@permitio/permit-strapi 1.0.0

package/dist/server/index.mjs

@@ -0,0 +1,1111 @@
+import { Permit } from "permitio";
+const debugLog = (strapi, message) => {
+  if (process.env.PERMIT_STRAPI_DEBUG === "true") {
+    strapi.log.info(message);
+  }
+};
+const bootstrap = async ({ strapi }) => {
+  strapi.log.info("[permit-strapi] bootstrap running - v2");
+  const config2 = await strapi.plugin("permit-strapi").service("config").getConfig();
+  if (!config2?.apiKey) {
+    debugLog(strapi, "[permit-strapi] No config found, skipping initialization");
+    return;
+  }
+  strapi.permit = new Permit({
+    token: config2.apiKey,
+    pdp: config2.pdpUrl
+  });
+  debugLog(strapi, "[permit-strapi] Permit.io client initialized");
+  const excludedResources = await strapi.plugin("permit-strapi").service("config").getExcludedResources();
+  await strapi.plugin("permit-strapi").service("config").syncResourcesToPermit(excludedResources);
+  await strapi.plugin("permit-strapi").service("roles").syncRolesToPermit();
+};
+const destroy = ({ strapi }) => {
+};
+const deriveAction = (method, hasId) => {
+  if (method === "GET") return hasId ? "findOne" : "find";
+  if (method === "POST") return "create";
+  if (method === "PUT" || method === "PATCH") return "update";
+  if (method === "DELETE") return "delete";
+  return null;
+};
+const extractAttributes = (entity, mappedFields) => {
+  const attributes = {};
+  for (const field of mappedFields) {
+    const value = entity[field];
+    if (value === void 0 || value === null) continue;
+    if (typeof value === "object" && !Array.isArray(value) && value.id !== void 0) {
+      attributes[`${field}Id`] = value.id;
+    } else {
+      attributes[field] = value;
+    }
+  }
+  return attributes;
+};
+const permitAuthMiddleware = ({ strapi }) => {
+  return async (ctx, next) => {
+    if (!ctx.request.url.startsWith("/api/")) {
+      return next();
+    }
+    const authHeader = ctx.request.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return next();
+    }
+    const permit = strapi.permit;
+    if (!permit) {
+      return next();
+    }
+    const token = authHeader.slice(7);
+    let userId;
+    let decodedId;
+    try {
+      const jwtService = strapi.plugin("users-permissions").service("jwt");
+      const decoded = await jwtService.verify(token);
+      decodedId = decoded.id;
+      userId = `strapi-${decoded.id}`;
+    } catch {
+      return next();
+    }
+    const urlPath = ctx.request.url.split("?")[0];
+    const pathParts = urlPath.split("/").filter(Boolean);
+    if (pathParts.length < 2) return next();
+    const resourceSlug = pathParts[1];
+    const hasId = pathParts.length > 2;
+    const resourceId = hasId ? pathParts[2] : null;
+    const ctEntry = Object.values(strapi.contentTypes).filter((ct) => ct.uid.startsWith("api::")).find(
+      (ct) => ct.info?.pluralName === resourceSlug || ct.info?.singularName === resourceSlug
+    );
+    if (!ctEntry) {
+      return next();
+    }
+    const resourceUid = ctEntry.uid;
+    const resourceName = resourceUid.split("::")[1]?.split(".")[0];
+    const configService2 = strapi.plugin("permit-strapi").service("config");
+    const excludedResources = await configService2.getExcludedResources();
+    if (excludedResources.includes(resourceUid)) {
+      debugLog(strapi, `[permit-strapi] Skipping excluded resource: ${resourceUid}`);
+      return next();
+    }
+    const action = deriveAction(ctx.request.method, hasId);
+    if (!action) return next();
+    const userAttrMappings = await configService2.getUserAttributeMappings();
+    let userObj = userId;
+    if (userAttrMappings.length > 0) {
+      try {
+        const fullUser = await strapi.db.query("plugin::users-permissions.user").findOne({
+          where: { id: decodedId },
+          populate: userAttrMappings
+        });
+        if (fullUser) {
+          const attrs = extractAttributes(fullUser, userAttrMappings);
+          attrs.strapiId = decodedId;
+          userObj = { key: userId, attributes: attrs };
+        }
+      } catch (err) {
+        strapi.log.warn(`[permit-strapi] Failed to fetch user attributes: ${err.message}`);
+      }
+    }
+    const resourceAttrMappings = await configService2.getResourceAttributeMappings();
+    const mappedResourceFields = resourceAttrMappings[resourceUid] || [];
+    if (action === "find" && mappedResourceFields.length > 0) {
+      await next();
+      if (ctx.status !== 200 || !ctx.body?.data || !Array.isArray(ctx.body.data)) return;
+      const entities = ctx.body.data;
+      if (entities.length === 0) return;
+      try {
+        const documentIds = entities.map((e) => e.documentId);
+        const fullEntities = await strapi.db.query(resourceUid).findMany({
+          where: { documentId: { $in: documentIds } },
+          populate: mappedResourceFields
+        });
+        const entityMap = /* @__PURE__ */ new Map();
+        for (const e of fullEntities) {
+          if (!entityMap.has(e.documentId)) {
+            entityMap.set(e.documentId, e);
+          }
+        }
+        const checks = entities.map((entity) => {
+          const full = entityMap.get(entity.documentId);
+          const attrs = full ? extractAttributes(full, mappedResourceFields) : {};
+          return {
+            user: userObj,
+            action: "find",
+            resource: { type: resourceName, key: entity.documentId, attributes: attrs }
+          };
+        });
+        debugLog(
+          strapi,
+          `[permit-strapi] bulkCheck: user=${typeof userObj === "string" ? userObj : userObj.key} action=find resource=${resourceName} count=${checks.length}`
+        );
+        const results = await permit.bulkCheck(checks);
+        const allowed = entities.filter((_, i) => results[i]);
+        const denied = entities.length - allowed.length;
+        if (denied > 0) {
+          debugLog(
+            strapi,
+            `[permit-strapi] bulkCheck filtered: ${allowed.length} allowed, ${denied} denied out of ${entities.length} ${resourceName}(s)`
+          );
+        }
+        ctx.body = {
+          ...ctx.body,
+          data: allowed,
+          meta: {
+            ...ctx.body.meta,
+            pagination: ctx.body.meta?.pagination ? { ...ctx.body.meta.pagination, total: allowed.length } : void 0
+          }
+        };
+      } catch (err) {
+        strapi.log.error(`[permit-strapi] bulkCheck failed, returning unfiltered: ${err.message}`);
+      }
+      return;
+    }
+    let resourceObj = resourceName;
+    if (hasId && resourceId) {
+      if (mappedResourceFields.length > 0) {
+        try {
+          const entity = await strapi.db.query(resourceUid).findOne({
+            where: { documentId: resourceId },
+            populate: mappedResourceFields
+          });
+          if (entity) {
+            resourceObj = { type: resourceName, key: resourceId, attributes: extractAttributes(entity, mappedResourceFields) };
+          } else {
+            resourceObj = { type: resourceName, key: resourceId };
+          }
+        } catch (err) {
+          strapi.log.warn(`[permit-strapi] Failed to fetch resource attributes: ${err.message}`);
+          resourceObj = { type: resourceName, key: resourceId };
+        }
+      } else {
+        resourceObj = { type: resourceName, key: resourceId };
+      }
+    }
+    debugLog(
+      strapi,
+      `[permit-strapi] check: user=${typeof userObj === "string" ? userObj : userObj.key} action=${action} resource=${typeof resourceObj === "string" ? resourceObj : `${resourceObj.type}(key=${resourceObj.key ?? "none"}, attrs=${JSON.stringify(resourceObj.attributes || {})})`}`
+    );
+    try {
+      const permitted = await permit.check(userObj, action, resourceObj);
+      if (!permitted) {
+        strapi.log.warn(
+          `[permit-strapi] DENIED: user=${userId} action=${action} resource=${resourceName}`
+        );
+        ctx.status = 403;
+        ctx.body = {
+          data: null,
+          error: {
+            status: 403,
+            name: "ForbiddenError",
+            message: "You are not authorized to perform this action",
+            details: {}
+          }
+        };
+        return;
+      }
+      debugLog(strapi, `[permit-strapi] ALLOWED: user=${userId} action=${action} resource=${resourceName}`);
+      return next();
+    } catch (error) {
+      strapi.log.error(`[permit-strapi] permit.check() failed: ${error.message}`);
+      return next();
+    }
+  };
+};
+const register = ({ strapi }) => {
+  strapi.server.use(permitAuthMiddleware({ strapi }));
+  strapi.db.lifecycles.subscribe({
+    models: ["plugin::users-permissions.role"],
+    async afterCreate({ result }) {
+      await strapi.plugin("permit-strapi").service("roles").createOrUpdatePermitRole(result);
+    },
+    async afterUpdate({ result }) {
+      await strapi.plugin("permit-strapi").service("roles").createOrUpdatePermitRole(result);
+    },
+    async afterDelete({ result }) {
+      await strapi.plugin("permit-strapi").service("roles").deletePermitRole(result);
+    }
+  });
+  strapi.db.lifecycles.subscribe({
+    models: ["plugin::users-permissions.user"],
+    async afterCreate({ result }) {
+      await strapi.plugin("permit-strapi").service("users").syncUserToPermit(result);
+    },
+    async afterUpdate({ result }) {
+      await strapi.plugin("permit-strapi").service("users").syncUserToPermit(result);
+    },
+    async afterDelete({ result }) {
+      await strapi.plugin("permit-strapi").service("users").deletePermitUser(result);
+    }
+  });
+  strapi.db.lifecycles.subscribe({
+    async afterCreate(event) {
+      const { model, result } = event;
+      if (!model?.uid?.startsWith("api::") || !result?.documentId) return;
+      const permit = strapi.permit;
+      if (!permit) return;
+      const configService2 = strapi.plugin("permit-strapi").service("config");
+      const excluded = await configService2.getExcludedResources();
+      if (excluded.includes(model.uid)) return;
+      const rebacConfig = await configService2.getRebacConfig();
+      if (!rebacConfig[model.uid]?.enabled) return;
+      await strapi.plugin("permit-strapi").service("instances").createResourceInstance(model.uid, result.documentId);
+    },
+    async afterDelete(event) {
+      const { model, result } = event;
+      if (!model?.uid?.startsWith("api::") || !result?.documentId) return;
+      const permit = strapi.permit;
+      if (!permit) return;
+      const configService2 = strapi.plugin("permit-strapi").service("config");
+      const excluded = await configService2.getExcludedResources();
+      if (excluded.includes(model.uid)) return;
+      const rebacConfig = await configService2.getRebacConfig();
+      if (!rebacConfig[model.uid]?.enabled) return;
+      await strapi.plugin("permit-strapi").service("instances").deleteResourceInstance(model.uid, result.documentId);
+    }
+  });
+};
+const config = {
+  default: {},
+  validator() {
+  }
+};
+const contentTypes = {};
+const controller = ({ strapi }) => ({
+  index(ctx) {
+    ctx.body = strapi.plugin("permit-strapi").service("service").getWelcomeMessage();
+  }
+});
+const configController = ({ strapi }) => ({
+  async saveConfig(ctx) {
+    const { apiKey, pdpUrl } = ctx.request.body;
+    if (!apiKey) {
+      return ctx.badRequest("API key is required");
+    }
+    if (!pdpUrl) {
+      return ctx.badRequest("PDP URL is required");
+    }
+    try {
+      const result = await strapi.plugin("permit-strapi").service("config").validateAndSave({ apiKey, pdpUrl });
+      ctx.body = result;
+    } catch (error) {
+      strapi.log.error(`[permit-strapi] saveConfig failed: ${error.message}`);
+      return ctx.badRequest(error.message);
+    }
+  },
+  async getExcludedResources(ctx) {
+    const excludedResources = await strapi.plugin("permit-strapi").service("config").getExcludedResources();
+    ctx.body = { excludedResources };
+  },
+  async saveExcludedResources(ctx) {
+    const { excludedResources } = ctx.request.body;
+    if (!Array.isArray(excludedResources)) {
+      return ctx.badRequest("excludedResources must be an array");
+    }
+    await strapi.plugin("permit-strapi").service("config").saveExcludedResources(excludedResources);
+    ctx.body = { success: true };
+  },
+  async deleteConfig(ctx) {
+    const store = await strapi.plugin("permit-strapi").service("config").getStore();
+    await store.delete({ key: "config" });
+    strapi.permit = null;
+    ctx.body = { success: true };
+  },
+  async getContentTypes(ctx) {
+    const contentTypes2 = Object.values(strapi.contentTypes).filter((ct) => ct.kind === "collectionType" && ct.uid.startsWith("api::")).map((ct) => ({
+      uid: ct.uid,
+      displayName: ct.info?.displayName || ct.uid,
+      apiID: ct.info?.singularName || ct.uid
+    }));
+    ctx.body = { contentTypes: contentTypes2 };
+  },
+  async syncAllUsers(ctx) {
+    try {
+      const result = await strapi.plugin("permit-strapi").service("users").syncAllUsers();
+      ctx.body = result;
+    } catch (error) {
+      return ctx.badRequest(error.message);
+    }
+  },
+  async getConfig(ctx) {
+    const config2 = await strapi.plugin("permit-strapi").service("config").getConfig();
+    if (!config2) {
+      return ctx.body = { configured: false };
+    }
+    const maskedApiKey = `${"*".repeat(8)}${config2.apiKey.slice(-4)}`;
+    ctx.body = {
+      configured: true,
+      pdpUrl: config2.pdpUrl,
+      apiKey: maskedApiKey
+    };
+  },
+  async getUserAttributeMappings(ctx) {
+    const mappings = await strapi.plugin("permit-strapi").service("config").getUserAttributeMappings();
+    ctx.body = { mappings };
+  },
+  async saveUserAttributeMappings(ctx) {
+    const { mappings } = ctx.request.body;
+    if (!Array.isArray(mappings)) {
+      return ctx.badRequest("mappings must be an array of field names");
+    }
+    const configService2 = strapi.plugin("permit-strapi").service("config");
+    await configService2.saveUserAttributeMappings(mappings);
+    const excludedResources = await configService2.getExcludedResources();
+    await configService2.syncResourcesToPermit(excludedResources);
+    ctx.body = { success: true };
+  },
+  async getResourceAttributeMappings(ctx) {
+    const mappings = await strapi.plugin("permit-strapi").service("config").getResourceAttributeMappings();
+    ctx.body = { mappings };
+  },
+  async saveResourceAttributeMappings(ctx) {
+    const { mappings } = ctx.request.body;
+    if (!mappings || typeof mappings !== "object") {
+      return ctx.badRequest("mappings must be an object of { uid: string[] }");
+    }
+    const configService2 = strapi.plugin("permit-strapi").service("config");
+    await configService2.saveResourceAttributeMappings(mappings);
+    const excludedResources = await configService2.getExcludedResources();
+    await configService2.syncResourcesToPermit(excludedResources);
+    ctx.body = { success: true };
+  },
+  async getContentTypeFields(ctx) {
+    const { uid } = ctx.params;
+    strapi.log.info(`[permit-strapi] getContentTypeFields called for: ${uid}`);
+    const ct = strapi.contentTypes[uid];
+    strapi.log.info(`[permit-strapi] raw attributes for ${uid}: ${JSON.stringify(ct?.attributes)}`);
+    if (!ct) {
+      return ctx.notFound(`Content type ${uid} not found`);
+    }
+    const scalarTypes = [
+      "string",
+      "text",
+      "richtext",
+      "email",
+      "uid",
+      "enumeration",
+      "integer",
+      "biginteger",
+      "float",
+      "decimal",
+      "boolean",
+      "date",
+      "datetime",
+      "time",
+      "json",
+      "relation"
+    ];
+    const fields = Object.entries(ct.attributes || {}).filter(([, attr]) => scalarTypes.includes(attr.type)).map(([name, attr]) => ({
+      name,
+      type: attr.type
+    }));
+    strapi.log.info(`[permit-strapi] fields for ${uid}: ${JSON.stringify(fields)}`);
+    ctx.body = { fields };
+  },
+  async getUserFields(ctx) {
+    const userCt = strapi.contentTypes["plugin::users-permissions.user"];
+    if (!userCt) {
+      return ctx.notFound("User content type not found");
+    }
+    const scalarTypes = [
+      "string",
+      "text",
+      "email",
+      "enumeration",
+      "integer",
+      "biginteger",
+      "float",
+      "decimal",
+      "boolean",
+      "date",
+      "datetime",
+      "time",
+      "relation"
+    ];
+    const systemFields = ["password", "resetPasswordToken", "confirmationToken", "provider", "confirmed", "blocked"];
+    const fields = Object.entries(userCt.attributes || {}).filter(
+      ([name, attr]) => scalarTypes.includes(attr.type) && !systemFields.includes(name)
+    ).map(([name, attr]) => ({
+      name,
+      type: attr.type
+    }));
+    ctx.body = { fields };
+  }
+});
+const extractResourceKey$2 = (uid) => uid.split("::")[1]?.split(".")[0] ?? uid;
+const rebacController = ({ strapi }) => ({
+  async getRebacConfig(ctx) {
+    const config2 = await strapi.plugin("permit-strapi").service("config").getRebacConfig();
+    ctx.body = { config: config2 };
+  },
+  async saveRebacConfig(ctx) {
+    const { config: config2 } = ctx.request.body;
+    if (!config2 || typeof config2 !== "object") {
+      return ctx.badRequest("config must be an object");
+    }
+    await strapi.plugin("permit-strapi").service("config").saveRebacConfig(config2);
+    ctx.body = { success: true };
+  },
+  async syncInstances(ctx) {
+    const uid = decodeURIComponent(ctx.params.uid);
+    const ct = strapi.contentTypes[uid];
+    if (!ct || !uid.startsWith("api::")) {
+      return ctx.notFound(`Content type ${uid} not found`);
+    }
+    try {
+      const result = await strapi.plugin("permit-strapi").service("instances").syncAllInstances(uid);
+      ctx.body = result;
+    } catch (error) {
+      return ctx.badRequest(error.message);
+    }
+  },
+  async getInstanceRoles(ctx) {
+    const uid = decodeURIComponent(ctx.params.uid);
+    const store = await strapi.plugin("permit-strapi").service("config").getStore();
+    const allRoles = await store.get({ key: "rebacInstanceRoles" });
+    ctx.body = { roles: allRoles?.[uid] || [] };
+  },
+  /**
+   * Saves instance roles to the Strapi store and syncs them to Permit.io
+   * as resource roles on the corresponding resource.
+   *
+   * Body: `{ roles: [{ key: "owner", name: "Owner" }, ...] }`
+   */
+  async saveInstanceRoles(ctx) {
+    const uid = decodeURIComponent(ctx.params.uid);
+    const { roles } = ctx.request.body;
+    if (!Array.isArray(roles)) {
+      return ctx.badRequest("roles must be an array of { key, name }");
+    }
+    const ct = strapi.contentTypes[uid];
+    if (!ct || !uid.startsWith("api::")) {
+      return ctx.notFound(`Content type ${uid} not found`);
+    }
+    const store = await strapi.plugin("permit-strapi").service("config").getStore();
+    const allRoles = await store.get({ key: "rebacInstanceRoles" }) || {};
+    allRoles[uid] = roles;
+    await store.set({ key: "rebacInstanceRoles", value: allRoles });
+    const permit = strapi.permit;
+    if (permit) {
+      const resourceKey = extractResourceKey$2(uid);
+      for (const role of roles) {
+        try {
+          await permit.api.resourceRoles.create(resourceKey, {
+            key: role.key,
+            name: role.name
+          });
+          debugLog(strapi, `[permit-strapi] Created resource role "${role.key}" on ${resourceKey}`);
+        } catch {
+          try {
+            await permit.api.resourceRoles.update(resourceKey, role.key, { name: role.name });
+            debugLog(strapi, `[permit-strapi] Updated resource role "${role.key}" on ${resourceKey}`);
+          } catch (updateError) {
+            strapi.log.warn(`[permit-strapi] Could not sync role "${role.key}" on ${resourceKey}: ${updateError.message}`);
+          }
+        }
+      }
+    }
+    ctx.body = { success: true };
+  }
+});
+const controllers = {
+  controller,
+  config: configController,
+  rebac: rebacController
+};
+const middlewares = {};
+const policies = {};
+const contentAPIRoutes = () => ({
+  type: "content-api",
+  routes: [
+    {
+      method: "GET",
+      path: "/",
+      // name of the controller file & the method.
+      handler: "controller.index",
+      config: {
+        policies: []
+      }
+    }
+  ]
+});
+const adminAPIRoutes = () => ({
+  type: "admin",
+  routes: [
+    {
+      method: "POST",
+      path: "/config",
+      handler: "config.saveConfig",
+      config: {
+        policies: []
+      }
+    },
+    {
+      method: "GET",
+      path: "/config",
+      handler: "config.getConfig",
+      config: {
+        policies: []
+      }
+    },
+    {
+      method: "GET",
+      path: "/excluded-resources",
+      handler: "config.getExcludedResources",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/excluded-resources",
+      handler: "config.saveExcludedResources",
+      config: { policies: [] }
+    },
+    {
+      method: "DELETE",
+      path: "/config",
+      handler: "config.deleteConfig",
+      config: {
+        policies: []
+      }
+    },
+    {
+      method: "GET",
+      path: "/content-types",
+      handler: "config.getContentTypes",
+      config: {
+        policies: []
+      }
+    },
+    {
+      method: "POST",
+      path: "/sync-users",
+      handler: "config.syncAllUsers",
+      config: { policies: [] }
+    },
+    // ABAC Attribute Mapping Routes
+    {
+      method: "GET",
+      path: "/user-attribute-mappings",
+      handler: "config.getUserAttributeMappings",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/user-attribute-mappings",
+      handler: "config.saveUserAttributeMappings",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/resource-attribute-mappings",
+      handler: "config.getResourceAttributeMappings",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/resource-attribute-mappings",
+      handler: "config.saveResourceAttributeMappings",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/content-type-fields/:uid",
+      handler: "config.getContentTypeFields",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/user-fields",
+      handler: "config.getUserFields",
+      config: { policies: [] }
+    },
+    // ReBAC Routes
+    {
+      method: "GET",
+      path: "/rebac-config",
+      handler: "rebac.getRebacConfig",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/rebac-config",
+      handler: "rebac.saveRebacConfig",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/sync-instances/:uid",
+      handler: "rebac.syncInstances",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/instance-roles/:uid",
+      handler: "rebac.getInstanceRoles",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/instance-roles/:uid",
+      handler: "rebac.saveInstanceRoles",
+      config: { policies: [] }
+    }
+  ]
+});
+const routes = {
+  "content-api": contentAPIRoutes,
+  admin: adminAPIRoutes
+};
+const service = ({ strapi }) => ({
+  getWelcomeMessage() {
+    return "Welcome to Strapi 🚀";
+  }
+});
+const STORE_KEY = "config";
+const RESOURCE_ACTIONS = {
+  find: { name: "Find" },
+  findOne: { name: "Find One" },
+  create: { name: "Create" },
+  update: { name: "Update" },
+  delete: { name: "Delete" }
+};
+const STRAPI_TO_PERMIT_TYPE = {
+  string: "string",
+  text: "string",
+  richtext: "string",
+  email: "string",
+  uid: "string",
+  enumeration: "string",
+  integer: "number",
+  biginteger: "number",
+  float: "number",
+  decimal: "number",
+  boolean: "bool",
+  date: "string",
+  datetime: "string",
+  time: "string",
+  json: "json",
+  relation: "number"
+};
+const extractResourceKey$1 = (uid) => uid.split("::")[1]?.split(".")[0] ?? uid;
+const configService = ({ strapi }) => ({
+  async getStore() {
+    return strapi.store({ type: "plugin", name: "permit-strapi" });
+  },
+  async getConfig() {
+    const store = await this.getStore();
+    return store.get({ key: STORE_KEY });
+  },
+  async saveConfig({ apiKey, pdpUrl }) {
+    const store = await this.getStore();
+    await store.set({ key: STORE_KEY, value: { apiKey, pdpUrl } });
+  },
+  async getExcludedResources() {
+    const store = await this.getStore();
+    const excluded = await store.get({ key: "excludedResources" });
+    return excluded || [];
+  },
+  async getUserAttributeMappings() {
+    const store = await this.getStore();
+    const mappings = await store.get({ key: "userAttributeMappings" });
+    return mappings || [];
+  },
+  async saveUserAttributeMappings(mappings) {
+    const store = await this.getStore();
+    await store.set({ key: "userAttributeMappings", value: mappings });
+    debugLog(strapi, `[permit-strapi] Saved user attribute mappings: ${JSON.stringify(mappings)}`);
+  },
+  async getResourceAttributeMappings() {
+    const store = await this.getStore();
+    const mappings = await store.get({ key: "resourceAttributeMappings" });
+    return mappings || {};
+  },
+  async saveResourceAttributeMappings(mappings) {
+    const store = await this.getStore();
+    await store.set({ key: "resourceAttributeMappings", value: mappings });
+    debugLog(strapi, `[permit-strapi] Saved resource attribute mappings: ${JSON.stringify(mappings)}`);
+  },
+  /** ReBAC config keyed by CT UID: `{ "api::post.post": { enabled: true, creatorRole: "owner" } }` */
+  async getRebacConfig() {
+    const store = await this.getStore();
+    const config2 = await store.get({ key: "rebacConfig" });
+    return config2 || {};
+  },
+  async saveRebacConfig(config2) {
+    const store = await this.getStore();
+    await store.set({ key: "rebacConfig", value: config2 });
+    debugLog(strapi, `[permit-strapi] Saved ReBAC config: ${JSON.stringify(config2)}`);
+  },
+  /** Converts mapped Strapi CT fields into the Permit.io attribute schema format. */
+  buildAttributeSchema(ctUid, mappedFields) {
+    const ct = strapi.contentTypes[ctUid];
+    if (!ct || !ct.attributes || mappedFields.length === 0) return {};
+    const schema = {};
+    for (const field of mappedFields) {
+      const attr = ct.attributes[field];
+      if (!attr) continue;
+      const permitType = STRAPI_TO_PERMIT_TYPE[attr.type];
+      if (!permitType) continue;
+      const schemaKey = attr.type === "relation" ? `${field}Id` : field;
+      schema[schemaKey] = {
+        type: permitType,
+        description: `${schemaKey} (${attr.type})`
+      };
+    }
+    return schema;
+  },
+  /** Upserts all non-excluded CTs as Permit.io resources. Safe to call on every bootstrap. */
+  async syncResourcesToPermit(excludedResources) {
+    const permit = strapi.permit;
+    if (!permit) return;
+    const resourceAttrMappings = await this.getResourceAttributeMappings();
+    const contentTypes2 = Object.values(strapi.contentTypes).filter((ct) => ct.kind === "collectionType" && ct.uid.startsWith("api::")).map((ct) => ({
+      uid: ct.uid,
+      displayName: ct.info?.displayName || ct.uid,
+      key: extractResourceKey$1(ct.uid)
+    }));
+    for (const ct of contentTypes2) {
+      if (excludedResources.includes(ct.uid)) continue;
+      const mappedFields = resourceAttrMappings[ct.uid] || [];
+      const attributes = this.buildAttributeSchema(ct.uid, mappedFields);
+      try {
+        await permit.api.resources.get(ct.key);
+        await permit.api.resources.update(ct.key, {
+          name: ct.displayName,
+          actions: RESOURCE_ACTIONS,
+          attributes
+        });
+        debugLog(strapi, `[permit-strapi] Updated resource: ${ct.key}`);
+      } catch {
+        try {
+          await permit.api.resources.create({
+            key: ct.key,
+            name: ct.displayName,
+            actions: RESOURCE_ACTIONS,
+            attributes
+          });
+          debugLog(strapi, `[permit-strapi] Created resource: ${ct.key}`);
+        } catch (createError) {
+          strapi.log.error(`[permit-strapi] Failed to sync resource ${ct.key}: ${createError.message}`);
+        }
+      }
+    }
+  },
+  async saveExcludedResources(excludedResources) {
+    const oldExcluded = await this.getExcludedResources();
+    const store = await this.getStore();
+    await store.set({ key: "excludedResources", value: excludedResources });
+    const permit = strapi.permit;
+    if (!permit) return;
+    const resourceAttrMappings = await this.getResourceAttributeMappings();
+    const newlyExcluded = excludedResources.filter((uid) => !oldExcluded.includes(uid));
+    for (const uid of newlyExcluded) {
+      const key = extractResourceKey$1(uid);
+      try {
+        await permit.api.resources.delete(key);
+        debugLog(strapi, `[permit-strapi] Deleted resource: ${key}`);
+      } catch (error) {
+        strapi.log.warn(`[permit-strapi] Could not delete resource ${key}: ${error.message}`);
+      }
+    }
+    const newlyProtected = oldExcluded.filter((uid) => !excludedResources.includes(uid));
+    for (const uid of newlyProtected) {
+      const ct = strapi.contentTypes[uid];
+      if (!ct) continue;
+      const key = extractResourceKey$1(uid);
+      const displayName = ct.info?.displayName || key;
+      const mappedFields = resourceAttrMappings[uid] || [];
+      const attributes = this.buildAttributeSchema(uid, mappedFields);
+      try {
+        await permit.api.resources.get(key);
+        await permit.api.resources.update(key, {
+          name: displayName,
+          actions: RESOURCE_ACTIONS,
+          attributes
+        });
+        debugLog(strapi, `[permit-strapi] Updated resource: ${key}`);
+      } catch {
+        try {
+          await permit.api.resources.create({
+            key,
+            name: displayName,
+            actions: RESOURCE_ACTIONS,
+            attributes
+          });
+          debugLog(strapi, `[permit-strapi] Created resource: ${key}`);
+        } catch (createError) {
+          strapi.log.error(`[permit-strapi] Failed to create resource ${key}: ${createError.message}`);
+        }
+      }
+    }
+  },
+  /**
+   * Validates the API key against Permit.io, saves the config, reinitializes
+   * the shared Permit instance, and syncs all non-excluded resources.
+   */
+  async validateAndSave({ apiKey, pdpUrl }) {
+    const permit = new Permit({ token: apiKey, pdp: pdpUrl });
+    try {
+      await permit.api.projects.list();
+    } catch (error) {
+      strapi.log.error(`[permit-strapi] API key validation failed: ${error.message}`);
+      throw new Error("Invalid API key. Please check your Permit.io credentials.");
+    }
+    await this.saveConfig({ apiKey, pdpUrl });
+    strapi.permit = new Permit({ token: apiKey, pdp: pdpUrl });
+    const excludedResources = await this.getExcludedResources();
+    await this.syncResourcesToPermit(excludedResources);
+    return { success: true };
+  }
+});
+const getRoleKey = (role) => role.type || role.name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+const rolesService = ({ strapi }) => ({
+  async getUPRoles() {
+    const roles = await strapi.db.query("plugin::users-permissions.role").findMany({});
+    return roles.filter((role) => role.type !== "public");
+  },
+  /** Upserts a single UP role to Permit.io. */
+  async createOrUpdatePermitRole(role) {
+    const permit = strapi.permit;
+    if (!permit || role.type === "public") return;
+    const key = getRoleKey(role);
+    const name = role.name;
+    try {
+      await permit.api.roles.get(key);
+      await permit.api.roles.update(key, { name });
+      debugLog(strapi, `[permit-strapi] Updated role: ${key}`);
+    } catch {
+      try {
+        await permit.api.roles.create({ key, name });
+        debugLog(strapi, `[permit-strapi] Created role: ${key}`);
+      } catch (createError) {
+        strapi.log.error(
+          `[permit-strapi] Failed to sync role ${key}: ${createError.message}`
+        );
+      }
+    }
+  },
+  async deletePermitRole(role) {
+    const permit = strapi.permit;
+    if (!permit || role.type === "public") return;
+    const key = getRoleKey(role);
+    try {
+      await permit.api.roles.delete(key);
+      debugLog(strapi, `[permit-strapi] Deleted role: ${key}`);
+    } catch (error) {
+      strapi.log.warn(
+        `[permit-strapi] Could not delete role ${key}: ${error.message}`
+      );
+    }
+  },
+  /** Upserts all non-public UP roles to Permit.io. Called on bootstrap. */
+  async syncRolesToPermit() {
+    const permit = strapi.permit;
+    if (!permit) return;
+    const roles = await this.getUPRoles();
+    for (const role of roles) {
+      await this.createOrUpdatePermitRole(role);
+    }
+  }
+});
+const DEFAULT_TENANT$1 = "default";
+const usersService = ({ strapi }) => ({
+  async getUserWithRole(userId) {
+    const mappings = await strapi.plugin("permit-strapi").service("config").getUserAttributeMappings();
+    return strapi.db.query("plugin::users-permissions.user").findOne({
+      where: { id: userId },
+      populate: ["role", ...mappings]
+    });
+  },
+  /** Returns an object of mapped attribute values from a user record. */
+  async extractUserAttributes(user) {
+    const mappings = await strapi.plugin("permit-strapi").service("config").getUserAttributeMappings();
+    if (!mappings || mappings.length === 0) return {};
+    const attributes = {};
+    for (const field of mappings) {
+      const value = user[field];
+      if (value === void 0 || value === null) continue;
+      if (typeof value === "object" && !Array.isArray(value) && value.id !== void 0) {
+        attributes[`${field}Id`] = value.id;
+      } else {
+        attributes[field] = value;
+      }
+    }
+    return attributes;
+  },
+  /**
+   * Replaces the user's current Permit.io role assignments with the given role.
+   * Unassigns all existing roles first to prevent stale accumulation.
+   */
+  async syncUserRole(key, roleType) {
+    const permit = strapi.permit;
+    const current = await permit.api.users.getAssignedRoles({
+      user: key,
+      tenant: DEFAULT_TENANT$1
+    });
+    await Promise.all(
+      current.map(
+        (assignment) => permit.api.users.unassignRole({
+          user: key,
+          role: assignment.role,
+          tenant: DEFAULT_TENANT$1
+        })
+      )
+    );
+    await permit.api.users.assignRole({
+      user: key,
+      role: roleType,
+      tenant: DEFAULT_TENANT$1
+    });
+    debugLog(strapi, `[permit-strapi] Assigned role "${roleType}" to user ${key}`);
+  },
+  /** Syncs a user to Permit.io and assigns their current UP role. */
+  async syncUserToPermit(user) {
+    const permit = strapi.permit;
+    if (!permit) return;
+    const fullUser = await this.getUserWithRole(user.id);
+    if (!fullUser) return;
+    const key = `strapi-${fullUser.id}`;
+    const attributes = await this.extractUserAttributes(fullUser);
+    attributes.strapiId = fullUser.id;
+    try {
+      await permit.api.users.sync({
+        key,
+        email: fullUser.email,
+        first_name: fullUser.username,
+        attributes
+      });
+      debugLog(strapi, `[permit-strapi] Synced user: ${key}`);
+    } catch (error) {
+      strapi.log.error(`[permit-strapi] Failed to sync user ${key}: ${error.message}`);
+      return;
+    }
+    const roleType = fullUser.role?.type;
+    if (!roleType || roleType === "public") return;
+    try {
+      await this.syncUserRole(key, roleType);
+    } catch (error) {
+      strapi.log.error(`[permit-strapi] Failed to sync role for user ${key}: ${error.message}`);
+    }
+  },
+  /** Bulk syncs all existing UP users to Permit.io. */
+  async syncAllUsers() {
+    const permit = strapi.permit;
+    if (!permit) throw new Error("Permit.io client not initialized");
+    const allUsers = await strapi.db.query("plugin::users-permissions.user").findMany({ populate: ["role"] });
+    let synced = 0;
+    let failed = 0;
+    for (const user of allUsers) {
+      try {
+        await this.syncUserToPermit(user);
+        synced++;
+      } catch {
+        failed++;
+      }
+    }
+    debugLog(strapi, `[permit-strapi] Bulk user sync: ${synced} synced, ${failed} failed`);
+    return { synced, failed, total: allUsers.length };
+  },
+  async deletePermitUser(user) {
+    const permit = strapi.permit;
+    if (!permit) return;
+    const key = `strapi-${user.id}`;
+    try {
+      await permit.api.users.delete(key);
+      debugLog(strapi, `[permit-strapi] Deleted user: ${key}`);
+    } catch (error) {
+      strapi.log.warn(`[permit-strapi] Could not delete user ${key}: ${error.message}`);
+    }
+  }
+});
+const DEFAULT_TENANT = "default";
+const extractResourceKey = (uid) => uid.split("::")[1]?.split(".")[0] ?? uid;
+const instancesService = ({ strapi }) => ({
+  async createResourceInstance(uid, documentId) {
+    const permit = strapi.permit;
+    if (!permit) return;
+    const resourceKey = extractResourceKey(uid);
+    try {
+      await permit.api.resourceInstances.create({
+        resource: resourceKey,
+        key: documentId,
+        tenant: DEFAULT_TENANT
+      });
+      debugLog(strapi, `[permit-strapi] Created resource instance: ${resourceKey}:${documentId}`);
+    } catch (error) {
+      strapi.log.warn(`[permit-strapi] Could not create resource instance ${resourceKey}:${documentId}: ${error.message}`);
+    }
+  },
+  async deleteResourceInstance(uid, documentId) {
+    const permit = strapi.permit;
+    if (!permit) return;
+    const resourceKey = extractResourceKey(uid);
+    try {
+      await permit.api.resourceInstances.delete(`${resourceKey}:${documentId}`);
+      debugLog(strapi, `[permit-strapi] Deleted resource instance: ${resourceKey}:${documentId}`);
+    } catch (error) {
+      strapi.log.warn(`[permit-strapi] Could not delete resource instance ${resourceKey}:${documentId}: ${error.message}`);
+    }
+  },
+  /** Assigns an instance role to a user on a specific resource instance. */
+  async assignInstanceRole(userKey, role, uid, documentId) {
+    const permit = strapi.permit;
+    if (!permit) return;
+    const resourceKey = extractResourceKey(uid);
+    try {
+      await permit.api.roleAssignments.assign({
+        user: userKey,
+        role,
+        resource_instance: `${resourceKey}:${documentId}`,
+        tenant: DEFAULT_TENANT
+      });
+      debugLog(strapi, `[permit-strapi] Assigned role "${role}" to ${userKey} on ${resourceKey}:${documentId}`);
+    } catch (error) {
+      strapi.log.warn(`[permit-strapi] Could not assign instance role for ${userKey} on ${resourceKey}:${documentId}: ${error.message}`);
+    }
+  },
+  /** Bulk syncs all existing records for a content type as Permit.io resource instances. */
+  async syncAllInstances(uid) {
+    const permit = strapi.permit;
+    if (!permit) throw new Error("Permit.io client not initialized");
+    const resourceKey = extractResourceKey(uid);
+    const records = await strapi.db.query(uid).findMany({});
+    let synced = 0;
+    let failed = 0;
+    for (const record of records) {
+      if (!record.documentId) continue;
+      try {
+        await permit.api.resourceInstances.create({
+          resource: resourceKey,
+          key: record.documentId,
+          tenant: DEFAULT_TENANT
+        });
+        synced++;
+      } catch {
+        failed++;
+      }
+    }
+    debugLog(strapi, `[permit-strapi] Bulk instance sync for ${resourceKey}: ${synced} synced, ${failed} failed`);
+    return { synced, failed, total: records.length };
+  }
+});
+const services = {
+  service,
+  config: configService,
+  roles: rolesService,
+  users: usersService,
+  instances: instancesService
+};
+const index = {
+  register,
+  bootstrap,
+  destroy,
+  config,
+  controllers,
+  routes,
+  services,
+  contentTypes,
+  policies,
+  middlewares
+};
+export {
+  index as default
+};