(req)\n\n  try {\n    return getAccessResults({ req })\n  } catch (e: unknown) {\n    await killTransaction(req)\n    throw e\n  }\n}\n"],"names":["killTransaction","adminInit","adminInitTelemetry","getAccessResults","accessOperation","args","req","e"],"mappings":"AAGA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAaC,kBAAkB,QAAQ,gDAA+C;AAC/F,SAASC,gBAAgB,QAAQ,yBAAwB;AAMzD,OAAO,MAAMC,kBAAkB,OAAOC;IACpC,MAAM,EAAEC,GAAG,EAAE,GAAGD;IAEhBH,mBAAmBI;IAEnB,IAAI;QACF,OAAOH,iBAAiB;YAAEG;QAAI;IAChC,EAAE,OAAOC,GAAY;QACnB,MAAMP,gBAAgBM;QACtB,MAAMC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/access.ts"],"sourcesContent":["import type { PayloadRequest } from '../../types/index.js'\nimport type { SanitizedPermissions } from '../types.js'\n\nimport { adminInit as adminInitTelemetry } from '../../utilities/telemetry/events/adminInit.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\ntype Arguments = {\n  req: PayloadRequest\n}\n\nexport const accessOperation = async (args: Arguments): Promise<SanitizedPermissions> => {\n  const { req } = args\n\n  adminInitTelemetry(req)\n\n  return getAccessResults({ req })\n}\n"],"names":["adminInit","adminInitTelemetry","getAccessResults","accessOperation","args","req"],"mappings":"AAGA,SAASA,aAAaC,kBAAkB,QAAQ,gDAA+C;AAC/F,SAASC,gBAAgB,QAAQ,yBAAwB;AAMzD,OAAO,MAAMC,kBAAkB,OAAOC;IACpC,MAAM,EAAEC,GAAG,EAAE,GAAGD;IAEhBH,mBAAmBI;IAEnB,OAAOH,iBAAiB;QAAEG;IAAI;AAChC,EAAC"}

package/dist/auth/operations/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAM1D,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,EAAE,oBAAoB,CAAA;IACjC,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAG,OAAO,CAAC,UAAU,CA4BvE,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAK1D,MAAM,MAAM,QAAQ,GAAG;IACrB;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,EAAE,oBAAoB,CAAA;IACjC,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,eAAO,MAAM,IAAI,SAAgB,QAAQ,CAAC,QAAQ,CAAC,KAAG,OAAO,CAAC,UAAU,CAwBvE,CAAA"}

package/dist/auth/operations/auth.js

@@ -1,30 +1,25 @@
-import { killTransaction } from '../../utilities/killTransaction.js';
 import { executeAuthStrategies } from '../executeAuthStrategies.js';
 import { getAccessResults } from '../getAccessResults.js';
 export const auth = async (args)=>{
     const { canSetHeaders, headers } = args;
     const req = args.req;
     const { payload } = req;
-    try {
-        const { responseHeaders, user } = await executeAuthStrategies({
-            canSetHeaders,
-            headers,
-            payload
-        });
-        req.user = user;
-        req.responseHeaders = responseHeaders;
-        const permissions = await getAccessResults({
-            req
-        });
-        return {
-            permissions,
-            responseHeaders,
-            user
-        };
-    } catch (error) {
-        await killTransaction(req);
-        throw error;
-    }
+    const { responseHeaders, user } = await executeAuthStrategies({
+        canSetHeaders,
+        headers,
+        payload,
+        req
+    });
+    req.user = user;
+    req.responseHeaders = responseHeaders;
+    const permissions = await getAccessResults({
+        req
+    });
+    return {
+        permissions,
+        responseHeaders,
+        user
+    };
 };
 
 //# sourceMappingURL=auth.js.map

package/dist/auth/operations/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/auth.ts"],"sourcesContent":["import type { AuthenticatedUser, SanitizedPermissions } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAuthStrategies } from '../executeAuthStrategies.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\nexport type AuthArgs = {\n  /**\n   * Specify if it's possible for auth strategies to set headers within this operation.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  req?: Omit<PayloadRequest, 'user'>\n}\n\nexport type AuthResult = {\n  permissions: SanitizedPermissions\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport const auth = async (args: Required<AuthArgs>): Promise<AuthResult> => {\n  const { canSetHeaders, headers } = args\n  const req = args.req as PayloadRequest\n  const { payload } = req\n\n  try {\n    const { responseHeaders, user } = await executeAuthStrategies({\n      canSetHeaders,\n      headers,\n      payload,\n    })\n\n    req.user = user\n    req.responseHeaders = responseHeaders\n\n    const permissions = await getAccessResults({\n      req,\n    })\n\n    return {\n      permissions,\n      responseHeaders,\n      user,\n    }\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["killTransaction","executeAuthStrategies","getAccessResults","auth","args","canSetHeaders","headers","req","payload","responseHeaders","user","permissions","error"],"mappings":"AAGA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,gBAAgB,QAAQ,yBAAwB;AAiBzD,OAAO,MAAMC,OAAO,OAAOC;IACzB,MAAM,EAAEC,aAAa,EAAEC,OAAO,EAAE,GAAGF;IACnC,MAAMG,MAAMH,KAAKG,GAAG;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAGD;IAEpB,IAAI;QACF,MAAM,EAAEE,eAAe,EAAEC,IAAI,EAAE,GAAG,MAAMT,sBAAsB;YAC5DI;YACAC;YACAE;QACF;QAEAD,IAAIG,IAAI,GAAGA;QACXH,IAAIE,eAAe,GAAGA;QAEtB,MAAME,cAAc,MAAMT,iBAAiB;YACzCK;QACF;QAEA,OAAO;YACLI;YACAF;YACAC;QACF;IACF,EAAE,OAAOE,OAAgB;QACvB,MAAMZ,gBAAgBO;QACtB,MAAMK;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/auth.ts"],"sourcesContent":["import type { AuthenticatedUser, SanitizedPermissions } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { executeAuthStrategies } from '../executeAuthStrategies.js'\nimport { getAccessResults } from '../getAccessResults.js'\n\nexport type AuthArgs = {\n  /**\n   * Specify if it's possible for auth strategies to set headers within this operation.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  req?: Omit<PayloadRequest, 'user'>\n}\n\nexport type AuthResult = {\n  permissions: SanitizedPermissions\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport const auth = async (args: Required<AuthArgs>): Promise<AuthResult> => {\n  const { canSetHeaders, headers } = args\n  const req = args.req as PayloadRequest\n  const { payload } = req\n\n  const { responseHeaders, user } = await executeAuthStrategies({\n    canSetHeaders,\n    headers,\n    payload,\n    req,\n  })\n\n  req.user = user\n  req.responseHeaders = responseHeaders\n\n  const permissions = await getAccessResults({\n    req,\n  })\n\n  return {\n    permissions,\n    responseHeaders,\n    user,\n  }\n}\n"],"names":["executeAuthStrategies","getAccessResults","auth","args","canSetHeaders","headers","req","payload","responseHeaders","user","permissions"],"mappings":"AAGA,SAASA,qBAAqB,QAAQ,8BAA6B;AACnE,SAASC,gBAAgB,QAAQ,yBAAwB;AAiBzD,OAAO,MAAMC,OAAO,OAAOC;IACzB,MAAM,EAAEC,aAAa,EAAEC,OAAO,EAAE,GAAGF;IACnC,MAAMG,MAAMH,KAAKG,GAAG;IACpB,MAAM,EAAEC,OAAO,EAAE,GAAGD;IAEpB,MAAM,EAAEE,eAAe,EAAEC,IAAI,EAAE,GAAG,MAAMT,sBAAsB;QAC5DI;QACAC;QACAE;QACAD;IACF;IAEAA,IAAIG,IAAI,GAAGA;IACXH,IAAIE,eAAe,GAAGA;IAEtB,MAAME,cAAc,MAAMT,iBAAiB;QACzCK;IACF;IAEA,OAAO;QACLI;QACAF;QACAC;IACF;AACF,EAAC"}

package/dist/auth/operations/forgotPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/forgotPassword.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,eAAO,MAAM,uBAAuB,GAAU,KAAK,SAAS,kBAAkB,EAC5E,cAAc,SAAS,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,IAAI,GAAG,MAAM,CA2LvB,CAAA"}
+{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/forgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAiBjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B,eAAO,MAAM,uBAAuB,GAAU,KAAK,SAAS,kBAAkB,gBAC9D,SAAS,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,IAAI,GAAG,MAAM,CAyPvB,CAAA"}

package/dist/auth/operations/forgotPassword.js

@@ -1,23 +1,28 @@
 import crypto from 'crypto';
-import { status as httpStatus } from 'http-status';
 import { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js';
 import { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js';
 import { APIError } from '../../errors/index.js';
 import { Forbidden } from '../../index.js';
 import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js';
+import { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js';
 import { commitTransaction } from '../../utilities/commitTransaction.js';
 import { formatAdminURL } from '../../utilities/formatAdminURL.js';
 import { getRequestOrigin } from '../../utilities/getRequestOrigin.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
+import { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 import { getLoginOptions } from '../getLoginOptions.js';
 export const forgotPasswordOperation = async (incomingArgs)=>{
+    assertNoValidationWrite(incomingArgs.req);
     const loginWithUsername = incomingArgs.collection.config.auth.loginWithUsername;
     const { data, overrideAccess } = incomingArgs;
     const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername);
     const sanitizedEmail = canLoginWithEmail && (incomingArgs.data.email || '').toLowerCase().trim() || null;
     const sanitizedUsername = 'username' in data && typeof data?.username === 'string' ? data.username.toLowerCase().trim() : null;
     let args = incomingArgs;
+    let hasSentEmail = false;
+    let releaseRequestInterval = null;
     if (incomingArgs.collection.config.auth.disableLocalStrategy) {
         throw new Forbidden(incomingArgs.req.t);
     }
@@ -36,13 +41,7 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
             overrideAccess
         });
         const { collection: { config: collectionConfig }, disableEmail, expiration, req: { payload: { config, email }, payload }, req } = args;
-        // /////////////////////////////////////
-        // Forget password
-        // /////////////////////////////////////
-        let token = crypto.randomBytes(20).toString('hex');
-        if (!sanitizedEmail && !sanitizedUsername) {
-            throw new APIError(`Missing ${loginWithUsername ? 'username' : 'email'}.`, httpStatus.BAD_REQUEST);
-        }
+        const minRequestInterval = collectionConfig.auth.forgotPassword.minRequestInterval ?? 15000;
         let whereConstraint = {};
         if (canLoginWithEmail && sanitizedEmail) {
             whereConstraint = {
@@ -63,19 +62,93 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
             trash: false,
             where: whereConstraint
         });
-        let user = await payload.db.findOne({
-            collection: collectionConfig.slug,
-            req,
-            where: whereConstraint
-        });
+        const now = Date.now();
+        let token = crypto.randomBytes(20).toString('hex');
+        const resetPasswordExpiration = new Date(now + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000)).toISOString();
+        let user;
+        if (!disableEmail && minRequestInterval > 0) {
+            const requestedAt = new Date(now).toISOString();
+            const reservationReq = isolateObjectProperty(req, 'transactionID');
+            reservationReq.transactionID = undefined;
+            user = await payload.db.updateOne({
+                collection: collectionConfig.slug,
+                data: {
+                    resetPasswordRequestedAt: requestedAt
+                },
+                options: {
+                    atomic: true
+                },
+                req: reservationReq,
+                where: {
+                    and: [
+                        whereConstraint,
+                        {
+                            or: [
+                                {
+                                    resetPasswordRequestedAt: {
+                                        exists: false
+                                    }
+                                },
+                                {
+                                    resetPasswordRequestedAt: {
+                                        equals: null
+                                    }
+                                },
+                                {
+                                    resetPasswordRequestedAt: {
+                                        less_than_equal: new Date(now - minRequestInterval).toISOString()
+                                    }
+                                }
+                            ]
+                        }
+                    ]
+                }
+            });
+            if (user) {
+                const userID = user.id;
+                releaseRequestInterval = async ()=>{
+                    await payload.db.updateOne({
+                        collection: collectionConfig.slug,
+                        data: {
+                            resetPasswordRequestedAt: null
+                        },
+                        options: {
+                            atomic: true
+                        },
+                        req: reservationReq,
+                        where: {
+                            and: [
+                                {
+                                    id: {
+                                        equals: userID
+                                    }
+                                },
+                                {
+                                    resetPasswordRequestedAt: {
+                                        equals: requestedAt
+                                    }
+                                }
+                            ]
+                        }
+                    });
+                };
+            }
+        } else {
+            user = await payload.db.findOne({
+                collection: collectionConfig.slug,
+                req,
+                where: whereConstraint
+            });
+        }
         // We don't want to indicate specifically that an email was not found,
         // as doing so could lead to the exposure of registered emails.
         // Therefore, we prefer to fail silently.
         if (!user) {
-            await commitTransaction(args.req);
+            if (shouldCommit) {
+                await commitTransaction(args.req);
+            }
             return null;
         }
-        const resetPasswordExpiration = new Date(Date.now() + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000)).toISOString();
         user = await payload.update({
             id: user.id,
             collection: collectionConfig.slug,
@@ -83,6 +156,7 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
                 resetPasswordExpiration,
                 resetPasswordToken: token
             },
+            overrideAccess: true,
             req
         });
         if (!disableEmail && user.email) {
@@ -119,6 +193,7 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
                 subject,
                 to: user.email
             });
+            hasSentEmail = true;
         }
         // /////////////////////////////////////
         // afterForgotPassword - Collection
@@ -148,6 +223,16 @@ export const forgotPasswordOperation = async (incomingArgs)=>{
         return token;
     } catch (error) {
         await killTransaction(args.req);
+        if (!hasSentEmail && releaseRequestInterval) {
+            try {
+                await releaseRequestInterval();
+            } catch (err) {
+                args.req.payload.logger.error({
+                    err,
+                    msg: 'Failed to release forgot-password interval'
+                });
+            }
+        }
         throw error;
     }
 };

package/dist/auth/operations/forgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/forgotPassword.ts"],"sourcesContent":["import crypto from 'crypto'\nimport { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { formatAdminURL } from '../../utilities/formatAdminURL.js'\nimport { getRequestOrigin } from '../../utilities/getRequestOrigin.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: {\n    [key: string]: unknown\n  } & AuthOperationsFromCollectionSlug<TSlug>['forgotPassword']\n  disableEmail?: boolean\n  expiration?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport type Result = string\n\nexport const forgotPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<null | string> => {\n  const loginWithUsername = incomingArgs.collection.config.auth.loginWithUsername\n  const { data, overrideAccess } = incomingArgs\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail =\n    (canLoginWithEmail && (incomingArgs.data.email || '').toLowerCase().trim()) || null\n  const sanitizedUsername =\n    'username' in data && typeof data?.username === 'string'\n      ? data.username.toLowerCase().trim()\n      : null\n\n  let args = incomingArgs\n\n  if (incomingArgs.collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(incomingArgs.req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n    })\n\n    const {\n      collection: { config: collectionConfig },\n      disableEmail,\n      expiration,\n      req: {\n        payload: { config, email },\n        payload,\n      },\n      req,\n    } = args\n\n    // /////////////////////////////////////\n    // Forget password\n    // /////////////////////////////////////\n\n    let token: string = crypto.randomBytes(20).toString('hex')\n    type UserDoc = {\n      email?: string\n      id: number | string\n      resetPasswordExpiration?: string\n      resetPasswordToken?: string\n    }\n\n    if (!sanitizedEmail && !sanitizedUsername) {\n      throw new APIError(\n        `Missing ${loginWithUsername ? 'username' : 'email'}.`,\n        httpStatus.BAD_REQUEST,\n      )\n    }\n\n    let whereConstraint: Where = {}\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = {\n        email: {\n          equals: sanitizedEmail,\n        },\n      }\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = {\n        username: {\n          equals: sanitizedUsername,\n        },\n      }\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: collectionConfig.trash,\n      trash: false,\n      where: whereConstraint,\n    })\n\n    let user = await payload.db.findOne<UserDoc>({\n      collection: collectionConfig.slug,\n      req,\n      where: whereConstraint,\n    })\n\n    // We don't want to indicate specifically that an email was not found,\n    // as doing so could lead to the exposure of registered emails.\n    // Therefore, we prefer to fail silently.\n    if (!user) {\n      await commitTransaction(args.req)\n      return null\n    }\n\n    const resetPasswordExpiration = new Date(\n      Date.now() + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000),\n    ).toISOString()\n\n    user = await payload.update({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        resetPasswordExpiration,\n        resetPasswordToken: token,\n      },\n      req,\n    })\n\n    if (!disableEmail && user.email) {\n      const serverURL = getRequestOrigin({ config, req })\n      const forgotURL = formatAdminURL({\n        adminRoute: config.routes.admin,\n        path: `${config.admin.routes.reset}/${token}`,\n        serverURL,\n      })\n      let html = `${req.t('authentication:youAreReceivingResetPassword')}\n    <a href=\"${forgotURL}\">${forgotURL}</a>\n    ${req.t('authentication:youDidNotRequestPassword')}`\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailHTML === 'function') {\n        html = await collectionConfig.auth.forgotPassword.generateEmailHTML({\n          req,\n          token,\n          user,\n        })\n      }\n\n      let subject = req.t('authentication:resetYourPassword')\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailSubject === 'function') {\n        subject = await collectionConfig.auth.forgotPassword.generateEmailSubject({\n          req,\n          token,\n          user,\n        })\n      }\n\n      await email.sendEmail({\n        from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n        html,\n        subject,\n        to: user.email,\n      })\n    }\n\n    // /////////////////////////////////////\n    // afterForgotPassword - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterForgotPassword?.length) {\n      for (const hook of collectionConfig.hooks.afterForgotPassword) {\n        await hook({ args, collection: args.collection?.config, context: req.context })\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    token = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n      result: token,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return token\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n    throw error\n  }\n}\n"],"names":["crypto","status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","formatAdminURL","getRequestOrigin","initTransaction","killTransaction","getLoginOptions","forgotPasswordOperation","incomingArgs","loginWithUsername","collection","config","auth","data","overrideAccess","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","email","toLowerCase","trim","sanitizedUsername","username","args","disableLocalStrategy","req","t","BAD_REQUEST","shouldCommit","operation","collectionConfig","disableEmail","expiration","payload","token","randomBytes","toString","whereConstraint","equals","enableTrash","trash","where","user","db","findOne","slug","resetPasswordExpiration","Date","now","forgotPassword","toISOString","update","id","resetPasswordToken","serverURL","forgotURL","adminRoute","routes","admin","path","reset","html","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to","hooks","afterForgotPassword","length","hook","context","result","error"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,SAAS,QAAQ,iBAAgB;AAC1C,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AAevD,OAAO,MAAMC,0BAA0B,OACrCC;IAEA,MAAMC,oBAAoBD,aAAaE,UAAU,CAACC,MAAM,CAACC,IAAI,CAACH,iBAAiB;IAC/E,MAAM,EAAEI,IAAI,EAAEC,cAAc,EAAE,GAAGN;IAEjC,MAAM,EAAEO,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGV,gBAAgBG;IAEpE,MAAMQ,iBACJ,AAACF,qBAAqB,AAACP,CAAAA,aAAaK,IAAI,CAACK,KAAK,IAAI,EAAC,EAAGC,WAAW,GAAGC,IAAI,MAAO;IACjF,MAAMC,oBACJ,cAAcR,QAAQ,OAAOA,MAAMS,aAAa,WAC5CT,KAAKS,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IAEN,IAAIG,OAAOf;IAEX,IAAIA,aAAaE,UAAU,CAACC,MAAM,CAACC,IAAI,CAACY,oBAAoB,EAAE;QAC5D,MAAM,IAAIzB,UAAUS,aAAaiB,GAAG,CAACC,CAAC;IACxC;IACA,IAAI,CAACT,kBAAkB,CAACI,mBAAmB;QACzC,MAAM,IAAIvB,SACR,CAAC,QAAQ,EAAEW,oBAAoB,aAAa,QAAQ,CAAC,CAAC,EACtDd,WAAWgC,WAAW;IAE1B;IAEA,IAAI;QACF,MAAMC,eAAe,MAAMxB,gBAAgBmB,KAAKE,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QACxCF,OAAO,MAAM1B,qBAAqB;YAChC0B;YACAb,YAAYa,KAAKb,UAAU,CAACC,MAAM;YAClCkB,WAAW;YACXf;QACF;QAEA,MAAM,EACJJ,YAAY,EAAEC,QAAQmB,gBAAgB,EAAE,EACxCC,YAAY,EACZC,UAAU,EACVP,KAAK,EACHQ,SAAS,EAAEtB,MAAM,EAAEO,KAAK,EAAE,EAC1Be,OAAO,EACR,EACDR,GAAG,EACJ,GAAGF;QAEJ,wCAAwC;QACxC,kBAAkB;QAClB,wCAAwC;QAExC,IAAIW,QAAgBzC,OAAO0C,WAAW,CAAC,IAAIC,QAAQ,CAAC;QAQpD,IAAI,CAACnB,kBAAkB,CAACI,mBAAmB;YACzC,MAAM,IAAIvB,SACR,CAAC,QAAQ,EAAEW,oBAAoB,aAAa,QAAQ,CAAC,CAAC,EACtDd,WAAWgC,WAAW;QAE1B;QAEA,IAAIU,kBAAyB,CAAC;QAE9B,IAAItB,qBAAqBE,gBAAgB;YACvCoB,kBAAkB;gBAChBnB,OAAO;oBACLoB,QAAQrB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBK,mBAAmB;YACpDgB,kBAAkB;gBAChBf,UAAU;oBACRgB,QAAQjB;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CgB,kBAAkBrC,uBAAuB;YACvCuC,aAAaT,iBAAiBU,KAAK;YACnCA,OAAO;YACPC,OAAOJ;QACT;QAEA,IAAIK,OAAO,MAAMT,QAAQU,EAAE,CAACC,OAAO,CAAU;YAC3ClC,YAAYoB,iBAAiBe,IAAI;YACjCpB;YACAgB,OAAOJ;QACT;QAEA,sEAAsE;QACtE,+DAA+D;QAC/D,yCAAyC;QACzC,IAAI,CAACK,MAAM;YACT,MAAMzC,kBAAkBsB,KAAKE,GAAG;YAChC,OAAO;QACT;QAEA,MAAMqB,0BAA0B,IAAIC,KAClCA,KAAKC,GAAG,KAAMlB,CAAAA,iBAAiBlB,IAAI,EAAEqC,gBAAgBjB,cAAcA,cAAc,OAAM,GACvFkB,WAAW;QAEbR,OAAO,MAAMT,QAAQkB,MAAM,CAAC;YAC1BC,IAAIV,KAAKU,EAAE;YACX1C,YAAYoB,iBAAiBe,IAAI;YACjChC,MAAM;gBACJiC;gBACAO,oBAAoBnB;YACtB;YACAT;QACF;QAEA,IAAI,CAACM,gBAAgBW,KAAKxB,KAAK,EAAE;YAC/B,MAAMoC,YAAYnD,iBAAiB;gBAAEQ;gBAAQc;YAAI;YACjD,MAAM8B,YAAYrD,eAAe;gBAC/BsD,YAAY7C,OAAO8C,MAAM,CAACC,KAAK;gBAC/BC,MAAM,GAAGhD,OAAO+C,KAAK,CAACD,MAAM,CAACG,KAAK,CAAC,CAAC,EAAE1B,OAAO;gBAC7CoB;YACF;YACA,IAAIO,OAAO,GAAGpC,IAAIC,CAAC,CAAC,+CAA+C;aAC5D,EAAE6B,UAAU,EAAE,EAAEA,UAAU;IACnC,EAAE9B,IAAIC,CAAC,CAAC,4CAA4C;YAElD,IAAI,OAAOI,iBAAiBlB,IAAI,CAACqC,cAAc,EAAEa,sBAAsB,YAAY;gBACjFD,OAAO,MAAM/B,iBAAiBlB,IAAI,CAACqC,cAAc,CAACa,iBAAiB,CAAC;oBAClErC;oBACAS;oBACAQ;gBACF;YACF;YAEA,IAAIqB,UAAUtC,IAAIC,CAAC,CAAC;YAEpB,IAAI,OAAOI,iBAAiBlB,IAAI,CAACqC,cAAc,EAAEe,yBAAyB,YAAY;gBACpFD,UAAU,MAAMjC,iBAAiBlB,IAAI,CAACqC,cAAc,CAACe,oBAAoB,CAAC;oBACxEvC;oBACAS;oBACAQ;gBACF;YACF;YAEA,MAAMxB,MAAM+C,SAAS,CAAC;gBACpBC,MAAM,CAAC,CAAC,EAAEhD,MAAMiD,eAAe,CAAC,GAAG,EAAEjD,MAAMkD,kBAAkB,CAAC,CAAC,CAAC;gBAChEP;gBACAE;gBACAM,IAAI3B,KAAKxB,KAAK;YAChB;QACF;QAEA,wCAAwC;QACxC,mCAAmC;QACnC,wCAAwC;QAExC,IAAIY,iBAAiBwC,KAAK,EAAEC,qBAAqBC,QAAQ;YACvD,KAAK,MAAMC,QAAQ3C,iBAAiBwC,KAAK,CAACC,mBAAmB,CAAE;gBAC7D,MAAME,KAAK;oBAAElD;oBAAMb,YAAYa,KAAKb,UAAU,EAAEC;oBAAQ+D,SAASjD,IAAIiD,OAAO;gBAAC;YAC/E;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCxC,QAAQ,MAAMtC,oBAAoB;YAChC2B;YACAb,YAAYa,KAAKb,UAAU,EAAEC;YAC7BkB,WAAW;YACXf;YACA6D,QAAQzC;QACV;QAEA,IAAIN,cAAc;YAChB,MAAM3B,kBAAkBwB;QAC1B;QAEA,OAAOS;IACT,EAAE,OAAO0C,OAAgB;QACvB,MAAMvE,gBAAgBkB,KAAKE,GAAG;QAC9B,MAAMmD;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/forgotPassword.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { formatAdminURL } from '../../utilities/formatAdminURL.js'\nimport { getRequestOrigin } from '../../utilities/getRequestOrigin.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: {\n    [key: string]: unknown\n  } & AuthOperationsFromCollectionSlug<TSlug>['forgotPassword']\n  disableEmail?: boolean\n  expiration?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport type Result = string\n\nexport const forgotPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<null | string> => {\n  assertNoValidationWrite(incomingArgs.req)\n\n  const loginWithUsername = incomingArgs.collection.config.auth.loginWithUsername\n  const { data, overrideAccess } = incomingArgs\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail =\n    (canLoginWithEmail && (incomingArgs.data.email || '').toLowerCase().trim()) || null\n  const sanitizedUsername =\n    'username' in data && typeof data?.username === 'string'\n      ? data.username.toLowerCase().trim()\n      : null\n  let args = incomingArgs\n  let hasSentEmail = false\n  let releaseRequestInterval: (() => Promise<void>) | null = null\n\n  if (incomingArgs.collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(incomingArgs.req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    const shouldCommit = await initTransaction(args.req)\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n    })\n\n    const {\n      collection: { config: collectionConfig },\n      disableEmail,\n      expiration,\n      req: {\n        payload: { config, email },\n        payload,\n      },\n      req,\n    } = args\n    const minRequestInterval = collectionConfig.auth.forgotPassword.minRequestInterval ?? 15000\n\n    // /////////////////////////////////////\n    // Forget password\n    // /////////////////////////////////////\n\n    type UserDoc = {\n      email?: string\n      id: number | string\n      resetPasswordExpiration?: string\n      resetPasswordRequestedAt?: string\n      resetPasswordToken?: string\n    }\n\n    let whereConstraint: Where = {}\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = {\n        email: {\n          equals: sanitizedEmail,\n        },\n      }\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = {\n        username: {\n          equals: sanitizedUsername,\n        },\n      }\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: collectionConfig.trash,\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const now = Date.now()\n    let token: string = crypto.randomBytes(20).toString('hex')\n    const resetPasswordExpiration = new Date(\n      now + (collectionConfig.auth?.forgotPassword?.expiration ?? expiration ?? 3600000),\n    ).toISOString()\n    let user: null | UserDoc\n\n    if (!disableEmail && minRequestInterval > 0) {\n      const requestedAt = new Date(now).toISOString()\n      const reservationReq = isolateObjectProperty(req, 'transactionID')\n      reservationReq.transactionID = undefined\n\n      user = (await payload.db.updateOne({\n        collection: collectionConfig.slug,\n        data: {\n          resetPasswordRequestedAt: requestedAt,\n        },\n        options: { atomic: true },\n        req: reservationReq,\n        where: {\n          and: [\n            whereConstraint,\n            {\n              or: [\n                { resetPasswordRequestedAt: { exists: false } },\n                { resetPasswordRequestedAt: { equals: null } },\n                {\n                  resetPasswordRequestedAt: {\n                    less_than_equal: new Date(now - minRequestInterval).toISOString(),\n                  },\n                },\n              ],\n            },\n          ],\n        },\n      })) as null | UserDoc\n\n      if (user) {\n        const userID = user.id\n        releaseRequestInterval = async () => {\n          await payload.db.updateOne({\n            collection: collectionConfig.slug,\n            data: { resetPasswordRequestedAt: null },\n            options: { atomic: true },\n            req: reservationReq,\n            where: {\n              and: [\n                { id: { equals: userID } },\n                { resetPasswordRequestedAt: { equals: requestedAt } },\n              ],\n            },\n          })\n        }\n      }\n    } else {\n      user = await payload.db.findOne<UserDoc>({\n        collection: collectionConfig.slug,\n        req,\n        where: whereConstraint,\n      })\n    }\n\n    // We don't want to indicate specifically that an email was not found,\n    // as doing so could lead to the exposure of registered emails.\n    // Therefore, we prefer to fail silently.\n    if (!user) {\n      if (shouldCommit) {\n        await commitTransaction(args.req)\n      }\n      return null\n    }\n\n    user = await payload.update({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        resetPasswordExpiration,\n        resetPasswordToken: token,\n      },\n      overrideAccess: true,\n      req,\n    })\n\n    if (!disableEmail && user.email) {\n      const serverURL = getRequestOrigin({ config, req })\n      const forgotURL = formatAdminURL({\n        adminRoute: config.routes.admin,\n        path: `${config.admin.routes.reset}/${token}`,\n        serverURL,\n      })\n      let html = `${req.t('authentication:youAreReceivingResetPassword')}\n    <a href=\"${forgotURL}\">${forgotURL}</a>\n    ${req.t('authentication:youDidNotRequestPassword')}`\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailHTML === 'function') {\n        html = await collectionConfig.auth.forgotPassword.generateEmailHTML({\n          req,\n          token,\n          user,\n        })\n      }\n\n      let subject = req.t('authentication:resetYourPassword')\n\n      if (typeof collectionConfig.auth.forgotPassword?.generateEmailSubject === 'function') {\n        subject = await collectionConfig.auth.forgotPassword.generateEmailSubject({\n          req,\n          token,\n          user,\n        })\n      }\n\n      await email.sendEmail({\n        from: `\"${email.defaultFromName}\" <${email.defaultFromAddress}>`,\n        html,\n        subject,\n        to: user.email,\n      })\n      hasSentEmail = true\n    }\n\n    // /////////////////////////////////////\n    // afterForgotPassword - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterForgotPassword?.length) {\n      for (const hook of collectionConfig.hooks.afterForgotPassword) {\n        await hook({ args, collection: args.collection?.config, context: req.context })\n      }\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    token = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'forgotPassword',\n      overrideAccess,\n      result: token,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return token\n  } catch (error: unknown) {\n    await killTransaction(args.req)\n\n    if (!hasSentEmail && releaseRequestInterval) {\n      try {\n        await releaseRequestInterval()\n      } catch (err) {\n        args.req.payload.logger.error({ err, msg: 'Failed to release forgot-password interval' })\n      }\n    }\n\n    throw error\n  }\n}\n"],"names":["crypto","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","assertNoValidationWrite","commitTransaction","formatAdminURL","getRequestOrigin","httpStatus","initTransaction","isolateObjectProperty","killTransaction","getLoginOptions","forgotPasswordOperation","incomingArgs","req","loginWithUsername","collection","config","auth","data","overrideAccess","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","email","toLowerCase","trim","sanitizedUsername","username","args","hasSentEmail","releaseRequestInterval","disableLocalStrategy","t","BAD_REQUEST","shouldCommit","operation","collectionConfig","disableEmail","expiration","payload","minRequestInterval","forgotPassword","whereConstraint","equals","enableTrash","trash","where","now","Date","token","randomBytes","toString","resetPasswordExpiration","toISOString","user","requestedAt","reservationReq","transactionID","undefined","db","updateOne","slug","resetPasswordRequestedAt","options","atomic","and","or","exists","less_than_equal","userID","id","findOne","update","resetPasswordToken","serverURL","forgotURL","adminRoute","routes","admin","path","reset","html","generateEmailHTML","subject","generateEmailSubject","sendEmail","from","defaultFromName","defaultFromAddress","to","hooks","afterForgotPassword","length","hook","context","result","error","err","logger","msg"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAS3B,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,SAAS,QAAQ,iBAAgB;AAC1C,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AAevD,OAAO,MAAMC,0BAA0B,OACrCC;IAEAV,wBAAwBU,aAAaC,GAAG;IAExC,MAAMC,oBAAoBF,aAAaG,UAAU,CAACC,MAAM,CAACC,IAAI,CAACH,iBAAiB;IAC/E,MAAM,EAAEI,IAAI,EAAEC,cAAc,EAAE,GAAGP;IAEjC,MAAM,EAAEQ,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGX,gBAAgBI;IAEpE,MAAMQ,iBACJ,AAACF,qBAAqB,AAACR,CAAAA,aAAaM,IAAI,CAACK,KAAK,IAAI,EAAC,EAAGC,WAAW,GAAGC,IAAI,MAAO;IACjF,MAAMC,oBACJ,cAAcR,QAAQ,OAAOA,MAAMS,aAAa,WAC5CT,KAAKS,QAAQ,CAACH,WAAW,GAAGC,IAAI,KAChC;IACN,IAAIG,OAAOhB;IACX,IAAIiB,eAAe;IACnB,IAAIC,yBAAuD;IAE3D,IAAIlB,aAAaG,UAAU,CAACC,MAAM,CAACC,IAAI,CAACc,oBAAoB,EAAE;QAC5D,MAAM,IAAI/B,UAAUY,aAAaC,GAAG,CAACmB,CAAC;IACxC;IACA,IAAI,CAACV,kBAAkB,CAACI,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEe,oBAAoB,aAAa,QAAQ,CAAC,CAAC,EACtDR,WAAW2B,WAAW;IAE1B;IAEA,IAAI;QACF,MAAMC,eAAe,MAAM3B,gBAAgBqB,KAAKf,GAAG;QAEnD,wCAAwC;QACxC,+BAA+B;QAC/B,wCAAwC;QACxCe,OAAO,MAAM9B,qBAAqB;YAChC8B;YACAb,YAAYa,KAAKb,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXhB;QACF;QAEA,MAAM,EACJJ,YAAY,EAAEC,QAAQoB,gBAAgB,EAAE,EACxCC,YAAY,EACZC,UAAU,EACVzB,KAAK,EACH0B,SAAS,EAAEvB,MAAM,EAAEO,KAAK,EAAE,EAC1BgB,OAAO,EACR,EACD1B,GAAG,EACJ,GAAGe;QACJ,MAAMY,qBAAqBJ,iBAAiBnB,IAAI,CAACwB,cAAc,CAACD,kBAAkB,IAAI;QActF,IAAIE,kBAAyB,CAAC;QAE9B,IAAItB,qBAAqBE,gBAAgB;YACvCoB,kBAAkB;gBAChBnB,OAAO;oBACLoB,QAAQrB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBK,mBAAmB;YACpDgB,kBAAkB;gBAChBf,UAAU;oBACRgB,QAAQjB;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CgB,kBAAkBzC,uBAAuB;YACvC2C,aAAaR,iBAAiBS,KAAK;YACnCA,OAAO;YACPC,OAAOJ;QACT;QAEA,MAAMK,MAAMC,KAAKD,GAAG;QACpB,IAAIE,QAAgBrD,OAAOsD,WAAW,CAAC,IAAIC,QAAQ,CAAC;QACpD,MAAMC,0BAA0B,IAAIJ,KAClCD,MAAOX,CAAAA,iBAAiBnB,IAAI,EAAEwB,gBAAgBH,cAAcA,cAAc,OAAM,GAChFe,WAAW;QACb,IAAIC;QAEJ,IAAI,CAACjB,gBAAgBG,qBAAqB,GAAG;YAC3C,MAAMe,cAAc,IAAIP,KAAKD,KAAKM,WAAW;YAC7C,MAAMG,iBAAiBhD,sBAAsBK,KAAK;YAClD2C,eAAeC,aAAa,GAAGC;YAE/BJ,OAAQ,MAAMf,QAAQoB,EAAE,CAACC,SAAS,CAAC;gBACjC7C,YAAYqB,iBAAiByB,IAAI;gBACjC3C,MAAM;oBACJ4C,0BAA0BP;gBAC5B;gBACAQ,SAAS;oBAAEC,QAAQ;gBAAK;gBACxBnD,KAAK2C;gBACLV,OAAO;oBACLmB,KAAK;wBACHvB;wBACA;4BACEwB,IAAI;gCACF;oCAAEJ,0BAA0B;wCAAEK,QAAQ;oCAAM;gCAAE;gCAC9C;oCAAEL,0BAA0B;wCAAEnB,QAAQ;oCAAK;gCAAE;gCAC7C;oCACEmB,0BAA0B;wCACxBM,iBAAiB,IAAIpB,KAAKD,MAAMP,oBAAoBa,WAAW;oCACjE;gCACF;6BACD;wBACH;qBACD;gBACH;YACF;YAEA,IAAIC,MAAM;gBACR,MAAMe,SAASf,KAAKgB,EAAE;gBACtBxC,yBAAyB;oBACvB,MAAMS,QAAQoB,EAAE,CAACC,SAAS,CAAC;wBACzB7C,YAAYqB,iBAAiByB,IAAI;wBACjC3C,MAAM;4BAAE4C,0BAA0B;wBAAK;wBACvCC,SAAS;4BAAEC,QAAQ;wBAAK;wBACxBnD,KAAK2C;wBACLV,OAAO;4BACLmB,KAAK;gCACH;oCAAEK,IAAI;wCAAE3B,QAAQ0B;oCAAO;gCAAE;gCACzB;oCAAEP,0BAA0B;wCAAEnB,QAAQY;oCAAY;gCAAE;6BACrD;wBACH;oBACF;gBACF;YACF;QACF,OAAO;YACLD,OAAO,MAAMf,QAAQoB,EAAE,CAACY,OAAO,CAAU;gBACvCxD,YAAYqB,iBAAiByB,IAAI;gBACjChD;gBACAiC,OAAOJ;YACT;QACF;QAEA,sEAAsE;QACtE,+DAA+D;QAC/D,yCAAyC;QACzC,IAAI,CAACY,MAAM;YACT,IAAIpB,cAAc;gBAChB,MAAM/B,kBAAkByB,KAAKf,GAAG;YAClC;YACA,OAAO;QACT;QAEAyC,OAAO,MAAMf,QAAQiC,MAAM,CAAC;YAC1BF,IAAIhB,KAAKgB,EAAE;YACXvD,YAAYqB,iBAAiByB,IAAI;YACjC3C,MAAM;gBACJkC;gBACAqB,oBAAoBxB;YACtB;YACA9B,gBAAgB;YAChBN;QACF;QAEA,IAAI,CAACwB,gBAAgBiB,KAAK/B,KAAK,EAAE;YAC/B,MAAMmD,YAAYrE,iBAAiB;gBAAEW;gBAAQH;YAAI;YACjD,MAAM8D,YAAYvE,eAAe;gBAC/BwE,YAAY5D,OAAO6D,MAAM,CAACC,KAAK;gBAC/BC,MAAM,GAAG/D,OAAO8D,KAAK,CAACD,MAAM,CAACG,KAAK,CAAC,CAAC,EAAE/B,OAAO;gBAC7CyB;YACF;YACA,IAAIO,OAAO,GAAGpE,IAAImB,CAAC,CAAC,+CAA+C;aAC5D,EAAE2C,UAAU,EAAE,EAAEA,UAAU;IACnC,EAAE9D,IAAImB,CAAC,CAAC,4CAA4C;YAElD,IAAI,OAAOI,iBAAiBnB,IAAI,CAACwB,cAAc,EAAEyC,sBAAsB,YAAY;gBACjFD,OAAO,MAAM7C,iBAAiBnB,IAAI,CAACwB,cAAc,CAACyC,iBAAiB,CAAC;oBAClErE;oBACAoC;oBACAK;gBACF;YACF;YAEA,IAAI6B,UAAUtE,IAAImB,CAAC,CAAC;YAEpB,IAAI,OAAOI,iBAAiBnB,IAAI,CAACwB,cAAc,EAAE2C,yBAAyB,YAAY;gBACpFD,UAAU,MAAM/C,iBAAiBnB,IAAI,CAACwB,cAAc,CAAC2C,oBAAoB,CAAC;oBACxEvE;oBACAoC;oBACAK;gBACF;YACF;YAEA,MAAM/B,MAAM8D,SAAS,CAAC;gBACpBC,MAAM,CAAC,CAAC,EAAE/D,MAAMgE,eAAe,CAAC,GAAG,EAAEhE,MAAMiE,kBAAkB,CAAC,CAAC,CAAC;gBAChEP;gBACAE;gBACAM,IAAInC,KAAK/B,KAAK;YAChB;YACAM,eAAe;QACjB;QAEA,wCAAwC;QACxC,mCAAmC;QACnC,wCAAwC;QAExC,IAAIO,iBAAiBsD,KAAK,EAAEC,qBAAqBC,QAAQ;YACvD,KAAK,MAAMC,QAAQzD,iBAAiBsD,KAAK,CAACC,mBAAmB,CAAE;gBAC7D,MAAME,KAAK;oBAAEjE;oBAAMb,YAAYa,KAAKb,UAAU,EAAEC;oBAAQ8E,SAASjF,IAAIiF,OAAO;gBAAC;YAC/E;QACF;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC7C,QAAQ,MAAMpD,oBAAoB;YAChC+B;YACAb,YAAYa,KAAKb,UAAU,EAAEC;YAC7BmB,WAAW;YACXhB;YACA4E,QAAQ9C;QACV;QAEA,IAAIf,cAAc;YAChB,MAAM/B,kBAAkBU;QAC1B;QAEA,OAAOoC;IACT,EAAE,OAAO+C,OAAgB;QACvB,MAAMvF,gBAAgBmB,KAAKf,GAAG;QAE9B,IAAI,CAACgB,gBAAgBC,wBAAwB;YAC3C,IAAI;gBACF,MAAMA;YACR,EAAE,OAAOmE,KAAK;gBACZrE,KAAKf,GAAG,CAAC0B,OAAO,CAAC2D,MAAM,CAACF,KAAK,CAAC;oBAAEC;oBAAKE,KAAK;gBAA6C;YACzF;QACF;QAEA,MAAMH;IACR;AACF,EAAC"}

package/dist/auth/operations/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAIjE,eAAO,MAAM,aAAa,GAAU,MAAM;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,OAAO,CAmBlB,CAAA"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAIjE,eAAO,MAAM,aAAa,SAAgB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,OAAO,CAmBlB,CAAA"}

package/dist/auth/operations/local/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/auth/operations/local/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,eAAO,MAAM,SAAS,GAAU,SAAS,OAAO,EAAE,SAAS,QAAQ,KAAG,OAAO,CAAC,UAAU,CAQvF,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/auth/operations/local/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,eAAO,MAAM,SAAS,YAAmB,OAAO,WAAW,QAAQ,KAAG,OAAO,CAAC,UAAU,CAQvF,CAAA"}

package/dist/auth/operations/local/auth.js

@@ -1,13 +1,16 @@
-import { createLocalReq } from '../../../utilities/createLocalReq.js';
+import { createPayloadRequest } from '../../../utilities/createPayloadRequest.js';
 import { auth as authOperation } from '../auth.js';
 export const authLocal = async (payload, options)=>{
     const { headers, req } = options;
     return await authOperation({
         canSetHeaders: Boolean(options.canSetHeaders),
         headers,
-        req: await createLocalReq({
-            req
-        }, payload)
+        req: await createPayloadRequest({
+            payload,
+            req: req ?? {
+                headers
+            }
+        })
     });
 };