payload 4.0.0-internal.fa345ef → 4.0.0-internal.ff27d6e

package/dist/auth/endpoints/registerFirstUser.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/registerFirstUser.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { registerFirstUserOperation } from '../operations/registerFirstUser.js'\n\nexport const registerFirstUserHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { data, t } = req\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n      }\n\n  const result = await registerFirstUserOperation({\n    collection,\n    data: {\n      ...data,\n      ...authData,\n    },\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token!,\n  })\n\n  return Response.json(\n    {\n      exp: result.exp,\n      message: t('authentication:successfullyRegisteredFirstUser'),\n      token: result.token,\n      user: result.user,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","generatePayloadCookie","registerFirstUserOperation","registerFirstUserHandler","req","collection","data","t","authData","config","auth","loginWithUsername","email","password","username","result","cookie","collectionAuthConfig","cookiePrefix","payload","token","Response","json","exp","message","user","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,0BAA0B,QAAQ,qCAAoC;AAE/E,OAAO,MAAMC,2BAA2C,OAAOC;IAC7D,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,IAAI,EAAEC,CAAC,EAAE,GAAGH;IACpB,MAAMI,WAAWH,WAAWI,MAAM,CAACC,IAAI,EAAEC,oBACrC;QACEC,OAAO,OAAOR,IAAIE,IAAI,EAAEM,UAAU,WAAWR,IAAIE,IAAI,CAACM,KAAK,GAAG;QAC9DC,UAAU,OAAOT,IAAIE,IAAI,EAAEO,aAAa,WAAWT,IAAIE,IAAI,CAACO,QAAQ,GAAG;QACvEC,UAAU,OAAOV,IAAIE,IAAI,EAAEQ,aAAa,WAAWV,IAAIE,IAAI,CAACQ,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOR,IAAIE,IAAI,EAAEM,UAAU,WAAWR,IAAIE,IAAI,CAACM,KAAK,GAAG;QAC9DC,UAAU,OAAOT,IAAIE,IAAI,EAAEO,aAAa,WAAWT,IAAIE,IAAI,CAACO,QAAQ,GAAG;IACzE;IAEJ,MAAME,SAAS,MAAMb,2BAA2B;QAC9CG;QACAC,MAAM;YACJ,GAAGA,IAAI;YACP,GAAGE,QAAQ;QACb;QACAJ;IACF;IAEA,MAAMY,SAASf,sBAAsB;QACnCgB,sBAAsBZ,WAAWI,MAAM,CAACC,IAAI;QAC5CQ,cAAcd,IAAIe,OAAO,CAACV,MAAM,CAACS,YAAY;QAC7CE,OAAOL,OAAOK,KAAK;IACrB;IAEA,OAAOC,SAASC,IAAI,CAClB;QACEC,KAAKR,OAAOQ,GAAG;QACfC,SAASjB,EAAE;QACXa,OAAOL,OAAOK,KAAK;QACnBK,MAAMV,OAAOU,IAAI;IACnB,GACA;QACEC,SAAS1B,gBAAgB;YACvB0B,SAAS,IAAIC,QAAQ;gBACnB,cAAcX;YAChB;YACAZ;QACF;QACAP,QAAQC,WAAW8B,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/registerFirstUser.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { registerFirstUserOperation } from '../operations/registerFirstUser.js'\n\nexport const registerFirstUserHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { data, t } = req\n  const authData = collection.config.auth?.loginWithUsername\n    ? {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n        username: typeof req.data?.username === 'string' ? req.data.username : '',\n      }\n    : {\n        email: typeof req.data?.email === 'string' ? req.data.email : '',\n        password: typeof req.data?.password === 'string' ? req.data.password : '',\n      }\n\n  const result = await registerFirstUserOperation({\n    collection,\n    data: {\n      ...data,\n      ...authData,\n    },\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token!,\n  })\n\n  return Response.json(\n    {\n      exp: result.exp,\n      message: t('authentication:successfullyRegisteredFirstUser'),\n      token: result.token,\n      user: result.user,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["getRequestCollection","headersWithCors","httpStatus","generatePayloadCookie","registerFirstUserOperation","registerFirstUserHandler","req","collection","data","t","authData","config","auth","loginWithUsername","email","password","username","result","cookie","collectionAuthConfig","cookiePrefix","payload","token","Response","json","exp","message","user","headers","Headers","status","OK"],"mappings":"AAEA,SAASA,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,0BAA0B,QAAQ,qCAAoC;AAE/E,OAAO,MAAMC,2BAA2C,OAAOC;IAC7D,MAAMC,aAAaP,qBAAqBM;IACxC,MAAM,EAAEE,IAAI,EAAEC,CAAC,EAAE,GAAGH;IACpB,MAAMI,WAAWH,WAAWI,MAAM,CAACC,IAAI,EAAEC,oBACrC;QACEC,OAAO,OAAOR,IAAIE,IAAI,EAAEM,UAAU,WAAWR,IAAIE,IAAI,CAACM,KAAK,GAAG;QAC9DC,UAAU,OAAOT,IAAIE,IAAI,EAAEO,aAAa,WAAWT,IAAIE,IAAI,CAACO,QAAQ,GAAG;QACvEC,UAAU,OAAOV,IAAIE,IAAI,EAAEQ,aAAa,WAAWV,IAAIE,IAAI,CAACQ,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOR,IAAIE,IAAI,EAAEM,UAAU,WAAWR,IAAIE,IAAI,CAACM,KAAK,GAAG;QAC9DC,UAAU,OAAOT,IAAIE,IAAI,EAAEO,aAAa,WAAWT,IAAIE,IAAI,CAACO,QAAQ,GAAG;IACzE;IAEJ,MAAME,SAAS,MAAMb,2BAA2B;QAC9CG;QACAC,MAAM;YACJ,GAAGA,IAAI;YACP,GAAGE,QAAQ;QACb;QACAJ;IACF;IAEA,MAAMY,SAASf,sBAAsB;QACnCgB,sBAAsBZ,WAAWI,MAAM,CAACC,IAAI;QAC5CQ,cAAcd,IAAIe,OAAO,CAACV,MAAM,CAACS,YAAY;QAC7CE,OAAOL,OAAOK,KAAK;IACrB;IAEA,OAAOC,SAASC,IAAI,CAClB;QACEC,KAAKR,OAAOQ,GAAG;QACfC,SAASjB,EAAE;QACXa,OAAOL,OAAOK,KAAK;QACnBK,MAAMV,OAAOU,IAAI;IACnB,GACA;QACEC,SAAS3B,gBAAgB;YACvB2B,SAAS,IAAIC,QAAQ;gBACnB,cAAcX;YAChB;YACAZ;QACF;QACAwB,QAAQ5B,WAAW6B,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/resetPassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,oBAAoB,EAAE,cAwClC,CAAA"}
+{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/resetPassword.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D,eAAO,MAAM,oBAAoB,EAAE,cAwClC,CAAA"}

package/dist/auth/endpoints/resetPassword.js

@@ -1,6 +1,6 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { generatePayloadCookie } from '../cookies.js';
 import { resetPasswordOperation } from '../operations/resetPassword.js';
 export const resetPasswordHandler = async (req)=>{

package/dist/auth/endpoints/resetPassword.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/resetPassword.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { resetPasswordOperation } from '../operations/resetPassword.js'\n\nexport const resetPasswordHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n\n  const result = await resetPasswordOperation({\n    collection,\n    data: {\n      password: typeof req.data?.password === 'string' ? req.data.password : '',\n      token: typeof req.data?.token === 'string' ? req.data.token : '',\n    },\n    depth: depth ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token!,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passwordResetSuccessfully'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","generatePayloadCookie","resetPasswordOperation","resetPasswordHandler","req","collection","searchParams","t","depth","get","result","data","password","token","Number","undefined","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","removeTokenFromResponses","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,sBAAsB,QAAQ,iCAAgC;AAEvE,OAAO,MAAMC,uBAAuC,OAAOC;IACzD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAE/B,MAAMC,SAAS,MAAMR,uBAAuB;QAC1CG;QACAM,MAAM;YACJC,UAAU,OAAOR,IAAIO,IAAI,EAAEC,aAAa,WAAWR,IAAIO,IAAI,CAACC,QAAQ,GAAG;YACvEC,OAAO,OAAOT,IAAIO,IAAI,EAAEE,UAAU,WAAWT,IAAIO,IAAI,CAACE,KAAK,GAAG;QAChE;QACAL,OAAOA,QAAQM,OAAON,SAASO;QAC/BX;IACF;IAEA,MAAMY,SAASf,sBAAsB;QACnCgB,sBAAsBZ,WAAWa,MAAM,CAACC,IAAI;QAC5CC,cAAchB,IAAIiB,OAAO,CAACH,MAAM,CAACE,YAAY;QAC7CP,OAAOH,OAAOG,KAAK;IACrB;IAEA,IAAIR,WAAWa,MAAM,CAACC,IAAI,CAACG,wBAAwB,EAAE;QACnD,OAAOZ,OAAOG,KAAK;IACrB;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASlB,EAAE;QACX,GAAGG,MAAM;IACX,GACA;QACEgB,SAAS1B,gBAAgB;YACvB0B,SAAS,IAAIC,QAAQ;gBACnB,cAAcX;YAChB;YACAZ;QACF;QACAP,QAAQC,WAAW8B,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/resetPassword.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { generatePayloadCookie } from '../cookies.js'\nimport { resetPasswordOperation } from '../operations/resetPassword.js'\n\nexport const resetPasswordHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { searchParams, t } = req\n  const depth = searchParams.get('depth')\n\n  const result = await resetPasswordOperation({\n    collection,\n    data: {\n      password: typeof req.data?.password === 'string' ? req.data.password : '',\n      token: typeof req.data?.token === 'string' ? req.data.token : '',\n    },\n    depth: depth ? Number(depth) : undefined,\n    req,\n  })\n\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: collection.config.auth,\n    cookiePrefix: req.payload.config.cookiePrefix,\n    token: result.token!,\n  })\n\n  if (collection.config.auth.removeTokenFromResponses) {\n    delete result.token\n  }\n\n  return Response.json(\n    {\n      message: t('authentication:passwordResetSuccessfully'),\n      ...result,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers({\n          'Set-Cookie': cookie,\n        }),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["getRequestCollection","headersWithCors","httpStatus","generatePayloadCookie","resetPasswordOperation","resetPasswordHandler","req","collection","searchParams","t","depth","get","result","data","password","token","Number","undefined","cookie","collectionAuthConfig","config","auth","cookiePrefix","payload","removeTokenFromResponses","Response","json","message","headers","Headers","status","OK"],"mappings":"AAEA,SAASA,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,qBAAqB,QAAQ,gBAAe;AACrD,SAASC,sBAAsB,QAAQ,iCAAgC;AAEvE,OAAO,MAAMC,uBAAuC,OAAOC;IACzD,MAAMC,aAAaP,qBAAqBM;IACxC,MAAM,EAAEE,YAAY,EAAEC,CAAC,EAAE,GAAGH;IAC5B,MAAMI,QAAQF,aAAaG,GAAG,CAAC;IAE/B,MAAMC,SAAS,MAAMR,uBAAuB;QAC1CG;QACAM,MAAM;YACJC,UAAU,OAAOR,IAAIO,IAAI,EAAEC,aAAa,WAAWR,IAAIO,IAAI,CAACC,QAAQ,GAAG;YACvEC,OAAO,OAAOT,IAAIO,IAAI,EAAEE,UAAU,WAAWT,IAAIO,IAAI,CAACE,KAAK,GAAG;QAChE;QACAL,OAAOA,QAAQM,OAAON,SAASO;QAC/BX;IACF;IAEA,MAAMY,SAASf,sBAAsB;QACnCgB,sBAAsBZ,WAAWa,MAAM,CAACC,IAAI;QAC5CC,cAAchB,IAAIiB,OAAO,CAACH,MAAM,CAACE,YAAY;QAC7CP,OAAOH,OAAOG,KAAK;IACrB;IAEA,IAAIR,WAAWa,MAAM,CAACC,IAAI,CAACG,wBAAwB,EAAE;QACnD,OAAOZ,OAAOG,KAAK;IACrB;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASlB,EAAE;QACX,GAAGG,MAAM;IACX,GACA;QACEgB,SAAS3B,gBAAgB;YACvB2B,SAAS,IAAIC,QAAQ;gBACnB,cAAcX;YAChB;YACAZ;QACF;QACAwB,QAAQ5B,WAAW6B,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/revealAPIKey.d.ts

@@ -0,0 +1,7 @@
+import type { PayloadHandler } from '../../config/types.js';
+/**
+ * Reveals an encrypted API key when the collection explicitly enables reveal support.
+ * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.
+ */
+export declare const revealAPIKeyHandler: PayloadHandler;
+//# sourceMappingURL=revealAPIKey.d.ts.map

package/dist/auth/endpoints/revealAPIKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revealAPIKey.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/revealAPIKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAS3D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,cAmFjC,CAAA"}

package/dist/auth/endpoints/revealAPIKey.js

@@ -0,0 +1,122 @@
+import { combineQueries } from '../../database/combineQueries.js';
+import { UnauthorizedError } from '../../errors/UnauthorizedError.js';
+import { fieldAffectsData } from '../../fields/config/types.js';
+import { canAccessAdmin } from '../../utilities/canAccessAdmin.js';
+import { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js';
+import { executeAccess } from '../executeAccess.js';
+/**
+ * Reveals an encrypted API key when the collection explicitly enables reveal support.
+ * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.
+ */ export const revealAPIKeyHandler = async (req)=>{
+    const { id, collection } = getRequestCollectionWithID(req);
+    const useAPIKey = collection.config.auth.useAPIKey;
+    if (typeof useAPIKey !== 'object' || useAPIKey.reveal !== true || !req.user) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    try {
+        await canAccessAdmin({
+            req
+        });
+    } catch (error) {
+        if (error instanceof UnauthorizedError) {
+            return Response.json({
+                error: 'Forbidden'
+            }, {
+                status: 403
+            });
+        }
+        throw error;
+    }
+    const userWithReadAccess = await req.payload.findByID({
+        id,
+        collection: collection.config.slug,
+        depth: 0,
+        disableErrors: true,
+        overrideAccess: false,
+        req
+    });
+    if (!userWithReadAccess) {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    // Reveal is treated as a no-op update, so `data` reflects the current document.
+    const updateAccess = await executeAccess({
+        id,
+        slug: collection.config.slug,
+        data: userWithReadAccess,
+        disableErrors: true,
+        req
+    }, collection.config.access.update);
+    if (!updateAccess) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const user = await req.payload.db.findOne({
+        collection: collection.config.slug,
+        req,
+        select: {
+            apiKey: true
+        },
+        where: combineQueries({
+            id: {
+                equals: id
+            }
+        }, updateAccess)
+    });
+    if (!user) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const apiKeyField = collection.config.fields.find((field)=>fieldAffectsData(field) && field.name === 'apiKey');
+    if (!apiKeyField || !fieldAffectsData(apiKeyField) || !apiKeyField.access?.update) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    const canUpdateAPIKey = await apiKeyField.access.update({
+        id,
+        collection: collection.config,
+        data: {},
+        doc: userWithReadAccess,
+        req,
+        siblingData: {}
+    });
+    if (!canUpdateAPIKey) {
+        return Response.json({
+            error: 'Forbidden'
+        }, {
+            status: 403
+        });
+    }
+    if (!('apiKey' in user) || typeof user.apiKey !== 'string') {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    return Response.json({
+        apiKey: req.payload.decrypt(user.apiKey)
+    }, {
+        headers: {
+            'Cache-Control': 'no-store'
+        }
+    });
+};
+
+//# sourceMappingURL=revealAPIKey.js.map

package/dist/auth/endpoints/revealAPIKey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/endpoints/revealAPIKey.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { combineQueries } from '../../database/combineQueries.js'\nimport { UnauthorizedError } from '../../errors/UnauthorizedError.js'\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { canAccessAdmin } from '../../utilities/canAccessAdmin.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { executeAccess } from '../executeAccess.js'\n\n/**\n * Reveals an encrypted API key when the collection explicitly enables reveal support.\n * This endpoint is only injected when `auth.useAPIKey.reveal` is `true`.\n */\nexport const revealAPIKeyHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req)\n  const useAPIKey = collection.config.auth.useAPIKey\n\n  if (typeof useAPIKey !== 'object' || useAPIKey.reveal !== true || !req.user) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  try {\n    await canAccessAdmin({ req })\n  } catch (error) {\n    if (error instanceof UnauthorizedError) {\n      return Response.json({ error: 'Forbidden' }, { status: 403 })\n    }\n\n    throw error\n  }\n\n  const userWithReadAccess = await req.payload.findByID({\n    id,\n    collection: collection.config.slug,\n    depth: 0,\n    disableErrors: true,\n    overrideAccess: false,\n    req,\n  })\n\n  if (!userWithReadAccess) {\n    return Response.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  // Reveal is treated as a no-op update, so `data` reflects the current document.\n  const updateAccess = await executeAccess(\n    { id, slug: collection.config.slug, data: userWithReadAccess, disableErrors: true, req },\n    collection.config.access.update,\n  )\n\n  if (!updateAccess) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const user = await req.payload.db.findOne({\n    collection: collection.config.slug,\n    req,\n    select: {\n      apiKey: true,\n    },\n    where: combineQueries({ id: { equals: id } }, updateAccess),\n  })\n\n  if (!user) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const apiKeyField = collection.config.fields.find(\n    (field) => fieldAffectsData(field) && field.name === 'apiKey',\n  )\n\n  if (!apiKeyField || !fieldAffectsData(apiKeyField) || !apiKeyField.access?.update) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const canUpdateAPIKey = await apiKeyField.access.update({\n    id,\n    collection: collection.config,\n    data: {},\n    doc: userWithReadAccess,\n    req,\n    siblingData: {},\n  })\n\n  if (!canUpdateAPIKey) {\n    return Response.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  if (!('apiKey' in user) || typeof user.apiKey !== 'string') {\n    return Response.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  return Response.json(\n    { apiKey: req.payload.decrypt(user.apiKey) },\n    { headers: { 'Cache-Control': 'no-store' } },\n  )\n}\n"],"names":["combineQueries","UnauthorizedError","fieldAffectsData","canAccessAdmin","getRequestCollectionWithID","executeAccess","revealAPIKeyHandler","req","id","collection","useAPIKey","config","auth","reveal","user","Response","json","error","status","userWithReadAccess","payload","findByID","slug","depth","disableErrors","overrideAccess","updateAccess","data","access","update","db","findOne","select","apiKey","where","equals","apiKeyField","fields","find","field","name","canUpdateAPIKey","doc","siblingData","decrypt","headers"],"mappings":"AAEA,SAASA,cAAc,QAAQ,mCAAkC;AACjE,SAASC,iBAAiB,QAAQ,oCAAmC;AACrE,SAASC,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,cAAc,QAAQ,oCAAmC;AAClE,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,aAAa,QAAQ,sBAAqB;AAEnD;;;CAGC,GACD,OAAO,MAAMC,sBAAsC,OAAOC;IACxD,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGL,2BAA2BG;IACtD,MAAMG,YAAYD,WAAWE,MAAM,CAACC,IAAI,CAACF,SAAS;IAElD,IAAI,OAAOA,cAAc,YAAYA,UAAUG,MAAM,KAAK,QAAQ,CAACN,IAAIO,IAAI,EAAE;QAC3E,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,IAAI;QACF,MAAMf,eAAe;YAAEI;QAAI;IAC7B,EAAE,OAAOU,OAAO;QACd,IAAIA,iBAAiBhB,mBAAmB;YACtC,OAAOc,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAAY,GAAG;gBAAEC,QAAQ;YAAI;QAC7D;QAEA,MAAMD;IACR;IAEA,MAAME,qBAAqB,MAAMZ,IAAIa,OAAO,CAACC,QAAQ,CAAC;QACpDb;QACAC,YAAYA,WAAWE,MAAM,CAACW,IAAI;QAClCC,OAAO;QACPC,eAAe;QACfC,gBAAgB;QAChBlB;IACF;IAEA,IAAI,CAACY,oBAAoB;QACvB,OAAOJ,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,gFAAgF;IAChF,MAAMQ,eAAe,MAAMrB,cACzB;QAAEG;QAAIc,MAAMb,WAAWE,MAAM,CAACW,IAAI;QAAEK,MAAMR;QAAoBK,eAAe;QAAMjB;IAAI,GACvFE,WAAWE,MAAM,CAACiB,MAAM,CAACC,MAAM;IAGjC,IAAI,CAACH,cAAc;QACjB,OAAOX,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMJ,OAAO,MAAMP,IAAIa,OAAO,CAACU,EAAE,CAACC,OAAO,CAAC;QACxCtB,YAAYA,WAAWE,MAAM,CAACW,IAAI;QAClCf;QACAyB,QAAQ;YACNC,QAAQ;QACV;QACAC,OAAOlC,eAAe;YAAEQ,IAAI;gBAAE2B,QAAQ3B;YAAG;QAAE,GAAGkB;IAChD;IAEA,IAAI,CAACZ,MAAM;QACT,OAAOC,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMkB,cAAc3B,WAAWE,MAAM,CAAC0B,MAAM,CAACC,IAAI,CAC/C,CAACC,QAAUrC,iBAAiBqC,UAAUA,MAAMC,IAAI,KAAK;IAGvD,IAAI,CAACJ,eAAe,CAAClC,iBAAiBkC,gBAAgB,CAACA,YAAYR,MAAM,EAAEC,QAAQ;QACjF,OAAOd,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,MAAMuB,kBAAkB,MAAML,YAAYR,MAAM,CAACC,MAAM,CAAC;QACtDrB;QACAC,YAAYA,WAAWE,MAAM;QAC7BgB,MAAM,CAAC;QACPe,KAAKvB;QACLZ;QACAoC,aAAa,CAAC;IAChB;IAEA,IAAI,CAACF,iBAAiB;QACpB,OAAO1B,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,IAAI,CAAE,CAAA,YAAYJ,IAAG,KAAM,OAAOA,KAAKmB,MAAM,KAAK,UAAU;QAC1D,OAAOlB,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAY,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,OAAOH,SAASC,IAAI,CAClB;QAAEiB,QAAQ1B,IAAIa,OAAO,CAACwB,OAAO,CAAC9B,KAAKmB,MAAM;IAAE,GAC3C;QAAEY,SAAS;YAAE,iBAAiB;QAAW;IAAE;AAE/C,EAAC"}

package/dist/auth/endpoints/unlock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/unlock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,aAAa,EAAE,cAgC3B,CAAA"}
+{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/unlock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,aAAa,EAAE,cAgC3B,CAAA"}

package/dist/auth/endpoints/unlock.js

@@ -1,6 +1,6 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { unlockOperation } from '../operations/unlock.js';
 export const unlockHandler = async (req)=>{
     const collection = getRequestCollection(req);

package/dist/auth/endpoints/unlock.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/unlock.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { unlockOperation } from '../operations/unlock.js'\n\nexport const unlockHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { t } = req\n\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n        }\n\n  await unlockOperation({\n    collection,\n    data: authData,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('general:success'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollection","headersWithCors","unlockOperation","unlockHandler","req","collection","t","authData","config","auth","loginWithUsername","email","data","username","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,aAAaL,qBAAqBI;IACxC,MAAM,EAAEE,CAAC,EAAE,GAAGF;IAEd,MAAMG,WACJF,WAAWG,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOT,IAAIQ,IAAI,EAAEC,aAAa,WAAWT,IAAIQ,IAAI,CAACC,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;IAChE;IAEN,MAAMT,gBAAgB;QACpBG;QACAO,MAAML;QACNH;IACF;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASV,EAAE;IACb,GACA;QACEW,SAAShB,gBAAgB;YACvBgB,SAAS,IAAIC;YACbd;QACF;QACAN,QAAQC,WAAWoB,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/unlock.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { unlockOperation } from '../operations/unlock.js'\n\nexport const unlockHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n  const { t } = req\n\n  const authData =\n    collection.config.auth?.loginWithUsername !== false\n      ? {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n          username: typeof req.data?.username === 'string' ? req.data.username : '',\n        }\n      : {\n          email: typeof req.data?.email === 'string' ? req.data.email : '',\n        }\n\n  await unlockOperation({\n    collection,\n    data: authData,\n    req,\n  })\n\n  return Response.json(\n    {\n      message: t('general:success'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["getRequestCollection","headersWithCors","httpStatus","unlockOperation","unlockHandler","req","collection","t","authData","config","auth","loginWithUsername","email","data","username","Response","json","message","headers","Headers","status","OK"],"mappings":"AAEA,SAASA,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,eAAe,QAAQ,0BAAyB;AAEzD,OAAO,MAAMC,gBAAgC,OAAOC;IAClD,MAAMC,aAAaN,qBAAqBK;IACxC,MAAM,EAAEE,CAAC,EAAE,GAAGF;IAEd,MAAMG,WACJF,WAAWG,MAAM,CAACC,IAAI,EAAEC,sBAAsB,QAC1C;QACEC,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;QAC9DE,UAAU,OAAOT,IAAIQ,IAAI,EAAEC,aAAa,WAAWT,IAAIQ,IAAI,CAACC,QAAQ,GAAG;IACzE,IACA;QACEF,OAAO,OAAOP,IAAIQ,IAAI,EAAED,UAAU,WAAWP,IAAIQ,IAAI,CAACD,KAAK,GAAG;IAChE;IAEN,MAAMT,gBAAgB;QACpBG;QACAO,MAAML;QACNH;IACF;IAEA,OAAOU,SAASC,IAAI,CAClB;QACEC,SAASV,EAAE;IACb,GACA;QACEW,SAASjB,gBAAgB;YACvBiB,SAAS,IAAIC;YACbd;QACF;QACAe,QAAQlB,WAAWmB,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/endpoints/verifyEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyEmail.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/verifyEmail.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAM3D,eAAO,MAAM,kBAAkB,EAAE,cAqBhC,CAAA"}
+{"version":3,"file":"verifyEmail.d.ts","sourceRoot":"","sources":["../../../src/auth/endpoints/verifyEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,eAAO,MAAM,kBAAkB,EAAE,cAqBhC,CAAA"}

package/dist/auth/endpoints/verifyEmail.js

@@ -1,6 +1,6 @@
-import { status as httpStatus } from 'http-status';
 import { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { httpStatus } from '../../utilities/httpStatus.js';
 import { verifyEmailOperation } from '../operations/verifyEmail.js';
 export const verifyEmailHandler = async (req)=>{
     const { id, collection } = getRequestCollectionWithID(req, {

package/dist/auth/endpoints/verifyEmail.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/endpoints/verifyEmail.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { verifyEmailOperation } from '../operations/verifyEmail.js'\n\nexport const verifyEmailHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { disableSanitize: true })\n  const { t } = req\n  await verifyEmailOperation({\n    collection,\n    req,\n    token: id,\n  })\n\n  return Response.json(\n    {\n      message: t('authentication:accountVerified'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["status","httpStatus","getRequestCollectionWithID","headersWithCors","verifyEmailOperation","verifyEmailHandler","req","id","collection","disableSanitize","t","token","Response","json","message","headers","Headers","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAIlD,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,oBAAoB,QAAQ,+BAA8B;AAEnE,OAAO,MAAMC,qBAAqC,OAAOC;IACvD,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGN,2BAA2BI,KAAK;QAAEG,iBAAiB;IAAK;IACnF,MAAM,EAAEC,CAAC,EAAE,GAAGJ;IACd,MAAMF,qBAAqB;QACzBI;QACAF;QACAK,OAAOJ;IACT;IAEA,OAAOK,SAASC,IAAI,CAClB;QACEC,SAASJ,EAAE;IACb,GACA;QACEK,SAASZ,gBAAgB;YACvBY,SAAS,IAAIC;YACbV;QACF;QACAN,QAAQC,WAAWgB,EAAE;IACvB;AAEJ,EAAC"}
+{"version":3,"sources":["../../../src/auth/endpoints/verifyEmail.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { httpStatus } from '../../utilities/httpStatus.js'\nimport { verifyEmailOperation } from '../operations/verifyEmail.js'\n\nexport const verifyEmailHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { disableSanitize: true })\n  const { t } = req\n  await verifyEmailOperation({\n    collection,\n    req,\n    token: id,\n  })\n\n  return Response.json(\n    {\n      message: t('authentication:accountVerified'),\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.OK,\n    },\n  )\n}\n"],"names":["getRequestCollectionWithID","headersWithCors","httpStatus","verifyEmailOperation","verifyEmailHandler","req","id","collection","disableSanitize","t","token","Response","json","message","headers","Headers","status","OK"],"mappings":"AAEA,SAASA,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,eAAe,QAAQ,qCAAoC;AACpE,SAASC,UAAU,QAAQ,gCAA+B;AAC1D,SAASC,oBAAoB,QAAQ,+BAA8B;AAEnE,OAAO,MAAMC,qBAAqC,OAAOC;IACvD,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGP,2BAA2BK,KAAK;QAAEG,iBAAiB;IAAK;IACnF,MAAM,EAAEC,CAAC,EAAE,GAAGJ;IACd,MAAMF,qBAAqB;QACzBI;QACAF;QACAK,OAAOJ;IACT;IAEA,OAAOK,SAASC,IAAI,CAClB;QACEC,SAASJ,EAAE;IACb,GACA;QACEK,SAASb,gBAAgB;YACvBa,SAAS,IAAIC;YACbV;QACF;QACAW,QAAQd,WAAWe,EAAE;IACvB;AAEJ,EAAC"}

package/dist/auth/ensureUsernameOrEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensureUsernameOrEmail.d.ts","sourceRoot":"","sources":["../../src/auth/ensureUsernameOrEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAA;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjF,KAAK,2BAA2B,CAAC,KAAK,SAAS,cAAc,IAAI;IAC/D,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;IAC7C,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,CAAC,EAAE,KAAK,CAAA;CACpB,GACD;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;CACnD,CACJ,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,KAAK,SAAS,cAAc,EAAE,kHAOjE,2BAA2B,CAAC,KAAK,CAAC,SAiDpC,CAAA"}
+{"version":3,"file":"ensureUsernameOrEmail.d.ts","sourceRoot":"","sources":["../../src/auth/ensureUsernameOrEmail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAA;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjF,KAAK,2BAA2B,CAAC,KAAK,SAAS,cAAc,IAAI;IAC/D,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;IAC7C,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,CAAC,EAAE,KAAK,CAAA;CACpB,GACD;IACE,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAA;CACnD,CACJ,CAAA;AACD,eAAO,MAAM,qBAAqB,GAAI,KAAK,SAAS,cAAc,oHAO/D,2BAA2B,CAAC,KAAK,CAAC,SAiDpC,CAAA"}

package/dist/auth/executeAccess.d.ts

@@ -6,7 +6,8 @@ type OperationArgs = {
     id?: number | string;
     isReadingStaticFile?: boolean;
     req: PayloadRequest;
+    slug: string;
 };
-export declare const executeAccess: ({ id, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access: Access) => Promise<AccessResult>;
+export declare const executeAccess: ({ id, slug, data, disableErrors, isReadingStaticFile, req }: OperationArgs, access?: Access) => Promise<AccessResult>;
 export {};
 //# sourceMappingURL=executeAccess.d.ts.map

package/dist/auth/executeAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,eAAO,MAAM,aAAa,GACxB,uDAA+D,aAAa,EAC5E,QAAQ,MAAM,KACb,OAAO,CAAC,YAAY,CA0BtB,CAAA"}
+{"version":3,"file":"executeAccess.d.ts","sourceRoot":"","sources":["../../src/auth/executeAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AACD,eAAO,MAAM,aAAa,gEAC6C,aAAa,WACzE,MAAM,KACd,OAAO,CAAC,YAAY,CA2BtB,CAAA"}

package/dist/auth/executeAccess.js

@@ -1,8 +1,9 @@
 import { Forbidden } from '../errors/index.js';
-export const executeAccess = async ({ id, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
+export const executeAccess = async ({ id, slug, data, disableErrors, isReadingStaticFile = false, req }, access)=>{
     if (access) {
         const resolvedConstraint = await access({
             id,
+            slug,
             data,
             isReadingStaticFile,
             req

package/dist/auth/executeAccess.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/executeAccess.ts"],"sourcesContent":["import type { Access, AccessResult } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { Forbidden } from '../errors/index.js'\n\ntype OperationArgs = {\n  data?: any\n  disableErrors?: boolean\n  id?: number | string\n  isReadingStaticFile?: boolean\n  req: PayloadRequest\n}\nexport const executeAccess = async (\n  { id, data, disableErrors, isReadingStaticFile = false, req }: OperationArgs,\n  access: Access,\n): Promise<AccessResult> => {\n  if (access) {\n    const resolvedConstraint = await access({\n      id,\n      data,\n      isReadingStaticFile,\n      req,\n    })\n\n    if (!resolvedConstraint) {\n      if (!disableErrors) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    return resolvedConstraint\n  }\n\n  if (req.user) {\n    return true\n  }\n\n  if (!disableErrors) {\n    throw new Forbidden(req.t)\n  }\n  return false\n}\n"],"names":["Forbidden","executeAccess","id","data","disableErrors","isReadingStaticFile","req","access","resolvedConstraint","t","user"],"mappings":"AAGA,SAASA,SAAS,QAAQ,qBAAoB;AAS9C,OAAO,MAAMC,gBAAgB,OAC3B,EAAEC,EAAE,EAAEC,IAAI,EAAEC,aAAa,EAAEC,sBAAsB,KAAK,EAAEC,GAAG,EAAiB,EAC5EC;IAEA,IAAIA,QAAQ;QACV,MAAMC,qBAAqB,MAAMD,OAAO;YACtCL;YACAC;YACAE;YACAC;QACF;QAEA,IAAI,CAACE,oBAAoB;YACvB,IAAI,CAACJ,eAAe;gBAClB,MAAM,IAAIJ,UAAUM,IAAIG,CAAC;YAC3B;QACF;QAEA,OAAOD;IACT;IAEA,IAAIF,IAAII,IAAI,EAAE;QACZ,OAAO;IACT;IAEA,IAAI,CAACN,eAAe;QAClB,MAAM,IAAIJ,UAAUM,IAAIG,CAAC;IAC3B;IACA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/executeAccess.ts"],"sourcesContent":["import type { Access, AccessResult } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { Forbidden } from '../errors/index.js'\n\ntype OperationArgs = {\n  data?: any\n  disableErrors?: boolean\n  id?: number | string\n  isReadingStaticFile?: boolean\n  req: PayloadRequest\n  slug: string\n}\nexport const executeAccess = async (\n  { id, slug, data, disableErrors, isReadingStaticFile = false, req }: OperationArgs,\n  access?: Access,\n): Promise<AccessResult> => {\n  if (access) {\n    const resolvedConstraint = await access({\n      id,\n      slug,\n      data,\n      isReadingStaticFile,\n      req,\n    })\n\n    if (!resolvedConstraint) {\n      if (!disableErrors) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    return resolvedConstraint\n  }\n\n  if (req.user) {\n    return true\n  }\n\n  if (!disableErrors) {\n    throw new Forbidden(req.t)\n  }\n  return false\n}\n"],"names":["Forbidden","executeAccess","id","slug","data","disableErrors","isReadingStaticFile","req","access","resolvedConstraint","t","user"],"mappings":"AAGA,SAASA,SAAS,QAAQ,qBAAoB;AAU9C,OAAO,MAAMC,gBAAgB,OAC3B,EAAEC,EAAE,EAAEC,IAAI,EAAEC,IAAI,EAAEC,aAAa,EAAEC,sBAAsB,KAAK,EAAEC,GAAG,EAAiB,EAClFC;IAEA,IAAIA,QAAQ;QACV,MAAMC,qBAAqB,MAAMD,OAAO;YACtCN;YACAC;YACAC;YACAE;YACAC;QACF;QAEA,IAAI,CAACE,oBAAoB;YACvB,IAAI,CAACJ,eAAe;gBAClB,MAAM,IAAIL,UAAUO,IAAIG,CAAC;YAC3B;QACF;QAEA,OAAOD;IACT;IAEA,IAAIF,IAAII,IAAI,EAAE;QACZ,OAAO;IACT;IAEA,IAAI,CAACN,eAAe;QAClB,MAAM,IAAIL,UAAUO,IAAIG,CAAC;IAC3B;IACA,OAAO;AACT,EAAC"}

package/dist/auth/executeAuthStrategies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executeAuthStrategies.d.ts","sourceRoot":"","sources":["../../src/auth/executeAuthStrategies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAI9E,eAAO,MAAM,qBAAqB,GAChC,MAAM,wBAAwB,KAC7B,OAAO,CAAC,kBAAkB,CA+B5B,CAAA"}
+{"version":3,"file":"executeAuthStrategies.d.ts","sourceRoot":"","sources":["../../src/auth/executeAuthStrategies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAI9E,eAAO,MAAM,qBAAqB,SAC1B,wBAAwB,KAC7B,OAAO,CAAC,kBAAkB,CA+B5B,CAAA"}

package/dist/auth/extractAccessFromPermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractAccessFromPermission.d.ts","sourceRoot":"","sources":["../../src/auth/extractAccessFromPermission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,eAAO,MAAM,2BAA2B,GAAI,eAAe,OAAO,GAAG,UAAU,KAAG,YAajF,CAAA"}
+{"version":3,"file":"extractAccessFromPermission.d.ts","sourceRoot":"","sources":["../../src/auth/extractAccessFromPermission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,eAAO,MAAM,2BAA2B,kBAAmB,OAAO,GAAG,UAAU,KAAG,YAajF,CAAA"}

package/dist/auth/extractJWT.d.ts

@@ -1,3 +1,3 @@
 import type { AuthStrategyFunctionArgs } from './index.js';
-export declare const extractJWT: (args: Omit<AuthStrategyFunctionArgs, "strategyName">) => null | string;
+export declare const extractJWT: (args: Omit<AuthStrategyFunctionArgs, 'strategyName'>) => null | string;
 //# sourceMappingURL=extractJWT.d.ts.map

package/dist/auth/extractJWT.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractJWT.d.ts","sourceRoot":"","sources":["../../src/auth/extractJWT.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AA+D1D,eAAO,MAAM,UAAU,GAAI,MAAM,IAAI,CAAC,wBAAwB,EAAE,cAAc,CAAC,KAAG,IAAI,GAAG,MAcxF,CAAA"}
+{"version":3,"file":"extractJWT.d.ts","sourceRoot":"","sources":["../../src/auth/extractJWT.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAiF1D,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,wBAAwB,EAAE,cAAc,CAAC,KAAG,IAAI,GAAG,MAcxF,CAAA"}

package/dist/auth/extractJWT.js

@@ -33,6 +33,22 @@ const extractionMethods = {
         if (secFetchSite === 'same-origin' || secFetchSite === 'same-site' || secFetchSite === 'none') {
             return cookieToken;
         }
+        // Sec-Fetch-Site is omitted by browsers for same-origin navigations over plain HTTP on
+        // non-localhost hosts (it is only sent to potentially trustworthy origins). Its absence is
+        // therefore inconclusive rather than cross-site — fall back to validating the Referer
+        // header's origin against the same csrf allowlist.
+        if (!secFetchSite) {
+            const referer = headers.get('Referer');
+            if (referer) {
+                try {
+                    if (payload.config.csrf.includes(new URL(referer).origin)) {
+                        return cookieToken;
+                    }
+                } catch  {
+                // Malformed Referer — fall through to reject
+                }
+            }
+        }
         // Reject cross-site requests and missing header (non-browser clients)
         return null;
     },

package/dist/auth/extractJWT.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/extractJWT.ts"],"sourcesContent":["import type { BasePayload } from '../index.js'\nimport type { AuthStrategyFunctionArgs } from './index.js'\n\nimport { parseCookies } from '../utilities/parseCookies.js'\n\ntype ExtractionMethod = (args: { headers: Headers; payload: BasePayload }) => null | string\n\nconst extractionMethods: Record<string, ExtractionMethod> = {\n  Bearer: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    // RFC6750 OAuth 2.0 Bearer token\n    if (jwtFromHeader?.startsWith('Bearer ')) {\n      return jwtFromHeader.replace('Bearer ', '')\n    }\n\n    return null\n  },\n  cookie: ({ headers, payload }) => {\n    const cookies = parseCookies(headers)\n    const tokenCookieName = `${payload.config.cookiePrefix}-token`\n    const cookieToken = cookies.get(tokenCookieName)\n\n    if (!cookieToken) {\n      return null\n    }\n\n    const origin = headers.get('Origin')\n\n    // Origin present — validate against csrf allowlist\n    if (origin) {\n      if (payload.config.csrf.length === 0 || payload.config.csrf.includes(origin)) {\n        return cookieToken\n      }\n      return null\n    }\n\n    // No Origin and no csrf configured — no allowlist to enforce\n    if (payload.config.csrf.length === 0) {\n      return cookieToken\n    }\n\n    // No Origin with csrf configured — fall back to Sec-Fetch-Site\n    const secFetchSite = headers.get('Sec-Fetch-Site')\n\n    // Allow same-origin, same-site, and direct navigations (none)\n    if (secFetchSite === 'same-origin' || secFetchSite === 'same-site' || secFetchSite === 'none') {\n      return cookieToken\n    }\n\n    // Reject cross-site requests and missing header (non-browser clients)\n    return null\n  },\n  JWT: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    if (jwtFromHeader?.startsWith('JWT ')) {\n      return jwtFromHeader.replace('JWT ', '')\n    }\n\n    return null\n  },\n}\n\nexport const extractJWT = (args: Omit<AuthStrategyFunctionArgs, 'strategyName'>): null | string => {\n  const { headers, payload } = args\n\n  const extractionOrder = payload.config.auth.jwtOrder\n\n  for (const extractionStrategy of extractionOrder) {\n    const result = extractionMethods[extractionStrategy]!({ headers, payload })\n\n    if (result) {\n      return result\n    }\n  }\n\n  return null\n}\n"],"names":["parseCookies","extractionMethods","Bearer","headers","jwtFromHeader","get","startsWith","replace","cookie","payload","cookies","tokenCookieName","config","cookiePrefix","cookieToken","origin","csrf","length","includes","secFetchSite","JWT","extractJWT","args","extractionOrder","auth","jwtOrder","extractionStrategy","result"],"mappings":"AAGA,SAASA,YAAY,QAAQ,+BAA8B;AAI3D,MAAMC,oBAAsD;IAC1DC,QAAQ,CAAC,EAAEC,OAAO,EAAE;QAClB,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,iCAAiC;QACjC,IAAID,eAAeE,WAAW,YAAY;YACxC,OAAOF,cAAcG,OAAO,CAAC,WAAW;QAC1C;QAEA,OAAO;IACT;IACAC,QAAQ,CAAC,EAAEL,OAAO,EAAEM,OAAO,EAAE;QAC3B,MAAMC,UAAUV,aAAaG;QAC7B,MAAMQ,kBAAkB,GAAGF,QAAQG,MAAM,CAACC,YAAY,CAAC,MAAM,CAAC;QAC9D,MAAMC,cAAcJ,QAAQL,GAAG,CAACM;QAEhC,IAAI,CAACG,aAAa;YAChB,OAAO;QACT;QAEA,MAAMC,SAASZ,QAAQE,GAAG,CAAC;QAE3B,mDAAmD;QACnD,IAAIU,QAAQ;YACV,IAAIN,QAAQG,MAAM,CAACI,IAAI,CAACC,MAAM,KAAK,KAAKR,QAAQG,MAAM,CAACI,IAAI,CAACE,QAAQ,CAACH,SAAS;gBAC5E,OAAOD;YACT;YACA,OAAO;QACT;QAEA,6DAA6D;QAC7D,IAAIL,QAAQG,MAAM,CAACI,IAAI,CAACC,MAAM,KAAK,GAAG;YACpC,OAAOH;QACT;QAEA,+DAA+D;QAC/D,MAAMK,eAAehB,QAAQE,GAAG,CAAC;QAEjC,8DAA8D;QAC9D,IAAIc,iBAAiB,iBAAiBA,iBAAiB,eAAeA,iBAAiB,QAAQ;YAC7F,OAAOL;QACT;QAEA,sEAAsE;QACtE,OAAO;IACT;IACAM,KAAK,CAAC,EAAEjB,OAAO,EAAE;QACf,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,IAAID,eAAeE,WAAW,SAAS;YACrC,OAAOF,cAAcG,OAAO,CAAC,QAAQ;QACvC;QAEA,OAAO;IACT;AACF;AAEA,OAAO,MAAMc,aAAa,CAACC;IACzB,MAAM,EAAEnB,OAAO,EAAEM,OAAO,EAAE,GAAGa;IAE7B,MAAMC,kBAAkBd,QAAQG,MAAM,CAACY,IAAI,CAACC,QAAQ;IAEpD,KAAK,MAAMC,sBAAsBH,gBAAiB;QAChD,MAAMI,SAAS1B,iBAAiB,CAACyB,mBAAmB,CAAE;YAAEvB;YAASM;QAAQ;QAEzE,IAAIkB,QAAQ;YACV,OAAOA;QACT;IACF;IAEA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/extractJWT.ts"],"sourcesContent":["import type { BasePayload } from '../index.js'\nimport type { AuthStrategyFunctionArgs } from './index.js'\n\nimport { parseCookies } from '../utilities/parseCookies.js'\n\ntype ExtractionMethod = (args: { headers: Headers; payload: BasePayload }) => null | string\n\nconst extractionMethods: Record<string, ExtractionMethod> = {\n  Bearer: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    // RFC6750 OAuth 2.0 Bearer token\n    if (jwtFromHeader?.startsWith('Bearer ')) {\n      return jwtFromHeader.replace('Bearer ', '')\n    }\n\n    return null\n  },\n  cookie: ({ headers, payload }) => {\n    const cookies = parseCookies(headers)\n    const tokenCookieName = `${payload.config.cookiePrefix}-token`\n    const cookieToken = cookies.get(tokenCookieName)\n\n    if (!cookieToken) {\n      return null\n    }\n\n    const origin = headers.get('Origin')\n\n    // Origin present — validate against csrf allowlist\n    if (origin) {\n      if (payload.config.csrf.length === 0 || payload.config.csrf.includes(origin)) {\n        return cookieToken\n      }\n      return null\n    }\n\n    // No Origin and no csrf configured — no allowlist to enforce\n    if (payload.config.csrf.length === 0) {\n      return cookieToken\n    }\n\n    // No Origin with csrf configured — fall back to Sec-Fetch-Site\n    const secFetchSite = headers.get('Sec-Fetch-Site')\n\n    // Allow same-origin, same-site, and direct navigations (none)\n    if (secFetchSite === 'same-origin' || secFetchSite === 'same-site' || secFetchSite === 'none') {\n      return cookieToken\n    }\n\n    // Sec-Fetch-Site is omitted by browsers for same-origin navigations over plain HTTP on\n    // non-localhost hosts (it is only sent to potentially trustworthy origins). Its absence is\n    // therefore inconclusive rather than cross-site — fall back to validating the Referer\n    // header's origin against the same csrf allowlist.\n    if (!secFetchSite) {\n      const referer = headers.get('Referer')\n\n      if (referer) {\n        try {\n          if (payload.config.csrf.includes(new URL(referer).origin)) {\n            return cookieToken\n          }\n        } catch {\n          // Malformed Referer — fall through to reject\n        }\n      }\n    }\n\n    // Reject cross-site requests and missing header (non-browser clients)\n    return null\n  },\n  JWT: ({ headers }) => {\n    const jwtFromHeader = headers.get('Authorization')\n\n    if (jwtFromHeader?.startsWith('JWT ')) {\n      return jwtFromHeader.replace('JWT ', '')\n    }\n\n    return null\n  },\n}\n\nexport const extractJWT = (args: Omit<AuthStrategyFunctionArgs, 'strategyName'>): null | string => {\n  const { headers, payload } = args\n\n  const extractionOrder = payload.config.auth.jwtOrder\n\n  for (const extractionStrategy of extractionOrder) {\n    const result = extractionMethods[extractionStrategy]!({ headers, payload })\n\n    if (result) {\n      return result\n    }\n  }\n\n  return null\n}\n"],"names":["parseCookies","extractionMethods","Bearer","headers","jwtFromHeader","get","startsWith","replace","cookie","payload","cookies","tokenCookieName","config","cookiePrefix","cookieToken","origin","csrf","length","includes","secFetchSite","referer","URL","JWT","extractJWT","args","extractionOrder","auth","jwtOrder","extractionStrategy","result"],"mappings":"AAGA,SAASA,YAAY,QAAQ,+BAA8B;AAI3D,MAAMC,oBAAsD;IAC1DC,QAAQ,CAAC,EAAEC,OAAO,EAAE;QAClB,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,iCAAiC;QACjC,IAAID,eAAeE,WAAW,YAAY;YACxC,OAAOF,cAAcG,OAAO,CAAC,WAAW;QAC1C;QAEA,OAAO;IACT;IACAC,QAAQ,CAAC,EAAEL,OAAO,EAAEM,OAAO,EAAE;QAC3B,MAAMC,UAAUV,aAAaG;QAC7B,MAAMQ,kBAAkB,GAAGF,QAAQG,MAAM,CAACC,YAAY,CAAC,MAAM,CAAC;QAC9D,MAAMC,cAAcJ,QAAQL,GAAG,CAACM;QAEhC,IAAI,CAACG,aAAa;YAChB,OAAO;QACT;QAEA,MAAMC,SAASZ,QAAQE,GAAG,CAAC;QAE3B,mDAAmD;QACnD,IAAIU,QAAQ;YACV,IAAIN,QAAQG,MAAM,CAACI,IAAI,CAACC,MAAM,KAAK,KAAKR,QAAQG,MAAM,CAACI,IAAI,CAACE,QAAQ,CAACH,SAAS;gBAC5E,OAAOD;YACT;YACA,OAAO;QACT;QAEA,6DAA6D;QAC7D,IAAIL,QAAQG,MAAM,CAACI,IAAI,CAACC,MAAM,KAAK,GAAG;YACpC,OAAOH;QACT;QAEA,+DAA+D;QAC/D,MAAMK,eAAehB,QAAQE,GAAG,CAAC;QAEjC,8DAA8D;QAC9D,IAAIc,iBAAiB,iBAAiBA,iBAAiB,eAAeA,iBAAiB,QAAQ;YAC7F,OAAOL;QACT;QAEA,uFAAuF;QACvF,2FAA2F;QAC3F,sFAAsF;QACtF,mDAAmD;QACnD,IAAI,CAACK,cAAc;YACjB,MAAMC,UAAUjB,QAAQE,GAAG,CAAC;YAE5B,IAAIe,SAAS;gBACX,IAAI;oBACF,IAAIX,QAAQG,MAAM,CAACI,IAAI,CAACE,QAAQ,CAAC,IAAIG,IAAID,SAASL,MAAM,GAAG;wBACzD,OAAOD;oBACT;gBACF,EAAE,OAAM;gBACN,6CAA6C;gBAC/C;YACF;QACF;QAEA,sEAAsE;QACtE,OAAO;IACT;IACAQ,KAAK,CAAC,EAAEnB,OAAO,EAAE;QACf,MAAMC,gBAAgBD,QAAQE,GAAG,CAAC;QAElC,IAAID,eAAeE,WAAW,SAAS;YACrC,OAAOF,cAAcG,OAAO,CAAC,QAAQ;QACvC;QAEA,OAAO;IACT;AACF;AAEA,OAAO,MAAMgB,aAAa,CAACC;IACzB,MAAM,EAAErB,OAAO,EAAEM,OAAO,EAAE,GAAGe;IAE7B,MAAMC,kBAAkBhB,QAAQG,MAAM,CAACc,IAAI,CAACC,QAAQ;IAEpD,KAAK,MAAMC,sBAAsBH,gBAAiB;QAChD,MAAMI,SAAS5B,iBAAiB,CAAC2B,mBAAmB,CAAE;YAAEzB;YAASM;QAAQ;QAEzE,IAAIoB,QAAQ;YACV,OAAOA;QACT;IACF;IAEA,OAAO;AACT,EAAC"}

package/dist/auth/getAccessResults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getAccessResults.d.ts","sourceRoot":"","sources":["../../src/auth/getAccessResults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKnE,KAAK,oBAAoB,GAAG;IAC1B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,GACJ,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqEtD"}
+{"version":3,"file":"getAccessResults.d.ts","sourceRoot":"","sources":["../../src/auth/getAccessResults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKnE,KAAK,oBAAoB,GAAG;IAC1B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,GACJ,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2EtD"}

package/dist/auth/getAccessResults.js

@@ -10,6 +10,7 @@ export async function getAccessResults({ req }) {
     const userCollectionConfig = user && user.collection ? payload?.collections?.[user.collection]?.config : null;
     if (userCollectionConfig && payload.config.admin.user === user?.collection) {
         results.canAccessAdmin = userCollectionConfig.access.admin ? await userCollectionConfig.access.admin({
+            slug: userCollectionConfig.slug,
             req
         }) : isLoggedIn;
     } else {
@@ -21,7 +22,8 @@ export async function getAccessResults({ req }) {
             'create',
             'read',
             'update',
-            'delete'
+            'delete',
+            'validate'
         ];
         if (collection.auth && typeof collection.auth.maxLoginAttempts !== 'undefined' && collection.auth.maxLoginAttempts !== 0) {
             collectionOperations.push('unlock');
@@ -42,7 +44,8 @@ export async function getAccessResults({ req }) {
     await Promise.all(payload.config.globals.map(async (global)=>{
         const globalOperations = [
             'read',
-            'update'
+            'update',
+            'validate'
         ];
         if (global.versions) {
             globalOperations.push('readVersions');

package/dist/auth/getAccessResults.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getAccessResults.ts"],"sourcesContent":["import type { AllOperations, PayloadRequest } from '../types/index.js'\nimport type { Permissions, SanitizedPermissions } from './types.js'\n\nimport { getEntityPermissions } from '../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { sanitizePermissions } from '../utilities/sanitizePermissions.js'\n\ntype GetAccessResultsArgs = {\n  req: PayloadRequest\n}\nexport async function getAccessResults({\n  req,\n}: GetAccessResultsArgs): Promise<SanitizedPermissions> {\n  const results = {\n    collections: {},\n    globals: {},\n  } as Permissions\n  const { payload, user } = req\n\n  const isLoggedIn = !!user\n  const userCollectionConfig =\n    user && user.collection ? payload?.collections?.[user.collection]?.config : null\n\n  if (userCollectionConfig && payload.config.admin.user === user?.collection) {\n    results.canAccessAdmin = userCollectionConfig.access.admin\n      ? await userCollectionConfig.access.admin({ req })\n      : isLoggedIn\n  } else {\n    results.canAccessAdmin = false\n  }\n  const blockReferencesPermissions = {}\n\n  await Promise.all(\n    payload.config.collections.map(async (collection) => {\n      const collectionOperations: AllOperations[] = ['create', 'read', 'update', 'delete']\n\n      if (\n        collection.auth &&\n        typeof collection.auth.maxLoginAttempts !== 'undefined' &&\n        collection.auth.maxLoginAttempts !== 0\n      ) {\n        collectionOperations.push('unlock')\n      }\n\n      if (collection.versions) {\n        collectionOperations.push('readVersions')\n      }\n\n      const collectionPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: collection,\n        entityType: 'collection',\n        fetchData: false,\n        operations: collectionOperations,\n        req,\n      })\n      results.collections![collection.slug] = collectionPermissions\n    }),\n  )\n\n  await Promise.all(\n    payload.config.globals.map(async (global) => {\n      const globalOperations: AllOperations[] = ['read', 'update']\n\n      if (global.versions) {\n        globalOperations.push('readVersions')\n      }\n\n      const globalPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: global,\n        entityType: 'global',\n        fetchData: false,\n        operations: globalOperations,\n        req,\n      })\n      results.globals![global.slug] = globalPermissions\n    }),\n  )\n\n  return sanitizePermissions(results)\n}\n"],"names":["getEntityPermissions","sanitizePermissions","getAccessResults","req","results","collections","globals","payload","user","isLoggedIn","userCollectionConfig","collection","config","admin","canAccessAdmin","access","blockReferencesPermissions","Promise","all","map","collectionOperations","auth","maxLoginAttempts","push","versions","collectionPermissions","entity","entityType","fetchData","operations","slug","global","globalOperations","globalPermissions"],"mappings":"AAGA,SAASA,oBAAoB,QAAQ,4DAA2D;AAChG,SAASC,mBAAmB,QAAQ,sCAAqC;AAKzE,OAAO,eAAeC,iBAAiB,EACrCC,GAAG,EACkB;IACrB,MAAMC,UAAU;QACdC,aAAa,CAAC;QACdC,SAAS,CAAC;IACZ;IACA,MAAM,EAAEC,OAAO,EAAEC,IAAI,EAAE,GAAGL;IAE1B,MAAMM,aAAa,CAAC,CAACD;IACrB,MAAME,uBACJF,QAAQA,KAAKG,UAAU,GAAGJ,SAASF,aAAa,CAACG,KAAKG,UAAU,CAAC,EAAEC,SAAS;IAE9E,IAAIF,wBAAwBH,QAAQK,MAAM,CAACC,KAAK,CAACL,IAAI,KAAKA,MAAMG,YAAY;QAC1EP,QAAQU,cAAc,GAAGJ,qBAAqBK,MAAM,CAACF,KAAK,GACtD,MAAMH,qBAAqBK,MAAM,CAACF,KAAK,CAAC;YAAEV;QAAI,KAC9CM;IACN,OAAO;QACLL,QAAQU,cAAc,GAAG;IAC3B;IACA,MAAME,6BAA6B,CAAC;IAEpC,MAAMC,QAAQC,GAAG,CACfX,QAAQK,MAAM,CAACP,WAAW,CAACc,GAAG,CAAC,OAAOR;QACpC,MAAMS,uBAAwC;YAAC;YAAU;YAAQ;YAAU;SAAS;QAEpF,IACET,WAAWU,IAAI,IACf,OAAOV,WAAWU,IAAI,CAACC,gBAAgB,KAAK,eAC5CX,WAAWU,IAAI,CAACC,gBAAgB,KAAK,GACrC;YACAF,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,IAAIZ,WAAWa,QAAQ,EAAE;YACvBJ,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,MAAME,wBAAwB,MAAMzB,qBAAqB;YACvDgB;YACAU,QAAQf;YACRgB,YAAY;YACZC,WAAW;YACXC,YAAYT;YACZjB;QACF;QACAC,QAAQC,WAAW,AAAC,CAACM,WAAWmB,IAAI,CAAC,GAAGL;IAC1C;IAGF,MAAMR,QAAQC,GAAG,CACfX,QAAQK,MAAM,CAACN,OAAO,CAACa,GAAG,CAAC,OAAOY;QAChC,MAAMC,mBAAoC;YAAC;YAAQ;SAAS;QAE5D,IAAID,OAAOP,QAAQ,EAAE;YACnBQ,iBAAiBT,IAAI,CAAC;QACxB;QAEA,MAAMU,oBAAoB,MAAMjC,qBAAqB;YACnDgB;YACAU,QAAQK;YACRJ,YAAY;YACZC,WAAW;YACXC,YAAYG;YACZ7B;QACF;QACAC,QAAQE,OAAO,AAAC,CAACyB,OAAOD,IAAI,CAAC,GAAGG;IAClC;IAGF,OAAOhC,oBAAoBG;AAC7B"}
+{"version":3,"sources":["../../src/auth/getAccessResults.ts"],"sourcesContent":["import type { AllOperations, PayloadRequest } from '../types/index.js'\nimport type { Permissions, SanitizedPermissions } from './types.js'\n\nimport { getEntityPermissions } from '../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { sanitizePermissions } from '../utilities/sanitizePermissions.js'\n\ntype GetAccessResultsArgs = {\n  req: PayloadRequest\n}\nexport async function getAccessResults({\n  req,\n}: GetAccessResultsArgs): Promise<SanitizedPermissions> {\n  const results = {\n    collections: {},\n    globals: {},\n  } as Permissions\n  const { payload, user } = req\n\n  const isLoggedIn = !!user\n  const userCollectionConfig =\n    user && user.collection ? payload?.collections?.[user.collection]?.config : null\n\n  if (userCollectionConfig && payload.config.admin.user === user?.collection) {\n    results.canAccessAdmin = userCollectionConfig.access.admin\n      ? await userCollectionConfig.access.admin({ slug: userCollectionConfig.slug, req })\n      : isLoggedIn\n  } else {\n    results.canAccessAdmin = false\n  }\n  const blockReferencesPermissions = {}\n\n  await Promise.all(\n    payload.config.collections.map(async (collection) => {\n      const collectionOperations: AllOperations[] = [\n        'create',\n        'read',\n        'update',\n        'delete',\n        'validate',\n      ]\n\n      if (\n        collection.auth &&\n        typeof collection.auth.maxLoginAttempts !== 'undefined' &&\n        collection.auth.maxLoginAttempts !== 0\n      ) {\n        collectionOperations.push('unlock')\n      }\n\n      if (collection.versions) {\n        collectionOperations.push('readVersions')\n      }\n\n      const collectionPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: collection,\n        entityType: 'collection',\n        fetchData: false,\n        operations: collectionOperations,\n        req,\n      })\n      results.collections![collection.slug] = collectionPermissions\n    }),\n  )\n\n  await Promise.all(\n    payload.config.globals.map(async (global) => {\n      const globalOperations: AllOperations[] = ['read', 'update', 'validate']\n\n      if (global.versions) {\n        globalOperations.push('readVersions')\n      }\n\n      const globalPermissions = await getEntityPermissions({\n        blockReferencesPermissions,\n        entity: global,\n        entityType: 'global',\n        fetchData: false,\n        operations: globalOperations,\n        req,\n      })\n      results.globals![global.slug] = globalPermissions\n    }),\n  )\n\n  return sanitizePermissions(results)\n}\n"],"names":["getEntityPermissions","sanitizePermissions","getAccessResults","req","results","collections","globals","payload","user","isLoggedIn","userCollectionConfig","collection","config","admin","canAccessAdmin","access","slug","blockReferencesPermissions","Promise","all","map","collectionOperations","auth","maxLoginAttempts","push","versions","collectionPermissions","entity","entityType","fetchData","operations","global","globalOperations","globalPermissions"],"mappings":"AAGA,SAASA,oBAAoB,QAAQ,4DAA2D;AAChG,SAASC,mBAAmB,QAAQ,sCAAqC;AAKzE,OAAO,eAAeC,iBAAiB,EACrCC,GAAG,EACkB;IACrB,MAAMC,UAAU;QACdC,aAAa,CAAC;QACdC,SAAS,CAAC;IACZ;IACA,MAAM,EAAEC,OAAO,EAAEC,IAAI,EAAE,GAAGL;IAE1B,MAAMM,aAAa,CAAC,CAACD;IACrB,MAAME,uBACJF,QAAQA,KAAKG,UAAU,GAAGJ,SAASF,aAAa,CAACG,KAAKG,UAAU,CAAC,EAAEC,SAAS;IAE9E,IAAIF,wBAAwBH,QAAQK,MAAM,CAACC,KAAK,CAACL,IAAI,KAAKA,MAAMG,YAAY;QAC1EP,QAAQU,cAAc,GAAGJ,qBAAqBK,MAAM,CAACF,KAAK,GACtD,MAAMH,qBAAqBK,MAAM,CAACF,KAAK,CAAC;YAAEG,MAAMN,qBAAqBM,IAAI;YAAEb;QAAI,KAC/EM;IACN,OAAO;QACLL,QAAQU,cAAc,GAAG;IAC3B;IACA,MAAMG,6BAA6B,CAAC;IAEpC,MAAMC,QAAQC,GAAG,CACfZ,QAAQK,MAAM,CAACP,WAAW,CAACe,GAAG,CAAC,OAAOT;QACpC,MAAMU,uBAAwC;YAC5C;YACA;YACA;YACA;YACA;SACD;QAED,IACEV,WAAWW,IAAI,IACf,OAAOX,WAAWW,IAAI,CAACC,gBAAgB,KAAK,eAC5CZ,WAAWW,IAAI,CAACC,gBAAgB,KAAK,GACrC;YACAF,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,IAAIb,WAAWc,QAAQ,EAAE;YACvBJ,qBAAqBG,IAAI,CAAC;QAC5B;QAEA,MAAME,wBAAwB,MAAM1B,qBAAqB;YACvDiB;YACAU,QAAQhB;YACRiB,YAAY;YACZC,WAAW;YACXC,YAAYT;YACZlB;QACF;QACAC,QAAQC,WAAW,AAAC,CAACM,WAAWK,IAAI,CAAC,GAAGU;IAC1C;IAGF,MAAMR,QAAQC,GAAG,CACfZ,QAAQK,MAAM,CAACN,OAAO,CAACc,GAAG,CAAC,OAAOW;QAChC,MAAMC,mBAAoC;YAAC;YAAQ;YAAU;SAAW;QAExE,IAAID,OAAON,QAAQ,EAAE;YACnBO,iBAAiBR,IAAI,CAAC;QACxB;QAEA,MAAMS,oBAAoB,MAAMjC,qBAAqB;YACnDiB;YACAU,QAAQI;YACRH,YAAY;YACZC,WAAW;YACXC,YAAYE;YACZ7B;QACF;QACAC,QAAQE,OAAO,AAAC,CAACyB,OAAOf,IAAI,CAAC,GAAGiB;IAClC;IAGF,OAAOhC,oBAAoBG;AAC7B"}

package/dist/auth/getAuthFields.d.ts

@@ -1,4 +1,4 @@
 import type { Field } from '../fields/config/types.js';
 import type { IncomingAuthType } from './types.js';
-export declare const getBaseAuthFields: (authConfig: IncomingAuthType) => Field[];
+export declare const getBaseAuthFields: (authConfig: IncomingAuthType, fields?: Field[]) => Field[];
 //# sourceMappingURL=getAuthFields.d.ts.map

package/dist/auth/getAuthFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getAuthFields.d.ts","sourceRoot":"","sources":["../../src/auth/getAuthFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAUlD,eAAO,MAAM,iBAAiB,GAAI,YAAY,gBAAgB,KAAG,KAAK,EAmDrE,CAAA"}
+{"version":3,"file":"getAuthFields.d.ts","sourceRoot":"","sources":["../../src/auth/getAuthFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAUlD,eAAO,MAAM,iBAAiB,eAAgB,gBAAgB,WAAU,KAAK,EAAE,KAAQ,KAAK,EA0D3F,CAAA"}

package/dist/auth/getAuthFields.js

@@ -1,14 +1,14 @@
 import { accountLockFields } from './baseFields/accountLock.js';
-import { createAPIKeyFields } from './baseFields/apiKey.js';
-import { baseAuthFields } from './baseFields/auth.js';
+import { getAPIKeyFields } from './baseFields/apiKey.js';
+import { baseAuthFields, resetPasswordRequestedAtField } from './baseFields/auth.js';
 import { emailFieldConfig } from './baseFields/email.js';
 import { sessionsFieldConfig } from './baseFields/sessions.js';
 import { usernameFieldConfig } from './baseFields/username.js';
 import { verificationFields } from './baseFields/verification.js';
-export const getBaseAuthFields = (authConfig)=>{
+export const getBaseAuthFields = (authConfig, fields = [])=>{
     const authFields = [];
     if (authConfig.useAPIKey) {
-        authFields.push(...createAPIKeyFields());
+        authFields.push(...getAPIKeyFields(fields));
     }
     if (!authConfig.disableLocalStrategy || typeof authConfig.disableLocalStrategy === 'object' && authConfig.disableLocalStrategy.enableFields) {
         const emailField = {
@@ -36,6 +36,9 @@ export const getBaseAuthFields = (authConfig)=>{
             authFields.push(usernameField);
         }
         authFields.push(...baseAuthFields);
+        if (authConfig.forgotPassword?.minRequestInterval && authConfig.forgotPassword.minRequestInterval > 0) {
+            authFields.push(resetPasswordRequestedAtField);
+        }
         if (authConfig.verify) {
             authFields.push(...verificationFields);
         }

package/dist/auth/getAuthFields.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/getAuthFields.ts"],"sourcesContent":["import type { Field, TextField } from '../fields/config/types.js'\nimport type { IncomingAuthType } from './types.js'\n\nimport { accountLockFields } from './baseFields/accountLock.js'\nimport { createAPIKeyFields } from './baseFields/apiKey.js'\nimport { baseAuthFields } from './baseFields/auth.js'\nimport { emailFieldConfig } from './baseFields/email.js'\nimport { sessionsFieldConfig } from './baseFields/sessions.js'\nimport { usernameFieldConfig } from './baseFields/username.js'\nimport { verificationFields } from './baseFields/verification.js'\n\nexport const getBaseAuthFields = (authConfig: IncomingAuthType): Field[] => {\n  const authFields: Field[] = []\n\n  if (authConfig.useAPIKey) {\n    authFields.push(...createAPIKeyFields())\n  }\n\n  if (\n    !authConfig.disableLocalStrategy ||\n    (typeof authConfig.disableLocalStrategy === 'object' &&\n      authConfig.disableLocalStrategy.enableFields)\n  ) {\n    const emailField = { ...emailFieldConfig }\n    let usernameField: TextField | undefined\n\n    if (authConfig.loginWithUsername) {\n      usernameField = { ...usernameFieldConfig }\n      if (typeof authConfig.loginWithUsername === 'object') {\n        if (authConfig.loginWithUsername.requireEmail === false) {\n          emailField.required = false\n        }\n        if (authConfig.loginWithUsername.requireUsername === false) {\n          usernameField.required = false\n        }\n        if (authConfig.loginWithUsername.allowEmailLogin === false) {\n          emailField.unique = false\n        }\n      }\n    }\n\n    authFields.push(emailField)\n    if (usernameField) {\n      authFields.push(usernameField)\n    }\n\n    authFields.push(...baseAuthFields)\n\n    if (authConfig.verify) {\n      authFields.push(...verificationFields)\n    }\n\n    if (authConfig?.maxLoginAttempts && authConfig.maxLoginAttempts > 0) {\n      authFields.push(...accountLockFields)\n    }\n\n    if (authConfig.useSessions) {\n      authFields.push(sessionsFieldConfig)\n    }\n  }\n\n  return authFields\n}\n"],"names":["accountLockFields","createAPIKeyFields","baseAuthFields","emailFieldConfig","sessionsFieldConfig","usernameFieldConfig","verificationFields","getBaseAuthFields","authConfig","authFields","useAPIKey","push","disableLocalStrategy","enableFields","emailField","usernameField","loginWithUsername","requireEmail","required","requireUsername","allowEmailLogin","unique","verify","maxLoginAttempts","useSessions"],"mappings":"AAGA,SAASA,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,kBAAkB,QAAQ,yBAAwB;AAC3D,SAASC,cAAc,QAAQ,uBAAsB;AACrD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,+BAA8B;AAEjE,OAAO,MAAMC,oBAAoB,CAACC;IAChC,MAAMC,aAAsB,EAAE;IAE9B,IAAID,WAAWE,SAAS,EAAE;QACxBD,WAAWE,IAAI,IAAIV;IACrB;IAEA,IACE,CAACO,WAAWI,oBAAoB,IAC/B,OAAOJ,WAAWI,oBAAoB,KAAK,YAC1CJ,WAAWI,oBAAoB,CAACC,YAAY,EAC9C;QACA,MAAMC,aAAa;YAAE,GAAGX,gBAAgB;QAAC;QACzC,IAAIY;QAEJ,IAAIP,WAAWQ,iBAAiB,EAAE;YAChCD,gBAAgB;gBAAE,GAAGV,mBAAmB;YAAC;YACzC,IAAI,OAAOG,WAAWQ,iBAAiB,KAAK,UAAU;gBACpD,IAAIR,WAAWQ,iBAAiB,CAACC,YAAY,KAAK,OAAO;oBACvDH,WAAWI,QAAQ,GAAG;gBACxB;gBACA,IAAIV,WAAWQ,iBAAiB,CAACG,eAAe,KAAK,OAAO;oBAC1DJ,cAAcG,QAAQ,GAAG;gBAC3B;gBACA,IAAIV,WAAWQ,iBAAiB,CAACI,eAAe,KAAK,OAAO;oBAC1DN,WAAWO,MAAM,GAAG;gBACtB;YACF;QACF;QAEAZ,WAAWE,IAAI,CAACG;QAChB,IAAIC,eAAe;YACjBN,WAAWE,IAAI,CAACI;QAClB;QAEAN,WAAWE,IAAI,IAAIT;QAEnB,IAAIM,WAAWc,MAAM,EAAE;YACrBb,WAAWE,IAAI,IAAIL;QACrB;QAEA,IAAIE,YAAYe,oBAAoBf,WAAWe,gBAAgB,GAAG,GAAG;YACnEd,WAAWE,IAAI,IAAIX;QACrB;QAEA,IAAIQ,WAAWgB,WAAW,EAAE;YAC1Bf,WAAWE,IAAI,CAACP;QAClB;IACF;IAEA,OAAOK;AACT,EAAC"}
+{"version":3,"sources":["../../src/auth/getAuthFields.ts"],"sourcesContent":["import type { Field, TextField } from '../fields/config/types.js'\nimport type { IncomingAuthType } from './types.js'\n\nimport { accountLockFields } from './baseFields/accountLock.js'\nimport { getAPIKeyFields } from './baseFields/apiKey.js'\nimport { baseAuthFields, resetPasswordRequestedAtField } from './baseFields/auth.js'\nimport { emailFieldConfig } from './baseFields/email.js'\nimport { sessionsFieldConfig } from './baseFields/sessions.js'\nimport { usernameFieldConfig } from './baseFields/username.js'\nimport { verificationFields } from './baseFields/verification.js'\n\nexport const getBaseAuthFields = (authConfig: IncomingAuthType, fields: Field[] = []): Field[] => {\n  const authFields: Field[] = []\n\n  if (authConfig.useAPIKey) {\n    authFields.push(...getAPIKeyFields(fields))\n  }\n\n  if (\n    !authConfig.disableLocalStrategy ||\n    (typeof authConfig.disableLocalStrategy === 'object' &&\n      authConfig.disableLocalStrategy.enableFields)\n  ) {\n    const emailField = { ...emailFieldConfig }\n    let usernameField: TextField | undefined\n\n    if (authConfig.loginWithUsername) {\n      usernameField = { ...usernameFieldConfig }\n      if (typeof authConfig.loginWithUsername === 'object') {\n        if (authConfig.loginWithUsername.requireEmail === false) {\n          emailField.required = false\n        }\n        if (authConfig.loginWithUsername.requireUsername === false) {\n          usernameField.required = false\n        }\n        if (authConfig.loginWithUsername.allowEmailLogin === false) {\n          emailField.unique = false\n        }\n      }\n    }\n\n    authFields.push(emailField)\n    if (usernameField) {\n      authFields.push(usernameField)\n    }\n\n    authFields.push(...baseAuthFields)\n\n    if (\n      authConfig.forgotPassword?.minRequestInterval &&\n      authConfig.forgotPassword.minRequestInterval > 0\n    ) {\n      authFields.push(resetPasswordRequestedAtField)\n    }\n\n    if (authConfig.verify) {\n      authFields.push(...verificationFields)\n    }\n\n    if (authConfig?.maxLoginAttempts && authConfig.maxLoginAttempts > 0) {\n      authFields.push(...accountLockFields)\n    }\n\n    if (authConfig.useSessions) {\n      authFields.push(sessionsFieldConfig)\n    }\n  }\n\n  return authFields\n}\n"],"names":["accountLockFields","getAPIKeyFields","baseAuthFields","resetPasswordRequestedAtField","emailFieldConfig","sessionsFieldConfig","usernameFieldConfig","verificationFields","getBaseAuthFields","authConfig","fields","authFields","useAPIKey","push","disableLocalStrategy","enableFields","emailField","usernameField","loginWithUsername","requireEmail","required","requireUsername","allowEmailLogin","unique","forgotPassword","minRequestInterval","verify","maxLoginAttempts","useSessions"],"mappings":"AAGA,SAASA,iBAAiB,QAAQ,8BAA6B;AAC/D,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,cAAc,EAAEC,6BAA6B,QAAQ,uBAAsB;AACpF,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,+BAA8B;AAEjE,OAAO,MAAMC,oBAAoB,CAACC,YAA8BC,SAAkB,EAAE;IAClF,MAAMC,aAAsB,EAAE;IAE9B,IAAIF,WAAWG,SAAS,EAAE;QACxBD,WAAWE,IAAI,IAAIZ,gBAAgBS;IACrC;IAEA,IACE,CAACD,WAAWK,oBAAoB,IAC/B,OAAOL,WAAWK,oBAAoB,KAAK,YAC1CL,WAAWK,oBAAoB,CAACC,YAAY,EAC9C;QACA,MAAMC,aAAa;YAAE,GAAGZ,gBAAgB;QAAC;QACzC,IAAIa;QAEJ,IAAIR,WAAWS,iBAAiB,EAAE;YAChCD,gBAAgB;gBAAE,GAAGX,mBAAmB;YAAC;YACzC,IAAI,OAAOG,WAAWS,iBAAiB,KAAK,UAAU;gBACpD,IAAIT,WAAWS,iBAAiB,CAACC,YAAY,KAAK,OAAO;oBACvDH,WAAWI,QAAQ,GAAG;gBACxB;gBACA,IAAIX,WAAWS,iBAAiB,CAACG,eAAe,KAAK,OAAO;oBAC1DJ,cAAcG,QAAQ,GAAG;gBAC3B;gBACA,IAAIX,WAAWS,iBAAiB,CAACI,eAAe,KAAK,OAAO;oBAC1DN,WAAWO,MAAM,GAAG;gBACtB;YACF;QACF;QAEAZ,WAAWE,IAAI,CAACG;QAChB,IAAIC,eAAe;YACjBN,WAAWE,IAAI,CAACI;QAClB;QAEAN,WAAWE,IAAI,IAAIX;QAEnB,IACEO,WAAWe,cAAc,EAAEC,sBAC3BhB,WAAWe,cAAc,CAACC,kBAAkB,GAAG,GAC/C;YACAd,WAAWE,IAAI,CAACV;QAClB;QAEA,IAAIM,WAAWiB,MAAM,EAAE;YACrBf,WAAWE,IAAI,IAAIN;QACrB;QAEA,IAAIE,YAAYkB,oBAAoBlB,WAAWkB,gBAAgB,GAAG,GAAG;YACnEhB,WAAWE,IAAI,IAAIb;QACrB;QAEA,IAAIS,WAAWmB,WAAW,EAAE;YAC1BjB,WAAWE,IAAI,CAACR;QAClB;IACF;IAEA,OAAOM;AACT,EAAC"}

package/dist/auth/getFieldsToSign.d.ts

@@ -4,6 +4,6 @@ export declare const getFieldsToSign: (args: {
     collectionConfig: CollectionConfig;
     email: string;
     sid?: string;
-    user: PayloadRequest["user"];
+    user: PayloadRequest['user'];
 }) => Record<string, unknown>;
 //# sourceMappingURL=getFieldsToSign.d.ts.map

package/dist/auth/getFieldsToSign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAiHvD,eAAO,MAAM,eAAe,GAAI,MAAM;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoBzB,CAAA"}
+{"version":3,"file":"getFieldsToSign.d.ts","sourceRoot":"","sources":["../../src/auth/getFieldsToSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAmHvD,eAAO,MAAM,eAAe,SAAU;IACpC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAwBzB,CAAA"}

package/dist/auth/getFieldsToSign.js

@@ -1,4 +1,12 @@
 import { fieldAffectsData, tabHasName } from '../fields/config/types.js';
+const reservedJWTFields = new Set([
+    'collection',
+    'email',
+    'exp',
+    'iat',
+    'id',
+    'sid'
+]);
 const traverseFields = ({ data, // parent,
 fields, result })=>{
     fields.forEach((field)=>{
@@ -99,20 +107,22 @@ fields, result })=>{
 };
 export const getFieldsToSign = (args)=>{
     const { collectionConfig, email, sid, user } = args;
-    const result = {
-        id: user?.id,
-        collection: collectionConfig.slug,
-        email
-    };
-    if (sid) {
-        result.sid = sid;
-    }
+    const fieldsToSign = Object.create(null);
     traverseFields({
         data: user,
         fields: collectionConfig.fields,
-        result
+        result: fieldsToSign
     });
-    return result;
+    for (const fieldName of reservedJWTFields){
+        delete fieldsToSign[fieldName];
+    }
+    fieldsToSign.id = user?.id;
+    fieldsToSign.collection = collectionConfig.slug;
+    fieldsToSign.email = email;
+    if (sid) {
+        fieldsToSign.sid = sid;
+    }
+    return fieldsToSign;
 };
 
 //# sourceMappingURL=getFieldsToSign.js.map