payload 4.0.0-internal.fa345ef → 4.0.0-internal.ff27d6e

package/dist/auth/operations/resetPassword.js

@@ -1,18 +1,20 @@
-import { status as httpStatus } from 'http-status';
 import { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js';
 import { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js';
-import { APIError, Forbidden } from '../../errors/index.js';
+import { APIError, Forbidden, ValidationError } from '../../errors/index.js';
 import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js';
+import { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js';
 import { commitTransaction } from '../../utilities/commitTransaction.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
-import { getFieldsToSign } from '../getFieldsToSign.js';
-import { jwtSign } from '../jwt.js';
-import { addSessionToUser, revokeSession } from '../sessions.js';
+import { applyUserReadAccess } from '../applyUserReadAccess.js';
+import { createAuthToken } from '../createAuthToken.js';
+import { revokeSession } from '../sessions.js';
 import { authenticateLocalStrategy } from '../strategies/local/authenticate.js';
 import { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js';
 export const resetPasswordOperation = async (args)=>{
-    const { collection: { config: collectionConfig }, data, depth, overrideAccess, req: { payload: { secret }, payload }, req } = args;
+    const { collection: { config: collectionConfig }, data, depth, overrideAccess = false, req: { payload }, req } = args;
+    assertNoValidationWrite(req);
     if (!Object.prototype.hasOwnProperty.call(data, 'token') || !Object.prototype.hasOwnProperty.call(data, 'password')) {
         throw new APIError('Missing required data.', httpStatus.BAD_REQUEST);
     }
@@ -20,7 +22,7 @@ export const resetPasswordOperation = async (args)=>{
         throw new Forbidden(req.t);
     }
     let sid;
-    let user = null;
+    let sessionUser = null;
     try {
         const shouldCommit = await initTransaction(req);
         args = await buildBeforeOperation({
@@ -44,7 +46,7 @@ export const resetPasswordOperation = async (args)=>{
                 }
             }
         });
-        user = await payload.db.findOne({
+        let user = await payload.db.findOne({
             collection: collectionConfig.slug,
             req,
             where
@@ -52,6 +54,13 @@ export const resetPasswordOperation = async (args)=>{
         if (!user) {
             throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN);
         }
+        await validatePasswordField({
+            collectionConfig,
+            overrideAccess,
+            password: data.password,
+            req,
+            user
+        });
         // TODO: replace this method
         const { hash, salt } = await generatePasswordSaltHash({
             collection: collectionConfig,
@@ -61,6 +70,10 @@ export const resetPasswordOperation = async (args)=>{
         user.salt = salt;
         user.hash = hash;
         user.resetPasswordExpiration = new Date().toISOString();
+        if (collectionConfig.auth.maxLoginAttempts > 0) {
+            user.lockUntil = null;
+            user.loginAttempts = 0;
+        }
         if (collectionConfig.auth.verify) {
             user._verified = Boolean(user._verified);
         }
@@ -83,6 +96,9 @@ export const resetPasswordOperation = async (args)=>{
         // /////////////////////////////////////
         // Ensure updatedAt date is always updated
         user.updatedAt = new Date().toISOString();
+        if (collectionConfig.auth.useSessions) {
+            user.sessions = [];
+        }
         const doc = await payload.db.updateOne({
             id: user.id,
             collection: collectionConfig.slug,
@@ -91,76 +107,64 @@ export const resetPasswordOperation = async (args)=>{
         });
         await authenticateLocalStrategy({
             doc,
-            password: data.password
+            password: data.password,
+            passwordHashIterations: payload.config.auth.passwordHashIterations
         });
-        const fieldsToSignArgs = {
+        user = doc;
+        user.collection = collectionConfig.slug;
+        user._strategy = 'local-jwt';
+        const { token, ...session } = await createAuthToken({
             collectionConfig,
             email: user.email,
-            user
-        };
-        const session = await addSessionToUser({
-            collectionConfig,
-            payload,
             req,
             user
         });
+        sessionUser = user;
         sid = session.sid;
-        if (sid) {
-            fieldsToSignArgs.sid = sid;
-        }
-        const fieldsToSign = getFieldsToSign(fieldsToSignArgs);
         // /////////////////////////////////////
         // beforeLogin - Collection
         // /////////////////////////////////////
-        let userBeforeLogin = user;
         if (collectionConfig.hooks?.beforeLogin?.length) {
             for (const hook of collectionConfig.hooks.beforeLogin){
-                userBeforeLogin = await hook({
+                user = await hook({
                     collection: args.collection?.config,
                     context: args.req.context,
                     req: args.req,
-                    user: userBeforeLogin
-                }) || userBeforeLogin;
+                    user
+                }) || user;
             }
         }
-        const { token } = await jwtSign({
-            fieldsToSign,
-            secret,
-            tokenExpiration: collectionConfig.auth.tokenExpiration
-        });
-        req.user = userBeforeLogin;
+        req.user = user;
         // /////////////////////////////////////
         // afterLogin - Collection
         // /////////////////////////////////////
         if (collectionConfig.hooks?.afterLogin?.length) {
             for (const hook of collectionConfig.hooks.afterLogin){
-                userBeforeLogin = await hook({
+                user = await hook({
                     collection: args.collection?.config,
                     context: args.req.context,
                     req: args.req,
                     token,
-                    user: userBeforeLogin
-                }) || userBeforeLogin;
+                    user
+                }) || user;
             }
         }
-        const fullUser = await payload.findByID({
-            id: user.id,
-            collection: collectionConfig.slug,
-            depth,
+        user.collection = collectionConfig.slug;
+        user._strategy = 'local-jwt';
+        const userWithReadAccess = await applyUserReadAccess({
+            collection: collectionConfig,
+            depth: depth,
             overrideAccess,
             req,
-            trash: false
+            showHiddenFields: false,
+            user: user
         });
         if (shouldCommit) {
             await commitTransaction(req);
         }
-        if (fullUser) {
-            fullUser.collection = collectionConfig.slug;
-            fullUser._strategy = 'local-jwt';
-        }
         let result = {
             token,
-            user: fullUser
+            user: userWithReadAccess
         };
         // /////////////////////////////////////
         // afterOperation - Collection
@@ -174,18 +178,62 @@ export const resetPasswordOperation = async (args)=>{
         });
         return result;
     } catch (error) {
+        // Logging in with the new password failed, e.g. in a `beforeLogin` hook, so remove the session
+        // it started
         if (sid) {
             await revokeSession({
                 collectionConfig,
                 payload,
                 req,
                 sid,
-                user
+                user: sessionUser
             });
         }
         await killTransaction(req);
         throw error;
     }
 };
+/**
+ * Runs the `password` field override's validation, which `payload.db.updateOne` skips.
+ */ async function validatePasswordField({ collectionConfig, overrideAccess, password, req, user }) {
+    const passwordField = collectionConfig.flattenedFields.find((field)=>field.name === 'password');
+    if (!passwordField || !('validate' in passwordField) || !passwordField.validate) {
+        return;
+    }
+    const validate = passwordField.validate;
+    const dataToValidate = {
+        ...user,
+        password
+    };
+    const validationResult = await validate(password, {
+        ...passwordField,
+        id: user.id,
+        blockData: {},
+        collectionSlug: collectionConfig.slug,
+        data: dataToValidate,
+        event: 'submit',
+        operation: 'update',
+        overrideAccess,
+        path: [
+            'password'
+        ],
+        preferences: {
+            fields: {}
+        },
+        req,
+        siblingData: dataToValidate
+    });
+    if (typeof validationResult === 'string') {
+        throw new ValidationError({
+            collection: collectionConfig.slug,
+            errors: [
+                {
+                    message: validationResult,
+                    path: 'password'
+                }
+            ]
+        });
+    }
+}
 
 //# sourceMappingURL=resetPassword.js.map

package/dist/auth/operations/resetPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection, DataFromCollectionSlug } from '../../collections/config/types.js'\nimport type { AuthCollectionSlug, User } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { getFieldsToSign } from '../getFieldsToSign.js'\nimport { jwtSign } from '../jwt.js'\nimport { addSessionToUser, revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n  token?: string\n  user: Record<string, unknown>\n}\n\nexport type Arguments = {\n  collection: Collection\n  data: {\n    password: string\n    token: string\n  }\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments,\n): Promise<Result> => {\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess,\n    req: {\n      payload: { secret },\n      payload,\n    },\n    req,\n  } = args\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let user: null | User = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })\n\n    // /////////////////////////////////////\n    // Reset Password\n    // /////////////////////////////////////\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: {\n        resetPasswordExpiration: { greater_than: new Date().toISOString() },\n        resetPasswordToken: { equals: data.token },\n      },\n    })\n\n    user = await payload.db.findOne<User>({\n      collection: collectionConfig.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n    }\n\n    // TODO: replace this method\n    const { hash, salt } = await generatePasswordSaltHash({\n      collection: collectionConfig,\n      password: data.password,\n      req,\n    })\n\n    user.salt = salt\n    user.hash = hash\n\n    user.resetPasswordExpiration = new Date().toISOString()\n\n    if (collectionConfig.auth.verify) {\n      user._verified = Boolean(user._verified)\n    }\n\n    // /////////////////////////////////////\n    // beforeValidate - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeValidate?.length) {\n      for (const hook of collectionConfig.hooks.beforeValidate) {\n        await hook({\n          collection: args.collection?.config,\n          context: req.context,\n          data: user,\n          operation: 'update',\n          req,\n        })\n      }\n    }\n\n    // /////////////////////////////////////\n    // Update new password\n    // /////////////////////////////////////\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    const doc = await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n    })\n\n    await authenticateLocalStrategy({ doc, password: data.password })\n\n    const fieldsToSignArgs: Parameters<typeof getFieldsToSign>[0] = {\n      collectionConfig,\n      email: user.email!,\n      user,\n    }\n\n    const session = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req,\n      user,\n    })\n    sid = session.sid\n\n    if (sid) {\n      fieldsToSignArgs.sid = sid\n    }\n\n    const fieldsToSign = getFieldsToSign(fieldsToSignArgs)\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    let userBeforeLogin = user\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const { token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration: collectionConfig.auth.tokenExpiration,\n    })\n\n    req.user = userBeforeLogin\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        userBeforeLogin =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            token,\n            user: userBeforeLogin,\n          })) || userBeforeLogin\n      }\n    }\n\n    const fullUser = await payload.findByID({\n      id: user.id,\n      collection: collectionConfig.slug,\n      depth,\n      overrideAccess,\n      req,\n      trash: false,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    if (fullUser) {\n      fullUser.collection = collectionConfig.slug\n      fullUser._strategy = 'local-jwt'\n    }\n\n    let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n      token,\n      user: fullUser,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'resetPassword',\n      overrideAccess,\n      result,\n    })\n\n    return result\n  } catch (error: unknown) {\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user,\n      })\n    }\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","getFieldsToSign","jwtSign","addSessionToUser","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","secret","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","user","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","db","findOne","slug","FORBIDDEN","hash","salt","password","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","doc","updateOne","id","fieldsToSignArgs","email","session","fieldsToSign","userBeforeLogin","beforeLogin","tokenExpiration","afterLogin","fullUser","findByID","_strategy","result","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAMlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,OAAO,QAAQ,YAAW;AACnC,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,iBAAgB;AAChE,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,cAAc,EACdC,KAAK,EACHC,SAAS,EAAEC,MAAM,EAAE,EACnBD,OAAO,EACR,EACDD,GAAG,EACJ,GAAGP;IAEJ,IACE,CAACU,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,YAC5C,CAACM,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACT,MAAM,aAC5C;QACA,MAAM,IAAIjB,SAAS,0BAA0BH,WAAW8B,WAAW;IACrE;IAEA,IAAIX,iBAAiBY,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI5B,UAAUmB,IAAIU,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,OAAoB;IAExB,IAAI;QACF,MAAMC,eAAe,MAAM7B,gBAAgBgB;QAE3CP,OAAO,MAAMd,qBAAqB;YAChCc;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXf;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMgB,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQrB,iBAAiBsB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ3B,KAAK4B,KAAK;gBAAC;YAC3C;QACF;QAEAb,OAAO,MAAMX,QAAQyB,EAAE,CAACC,OAAO,CAAO;YACpCjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAe;QACF;QAEA,IAAI,CAACH,MAAM;YACT,MAAM,IAAIhC,SAAS,2CAA2CH,WAAWoD,SAAS;QACpF;QAEA,4BAA4B;QAC5B,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMxC,yBAAyB;YACpDG,YAAYE;YACZoC,UAAUnC,KAAKmC,QAAQ;YACvBhC;QACF;QAEAY,KAAKmB,IAAI,GAAGA;QACZnB,KAAKkB,IAAI,GAAGA;QAEZlB,KAAKO,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAI1B,iBAAiBY,IAAI,CAACyB,MAAM,EAAE;YAChCrB,KAAKsB,SAAS,GAAGjB,QAAQL,KAAKsB,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAItC,iBAAiBuC,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACT5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAASvC,IAAIuC,OAAO;oBACpB1C,MAAMe;oBACNE,WAAW;oBACXd;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CY,KAAK4B,SAAS,GAAG,IAAInB,OAAOC,WAAW;QAEvC,MAAMmB,MAAM,MAAMxC,QAAQyB,EAAE,CAACgB,SAAS,CAAC;YACrCC,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAMe;YACNZ;QACF;QAEA,MAAMV,0BAA0B;YAAEmD;YAAKT,UAAUnC,KAAKmC,QAAQ;QAAC;QAE/D,MAAMY,mBAA0D;YAC9DhD;YACAiD,OAAOjC,KAAKiC,KAAK;YACjBjC;QACF;QAEA,MAAMkC,UAAU,MAAM1D,iBAAiB;YACrCQ;YACAK;YACAD;YACAY;QACF;QACAD,MAAMmC,QAAQnC,GAAG;QAEjB,IAAIA,KAAK;YACPiC,iBAAiBjC,GAAG,GAAGA;QACzB;QAEA,MAAMoC,eAAe7D,gBAAgB0D;QAErC,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAII,kBAAkBpC;QAEtB,IAAIhB,iBAAiBuC,KAAK,EAAEc,aAAaZ,QAAQ;YAC/C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACc,WAAW,CAAE;gBACrDD,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbY,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAM,EAAEvB,KAAK,EAAE,GAAG,MAAMtC,QAAQ;YAC9B4D;YACA7C;YACAgD,iBAAiBtD,iBAAiBY,IAAI,CAAC0C,eAAe;QACxD;QAEAlD,IAAIY,IAAI,GAAGoC;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAIpD,iBAAiBuC,KAAK,EAAEgB,YAAYd,QAAQ;YAC9C,KAAK,MAAMC,QAAQ1C,iBAAiBuC,KAAK,CAACgB,UAAU,CAAE;gBACpDH,kBACE,AAAC,MAAMV,KAAK;oBACV5C,YAAYD,KAAKC,UAAU,EAAEC;oBAC7B4C,SAAS9C,KAAKO,GAAG,CAACuC,OAAO;oBACzBvC,KAAKP,KAAKO,GAAG;oBACbyB;oBACAb,MAAMoC;gBACR,MAAOA;YACX;QACF;QAEA,MAAMI,WAAW,MAAMnD,QAAQoD,QAAQ,CAAC;YACtCV,IAAI/B,KAAK+B,EAAE;YACXjD,YAAYE,iBAAiBgC,IAAI;YACjC9B;YACAC;YACAC;YACAkB,OAAO;QACT;QAEA,IAAIL,cAAc;YAChB,MAAM9B,kBAAkBiB;QAC1B;QAEA,IAAIoD,UAAU;YACZA,SAAS1D,UAAU,GAAGE,iBAAiBgC,IAAI;YAC3CwB,SAASE,SAAS,GAAG;QACvB;QAEA,IAAIC,SAA2D;YAC7D9B;YACAb,MAAMwC;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCG,SAAS,MAAM7E,oBAAoB;YACjCe;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BmB,WAAW;YACXf;YACAwD;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,IAAI7C,KAAK;YACP,MAAMtB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAW;gBACAC;YACF;QACF;QACA,MAAM3B,gBAAgBe;QACtB,MAAMwD;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/resetPassword.ts"],"sourcesContent":["import type {\n  Collection,\n  DataFromCollectionSlug,\n  SanitizedCollectionConfig,\n} from '../../collections/config/types.js'\nimport type { Validate } from '../../fields/config/types.js'\nimport type { AuthCollectionSlug, AuthenticatedUser } from '../../index.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError, Forbidden, ValidationError } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { applyUserReadAccess } from '../applyUserReadAccess.js'\nimport { createAuthToken } from '../createAuthToken.js'\nimport { revokeSession } from '../sessions.js'\nimport { authenticateLocalStrategy } from '../strategies/local/authenticate.js'\nimport { generatePasswordSaltHash } from '../strategies/local/generatePasswordSaltHash.js'\n\nexport type Result = {\n  token?: string\n  user: Record<string, unknown>\n}\n\nexport type Arguments = {\n  collection: Collection\n  data: {\n    password: string\n    token: string\n  }\n  depth?: number\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const resetPasswordOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments,\n): Promise<Result> => {\n  const {\n    collection: { config: collectionConfig },\n    data,\n    depth,\n    overrideAccess = false,\n    req: { payload },\n    req,\n  } = args\n\n  assertNoValidationWrite(req)\n\n  if (\n    !Object.prototype.hasOwnProperty.call(data, 'token') ||\n    !Object.prototype.hasOwnProperty.call(data, 'password')\n  ) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  let sid: string | undefined\n  let sessionUser: AuthenticatedUser | null = null\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'resetPassword',\n      overrideAccess,\n    })\n\n    // /////////////////////////////////////\n    // Reset Password\n    // /////////////////////////////////////\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: {\n        resetPasswordExpiration: { greater_than: new Date().toISOString() },\n        resetPasswordToken: { equals: data.token },\n      },\n    })\n\n    let user = await payload.db.findOne<AuthenticatedUser>({\n      collection: collectionConfig.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Token is either invalid or has expired.', httpStatus.FORBIDDEN)\n    }\n\n    await validatePasswordField({\n      collectionConfig,\n      overrideAccess,\n      password: data.password,\n      req,\n      user,\n    })\n\n    // TODO: replace this method\n    const { hash, salt } = await generatePasswordSaltHash({\n      collection: collectionConfig,\n      password: data.password,\n      req,\n    })\n\n    user.salt = salt\n    user.hash = hash\n\n    user.resetPasswordExpiration = new Date().toISOString()\n\n    if (collectionConfig.auth.maxLoginAttempts > 0) {\n      user.lockUntil = null\n      user.loginAttempts = 0\n    }\n\n    if (collectionConfig.auth.verify) {\n      user._verified = Boolean(user._verified)\n    }\n\n    // /////////////////////////////////////\n    // beforeValidate - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeValidate?.length) {\n      for (const hook of collectionConfig.hooks.beforeValidate) {\n        await hook({\n          collection: args.collection?.config,\n          context: req.context,\n          data: user,\n          operation: 'update',\n          req,\n        })\n      }\n    }\n\n    // /////////////////////////////////////\n    // Update new password\n    // /////////////////////////////////////\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    if (collectionConfig.auth.useSessions) {\n      user.sessions = []\n    }\n\n    const doc = await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n    })\n\n    await authenticateLocalStrategy({\n      doc,\n      password: data.password,\n      passwordHashIterations: payload.config.auth.passwordHashIterations,\n    })\n\n    user = doc as AuthenticatedUser\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n\n    const { token, ...session } = await createAuthToken({\n      collectionConfig,\n      email: user.email!,\n      req,\n      user,\n    })\n\n    sessionUser = user\n    sid = session.sid\n\n    // /////////////////////////////////////\n    // beforeLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.beforeLogin?.length) {\n      for (const hook of collectionConfig.hooks.beforeLogin) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            user,\n          })) || user\n      }\n    }\n\n    req.user = user\n\n    // /////////////////////////////////////\n    // afterLogin - Collection\n    // /////////////////////////////////////\n\n    if (collectionConfig.hooks?.afterLogin?.length) {\n      for (const hook of collectionConfig.hooks.afterLogin) {\n        user =\n          (await hook({\n            collection: args.collection?.config,\n            context: args.req.context,\n            req: args.req,\n            token,\n            user,\n          })) || user\n      }\n    }\n\n    user!.collection = collectionConfig.slug\n    user!._strategy = 'local-jwt'\n\n    const userWithReadAccess = await applyUserReadAccess({\n      collection: collectionConfig,\n      depth: depth!,\n      overrideAccess,\n      req,\n      showHiddenFields: false,\n      user: user!,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    let result: { user: DataFromCollectionSlug<TSlug> } & Result = {\n      token,\n      user: userWithReadAccess,\n    }\n\n    // /////////////////////////////////////\n    // afterOperation - Collection\n    // /////////////////////////////////////\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection?.config,\n      operation: 'resetPassword',\n      overrideAccess,\n      result,\n    })\n\n    return result\n  } catch (error: unknown) {\n    // Logging in with the new password failed, e.g. in a `beforeLogin` hook, so remove the session\n    // it started\n    if (sid) {\n      await revokeSession({\n        collectionConfig,\n        payload,\n        req,\n        sid,\n        user: sessionUser,\n      })\n    }\n    await killTransaction(req)\n    throw error\n  }\n}\n\n/**\n * Runs the `password` field override's validation, which `payload.db.updateOne` skips.\n */\nasync function validatePasswordField({\n  collectionConfig,\n  overrideAccess,\n  password,\n  req,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  overrideAccess: boolean\n  password: string\n  req: PayloadRequest\n  user: AuthenticatedUser\n}): Promise<void> {\n  const passwordField = collectionConfig.flattenedFields.find((field) => field.name === 'password')\n\n  if (!passwordField || !('validate' in passwordField) || !passwordField.validate) {\n    return\n  }\n\n  const validate = passwordField.validate as Validate<string>\n  const dataToValidate = { ...user, password }\n\n  const validationResult = await validate(password, {\n    ...passwordField,\n    id: user.id,\n    blockData: {},\n    collectionSlug: collectionConfig.slug,\n    data: dataToValidate,\n    event: 'submit',\n    operation: 'update',\n    overrideAccess,\n    path: ['password'],\n    preferences: { fields: {} },\n    req,\n    siblingData: dataToValidate,\n  })\n\n  if (typeof validationResult === 'string') {\n    throw new ValidationError({\n      collection: collectionConfig.slug,\n      errors: [{ message: validationResult, path: 'password' }],\n    })\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","APIError","Forbidden","ValidationError","appendNonTrashedFilter","assertNoValidationWrite","commitTransaction","httpStatus","initTransaction","killTransaction","applyUserReadAccess","createAuthToken","revokeSession","authenticateLocalStrategy","generatePasswordSaltHash","resetPasswordOperation","args","collection","config","collectionConfig","data","depth","overrideAccess","req","payload","Object","prototype","hasOwnProperty","call","BAD_REQUEST","auth","disableLocalStrategy","t","sid","sessionUser","shouldCommit","operation","where","enableTrash","Boolean","trash","resetPasswordExpiration","greater_than","Date","toISOString","resetPasswordToken","equals","token","user","db","findOne","slug","FORBIDDEN","validatePasswordField","password","hash","salt","maxLoginAttempts","lockUntil","loginAttempts","verify","_verified","hooks","beforeValidate","length","hook","context","updatedAt","useSessions","sessions","doc","updateOne","id","passwordHashIterations","_strategy","session","email","beforeLogin","afterLogin","userWithReadAccess","showHiddenFields","result","error","passwordField","flattenedFields","find","field","name","validate","dataToValidate","validationResult","blockData","collectionSlug","event","path","preferences","fields","siblingData","errors","message"],"mappings":"AASA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,EAAEC,SAAS,EAAEC,eAAe,QAAQ,wBAAuB;AAC5E,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,mBAAmB,QAAQ,4BAA2B;AAC/D,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,aAAa,QAAQ,iBAAgB;AAC9C,SAASC,yBAAyB,QAAQ,sCAAqC;AAC/E,SAASC,wBAAwB,QAAQ,kDAAiD;AAkB1F,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,IAAI,EACJC,KAAK,EACLC,iBAAiB,KAAK,EACtBC,KAAK,EAAEC,OAAO,EAAE,EAChBD,GAAG,EACJ,GAAGP;IAEJX,wBAAwBkB;IAExB,IACE,CAACE,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,MAAM,YAC5C,CAACK,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,MAAM,aAC5C;QACA,MAAM,IAAInB,SAAS,0BAA0BM,WAAWsB,WAAW;IACrE;IAEA,IAAIV,iBAAiBW,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAI7B,UAAUqB,IAAIS,CAAC;IAC3B;IAEA,IAAIC;IACJ,IAAIC,cAAwC;IAE5C,IAAI;QACF,MAAMC,eAAe,MAAM3B,gBAAgBe;QAE3CP,OAAO,MAAMhB,qBAAqB;YAChCgB;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCkB,WAAW;YACXd;QACF;QAEA,wCAAwC;QACxC,iBAAiB;QACjB,wCAAwC;QAExC,MAAMe,QAAQjC,uBAAuB;YACnCkC,aAAaC,QAAQpB,iBAAiBqB,KAAK;YAC3CA,OAAO;YACPH,OAAO;gBACLI,yBAAyB;oBAAEC,cAAc,IAAIC,OAAOC,WAAW;gBAAG;gBAClEC,oBAAoB;oBAAEC,QAAQ1B,KAAK2B,KAAK;gBAAC;YAC3C;QACF;QAEA,IAAIC,OAAO,MAAMxB,QAAQyB,EAAE,CAACC,OAAO,CAAoB;YACrDjC,YAAYE,iBAAiBgC,IAAI;YACjC5B;YACAc;QACF;QAEA,IAAI,CAACW,MAAM;YACT,MAAM,IAAI/C,SAAS,2CAA2CM,WAAW6C,SAAS;QACpF;QAEA,MAAMC,sBAAsB;YAC1BlC;YACAG;YACAgC,UAAUlC,KAAKkC,QAAQ;YACvB/B;YACAyB;QACF;QAEA,4BAA4B;QAC5B,MAAM,EAAEO,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAM1C,yBAAyB;YACpDG,YAAYE;YACZmC,UAAUlC,KAAKkC,QAAQ;YACvB/B;QACF;QAEAyB,KAAKQ,IAAI,GAAGA;QACZR,KAAKO,IAAI,GAAGA;QAEZP,KAAKP,uBAAuB,GAAG,IAAIE,OAAOC,WAAW;QAErD,IAAIzB,iBAAiBW,IAAI,CAAC2B,gBAAgB,GAAG,GAAG;YAC9CT,KAAKU,SAAS,GAAG;YACjBV,KAAKW,aAAa,GAAG;QACvB;QAEA,IAAIxC,iBAAiBW,IAAI,CAAC8B,MAAM,EAAE;YAChCZ,KAAKa,SAAS,GAAGtB,QAAQS,KAAKa,SAAS;QACzC;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExC,IAAI1C,iBAAiB2C,KAAK,EAAEC,gBAAgBC,QAAQ;YAClD,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACC,cAAc,CAAE;gBACxD,MAAME,KAAK;oBACThD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAAS3C,IAAI2C,OAAO;oBACpB9C,MAAM4B;oBACNZ,WAAW;oBACXb;gBACF;YACF;QACF;QAEA,wCAAwC;QACxC,sBAAsB;QACtB,wCAAwC;QAExC,0CAA0C;QAC1CyB,KAAKmB,SAAS,GAAG,IAAIxB,OAAOC,WAAW;QAEvC,IAAIzB,iBAAiBW,IAAI,CAACsC,WAAW,EAAE;YACrCpB,KAAKqB,QAAQ,GAAG,EAAE;QACpB;QAEA,MAAMC,MAAM,MAAM9C,QAAQyB,EAAE,CAACsB,SAAS,CAAC;YACrCC,IAAIxB,KAAKwB,EAAE;YACXvD,YAAYE,iBAAiBgC,IAAI;YACjC/B,MAAM4B;YACNzB;QACF;QAEA,MAAMV,0BAA0B;YAC9ByD;YACAhB,UAAUlC,KAAKkC,QAAQ;YACvBmB,wBAAwBjD,QAAQN,MAAM,CAACY,IAAI,CAAC2C,sBAAsB;QACpE;QAEAzB,OAAOsB;QACPtB,KAAK/B,UAAU,GAAGE,iBAAiBgC,IAAI;QACvCH,KAAK0B,SAAS,GAAG;QAEjB,MAAM,EAAE3B,KAAK,EAAE,GAAG4B,SAAS,GAAG,MAAMhE,gBAAgB;YAClDQ;YACAyD,OAAO5B,KAAK4B,KAAK;YACjBrD;YACAyB;QACF;QAEAd,cAAcc;QACdf,MAAM0C,QAAQ1C,GAAG;QAEjB,wCAAwC;QACxC,2BAA2B;QAC3B,wCAAwC;QAExC,IAAId,iBAAiB2C,KAAK,EAAEe,aAAab,QAAQ;YAC/C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACe,WAAW,CAAE;gBACrD7B,OACE,AAAC,MAAMiB,KAAK;oBACVhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACbyB;gBACF,MAAOA;YACX;QACF;QAEAzB,IAAIyB,IAAI,GAAGA;QAEX,wCAAwC;QACxC,0BAA0B;QAC1B,wCAAwC;QAExC,IAAI7B,iBAAiB2C,KAAK,EAAEgB,YAAYd,QAAQ;YAC9C,KAAK,MAAMC,QAAQ9C,iBAAiB2C,KAAK,CAACgB,UAAU,CAAE;gBACpD9B,OACE,AAAC,MAAMiB,KAAK;oBACVhD,YAAYD,KAAKC,UAAU,EAAEC;oBAC7BgD,SAASlD,KAAKO,GAAG,CAAC2C,OAAO;oBACzB3C,KAAKP,KAAKO,GAAG;oBACbwB;oBACAC;gBACF,MAAOA;YACX;QACF;QAEAA,KAAM/B,UAAU,GAAGE,iBAAiBgC,IAAI;QACxCH,KAAM0B,SAAS,GAAG;QAElB,MAAMK,qBAAqB,MAAMrE,oBAAoB;YACnDO,YAAYE;YACZE,OAAOA;YACPC;YACAC;YACAyD,kBAAkB;YAClBhC,MAAMA;QACR;QAEA,IAAIb,cAAc;YAChB,MAAM7B,kBAAkBiB;QAC1B;QAEA,IAAI0D,SAA2D;YAC7DlC;YACAC,MAAM+B;QACR;QAEA,wCAAwC;QACxC,8BAA8B;QAC9B,wCAAwC;QAExCE,SAAS,MAAMlF,oBAAoB;YACjCiB;YACAC,YAAYD,KAAKC,UAAU,EAAEC;YAC7BkB,WAAW;YACXd;YACA2D;QACF;QAEA,OAAOA;IACT,EAAE,OAAOC,OAAgB;QACvB,+FAA+F;QAC/F,aAAa;QACb,IAAIjD,KAAK;YACP,MAAMrB,cAAc;gBAClBO;gBACAK;gBACAD;gBACAU;gBACAe,MAAMd;YACR;QACF;QACA,MAAMzB,gBAAgBc;QACtB,MAAM2D;IACR;AACF,EAAC;AAED;;CAEC,GACD,eAAe7B,sBAAsB,EACnClC,gBAAgB,EAChBG,cAAc,EACdgC,QAAQ,EACR/B,GAAG,EACHyB,IAAI,EAOL;IACC,MAAMmC,gBAAgBhE,iBAAiBiE,eAAe,CAACC,IAAI,CAAC,CAACC,QAAUA,MAAMC,IAAI,KAAK;IAEtF,IAAI,CAACJ,iBAAiB,CAAE,CAAA,cAAcA,aAAY,KAAM,CAACA,cAAcK,QAAQ,EAAE;QAC/E;IACF;IAEA,MAAMA,WAAWL,cAAcK,QAAQ;IACvC,MAAMC,iBAAiB;QAAE,GAAGzC,IAAI;QAAEM;IAAS;IAE3C,MAAMoC,mBAAmB,MAAMF,SAASlC,UAAU;QAChD,GAAG6B,aAAa;QAChBX,IAAIxB,KAAKwB,EAAE;QACXmB,WAAW,CAAC;QACZC,gBAAgBzE,iBAAiBgC,IAAI;QACrC/B,MAAMqE;QACNI,OAAO;QACPzD,WAAW;QACXd;QACAwE,MAAM;YAAC;SAAW;QAClBC,aAAa;YAAEC,QAAQ,CAAC;QAAE;QAC1BzE;QACA0E,aAAaR;IACf;IAEA,IAAI,OAAOC,qBAAqB,UAAU;QACxC,MAAM,IAAIvF,gBAAgB;YACxBc,YAAYE,iBAAiBgC,IAAI;YACjC+C,QAAQ;gBAAC;oBAAEC,SAAST;oBAAkBI,MAAM;gBAAW;aAAE;QAC3D;IACF;AACF"}

package/dist/auth/operations/unlock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAcjE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,EACpE,MAAM,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAqHjB,CAAA"}
+{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/unlock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,UAAU,EACX,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,sBAAsB,CAAA;AAejE,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,kBAAkB,IAAI;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,eAAe,GAAU,KAAK,SAAS,kBAAkB,QAC9D,SAAS,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,OAAO,CAwHjB,CAAA"}

package/dist/auth/operations/unlock.js

@@ -1,10 +1,10 @@
-import { status as httpStatus } from 'http-status';
 import { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js';
 import { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js';
 import { APIError } from '../../errors/index.js';
 import { combineQueries, Forbidden } from '../../index.js';
 import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js';
 import { commitTransaction } from '../../utilities/commitTransaction.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 import { executeAccess } from '../executeAccess.js';
@@ -36,6 +36,7 @@ export const unlockOperation = async (args)=>{
         // /////////////////////////////////////
         if (!overrideAccess) {
             const accessResult = await executeAccess({
+                slug: collectionConfig.slug,
                 req
             }, collectionConfig.access.unlock);
             if (accessResult && typeof accessResult === 'object') {

package/dist/auth/operations/unlock.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess({ req }, collectionConfig.access.unlock)\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","slug","result","doc","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD,SAASC,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI3B,UAAUc,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI3B,SACR,CAAC,QAAQ,EAAEc,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5ErB,WAAWkC,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMZ,qBAAqB;YAChCY;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cAAc;gBAAES;YAAI,GAAGF,iBAAiBsB,MAAM,CAACC,MAAM;YAEhF,IAAIF,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBjC,eAAeiC,iBAAiB;gBAChDV,OAAO;oBACLc,QAAQhB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBjC,eAAeiC,iBAAiB;gBAChDN,UAAU;oBACRU,QAAQX;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkB/B,uBAAuB;YACvCoC,aAAaC,QAAQ1B,iBAAiB2B,KAAK;YAC3CA,OAAO;YACPC,OAAOR;QACT;QAEA,MAAMS,OAAO,MAAM3B,IAAI4B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxClC,YAAYE,iBAAiBiC,IAAI;YACjC9B,QAAQA;YACRD;YACA0B,OAAOR;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIL,MAAM;YACR,MAAMlC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKN;gBACLC,SAAS5B,IAAI4B,OAAO;gBACpB5B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI9C,UAAUc,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM7B,kBAAkBY;QAC1B;QAEAgC,SAAS,MAAMlD,oBAAoB;YACjCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOR,QAAQQ;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/unlock.ts"],"sourcesContent":["import type {\n  AuthOperationsFromCollectionSlug,\n  Collection,\n} from '../../collections/config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { PayloadRequest, Where } from '../../types/index.js'\n\nimport { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'\nimport { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'\nimport { APIError } from '../../errors/index.js'\nimport { combineQueries, Forbidden } from '../../index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\nimport { executeAccess } from '../executeAccess.js'\nimport { getLoginOptions } from '../getLoginOptions.js'\nimport { resetLoginAttempts } from '../strategies/local/resetLoginAttempts.js'\n\nexport type Arguments<TSlug extends AuthCollectionSlug> = {\n  collection: Collection\n  data: AuthOperationsFromCollectionSlug<TSlug>['unlock']\n  overrideAccess?: boolean\n  req: PayloadRequest\n}\n\nexport const unlockOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<boolean> => {\n  const {\n    collection: { config: collectionConfig },\n    overrideAccess,\n    req: { locale },\n    req,\n  } = args\n\n  const loginWithUsername = collectionConfig.auth.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  const sanitizedEmail = canLoginWithEmail && (args.data?.email || '').toLowerCase().trim()\n  const sanitizedUsername =\n    (canLoginWithUsername &&\n      'username' in args.data &&\n      typeof args.data.username === 'string' &&\n      args.data.username.toLowerCase().trim()) ||\n    null\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!sanitizedEmail && !sanitizedUsername) {\n    throw new APIError(\n      `Missing ${collectionConfig.auth.loginWithUsername ? 'username' : 'email'}.`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  try {\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n    })\n\n    const shouldCommit = await initTransaction(req)\n    let whereConstraint: Where = {}\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    if (!overrideAccess) {\n      const accessResult = await executeAccess(\n        { slug: collectionConfig.slug, req },\n        collectionConfig.access.unlock,\n      )\n\n      if (accessResult && typeof accessResult === 'object') {\n        whereConstraint = accessResult\n      }\n    }\n\n    // /////////////////////////////////////\n    // Unlock\n    // /////////////////////////////////////\n\n    if (canLoginWithEmail && sanitizedEmail) {\n      whereConstraint = combineQueries(whereConstraint, {\n        email: {\n          equals: sanitizedEmail,\n        },\n      })\n    } else if (canLoginWithUsername && sanitizedUsername) {\n      whereConstraint = combineQueries(whereConstraint, {\n        username: {\n          equals: sanitizedUsername,\n        },\n      })\n    }\n\n    // Exclude trashed users unless `trash: true`\n    whereConstraint = appendNonTrashedFilter({\n      enableTrash: Boolean(collectionConfig.trash),\n      trash: false,\n      where: whereConstraint,\n    })\n\n    const user = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: locale!,\n      req,\n      where: whereConstraint,\n    })\n\n    let result: boolean | null = null\n\n    if (user) {\n      await resetLoginAttempts({\n        collection: collectionConfig,\n        doc: user,\n        payload: req.payload,\n        req,\n      })\n      result = true\n    } else {\n      result = null\n      throw new Forbidden(req.t)\n    }\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    result = await buildAfterOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'unlock',\n      overrideAccess,\n      result,\n    })\n\n    return Boolean(result)\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["buildAfterOperation","buildBeforeOperation","APIError","combineQueries","Forbidden","appendNonTrashedFilter","commitTransaction","httpStatus","initTransaction","killTransaction","executeAccess","getLoginOptions","resetLoginAttempts","unlockOperation","args","collection","config","collectionConfig","overrideAccess","req","locale","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","sanitizedEmail","data","email","toLowerCase","trim","sanitizedUsername","username","disableLocalStrategy","t","BAD_REQUEST","operation","shouldCommit","whereConstraint","accessResult","slug","access","unlock","equals","enableTrash","Boolean","trash","where","user","payload","db","findOne","result","doc","error"],"mappings":"AAOA,SAASA,mBAAmB,QAAQ,gEAA+D;AACnG,SAASC,oBAAoB,QAAQ,iEAAgE;AACrG,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,cAAc,EAAEC,SAAS,QAAQ,iBAAgB;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,sBAAqB;AACnD,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,kBAAkB,QAAQ,4CAA2C;AAS9E,OAAO,MAAMC,kBAAkB,OAC7BC;IAEA,MAAM,EACJC,YAAY,EAAEC,QAAQC,gBAAgB,EAAE,EACxCC,cAAc,EACdC,KAAK,EAAEC,MAAM,EAAE,EACfD,GAAG,EACJ,GAAGL;IAEJ,MAAMO,oBAAoBJ,iBAAiBK,IAAI,CAACD,iBAAiB;IAEjE,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGb,gBAAgBU;IAEpE,MAAMI,iBAAiBF,qBAAqB,AAACT,CAAAA,KAAKY,IAAI,EAAEC,SAAS,EAAC,EAAGC,WAAW,GAAGC,IAAI;IACvF,MAAMC,oBACJ,AAACN,wBACC,cAAcV,KAAKY,IAAI,IACvB,OAAOZ,KAAKY,IAAI,CAACK,QAAQ,KAAK,YAC9BjB,KAAKY,IAAI,CAACK,QAAQ,CAACH,WAAW,GAAGC,IAAI,MACvC;IAEF,IAAIZ,iBAAiBK,IAAI,CAACU,oBAAoB,EAAE;QAC9C,MAAM,IAAI5B,UAAUe,IAAIc,CAAC;IAC3B;IACA,IAAI,CAACR,kBAAkB,CAACK,mBAAmB;QACzC,MAAM,IAAI5B,SACR,CAAC,QAAQ,EAAEe,iBAAiBK,IAAI,CAACD,iBAAiB,GAAG,aAAa,QAAQ,CAAC,CAAC,EAC5Ed,WAAW2B,WAAW;IAE1B;IAEA,IAAI;QACFpB,OAAO,MAAMb,qBAAqB;YAChCa;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;QACF;QAEA,MAAMkB,eAAe,MAAM5B,gBAAgBW;QAC3C,IAAIkB,kBAAyB,CAAC;QAE9B,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAI,CAACnB,gBAAgB;YACnB,MAAMoB,eAAe,MAAM5B,cACzB;gBAAE6B,MAAMtB,iBAAiBsB,IAAI;gBAAEpB;YAAI,GACnCF,iBAAiBuB,MAAM,CAACC,MAAM;YAGhC,IAAIH,gBAAgB,OAAOA,iBAAiB,UAAU;gBACpDD,kBAAkBC;YACpB;QACF;QAEA,wCAAwC;QACxC,SAAS;QACT,wCAAwC;QAExC,IAAIf,qBAAqBE,gBAAgB;YACvCY,kBAAkBlC,eAAekC,iBAAiB;gBAChDV,OAAO;oBACLe,QAAQjB;gBACV;YACF;QACF,OAAO,IAAID,wBAAwBM,mBAAmB;YACpDO,kBAAkBlC,eAAekC,iBAAiB;gBAChDN,UAAU;oBACRW,QAAQZ;gBACV;YACF;QACF;QAEA,6CAA6C;QAC7CO,kBAAkBhC,uBAAuB;YACvCsC,aAAaC,QAAQ3B,iBAAiB4B,KAAK;YAC3CA,OAAO;YACPC,OAAOT;QACT;QAEA,MAAMU,OAAO,MAAM5B,IAAI6B,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;YACxCnC,YAAYE,iBAAiBsB,IAAI;YACjCnB,QAAQA;YACRD;YACA2B,OAAOT;QACT;QAEA,IAAIc,SAAyB;QAE7B,IAAIJ,MAAM;YACR,MAAMnC,mBAAmB;gBACvBG,YAAYE;gBACZmC,KAAKL;gBACLC,SAAS7B,IAAI6B,OAAO;gBACpB7B;YACF;YACAgC,SAAS;QACX,OAAO;YACLA,SAAS;YACT,MAAM,IAAI/C,UAAUe,IAAIc,CAAC;QAC3B;QAEA,IAAIG,cAAc;YAChB,MAAM9B,kBAAkBa;QAC1B;QAEAgC,SAAS,MAAMnD,oBAAoB;YACjCc;YACAC,YAAYD,KAAKC,UAAU,CAACC,MAAM;YAClCmB,WAAW;YACXjB;YACAiC;QACF;QAEA,OAAOP,QAAQO;IACjB,EAAE,OAAOE,OAAgB;QACvB,MAAM5C,gBAAgBU;QACtB,MAAMkC;IACR;AACF,EAAC"}

package/dist/auth/operations/verifyEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyEmail.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/verifyEmail.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D,MAAM,MAAM,IAAI,GAAG;IACjB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAU,MAAM,IAAI,KAAG,OAAO,CAAC,OAAO,CAuDtE,CAAA"}
+{"version":3,"file":"verifyEmail.d.ts","sourceRoot":"","sources":["../../../src/auth/operations/verifyEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAU1D,MAAM,MAAM,IAAI,GAAG;IACjB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,eAAO,MAAM,oBAAoB,SAAgB,IAAI,KAAG,OAAO,CAAC,OAAO,CAyDtE,CAAA"}

package/dist/auth/operations/verifyEmail.js

@@ -1,11 +1,13 @@
-import { status as httpStatus } from 'http-status';
 import { APIError, Forbidden } from '../../errors/index.js';
 import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js';
+import { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js';
 import { commitTransaction } from '../../utilities/commitTransaction.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { initTransaction } from '../../utilities/initTransaction.js';
 import { killTransaction } from '../../utilities/killTransaction.js';
 export const verifyEmailOperation = async (args)=>{
     const { collection, req, token } = args;
+    assertNoValidationWrite(req);
     if (collection.config.auth.disableLocalStrategy) {
         throw new Forbidden(req.t);
     }

package/dist/auth/operations/verifyEmail.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/operations/verifyEmail.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\n\nexport type Args = {\n  collection: Collection\n  req: PayloadRequest\n  token: string\n}\n\nexport const verifyEmailOperation = async (args: Args): Promise<boolean> => {\n  const { collection, req, token } = args\n\n  if (collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!Object.prototype.hasOwnProperty.call(args, 'token')) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collection.config.trash),\n      trash: false,\n      where: {\n        _verificationToken: { equals: token },\n      },\n    })\n\n    const user = await req.payload.db.findOne<any>({\n      collection: collection.config.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Verification token is invalid.', httpStatus.FORBIDDEN)\n    }\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    await req.payload.db.updateOne({\n      id: user.id,\n      collection: collection.config.slug,\n      data: {\n        ...user,\n        _verificationToken: null,\n        _verified: true,\n      },\n      req,\n      returning: false,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return true\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["status","httpStatus","APIError","Forbidden","appendNonTrashedFilter","commitTransaction","initTransaction","killTransaction","verifyEmailOperation","args","collection","req","token","config","auth","disableLocalStrategy","t","Object","prototype","hasOwnProperty","call","BAD_REQUEST","shouldCommit","where","enableTrash","Boolean","trash","_verificationToken","equals","user","payload","db","findOne","slug","FORBIDDEN","updatedAt","Date","toISOString","updateOne","id","data","_verified","returning","error"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAKlD,SAASC,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AAQpE,OAAO,MAAMC,uBAAuB,OAAOC;IACzC,MAAM,EAAEC,UAAU,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGH;IAEnC,IAAIC,WAAWG,MAAM,CAACC,IAAI,CAACC,oBAAoB,EAAE;QAC/C,MAAM,IAAIZ,UAAUQ,IAAIK,CAAC;IAC3B;IACA,IAAI,CAACC,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACX,MAAM,UAAU;QACxD,MAAM,IAAIP,SAAS,0BAA0BD,WAAWoB,WAAW;IACrE;IAEA,IAAI;QACF,MAAMC,eAAe,MAAMhB,gBAAgBK;QAE3C,MAAMY,QAAQnB,uBAAuB;YACnCoB,aAAaC,QAAQf,WAAWG,MAAM,CAACa,KAAK;YAC5CA,OAAO;YACPH,OAAO;gBACLI,oBAAoB;oBAAEC,QAAQhB;gBAAM;YACtC;QACF;QAEA,MAAMiB,OAAO,MAAMlB,IAAImB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAM;YAC7CtB,YAAYA,WAAWG,MAAM,CAACoB,IAAI;YAClCtB;YACAY;QACF;QAEA,IAAI,CAACM,MAAM;YACT,MAAM,IAAI3B,SAAS,kCAAkCD,WAAWiC,SAAS;QAC3E;QAEA,0CAA0C;QAC1CL,KAAKM,SAAS,GAAG,IAAIC,OAAOC,WAAW;QAEvC,MAAM1B,IAAImB,OAAO,CAACC,EAAE,CAACO,SAAS,CAAC;YAC7BC,IAAIV,KAAKU,EAAE;YACX7B,YAAYA,WAAWG,MAAM,CAACoB,IAAI;YAClCO,MAAM;gBACJ,GAAGX,IAAI;gBACPF,oBAAoB;gBACpBc,WAAW;YACb;YACA9B;YACA+B,WAAW;QACb;QAEA,IAAIpB,cAAc;YAChB,MAAMjB,kBAAkBM;QAC1B;QAEA,OAAO;IACT,EAAE,OAAOgC,OAAgB;QACvB,MAAMpC,gBAAgBI;QACtB,MAAMgC;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../../src/auth/operations/verifyEmail.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { APIError, Forbidden } from '../../errors/index.js'\nimport { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'\nimport { assertNoValidationWrite } from '../../utilities/assertNoValidationWrite.js'\nimport { commitTransaction } from '../../utilities/commitTransaction.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { initTransaction } from '../../utilities/initTransaction.js'\nimport { killTransaction } from '../../utilities/killTransaction.js'\n\nexport type Args = {\n  collection: Collection\n  req: PayloadRequest\n  token: string\n}\n\nexport const verifyEmailOperation = async (args: Args): Promise<boolean> => {\n  const { collection, req, token } = args\n\n  assertNoValidationWrite(req)\n\n  if (collection.config.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n  if (!Object.prototype.hasOwnProperty.call(args, 'token')) {\n    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)\n  }\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(collection.config.trash),\n      trash: false,\n      where: {\n        _verificationToken: { equals: token },\n      },\n    })\n\n    const user = await req.payload.db.findOne<any>({\n      collection: collection.config.slug,\n      req,\n      where,\n    })\n\n    if (!user) {\n      throw new APIError('Verification token is invalid.', httpStatus.FORBIDDEN)\n    }\n\n    // Ensure updatedAt date is always updated\n    user.updatedAt = new Date().toISOString()\n\n    await req.payload.db.updateOne({\n      id: user.id,\n      collection: collection.config.slug,\n      data: {\n        ...user,\n        _verificationToken: null,\n        _verified: true,\n      },\n      req,\n      returning: false,\n    })\n\n    if (shouldCommit) {\n      await commitTransaction(req)\n    }\n\n    return true\n  } catch (error: unknown) {\n    await killTransaction(req)\n    throw error\n  }\n}\n"],"names":["APIError","Forbidden","appendNonTrashedFilter","assertNoValidationWrite","commitTransaction","httpStatus","initTransaction","killTransaction","verifyEmailOperation","args","collection","req","token","config","auth","disableLocalStrategy","t","Object","prototype","hasOwnProperty","call","BAD_REQUEST","shouldCommit","where","enableTrash","Boolean","trash","_verificationToken","equals","user","payload","db","findOne","slug","FORBIDDEN","updatedAt","Date","toISOString","updateOne","id","data","_verified","returning","error"],"mappings":"AAGA,SAASA,QAAQ,EAAEC,SAAS,QAAQ,wBAAuB;AAC3D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,uBAAuB,QAAQ,6CAA4C;AACpF,SAASC,iBAAiB,QAAQ,uCAAsC;AACxE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,qCAAoC;AAQpE,OAAO,MAAMC,uBAAuB,OAAOC;IACzC,MAAM,EAAEC,UAAU,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGH;IAEnCN,wBAAwBQ;IAExB,IAAID,WAAWG,MAAM,CAACC,IAAI,CAACC,oBAAoB,EAAE;QAC/C,MAAM,IAAId,UAAUU,IAAIK,CAAC;IAC3B;IACA,IAAI,CAACC,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACX,MAAM,UAAU;QACxD,MAAM,IAAIT,SAAS,0BAA0BK,WAAWgB,WAAW;IACrE;IAEA,IAAI;QACF,MAAMC,eAAe,MAAMhB,gBAAgBK;QAE3C,MAAMY,QAAQrB,uBAAuB;YACnCsB,aAAaC,QAAQf,WAAWG,MAAM,CAACa,KAAK;YAC5CA,OAAO;YACPH,OAAO;gBACLI,oBAAoB;oBAAEC,QAAQhB;gBAAM;YACtC;QACF;QAEA,MAAMiB,OAAO,MAAMlB,IAAImB,OAAO,CAACC,EAAE,CAACC,OAAO,CAAM;YAC7CtB,YAAYA,WAAWG,MAAM,CAACoB,IAAI;YAClCtB;YACAY;QACF;QAEA,IAAI,CAACM,MAAM;YACT,MAAM,IAAI7B,SAAS,kCAAkCK,WAAW6B,SAAS;QAC3E;QAEA,0CAA0C;QAC1CL,KAAKM,SAAS,GAAG,IAAIC,OAAOC,WAAW;QAEvC,MAAM1B,IAAImB,OAAO,CAACC,EAAE,CAACO,SAAS,CAAC;YAC7BC,IAAIV,KAAKU,EAAE;YACX7B,YAAYA,WAAWG,MAAM,CAACoB,IAAI;YAClCO,MAAM;gBACJ,GAAGX,IAAI;gBACPF,oBAAoB;gBACpBc,WAAW;YACb;YACA9B;YACA+B,WAAW;QACb;QAEA,IAAIpB,cAAc;YAChB,MAAMlB,kBAAkBO;QAC1B;QAEA,OAAO;IACT,EAAE,OAAOgC,OAAgB;QACvB,MAAMpC,gBAAgBI;QACtB,MAAMgC;IACR;AACF,EAAC"}

package/dist/auth/rotateSecret.d.ts

@@ -0,0 +1,51 @@
+import type { CollectionSlug, Payload } from '../index.js';
+export type RotateSecretArgs = {
+    /**
+     * Number of documents to process per batch.
+     * @default 100
+     */
+    batchSize?: number;
+    /**
+     * Limit rotation to these collection slugs. Defaults to every auth collection
+     * configured with `useAPIKey`.
+     */
+    collections?: CollectionSlug[];
+    /**
+     * When true, verifies every row against the old and current secrets without
+     * writing. Run this first to confirm `oldSecret` is correct.
+     * @default false
+     */
+    dryRun?: boolean;
+    /**
+     * The previous raw `PAYLOAD_SECRET` that existing data was encrypted under.
+     */
+    oldSecret: string;
+    payload: Payload;
+};
+export type RotateSecretResult = {
+    /** Documents re-keyed from the old secret to the current secret. */
+    migrated: number;
+    /** Documents already encrypted under the current secret (safe re-run). */
+    skipped: number;
+};
+/**
+ * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous
+ * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.
+ *
+ * Operates at the database-adapter layer to bypass the `apiKey` field's
+ * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).
+ *
+ * Each document is verified against the old and current secrets before it is
+ * written, so the run is:
+ * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC
+ *   index), so it is safe to run repeatedly;
+ * - **fail-closed** — a row that matches neither the old nor the current secret
+ *   throws and aborts the run before that row is written. Rows already migrated
+ *   earlier in the same run remain migrated and are safe to keep: fix the secret
+ *   and re-run.
+ *
+ * Password logins are unaffected by a secret rotation, and active JWT sessions
+ * are invalidated by design. See the "Rotating your PAYLOAD_SECRET" docs.
+ */
+export declare const rotateSecret: ({ batchSize, collections, dryRun, oldSecret, payload, }: RotateSecretArgs) => Promise<RotateSecretResult>;
+//# sourceMappingURL=rotateSecret.d.ts.map

package/dist/auth/rotateSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotateSecret.d.ts","sourceRoot":"","sources":["../../src/auth/rotateSecret.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAI1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,4DAMtB,gBAAgB,KAAG,OAAO,CAAC,kBAAkB,CA4F/C,CAAA"}

package/dist/auth/rotateSecret.js

@@ -0,0 +1,131 @@
+import crypto from 'crypto';
+import { deriveSecretKey } from './crypto.js';
+/**
+ * Re-keys the built-in `apiKey`/`apiKeyIndex` fields from a previous
+ * `PAYLOAD_SECRET` to the current one, for every auth collection using API keys.
+ *
+ * Operates at the database-adapter layer to bypass the `apiKey` field's
+ * encrypt/decrypt hooks (which would otherwise corrupt data mid-rotation).
+ *
+ * Each document is verified against the old and current secrets before it is
+ * written, so the run is:
+ * - **idempotent** — a re-run skips already-migrated rows (matched via the HMAC
+ *   index), so it is safe to run repeatedly;
+ * - **fail-closed** — a row that matches neither the old nor the current secret
+ *   throws and aborts the run before that row is written. Rows already migrated
+ *   earlier in the same run remain migrated and are safe to keep: fix the secret
+ *   and re-run.
+ *
+ * Password logins are unaffected by a secret rotation, and active JWT sessions
+ * are invalidated by design. See the "Rotating your PAYLOAD_SECRET" docs.
+ */ export const rotateSecret = async ({ batchSize = 100, collections, dryRun = false, oldSecret, payload })=>{
+    const oldDerivedKey = deriveSecretKey(oldSecret);
+    const newDerivedKey = payload.secret;
+    const result = {
+        migrated: 0,
+        skipped: 0
+    };
+    if (oldDerivedKey === newDerivedKey) {
+        payload.logger.warn('rotateSecret: oldSecret matches the current secret - nothing to rotate. Did you forget to set the new PAYLOAD_SECRET?');
+        return result;
+    }
+    const targetSlugs = (collections ?? Object.keys(payload.collections)).filter((slug)=>payload.collections[slug]?.config.auth?.useAPIKey);
+    for (const slug of targetSlugs){
+        let page = 1;
+        let hasNextPage = true;
+        while(hasNextPage){
+            const { docs, hasNextPage: nextPage } = await payload.db.find({
+                collection: slug,
+                limit: batchSize,
+                page,
+                pagination: true,
+                sort: 'id',
+                // Only rows with a lookup index need re-keying. A row can have `apiKey`
+                // ciphertext but a null `apiKeyIndex` (e.g. after unchecking "Enable API
+                // Key"); those are never used for auth, so skip them.
+                where: {
+                    and: [
+                        {
+                            apiKey: {
+                                exists: true
+                            }
+                        },
+                        {
+                            apiKeyIndex: {
+                                exists: true
+                            }
+                        }
+                    ]
+                }
+            });
+            for (const doc of docs){
+                const storedApiKey = doc.apiKey;
+                const storedIndex = doc.apiKeyIndex;
+                if (!storedApiKey || !storedIndex) {
+                    continue;
+                }
+                // The v1 (aes-256-gcm) envelope throws on a wrong key; legacy aes-256-ctr
+                // returns garbage. Either way the HMAC-index check is the source of truth,
+                // so treat a decrypt failure as "does not match this secret".
+                const rawFromOld = tryDecrypt({
+                    hash: storedApiKey,
+                    payload,
+                    secret: oldSecret
+                });
+                if (rawFromOld !== undefined && apiKeyIndexHmac({
+                    derivedKey: oldDerivedKey,
+                    rawApiKey: rawFromOld
+                }) === storedIndex) {
+                    if (!dryRun) {
+                        await payload.db.updateOne({
+                            id: doc.id,
+                            collection: slug,
+                            data: {
+                                apiKey: payload.encrypt(rawFromOld),
+                                apiKeyIndex: apiKeyIndexHmac({
+                                    derivedKey: newDerivedKey,
+                                    rawApiKey: rawFromOld
+                                })
+                            },
+                            returning: false
+                        });
+                    }
+                    result.migrated++;
+                    continue;
+                }
+                // Confirm the row is already on the current secret (safe re-run).
+                const rawFromNew = tryDecrypt({
+                    hash: storedApiKey,
+                    payload
+                });
+                if (rawFromNew !== undefined && apiKeyIndexHmac({
+                    derivedKey: newDerivedKey,
+                    rawApiKey: rawFromNew
+                }) === storedIndex) {
+                    result.skipped++;
+                    continue;
+                }
+                throw new Error(`rotateSecret: could not verify apiKey for collection "${slug}" id "${String(doc.id)}" against the provided oldSecret or the current secret. Aborting; rows already migrated in this run are safe to keep - fix the secret and re-run.`);
+            }
+            hasNextPage = Boolean(nextPage);
+            page++;
+        }
+    }
+    return result;
+};
+const apiKeyIndexHmac = ({ derivedKey, rawApiKey })=>crypto.createHmac('sha256', derivedKey).update(rawApiKey).digest('hex');
+/**
+ * Decrypts with the given secret (or the active secret), returning `undefined`
+ * instead of throwing when the value cannot be decrypted (wrong-key v1 values
+ * throw; the caller relies on the HMAC index to decide correctness).
+ */ const tryDecrypt = ({ hash, payload, secret })=>{
+    try {
+        return secret ? payload.decrypt(hash, {
+            secret
+        }) : payload.decrypt(hash);
+    } catch  {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=rotateSecret.js.map