@localazy/strapi-plugin 1.4.0 → 1.6.0

package/dist/server/index.js

@@ -20534,7 +20534,7 @@ var distExports = dist$1.exports;
 const io = /* @__PURE__ */ getDefaultExportFromCjs(distExports);
 const { Server: Server2, Namespace, Socket: Socket3 } = io;
 const name = "@localazy/strapi-plugin";
-const version = "1.4.0";
+const version = "1.6.0";
 const description = "The official Strapi Plugin by Localazy.";
 const keywords = [
   "strapi",
@@ -20718,7 +20718,60 @@ const _package$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
   version
 }, Symbol.toStringTag, { value: "Module" }));
 const PLUGIN_NAME = strapi$1.name;
-const bootstrap = ({ strapi: strapi2 }) => {
+const PERMISSION_UIDS = {
+  READ: `plugin::${PLUGIN_NAME}.read`,
+  TRANSFER: `plugin::${PLUGIN_NAME}.transfer`,
+  SETTINGS_UPDATE: `plugin::${PLUGIN_NAME}.settings.update`
+};
+const LOCALAZY_RBAC_ACTIONS = [
+  {
+    section: "plugins",
+    subCategory: "General",
+    pluginName: PLUGIN_NAME,
+    displayName: "Read",
+    uid: "read"
+  },
+  {
+    section: "plugins",
+    subCategory: "General",
+    pluginName: PLUGIN_NAME,
+    displayName: "Transfer",
+    uid: "transfer"
+  },
+  {
+    section: "plugins",
+    subCategory: "Settings",
+    pluginName: PLUGIN_NAME,
+    displayName: "Read settings",
+    uid: "settings.read"
+  },
+  {
+    section: "plugins",
+    subCategory: "Settings",
+    pluginName: PLUGIN_NAME,
+    displayName: "Update settings",
+    uid: "settings.update"
+  }
+];
+const registerRbacActions = async (strapi2) => {
+  try {
+    const permissionService = strapi2.service("admin::permission");
+    const actionProvider = permissionService?.actionProvider;
+    if (!actionProvider?.registerMany) {
+      strapi2.log.warn(
+        `[${PLUGIN_NAME}] admin::permission.actionProvider unavailable — skipping RBAC action registration`
+      );
+      return;
+    }
+    await actionProvider.registerMany(LOCALAZY_RBAC_ACTIONS);
+  } catch (error) {
+    strapi2.log.error(
+      `[${PLUGIN_NAME}] Failed to register RBAC actions — plugin permissions will not appear in role editor: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+const bootstrap = async ({ strapi: strapi2 }) => {
+  await registerRbacActions(strapi2);
   if (strapi2.plugin(PLUGIN_NAME)?.config("enableSocketIO", true)) {
     process.nextTick(async () => {
       const io2 = new Server2(strapi2.server.httpServer, {
@@ -24301,6 +24354,9 @@ const PluginSettingsController = ({ strapi: _strapi }) => ({
   async updatePluginSettings(ctx) {
     ctx.body = await getPluginSettingsService().updatePluginSettings(ctx.request.body);
   },
+  async updatePluginSettingsUiPrefs(ctx) {
+    ctx.body = await getPluginSettingsService().updatePluginSettingsUiPrefs(ctx.request.body);
+  },
   async getSyncCursor(ctx) {
     ctx.body = await getPluginSettingsService().getSyncCursor();
   }
@@ -24400,6 +24456,8 @@ const LocalazyTransferController = ({ strapi: strapi2 }) => ({
     try {
       const LocalazyTransferDownloadService2 = getLocalazyTransferDownloadService();
       let fullSync = ctx.request.body?.fullSync === true;
+      const rawUiLanguages = ctx.request.body?.uiLanguages;
+      const requestedUiLanguages = Array.isArray(rawUiLanguages) && rawUiLanguages.every((code) => typeof code === "string") ? rawUiLanguages : void 0;
       const requestInitiatorHelper = new RequestInitiatorHelper(strapi2);
       if (requestInitiatorHelper.isInitiatedByLocalazyWebhook()) {
         const pluginSettingsServiceHelper = new PluginSettingsServiceHelper();
@@ -24409,7 +24467,8 @@ const LocalazyTransferController = ({ strapi: strapi2 }) => ({
       setTimeout(
         () => LocalazyTransferDownloadService2.download({
           notificationService: JobNotificationService$1,
-          fullSync
+          fullSync,
+          requestedUiLanguages
         }),
         1e3
       );
@@ -24978,13 +25037,17 @@ const middlewares = {
 };
 const policies = {};
 const ROUTE_PREFIX$8 = "/user";
+const readPolicy$6 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$4 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyUserRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.getUser",
     config: {
-      policies: []
+      policies: readPolicy$6
     }
   },
   {
@@ -24992,7 +25055,7 @@ const LocalazyUserRoutes = [
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.updateUser",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$4
     }
   },
   {
@@ -25000,18 +25063,21 @@ const LocalazyUserRoutes = [
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.deleteUser",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$4
     }
   }
 ];
 const ROUTE_PREFIX$7 = "/auth";
+const settingsUpdatePolicy$3 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyAuthRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$7}/generate-keys`,
     handler: "LocalazyAuthController.generateKeys",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$3
     }
   },
   {
@@ -25019,18 +25085,26 @@ const LocalazyAuthRoutes = [
     path: `${ROUTE_PREFIX$7}/continuous-poll`,
     handler: "LocalazyAuthController.continuousPoll",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$3
     }
   }
 ];
 const ROUTE_PREFIX$6 = "/plugin-settings";
+const readPolicy$5 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$2 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const PluginSettingsRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$6}/content-transfer-setup`,
     handler: "PluginSettingsController.getContentTransferSetup",
     config: {
-      policies: []
+      // Upload/Download pages call this to detect "model changed" before
+      // transferring. Gating on `settings.read` would lock transfer-only
+      // roles out of the transfer pages, so the read is open to any plugin
+      // user. The destructive PUT below stays on `settings.update`.
+      policies: readPolicy$5
     }
   },
   {
@@ -25038,7 +25112,7 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/content-transfer-setup`,
     handler: "PluginSettingsController.updateContentTransferSetup",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$2
     }
   },
   {
@@ -25046,7 +25120,7 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/plugin-settings`,
     handler: "PluginSettingsController.getPluginSettings",
     config: {
-      policies: []
+      policies: readPolicy$5
     }
   },
   {
@@ -25054,7 +25128,20 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/plugin-settings`,
     handler: "PluginSettingsController.updatePluginSettings",
     config: {
-      policies: []
+      // Persists destructive Global Settings (webhookConfig, download.*, upload.*).
+      // UI-pref-only writes use `PUT /plugin-settings/ui-prefs` (read-gated) below.
+      policies: settingsUpdatePolicy$2
+    }
+  },
+  {
+    method: "PUT",
+    path: `${ROUTE_PREFIX$6}/ui-prefs`,
+    handler: "PluginSettingsController.updatePluginSettingsUiPrefs",
+    config: {
+      // Per-user UI state (last visited route, sort prefs). Service-side filters
+      // the body to a fixed allowlist so a `read`-only caller cannot reach the
+      // destructive fields that share the same plugin-settings store.
+      policies: readPolicy$5
     }
   },
   {
@@ -25062,18 +25149,22 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/sync-cursor`,
     handler: "PluginSettingsController.getSyncCursor",
     config: {
-      policies: []
+      policies: readPolicy$5
     }
   }
 ];
 const ROUTE_PREFIX$5 = "/strapi";
+const readPolicy$4 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$1 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const StrapiRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$5}/models`,
     handler: "StrapiController.getModels",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   },
   {
@@ -25081,7 +25172,7 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/localizable-models`,
     handler: "StrapiController.getLocalizableModels",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   },
   {
@@ -25089,7 +25180,7 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/lifecycle/localazy-webhooks`,
     handler: "StrapiController.postLifecycleLocalazyWebhooks",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$1
     }
   },
   {
@@ -25097,18 +25188,19 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/version`,
     handler: "StrapiController.getPluginVersion",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   }
 ];
 const ROUTE_PREFIX$4 = "/transfer";
+const transferPolicy$2 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const LocalazyTransferRoutes = [
   {
     method: "POST",
     path: `${ROUTE_PREFIX$4}/upload`,
     handler: "LocalazyTransferController.upload",
     config: {
-      policies: []
+      policies: transferPolicy$2
     }
   },
   {
@@ -25116,18 +25208,22 @@ const LocalazyTransferRoutes = [
     path: `${ROUTE_PREFIX$4}/download`,
     handler: "LocalazyTransferController.download",
     config: {
-      policies: []
+      policies: transferPolicy$2
     }
   }
 ];
 const ROUTE_PREFIX$3 = "/project";
+const readPolicy$3 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyProjectRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$3}`,
     handler: "LocalazyProjectController.getConnectedProject",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   },
   {
@@ -25135,7 +25231,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/webhooks`,
     handler: "LocalazyProjectController.getWebhookStatus",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   },
   {
@@ -25143,7 +25239,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/webhooks/setup`,
     handler: "LocalazyProjectController.setupWebhook",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy
     }
   },
   {
@@ -25151,7 +25247,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/strapi-url`,
     handler: "LocalazyProjectController.getStrapiUrl",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   }
 ];
@@ -25170,13 +25266,15 @@ const LocalazyPublicTransferRoutes = [
   }
 ];
 const ROUTE_PREFIX$1 = "/entry-exclusion";
+const readPolicy$2 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const transferPolicy$1 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const EntryExclusionRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$1}/:contentType/:documentId`,
     handler: "EntryExclusionController.getEntryExclusion",
     config: {
-      policies: []
+      policies: readPolicy$2
     }
   },
   {
@@ -25184,7 +25282,7 @@ const EntryExclusionRoutes = [
     path: `${ROUTE_PREFIX$1}/:contentType/:documentId`,
     handler: "EntryExclusionController.setEntryExclusion",
     config: {
-      policies: []
+      policies: transferPolicy$1
     }
   },
   {
@@ -25192,18 +25290,20 @@ const EntryExclusionRoutes = [
     path: `${ROUTE_PREFIX$1}/:contentType`,
     handler: "EntryExclusionController.getContentTypeExclusions",
     config: {
-      policies: []
+      policies: readPolicy$2
     }
   }
 ];
 const ROUTE_PREFIX = "/activity-logs";
+const readPolicy$1 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const transferPolicy = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const ActivityLogsRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX}`,
     handler: "ActivityLogsController.getSessions",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -25211,7 +25311,7 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}/export`,
     handler: "ActivityLogsController.exportSessions",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -25219,7 +25319,7 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}/:sessionId`,
     handler: "ActivityLogsController.getSession",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -25227,23 +25327,28 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}`,
     handler: "ActivityLogsController.clearSessions",
     config: {
-      policies: []
+      policies: transferPolicy
     }
   }
 ];
+const readPolicy = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
 const DebugBundleRoutes = [
   {
     method: "GET",
     path: "/activity-logs/:sessionId/bundle",
     handler: "DebugBundleController.getBundle",
     config: {
-      policies: []
+      policies: readPolicy
     }
   }
 ];
+const withoutAdminPolicies = (routes2) => routes2.map((route) => ({
+  ...route,
+  config: { ...route.config, policies: [] }
+}));
 const routes = {
   "content-api": {
-    routes: [...StrapiRoutes]
+    routes: withoutAdminPolicies(StrapiRoutes)
   },
   admin: {
     type: "admin",
@@ -25455,6 +25560,7 @@ const KEY$1 = "sync-cursor";
 const emptySyncCursor = {
   processedKeys: {}
 };
+const UI_PREF_FIELDS = ["defaultRoute", "activityLogsSort"];
 const PluginSettingsService = ({ strapi: strapi2 }) => ({
   async getContentTransferSetup() {
     const pluginStore = getStrapiStore(strapi2);
@@ -25491,6 +25597,20 @@ const PluginSettingsService = ({ strapi: strapi2 }) => ({
     });
     return newSettings;
   },
+  // Counterpart to `updatePluginSettings` for the `read`-gated UI-prefs route.
+  // Drops any field outside `UI_PREF_FIELDS` server-side so a `read`-only caller
+  // cannot reach `webhookConfig` / `download.*` / `upload.*` via the merge.
+  async updatePluginSettingsUiPrefs(prefs) {
+    const sanitized = {};
+    if (prefs && typeof prefs === "object") {
+      for (const field of UI_PREF_FIELDS) {
+        if (field in prefs) {
+          sanitized[field] = prefs[field];
+        }
+      }
+    }
+    return this.updatePluginSettings(sanitized);
+  },
   async getSyncCursor() {
     const pluginStore = getStrapiStore(strapi2);
     const cursor = await pluginStore.get({ key: KEY$1 });
@@ -26067,7 +26187,7 @@ const shouldSetDownloadedProperty = (modelContentTransferSetup, parsedKeyRest) =
     return "no";
   }
 };
-const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
+const getFilteredLanguagesCodesForDownload = async (languagesCodes, requestedUiLanguages) => {
   const pluginSettingsServiceHelper = new PluginSettingsServiceHelper();
   const requestInitiatorHelper = new RequestInitiatorHelper(strapi);
   await pluginSettingsServiceHelper.setup();
@@ -26075,7 +26195,7 @@ const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
   if (requestInitiatorHelper.isInitiatedByLocalazyWebhook()) {
     localLanguagesCodes = pluginSettingsServiceHelper.getWebhookLanguagesCodes();
   } else if (requestInitiatorHelper.isInitiatedByLocalazyPluginUI()) {
-    localLanguagesCodes = pluginSettingsServiceHelper.getUiLanguagesCodes();
+    localLanguagesCodes = requestedUiLanguages ?? pluginSettingsServiceHelper.getUiLanguagesCodes();
   } else {
     strapi.log.warn("Called by an unknown initiator.");
     return languagesCodes;
@@ -26088,7 +26208,8 @@ const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
 const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
   async download({
     notificationService,
-    fullSync = false
+    fullSync = false,
+    requestedUiLanguages
   }) {
     console.time("download");
     const syncMode = fullSync ? "Full sync" : "Incremental sync";
@@ -26168,7 +26289,7 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
       return;
     }
     let languagesCodes = projectLanguagesWithoutSourceLanguage.map((language3) => language3.code);
-    languagesCodes = await getFilteredLanguagesCodesForDownload(languagesCodes);
+    languagesCodes = await getFilteredLanguagesCodesForDownload(languagesCodes, requestedUiLanguages);
     const strapiUnsupportedLanguages = [];
     const strapiLocales = await StrapiI18nService2.getLocales();
     for (const isoLocalazy of languagesCodes) {