Merge pull request #125 from authsmith/v0.7.3

sourabpramanik · web-flow · commit 93cf005e50fb · 2025-06-27T23:29:51.000+05:30
V0.7.3
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "payload-auth-plugin",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "type": "module",
   "sideEffects": false,
   "author": "Sourab Pramanik<shubpramanik241@gmail.com>",
diff --git a/src/core/errors/apiErrors.ts b/src/core/errors/apiErrors.ts
@@ -100,7 +100,7 @@ export class InternalServerError extends AuthAPIError {
 export class MissingOrInvalidVerification extends AuthAPIError {
   constructor() {
     super(
-      "Verifcation failed. Missing or invalid verification code.",
+      "Verification failed. Missing or invalid verification code.",
       ErrorKind.BadRequest,
     )
   }
diff --git a/src/core/protocols/email.ts b/src/core/protocols/email.ts
diff --git a/src/core/protocols/oauth/oauth_authentication.ts b/src/core/protocols/oauth/oauth_authentication.ts
@@ -31,8 +31,11 @@ export async function OAuthAuthentication(
     picture?: string | undefined
   },
 ): Promise<Response> {
-  const { email, sub, name, scope, issuer, picture } = account
+  const { email: _email, sub, name, scope, issuer, picture } = account
   const { payload } = request
+
+  const email = _email.toLowerCase()
+
   const userRecords = await payload.find({
     collection: collections.usersCollection,
     where: {
diff --git a/src/core/protocols/password.ts b/src/core/protocols/password.ts
@@ -1,11 +1,5 @@
+import { parseCookies, type PayloadRequest } from "payload"
 import {
-  BasePayload,
-  getCookieExpiration,
-  parseCookies,
-  type PayloadRequest,
-} from "payload"
-import {
-  AuthenticationFailed,
   EmailAlreadyExistError,
   InvalidCredentials,
   InvalidRequestBodyError,
@@ -16,14 +10,10 @@ import {
 import { hashPassword, verifyPassword } from "../utils/password.js"
 import { SuccessKind } from "../../types.js"
 import { ephemeralCode, verifyEphemeralCode } from "../utils/hash.js"
-import {
-  APP_COOKIE_SUFFIX,
-  EPHEMERAL_CODE_COOKIE_NAME,
-} from "../../constants.js"
+import { APP_COOKIE_SUFFIX } from "../../constants.js"
 import {
   createSessionCookies,
   invalidateOAuthCookies,
-  invalidateSessionCookies,
   verifySessionCookie,
 } from "../utils/cookies.js"
 
@@ -72,11 +62,13 @@ export const PasswordSignin = async (
     return new InvalidRequestBodyError()
   }
 
+  const email = body.email.toLowerCase()
+
   const { payload } = request
   const { docs } = await payload.find({
     collection: internal.usersCollectionSlug,
     where: {
-      email: { equals: body.email },
+      email: { equals: email },
     },
     limit: 1,
   })
@@ -104,7 +96,7 @@ export const PasswordSignin = async (
     : `__${pluginType}-${APP_COOKIE_SUFFIX}`
   const signinFields = {
     id: userRecord.id,
-    email: body.email,
+    email,
     collection: internal.usersCollectionSlug,
   }
   return await redirectWithSession(
@@ -140,11 +132,12 @@ export const PasswordSignup = async (
     return new InvalidRequestBodyError()
   }
 
+  const email = body.email.toLowerCase()
   const { payload } = request
   const { docs } = await payload.find({
     collection: internal.usersCollectionSlug,
     where: {
-      email: { equals: body.email },
+      email: { equals: email },
     },
     limit: 1,
   })
@@ -162,7 +155,7 @@ export const PasswordSignup = async (
   const userRecord = await payload.create({
     collection: internal.usersCollectionSlug,
     data: {
-      email: body.email,
+      email,
       hashedPassword: hashedPassword,
       hashIterations: iterations,
       hashSalt,
@@ -176,7 +169,7 @@ export const PasswordSignup = async (
       : `__${pluginType}-${APP_COOKIE_SUFFIX}`
     const signinFields = {
       id: userRecord.id,
-      email: body.email,
+      email,
       collection: internal.usersCollectionSlug,
     }
     return await redirectWithSession(
@@ -217,11 +210,11 @@ export const ForgotPasswordInit = async (
   if (!body?.email) {
     return new InvalidRequestBodyError()
   }
-
+  const email = body.email.toLowerCase()
   const { docs } = await payload.find({
     collection: internal.usersCollectionSlug,
     where: {
-      email: { equals: body.email },
+      email: { equals: email },
     },
     limit: 1,
   })
@@ -232,7 +225,7 @@ export const ForgotPasswordInit = async (
   const { code, hash } = await ephemeralCode(6, payload.secret)
 
   await payload.sendEmail({
-    to: body.email,
+    to: email,
     subject: "Password recovery",
     html: await emailTemplate({
       verificationCode: code,
@@ -375,10 +368,12 @@ export const ResetPassword = async (
     return new InvalidRequestBodyError()
   }
 
+  const email = body.email.toLowerCase()
+
   const { docs } = await payload.find({
     collection: internal.usersCollectionSlug,
     where: {
-      email: { equals: body.email },
+      email: { equals: email },
     },
     limit: 1,
   })
diff --git a/src/providers/oauth2/apple.ts b/src/providers/oauth2/apple.ts
@@ -7,8 +7,6 @@ import type {
 
 type AppleAuthConfig = OAuthBaseProviderConfig
 
-const algorithm = "oauth2"
-
 const authorization_server: AuthorizationServer = {
   issuer: "https://appleid.apple.com",
   authorization_endpoint: "https://appleid.apple.com/auth/authorize",
@@ -47,13 +45,15 @@ const authorization_server: AuthorizationServer = {
  */
 
 function AppleOAuth2Provider(config: AppleAuthConfig): OAuth2ProviderConfig {
+  const { overrideScope, ...restConfig } = config
+
   return {
-    ...config,
+    ...restConfig,
     id: "apple",
-    scope: "name email",
+    scope: overrideScope ?? "name email",
     authorization_server,
     name: "Apple",
-    algorithm,
+    algorithm: "oauth2",
     params: {
       ...config.params,
       response_mode: "form_post",
diff --git a/src/providers/oauth2/atlassian.ts b/src/providers/oauth2/atlassian.ts
@@ -49,13 +49,14 @@ type AtlassianAuthConfig = OAuthBaseProviderConfig
 function AtlassianAuthProvider(
   config: AtlassianAuthConfig,
 ): OAuth2ProviderConfig {
+  const { overrideScope, ...restConfig } = config
   return {
-    ...config,
+    ...restConfig,
     id: "atlassian",
     authorization_server,
     name: "Atlassian",
     algorithm,
-    scope: "read:me read:account",
+    scope: overrideScope ?? "read:me read:account",
     kind: "oauth",
     profile: (profile): AccountInfo => {
       return {
diff --git a/src/providers/oauth2/auth0.ts b/src/providers/oauth2/auth0.ts
@@ -41,7 +41,7 @@ interface Auth0AuthConfig extends OAuthBaseProviderConfig {
  */
 
 function Auth0AuthProvider(config: Auth0AuthConfig): OAuth2ProviderConfig {
-  const { domain, ...restConfig } = config
+  const { domain, overrideScope, ...restConfig } = config
   const authorization_server: oauth.AuthorizationServer = {
     issuer: `https://${domain}/`,
     authorization_endpoint: `https://${domain}/authorize`,
@@ -52,7 +52,7 @@ function Auth0AuthProvider(config: Auth0AuthConfig): OAuth2ProviderConfig {
   return {
     ...restConfig,
     id: "auth0",
-    scope: "openid email profile",
+    scope: overrideScope ?? "openid email profile",
     authorization_server,
     name: "Auth0",
     algorithm: "oauth2",
diff --git a/src/providers/oauth2/discord.ts b/src/providers/oauth2/discord.ts
@@ -42,10 +42,12 @@ type DiscordAuthConfig = OAuthBaseProviderConfig
  */
 
 function DiscordAuthProvider(config: DiscordAuthConfig): OAuth2ProviderConfig {
+  const { overrideScope, ...restConfig } = config
+
   return {
-    ...config,
+    ...restConfig,
     id: "discord",
-    scope: "identify email",
+    scope: overrideScope ?? "identify email",
     authorization_server,
     name: "Discord",
     algorithm: "oauth2",
diff --git a/src/providers/oauth2/facebook.ts b/src/providers/oauth2/facebook.ts
@@ -47,10 +47,12 @@ type FacebookAuthConfig = OAuthBaseProviderConfig
 function FacebookAuthProvider(
   config: FacebookAuthConfig,
 ): OAuth2ProviderConfig {
+  const { overrideScope, ...restConfig } = config
+
   return {
-    ...config,
+    ...restConfig,
     id: "facebook",
-    scope: "email",
+    scope: overrideScope ?? "email",
     authorization_server,
     name: "Facebook",
     algorithm: "oauth2",
diff --git a/src/providers/oauth2/github.ts b/src/providers/oauth2/github.ts
@@ -45,10 +45,12 @@ type GitHubAuthConfig = OAuthBaseProviderConfig
  */
 
 function GitHubAuthProvider(config: GitHubAuthConfig): OAuth2ProviderConfig {
+  const { overrideScope, ...restConfig } = config
+
   return {
-    ...config,
+    ...restConfig,
     id: "github",
-    scope: "openid email profile",
+    scope: overrideScope ?? "openid email profile",
     authorization_server,
     name: "GitHub",
     algorithm: "oauth2",
diff --git a/src/providers/oauth2/jumpcloud.ts b/src/providers/oauth2/jumpcloud.ts
@@ -45,10 +45,12 @@ type JumpCloudAuthConfig = OAuthBaseProviderConfig
 function JumpCloudAuthProvider(
   config: JumpCloudAuthConfig,
 ): OAuth2ProviderConfig {
+  const { overrideScope, ...restConfig } = config
+
   return {
-    ...config,
+    ...restConfig,
     id: "jumpcloud",
-    scope: "openid email profile",
+    scope: overrideScope ?? "openid email profile",
     authorization_server,
     name: "Jump Cloud",
     algorithm: "oauth2",
diff --git a/src/providers/oauth2/twitch.ts b/src/providers/oauth2/twitch.ts
@@ -44,16 +44,18 @@ type TwitchAuthConfig = OAuthBaseProviderConfig
  */
 
 function TwitchAuthProvider(config: TwitchAuthConfig): OAuth2ProviderConfig {
+  const { overrideScope, ...restConfig } = config
+
   return {
-    ...config,
+    ...restConfig,
     id: "twitch",
-    scope: "openid user:read:email",
+    scope: overrideScope ?? "openid user:read:email",
     authorization_server,
     name: "Twitch",
     algorithm: "oauth2",
     kind: "oauth",
     params: {
-      scope: "openid user:read:email",
+      scope: overrideScope ?? "openid user:read:email",
       claims: JSON.stringify({
         id_token: { email: null, picture: null, preferred_username: null },
         userinfo: { email: null, picture: null, preferred_username: null },
diff --git a/src/providers/oidc/apple.ts b/src/providers/oidc/apple.ts
@@ -1,6 +1,10 @@
-import type { AccountInfo, OIDCProviderConfig } from "../../types.js"
+import type {
+  AccountInfo,
+  OAuthBaseProviderConfig,
+  OIDCProviderConfig,
+} from "../../types.js"
 
-type AppleAuthConfig = {
+interface AppleAuthConfig extends OAuthBaseProviderConfig {
   client_id: string
   params?: Record<string, string>
 }
@@ -34,10 +38,11 @@ type AppleAuthConfig = {
  */
 
 function AppleOIDCAuthProvider(config: AppleAuthConfig): OIDCProviderConfig {
+  const { overrideScope, ...restConfig } = config
   return {
-    ...config,
+    ...restConfig,
     id: "apple",
-    scope: "openid name email",
+    scope: overrideScope ?? "openid name email",
     issuer: "https://appleid.apple.com",
     name: "Apple",
     algorithm: "oidc",
diff --git a/src/providers/oidc/cognito.ts b/src/providers/oidc/cognito.ts
@@ -6,8 +6,6 @@ import type {
 
 interface CognitoAuthConfig extends OAuthBaseProviderConfig {
   domain: string
-  region: string
-  scope?: string
 }
 
 /**
@@ -40,11 +38,11 @@ interface CognitoAuthConfig extends OAuthBaseProviderConfig {
  */
 
 function CognitoAuthProvider(config: CognitoAuthConfig): OIDCProviderConfig {
-  const { domain, region, scope, ...restConfig } = config
+  const { domain, overrideScope, ...restConfig } = config
   return {
     ...restConfig,
     id: "cognito",
-    scope: "email openid profile",
+    scope: overrideScope ?? "email openid profile",
     issuer: domain,
     name: "Congnito",
     algorithm: "oidc",
diff --git a/src/providers/oidc/gitlab.ts b/src/providers/oidc/gitlab.ts
@@ -37,14 +37,15 @@ type GitLabAuthConfig = OAuthBaseProviderConfig
  */
 
 function GitLabAuthProvider(config: GitLabAuthConfig): OIDCProviderConfig {
-  const algorithm = "oidc"
+  const { overrideScope, ...restConfig } = config
+
   return {
-    ...config,
+    ...restConfig,
     id: "gitlab",
-    scope: "openid email profile",
+    scope: overrideScope ?? "openid email profile",
     issuer: "https://gitlab.com",
     name: "GitLab",
-    algorithm,
+    algorithm: "oidc",
     kind: "oauth",
     profile: (profile): AccountInfo => {
       return {
diff --git a/src/providers/oidc/google.ts b/src/providers/oidc/google.ts
@@ -34,10 +34,12 @@ type GoogleAuthConfig = OAuthBaseProviderConfig
  */
 
 function GoogleAuthProvider(config: GoogleAuthConfig): OIDCProviderConfig {
+  const { overrideScope, ...restConfig } = config
+
   return {
     ...config,
     id: "google",
-    scope: "openid email profile",
+    scope: overrideScope ?? "openid email profile",
     issuer: "https://accounts.google.com",
     name: "Google",
     algorithm: "oidc",
diff --git a/src/providers/oidc/keycloak.ts b/src/providers/oidc/keycloak.ts
@@ -46,11 +46,12 @@ interface KeyCloakAuthConfig extends OAuthBaseProviderConfig {
  */
 
 function KeyCloakAuthProvider(config: KeyCloakAuthConfig): OIDCProviderConfig {
-  const { realm, domain, identifier, name, ...restConfig } = config
+  const { realm, domain, identifier, name, overrideScope, ...restConfig } =
+    config
   return {
     ...restConfig,
     id: identifier,
-    scope: "email openid profile",
+    scope: overrideScope ?? "email openid profile",
     issuer: `https://${domain}/realms/${realm}`,
     name,
     algorithm: "oidc",
diff --git a/src/providers/oidc/microsoft-entra.ts b/src/providers/oidc/microsoft-entra.ts
diff --git a/src/providers/oidc/okta.ts b/src/providers/oidc/okta.ts
diff --git a/src/providers/oidc/slack.ts b/src/providers/oidc/slack.ts
diff --git a/src/types.ts b/src/types.ts

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "payload-auth-plugin",`
`3`		`- "version": "0.7.2",`
	`3`	`+ "version": "0.7.3",`
`4`	`4`	`"type": "module",`
`5`	`5`	`"sideEffects": false,`
`6`	`6`	`"author": "Sourab Pramanik<shubpramanik241@gmail.com>",`
Original file line number	Diff line number	Diff line change
`@@ -100,7 +100,7 @@ export class InternalServerError extends AuthAPIError {`
`100`	`100`	`export class MissingOrInvalidVerification extends AuthAPIError {`
`101`	`101`	`constructor() {`
`102`	`102`	`super(`
`103`		`- "Verifcation failed. Missing or invalid verification code.",`
	`103`	`+ "Verification failed. Missing or invalid verification code.",`
`104`	`104`	`ErrorKind.BadRequest,`
`105`	`105`	`)`
`106`	`106`	`}`