@localazy/strapi-plugin 1.4.0 → 1.6.0

package/dist/server/index.mjs

@@ -20520,7 +20520,7 @@ var distExports = dist$1.exports;
 const io = /* @__PURE__ */ getDefaultExportFromCjs(distExports);
 const { Server: Server2, Namespace, Socket: Socket3 } = io;
 const name = "@localazy/strapi-plugin";
-const version = "1.4.0";
+const version = "1.6.0";
 const description = "The official Strapi Plugin by Localazy.";
 const keywords = [
   "strapi",
@@ -20704,7 +20704,60 @@ const _package$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
   version
 }, Symbol.toStringTag, { value: "Module" }));
 const PLUGIN_NAME = strapi$1.name;
-const bootstrap = ({ strapi: strapi2 }) => {
+const PERMISSION_UIDS = {
+  READ: `plugin::${PLUGIN_NAME}.read`,
+  TRANSFER: `plugin::${PLUGIN_NAME}.transfer`,
+  SETTINGS_UPDATE: `plugin::${PLUGIN_NAME}.settings.update`
+};
+const LOCALAZY_RBAC_ACTIONS = [
+  {
+    section: "plugins",
+    subCategory: "General",
+    pluginName: PLUGIN_NAME,
+    displayName: "Read",
+    uid: "read"
+  },
+  {
+    section: "plugins",
+    subCategory: "General",
+    pluginName: PLUGIN_NAME,
+    displayName: "Transfer",
+    uid: "transfer"
+  },
+  {
+    section: "plugins",
+    subCategory: "Settings",
+    pluginName: PLUGIN_NAME,
+    displayName: "Read settings",
+    uid: "settings.read"
+  },
+  {
+    section: "plugins",
+    subCategory: "Settings",
+    pluginName: PLUGIN_NAME,
+    displayName: "Update settings",
+    uid: "settings.update"
+  }
+];
+const registerRbacActions = async (strapi2) => {
+  try {
+    const permissionService = strapi2.service("admin::permission");
+    const actionProvider = permissionService?.actionProvider;
+    if (!actionProvider?.registerMany) {
+      strapi2.log.warn(
+        `[${PLUGIN_NAME}] admin::permission.actionProvider unavailable — skipping RBAC action registration`
+      );
+      return;
+    }
+    await actionProvider.registerMany(LOCALAZY_RBAC_ACTIONS);
+  } catch (error) {
+    strapi2.log.error(
+      `[${PLUGIN_NAME}] Failed to register RBAC actions — plugin permissions will not appear in role editor: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+const bootstrap = async ({ strapi: strapi2 }) => {
+  await registerRbacActions(strapi2);
   if (strapi2.plugin(PLUGIN_NAME)?.config("enableSocketIO", true)) {
     process.nextTick(async () => {
       const io2 = new Server2(strapi2.server.httpServer, {
@@ -24287,6 +24340,9 @@ const PluginSettingsController = ({ strapi: _strapi }) => ({
   async updatePluginSettings(ctx) {
     ctx.body = await getPluginSettingsService().updatePluginSettings(ctx.request.body);
   },
+  async updatePluginSettingsUiPrefs(ctx) {
+    ctx.body = await getPluginSettingsService().updatePluginSettingsUiPrefs(ctx.request.body);
+  },
   async getSyncCursor(ctx) {
     ctx.body = await getPluginSettingsService().getSyncCursor();
   }
@@ -24386,6 +24442,8 @@ const LocalazyTransferController = ({ strapi: strapi2 }) => ({
     try {
       const LocalazyTransferDownloadService2 = getLocalazyTransferDownloadService();
       let fullSync = ctx.request.body?.fullSync === true;
+      const rawUiLanguages = ctx.request.body?.uiLanguages;
+      const requestedUiLanguages = Array.isArray(rawUiLanguages) && rawUiLanguages.every((code) => typeof code === "string") ? rawUiLanguages : void 0;
       const requestInitiatorHelper = new RequestInitiatorHelper(strapi2);
       if (requestInitiatorHelper.isInitiatedByLocalazyWebhook()) {
         const pluginSettingsServiceHelper = new PluginSettingsServiceHelper();
@@ -24395,7 +24453,8 @@ const LocalazyTransferController = ({ strapi: strapi2 }) => ({
       setTimeout(
         () => LocalazyTransferDownloadService2.download({
           notificationService: JobNotificationService$1,
-          fullSync
+          fullSync,
+          requestedUiLanguages
         }),
         1e3
       );
@@ -24964,13 +25023,17 @@ const middlewares = {
 };
 const policies = {};
 const ROUTE_PREFIX$8 = "/user";
+const readPolicy$6 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$4 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyUserRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.getUser",
     config: {
-      policies: []
+      policies: readPolicy$6
     }
   },
   {
@@ -24978,7 +25041,7 @@ const LocalazyUserRoutes = [
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.updateUser",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$4
     }
   },
   {
@@ -24986,18 +25049,21 @@ const LocalazyUserRoutes = [
     path: `${ROUTE_PREFIX$8}`,
     handler: "LocalazyUserController.deleteUser",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$4
     }
   }
 ];
 const ROUTE_PREFIX$7 = "/auth";
+const settingsUpdatePolicy$3 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyAuthRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$7}/generate-keys`,
     handler: "LocalazyAuthController.generateKeys",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$3
     }
   },
   {
@@ -25005,18 +25071,26 @@ const LocalazyAuthRoutes = [
     path: `${ROUTE_PREFIX$7}/continuous-poll`,
     handler: "LocalazyAuthController.continuousPoll",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$3
     }
   }
 ];
 const ROUTE_PREFIX$6 = "/plugin-settings";
+const readPolicy$5 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$2 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const PluginSettingsRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$6}/content-transfer-setup`,
     handler: "PluginSettingsController.getContentTransferSetup",
     config: {
-      policies: []
+      // Upload/Download pages call this to detect "model changed" before
+      // transferring. Gating on `settings.read` would lock transfer-only
+      // roles out of the transfer pages, so the read is open to any plugin
+      // user. The destructive PUT below stays on `settings.update`.
+      policies: readPolicy$5
     }
   },
   {
@@ -25024,7 +25098,7 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/content-transfer-setup`,
     handler: "PluginSettingsController.updateContentTransferSetup",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$2
     }
   },
   {
@@ -25032,7 +25106,7 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/plugin-settings`,
     handler: "PluginSettingsController.getPluginSettings",
     config: {
-      policies: []
+      policies: readPolicy$5
     }
   },
   {
@@ -25040,7 +25114,20 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/plugin-settings`,
     handler: "PluginSettingsController.updatePluginSettings",
     config: {
-      policies: []
+      // Persists destructive Global Settings (webhookConfig, download.*, upload.*).
+      // UI-pref-only writes use `PUT /plugin-settings/ui-prefs` (read-gated) below.
+      policies: settingsUpdatePolicy$2
+    }
+  },
+  {
+    method: "PUT",
+    path: `${ROUTE_PREFIX$6}/ui-prefs`,
+    handler: "PluginSettingsController.updatePluginSettingsUiPrefs",
+    config: {
+      // Per-user UI state (last visited route, sort prefs). Service-side filters
+      // the body to a fixed allowlist so a `read`-only caller cannot reach the
+      // destructive fields that share the same plugin-settings store.
+      policies: readPolicy$5
     }
   },
   {
@@ -25048,18 +25135,22 @@ const PluginSettingsRoutes = [
     path: `${ROUTE_PREFIX$6}/sync-cursor`,
     handler: "PluginSettingsController.getSyncCursor",
     config: {
-      policies: []
+      policies: readPolicy$5
     }
   }
 ];
 const ROUTE_PREFIX$5 = "/strapi";
+const readPolicy$4 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy$1 = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const StrapiRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$5}/models`,
     handler: "StrapiController.getModels",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   },
   {
@@ -25067,7 +25158,7 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/localizable-models`,
     handler: "StrapiController.getLocalizableModels",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   },
   {
@@ -25075,7 +25166,7 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/lifecycle/localazy-webhooks`,
     handler: "StrapiController.postLifecycleLocalazyWebhooks",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy$1
     }
   },
   {
@@ -25083,18 +25174,19 @@ const StrapiRoutes = [
     path: `${ROUTE_PREFIX$5}/version`,
     handler: "StrapiController.getPluginVersion",
     config: {
-      policies: []
+      policies: readPolicy$4
     }
   }
 ];
 const ROUTE_PREFIX$4 = "/transfer";
+const transferPolicy$2 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const LocalazyTransferRoutes = [
   {
     method: "POST",
     path: `${ROUTE_PREFIX$4}/upload`,
     handler: "LocalazyTransferController.upload",
     config: {
-      policies: []
+      policies: transferPolicy$2
     }
   },
   {
@@ -25102,18 +25194,22 @@ const LocalazyTransferRoutes = [
     path: `${ROUTE_PREFIX$4}/download`,
     handler: "LocalazyTransferController.download",
     config: {
-      policies: []
+      policies: transferPolicy$2
     }
   }
 ];
 const ROUTE_PREFIX$3 = "/project";
+const readPolicy$3 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const settingsUpdatePolicy = [
+  { name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.SETTINGS_UPDATE] } }
+];
 const LocalazyProjectRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$3}`,
     handler: "LocalazyProjectController.getConnectedProject",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   },
   {
@@ -25121,7 +25217,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/webhooks`,
     handler: "LocalazyProjectController.getWebhookStatus",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   },
   {
@@ -25129,7 +25225,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/webhooks/setup`,
     handler: "LocalazyProjectController.setupWebhook",
     config: {
-      policies: []
+      policies: settingsUpdatePolicy
     }
   },
   {
@@ -25137,7 +25233,7 @@ const LocalazyProjectRoutes = [
     path: `${ROUTE_PREFIX$3}/strapi-url`,
     handler: "LocalazyProjectController.getStrapiUrl",
     config: {
-      policies: []
+      policies: readPolicy$3
     }
   }
 ];
@@ -25156,13 +25252,15 @@ const LocalazyPublicTransferRoutes = [
   }
 ];
 const ROUTE_PREFIX$1 = "/entry-exclusion";
+const readPolicy$2 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const transferPolicy$1 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const EntryExclusionRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX$1}/:contentType/:documentId`,
     handler: "EntryExclusionController.getEntryExclusion",
     config: {
-      policies: []
+      policies: readPolicy$2
     }
   },
   {
@@ -25170,7 +25268,7 @@ const EntryExclusionRoutes = [
     path: `${ROUTE_PREFIX$1}/:contentType/:documentId`,
     handler: "EntryExclusionController.setEntryExclusion",
     config: {
-      policies: []
+      policies: transferPolicy$1
     }
   },
   {
@@ -25178,18 +25276,20 @@ const EntryExclusionRoutes = [
     path: `${ROUTE_PREFIX$1}/:contentType`,
     handler: "EntryExclusionController.getContentTypeExclusions",
     config: {
-      policies: []
+      policies: readPolicy$2
     }
   }
 ];
 const ROUTE_PREFIX = "/activity-logs";
+const readPolicy$1 = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
+const transferPolicy = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.TRANSFER] } }];
 const ActivityLogsRoutes = [
   {
     method: "GET",
     path: `${ROUTE_PREFIX}`,
     handler: "ActivityLogsController.getSessions",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -25197,7 +25297,7 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}/export`,
     handler: "ActivityLogsController.exportSessions",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -25205,7 +25305,7 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}/:sessionId`,
     handler: "ActivityLogsController.getSession",
     config: {
-      policies: []
+      policies: readPolicy$1
     }
   },
   {
@@ -25213,23 +25313,28 @@ const ActivityLogsRoutes = [
     path: `${ROUTE_PREFIX}`,
     handler: "ActivityLogsController.clearSessions",
     config: {
-      policies: []
+      policies: transferPolicy
     }
   }
 ];
+const readPolicy = [{ name: "admin::hasPermissions", config: { actions: [PERMISSION_UIDS.READ] } }];
 const DebugBundleRoutes = [
   {
     method: "GET",
     path: "/activity-logs/:sessionId/bundle",
     handler: "DebugBundleController.getBundle",
     config: {
-      policies: []
+      policies: readPolicy
     }
   }
 ];
+const withoutAdminPolicies = (routes2) => routes2.map((route) => ({
+  ...route,
+  config: { ...route.config, policies: [] }
+}));
 const routes = {
   "content-api": {
-    routes: [...StrapiRoutes]
+    routes: withoutAdminPolicies(StrapiRoutes)
   },
   admin: {
     type: "admin",
@@ -25441,6 +25546,7 @@ const KEY$1 = "sync-cursor";
 const emptySyncCursor = {
   processedKeys: {}
 };
+const UI_PREF_FIELDS = ["defaultRoute", "activityLogsSort"];
 const PluginSettingsService = ({ strapi: strapi2 }) => ({
   async getContentTransferSetup() {
     const pluginStore = getStrapiStore(strapi2);
@@ -25477,6 +25583,20 @@ const PluginSettingsService = ({ strapi: strapi2 }) => ({
     });
     return newSettings;
   },
+  // Counterpart to `updatePluginSettings` for the `read`-gated UI-prefs route.
+  // Drops any field outside `UI_PREF_FIELDS` server-side so a `read`-only caller
+  // cannot reach `webhookConfig` / `download.*` / `upload.*` via the merge.
+  async updatePluginSettingsUiPrefs(prefs) {
+    const sanitized = {};
+    if (prefs && typeof prefs === "object") {
+      for (const field of UI_PREF_FIELDS) {
+        if (field in prefs) {
+          sanitized[field] = prefs[field];
+        }
+      }
+    }
+    return this.updatePluginSettings(sanitized);
+  },
   async getSyncCursor() {
     const pluginStore = getStrapiStore(strapi2);
     const cursor = await pluginStore.get({ key: KEY$1 });
@@ -26053,7 +26173,7 @@ const shouldSetDownloadedProperty = (modelContentTransferSetup, parsedKeyRest) =
     return "no";
   }
 };
-const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
+const getFilteredLanguagesCodesForDownload = async (languagesCodes, requestedUiLanguages) => {
   const pluginSettingsServiceHelper = new PluginSettingsServiceHelper();
   const requestInitiatorHelper = new RequestInitiatorHelper(strapi);
   await pluginSettingsServiceHelper.setup();
@@ -26061,7 +26181,7 @@ const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
   if (requestInitiatorHelper.isInitiatedByLocalazyWebhook()) {
     localLanguagesCodes = pluginSettingsServiceHelper.getWebhookLanguagesCodes();
   } else if (requestInitiatorHelper.isInitiatedByLocalazyPluginUI()) {
-    localLanguagesCodes = pluginSettingsServiceHelper.getUiLanguagesCodes();
+    localLanguagesCodes = requestedUiLanguages ?? pluginSettingsServiceHelper.getUiLanguagesCodes();
   } else {
     strapi.log.warn("Called by an unknown initiator.");
     return languagesCodes;
@@ -26074,7 +26194,8 @@ const getFilteredLanguagesCodesForDownload = async (languagesCodes) => {
 const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
   async download({
     notificationService,
-    fullSync = false
+    fullSync = false,
+    requestedUiLanguages
   }) {
     console.time("download");
     const syncMode = fullSync ? "Full sync" : "Incremental sync";
@@ -26154,7 +26275,7 @@ const LocalazyTransferDownloadService = ({ strapi: strapi2 }) => ({
       return;
     }
     let languagesCodes = projectLanguagesWithoutSourceLanguage.map((language3) => language3.code);
-    languagesCodes = await getFilteredLanguagesCodesForDownload(languagesCodes);
+    languagesCodes = await getFilteredLanguagesCodesForDownload(languagesCodes, requestedUiLanguages);
     const strapiUnsupportedLanguages = [];
     const strapiLocales = await StrapiI18nService2.getLocales();
     for (const isoLocalazy of languagesCodes) {

package/dist/server/src/bootstrap.d.ts

@@ -1,5 +1,5 @@
 import type { Core } from '@strapi/strapi';
 declare const bootstrap: ({ strapi }: {
     strapi: Core.Strapi;
-}) => void;
+}) => Promise<void>;
 export default bootstrap;

package/dist/server/src/constants/permissions.d.ts

@@ -0,0 +1,38 @@
+/**
+ * UIDs as Strapi sees them after `pluginName` is prepended by the action provider.
+ * Use these to reference permissions from route policies, admin menu/settings links
+ * and `useRBAC` calls. Renaming any UID is a breaking change for existing role grants
+ * — bumping a minor version is not enough.
+ */
+export declare const PERMISSION_UIDS: {
+    readonly READ: `plugin::${string}.read`;
+    readonly TRANSFER: `plugin::${string}.transfer`;
+    readonly SETTINGS_READ: `plugin::${string}.settings.read`;
+    readonly SETTINGS_UPDATE: `plugin::${string}.settings.update`;
+};
+export type PermissionUid = (typeof PERMISSION_UIDS)[keyof typeof PERMISSION_UIDS];
+type ActionRecord = {
+    section: 'plugins';
+    subCategory: string;
+    pluginName: string;
+    displayName: string;
+    uid: string;
+};
+/**
+ * Actions registered with `strapi.service('admin::permission').actionProvider.registerMany`
+ * during bootstrap. `pluginName` is prepended as `plugin::<pluginName>.` so the resulting
+ * UIDs become the ones in `PERMISSION_UIDS` above.
+ *
+ * All four actions live under `section: 'plugins'` so they appear together in the
+ * role editor's Plugins tab under "Localazy", grouped by `subCategory`. A previous
+ * split (settings-section for the two settings.* actions) caused them to land in a
+ * different tab — admins inspecting Plugins → Localazy only saw Read + Transfer and
+ * thought the other two were missing.
+ *
+ * Strapi's @strapi/admin yup validator (a) rejects `category` on `plugins`-section
+ * entries — `category` is only valid in `settings` section — and (b) allows
+ * `subCategory` on both `plugins` and `settings`. So we use `subCategory` alone for
+ * grouping here.
+ */
+export declare const LOCALAZY_RBAC_ACTIONS: ActionRecord[];
+export {};

package/dist/server/src/controllers/index.d.ts

@@ -35,6 +35,7 @@ declare const _default: {
         updateContentTransferSetup(ctx: any): Promise<void>;
         getPluginSettings(ctx: any): Promise<void>;
         updatePluginSettings(ctx: any): Promise<void>;
+        updatePluginSettingsUiPrefs(ctx: any): Promise<void>;
         getSyncCursor(ctx: any): Promise<void>;
     };
     LocalazyTransferController: ({ strapi }: {

package/dist/server/src/controllers/plugin-settings-controller.d.ts

@@ -6,6 +6,7 @@ declare const PluginSettingsController: ({ strapi: _strapi }: {
     updateContentTransferSetup(ctx: any): Promise<void>;
     getPluginSettings(ctx: any): Promise<void>;
     updatePluginSettings(ctx: any): Promise<void>;
+    updatePluginSettingsUiPrefs(ctx: any): Promise<void>;
     getSyncCursor(ctx: any): Promise<void>;
 };
 export default PluginSettingsController;

package/dist/server/src/core/index.d.ts

@@ -18,9 +18,10 @@ export declare const getLocalazyTransferUploadService: () => {
     }): Promise<void>;
 };
 export declare const getLocalazyTransferDownloadService: () => {
-    download({ notificationService, fullSync, }: {
+    download({ notificationService, fullSync, requestedUiLanguages, }: {
         notificationService: import("../services/helpers/job-notification-service").default;
         fullSync?: boolean;
+        requestedUiLanguages?: string[];
     }): Promise<void>;
 };
 export declare const getPluginSettingsService: () => {
@@ -31,6 +32,7 @@ export declare const getPluginSettingsService: () => {
     }>;
     getPluginSettings(): Promise<import("../db/model/plugin-settings").PluginSettings>;
     updatePluginSettings(settings: any): Promise<any>;
+    updatePluginSettingsUiPrefs(prefs: Partial<Pick<import("../db/model/plugin-settings").PluginSettings, "defaultRoute" | "activityLogsSort">>): Promise<import("../db/model/plugin-settings").PluginSettings>;
     getSyncCursor(): Promise<import("../db/model/sync-cursor").SyncCursor>;
     updateSyncCursor(cursor: import("../db/model/sync-cursor").SyncCursor): Promise<import("../db/model/sync-cursor").SyncCursor>;
 };