payload 4.0.0-internal.fa345ef → 4.0.0-internal.ff27d6e

package/dist/auth/strategies/local/generatePasswordSaltHash.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { PayloadRequest } from '../../../types/index.js'\n\nimport { ValidationError } from '../../../errors/index.js'\nimport { password } from '../../../fields/validations.js'\n\nfunction randomBytes(): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.randomBytes(32, (err, saltBuffer) => (err ? reject(err) : resolve(saltBuffer))),\n  )\n}\n\nfunction pbkdf2Promisified(password: string, salt: string): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.pbkdf2(password, salt, 25000, 512, 'sha256', (err, hashRaw) =>\n      err ? reject(err) : resolve(hashRaw),\n    ),\n  )\n}\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  password: string\n  req: PayloadRequest\n}\n\nexport const generatePasswordSaltHash = async ({\n  collection,\n  password: passwordToSet,\n  req,\n}: Args): Promise<{ hash: string; salt: string }> => {\n  const validationResult = password(passwordToSet, {\n    name: 'password',\n    type: 'text',\n    blockData: {},\n    data: {},\n    event: 'submit',\n    path: ['password'],\n    preferences: { fields: {} },\n    req,\n    required: true,\n    siblingData: {},\n  })\n\n  if (typeof validationResult === 'string') {\n    throw new ValidationError({\n      collection: collection?.slug,\n      errors: [{ message: validationResult, path: 'password' }],\n    })\n  }\n\n  const saltBuffer = await randomBytes()\n  const salt = saltBuffer.toString('hex')\n\n  const hashRaw = await pbkdf2Promisified(passwordToSet, salt)\n  const hash = hashRaw.toString('hex')\n\n  return { hash, salt }\n}\n"],"names":["crypto","ValidationError","password","randomBytes","Promise","resolve","reject","err","saltBuffer","pbkdf2Promisified","salt","pbkdf2","hashRaw","generatePasswordSaltHash","collection","passwordToSet","req","validationResult","name","type","blockData","data","event","path","preferences","fields","required","siblingData","slug","errors","message","toString","hash"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAK3B,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,QAAQ,QAAQ,iCAAgC;AAEzD,SAASC;IACP,OAAO,IAAIC,QAAQ,CAACC,SAASC,SAC3BN,OAAOG,WAAW,CAAC,IAAI,CAACI,KAAKC,aAAgBD,MAAMD,OAAOC,OAAOF,QAAQG;AAE7E;AAEA,SAASC,kBAAkBP,QAAgB,EAAEQ,IAAY;IACvD,OAAO,IAAIN,QAAQ,CAACC,SAASC,SAC3BN,OAAOW,MAAM,CAACT,UAAUQ,MAAM,OAAO,KAAK,UAAU,CAACH,KAAKK,UACxDL,MAAMD,OAAOC,OAAOF,QAAQO;AAGlC;AAQA,OAAO,MAAMC,2BAA2B,OAAO,EAC7CC,UAAU,EACVZ,UAAUa,aAAa,EACvBC,GAAG,EACE;IACL,MAAMC,mBAAmBf,SAASa,eAAe;QAC/CG,MAAM;QACNC,MAAM;QACNC,WAAW,CAAC;QACZC,MAAM,CAAC;QACPC,OAAO;QACPC,MAAM;YAAC;SAAW;QAClBC,aAAa;YAAEC,QAAQ,CAAC;QAAE;QAC1BT;QACAU,UAAU;QACVC,aAAa,CAAC;IAChB;IAEA,IAAI,OAAOV,qBAAqB,UAAU;QACxC,MAAM,IAAIhB,gBAAgB;YACxBa,YAAYA,YAAYc;YACxBC,QAAQ;gBAAC;oBAAEC,SAASb;oBAAkBM,MAAM;gBAAW;aAAE;QAC3D;IACF;IAEA,MAAMf,aAAa,MAAML;IACzB,MAAMO,OAAOF,WAAWuB,QAAQ,CAAC;IAEjC,MAAMnB,UAAU,MAAMH,kBAAkBM,eAAeL;IACvD,MAAMsB,OAAOpB,QAAQmB,QAAQ,CAAC;IAE9B,OAAO;QAAEC;QAAMtB;IAAK;AACtB,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/generatePasswordSaltHash.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { SanitizedConfig } from '../../../config/types.js'\nimport type { PayloadRequest } from '../../../types/index.js'\n\nimport { InvalidConfiguration, ValidationError } from '../../../errors/index.js'\nimport { password } from '../../../fields/validations.js'\n\ntype PasswordHashParameters = {\n  hash: string\n  iterations: number\n  keyLength: number\n}\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  isPasswordAuthenticated?: boolean\n  password: string\n  req: PayloadRequest\n}\n\ntype PasswordHashIterations = SanitizedConfig['auth']['passwordHashIterations']\n\n// Each supported iteration count has its own fixed prefix, so a stored hash\n// can be verified whichever count is configured\nconst passwordHashPrefixes: Record<PasswordHashIterations, string> = {\n  100000: 'pbkdf2-sha256-100k-v1:',\n  600000: 'pbkdf2-sha256-v1:',\n}\nexport const supportedPasswordHashIterations = Object.keys(passwordHashPrefixes).map(Number)\nconst passwordHashKeyLength = 32\nconst legacyPasswordHashIterations = 25000\nconst legacyPasswordHashKeyLength = 512\n\nexport const generatePasswordSaltHash = async ({\n  collection,\n  isPasswordAuthenticated,\n  password: passwordToSet,\n  req,\n}: Args): Promise<{ hash: string; salt: string }> => {\n  if (!isPasswordAuthenticated) {\n    const validationResult = password(passwordToSet, {\n      name: 'password',\n      type: 'text',\n      blockData: {},\n      data: {},\n      event: 'submit',\n      path: ['password'],\n      preferences: { fields: {} },\n      req,\n      required: true,\n      siblingData: {},\n    })\n\n    if (typeof validationResult === 'string') {\n      throw new ValidationError({\n        collection: collection?.slug,\n        errors: [{ message: validationResult, path: 'password' }],\n      })\n    }\n  }\n\n  const { passwordHashIterations } = req.payload.config.auth\n  const saltBuffer = await randomBytes()\n  const salt = saltBuffer.toString('hex')\n\n  const hashRaw = await pbkdf2Promisified({\n    iterations: passwordHashIterations,\n    keyLength: passwordHashKeyLength,\n    password: passwordToSet,\n    salt,\n  }).catch((err: unknown) => {\n    if (isUnsupportedIterationsError(err)) {\n      const configHint =\n        passwordHashIterations === 100000\n          ? ''\n          : ' Set `auth.passwordHashIterations` to 100000 in your Payload Config.'\n\n      throw new InvalidConfiguration(\n        `This environment does not support ${passwordHashIterations} PBKDF2 iterations for password hashing.${configHint}`,\n      )\n    }\n\n    throw err\n  })\n  const hash = `${passwordHashPrefixes[passwordHashIterations]}${hashRaw.toString('hex')}`\n\n  return { hash, salt }\n}\n\nexport const getPasswordHashParameters = (hash: string): PasswordHashParameters => {\n  for (const [iterations, prefix] of Object.entries(passwordHashPrefixes)) {\n    if (hash.startsWith(prefix)) {\n      return {\n        hash: hash.slice(prefix.length),\n        iterations: Number(iterations),\n        keyLength: passwordHashKeyLength,\n      }\n    }\n  }\n\n  return {\n    hash,\n    iterations: legacyPasswordHashIterations,\n    keyLength: legacyPasswordHashKeyLength,\n  }\n}\n\nexport const isCurrentPasswordHash = ({\n  hash,\n  passwordHashIterations,\n}: {\n  hash: string\n  passwordHashIterations: PasswordHashIterations\n}): boolean => hash.startsWith(passwordHashPrefixes[passwordHashIterations])\n\nfunction randomBytes(): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.randomBytes(32, (err, saltBuffer) => (err ? reject(err) : resolve(saltBuffer))),\n  )\n}\n\n// Environments such as Cloudflare Workers reject iteration counts above their limit\nexport const isUnsupportedIterationsError = (err: unknown): boolean =>\n  err instanceof Error && err.name === 'NotSupportedError'\n\nexport function pbkdf2Promisified({\n  iterations,\n  keyLength,\n  password,\n  salt,\n}: {\n  iterations: number\n  keyLength: number\n  password: string\n  salt: string\n}): Promise<Buffer> {\n  return new Promise((resolve, reject) =>\n    crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (err, hashRaw) =>\n      err ? reject(err) : resolve(hashRaw),\n    ),\n  )\n}\n"],"names":["crypto","InvalidConfiguration","ValidationError","password","passwordHashPrefixes","supportedPasswordHashIterations","Object","keys","map","Number","passwordHashKeyLength","legacyPasswordHashIterations","legacyPasswordHashKeyLength","generatePasswordSaltHash","collection","isPasswordAuthenticated","passwordToSet","req","validationResult","name","type","blockData","data","event","path","preferences","fields","required","siblingData","slug","errors","message","passwordHashIterations","payload","config","auth","saltBuffer","randomBytes","salt","toString","hashRaw","pbkdf2Promisified","iterations","keyLength","catch","err","isUnsupportedIterationsError","configHint","hash","getPasswordHashParameters","prefix","entries","startsWith","slice","length","isCurrentPasswordHash","Promise","resolve","reject","Error","pbkdf2"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAM3B,SAASC,oBAAoB,EAAEC,eAAe,QAAQ,2BAA0B;AAChF,SAASC,QAAQ,QAAQ,iCAAgC;AAiBzD,4EAA4E;AAC5E,gDAAgD;AAChD,MAAMC,uBAA+D;IACnE,QAAQ;IACR,QAAQ;AACV;AACA,OAAO,MAAMC,kCAAkCC,OAAOC,IAAI,CAACH,sBAAsBI,GAAG,CAACC,QAAO;AAC5F,MAAMC,wBAAwB;AAC9B,MAAMC,+BAA+B;AACrC,MAAMC,8BAA8B;AAEpC,OAAO,MAAMC,2BAA2B,OAAO,EAC7CC,UAAU,EACVC,uBAAuB,EACvBZ,UAAUa,aAAa,EACvBC,GAAG,EACE;IACL,IAAI,CAACF,yBAAyB;QAC5B,MAAMG,mBAAmBf,SAASa,eAAe;YAC/CG,MAAM;YACNC,MAAM;YACNC,WAAW,CAAC;YACZC,MAAM,CAAC;YACPC,OAAO;YACPC,MAAM;gBAAC;aAAW;YAClBC,aAAa;gBAAEC,QAAQ,CAAC;YAAE;YAC1BT;YACAU,UAAU;YACVC,aAAa,CAAC;QAChB;QAEA,IAAI,OAAOV,qBAAqB,UAAU;YACxC,MAAM,IAAIhB,gBAAgB;gBACxBY,YAAYA,YAAYe;gBACxBC,QAAQ;oBAAC;wBAAEC,SAASb;wBAAkBM,MAAM;oBAAW;iBAAE;YAC3D;QACF;IACF;IAEA,MAAM,EAAEQ,sBAAsB,EAAE,GAAGf,IAAIgB,OAAO,CAACC,MAAM,CAACC,IAAI;IAC1D,MAAMC,aAAa,MAAMC;IACzB,MAAMC,OAAOF,WAAWG,QAAQ,CAAC;IAEjC,MAAMC,UAAU,MAAMC,kBAAkB;QACtCC,YAAYV;QACZW,WAAWjC;QACXP,UAAUa;QACVsB;IACF,GAAGM,KAAK,CAAC,CAACC;QACR,IAAIC,6BAA6BD,MAAM;YACrC,MAAME,aACJf,2BAA2B,SACvB,KACA;YAEN,MAAM,IAAI/B,qBACR,CAAC,kCAAkC,EAAE+B,uBAAuB,wCAAwC,EAAEe,YAAY;QAEtH;QAEA,MAAMF;IACR;IACA,MAAMG,OAAO,GAAG5C,oBAAoB,CAAC4B,uBAAuB,GAAGQ,QAAQD,QAAQ,CAAC,QAAQ;IAExF,OAAO;QAAES;QAAMV;IAAK;AACtB,EAAC;AAED,OAAO,MAAMW,4BAA4B,CAACD;IACxC,KAAK,MAAM,CAACN,YAAYQ,OAAO,IAAI5C,OAAO6C,OAAO,CAAC/C,sBAAuB;QACvE,IAAI4C,KAAKI,UAAU,CAACF,SAAS;YAC3B,OAAO;gBACLF,MAAMA,KAAKK,KAAK,CAACH,OAAOI,MAAM;gBAC9BZ,YAAYjC,OAAOiC;gBACnBC,WAAWjC;YACb;QACF;IACF;IAEA,OAAO;QACLsC;QACAN,YAAY/B;QACZgC,WAAW/B;IACb;AACF,EAAC;AAED,OAAO,MAAM2C,wBAAwB,CAAC,EACpCP,IAAI,EACJhB,sBAAsB,EAIvB,GAAcgB,KAAKI,UAAU,CAAChD,oBAAoB,CAAC4B,uBAAuB,EAAC;AAE5E,SAASK;IACP,OAAO,IAAImB,QAAQ,CAACC,SAASC,SAC3B1D,OAAOqC,WAAW,CAAC,IAAI,CAACQ,KAAKT,aAAgBS,MAAMa,OAAOb,OAAOY,QAAQrB;AAE7E;AAEA,oFAAoF;AACpF,OAAO,MAAMU,+BAA+B,CAACD,MAC3CA,eAAec,SAASd,IAAI1B,IAAI,KAAK,oBAAmB;AAE1D,OAAO,SAASsB,kBAAkB,EAChCC,UAAU,EACVC,SAAS,EACTxC,QAAQ,EACRmC,IAAI,EAML;IACC,OAAO,IAAIkB,QAAQ,CAACC,SAASC,SAC3B1D,OAAO4D,MAAM,CAACzD,UAAUmC,MAAMI,YAAYC,WAAW,UAAU,CAACE,KAAKL,UACnEK,MAAMa,OAAOb,OAAOY,QAAQjB;AAGlC"}

package/dist/auth/strategies/local/incrementLoginAttempts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG5E,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAID,eAAO,MAAM,sBAAsB,GAAU,gCAI1C,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}
+{"version":3,"file":"incrementLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/incrementLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG5E,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAID,eAAO,MAAM,sBAAsB,mCAIhC,IAAI,KAAG,OAAO,CAAC,IAAI,CAuIrB,CAAA"}

package/dist/auth/strategies/local/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAMhF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,UAAU,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,8CAMzC,IAAI,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0ExC,CAAA"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAMhF,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,UAAU,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,iDAM/B,IAAI,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2ExC,CAAA"}

package/dist/auth/strategies/local/register.js

@@ -34,6 +34,7 @@ export const registerLocalStrategy = async ({ collection, doc, password, payload
         collection: collection.slug,
         depth: 0,
         limit: 1,
+        overrideAccess: true,
         pagination: false,
         req,
         where: whereConstraint

package/dist/auth/strategies/local/register.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/register.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { JsonObject, Payload } from '../../../index.js'\nimport type { PayloadRequest, SelectType, Where } from '../../../types/index.js'\n\nimport { ValidationError } from '../../../errors/index.js'\nimport { getLoginOptions } from '../../getLoginOptions.js'\nimport { generatePasswordSaltHash } from './generatePasswordSaltHash.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  doc: JsonObject\n  password: string\n  payload: Payload\n  req: PayloadRequest\n}\n\nexport const registerLocalStrategy = async ({\n  collection,\n  doc,\n  password,\n  payload,\n  req,\n}: Args): Promise<Record<string, unknown>> => {\n  const loginWithUsername = collection?.auth?.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  let whereConstraint: Where\n\n  if (!canLoginWithUsername) {\n    whereConstraint = {\n      email: {\n        equals: doc.email,\n      },\n    }\n  } else {\n    whereConstraint = {\n      or: [],\n    }\n\n    if (canLoginWithEmail && doc.email) {\n      whereConstraint.or?.push({\n        email: {\n          equals: doc.email,\n        },\n      })\n    }\n\n    if (doc.username) {\n      whereConstraint.or?.push({\n        username: {\n          equals: doc.username,\n        },\n      })\n    }\n  }\n\n  const existingUser = await payload.find({\n    collection: collection.slug,\n    depth: 0,\n    limit: 1,\n    pagination: false,\n    req,\n    where: whereConstraint,\n  })\n\n  if (existingUser.docs.length > 0) {\n    throw new ValidationError({\n      collection: collection.slug,\n      errors: [\n        canLoginWithUsername\n          ? {\n              message: req.t('error:usernameAlreadyRegistered'),\n              path: 'username',\n            }\n          : { message: req.t('error:userEmailAlreadyRegistered'), path: 'email' },\n      ],\n    })\n  }\n\n  const { hash, salt } = await generatePasswordSaltHash({ collection, password, req })\n\n  const sanitizedDoc = { ...doc }\n  if (sanitizedDoc.password) {\n    delete sanitizedDoc.password\n  }\n\n  return payload.db.create({\n    collection: collection.slug,\n    data: {\n      ...sanitizedDoc,\n      hash,\n      salt,\n    },\n    req,\n  })\n}\n"],"names":["ValidationError","getLoginOptions","generatePasswordSaltHash","registerLocalStrategy","collection","doc","password","payload","req","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","whereConstraint","email","equals","or","push","username","existingUser","find","slug","depth","limit","pagination","where","docs","length","errors","message","t","path","hash","salt","sanitizedDoc","db","create","data"],"mappings":"AAIA,SAASA,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,wBAAwB,QAAQ,gCAA+B;AAUxE,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,GAAG,EACHC,QAAQ,EACRC,OAAO,EACPC,GAAG,EACE;IACL,MAAMC,oBAAoBL,YAAYM,MAAMD;IAE5C,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGX,gBAAgBQ;IAEpE,IAAII;IAEJ,IAAI,CAACD,sBAAsB;QACzBC,kBAAkB;YAChBC,OAAO;gBACLC,QAAQV,IAAIS,KAAK;YACnB;QACF;IACF,OAAO;QACLD,kBAAkB;YAChBG,IAAI,EAAE;QACR;QAEA,IAAIL,qBAAqBN,IAAIS,KAAK,EAAE;YAClCD,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBH,OAAO;oBACLC,QAAQV,IAAIS,KAAK;gBACnB;YACF;QACF;QAEA,IAAIT,IAAIa,QAAQ,EAAE;YAChBL,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBC,UAAU;oBACRH,QAAQV,IAAIa,QAAQ;gBACtB;YACF;QACF;IACF;IAEA,MAAMC,eAAe,MAAMZ,QAAQa,IAAI,CAAC;QACtChB,YAAYA,WAAWiB,IAAI;QAC3BC,OAAO;QACPC,OAAO;QACPC,YAAY;QACZhB;QACAiB,OAAOZ;IACT;IAEA,IAAIM,aAAaO,IAAI,CAACC,MAAM,GAAG,GAAG;QAChC,MAAM,IAAI3B,gBAAgB;YACxBI,YAAYA,WAAWiB,IAAI;YAC3BO,QAAQ;gBACNhB,uBACI;oBACEiB,SAASrB,IAAIsB,CAAC,CAAC;oBACfC,MAAM;gBACR,IACA;oBAAEF,SAASrB,IAAIsB,CAAC,CAAC;oBAAqCC,MAAM;gBAAQ;aACzE;QACH;IACF;IAEA,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAM/B,yBAAyB;QAAEE;QAAYE;QAAUE;IAAI;IAElF,MAAM0B,eAAe;QAAE,GAAG7B,GAAG;IAAC;IAC9B,IAAI6B,aAAa5B,QAAQ,EAAE;QACzB,OAAO4B,aAAa5B,QAAQ;IAC9B;IAEA,OAAOC,QAAQ4B,EAAE,CAACC,MAAM,CAAC;QACvBhC,YAAYA,WAAWiB,IAAI;QAC3BgB,MAAM;YACJ,GAAGH,YAAY;YACfF;YACAC;QACF;QACAzB;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/register.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../../collections/config/types.js'\nimport type { JsonObject, Payload } from '../../../index.js'\nimport type { PayloadRequest, SelectType, Where } from '../../../types/index.js'\n\nimport { ValidationError } from '../../../errors/index.js'\nimport { getLoginOptions } from '../../getLoginOptions.js'\nimport { generatePasswordSaltHash } from './generatePasswordSaltHash.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  doc: JsonObject\n  password: string\n  payload: Payload\n  req: PayloadRequest\n}\n\nexport const registerLocalStrategy = async ({\n  collection,\n  doc,\n  password,\n  payload,\n  req,\n}: Args): Promise<Record<string, unknown>> => {\n  const loginWithUsername = collection?.auth?.loginWithUsername\n\n  const { canLoginWithEmail, canLoginWithUsername } = getLoginOptions(loginWithUsername)\n\n  let whereConstraint: Where\n\n  if (!canLoginWithUsername) {\n    whereConstraint = {\n      email: {\n        equals: doc.email,\n      },\n    }\n  } else {\n    whereConstraint = {\n      or: [],\n    }\n\n    if (canLoginWithEmail && doc.email) {\n      whereConstraint.or?.push({\n        email: {\n          equals: doc.email,\n        },\n      })\n    }\n\n    if (doc.username) {\n      whereConstraint.or?.push({\n        username: {\n          equals: doc.username,\n        },\n      })\n    }\n  }\n\n  const existingUser = await payload.find({\n    collection: collection.slug,\n    depth: 0,\n    limit: 1,\n    overrideAccess: true,\n    pagination: false,\n    req,\n    where: whereConstraint,\n  })\n\n  if (existingUser.docs.length > 0) {\n    throw new ValidationError({\n      collection: collection.slug,\n      errors: [\n        canLoginWithUsername\n          ? {\n              message: req.t('error:usernameAlreadyRegistered'),\n              path: 'username',\n            }\n          : { message: req.t('error:userEmailAlreadyRegistered'), path: 'email' },\n      ],\n    })\n  }\n\n  const { hash, salt } = await generatePasswordSaltHash({ collection, password, req })\n\n  const sanitizedDoc = { ...doc }\n  if (sanitizedDoc.password) {\n    delete sanitizedDoc.password\n  }\n\n  return payload.db.create({\n    collection: collection.slug,\n    data: {\n      ...sanitizedDoc,\n      hash,\n      salt,\n    },\n    req,\n  })\n}\n"],"names":["ValidationError","getLoginOptions","generatePasswordSaltHash","registerLocalStrategy","collection","doc","password","payload","req","loginWithUsername","auth","canLoginWithEmail","canLoginWithUsername","whereConstraint","email","equals","or","push","username","existingUser","find","slug","depth","limit","overrideAccess","pagination","where","docs","length","errors","message","t","path","hash","salt","sanitizedDoc","db","create","data"],"mappings":"AAIA,SAASA,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,eAAe,QAAQ,2BAA0B;AAC1D,SAASC,wBAAwB,QAAQ,gCAA+B;AAUxE,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,GAAG,EACHC,QAAQ,EACRC,OAAO,EACPC,GAAG,EACE;IACL,MAAMC,oBAAoBL,YAAYM,MAAMD;IAE5C,MAAM,EAAEE,iBAAiB,EAAEC,oBAAoB,EAAE,GAAGX,gBAAgBQ;IAEpE,IAAII;IAEJ,IAAI,CAACD,sBAAsB;QACzBC,kBAAkB;YAChBC,OAAO;gBACLC,QAAQV,IAAIS,KAAK;YACnB;QACF;IACF,OAAO;QACLD,kBAAkB;YAChBG,IAAI,EAAE;QACR;QAEA,IAAIL,qBAAqBN,IAAIS,KAAK,EAAE;YAClCD,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBH,OAAO;oBACLC,QAAQV,IAAIS,KAAK;gBACnB;YACF;QACF;QAEA,IAAIT,IAAIa,QAAQ,EAAE;YAChBL,gBAAgBG,EAAE,EAAEC,KAAK;gBACvBC,UAAU;oBACRH,QAAQV,IAAIa,QAAQ;gBACtB;YACF;QACF;IACF;IAEA,MAAMC,eAAe,MAAMZ,QAAQa,IAAI,CAAC;QACtChB,YAAYA,WAAWiB,IAAI;QAC3BC,OAAO;QACPC,OAAO;QACPC,gBAAgB;QAChBC,YAAY;QACZjB;QACAkB,OAAOb;IACT;IAEA,IAAIM,aAAaQ,IAAI,CAACC,MAAM,GAAG,GAAG;QAChC,MAAM,IAAI5B,gBAAgB;YACxBI,YAAYA,WAAWiB,IAAI;YAC3BQ,QAAQ;gBACNjB,uBACI;oBACEkB,SAAStB,IAAIuB,CAAC,CAAC;oBACfC,MAAM;gBACR,IACA;oBAAEF,SAAStB,IAAIuB,CAAC,CAAC;oBAAqCC,MAAM;gBAAQ;aACzE;QACH;IACF;IAEA,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAG,MAAMhC,yBAAyB;QAAEE;QAAYE;QAAUE;IAAI;IAElF,MAAM2B,eAAe;QAAE,GAAG9B,GAAG;IAAC;IAC9B,IAAI8B,aAAa7B,QAAQ,EAAE;QACzB,OAAO6B,aAAa7B,QAAQ;IAC9B;IAEA,OAAOC,QAAQ6B,EAAE,CAACC,MAAM,CAAC;QACvBjC,YAAYA,WAAWiB,IAAI;QAC3BiB,MAAM;YACJ,GAAGH,YAAY;YACfF;YACAC;QACF;QACA1B;IACF;AACF,EAAC"}

package/dist/auth/strategies/local/resetLoginAttempts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resetLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAU,oCAKtC,IAAI,KAAG,OAAO,CAAC,IAAI,CAiBrB,CAAA"}
+{"version":3,"file":"resetLoginAttempts.d.ts","sourceRoot":"","sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAI7D,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,yBAAyB,CAAA;IACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAA;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,kBAAkB,uCAK5B,IAAI,KAAG,OAAO,CAAC,IAAI,CAmBrB,CAAA"}

package/dist/auth/strategies/local/resetLoginAttempts.js

@@ -1,4 +1,6 @@
+import { assertNoValidationWrite } from '../../../utilities/assertNoValidationWrite.js';
 export const resetLoginAttempts = async ({ collection, doc, payload, req })=>{
+    assertNoValidationWrite(req);
     if (!('lockUntil' in doc && typeof doc.lockUntil === 'string') && (!('loginAttempts' in doc) || doc.loginAttempts === 0)) {
         return;
     }

package/dist/auth/strategies/local/resetLoginAttempts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig, TypeWithID } from '../../../collections/config/types.js'\nimport type { Payload } from '../../../index.js'\nimport type { PayloadRequest } from '../../../types/index.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  doc: Record<string, unknown> & TypeWithID\n  payload: Payload\n  req: PayloadRequest\n}\n\nexport const resetLoginAttempts = async ({\n  collection,\n  doc,\n  payload,\n  req,\n}: Args): Promise<void> => {\n  if (\n    !('lockUntil' in doc && typeof doc.lockUntil === 'string') &&\n    (!('loginAttempts' in doc) || doc.loginAttempts === 0)\n  ) {\n    return\n  }\n  await payload.db.updateOne({\n    id: doc.id,\n    collection: collection.slug,\n    data: {\n      lockUntil: null,\n      loginAttempts: 0,\n    },\n    req,\n    returning: false,\n  })\n}\n"],"names":["resetLoginAttempts","collection","doc","payload","req","lockUntil","loginAttempts","db","updateOne","id","slug","data","returning"],"mappings":"AAWA,OAAO,MAAMA,qBAAqB,OAAO,EACvCC,UAAU,EACVC,GAAG,EACHC,OAAO,EACPC,GAAG,EACE;IACL,IACE,CAAE,CAAA,eAAeF,OAAO,OAAOA,IAAIG,SAAS,KAAK,QAAO,KACvD,CAAA,CAAE,CAAA,mBAAmBH,GAAE,KAAMA,IAAII,aAAa,KAAK,CAAA,GACpD;QACA;IACF;IACA,MAAMH,QAAQI,EAAE,CAACC,SAAS,CAAC;QACzBC,IAAIP,IAAIO,EAAE;QACVR,YAAYA,WAAWS,IAAI;QAC3BC,MAAM;YACJN,WAAW;YACXC,eAAe;QACjB;QACAF;QACAQ,WAAW;IACb;AACF,EAAC"}
+{"version":3,"sources":["../../../../src/auth/strategies/local/resetLoginAttempts.ts"],"sourcesContent":["import type { SanitizedCollectionConfig, TypeWithID } from '../../../collections/config/types.js'\nimport type { Payload } from '../../../index.js'\nimport type { PayloadRequest } from '../../../types/index.js'\n\nimport { assertNoValidationWrite } from '../../../utilities/assertNoValidationWrite.js'\n\ntype Args = {\n  collection: SanitizedCollectionConfig\n  doc: Record<string, unknown> & TypeWithID\n  payload: Payload\n  req: PayloadRequest\n}\n\nexport const resetLoginAttempts = async ({\n  collection,\n  doc,\n  payload,\n  req,\n}: Args): Promise<void> => {\n  assertNoValidationWrite(req)\n\n  if (\n    !('lockUntil' in doc && typeof doc.lockUntil === 'string') &&\n    (!('loginAttempts' in doc) || doc.loginAttempts === 0)\n  ) {\n    return\n  }\n  await payload.db.updateOne({\n    id: doc.id,\n    collection: collection.slug,\n    data: {\n      lockUntil: null,\n      loginAttempts: 0,\n    },\n    req,\n    returning: false,\n  })\n}\n"],"names":["assertNoValidationWrite","resetLoginAttempts","collection","doc","payload","req","lockUntil","loginAttempts","db","updateOne","id","slug","data","returning"],"mappings":"AAIA,SAASA,uBAAuB,QAAQ,gDAA+C;AASvF,OAAO,MAAMC,qBAAqB,OAAO,EACvCC,UAAU,EACVC,GAAG,EACHC,OAAO,EACPC,GAAG,EACE;IACLL,wBAAwBK;IAExB,IACE,CAAE,CAAA,eAAeF,OAAO,OAAOA,IAAIG,SAAS,KAAK,QAAO,KACvD,CAAA,CAAE,CAAA,mBAAmBH,GAAE,KAAMA,IAAII,aAAa,KAAK,CAAA,GACpD;QACA;IACF;IACA,MAAMH,QAAQI,EAAE,CAACC,SAAS,CAAC;QACzBC,IAAIP,IAAIO,EAAE;QACVR,YAAYA,WAAWS,IAAI;QAC3BC,MAAM;YACJN,WAAW;YACXC,eAAe;QACjB;QACAF;QACAQ,WAAW;IACb;AACF,EAAC"}

package/dist/auth/types.d.ts

@@ -1,4 +1,3 @@
-import type { DeepRequired } from 'ts-essentials';
 import type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js';
 import type { PayloadRequest, Where } from '../types/index.js';
 /**
@@ -16,6 +15,8 @@ export type BlockPermissions = {
     fields: FieldsPermissions;
     read: Permission;
     update: Permission;
+    /** Permission to validate candidate block data without saving. */
+    validate: Permission;
 };
 export type SanitizedBlockPermissions = {
     fields: SanitizedFieldsPermissions;
@@ -32,6 +33,8 @@ export type FieldPermissions = {
     fields?: FieldsPermissions;
     read?: Permission;
     update?: Permission;
+    /** Permission to validate candidate field data without saving. */
+    validate?: Permission;
 };
 export type SanitizedFieldPermissions = {
     blocks?: SanitizedBlocksPermissions;
@@ -39,6 +42,7 @@ export type SanitizedFieldPermissions = {
     fields?: SanitizedFieldsPermissions;
     read: true;
     update: true;
+    validate: true;
 } | true;
 export type SanitizedFieldsPermissions = {
     [fieldName: string]: SanitizedFieldPermissions;
@@ -51,6 +55,8 @@ export type CollectionPermission = {
     readVersions?: Permission;
     unlock?: Permission;
     update?: Permission;
+    /** Permission to validate collection candidate data without saving. */
+    validate?: Permission;
 };
 export type SanitizedCollectionPermission = {
     create?: true;
@@ -60,18 +66,22 @@ export type SanitizedCollectionPermission = {
     readVersions?: true;
     unlock?: true;
     update?: true;
+    validate?: true;
 };
 export type GlobalPermission = {
     fields: FieldsPermissions;
     read?: Permission;
     readVersions?: Permission;
     update?: Permission;
+    /** Permission to validate global candidate data without saving. */
+    validate?: Permission;
 };
 export type SanitizedGlobalPermission = {
     fields: SanitizedFieldsPermissions;
     read?: true;
     readVersions?: true;
     update?: true;
+    validate?: true;
 };
 export type DocumentPermissions = CollectionPermission | GlobalPermission;
 export type SanitizedDocumentPermissions = SanitizedCollectionPermission | SanitizedGlobalPermission;
@@ -96,7 +106,8 @@ export type SanitizedPermissions = {
  */
 export type AuthRuntimeFields = {
     /**
-     * The session ID of the current request. Present only when sessions are enabled.
+     * The session ID of the current request. May be present on request-authenticated users when
+     * sessions are enabled.
      */
     _sid?: string;
     /**
@@ -110,15 +121,10 @@ export type AuthRuntimeFields = {
  * from a read `User` doc, so a `never`-typed `password` would break those assignments
  */
 /**
- * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`). This is
- * what `req.user`, `payload.auth()`, the `me` operation, and auth strategies return.
+ * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`).
+ * Server authentication APIs may retain complete fields, while response boundaries apply read access.
  */
 export type AuthenticatedUser = AuthRuntimeFields & User;
-/**
- * The user as available on the client (`useAuth().user`). It is the authenticated user as
- * serialized to the browser: `collection` and `_strategy` are present, `_sid` is not sent.
- */
-export type ClientUser = AuthenticatedUser;
 export type UserSession = {
     createdAt?: Date | null | string;
     expiresAt: Date | string;
@@ -152,6 +158,8 @@ export type AuthStrategyFunctionArgs = {
     headers: Request['headers'];
     isGraphQL?: boolean;
     payload: Payload;
+    /** The request that initiated authentication, when available. */
+    req?: PayloadRequest;
     /**
      * The AuthStrategy name property from the payload config.
      */
@@ -175,22 +183,28 @@ export type LoginWithUsernameOptions = {
     requireEmail?: boolean;
     requireUsername?: boolean;
 };
+type AuthCookies = {
+    domain?: string;
+    sameSite?: 'Lax' | 'None' | 'Strict' | boolean;
+    secure?: boolean;
+};
 export interface IncomingAuthType {
     /**
      * Set cookie options, including secure, sameSite, and domain. For advanced users.
      */
-    cookies?: {
-        domain?: string;
-        sameSite?: 'Lax' | 'None' | 'Strict' | boolean;
-        secure?: boolean;
-    };
+    cookies?: AuthCookies;
     /**
      * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.
      * @default 0
      */
     depth?: number;
     /**
-     * Advanced - disable Payload's built-in local auth strategy. Only use this property if you have replaced Payload's auth mechanisms with your own.
+     * Controls whether Payload's built-in local auth strategy is disabled. Set to `true` to disable
+     * local authentication or `false` to keep it enabled.
+     *
+     * Pass an object to disable local authentication while configuring how its fields are retained.
+     * Only disable local authentication if you have replaced Payload's auth mechanisms with your own.
+     * @default false
      */
     disableLocalStrategy?: {
         /**
@@ -198,8 +212,11 @@ export interface IncomingAuthType {
          * Useful when you do not want the database or types to vary depending on the auth configuration.
          */
         enableFields?: true;
+        /**
+         * When auth fields are retained, make the password field optional.
+         */
         optionalPassword?: true;
-    } | true;
+    } | boolean;
     /**
      * Customize the way that the forgotPassword operation functions.
      * @link https://payloadcms.com/docs/authentication/email#forgot-password
@@ -212,6 +229,12 @@ export interface IncomingAuthType {
         expiration?: number;
         generateEmailHTML?: GenerateForgotPasswordEmailHTML;
         generateEmailSubject?: GenerateForgotPasswordEmailSubject;
+        /**
+         * The minimum number of milliseconds between password reset emails for the same user.
+         * @default 15000
+         * Set to 0 to disable.
+         */
+        minRequestInterval?: number;
     };
     /**
      * Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.
@@ -247,7 +270,13 @@ export interface IncomingAuthType {
      * @default false
      * @link https://payloadcms.com/docs/authentication/api-keys
      */
-    useAPIKey?: boolean;
+    useAPIKey?: {
+        /**
+         * Allows administrators to reveal stored API keys from the Admin Panel.
+         * @default false
+         */
+        reveal?: boolean;
+    } | boolean;
     /**
      * Use sessions for authentication. Enabled by default.
      * @default true
@@ -266,14 +295,9 @@ export type VerifyConfig = {
     generateEmailHTML?: GenerateVerifyEmailHTML;
     generateEmailSubject?: GenerateVerifyEmailSubject;
 };
-export interface Auth extends Omit<DeepRequired<IncomingAuthType>, 'forgotPassword' | 'loginWithUsername' | 'verify'> {
-    forgotPassword?: {
-        expiration?: number;
-        generateEmailHTML?: GenerateForgotPasswordEmailHTML;
-        generateEmailSubject?: GenerateForgotPasswordEmailSubject;
-    };
-    loginWithUsername: false | LoginWithUsernameOptions;
-    verify?: boolean | VerifyConfig;
+export interface Auth extends Omit<IncomingAuthType, 'cookies' | 'forgotPassword' | 'lockTime' | 'loginWithUsername' | 'maxLoginAttempts' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>, Required<Pick<IncomingAuthType, 'forgotPassword' | 'lockTime' | 'maxLoginAttempts' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>> {
+    cookies: Pick<AuthCookies, 'domain'> & Required<Pick<AuthCookies, 'sameSite' | 'secure'>>;
+    loginWithUsername: false | Required<LoginWithUsernameOptions>;
 }
 export declare function hasWhereAccessResult(result: boolean | Where): result is Where;
 export {};

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;CACb,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAA;AAE1C,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;IACxB,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AACD,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;QAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,CAAA;IACD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,IAAI,CAAA;IACR;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC/F,cAAc,CAAC,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;KAC1D,CAAA;IACD,iBAAiB,EAAE,KAAK,GAAG,wBAAwB,CAAA;IACnD,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAA;CAChC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,kEAAkE;IAClE,QAAQ,EAAE,UAAU,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;IACZ,QAAQ,EAAE,IAAI,CAAA;CACf,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExD,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;IACxB,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AACD,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,iEAAiE;IACjE,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,KAAK,WAAW,GAAG;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB;;WAEG;QACH,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,OAAO,CAAA;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;QACzD;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EACN;QACE;;;WAGG;QACH,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GACD,OAAO,CAAA;IAEX;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SACE,IAAI,CACF,gBAAgB,EACd,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,EACD,QAAQ,CACN,IAAI,CACF,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,CACF;IACH,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAA;IACzF,iBAAiB,EAAE,KAAK,GAAG,QAAQ,CAAC,wBAAwB,CAAC,CAAA;CAC9D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}

package/dist/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { DeepRequired } from 'ts-essentials'\n\nimport type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/**\n * A permission object that can be used to determine if a user has access to a specific operation.\n */\nexport type Permission = {\n  permission: boolean\n  where?: Where\n}\n\nexport type FieldsPermissions = {\n  [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n  create: Permission\n  fields: FieldsPermissions\n  read: Permission\n  update: Permission\n}\n\nexport type SanitizedBlockPermissions =\n  | {\n      fields: SanitizedFieldsPermissions\n    }\n  | true\n\nexport type BlocksPermissions = {\n  [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n  | {\n      [blockSlug: string]: SanitizedBlockPermissions\n    }\n  | true\n\nexport type FieldPermissions = {\n  blocks?: BlocksPermissions\n  create?: Permission\n  fields?: FieldsPermissions\n  read?: Permission\n  update?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n  | {\n      blocks?: SanitizedBlocksPermissions\n      create: true\n      fields?: SanitizedFieldsPermissions\n      read: true\n      update: true\n    }\n  | true\n\nexport type SanitizedFieldsPermissions =\n  | {\n      [fieldName: string]: SanitizedFieldPermissions\n    }\n  | true\n\nexport type CollectionPermission = {\n  create?: Permission\n  delete?: Permission\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  // Auth-enabled Collections only\n  unlock?: Permission\n  update?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n  create?: true\n  delete?: true\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  // Auth-enabled Collections only\n  unlock?: true\n  update?: true\n}\n\nexport type GlobalPermission = {\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  update?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  update?: true\n}\n\nexport type DocumentPermissions = CollectionPermission | GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission | SanitizedGlobalPermission\n\nexport type Permissions = {\n  canAccessAdmin: boolean\n  collections?: Record<CollectionSlug, CollectionPermission>\n  globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n  canAccessAdmin?: boolean\n  collections?: {\n    [collectionSlug: string]: SanitizedCollectionPermission\n  }\n  globals?: {\n    [globalSlug: string]: SanitizedGlobalPermission\n  }\n}\n\n/**\n * Fields injected onto a user at authentication time. They are never stored in the database and\n * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated\n * user (`req.user`, login/auth/me results, auth strategies).\n */\nexport type AuthRuntimeFields = {\n  /**\n   * The session ID of the current request. Present only when sessions are enabled.\n   */\n  _sid?: string\n  /**\n   * The name of the auth strategy that authenticated the request (e.g. `local-jwt`).\n   */\n  _strategy?: string\n}\n\n/**\n * Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).\n * Stripping it cleanly isn't possible, because auth operations build the authenticated user\n * from a read `User` doc, so a `never`-typed `password` would break those assignments\n */\n/**\n * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`). This is\n * what `req.user`, `payload.auth()`, the `me` operation, and auth strategies return.\n */\nexport type AuthenticatedUser = AuthRuntimeFields & User\n\n/**\n * The user as available on the client (`useAuth().user`). It is the authenticated user as\n * serialized to the browser: `collection` and `_strategy` are present, `_sid` is not sent.\n */\nexport type ClientUser = AuthenticatedUser\n\nexport type UserSession = {\n  createdAt?: Date | null | string\n  expiresAt: Date | string\n  id: string\n}\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\nexport type AuthStrategyFunctionArgs = {\n  /**\n   * Specifies whether or not response headers can be set from this strategy.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  isGraphQL?: boolean\n  payload: Payload\n  /**\n   * The AuthStrategy name property from the payload config.\n   */\n  strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport type AuthStrategyFunction = (\n  args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult | Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n  authenticate: AuthStrategyFunction\n  name: string\n}\n\nexport type LoginWithUsernameOptions =\n  | {\n      allowEmailLogin?: false\n      requireEmail?: boolean\n      // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n      requireUsername?: true\n    }\n  | {\n      allowEmailLogin?: true\n      requireEmail?: boolean\n      requireUsername?: boolean\n    }\n\nexport interface IncomingAuthType {\n  /**\n   * Set cookie options, including secure, sameSite, and domain. For advanced users.\n   */\n  cookies?: {\n    domain?: string\n    sameSite?: 'Lax' | 'None' | 'Strict' | boolean\n    secure?: boolean\n  }\n  /**\n   * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n   * @default 0\n   */\n  depth?: number\n  /**\n   * Advanced - disable Payload's built-in local auth strategy. Only use this property if you have replaced Payload's auth mechanisms with your own.\n   */\n  disableLocalStrategy?:\n    | {\n        /**\n         * Include auth fields on the collection even though the local strategy is disabled.\n         * Useful when you do not want the database or types to vary depending on the auth configuration.\n         */\n        enableFields?: true\n        optionalPassword?: true\n      }\n    | true\n  /**\n   * Customize the way that the forgotPassword operation functions.\n   * @link https://payloadcms.com/docs/authentication/email#forgot-password\n   */\n  forgotPassword?: {\n    /**\n     * The number of milliseconds that the forgot password token should be valid for.\n     * @default 3600000 // 1 hour\n     */\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n  }\n  /**\n   * Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n   */\n  lockTime?: number\n  /**\n   * Ability to allow users to login with username/password.\n   *\n   * @link https://payloadcms.com/docs/authentication/overview#login-with-username\n   */\n  loginWithUsername?: boolean | LoginWithUsernameOptions\n  /**\n   * Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n   */\n  maxLoginAttempts?: number\n  /***\n   * Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n   */\n  removeTokenFromResponses?: true\n  /**\n   * Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n   * @link https://payloadcms.com/docs/authentication/custom-strategies\n   */\n  strategies?: AuthStrategy[]\n  /**\n   * Controls how many seconds the token will be valid for. Default is 2 hours.\n   * @default 7200\n   * @link https://payloadcms.com/docs/authentication/overview#config-options\n   */\n  tokenExpiration?: number\n  /**\n   * Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n   * @default false\n   * @link https://payloadcms.com/docs/authentication/api-keys\n   */\n  useAPIKey?: boolean\n\n  /**\n   * Use sessions for authentication. Enabled by default.\n   * @default true\n   */\n  useSessions?: boolean\n\n  /**\n   * Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n   * @link https://payloadcms.com/docs/authentication/email#email-verification\n   */\n  verify?:\n    | {\n        generateEmailHTML?: GenerateVerifyEmailHTML\n        generateEmailSubject?: GenerateVerifyEmailSubject\n      }\n    | boolean\n}\n\nexport type VerifyConfig = {\n  generateEmailHTML?: GenerateVerifyEmailHTML\n  generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n  extends Omit<DeepRequired<IncomingAuthType>, 'forgotPassword' | 'loginWithUsername' | 'verify'> {\n  forgotPassword?: {\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n  }\n  loginWithUsername: false | LoginWithUsernameOptions\n  verify?: boolean | VerifyConfig\n}\n\nexport function hasWhereAccessResult(result: boolean | Where): result is Where {\n  return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"AA4UA,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/**\n * A permission object that can be used to determine if a user has access to a specific operation.\n */\nexport type Permission = {\n  permission: boolean\n  where?: Where\n}\n\nexport type FieldsPermissions = {\n  [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n  create: Permission\n  fields: FieldsPermissions\n  read: Permission\n  update: Permission\n  /** Permission to validate candidate block data without saving. */\n  validate: Permission\n}\n\nexport type SanitizedBlockPermissions =\n  | {\n      fields: SanitizedFieldsPermissions\n    }\n  | true\n\nexport type BlocksPermissions = {\n  [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n  | {\n      [blockSlug: string]: SanitizedBlockPermissions\n    }\n  | true\n\nexport type FieldPermissions = {\n  blocks?: BlocksPermissions\n  create?: Permission\n  fields?: FieldsPermissions\n  read?: Permission\n  update?: Permission\n  /** Permission to validate candidate field data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n  | {\n      blocks?: SanitizedBlocksPermissions\n      create: true\n      fields?: SanitizedFieldsPermissions\n      read: true\n      update: true\n      validate: true\n    }\n  | true\n\nexport type SanitizedFieldsPermissions =\n  | {\n      [fieldName: string]: SanitizedFieldPermissions\n    }\n  | true\n\nexport type CollectionPermission = {\n  create?: Permission\n  delete?: Permission\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  // Auth-enabled Collections only\n  unlock?: Permission\n  update?: Permission\n  /** Permission to validate collection candidate data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n  create?: true\n  delete?: true\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  // Auth-enabled Collections only\n  unlock?: true\n  update?: true\n  validate?: true\n}\n\nexport type GlobalPermission = {\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  update?: Permission\n  /** Permission to validate global candidate data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  update?: true\n  validate?: true\n}\n\nexport type DocumentPermissions = CollectionPermission | GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission | SanitizedGlobalPermission\n\nexport type Permissions = {\n  canAccessAdmin: boolean\n  collections?: Record<CollectionSlug, CollectionPermission>\n  globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n  canAccessAdmin?: boolean\n  collections?: {\n    [collectionSlug: string]: SanitizedCollectionPermission\n  }\n  globals?: {\n    [globalSlug: string]: SanitizedGlobalPermission\n  }\n}\n\n/**\n * Fields injected onto a user at authentication time. They are never stored in the database and\n * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated\n * user (`req.user`, login/auth/me results, auth strategies).\n */\nexport type AuthRuntimeFields = {\n  /**\n   * The session ID of the current request. May be present on request-authenticated users when\n   * sessions are enabled.\n   */\n  _sid?: string\n  /**\n   * The name of the auth strategy that authenticated the request (e.g. `local-jwt`).\n   */\n  _strategy?: string\n}\n\n/**\n * Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).\n * Stripping it cleanly isn't possible, because auth operations build the authenticated user\n * from a read `User` doc, so a `never`-typed `password` would break those assignments\n */\n/**\n * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`).\n * Server authentication APIs may retain complete fields, while response boundaries apply read access.\n */\nexport type AuthenticatedUser = AuthRuntimeFields & User\n\nexport type UserSession = {\n  createdAt?: Date | null | string\n  expiresAt: Date | string\n  id: string\n}\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\nexport type AuthStrategyFunctionArgs = {\n  /**\n   * Specifies whether or not response headers can be set from this strategy.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  isGraphQL?: boolean\n  payload: Payload\n  /** The request that initiated authentication, when available. */\n  req?: PayloadRequest\n  /**\n   * The AuthStrategy name property from the payload config.\n   */\n  strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport type AuthStrategyFunction = (\n  args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult | Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n  authenticate: AuthStrategyFunction\n  name: string\n}\n\nexport type LoginWithUsernameOptions =\n  | {\n      allowEmailLogin?: false\n      requireEmail?: boolean\n      // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n      requireUsername?: true\n    }\n  | {\n      allowEmailLogin?: true\n      requireEmail?: boolean\n      requireUsername?: boolean\n    }\n\ntype AuthCookies = {\n  domain?: string\n  sameSite?: 'Lax' | 'None' | 'Strict' | boolean\n  secure?: boolean\n}\n\nexport interface IncomingAuthType {\n  /**\n   * Set cookie options, including secure, sameSite, and domain. For advanced users.\n   */\n  cookies?: AuthCookies\n  /**\n   * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n   * @default 0\n   */\n  depth?: number\n  /**\n   * Controls whether Payload's built-in local auth strategy is disabled. Set to `true` to disable\n   * local authentication or `false` to keep it enabled.\n   *\n   * Pass an object to disable local authentication while configuring how its fields are retained.\n   * Only disable local authentication if you have replaced Payload's auth mechanisms with your own.\n   * @default false\n   */\n  disableLocalStrategy?:\n    | {\n        /**\n         * Include auth fields on the collection even though the local strategy is disabled.\n         * Useful when you do not want the database or types to vary depending on the auth configuration.\n         */\n        enableFields?: true\n        /**\n         * When auth fields are retained, make the password field optional.\n         */\n        optionalPassword?: true\n      }\n    | boolean\n  /**\n   * Customize the way that the forgotPassword operation functions.\n   * @link https://payloadcms.com/docs/authentication/email#forgot-password\n   */\n  forgotPassword?: {\n    /**\n     * The number of milliseconds that the forgot password token should be valid for.\n     * @default 3600000 // 1 hour\n     */\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n    /**\n     * The minimum number of milliseconds between password reset emails for the same user.\n     * @default 15000\n     * Set to 0 to disable.\n     */\n    minRequestInterval?: number\n  }\n  /**\n   * Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n   */\n  lockTime?: number\n  /**\n   * Ability to allow users to login with username/password.\n   *\n   * @link https://payloadcms.com/docs/authentication/overview#login-with-username\n   */\n  loginWithUsername?: boolean | LoginWithUsernameOptions\n  /**\n   * Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n   */\n  maxLoginAttempts?: number\n  /***\n   * Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n   */\n  removeTokenFromResponses?: true\n  /**\n   * Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n   * @link https://payloadcms.com/docs/authentication/custom-strategies\n   */\n  strategies?: AuthStrategy[]\n  /**\n   * Controls how many seconds the token will be valid for. Default is 2 hours.\n   * @default 7200\n   * @link https://payloadcms.com/docs/authentication/overview#config-options\n   */\n  tokenExpiration?: number\n  /**\n   * Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n   * @default false\n   * @link https://payloadcms.com/docs/authentication/api-keys\n   */\n  useAPIKey?:\n    | {\n        /**\n         * Allows administrators to reveal stored API keys from the Admin Panel.\n         * @default false\n         */\n        reveal?: boolean\n      }\n    | boolean\n\n  /**\n   * Use sessions for authentication. Enabled by default.\n   * @default true\n   */\n  useSessions?: boolean\n\n  /**\n   * Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n   * @link https://payloadcms.com/docs/authentication/email#email-verification\n   */\n  verify?:\n    | {\n        generateEmailHTML?: GenerateVerifyEmailHTML\n        generateEmailSubject?: GenerateVerifyEmailSubject\n      }\n    | boolean\n}\n\nexport type VerifyConfig = {\n  generateEmailHTML?: GenerateVerifyEmailHTML\n  generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n  extends\n    Omit<\n      IncomingAuthType,\n      | 'cookies'\n      | 'forgotPassword'\n      | 'lockTime'\n      | 'loginWithUsername'\n      | 'maxLoginAttempts'\n      | 'strategies'\n      | 'tokenExpiration'\n      | 'useSessions'\n      | 'verify'\n    >,\n    Required<\n      Pick<\n        IncomingAuthType,\n        | 'forgotPassword'\n        | 'lockTime'\n        | 'maxLoginAttempts'\n        | 'strategies'\n        | 'tokenExpiration'\n        | 'useSessions'\n        | 'verify'\n      >\n    > {\n  cookies: Pick<AuthCookies, 'domain'> & Required<Pick<AuthCookies, 'sameSite' | 'secure'>>\n  loginWithUsername: false | Required<LoginWithUsernameOptions>\n}\n\nexport function hasWhereAccessResult(result: boolean | Where): result is Where {\n  return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"AA6XA,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}

package/dist/auth/withBaseAccess.d.ts

@@ -0,0 +1,22 @@
+import type { CollectionAccess } from '../collections/config/types.js';
+import type { Access } from '../config/types.js';
+import type { GlobalAccess } from '../globals/config/types.js';
+type CommonArgs = {
+    access?: Access;
+    slug: string;
+};
+type AdminAccess = NonNullable<CollectionAccess['admin']>;
+type Args = ({
+    entityType: 'collection';
+    operation: Exclude<keyof CollectionAccess, 'admin'>;
+} | {
+    entityType: 'global';
+    operation: keyof GlobalAccess;
+}) & CommonArgs;
+export declare const withBaseAccess: (options: Args) => Access;
+export declare const withBaseAdminAccess: ({ slug, access, }: {
+    access?: AdminAccess;
+    slug: string;
+}) => AdminAccess;
+export {};
+//# sourceMappingURL=withBaseAccess.d.ts.map

package/dist/auth/withBaseAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withBaseAccess.d.ts","sourceRoot":"","sources":["../../src/auth/withBaseAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,MAAM,EAA4B,MAAM,oBAAoB,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAE9D,KAAK,UAAU,GAAG;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,KAAK,WAAW,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;AAEzD,KAAK,IAAI,GAAG,CACR;IACE,UAAU,EAAE,YAAY,CAAA;IACxB,SAAS,EAAE,OAAO,CAAC,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAA;CACpD,GACD;IACE,UAAU,EAAE,QAAQ,CAAA;IACpB,SAAS,EAAE,MAAM,YAAY,CAAA;CAC9B,CACJ,GACC,UAAU,CAAA;AAIZ,eAAO,MAAM,cAAc,YAAa,IAAI,KAAG,MA2D9C,CAAA;AAED,eAAO,MAAM,mBAAmB,sBAG7B;IACD,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;CACb,KAAG,WA2BH,CAAA"}

package/dist/auth/withBaseAccess.js

@@ -0,0 +1,66 @@
+const authenticatedAccess = ({ req })=>Boolean(req.user);
+export const withBaseAccess = (options)=>{
+    const documentAccess = options.access ?? authenticatedAccess;
+    return async (args)=>{
+        const accessArgs = {
+            ...args,
+            slug: options.slug
+        };
+        const { baseAccess } = args.req.payload.config;
+        let baseAccessFunction;
+        if (options.entityType === 'collection') {
+            baseAccessFunction = options.operation === 'validate' ? baseAccess?.collections?.validate ?? baseAccess?.collections?.update : baseAccess?.collections?.[options.operation];
+        } else {
+            baseAccessFunction = options.operation === 'validate' ? baseAccess?.globals?.validate ?? baseAccess?.globals?.update : baseAccess?.globals?.[options.operation];
+        }
+        if (!baseAccessFunction) {
+            return documentAccess(accessArgs);
+        }
+        const baseResult = await baseAccessFunction(accessArgs);
+        if (!baseResult) {
+            return false;
+        }
+        if (options.entityType === 'collection' && options.operation === 'create' && typeof baseResult === 'object') {
+            throw new Error('baseAccess must return a boolean for collection create operations.');
+        }
+        const documentResult = await documentAccess(accessArgs);
+        if (!documentResult) {
+            return false;
+        }
+        if (baseResult === true) {
+            return documentResult;
+        }
+        if (documentResult === true) {
+            return baseResult;
+        }
+        return {
+            and: [
+                baseResult,
+                documentResult
+            ]
+        };
+    };
+};
+export const withBaseAdminAccess = ({ slug, access })=>{
+    const documentAccess = access ?? (({ req })=>Boolean(req.user && req.payload.config.admin.user === slug));
+    return async (args)=>{
+        const accessArgs = {
+            ...args,
+            slug
+        };
+        const baseAccessFunction = args.req.payload.config.baseAccess?.collections?.admin;
+        if (!baseAccessFunction) {
+            return documentAccess(accessArgs);
+        }
+        const baseResult = await baseAccessFunction(accessArgs);
+        if (!baseResult) {
+            return false;
+        }
+        if (typeof baseResult === 'object') {
+            throw new Error('baseAccess must return a boolean for collection admin operations.');
+        }
+        return documentAccess(accessArgs);
+    };
+};
+
+//# sourceMappingURL=withBaseAccess.js.map

package/dist/auth/withBaseAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/withBaseAccess.ts"],"sourcesContent":["import type { CollectionAccess } from '../collections/config/types.js'\nimport type { Access, AccessArgs, AccessResult } from '../config/types.js'\nimport type { GlobalAccess } from '../globals/config/types.js'\n\ntype CommonArgs = {\n  access?: Access\n  slug: string\n}\n\ntype AdminAccess = NonNullable<CollectionAccess['admin']>\n\ntype Args = (\n  | {\n      entityType: 'collection'\n      operation: Exclude<keyof CollectionAccess, 'admin'>\n    }\n  | {\n      entityType: 'global'\n      operation: keyof GlobalAccess\n    }\n) &\n  CommonArgs\n\nconst authenticatedAccess: Access = ({ req }) => Boolean(req.user)\n\nexport const withBaseAccess = (options: Args): Access => {\n  const documentAccess = options.access ?? authenticatedAccess\n\n  return async (args: AccessArgs): Promise<AccessResult> => {\n    const accessArgs = {\n      ...args,\n      slug: options.slug,\n    }\n    const { baseAccess } = args.req.payload.config\n    let baseAccessFunction: Access | undefined\n\n    if (options.entityType === 'collection') {\n      baseAccessFunction =\n        options.operation === 'validate'\n          ? (baseAccess?.collections?.validate ?? baseAccess?.collections?.update)\n          : baseAccess?.collections?.[options.operation]\n    } else {\n      baseAccessFunction =\n        options.operation === 'validate'\n          ? (baseAccess?.globals?.validate ?? baseAccess?.globals?.update)\n          : baseAccess?.globals?.[options.operation]\n    }\n\n    if (!baseAccessFunction) {\n      return documentAccess(accessArgs)\n    }\n\n    const baseResult = await baseAccessFunction(accessArgs)\n\n    if (!baseResult) {\n      return false\n    }\n\n    if (\n      options.entityType === 'collection' &&\n      options.operation === 'create' &&\n      typeof baseResult === 'object'\n    ) {\n      throw new Error('baseAccess must return a boolean for collection create operations.')\n    }\n\n    const documentResult = await documentAccess(accessArgs)\n\n    if (!documentResult) {\n      return false\n    }\n\n    if (baseResult === true) {\n      return documentResult\n    }\n\n    if (documentResult === true) {\n      return baseResult\n    }\n\n    return {\n      and: [baseResult, documentResult],\n    }\n  }\n}\n\nexport const withBaseAdminAccess = ({\n  slug,\n  access,\n}: {\n  access?: AdminAccess\n  slug: string\n}): AdminAccess => {\n  const documentAccess =\n    access ?? (({ req }) => Boolean(req.user && req.payload.config.admin.user === slug))\n\n  return async (args) => {\n    const accessArgs = {\n      ...args,\n      slug,\n    }\n    const baseAccessFunction = args.req.payload.config.baseAccess?.collections?.admin\n\n    if (!baseAccessFunction) {\n      return documentAccess(accessArgs)\n    }\n\n    const baseResult = await baseAccessFunction(accessArgs)\n\n    if (!baseResult) {\n      return false\n    }\n\n    if (typeof baseResult === 'object') {\n      throw new Error('baseAccess must return a boolean for collection admin operations.')\n    }\n\n    return documentAccess(accessArgs)\n  }\n}\n"],"names":["authenticatedAccess","req","Boolean","user","withBaseAccess","options","documentAccess","access","args","accessArgs","slug","baseAccess","payload","config","baseAccessFunction","entityType","operation","collections","validate","update","globals","baseResult","Error","documentResult","and","withBaseAdminAccess","admin"],"mappings":"AAuBA,MAAMA,sBAA8B,CAAC,EAAEC,GAAG,EAAE,GAAKC,QAAQD,IAAIE,IAAI;AAEjE,OAAO,MAAMC,iBAAiB,CAACC;IAC7B,MAAMC,iBAAiBD,QAAQE,MAAM,IAAIP;IAEzC,OAAO,OAAOQ;QACZ,MAAMC,aAAa;YACjB,GAAGD,IAAI;YACPE,MAAML,QAAQK,IAAI;QACpB;QACA,MAAM,EAAEC,UAAU,EAAE,GAAGH,KAAKP,GAAG,CAACW,OAAO,CAACC,MAAM;QAC9C,IAAIC;QAEJ,IAAIT,QAAQU,UAAU,KAAK,cAAc;YACvCD,qBACET,QAAQW,SAAS,KAAK,aACjBL,YAAYM,aAAaC,YAAYP,YAAYM,aAAaE,SAC/DR,YAAYM,aAAa,CAACZ,QAAQW,SAAS,CAAC;QACpD,OAAO;YACLF,qBACET,QAAQW,SAAS,KAAK,aACjBL,YAAYS,SAASF,YAAYP,YAAYS,SAASD,SACvDR,YAAYS,SAAS,CAACf,QAAQW,SAAS,CAAC;QAChD;QAEA,IAAI,CAACF,oBAAoB;YACvB,OAAOR,eAAeG;QACxB;QAEA,MAAMY,aAAa,MAAMP,mBAAmBL;QAE5C,IAAI,CAACY,YAAY;YACf,OAAO;QACT;QAEA,IACEhB,QAAQU,UAAU,KAAK,gBACvBV,QAAQW,SAAS,KAAK,YACtB,OAAOK,eAAe,UACtB;YACA,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAMC,iBAAiB,MAAMjB,eAAeG;QAE5C,IAAI,CAACc,gBAAgB;YACnB,OAAO;QACT;QAEA,IAAIF,eAAe,MAAM;YACvB,OAAOE;QACT;QAEA,IAAIA,mBAAmB,MAAM;YAC3B,OAAOF;QACT;QAEA,OAAO;YACLG,KAAK;gBAACH;gBAAYE;aAAe;QACnC;IACF;AACF,EAAC;AAED,OAAO,MAAME,sBAAsB,CAAC,EAClCf,IAAI,EACJH,MAAM,EAIP;IACC,MAAMD,iBACJC,UAAW,CAAA,CAAC,EAAEN,GAAG,EAAE,GAAKC,QAAQD,IAAIE,IAAI,IAAIF,IAAIW,OAAO,CAACC,MAAM,CAACa,KAAK,CAACvB,IAAI,KAAKO,KAAI;IAEpF,OAAO,OAAOF;QACZ,MAAMC,aAAa;YACjB,GAAGD,IAAI;YACPE;QACF;QACA,MAAMI,qBAAqBN,KAAKP,GAAG,CAACW,OAAO,CAACC,MAAM,CAACF,UAAU,EAAEM,aAAaS;QAE5E,IAAI,CAACZ,oBAAoB;YACvB,OAAOR,eAAeG;QACxB;QAEA,MAAMY,aAAa,MAAMP,mBAAmBL;QAE5C,IAAI,CAACY,YAAY;YACf,OAAO;QACT;QAEA,IAAI,OAAOA,eAAe,UAAU;YAClC,MAAM,IAAIC,MAAM;QAClB;QAEA,OAAOhB,eAAeG;IACxB;AACF,EAAC"}

package/dist/branching/appendBranchFilter.d.ts

@@ -0,0 +1,30 @@
+import type { Where } from '../types/index.js';
+type Args = {
+    /** The active branch slug, or `'main'`. */
+    branch: string;
+    /** Canonical IDs deleted on this branch, from the change manifest. */
+    deletedIDs: (number | string)[];
+    /** Whether branching is active for this entity. */
+    enabled: boolean;
+    /**
+     * Canonical IDs of the documents this branch has shadowed, from the change
+     * manifest. Bounded by branch size rather than table size.
+     */
+    shadowedIDs: (number | string)[];
+    where: Where;
+};
+/**
+ * Appends the branch visibility predicate to a read query.
+ *
+ * On `main` this is a single indexed equality — the overwhelmingly common read
+ * must not pay for the branch machinery. On a branch it selects the branch's
+ * own rows plus the main rows the branch has not shadowed, and hides
+ * tombstones.
+ *
+ * The predicate has to be part of the database query rather than applied
+ * afterwards: filtering, sorting, `totalDocs` and pagination are all computed
+ * by the database, and a post-query pass cannot correct any of them.
+ */
+export declare const appendBranchFilter: ({ branch, deletedIDs, enabled, shadowedIDs, where, }: Args) => Where;
+export {};
+//# sourceMappingURL=appendBranchFilter.d.ts.map

package/dist/branching/appendBranchFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appendBranchFilter.d.ts","sourceRoot":"","sources":["../../src/branching/appendBranchFilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAI9C,KAAK,IAAI,GAAG;IACV,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAA;IACd,sEAAsE;IACtE,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;IAC/B,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,WAAW,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;IAChC,KAAK,EAAE,KAAK,CAAA;CACb,CAAA;AAcD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,yDAM5B,IAAI,KAAG,KAoCT,CAAA"}