@localazy/strapi-plugin 1.3.0 → 1.6.0

package/dist/server/index.js

@@ -10,6 +10,7 @@ const require$$0$2 = require("crypto");
 const require$$0$3 = require("events");
 const require$$2 = require("timers");
 const require$$8 = require("ws");
+const JSZip = require("jszip");
 const _interopDefault = (e2) => e2 && e2.__esModule ? e2 : { default: e2 };
 const require$$0__default$2 = /* @__PURE__ */ _interopDefault(require$$0$4);
 const require$$1__default$4 = /* @__PURE__ */ _interopDefault(require$$1$4);
@@ -22,6 +23,7 @@ const require$$0__default = /* @__PURE__ */ _interopDefault(require$$0$2);
 const require$$0__default$1 = /* @__PURE__ */ _interopDefault(require$$0$3);
 const require$$2__default = /* @__PURE__ */ _interopDefault(require$$2);
 const require$$8__default = /* @__PURE__ */ _interopDefault(require$$8);
+const JSZip__default = /* @__PURE__ */ _interopDefault(JSZip);
 var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : {};
 function getDefaultExportFromCjs(x2) {
   return x2 && x2.__esModule && Object.prototype.hasOwnProperty.call(x2, "default") ? x2["default"] : x2;
@@ -20532,7 +20534,7 @@ var distExports = dist$1.exports;
 const io = /* @__PURE__ */ getDefaultExportFromCjs(distExports);
 const { Server: Server2, Namespace, Socket: Socket3 } = io;
 const name = "@localazy/strapi-plugin";
-const version = "1.3.0";
+const version = "1.6.0";
 const description = "The official Strapi Plugin by Localazy.";
 const keywords = [
   "strapi",
@@ -20602,6 +20604,7 @@ const scripts = {
   prepare: "husky || true"
 };
 const dependencies = {
+  jszip: "^3.10.1",
   shelljs: "^0.8.5",
   ws: "^8.18.0"
 };
@@ -20715,7 +20718,60 @@ const _package$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
   version
 }, Symbol.toStringTag, { value: "Module" }));
 const PLUGIN_NAME = strapi$1.name;
-const bootstrap = ({ strapi: strapi2 }) => {
+const PERMISSION_UIDS = {
+  READ: `plugin::${PLUGIN_NAME}.read`,
+  TRANSFER: `plugin::${PLUGIN_NAME}.transfer`,
+  SETTINGS_UPDATE: `plugin::${PLUGIN_NAME}.settings.update`
+};
+const LOCALAZY_RBAC_ACTIONS = [
+  {
+    section: "plugins",
+    subCategory: "General",
+    pluginName: PLUGIN_NAME,
+    displayName: "Read",
+    uid: "read"
+  },
+  {
+    section: "plugins",
+    subCategory: "General",
+    pluginName: PLUGIN_NAME,
+    displayName: "Transfer",
+    uid: "transfer"
+  },
+  {
+    section: "plugins",
+    subCategory: "Settings",
+    pluginName: PLUGIN_NAME,
+    displayName: "Read settings",
+    uid: "settings.read"
+  },
+  {
+    section: "plugins",
+    subCategory: "Settings",
+    pluginName: PLUGIN_NAME,
+    displayName: "Update settings",
+    uid: "settings.update"
+  }
+];
+const registerRbacActions = async (strapi2) => {
+  try {
+    const permissionService = strapi2.service("admin::permission");
+    const actionProvider = permissionService?.actionProvider;
+    if (!actionProvider?.registerMany) {
+      strapi2.log.warn(
+        `[${PLUGIN_NAME}] admin::permission.actionProvider unavailable — skipping RBAC action registration`
+      );
+      return;
+    }
+    await actionProvider.registerMany(LOCALAZY_RBAC_ACTIONS);
+  } catch (error) {
+    strapi2.log.error(
+      `[${PLUGIN_NAME}] Failed to register RBAC actions — plugin permissions will not appear in role editor: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+const bootstrap = async ({ strapi: strapi2 }) => {
+  await registerRbacActions(strapi2);
   if (strapi2.plugin(PLUGIN_NAME)?.config("enableSocketIO", true)) {
     process.nextTick(async () => {
       const io2 = new Server2(strapi2.server.httpServer, {
@@ -24298,6 +24354,9 @@ const PluginSettingsController = ({ strapi: _strapi }) => ({
   async updatePluginSettings(ctx) {
     ctx.body = await getPluginSettingsService().updatePluginSettings(ctx.request.body);
   },
+  async updatePluginSettingsUiPrefs(ctx) {
+    ctx.body = await getPluginSettingsService().updatePluginSettingsUiPrefs(ctx.request.body);
+  },
   async getSyncCursor(ctx) {
     ctx.body = await getPluginSettingsService().getSyncCursor();
   }
@@ -24397,6 +24456,8 @@ const LocalazyTransferController = ({ strapi: strapi2 }) => ({
     try {
       const LocalazyTransferDownloadService2 = getLocalazyTransferDownloadService();
       let fullSync = ctx.request.body?.fullSync === true;
+      const rawUiLanguages = ctx.request.body?.uiLanguages;
+      const requestedUiLanguages = Array.isArray(rawUiLanguages) && rawUiLanguages.every((code) => typeof code === "string") ? rawUiLanguages : void 0;
       const requestInitiatorHelper = new RequestInitiatorHelper(strapi2);
       if (requestInitiatorHelper.isInitiatedByLocalazyWebhook()) {
         const pluginSettingsServiceHelper = new PluginSettingsServiceHelper();
@@ -24406,7 +24467,8 @@ const LocalazyTransferController = ({ strapi: strapi2 }) => ({
       setTimeout(
         () => LocalazyTransferDownloadService2.download({
           notificationService: JobNotificationService$1,
-          fullSync
+          fullSync,
+          requestedUiLanguages
         }),
         1e3
       );
@@ -24501,6 +24563,413 @@ const ActivityLogsController = ({ strapi: _strapi }) => ({
     ctx.body = { success: true };
   }
 });
+const URL_SECRET_KEYS = ["token", "secret", "signature", "key", "apikey", "api_key"];
+const DEBUG_BUNDLE_ENV_ALLOWLIST = [
+  "STRAPI_ADMIN_LOCALAZY_ENV",
+  "STRAPI_ADMIN_BACKEND_URL",
+  "NODE_ENV",
+  "STRAPI_TELEMETRY_DISABLED"
+];
+const redactIdentity = (identity2) => {
+  if (!identity2) return null;
+  return {
+    userId: identity2.user?.id ?? "",
+    name: identity2.user?.name ?? "",
+    scope: identity2.scope ?? "",
+    hasAccessToken: Boolean(identity2.accessToken)
+  };
+};
+const scrubUrlSecrets = (input) => {
+  if (typeof input !== "string") return input;
+  if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(input) && !input.includes("?")) return input;
+  try {
+    const url2 = new URL(input);
+    let mutated = false;
+    for (const k2 of [...url2.searchParams.keys()]) {
+      if (URL_SECRET_KEYS.includes(k2.toLowerCase())) {
+        url2.searchParams.delete(k2);
+        mutated = true;
+      }
+    }
+    return mutated ? url2.toString() : input;
+  } catch {
+    return input;
+  }
+};
+const pickEnvAllowlist = (env) => {
+  const out = {};
+  for (const key of DEBUG_BUNDLE_ENV_ALLOWLIST) {
+    const raw = env[key];
+    const present = raw !== void 0;
+    out[key] = {
+      present,
+      value: present ? raw : null
+    };
+  }
+  return out;
+};
+const serializeContentTypeSchema = (contentType) => {
+  if (!contentType || typeof contentType !== "object") return null;
+  const ct = contentType;
+  return {
+    kind: ct.kind,
+    collectionName: ct.collectionName,
+    info: ct.info,
+    options: ct.options,
+    pluginOptions: ct.pluginOptions,
+    attributes: ct.attributes
+  };
+};
+const DOCUMENT_INTERNAL_FIELDS = ["createdBy", "updatedBy"];
+const stripDocumentInternals = (doc) => {
+  if (!doc || typeof doc !== "object") return doc;
+  const clone = { ...doc };
+  for (const field of DOCUMENT_INTERNAL_FIELDS) {
+    delete clone[field];
+  }
+  return clone;
+};
+class SessionNotFoundError extends Error {
+  constructor(sessionId) {
+    super(`Session ${sessionId} not found`);
+    this.name = "SessionNotFoundError";
+  }
+}
+const DEBUG_BUNDLE_SCHEMA_VERSION = 1;
+const CAPS = {
+  perEntryBytes: 1 * 1024 * 1024,
+  // 1 MB
+  totalEntries: 100,
+  errorLogBytes: 2 * 1024 * 1024,
+  // 2 MB
+  consoleErrorsLines: 200,
+  browserPayloadBytes: 64 * 1024
+  // 64 KB
+};
+const selectAttemptedEntries = (attempted) => {
+  const failedByKey = /* @__PURE__ */ new Map();
+  const successByKey = /* @__PURE__ */ new Map();
+  for (const record of attempted) {
+    const key = `${record.uid}|${record.documentId}|${record.locale}`;
+    const selected = {
+      uid: record.uid,
+      documentId: record.documentId,
+      locale: record.locale,
+      status: record.status,
+      attemptedAt: record.attemptedAt
+    };
+    if (record.status === "failed") {
+      successByKey.delete(key);
+      if (!failedByKey.has(key)) failedByKey.set(key, selected);
+    } else if (!failedByKey.has(key) && !successByKey.has(key)) {
+      successByKey.set(key, selected);
+    }
+  }
+  return [...failedByKey.values(), ...successByKey.values()];
+};
+const formatTimestampForFilename = (ms2) => new Date(ms2).toISOString().replace(/[:.]/g, "-");
+const safeUidForPath = (uid) => uid.replace(/::/g, "--").replace(/\./g, "-");
+const decodeBrowserPayload = (encoded) => {
+  const markers = [];
+  if (!encoded) return { payload: null, truncationMarkers: markers };
+  try {
+    const raw = Buffer.from(encoded, "base64").toString("utf8");
+    const rawBytes = Buffer.byteLength(raw, "utf8");
+    if (rawBytes > CAPS.browserPayloadBytes) {
+      markers.push({ kind: "browser-payload-truncated", originalSizeBytes: rawBytes });
+      return { payload: null, truncationMarkers: markers };
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed && Array.isArray(parsed.consoleErrors) && parsed.consoleErrors.length > CAPS.consoleErrorsLines) {
+      markers.push({ kind: "console-errors-truncated", originalCount: parsed.consoleErrors.length });
+      parsed.consoleErrors = parsed.consoleErrors.slice(0, CAPS.consoleErrorsLines);
+    }
+    return { payload: parsed, truncationMarkers: markers };
+  } catch {
+    return { payload: null, truncationMarkers: markers };
+  }
+};
+const deepScrubUrls = (value) => {
+  if (value == null) return value;
+  if (typeof value === "string") return scrubUrlSecrets(value);
+  if (Array.isArray(value)) return value.map(deepScrubUrls);
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k2, v2] of Object.entries(value)) {
+      out[k2] = deepScrubUrls(v2);
+    }
+    return out;
+  }
+  return value;
+};
+const sanitizePluginSettings = (settings) => {
+  const cloned = JSON.parse(JSON.stringify(settings ?? {}));
+  if (cloned.webhookConfig?.url) {
+    cloned.webhookConfig.url = scrubUrlSecrets(cloned.webhookConfig.url);
+  }
+  return cloned;
+};
+const sanitizeSession = (session) => {
+  const cloned = JSON.parse(JSON.stringify(session));
+  for (const entry of cloned.entries ?? []) {
+    if (entry.data !== void 0) {
+      entry.data = deepScrubUrls(entry.data);
+    }
+  }
+  return cloned;
+};
+const buildErrorLog = (session) => {
+  const lines = [];
+  for (const entry of session.entries ?? []) {
+    const ts = Number.isFinite(entry.timestamp) ? new Date(entry.timestamp).toISOString() : "unknown";
+    lines.push(`${ts}  ${entry.message}`);
+  }
+  if (session.status === "failed" && session.summary) {
+    lines.push(`ERROR: ${session.summary}`);
+  }
+  const full = lines.join("\n");
+  const fullBytes = Buffer.byteLength(full, "utf8");
+  if (fullBytes <= CAPS.errorLogBytes) {
+    return { text: full, markers: [] };
+  }
+  const truncated = Buffer.from(full, "utf8").subarray(fullBytes - CAPS.errorLogBytes).toString("utf8");
+  return {
+    text: `...[truncated, kept last ${CAPS.errorLogBytes} bytes]
+${truncated}`,
+    markers: [{ kind: "error-log-truncated", originalSizeBytes: fullBytes }]
+  };
+};
+const readHostPackages = async (strapi2) => {
+  const appRoot = strapi2?.dirs?.app?.root ?? process.cwd();
+  if (!appRoot) return { data: null, reason: "host-app-root-unknown" };
+  try {
+    const raw = await require$$1$4.promises.readFile(require$$1__default.default.join(appRoot, "package.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      data: {
+        name: parsed.name,
+        version: parsed.version,
+        dependencies: parsed.dependencies ?? {},
+        devDependencies: parsed.devDependencies ?? {}
+      }
+    };
+  } catch (err) {
+    return { data: null, reason: err instanceof Error ? err.message : String(err) };
+  }
+};
+const buildReadme = ({
+  sessionShortId,
+  sessionId,
+  schemaVersion,
+  hostPackagesSkipped
+}) => {
+  const lines = [];
+  lines.push(`# Localazy Strapi Plugin — Troubleshooting Bundle`);
+  lines.push("");
+  lines.push(`Generated: ${(/* @__PURE__ */ new Date()).toISOString()}`);
+  lines.push(`Session id: ${sessionId}`);
+  lines.push(`Schema version: ${schemaVersion}`);
+  lines.push("");
+  lines.push("## Contents");
+  lines.push("");
+  lines.push("- `meta.json` — schema version, session metadata.");
+  lines.push("- `versions.json` — plugin version, Strapi version, Node version, platform/arch.");
+  lines.push("- `env.json` — allow-listed environment variables only.");
+  lines.push("- `browser.json` — user agent, language, viewport, console errors (from the admin UI).");
+  lines.push("- `session.json` — full activity-log session record (URLs scrubbed of secret query keys).");
+  lines.push("- `error.log` — chronological text log of session entries.");
+  lines.push("- `plugin-settings.json` — full plugin settings (webhook URL secrets scrubbed).");
+  lines.push("- `content-transfer-setup.json` — content-transfer setup record.");
+  if (hostPackagesSkipped) {
+    lines.push("- `host-packages.json` — NOT INCLUDED (could not be read; see `bundle-truncated.json`).");
+  } else {
+    lines.push("- `host-packages.json` — host project's package.json (deps + devDeps only).");
+  }
+  lines.push("- `content-types/` — schema.json per touched content-type UID.");
+  lines.push("- `entries/<uid>/<documentId>--<locale>.json` — per-entry payload from `strapi.documents().findOne()`.");
+  lines.push("- `bundle-truncated.json` — present only if any per-section cap was exceeded.");
+  lines.push("");
+  lines.push("## Reproducing locally");
+  lines.push("");
+  lines.push("1. `unzip` the bundle.");
+  lines.push("2. Recreate the content types from `content-types/*.schema.json` in your Strapi project.");
+  lines.push("3. Import the entries via the Document Service using `entries/<uid>/*.json`.");
+  lines.push("4. Apply `plugin-settings.json` and `content-transfer-setup.json` via the plugin admin UI.");
+  lines.push("5. Trigger the same upload/download/webhook with the same locale set.");
+  lines.push("6. Compare the failure against `error.log` and `session.json`.");
+  lines.push("");
+  lines.push(`Bundle short id: ${sessionShortId}`);
+  return lines.join("\n");
+};
+const buildDebugBundle = async ({
+  strapi: strapi2,
+  sessionId,
+  browserPayloadEncoded
+}) => {
+  const zip = new JSZip__default.default();
+  const truncationMarkers = [];
+  const pluginName = "localazy";
+  const activityLogsService = strapi2.plugin(pluginName).service("ActivityLogsService");
+  const pluginSettingsService = strapi2.plugin(pluginName).service("PluginSettingsService");
+  const strapiService = strapi2.plugin(pluginName).service("StrapiService");
+  const localazyUserService = strapi2.plugin(pluginName).service("LocalazyUserService");
+  const session = await activityLogsService.getSession(sessionId);
+  if (!session) {
+    throw new SessionNotFoundError(sessionId);
+  }
+  const sessionShortId = session.id.slice(0, 8);
+  const pluginSettingsRaw = await pluginSettingsService.getPluginSettings();
+  const contentTransferSetup = await pluginSettingsService.getContentTransferSetup();
+  const identity2 = await localazyUserService.getUser();
+  const redactedIdentity = redactIdentity(identity2);
+  const pluginVersion = await strapiService.getPluginVersion();
+  const strapiVersion = strapiService.getStrapiVersion();
+  zip.file(
+    "meta.json",
+    JSON.stringify(
+      {
+        schemaVersion: DEBUG_BUNDLE_SCHEMA_VERSION,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        sessionId: session.id,
+        sessionShortId,
+        eventType: session.eventType,
+        status: session.status,
+        startedAt: session.startedAt,
+        finishedAt: session.finishedAt ?? null,
+        initiatedBy: session.initiatedBy,
+        identity: redactedIdentity
+      },
+      null,
+      2
+    )
+  );
+  zip.file(
+    "versions.json",
+    JSON.stringify(
+      {
+        plugin: { name: "@localazy/strapi-plugin", version: pluginVersion },
+        strapi: { version: strapiVersion },
+        node: process.version,
+        platform: process.platform,
+        arch: process.arch
+      },
+      null,
+      2
+    )
+  );
+  const envSnapshot = pickEnvAllowlist(process.env);
+  zip.file(
+    "env.json",
+    JSON.stringify(
+      {
+        allowlist: [...DEBUG_BUNDLE_ENV_ALLOWLIST],
+        values: envSnapshot
+      },
+      null,
+      2
+    )
+  );
+  const { payload: browserPayload, truncationMarkers: browserMarkers } = decodeBrowserPayload(browserPayloadEncoded);
+  truncationMarkers.push(...browserMarkers);
+  zip.file("browser.json", JSON.stringify(browserPayload ? browserPayload : { captured: false }, null, 2));
+  zip.file("session.json", JSON.stringify(sanitizeSession(session), null, 2));
+  const { text: errorLogText, markers: errorLogMarkers } = buildErrorLog(session);
+  truncationMarkers.push(...errorLogMarkers);
+  zip.file("error.log", errorLogText);
+  zip.file("plugin-settings.json", JSON.stringify(sanitizePluginSettings(pluginSettingsRaw), null, 2));
+  zip.file("content-transfer-setup.json", JSON.stringify(contentTransferSetup, null, 2));
+  const hostPackages = await readHostPackages(strapi2);
+  if (hostPackages.data) {
+    zip.file("host-packages.json", JSON.stringify(hostPackages.data, null, 2));
+  }
+  if (session.attemptedEntries === void 0) {
+    truncationMarkers.push({ kind: "attempted-entries-missing-legacy-session" });
+  }
+  const selected = selectAttemptedEntries(session.attemptedEntries ?? []);
+  const kept = selected.slice(0, CAPS.totalEntries);
+  const skipped = selected.slice(CAPS.totalEntries);
+  if (skipped.length > 0) {
+    truncationMarkers.push({
+      kind: "entries-skipped",
+      tuples: skipped.map(({ uid, documentId, locale }) => ({ uid, documentId, locale }))
+    });
+  }
+  const uniqueUids = [...new Set(kept.map((t3) => t3.uid))];
+  for (const uid of uniqueUids) {
+    const schema = serializeContentTypeSchema(strapi2.contentTypes?.[uid]);
+    if (schema) {
+      zip.file(`content-types/${safeUidForPath(uid)}.schema.json`, JSON.stringify(schema, null, 2));
+    }
+  }
+  for (const tuple of kept) {
+    let documentJson = null;
+    try {
+      const doc = await strapi2.documents(tuple.uid).findOne({ documentId: tuple.documentId, locale: tuple.locale, populate: "*" });
+      documentJson = doc ? stripDocumentInternals(doc) : { __not_found: true, attemptedAt: tuple.attemptedAt };
+    } catch (err) {
+      documentJson = { __error: err instanceof Error ? err.message : String(err) };
+    }
+    const serialised = JSON.stringify(documentJson, null, 2);
+    const sizeBytes = Buffer.byteLength(serialised, "utf8");
+    let body;
+    if (sizeBytes > CAPS.perEntryBytes) {
+      truncationMarkers.push({
+        kind: "entry-too-large",
+        uid: tuple.uid,
+        documentId: tuple.documentId,
+        locale: tuple.locale,
+        originalSizeBytes: sizeBytes
+      });
+      body = JSON.stringify({ __truncated: true, originalSizeBytes: sizeBytes }, null, 2);
+    } else {
+      body = serialised;
+    }
+    const safeDocId = tuple.documentId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    zip.file(`entries/${safeUidForPath(tuple.uid)}/${safeDocId}--${tuple.locale}.json`, body);
+  }
+  zip.file(
+    "README.md",
+    buildReadme({
+      sessionShortId,
+      sessionId: session.id,
+      schemaVersion: DEBUG_BUNDLE_SCHEMA_VERSION,
+      hostPackagesSkipped: !hostPackages.data
+    })
+  );
+  if (truncationMarkers.length > 0 || !hostPackages.data) {
+    const marker = {
+      schemaVersion: DEBUG_BUNDLE_SCHEMA_VERSION,
+      markers: truncationMarkers,
+      hostPackagesSkipped: hostPackages.data ? null : hostPackages.reason ?? "unknown"
+    };
+    zip.file("bundle-truncated.json", JSON.stringify(marker, null, 2));
+  }
+  const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
+  const filename = `localazy-debug-bundle-${sessionShortId}-${formatTimestampForFilename(Date.now())}.zip`;
+  return { zipBuffer, filename };
+};
+const DebugBundleController = ({ strapi: strapi2 }) => ({
+  async getBundle(ctx) {
+    const { sessionId } = ctx.params;
+    const browserPayloadEncoded = typeof ctx.query.browser === "string" ? ctx.query.browser : null;
+    try {
+      const { zipBuffer, filename } = await buildDebugBundle({
+        strapi: strapi2,
+        sessionId,
+        browserPayloadEncoded
+      });
+      ctx.type = "application/zip";
+      ctx.set("Content-Disposition", `attachment; filename="${filename}"`);
+      ctx.body = zipBuffer;
+    } catch (err) {
+      if (err instanceof SessionNotFoundError) {
+        return ctx.notFound("Session not found");
+      }
+      strapi2.log.error(`[localazy] failed to build debug bundle: ${err instanceof Error ? err.message : err}`);
+      throw err;
+    }
+  }
+});
 const controllers = {
   LocalazyUserController,
   LocalazyAuthController,
@@ -24509,7 +24978,8 @@ const controllers = {
   PluginSettingsController,
   LocalazyTransferController,
   EntryExclusionController,
-  ActivityLogsController
+  ActivityLogsController,
+  DebugBundleController
 };
 const verifyWebhook = (config2, { strapi: strapi2 }) => {
   return async (ctx, next) => {
@@ -24567,13 +25037,17 @@ const middlewares = {
 };
 const policies = {};
 const ROUTE_PREFIX$8 = "/user";
+const readPolicy$6 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$4 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyUserRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.getUser",
     config: {
-      policies: []
+      policies: readPolicy$6
     }
   },
   {
@@ -24581,7 +25055,7 @@ const LocalazyUserRoutes = [
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.updateUser",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$4
     }
   },
   {
@@ -24589,18 +25063,21 @@ const LocalazyUserRoutes = [
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.deleteUser",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$4
     }
   }
 ];
 const ROUTE_PREFIX$7 = "/auth";
+const settingsUpdatePolicy$3 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyAuthRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$7}/generate-keys`,
     handler: "LocalazyAuthController.generateKeys",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$3
     }
   },
   {
@@ -24608,18 +25085,26 @@ const LocalazyAuthRoutes = [
     path: `${ROUTE_PREFIX$7}/continuous-poll`,
     handler: "LocalazyAuthController.continuousPoll",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$3
     }
   }
 ];
 const ROUTE_PREFIX$6 = "/plugin-settings";
+const readPolicy$5 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$2 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const PluginSettingsRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$6}/content-transfer-setup`,
     handler: "PluginSettingsController.getContentTransferSetup",
     config: {
-      policies: []
+      // Upload/Download pages call this to detect "model changed" before
+      // transferring. Gating on `settings.read` would lock transfer-only
+      // roles out of the transfer pages, so the read is open to any plugin
+      // user. The destructive PUT below stays on `settings.update`.
+      policies: readPolicy$5
     }
   },
   {
@@ -24627,7 +25112,7 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/content-transfer-setup`,
     handler: "PluginSettingsController.updateContentTransferSetup",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$2
     }
   },
   {
@@ -24635,7 +25120,7 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/plugin-settings`,
     handler: "PluginSettingsController.getPluginSettings",
     config: {
-      policies: []
+      policies: readPolicy$5
     }
   },
   {
@@ -24643,7 +25128,20 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/plugin-settings`,
     handler: "PluginSettingsController.updatePluginSettings",
     config: {
-      policies: []
+      // Persists destructive Global Settings (webhookConfig, download.*, upload.*).
+      // UI-pref-only writes use `PUT /plugin-settings/ui-prefs` (read-gated) below.
+      policies: settingsUpdatePolicy$2
+    }
+  },
+  {
+    method: "PUT",
+    path: `${ROUTE_PREFIX$6}/ui-prefs`,
+    handler: "PluginSettingsController.updatePluginSettingsUiPrefs",
+    config: {
+      // Per-user UI state (last visited route, sort prefs). Service-side filters
+      // the body to a fixed allowlist so a `read`-only caller cannot reach the
+      // destructive fields that share the same plugin-settings store.
+      policies: readPolicy$5
     }
   },
   {
@@ -24651,18 +25149,22 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/sync-cursor`,
     handler: "PluginSettingsController.getSyncCursor",
     config: {
-      policies: []
+      policies: readPolicy$5
     }
   }
 ];
 const ROUTE_PREFIX$5 = "/strapi";
+const readPolicy$4 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$1 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const StrapiRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$5}/models`,
     handler: "StrapiController.getModels",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   },
   {
@@ -24670,7 +25172,7 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/localizable-models`,
     handler: "StrapiController.getLocalizableModels",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   },
   {
@@ -24678,7 +25180,7 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/lifecycle/localazy-webhooks`,
     handler: "StrapiController.postLifecycleLocalazyWebhooks",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$1
     }
   },
   {
@@ -24686,18 +25188,19 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/version`,
     handler: "StrapiController.getPluginVersion",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   }
 ];
 const ROUTE_PREFIX$4 = "/transfer";
+const transferPolicy$2 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const LocalazyTransferRoutes = [
   {
     method: "POST",
     path: `${ROUTE_PREFIX$4}/upload`,
     handler: "LocalazyTransferController.upload",
     config: {
-      policies: []
+      policies: transferPolicy$2
     }
   },
   {
@@ -24705,18 +25208,22 @@ const LocalazyTransferRoutes = [
     path: `${ROUTE_PREFIX$4}/download`,
     handler: "LocalazyTransferController.download",
     config: {
-      policies: []
+      policies: transferPolicy$2
     }
   }
 ];
 const ROUTE_PREFIX$3 = "/project";
+const readPolicy$3 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyProjectRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$3}`,
     handler: "LocalazyProjectController.getConnectedProject",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   },
   {
@@ -24724,7 +25231,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/webhooks`,
     handler: "LocalazyProjectController.getWebhookStatus",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   },
   {
@@ -24732,7 +25239,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/webhooks/setup`,
     handler: "LocalazyProjectController.setupWebhook",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy
     }
   },
   {
@@ -24740,7 +25247,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/strapi-url`,
     handler: "LocalazyProjectController.getStrapiUrl",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   }
 ];
@@ -24759,13 +25266,15 @@ const LocalazyPublicTransferRoutes = [
   }
 ];
 const ROUTE_PREFIX$1 = "/entry-exclusion";
+const readPolicy$2 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const transferPolicy$1 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const EntryExclusionRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$1}/:contentType/:documentId`,
     handler: "EntryExclusionController.getEntryExclusion",
     config: {
-      policies: []
+      policies: readPolicy$2
     }
   },
   {
@@ -24773,7 +25282,7 @@ const EntryExclusionRoutes = [
     path: `${ROUTE_PREFIX$1}/:contentType/:documentId`,
     handler: "EntryExclusionController.setEntryExclusion",
     config: {
-      policies: []
+      policies: transferPolicy$1
     }
   },
   {
@@ -24781,18 +25290,20 @@ const EntryExclusionRoutes = [
     path: `${ROUTE_PREFIX$1}/:contentType`,
     handler: "EntryExclusionController.getContentTypeExclusions",
     config: {
-      policies: []
+      policies: readPolicy$2
     }
   }
 ];
 const ROUTE_PREFIX = "/activity-logs";
+const readPolicy$1 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const transferPolicy = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const ActivityLogsRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX}`,
     handler: "ActivityLogsController.getSessions",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -24800,7 +25311,7 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}/export`,
     handler: "ActivityLogsController.exportSessions",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -24808,7 +25319,7 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}/:sessionId`,
     handler: "ActivityLogsController.getSession",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -24816,13 +25327,28 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}`,
     handler: "ActivityLogsController.clearSessions",
     config: {
-      policies: []
+      policies: transferPolicy
     }
   }
 ];
+const readPolicy = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const DebugBundleRoutes = [
+  {
+    method: "GET",
+    path: "/activity-logs/:sessionId/bundle",
+    handler: "DebugBundleController.getBundle",
+    config: {
+      policies: readPolicy
+    }
+  }
+];
+const withoutAdminPolicies = (routes2) => routes2.map((route) => ({
+  ...route,
+  config: { ...route.config, policies: [] }
+}));
 const routes = {
   "content-api": {
-    routes: [...StrapiRoutes]
+    routes: withoutAdminPolicies(StrapiRoutes)
   },
   admin: {
     type: "admin",
@@ -24834,7 +25360,8 @@ const routes = {
       ...LocalazyTransferRoutes,
       ...LocalazyProjectRoutes,
       ...EntryExclusionRoutes,
-      ...ActivityLogsRoutes
+      ...ActivityLogsRoutes,
+      ...DebugBundleRoutes
     ]
   },
   LocalazyPublicTransferRoutes: {
@@ -25033,6 +25560,7 @@ const KEY$1 = "sync-cursor";
 const emptySyncCursor = {
   processedKeys: {}
 };
+const UI_PREF_FIELDS = ["defaultRoute", "activityLogsSort"];
 const PluginSettingsService = ({ strapi: strapi2 }) => ({
   async getContentTransferSetup() {
     const pluginStore = getStrapiStore(strapi2);
@@ -25069,6 +25597,20 @@ const PluginSettingsService = ({ strapi: strapi2 }) => ({
     });
     return newSettings;
   },
+  // Counterpart to `updatePluginSettings` for the `read`-gated UI-prefs route.
+  // Drops any field outside `UI_PREF_FIELDS` server-side so a `read`-only caller
+  // cannot reach `webhookConfig` / `download.*` / `upload.*` via the merge.
+  async updatePluginSettingsUiPrefs(prefs) {
+    const sanitized = {};
+    if (prefs && typeof prefs === "object") {
+      for (const field of UI_PREF_FIELDS) {
+        if (field in prefs) {
+          sanitized[field] = prefs[field];
+        }
+      }
+    }
+    return this.updatePluginSettings(sanitized);
+  },
   async getSyncCursor() {
     const pluginStore = getStrapiStore(strapi2);
     const cursor = await pluginStore.get({ key: KEY$1 });
@@ -25113,6 +25655,8 @@ const LocalazyTransferUploadService = ({ strapi: strapi2 }) => ({
     const { setup: setup2 } = contentTransferSetup;
     const collectionsNames = getCollectionsNames(setup2);
     const models = await StrapiService2.getModels();
+    const strapiDefaultLocaleCode = await StrapiI18nService2.getDefaultLocaleCode();
+    const attemptedTuples = [];
     let pickedFlattenStrapiContent = {};
     for (const collectionName of collectionsNames) {
       const currentModel = models.find((model) => model.collectionName === collectionName);
@@ -25175,6 +25719,15 @@ const LocalazyTransferUploadService = ({ strapi: strapi2 }) => ({
       });
       await activityLogsService.addEntry(sessionId, message);
       strapi2.log.info(message);
+      if (strapiDefaultLocaleCode) {
+        for (const entry of entries) {
+          attemptedTuples.push({
+            uid: modelUid,
+            documentId: entry.documentId,
+            locale: strapiDefaultLocaleCode
+          });
+        }
+      }
       entries = omitDeep(entries, ["locale", "createdAt", "updatedAt", "publishedAt"]);
       entries.forEach((entry) => {
         const flatten = flattenObject({
@@ -25192,7 +25745,6 @@ const LocalazyTransferUploadService = ({ strapi: strapi2 }) => ({
         ...characterLimitsMetadata
       };
     }
-    const strapiDefaultLocaleCode = await StrapiI18nService2.getDefaultLocaleCode();
     const localazyLocaleCode = strapiDefaultLocaleCode ? isoStrapiToLocalazy(strapiDefaultLocaleCode) : config.default.LOCALAZY_DEFAULT_LOCALE;
     const importFile = LocalazyUploadService2.createImportFileRepresentation(
       localazyLocaleCode,
@@ -25214,6 +25766,10 @@ const LocalazyTransferUploadService = ({ strapi: strapi2 }) => ({
     await activityLogsService.addEntry(sessionId, "Uploading collections to Localazy...");
     try {
       await LocalazyUploadService2.upload(importFile, uploadConfig);
+      await activityLogsService.recordAttemptedEntries(
+        sessionId,
+        attemptedTuples.map((t3) => ({ ...t3, status: "success" }))
+      );
     } catch (error) {
       success = false;
       const errorMessage = `Upload to Localazy failed: ${error instanceof Error ? error.message : String(error)}`;
@@ -25223,6 +25779,10 @@ const LocalazyTransferUploadService = ({ strapi: strapi2 }) => ({
         message: errorMessage
       });
       await activityLogsService.addEntry(sessionId, errorMessage);
+      await activityLogsService.recordAttemptedEntries(
+        sessionId,
+        attemptedTuples.map((t3) => ({ ...t3, status: "failed", errorMessage }))
+      );
       await activityLogsService.finishSession(sessionId, "failed", errorMessage);
       console.timeEnd("upload");
       return;
@@ -25627,7 +26187,7 @@ const shouldSetDownloadedProperty = (modelContentTransferSetup, parsedKeyRest) =
     return "no";
   }
 };
-const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
+const getFilteredLanguagesCodesForDownload = async (languagesCodes, requestedUiLanguages) => {
   const pluginSettingsServiceHelper = new PluginSettingsServiceHelper();
   const requestInitiatorHelper = new RequestInitiatorHelper(strapi);
   await pluginSettingsServiceHelper.setup();
@@ -25635,7 +26195,7 @@ const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
   if (requestInitiatorHelper.isInitiatedByLocalazyWebhook()) {
     localLanguagesCodes = pluginSettingsServiceHelper.getWebhookLanguagesCodes();
   } else if (requestInitiatorHelper.isInitiatedByLocalazyPluginUI()) {
-    localLanguagesCodes = pluginSettingsServiceHelper.getUiLanguagesCodes();
+    localLanguagesCodes = requestedUiLanguages ?? pluginSettingsServiceHelper.getUiLanguagesCodes();
   } else {
     strapi.log.warn("Called by an unknown initiator.");
     return languagesCodes;
@@ -25648,7 +26208,8 @@ const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
 const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
   async download({
     notificationService,
-    fullSync = false
+    fullSync = false,
+    requestedUiLanguages
   }) {
     console.time("download");
     const syncMode = fullSync ? "Full sync" : "Incremental sync";
@@ -25728,7 +26289,7 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
       return;
     }
     let languagesCodes = projectLanguagesWithoutSourceLanguage.map((language3) => language3.code);
-    languagesCodes = await getFilteredLanguagesCodesForDownload(languagesCodes);
+    languagesCodes = await getFilteredLanguagesCodesForDownload(languagesCodes, requestedUiLanguages);
     const strapiUnsupportedLanguages = [];
     const strapiLocales = await StrapiI18nService2.getLocales();
     for (const isoLocalazy of languagesCodes) {
@@ -25947,6 +26508,12 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
                   message
                 });
                 await activityLogsService.addEntry(sessionId, message);
+                await activityLogsService.recordAttemptedEntry(sessionId, {
+                  uid,
+                  documentId,
+                  locale: isoStrapi,
+                  status: "success"
+                });
                 await markKeysProcessed(sourceKeys);
               } catch (e2) {
                 success = false;
@@ -25963,6 +26530,13 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
                   sessionId,
                   `Failed to create ${uid} [${documentId}] in ${isoStrapi}: ${e2.message}`
                 );
+                await activityLogsService.recordAttemptedEntry(sessionId, {
+                  uid,
+                  documentId,
+                  locale: isoStrapi,
+                  status: "failed",
+                  errorMessage: e2.message
+                });
               }
             } else {
               try {
@@ -25981,6 +26555,12 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
                   message
                 });
                 await activityLogsService.addEntry(sessionId, message);
+                await activityLogsService.recordAttemptedEntry(sessionId, {
+                  uid,
+                  documentId,
+                  locale: isoStrapi,
+                  status: "success"
+                });
                 await markKeysProcessed(sourceKeys);
               } catch (e2) {
                 success = false;
@@ -25997,6 +26577,13 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
                   sessionId,
                   `Failed to update ${uid} [${documentId}] in ${isoStrapi}: ${e2.message}`
                 );
+                await activityLogsService.recordAttemptedEntry(sessionId, {
+                  uid,
+                  documentId,
+                  locale: isoStrapi,
+                  status: "failed",
+                  errorMessage: e2.message
+                });
               }
             }
           } catch (e2) {
@@ -26009,6 +26596,13 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
               sessionId,
               `Error processing ${uid} [${documentId}] in ${isoStrapi}: ${e2.message}`
             );
+            await activityLogsService.recordAttemptedEntry(sessionId, {
+              uid,
+              documentId,
+              locale: isoStrapi,
+              status: "failed",
+              errorMessage: e2.message
+            });
           }
         }
       }
@@ -26759,6 +27353,7 @@ const emptyActivityLogs = {
   sessions: []
 };
 const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1e3;
+const ATTEMPTED_ENTRIES_CAP = 5e3;
 let writeLock = Promise.resolve();
 const withLock = async (fn) => {
   let release;
@@ -26823,6 +27418,38 @@ const ActivityLogsService = ({ strapi: strapi2 }) => ({
       await this.saveActivityLogs(logs);
     });
   },
+  async recordAttemptedEntry(sessionId, entry) {
+    return this.recordAttemptedEntries(sessionId, [entry]);
+  },
+  async recordAttemptedEntries(sessionId, entries) {
+    if (!entries.length) {
+      return;
+    }
+    return withLock(async () => {
+      const logs = await this.getActivityLogs();
+      const session = logs.sessions.find((s2) => s2.id === sessionId);
+      if (!session) {
+        return;
+      }
+      if (!session.attemptedEntries) {
+        session.attemptedEntries = [];
+      }
+      const now = Date.now();
+      const wasAtCap = session.attemptedEntries.length >= ATTEMPTED_ENTRIES_CAP;
+      const remaining = Math.max(0, ATTEMPTED_ENTRIES_CAP - session.attemptedEntries.length);
+      const accepted = entries.slice(0, remaining);
+      const dropped = entries.length - accepted.length;
+      for (const entry of accepted) {
+        session.attemptedEntries.push({ ...entry, attemptedAt: now });
+      }
+      if (dropped > 0 && !wasAtCap) {
+        strapi2.log.warn(
+          `[localazy] attemptedEntries cap (${ATTEMPTED_ENTRIES_CAP}) reached for session ${sessionId}; ${dropped} record(s) dropped.`
+        );
+      }
+      await this.saveActivityLogs(logs);
+    });
+  },
   async finishSession(sessionId, status, summary) {
     return withLock(async () => {
       const logs = await this.getActivityLogs();