Jarrod Flesch 4ae5577357 fix: add field-level access control to internal auth fields (#16119) ...

Adds field-level access control to internal auth fields (`hash`, `salt`,
`resetPasswordToken`, `resetPasswordExpiration`, `loginAttempts`,
`lockUntil`, `_verificationToken`) to prevent external writes.

This is a preventative measure. Users should configure collection-level
access control on auth collections (e.g., restricting who can update
users) rather than relying solely on field-level protections. Internal
auth operations are unaffected as they use direct DB operations.

---
- To see the specific tasks where the Asana app for GitHub is being
used, see below:
  - https://app.asana.com/0/0/1213885887366085

2026-03-31 15:01:57 -04:00

..

baseFields

fix: add field-level access control to internal auth fields (#16119)

2026-03-31 15:01:57 -04:00

endpoints

fix: improved request origin retrieval (#15919)

2026-03-11 22:38:33 +00:00

operations

fix: improved request origin retrieval (#15919)

2026-03-11 22:38:33 +00:00

strategies

fix: replace deprecated scmp with crypto.timingSafeEqual (#15322)

2026-01-26 14:24:09 -05:00

cookies.spec.ts

test: migrate to vitest (#14337)

2025-12-19 16:07:14 -05:00

cookies.ts

chore: migrate to TypeScript strict in Payload package (enable strictNullChecks) - #3 (#12586)

2025-06-03 14:43:37 +00:00

crypto.ts

fix: make input/output encoding explicit in auth/crypto's encrypt/decrypt (#13710)

2025-09-24 14:38:57 -04:00

defaultAccess.ts

refactor: changed default exports to named exports in payload package (#12871)

2025-06-24 04:38:02 +00:00

defaultUser.ts

…

ensureUsernameOrEmail.ts

feat!: on demand rsc (#8364)

2024-11-11 13:59:05 -05:00

executeAccess.ts

fix: unlock access not being correctly denied when using a where query (#14585)

2025-11-13 09:15:11 -05:00

executeAuthStrategies.ts

feat: adds new canSetHeaders prop to auth strategies (#12591)

2025-05-29 09:58:58 -04:00

extractAccessFromPermission.ts

fix: versions not loading properly (#11256)

2025-02-19 10:22:31 -05:00

extractJWT.ts

fix: use Sec-Fetch-Site header for cookie authentication validation (#15751)

2026-03-12 16:31:36 +00:00

getAccessResults.ts

perf: up to 5000% faster permissions calculation (#14631)

2025-11-20 11:06:12 -08:00

getAuthFields.ts

feat: auth sessions (#12483)

2025-06-27 09:13:52 -04:00

getFieldsToSign.ts

fix: getFieldsToSign crashes when user missing group/tab fields (#15775)

2026-02-27 08:35:16 -08:00

getLoginOptions.ts

chore: migrate to TypeScript strict in Payload package (enable strictNullChecks) - #3 (#12586)

2025-06-03 14:43:37 +00:00

index.ts

…

isUserLocked.ts

fix: use atomic operation for incrementing login attempts (#13204)

2025-07-28 16:08:10 -07:00

jwt.ts

perf: replace jsonwebtoken with jose (#8217)

2024-10-18 10:04:37 -06:00

sendVerificationEmail.ts

fix: improved request origin retrieval (#15919)

2026-03-11 22:38:33 +00:00

sessions.ts

fix: adds missing transactions to login and logout operations (#15134)

2026-01-13 13:51:47 -05:00

types.ts

perf: up to 5000% faster permissions calculation (#14631)

2025-11-20 11:06:12 -08:00