payload 4.0.0-internal.fa345ef → 4.0.0-internal.ff27d6e

package/dist/uploads/deleteAssociatedFiles.js

@@ -1,37 +1,173 @@
 import fs from 'fs/promises';
-import { ErrorDeletingFile } from '../errors/index.js';
+import path from 'path';
+import { APIError, ErrorDeletingFile } from '../errors/index.js';
+import { httpStatus } from '../utilities/httpStatus.js';
+import { beginDeferredCleanupScopeIfNeeded, clearDeferredCleanupScope, flushDeferredCleanupScope, scheduleAfterTransactionCommit } from '../utilities/transactionCallbacks.js';
 import { fileExists } from './fileExists.js';
-export const deleteAssociatedFiles = async ({ collectionConfig, doc, files = [], overrideDelete, req })=>{
+import { getFileIdentity, hasRenameStableFileIdentity } from './fileIdentity.js';
+import { discardQuarantinedFile, quarantineFile, restoreQuarantinedFile } from './fileQuarantine.js';
+import { withLegacyUploadFileData } from './fileVersioning/storedFiles.js';
+export const deleteAssociatedFiles = async ({ collectionConfig, config, doc, files = [], overrideDelete, req })=>{
     if (!collectionConfig.upload) {
         return;
     }
-    if (overrideDelete || files.length > 0) {
-        const { staticDir: staticPath } = collectionConfig.upload;
-        const fileToDelete = `${staticPath}/${doc.filename}`;
-        try {
-            if (await fileExists(fileToDelete)) {
-                await fs.unlink(fileToDelete);
+    const stored = withLegacyUploadFileData({
+        collection: collectionConfig,
+        config,
+        doc
+    });
+    if (collectionConfig.versions || stored.original) {
+        return;
+    }
+    const cleanupScope = await beginDeferredCleanupScopeIfNeeded({
+        req
+    });
+    const replacementFilePaths = new Set(files.map((file)=>path.resolve(file.path)));
+    try {
+        if (overrideDelete || files.length > 0) {
+            const { staticDir: staticPath } = collectionConfig.upload;
+            const fileToDelete = resolveFilePath({
+                filename: doc.filename,
+                staticPath
+            });
+            if (fileToDelete && !replacementFilePaths.has(fileToDelete)) {
+                await scheduleFileDeletion({
+                    filePath: fileToDelete,
+                    req,
+                    staticPath
+                });
             }
-        } catch (ignore) {
-            throw new ErrorDeletingFile(req.t);
-        }
-        if (doc.sizes) {
-            const sizes = Object.values(doc.sizes);
-            // Since forEach will not wait until unlink is finished it could
-            // happen that two operations will try to delete the same file.
-            // To avoid this it is recommended to use "sync" instead
-            for (const size of sizes){
-                const sizeToDelete = `${staticPath}/${size.filename}`;
-                try {
-                    if (await fileExists(sizeToDelete)) {
-                        await fs.unlink(sizeToDelete);
+            if (doc.variants) {
+                const variants = Object.values(doc.variants);
+                // Since forEach will not wait until unlink is finished it could
+                // happen that two operations will try to delete the same file.
+                // To avoid this it is recommended to use "sync" instead
+                for (const variant of variants){
+                    const variantToDelete = resolveFilePath({
+                        filename: variant.filename,
+                        staticPath
+                    });
+                    if (variantToDelete && !replacementFilePaths.has(variantToDelete)) {
+                        await scheduleFileDeletion({
+                            filePath: variantToDelete,
+                            req,
+                            staticPath
+                        });
                     }
-                } catch (ignore) {
-                    throw new ErrorDeletingFile(req.t);
                 }
             }
         }
+        if (cleanupScope) {
+            await flushDeferredCleanupScope({
+                req,
+                scope: cleanupScope
+            });
+        }
+    } catch (error) {
+        if (cleanupScope) {
+            clearDeferredCleanupScope({
+                req,
+                scope: cleanupScope
+            });
+        }
+        throw error;
+    }
+};
+const scheduleFileDeletion = async ({ filePath, req, staticPath })=>{
+    let isFileDeletionSafe;
+    try {
+        isFileDeletionSafe = await assertFileDeletionIsSafe({
+            filePath,
+            staticPath
+        });
+    } catch (ignore) {
+        throw new ErrorDeletingFile(req.t);
     }
+    if (!isFileDeletionSafe) {
+        return;
+    }
+    const fileIdentity = await getFileIdentity({
+        filePath: filePath
+    });
+    if (!fileIdentity) {
+        return;
+    }
+    await scheduleAfterTransactionCommit({
+        callback: async ()=>{
+            try {
+                await deleteFile({
+                    fileIdentity,
+                    filePath,
+                    staticPath
+                });
+            } catch (ignore) {
+                throw new ErrorDeletingFile(req.t);
+            }
+        },
+        req
+    });
+};
+const resolveFilePath = ({ filename, staticPath })=>{
+    if (!filename || !staticPath) {
+        return;
+    }
+    const resolvedDir = path.resolve(staticPath);
+    const filePath = path.resolve(resolvedDir, filename);
+    if (!isWithinDirectory({
+        directory: resolvedDir,
+        target: filePath
+    })) {
+        throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST);
+    }
+    return filePath;
+};
+const deleteFile = async ({ fileIdentity, filePath, staticPath })=>{
+    if (!await assertFileDeletionIsSafe({
+        filePath,
+        staticPath
+    })) {
+        return;
+    }
+    const quarantinedFile = await quarantineFile({
+        filePath: filePath
+    });
+    if (!quarantinedFile) {
+        return;
+    }
+    if (!hasRenameStableFileIdentity({
+        actual: quarantinedFile.fileIdentity,
+        expected: fileIdentity
+    })) {
+        await restoreQuarantinedFile({
+            quarantinedFile,
+            targetFilePath: filePath
+        });
+        return;
+    }
+    await discardQuarantinedFile({
+        quarantinedFile
+    });
+};
+const assertFileDeletionIsSafe = async ({ filePath, staticPath })=>{
+    if (!filePath || !staticPath || !await fileExists(filePath)) {
+        return false;
+    }
+    const [resolvedDir, resolvedParent] = await Promise.all([
+        fs.realpath(staticPath),
+        fs.realpath(path.dirname(filePath))
+    ]);
+    const resolvedTarget = path.join(resolvedParent, path.basename(filePath));
+    if (!isWithinDirectory({
+        directory: resolvedDir,
+        target: resolvedTarget
+    })) {
+        throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST);
+    }
+    return true;
+};
+const isWithinDirectory = ({ directory, target })=>{
+    const relativePath = path.relative(directory, target);
+    return relativePath === '' || relativePath !== '..' && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath);
 };
 
 //# sourceMappingURL=deleteAssociatedFiles.js.map

package/dist/uploads/deleteAssociatedFiles.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.ts"],"sourcesContent":["import fs from 'fs/promises'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { FileData, FileToSave } from './types.js'\n\nimport { ErrorDeletingFile } from '../errors/index.js'\nimport { fileExists } from './fileExists.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  doc: Record<string, unknown>\n  files?: FileToSave[]\n  overrideDelete: boolean\n  req: PayloadRequest\n}\n\nexport const deleteAssociatedFiles: (args: Args) => Promise<void> = async ({\n  collectionConfig,\n  doc,\n  files = [],\n  overrideDelete,\n  req,\n}) => {\n  if (!collectionConfig.upload) {\n    return\n  }\n  if (overrideDelete || files.length > 0) {\n    const { staticDir: staticPath } = collectionConfig.upload\n\n    const fileToDelete = `${staticPath}/${doc.filename as string}`\n\n    try {\n      if (await fileExists(fileToDelete)) {\n        await fs.unlink(fileToDelete)\n      }\n    } catch (ignore) {\n      throw new ErrorDeletingFile(req.t)\n    }\n\n    if (doc.sizes) {\n      const sizes: FileData[] = Object.values(doc.sizes)\n      // Since forEach will not wait until unlink is finished it could\n      // happen that two operations will try to delete the same file.\n      // To avoid this it is recommended to use \"sync\" instead\n\n      for (const size of sizes) {\n        const sizeToDelete = `${staticPath}/${size.filename}`\n        try {\n          if (await fileExists(sizeToDelete)) {\n            await fs.unlink(sizeToDelete)\n          }\n        } catch (ignore) {\n          throw new ErrorDeletingFile(req.t)\n        }\n      }\n    }\n  }\n}\n"],"names":["fs","ErrorDeletingFile","fileExists","deleteAssociatedFiles","collectionConfig","doc","files","overrideDelete","req","upload","length","staticDir","staticPath","fileToDelete","filename","unlink","ignore","t","sizes","Object","values","size","sizeToDelete"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAO5B,SAASC,iBAAiB,QAAQ,qBAAoB;AACtD,SAASC,UAAU,QAAQ,kBAAiB;AAW5C,OAAO,MAAMC,wBAAuD,OAAO,EACzEC,gBAAgB,EAChBC,GAAG,EACHC,QAAQ,EAAE,EACVC,cAAc,EACdC,GAAG,EACJ;IACC,IAAI,CAACJ,iBAAiBK,MAAM,EAAE;QAC5B;IACF;IACA,IAAIF,kBAAkBD,MAAMI,MAAM,GAAG,GAAG;QACtC,MAAM,EAAEC,WAAWC,UAAU,EAAE,GAAGR,iBAAiBK,MAAM;QAEzD,MAAMI,eAAe,GAAGD,WAAW,CAAC,EAAEP,IAAIS,QAAQ,EAAY;QAE9D,IAAI;YACF,IAAI,MAAMZ,WAAWW,eAAe;gBAClC,MAAMb,GAAGe,MAAM,CAACF;YAClB;QACF,EAAE,OAAOG,QAAQ;YACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;QACnC;QAEA,IAAIZ,IAAIa,KAAK,EAAE;YACb,MAAMA,QAAoBC,OAAOC,MAAM,CAACf,IAAIa,KAAK;YACjD,gEAAgE;YAChE,+DAA+D;YAC/D,wDAAwD;YAExD,KAAK,MAAMG,QAAQH,MAAO;gBACxB,MAAMI,eAAe,GAAGV,WAAW,CAAC,EAAES,KAAKP,QAAQ,EAAE;gBACrD,IAAI;oBACF,IAAI,MAAMZ,WAAWoB,eAAe;wBAClC,MAAMtB,GAAGe,MAAM,CAACO;oBAClB;gBACF,EAAE,OAAON,QAAQ;oBACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;gBACnC;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport path from 'path'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { FileIdentity } from './fileIdentity.js'\nimport type { FileData, FileToSave } from './types.js'\n\nimport { APIError, ErrorDeletingFile } from '../errors/index.js'\nimport { httpStatus } from '../utilities/httpStatus.js'\nimport {\n  beginDeferredCleanupScopeIfNeeded,\n  clearDeferredCleanupScope,\n  flushDeferredCleanupScope,\n  scheduleAfterTransactionCommit,\n} from '../utilities/transactionCallbacks.js'\nimport { fileExists } from './fileExists.js'\nimport { getFileIdentity, hasRenameStableFileIdentity } from './fileIdentity.js'\nimport { discardQuarantinedFile, quarantineFile, restoreQuarantinedFile } from './fileQuarantine.js'\nimport { withLegacyUploadFileData } from './fileVersioning/storedFiles.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  doc: Record<string, unknown>\n  files?: FileToSave[]\n  overrideDelete: boolean\n  req: PayloadRequest\n}\n\nexport const deleteAssociatedFiles: (args: Args) => Promise<void> = async ({\n  collectionConfig,\n  config,\n  doc,\n  files = [],\n  overrideDelete,\n  req,\n}) => {\n  if (!collectionConfig.upload) {\n    return\n  }\n  const stored = withLegacyUploadFileData({ collection: collectionConfig, config, doc })\n\n  if (collectionConfig.versions || stored.original) {\n    return\n  }\n\n  const cleanupScope = await beginDeferredCleanupScopeIfNeeded({ req })\n  const replacementFilePaths = new Set(files.map((file) => path.resolve(file.path)))\n\n  try {\n    if (overrideDelete || files.length > 0) {\n      const { staticDir: staticPath } = collectionConfig.upload\n\n      const fileToDelete = resolveFilePath({\n        filename: doc.filename as string,\n        staticPath,\n      })\n\n      if (fileToDelete && !replacementFilePaths.has(fileToDelete)) {\n        await scheduleFileDeletion({ filePath: fileToDelete, req, staticPath })\n      }\n\n      if (doc.variants) {\n        const variants: FileData[] = Object.values(doc.variants)\n        // Since forEach will not wait until unlink is finished it could\n        // happen that two operations will try to delete the same file.\n        // To avoid this it is recommended to use \"sync\" instead\n\n        for (const variant of variants) {\n          const variantToDelete = resolveFilePath({ filename: variant.filename, staticPath })\n          if (variantToDelete && !replacementFilePaths.has(variantToDelete)) {\n            await scheduleFileDeletion({ filePath: variantToDelete, req, staticPath })\n          }\n        }\n      }\n    }\n\n    if (cleanupScope) {\n      await flushDeferredCleanupScope({ req, scope: cleanupScope })\n    }\n  } catch (error) {\n    if (cleanupScope) {\n      clearDeferredCleanupScope({ req, scope: cleanupScope })\n    }\n\n    throw error\n  }\n}\n\nconst scheduleFileDeletion = async ({\n  filePath,\n  req,\n  staticPath,\n}: {\n  filePath?: string\n  req: PayloadRequest\n  staticPath?: string\n}): Promise<void> => {\n  let isFileDeletionSafe: boolean\n\n  try {\n    isFileDeletionSafe = await assertFileDeletionIsSafe({ filePath, staticPath })\n  } catch (ignore) {\n    throw new ErrorDeletingFile(req.t)\n  }\n\n  if (!isFileDeletionSafe) {\n    return\n  }\n\n  const fileIdentity = await getFileIdentity({ filePath: filePath! })\n\n  if (!fileIdentity) {\n    return\n  }\n\n  await scheduleAfterTransactionCommit({\n    callback: async () => {\n      try {\n        await deleteFile({ fileIdentity, filePath, staticPath })\n      } catch (ignore) {\n        throw new ErrorDeletingFile(req.t)\n      }\n    },\n    req,\n  })\n}\n\nconst resolveFilePath = ({\n  filename,\n  staticPath,\n}: {\n  filename?: null | string\n  staticPath?: string\n}) => {\n  if (!filename || !staticPath) {\n    return\n  }\n\n  const resolvedDir = path.resolve(staticPath)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!isWithinDirectory({ directory: resolvedDir, target: filePath })) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  return filePath\n}\n\nconst deleteFile = async ({\n  fileIdentity,\n  filePath,\n  staticPath,\n}: {\n  fileIdentity: FileIdentity\n  filePath?: string\n  staticPath?: string\n}) => {\n  if (!(await assertFileDeletionIsSafe({ filePath, staticPath }))) {\n    return\n  }\n\n  const quarantinedFile = await quarantineFile({ filePath: filePath! })\n\n  if (!quarantinedFile) {\n    return\n  }\n\n  if (\n    !hasRenameStableFileIdentity({ actual: quarantinedFile.fileIdentity, expected: fileIdentity })\n  ) {\n    await restoreQuarantinedFile({ quarantinedFile, targetFilePath: filePath! })\n    return\n  }\n\n  await discardQuarantinedFile({ quarantinedFile })\n}\n\nconst assertFileDeletionIsSafe = async ({\n  filePath,\n  staticPath,\n}: {\n  filePath?: string\n  staticPath?: string\n}): Promise<boolean> => {\n  if (!filePath || !staticPath || !(await fileExists(filePath))) {\n    return false\n  }\n\n  const [resolvedDir, resolvedParent] = await Promise.all([\n    fs.realpath(staticPath),\n    fs.realpath(path.dirname(filePath)),\n  ])\n  const resolvedTarget = path.join(resolvedParent, path.basename(filePath))\n\n  if (!isWithinDirectory({ directory: resolvedDir, target: resolvedTarget })) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  return true\n}\n\nconst isWithinDirectory = ({ directory, target }: { directory: string; target: string }) => {\n  const relativePath = path.relative(directory, target)\n\n  return (\n    relativePath === '' ||\n    (relativePath !== '..' &&\n      !relativePath.startsWith(`..${path.sep}`) &&\n      !path.isAbsolute(relativePath))\n  )\n}\n"],"names":["fs","path","APIError","ErrorDeletingFile","httpStatus","beginDeferredCleanupScopeIfNeeded","clearDeferredCleanupScope","flushDeferredCleanupScope","scheduleAfterTransactionCommit","fileExists","getFileIdentity","hasRenameStableFileIdentity","discardQuarantinedFile","quarantineFile","restoreQuarantinedFile","withLegacyUploadFileData","deleteAssociatedFiles","collectionConfig","config","doc","files","overrideDelete","req","upload","stored","collection","versions","original","cleanupScope","replacementFilePaths","Set","map","file","resolve","length","staticDir","staticPath","fileToDelete","resolveFilePath","filename","has","scheduleFileDeletion","filePath","variants","Object","values","variant","variantToDelete","scope","error","isFileDeletionSafe","assertFileDeletionIsSafe","ignore","t","fileIdentity","callback","deleteFile","resolvedDir","isWithinDirectory","directory","target","BAD_REQUEST","quarantinedFile","actual","expected","targetFilePath","resolvedParent","Promise","all","realpath","dirname","resolvedTarget","join","basename","relativePath","relative","startsWith","sep","isAbsolute"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,UAAU,OAAM;AAQvB,SAASC,QAAQ,EAAEC,iBAAiB,QAAQ,qBAAoB;AAChE,SAASC,UAAU,QAAQ,6BAA4B;AACvD,SACEC,iCAAiC,EACjCC,yBAAyB,EACzBC,yBAAyB,EACzBC,8BAA8B,QACzB,uCAAsC;AAC7C,SAASC,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,eAAe,EAAEC,2BAA2B,QAAQ,oBAAmB;AAChF,SAASC,sBAAsB,EAAEC,cAAc,EAAEC,sBAAsB,QAAQ,sBAAqB;AACpG,SAASC,wBAAwB,QAAQ,kCAAiC;AAW1E,OAAO,MAAMC,wBAAuD,OAAO,EACzEC,gBAAgB,EAChBC,MAAM,EACNC,GAAG,EACHC,QAAQ,EAAE,EACVC,cAAc,EACdC,GAAG,EACJ;IACC,IAAI,CAACL,iBAAiBM,MAAM,EAAE;QAC5B;IACF;IACA,MAAMC,SAAST,yBAAyB;QAAEU,YAAYR;QAAkBC;QAAQC;IAAI;IAEpF,IAAIF,iBAAiBS,QAAQ,IAAIF,OAAOG,QAAQ,EAAE;QAChD;IACF;IAEA,MAAMC,eAAe,MAAMvB,kCAAkC;QAAEiB;IAAI;IACnE,MAAMO,uBAAuB,IAAIC,IAAIV,MAAMW,GAAG,CAAC,CAACC,OAAS/B,KAAKgC,OAAO,CAACD,KAAK/B,IAAI;IAE/E,IAAI;QACF,IAAIoB,kBAAkBD,MAAMc,MAAM,GAAG,GAAG;YACtC,MAAM,EAAEC,WAAWC,UAAU,EAAE,GAAGnB,iBAAiBM,MAAM;YAEzD,MAAMc,eAAeC,gBAAgB;gBACnCC,UAAUpB,IAAIoB,QAAQ;gBACtBH;YACF;YAEA,IAAIC,gBAAgB,CAACR,qBAAqBW,GAAG,CAACH,eAAe;gBAC3D,MAAMI,qBAAqB;oBAAEC,UAAUL;oBAAcf;oBAAKc;gBAAW;YACvE;YAEA,IAAIjB,IAAIwB,QAAQ,EAAE;gBAChB,MAAMA,WAAuBC,OAAOC,MAAM,CAAC1B,IAAIwB,QAAQ;gBACvD,gEAAgE;gBAChE,+DAA+D;gBAC/D,wDAAwD;gBAExD,KAAK,MAAMG,WAAWH,SAAU;oBAC9B,MAAMI,kBAAkBT,gBAAgB;wBAAEC,UAAUO,QAAQP,QAAQ;wBAAEH;oBAAW;oBACjF,IAAIW,mBAAmB,CAAClB,qBAAqBW,GAAG,CAACO,kBAAkB;wBACjE,MAAMN,qBAAqB;4BAAEC,UAAUK;4BAAiBzB;4BAAKc;wBAAW;oBAC1E;gBACF;YACF;QACF;QAEA,IAAIR,cAAc;YAChB,MAAMrB,0BAA0B;gBAAEe;gBAAK0B,OAAOpB;YAAa;QAC7D;IACF,EAAE,OAAOqB,OAAO;QACd,IAAIrB,cAAc;YAChBtB,0BAA0B;gBAAEgB;gBAAK0B,OAAOpB;YAAa;QACvD;QAEA,MAAMqB;IACR;AACF,EAAC;AAED,MAAMR,uBAAuB,OAAO,EAClCC,QAAQ,EACRpB,GAAG,EACHc,UAAU,EAKX;IACC,IAAIc;IAEJ,IAAI;QACFA,qBAAqB,MAAMC,yBAAyB;YAAET;YAAUN;QAAW;IAC7E,EAAE,OAAOgB,QAAQ;QACf,MAAM,IAAIjD,kBAAkBmB,IAAI+B,CAAC;IACnC;IAEA,IAAI,CAACH,oBAAoB;QACvB;IACF;IAEA,MAAMI,eAAe,MAAM5C,gBAAgB;QAAEgC,UAAUA;IAAU;IAEjE,IAAI,CAACY,cAAc;QACjB;IACF;IAEA,MAAM9C,+BAA+B;QACnC+C,UAAU;YACR,IAAI;gBACF,MAAMC,WAAW;oBAAEF;oBAAcZ;oBAAUN;gBAAW;YACxD,EAAE,OAAOgB,QAAQ;gBACf,MAAM,IAAIjD,kBAAkBmB,IAAI+B,CAAC;YACnC;QACF;QACA/B;IACF;AACF;AAEA,MAAMgB,kBAAkB,CAAC,EACvBC,QAAQ,EACRH,UAAU,EAIX;IACC,IAAI,CAACG,YAAY,CAACH,YAAY;QAC5B;IACF;IAEA,MAAMqB,cAAcxD,KAAKgC,OAAO,CAACG;IACjC,MAAMM,WAAWzC,KAAKgC,OAAO,CAACwB,aAAalB;IAE3C,IAAI,CAACmB,kBAAkB;QAAEC,WAAWF;QAAaG,QAAQlB;IAAS,IAAI;QACpE,MAAM,IAAIxC,SAAS,qBAAqBE,WAAWyD,WAAW;IAChE;IAEA,OAAOnB;AACT;AAEA,MAAMc,aAAa,OAAO,EACxBF,YAAY,EACZZ,QAAQ,EACRN,UAAU,EAKX;IACC,IAAI,CAAE,MAAMe,yBAAyB;QAAET;QAAUN;IAAW,IAAK;QAC/D;IACF;IAEA,MAAM0B,kBAAkB,MAAMjD,eAAe;QAAE6B,UAAUA;IAAU;IAEnE,IAAI,CAACoB,iBAAiB;QACpB;IACF;IAEA,IACE,CAACnD,4BAA4B;QAAEoD,QAAQD,gBAAgBR,YAAY;QAAEU,UAAUV;IAAa,IAC5F;QACA,MAAMxC,uBAAuB;YAAEgD;YAAiBG,gBAAgBvB;QAAU;QAC1E;IACF;IAEA,MAAM9B,uBAAuB;QAAEkD;IAAgB;AACjD;AAEA,MAAMX,2BAA2B,OAAO,EACtCT,QAAQ,EACRN,UAAU,EAIX;IACC,IAAI,CAACM,YAAY,CAACN,cAAc,CAAE,MAAM3B,WAAWiC,WAAY;QAC7D,OAAO;IACT;IAEA,MAAM,CAACe,aAAaS,eAAe,GAAG,MAAMC,QAAQC,GAAG,CAAC;QACtDpE,GAAGqE,QAAQ,CAACjC;QACZpC,GAAGqE,QAAQ,CAACpE,KAAKqE,OAAO,CAAC5B;KAC1B;IACD,MAAM6B,iBAAiBtE,KAAKuE,IAAI,CAACN,gBAAgBjE,KAAKwE,QAAQ,CAAC/B;IAE/D,IAAI,CAACgB,kBAAkB;QAAEC,WAAWF;QAAaG,QAAQW;IAAe,IAAI;QAC1E,MAAM,IAAIrE,SAAS,qBAAqBE,WAAWyD,WAAW;IAChE;IAEA,OAAO;AACT;AAEA,MAAMH,oBAAoB,CAAC,EAAEC,SAAS,EAAEC,MAAM,EAAyC;IACrF,MAAMc,eAAezE,KAAK0E,QAAQ,CAAChB,WAAWC;IAE9C,OACEc,iBAAiB,MAChBA,iBAAiB,QAChB,CAACA,aAAaE,UAAU,CAAC,CAAC,EAAE,EAAE3E,KAAK4E,GAAG,EAAE,KACxC,CAAC5E,KAAK6E,UAAU,CAACJ;AAEvB"}

package/dist/uploads/deleteUploadFilesExclusiveToDocument.d.ts

@@ -0,0 +1,15 @@
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { SanitizedConfig } from '../config/types.js';
+import type { PayloadRequest } from '../types/index.js';
+type Args = {
+    collectionConfig: SanitizedCollectionConfig;
+    config: SanitizedConfig;
+    deleteFromAdapter?: boolean;
+    req: PayloadRequest;
+    retainedDoc?: null | Record<string, unknown>;
+    sourceDoc: Record<string, unknown>;
+};
+/** Deletes upload files referenced by `sourceDoc` only when `retainedDoc` does not use them. */
+export declare const deleteUploadFilesExclusiveToDocument: ({ collectionConfig, config, deleteFromAdapter, req, retainedDoc, sourceDoc, }: Args) => Promise<void>;
+export {};
+//# sourceMappingURL=deleteUploadFilesExclusiveToDocument.d.ts.map

package/dist/uploads/deleteUploadFilesExclusiveToDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteUploadFilesExclusiveToDocument.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteUploadFilesExclusiveToDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,GAAG,EAAE,cAAc,CAAA;IACnB,WAAW,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA;AAED,gGAAgG;AAChG,eAAO,MAAM,oCAAoC,kFAO9C,IAAI,KAAG,OAAO,CAAC,IAAI,CAqBrB,CAAA"}

package/dist/uploads/deleteUploadFilesExclusiveToDocument.js

@@ -0,0 +1,62 @@
+import { deleteAssociatedFiles } from './deleteAssociatedFiles.js';
+/** Deletes upload files referenced by `sourceDoc` only when `retainedDoc` does not use them. */ export const deleteUploadFilesExclusiveToDocument = async ({ collectionConfig, config, deleteFromAdapter = true, req, retainedDoc, sourceDoc })=>{
+    if (!collectionConfig.upload) {
+        return;
+    }
+    const retainedFilenames = getUploadFilenames(retainedDoc);
+    const doc = filterDocumentFiles({
+        retainedFilenames,
+        sourceDoc
+    });
+    if (getUploadFilenames(doc).size > 0) {
+        await deleteAssociatedFiles({
+            collectionConfig,
+            config,
+            doc,
+            overrideDelete: true,
+            req
+        });
+    }
+    if (deleteFromAdapter) {
+        await collectionConfig.upload.deleteFiles?.({
+            req,
+            retainedDoc,
+            sourceDoc
+        });
+    }
+};
+const filterDocumentFiles = ({ retainedFilenames, sourceDoc })=>{
+    const sourceFilename = typeof sourceDoc.filename === 'string' && !retainedFilenames.has(sourceDoc.filename) ? sourceDoc.filename : undefined;
+    const sourceVariants = isRecord(sourceDoc.variants) ? sourceDoc.variants : {};
+    const variants = Object.fromEntries(Object.entries(sourceVariants).filter(([, variant])=>{
+        if (!isRecord(variant) || typeof variant.filename !== 'string') {
+            return false;
+        }
+        return !retainedFilenames.has(variant.filename);
+    }));
+    return {
+        ...sourceDoc,
+        filename: sourceFilename,
+        variants
+    };
+};
+const getUploadFilenames = (doc)=>{
+    const filenames = new Set();
+    if (!doc) {
+        return filenames;
+    }
+    if (typeof doc.filename === 'string') {
+        filenames.add(doc.filename);
+    }
+    if (isRecord(doc.variants)) {
+        for (const variant of Object.values(doc.variants)){
+            if (isRecord(variant) && typeof variant.filename === 'string') {
+                filenames.add(variant.filename);
+            }
+        }
+    }
+    return filenames;
+};
+const isRecord = (value)=>Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+//# sourceMappingURL=deleteUploadFilesExclusiveToDocument.js.map

package/dist/uploads/deleteUploadFilesExclusiveToDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/deleteUploadFilesExclusiveToDocument.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { deleteAssociatedFiles } from './deleteAssociatedFiles.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  deleteFromAdapter?: boolean\n  req: PayloadRequest\n  retainedDoc?: null | Record<string, unknown>\n  sourceDoc: Record<string, unknown>\n}\n\n/** Deletes upload files referenced by `sourceDoc` only when `retainedDoc` does not use them. */\nexport const deleteUploadFilesExclusiveToDocument = async ({\n  collectionConfig,\n  config,\n  deleteFromAdapter = true,\n  req,\n  retainedDoc,\n  sourceDoc,\n}: Args): Promise<void> => {\n  if (!collectionConfig.upload) {\n    return\n  }\n\n  const retainedFilenames = getUploadFilenames(retainedDoc)\n  const doc = filterDocumentFiles({ retainedFilenames, sourceDoc })\n\n  if (getUploadFilenames(doc).size > 0) {\n    await deleteAssociatedFiles({\n      collectionConfig,\n      config,\n      doc,\n      overrideDelete: true,\n      req,\n    })\n  }\n\n  if (deleteFromAdapter) {\n    await collectionConfig.upload.deleteFiles?.({ req, retainedDoc, sourceDoc })\n  }\n}\n\nconst filterDocumentFiles = ({\n  retainedFilenames,\n  sourceDoc,\n}: {\n  retainedFilenames: Set<string>\n  sourceDoc: Record<string, unknown>\n}): Record<string, unknown> => {\n  const sourceFilename =\n    typeof sourceDoc.filename === 'string' && !retainedFilenames.has(sourceDoc.filename)\n      ? sourceDoc.filename\n      : undefined\n  const sourceVariants = isRecord(sourceDoc.variants) ? sourceDoc.variants : {}\n  const variants = Object.fromEntries(\n    Object.entries(sourceVariants).filter(([, variant]) => {\n      if (!isRecord(variant) || typeof variant.filename !== 'string') {\n        return false\n      }\n\n      return !retainedFilenames.has(variant.filename)\n    }),\n  )\n\n  return {\n    ...sourceDoc,\n    filename: sourceFilename,\n    variants,\n  }\n}\n\nconst getUploadFilenames = (doc?: null | Record<string, unknown>): Set<string> => {\n  const filenames = new Set<string>()\n\n  if (!doc) {\n    return filenames\n  }\n\n  if (typeof doc.filename === 'string') {\n    filenames.add(doc.filename)\n  }\n\n  if (isRecord(doc.variants)) {\n    for (const variant of Object.values(doc.variants)) {\n      if (isRecord(variant) && typeof variant.filename === 'string') {\n        filenames.add(variant.filename)\n      }\n    }\n  }\n\n  return filenames\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  Boolean(value) && typeof value === 'object' && !Array.isArray(value)\n"],"names":["deleteAssociatedFiles","deleteUploadFilesExclusiveToDocument","collectionConfig","config","deleteFromAdapter","req","retainedDoc","sourceDoc","upload","retainedFilenames","getUploadFilenames","doc","filterDocumentFiles","size","overrideDelete","deleteFiles","sourceFilename","filename","has","undefined","sourceVariants","isRecord","variants","Object","fromEntries","entries","filter","variant","filenames","Set","add","values","value","Boolean","Array","isArray"],"mappings":"AAIA,SAASA,qBAAqB,QAAQ,6BAA4B;AAWlE,8FAA8F,GAC9F,OAAO,MAAMC,uCAAuC,OAAO,EACzDC,gBAAgB,EAChBC,MAAM,EACNC,oBAAoB,IAAI,EACxBC,GAAG,EACHC,WAAW,EACXC,SAAS,EACJ;IACL,IAAI,CAACL,iBAAiBM,MAAM,EAAE;QAC5B;IACF;IAEA,MAAMC,oBAAoBC,mBAAmBJ;IAC7C,MAAMK,MAAMC,oBAAoB;QAAEH;QAAmBF;IAAU;IAE/D,IAAIG,mBAAmBC,KAAKE,IAAI,GAAG,GAAG;QACpC,MAAMb,sBAAsB;YAC1BE;YACAC;YACAQ;YACAG,gBAAgB;YAChBT;QACF;IACF;IAEA,IAAID,mBAAmB;QACrB,MAAMF,iBAAiBM,MAAM,CAACO,WAAW,GAAG;YAAEV;YAAKC;YAAaC;QAAU;IAC5E;AACF,EAAC;AAED,MAAMK,sBAAsB,CAAC,EAC3BH,iBAAiB,EACjBF,SAAS,EAIV;IACC,MAAMS,iBACJ,OAAOT,UAAUU,QAAQ,KAAK,YAAY,CAACR,kBAAkBS,GAAG,CAACX,UAAUU,QAAQ,IAC/EV,UAAUU,QAAQ,GAClBE;IACN,MAAMC,iBAAiBC,SAASd,UAAUe,QAAQ,IAAIf,UAAUe,QAAQ,GAAG,CAAC;IAC5E,MAAMA,WAAWC,OAAOC,WAAW,CACjCD,OAAOE,OAAO,CAACL,gBAAgBM,MAAM,CAAC,CAAC,GAAGC,QAAQ;QAChD,IAAI,CAACN,SAASM,YAAY,OAAOA,QAAQV,QAAQ,KAAK,UAAU;YAC9D,OAAO;QACT;QAEA,OAAO,CAACR,kBAAkBS,GAAG,CAACS,QAAQV,QAAQ;IAChD;IAGF,OAAO;QACL,GAAGV,SAAS;QACZU,UAAUD;QACVM;IACF;AACF;AAEA,MAAMZ,qBAAqB,CAACC;IAC1B,MAAMiB,YAAY,IAAIC;IAEtB,IAAI,CAAClB,KAAK;QACR,OAAOiB;IACT;IAEA,IAAI,OAAOjB,IAAIM,QAAQ,KAAK,UAAU;QACpCW,UAAUE,GAAG,CAACnB,IAAIM,QAAQ;IAC5B;IAEA,IAAII,SAASV,IAAIW,QAAQ,GAAG;QAC1B,KAAK,MAAMK,WAAWJ,OAAOQ,MAAM,CAACpB,IAAIW,QAAQ,EAAG;YACjD,IAAID,SAASM,YAAY,OAAOA,QAAQV,QAAQ,KAAK,UAAU;gBAC7DW,UAAUE,GAAG,CAACH,QAAQV,QAAQ;YAChC;QACF;IACF;IAEA,OAAOW;AACT;AAEA,MAAMP,WAAW,CAACW,QAChBC,QAAQD,UAAU,OAAOA,UAAU,YAAY,CAACE,MAAMC,OAAO,CAACH"}

package/dist/uploads/detectSvgFromXml.d.ts

@@ -1,5 +1,2 @@
-/**
- * Securely detect if an XML buffer contains a valid SVG document
- */
-export declare function detectSvgFromXml(buffer: Buffer): boolean;
+export declare const detectSvgFromXml: (buffer: Buffer) => boolean;
 //# sourceMappingURL=detectSvgFromXml.d.ts.map

package/dist/uploads/detectSvgFromXml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detectSvgFromXml.d.ts","sourceRoot":"","sources":["../../src/uploads/detectSvgFromXml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA6CxD"}
+{"version":3,"file":"detectSvgFromXml.d.ts","sourceRoot":"","sources":["../../src/uploads/detectSvgFromXml.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gBAAgB,WAAY,MAAM,KAAG,OAAmC,CAAA"}

package/dist/uploads/detectSvgFromXml.js

@@ -1,43 +1,4 @@
-/**
- * Securely detect if an XML buffer contains a valid SVG document
- */ export function detectSvgFromXml(buffer) {
-    try {
-        // Limit buffer size to prevent processing large malicious files
-        const maxSize = 2048;
-        const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize));
-        // Check for XML declaration and extract encoding if present
-        const xmlDeclMatch = content.match(/^<\?xml[^>]*encoding=["']([^"']+)["']/i);
-        const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase();
-        // Only support safe encodings
-        if (declaredEncoding && ![
-            'ascii',
-            'utf-8',
-            'utf8'
-        ].includes(declaredEncoding)) {
-            return false;
-        }
-        // Remove XML declarations, comments, and processing instructions
-        const cleanContent = content.replace(/<\?xml[^>]*\?>/gi, '').replace(/<!--[\s\S]*?-->/g, '').replace(/<\?[^>]*\?>/g, '').trim();
-        // Find the first actual element (root element)
-        const rootElementMatch = cleanContent.match(/^<(\w+)(?:\s|>)/);
-        if (!rootElementMatch || rootElementMatch[1] !== 'svg') {
-            return false;
-        }
-        // Validate SVG namespace - must be present for valid SVG
-        const svgNamespaceRegex = /xmlns=["']http:\/\/www\.w3\.org\/2000\/svg["']/;
-        if (!svgNamespaceRegex.test(content)) {
-            return false;
-        }
-        // Additional validation: ensure it's not malformed
-        const svgOpenTag = content.match(/<svg[\s>]/);
-        if (!svgOpenTag) {
-            return false;
-        }
-        return true;
-    } catch (_error) {
-        // If any error occurs during parsing, treat as not SVG
-        return false;
-    }
-}
+import { inspectSvg } from './validateSvg.js';
+export const detectSvgFromXml = (buffer)=>inspectSvg(buffer).isSvg;
 
 //# sourceMappingURL=detectSvgFromXml.js.map

package/dist/uploads/detectSvgFromXml.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["/**\n * Securely detect if an XML buffer contains a valid SVG document\n */\nexport function detectSvgFromXml(buffer: Buffer): boolean {\n  try {\n    // Limit buffer size to prevent processing large malicious files\n    const maxSize = 2048\n    const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize))\n\n    // Check for XML declaration and extract encoding if present\n    const xmlDeclMatch = content.match(/^<\\?xml[^>]*encoding=[\"']([^\"']+)[\"']/i)\n    const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase()\n\n    // Only support safe encodings\n    if (declaredEncoding && !['ascii', 'utf-8', 'utf8'].includes(declaredEncoding)) {\n      return false\n    }\n\n    // Remove XML declarations, comments, and processing instructions\n    const cleanContent = content\n      .replace(/<\\?xml[^>]*\\?>/gi, '')\n      .replace(/<!--[\\s\\S]*?-->/g, '')\n      .replace(/<\\?[^>]*\\?>/g, '')\n      .trim()\n\n    // Find the first actual element (root element)\n    const rootElementMatch = cleanContent.match(/^<(\\w+)(?:\\s|>)/)\n    if (!rootElementMatch || rootElementMatch[1] !== 'svg') {\n      return false\n    }\n\n    // Validate SVG namespace - must be present for valid SVG\n    const svgNamespaceRegex = /xmlns=[\"']http:\\/\\/www\\.w3\\.org\\/2000\\/svg[\"']/\n    if (!svgNamespaceRegex.test(content)) {\n      return false\n    }\n\n    // Additional validation: ensure it's not malformed\n    const svgOpenTag = content.match(/<svg[\\s>]/)\n    if (!svgOpenTag) {\n      return false\n    }\n\n    return true\n  } catch (_error) {\n    // If any error occurs during parsing, treat as not SVG\n    return false\n  }\n}\n"],"names":["detectSvgFromXml","buffer","maxSize","content","toString","Math","min","length","xmlDeclMatch","match","declaredEncoding","toLowerCase","includes","cleanContent","replace","trim","rootElementMatch","svgNamespaceRegex","test","svgOpenTag","_error"],"mappings":"AAAA;;CAEC,GACD,OAAO,SAASA,iBAAiBC,MAAc;IAC7C,IAAI;QACF,gEAAgE;QAChE,MAAMC,UAAU;QAChB,MAAMC,UAAUF,OAAOG,QAAQ,CAAC,QAAQ,GAAGC,KAAKC,GAAG,CAACL,OAAOM,MAAM,EAAEL;QAEnE,4DAA4D;QAC5D,MAAMM,eAAeL,QAAQM,KAAK,CAAC;QACnC,MAAMC,mBAAmBF,cAAc,CAAC,EAAE,EAAEG;QAE5C,8BAA8B;QAC9B,IAAID,oBAAoB,CAAC;YAAC;YAAS;YAAS;SAAO,CAACE,QAAQ,CAACF,mBAAmB;YAC9E,OAAO;QACT;QAEA,iEAAiE;QACjE,MAAMG,eAAeV,QAClBW,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,gBAAgB,IACxBC,IAAI;QAEP,+CAA+C;QAC/C,MAAMC,mBAAmBH,aAAaJ,KAAK,CAAC;QAC5C,IAAI,CAACO,oBAAoBA,gBAAgB,CAAC,EAAE,KAAK,OAAO;YACtD,OAAO;QACT;QAEA,yDAAyD;QACzD,MAAMC,oBAAoB;QAC1B,IAAI,CAACA,kBAAkBC,IAAI,CAACf,UAAU;YACpC,OAAO;QACT;QAEA,mDAAmD;QACnD,MAAMgB,aAAahB,QAAQM,KAAK,CAAC;QACjC,IAAI,CAACU,YAAY;YACf,OAAO;QACT;QAEA,OAAO;IACT,EAAE,OAAOC,QAAQ;QACf,uDAAuD;QACvD,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["import { inspectSvg } from './validateSvg.js'\n\nexport const detectSvgFromXml = (buffer: Buffer): boolean => inspectSvg(buffer).isSvg\n"],"names":["inspectSvg","detectSvgFromXml","buffer","isSvg"],"mappings":"AAAA,SAASA,UAAU,QAAQ,mBAAkB;AAE7C,OAAO,MAAMC,mBAAmB,CAACC,SAA4BF,WAAWE,QAAQC,KAAK,CAAA"}

package/dist/uploads/docWithFilenameExists.d.ts

@@ -2,10 +2,11 @@ import type { PayloadRequest } from '../types/index.js';
 type Args = {
     collectionSlug: string;
     filename: string;
+    matchAnyPrefix?: boolean;
     path: string;
     prefix?: string;
     req: PayloadRequest;
 };
-export declare const docWithFilenameExists: ({ collectionSlug, filename, prefix, req, }: Args) => Promise<boolean>;
+export declare const docWithFilenameExists: ({ collectionSlug, filename, matchAnyPrefix, prefix, req, }: Args) => Promise<boolean>;
 export {};
 //# sourceMappingURL=docWithFilenameExists.d.ts.map

package/dist/uploads/docWithFilenameExists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docWithFilenameExists.d.ts","sourceRoot":"","sources":["../../src/uploads/docWithFilenameExists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAE9D,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,4CAKzC,IAAI,KAAG,OAAO,CAAC,OAAO,CAkBxB,CAAA"}
+{"version":3,"file":"docWithFilenameExists.d.ts","sourceRoot":"","sources":["../../src/uploads/docWithFilenameExists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAI9D,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,+DAM/B,IAAI,KAAG,OAAO,CAAC,OAAO,CAuBxB,CAAA"}

package/dist/uploads/docWithFilenameExists.js

@@ -1,14 +1,22 @@
-export const docWithFilenameExists = async ({ collectionSlug, filename, prefix, req })=>{
-    const where = {
-        filename: {
-            equals: filename
-        }
-    };
-    if (prefix) {
-        where.prefix = {
-            equals: prefix
-        };
-    }
+import { buildFilenameWhere } from './transformers/resolveUploadDocument.js';
+export const docWithFilenameExists = async ({ collectionSlug, filename, matchAnyPrefix = false, prefix, req })=>{
+    const collection = req.payload.collections[collectionSlug]?.config;
+    const upload = collection?.upload;
+    const hasPrefixField = (collection?.fields ?? []).some((field)=>'name' in field && field.name === 'prefix');
+    const filenameCondition = buildFilenameWhere({
+        filename,
+        variants: upload && typeof upload === 'object' ? upload.variants : undefined
+    });
+    const where = !matchAnyPrefix && typeof prefix === 'string' && hasPrefixField ? {
+        and: [
+            filenameCondition,
+            {
+                prefix: {
+                    equals: prefix
+                }
+            }
+        ]
+    } : filenameCondition;
     const doc = await req.payload.db.findOne({
         collection: collectionSlug,
         req,

package/dist/uploads/docWithFilenameExists.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/docWithFilenameExists.ts"],"sourcesContent":["import type { PayloadRequest, Where } from '../types/index.js'\n\ntype Args = {\n  collectionSlug: string\n  filename: string\n  path: string\n  prefix?: string\n  req: PayloadRequest\n}\n\nexport const docWithFilenameExists = async ({\n  collectionSlug,\n  filename,\n  prefix,\n  req,\n}: Args): Promise<boolean> => {\n  const where: Where = {\n    filename: {\n      equals: filename,\n    },\n  }\n\n  if (prefix) {\n    where.prefix = { equals: prefix }\n  }\n\n  const doc = await req.payload.db.findOne({\n    collection: collectionSlug,\n    req,\n    where,\n  })\n\n  return !!doc\n}\n"],"names":["docWithFilenameExists","collectionSlug","filename","prefix","req","where","equals","doc","payload","db","findOne","collection"],"mappings":"AAUA,OAAO,MAAMA,wBAAwB,OAAO,EAC1CC,cAAc,EACdC,QAAQ,EACRC,MAAM,EACNC,GAAG,EACE;IACL,MAAMC,QAAe;QACnBH,UAAU;YACRI,QAAQJ;QACV;IACF;IAEA,IAAIC,QAAQ;QACVE,MAAMF,MAAM,GAAG;YAAEG,QAAQH;QAAO;IAClC;IAEA,MAAMI,MAAM,MAAMH,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;QACvCC,YAAYV;QACZG;QACAC;IACF;IAEA,OAAO,CAAC,CAACE;AACX,EAAC"}
+{"version":3,"sources":["../../src/uploads/docWithFilenameExists.ts"],"sourcesContent":["import type { PayloadRequest, Where } from '../types/index.js'\n\nimport { buildFilenameWhere } from './transformers/resolveUploadDocument.js'\n\ntype Args = {\n  collectionSlug: string\n  filename: string\n  matchAnyPrefix?: boolean\n  path: string\n  prefix?: string\n  req: PayloadRequest\n}\n\nexport const docWithFilenameExists = async ({\n  collectionSlug,\n  filename,\n  matchAnyPrefix = false,\n  prefix,\n  req,\n}: Args): Promise<boolean> => {\n  const collection = req.payload.collections[collectionSlug]?.config\n  const upload = collection?.upload\n  const hasPrefixField = (collection?.fields ?? []).some(\n    (field) => 'name' in field && field.name === 'prefix',\n  )\n  const filenameCondition = buildFilenameWhere({\n    filename,\n    variants: upload && typeof upload === 'object' ? upload.variants : undefined,\n  })\n\n  const where: Where =\n    !matchAnyPrefix && typeof prefix === 'string' && hasPrefixField\n      ? { and: [filenameCondition, { prefix: { equals: prefix } }] }\n      : filenameCondition\n\n  const doc = await req.payload.db.findOne({\n    collection: collectionSlug,\n    req,\n    where,\n  })\n\n  return !!doc\n}\n"],"names":["buildFilenameWhere","docWithFilenameExists","collectionSlug","filename","matchAnyPrefix","prefix","req","collection","payload","collections","config","upload","hasPrefixField","fields","some","field","name","filenameCondition","variants","undefined","where","and","equals","doc","db","findOne"],"mappings":"AAEA,SAASA,kBAAkB,QAAQ,0CAAyC;AAW5E,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,cAAc,EACdC,QAAQ,EACRC,iBAAiB,KAAK,EACtBC,MAAM,EACNC,GAAG,EACE;IACL,MAAMC,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACP,eAAe,EAAEQ;IAC5D,MAAMC,SAASJ,YAAYI;IAC3B,MAAMC,iBAAiB,AAACL,CAAAA,YAAYM,UAAU,EAAE,AAAD,EAAGC,IAAI,CACpD,CAACC,QAAU,UAAUA,SAASA,MAAMC,IAAI,KAAK;IAE/C,MAAMC,oBAAoBjB,mBAAmB;QAC3CG;QACAe,UAAUP,UAAU,OAAOA,WAAW,WAAWA,OAAOO,QAAQ,GAAGC;IACrE;IAEA,MAAMC,QACJ,CAAChB,kBAAkB,OAAOC,WAAW,YAAYO,iBAC7C;QAAES,KAAK;YAACJ;YAAmB;gBAAEZ,QAAQ;oBAAEiB,QAAQjB;gBAAO;YAAE;SAAE;IAAC,IAC3DY;IAEN,MAAMM,MAAM,MAAMjB,IAAIE,OAAO,CAACgB,EAAE,CAACC,OAAO,CAAC;QACvClB,YAAYL;QACZI;QACAc;IACF;IAEA,OAAO,CAAC,CAACG;AACX,EAAC"}

package/dist/uploads/downloadFileToBuffer.d.ts

@@ -0,0 +1,11 @@
+import type { PayloadRequest } from '../types/index.js';
+import type { File, FileData, UploadConfig } from './types.js';
+type Args = {
+    data: Pick<FileData, 'filename' | 'url'>;
+    req: PayloadRequest;
+    uploadConfig: UploadConfig;
+};
+/** Downloads a file into a Payload File buffer, including existing files being resized or copied. */
+export declare const downloadFileToBuffer: ({ data, req, uploadConfig }: Args) => Promise<File>;
+export {};
+//# sourceMappingURL=downloadFileToBuffer.d.ts.map

package/dist/uploads/downloadFileToBuffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"downloadFileToBuffer.d.ts","sourceRoot":"","sources":["../../src/uploads/downloadFileToBuffer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAM9D,KAAK,IAAI,GAAG;IACV,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,CAAA;IACxC,GAAG,EAAE,cAAc,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,CAAA;AAeD,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,gCAAuC,IAAI,KAAG,OAAO,CAAC,IAAI,CAuE1F,CAAA"}

package/dist/uploads/downloadFileToBuffer.js

@@ -0,0 +1,72 @@
+import { APIError } from '../errors/index.js';
+import { getRequestOrigin } from '../utilities/getRequestOrigin.js';
+import { fetchWithRedirects, parseFileURL } from './fetchWithRedirects.js';
+const hasProtocol = (url)=>/^[a-z][a-z\d+.-]*:/i.test(url);
+const getRequestBaseURL = (req)=>{
+    try {
+        const requestURL = parseFileURL(req.url);
+        const host = req.headers.get('host') || requestURL.host;
+        return parseFileURL(`${requestURL.protocol}//${host}`);
+    } catch  {
+        return undefined;
+    }
+};
+/** Downloads a file into a Payload File buffer, including existing files being resized or copied. */ export const downloadFileToBuffer = async ({ data, req, uploadConfig })=>{
+    const { filename, url } = data;
+    if (typeof url === 'string') {
+        let baseOrigin;
+        let parsedFileURL;
+        if (hasProtocol(url)) {
+            parsedFileURL = parseFileURL(url);
+        } else {
+            const requestOrigin = getRequestOrigin({
+                config: req.payload.config,
+                req
+            });
+            let requestBaseURL;
+            if (requestOrigin) {
+                requestBaseURL = parseFileURL(requestOrigin);
+                baseOrigin = requestBaseURL.origin;
+            } else {
+                requestBaseURL = getRequestBaseURL(req);
+            }
+            if (!requestBaseURL) {
+                throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400);
+            }
+            parsedFileURL = parseFileURL(url, requestBaseURL);
+        }
+        const fileURL = parsedFileURL.toString();
+        const requestHeaders = Object.fromEntries(new Headers(req.headers));
+        const cookies = (req.headers.get('cookie') ?? '').split(';');
+        const getHeaders = (currentURL)=>{
+            const isSameOrigin = Boolean(baseOrigin && new URL(currentURL).origin === baseOrigin);
+            return uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter({
+                ...requestHeaders
+            }, {
+                isSameOrigin,
+                url: currentURL
+            }) : {
+                cookie: cookies.filter((cookie)=>isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix)).join(';')
+            };
+        };
+        const { response, url: resolvedURL } = await fetchWithRedirects({
+            allowList: uploadConfig.pasteURL ? uploadConfig.pasteURL.allowList : undefined,
+            getHeaders,
+            skipSafeFetch: uploadConfig.skipSafeFetch,
+            url: fileURL
+        });
+        if (!response.ok) {
+            throw new APIError(`Failed to fetch file from ${resolvedURL}`, response.status);
+        }
+        const data = await response.arrayBuffer();
+        return {
+            name: filename,
+            data: Buffer.from(data),
+            mimetype: response.headers.get('content-type') || undefined,
+            size: Number(response.headers.get('content-length')) || 0
+        };
+    }
+    throw new APIError('Invalid file url', 400);
+};
+
+//# sourceMappingURL=downloadFileToBuffer.js.map

package/dist/uploads/downloadFileToBuffer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/downloadFileToBuffer.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { getRequestOrigin } from '../utilities/getRequestOrigin.js'\nimport { fetchWithRedirects, parseFileURL } from './fetchWithRedirects.js'\n\ntype Args = {\n  data: Pick<FileData, 'filename' | 'url'>\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\n\nconst hasProtocol = (url: string): boolean => /^[a-z][a-z\\d+.-]*:/i.test(url)\n\nconst getRequestBaseURL = (req: PayloadRequest): undefined | URL => {\n  try {\n    const requestURL = parseFileURL(req.url!)\n    const host = req.headers.get('host') || requestURL.host\n\n    return parseFileURL(`${requestURL.protocol}//${host}`)\n  } catch {\n    return undefined\n  }\n}\n\n/** Downloads a file into a Payload File buffer, including existing files being resized or copied. */\nexport const downloadFileToBuffer = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  if (typeof url === 'string') {\n    let baseOrigin: string | undefined\n    let parsedFileURL: URL\n\n    if (hasProtocol(url)) {\n      parsedFileURL = parseFileURL(url)\n    } else {\n      const requestOrigin = getRequestOrigin({ config: req.payload.config, req })\n      let requestBaseURL: undefined | URL\n\n      if (requestOrigin) {\n        requestBaseURL = parseFileURL(requestOrigin)\n        baseOrigin = requestBaseURL.origin\n      } else {\n        requestBaseURL = getRequestBaseURL(req)\n      }\n\n      if (!requestBaseURL) {\n        throw new APIError('Unable to determine an HTTP(S) base URL for the external file.', 400)\n      }\n\n      parsedFileURL = parseFileURL(url, requestBaseURL)\n    }\n\n    const fileURL = parsedFileURL.toString()\n    const requestHeaders = Object.fromEntries(new Headers(req.headers))\n    const cookies = (req.headers.get('cookie') ?? '').split(';')\n\n    const getHeaders = (currentURL: string): Record<string, string> => {\n      const isSameOrigin = Boolean(baseOrigin && new URL(currentURL).origin === baseOrigin)\n\n      return uploadConfig.externalFileHeaderFilter\n        ? uploadConfig.externalFileHeaderFilter(\n            { ...requestHeaders },\n            { isSameOrigin, url: currentURL },\n          )\n        : {\n            cookie: cookies\n              .filter(\n                (cookie) =>\n                  isSameOrigin || !cookie.trim().startsWith(req.payload.config.cookiePrefix),\n              )\n              .join(';'),\n          }\n    }\n\n    const { response, url: resolvedURL } = await fetchWithRedirects({\n      allowList: uploadConfig.pasteURL ? uploadConfig.pasteURL.allowList : undefined,\n      getHeaders,\n      skipSafeFetch: uploadConfig.skipSafeFetch,\n      url: fileURL,\n    })\n\n    if (!response.ok) {\n      throw new APIError(`Failed to fetch file from ${resolvedURL}`, response.status)\n    }\n\n    const data = await response.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: response.headers.get('content-type') || undefined!,\n      size: Number(response.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","getRequestOrigin","fetchWithRedirects","parseFileURL","hasProtocol","url","test","getRequestBaseURL","req","requestURL","host","headers","get","protocol","undefined","downloadFileToBuffer","data","uploadConfig","filename","baseOrigin","parsedFileURL","requestOrigin","config","payload","requestBaseURL","origin","fileURL","toString","requestHeaders","Object","fromEntries","Headers","cookies","split","getHeaders","currentURL","isSameOrigin","Boolean","URL","externalFileHeaderFilter","cookie","filter","trim","startsWith","cookiePrefix","join","response","resolvedURL","allowList","pasteURL","skipSafeFetch","ok","status","arrayBuffer","name","Buffer","from","mimetype","size","Number"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,kBAAkB,EAAEC,YAAY,QAAQ,0BAAyB;AAQ1E,MAAMC,cAAc,CAACC,MAAyB,sBAAsBC,IAAI,CAACD;AAEzE,MAAME,oBAAoB,CAACC;IACzB,IAAI;QACF,MAAMC,aAAaN,aAAaK,IAAIH,GAAG;QACvC,MAAMK,OAAOF,IAAIG,OAAO,CAACC,GAAG,CAAC,WAAWH,WAAWC,IAAI;QAEvD,OAAOP,aAAa,GAAGM,WAAWI,QAAQ,CAAC,EAAE,EAAEH,MAAM;IACvD,EAAE,OAAM;QACN,OAAOI;IACT;AACF;AAEA,mGAAmG,GACnG,OAAO,MAAMC,uBAAuB,OAAO,EAAEC,IAAI,EAAER,GAAG,EAAES,YAAY,EAAQ;IAC1E,MAAM,EAAEC,QAAQ,EAAEb,GAAG,EAAE,GAAGW;IAE1B,IAAI,OAAOX,QAAQ,UAAU;QAC3B,IAAIc;QACJ,IAAIC;QAEJ,IAAIhB,YAAYC,MAAM;YACpBe,gBAAgBjB,aAAaE;QAC/B,OAAO;YACL,MAAMgB,gBAAgBpB,iBAAiB;gBAAEqB,QAAQd,IAAIe,OAAO,CAACD,MAAM;gBAAEd;YAAI;YACzE,IAAIgB;YAEJ,IAAIH,eAAe;gBACjBG,iBAAiBrB,aAAakB;gBAC9BF,aAAaK,eAAeC,MAAM;YACpC,OAAO;gBACLD,iBAAiBjB,kBAAkBC;YACrC;YAEA,IAAI,CAACgB,gBAAgB;gBACnB,MAAM,IAAIxB,SAAS,kEAAkE;YACvF;YAEAoB,gBAAgBjB,aAAaE,KAAKmB;QACpC;QAEA,MAAME,UAAUN,cAAcO,QAAQ;QACtC,MAAMC,iBAAiBC,OAAOC,WAAW,CAAC,IAAIC,QAAQvB,IAAIG,OAAO;QACjE,MAAMqB,UAAU,AAACxB,CAAAA,IAAIG,OAAO,CAACC,GAAG,CAAC,aAAa,EAAC,EAAGqB,KAAK,CAAC;QAExD,MAAMC,aAAa,CAACC;YAClB,MAAMC,eAAeC,QAAQlB,cAAc,IAAImB,IAAIH,YAAYV,MAAM,KAAKN;YAE1E,OAAOF,aAAasB,wBAAwB,GACxCtB,aAAasB,wBAAwB,CACnC;gBAAE,GAAGX,cAAc;YAAC,GACpB;gBAAEQ;gBAAc/B,KAAK8B;YAAW,KAElC;gBACEK,QAAQR,QACLS,MAAM,CACL,CAACD,SACCJ,gBAAgB,CAACI,OAAOE,IAAI,GAAGC,UAAU,CAACnC,IAAIe,OAAO,CAACD,MAAM,CAACsB,YAAY,GAE5EC,IAAI,CAAC;YACV;QACN;QAEA,MAAM,EAAEC,QAAQ,EAAEzC,KAAK0C,WAAW,EAAE,GAAG,MAAM7C,mBAAmB;YAC9D8C,WAAW/B,aAAagC,QAAQ,GAAGhC,aAAagC,QAAQ,CAACD,SAAS,GAAGlC;YACrEoB;YACAgB,eAAejC,aAAaiC,aAAa;YACzC7C,KAAKqB;QACP;QAEA,IAAI,CAACoB,SAASK,EAAE,EAAE;YAChB,MAAM,IAAInD,SAAS,CAAC,0BAA0B,EAAE+C,aAAa,EAAED,SAASM,MAAM;QAChF;QAEA,MAAMpC,OAAO,MAAM8B,SAASO,WAAW;QAEvC,OAAO;YACLC,MAAMpC;YACNF,MAAMuC,OAAOC,IAAI,CAACxC;YAClByC,UAAUX,SAASnC,OAAO,CAACC,GAAG,CAAC,mBAAmBE;YAClD4C,MAAMC,OAAOb,SAASnC,OAAO,CAACC,GAAG,CAAC,sBAAsB;QAC1D;IACF;IAEA,MAAM,IAAIZ,SAAS,oBAAoB;AACzC,EAAC"}

package/dist/uploads/endpoints/getFile.d.ts

@@ -1,3 +1,20 @@
+import type { Collection, TypeWithID } from '../../collections/config/types.js';
 import type { PayloadHandler } from '../../config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+import type { FileHandlerOperation } from '../types.js';
 export declare const getFileHandler: PayloadHandler;
+/**
+ * Shared by the ordinary `read` endpoint and, via `operation: 'transform'`, by
+ * `getSourceFileResponse` for internal source retrieval. `transform` ignores the
+ * `Range` header and skips `modifyResponseHeaders`/CORS wrapping, since those are
+ * applied once, later, to the transformer pipeline's final response.
+ */
+export declare function retrieveFileResponse({ collection, doc, filename, operation, prefix, req, }: {
+    collection: Collection;
+    doc?: TypeWithID;
+    filename: string;
+    operation?: FileHandlerOperation;
+    prefix?: string;
+    req: PayloadRequest;
+}): Promise<Response>;
 //# sourceMappingURL=getFile.d.ts.map

package/dist/uploads/endpoints/getFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFile.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAU3D,eAAO,MAAM,cAAc,EAAE,cA6J5B,CAAA"}
+{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFile.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAkBvD,eAAO,MAAM,cAAc,EAAE,cAqD5B,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,UAAU,EACV,GAAG,EACH,QAAQ,EACR,SAAkB,EAClB,MAAM,EACN,GAAG,GACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,CAAC,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,oBAAoB,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiJpB"}