@strapi/admin 4.20.4 → 5.0.0-alpha.0

package/dist/server/index.js

@@ -9,7 +9,6 @@ const koaStatic = require("koa-static");
 const dateFns = require("date-fns");
 const _$1 = require("lodash");
 const bcrypt = require("bcryptjs");
-const deepEqual = require("fast-deep-equal");
 const passport$1 = require("koa-passport");
 const passportLocal = require("passport-local");
 const crypto = require("crypto");
@@ -20,7 +19,6 @@ const permissions$1 = require("@strapi/permissions");
 const pmap = require("p-map");
 const assert = require("assert");
 const fs = require("fs");
-require("koa-bodyparser");
 const tsUtils = require("@strapi/typescript-utils");
 const compose = require("koa-compose");
 const dataTransfer$1 = require("@strapi/data-transfer");
@@ -31,7 +29,6 @@ const fse__default = /* @__PURE__ */ _interopDefault(fse);
 const koaStatic__default = /* @__PURE__ */ _interopDefault(koaStatic);
 const ___default = /* @__PURE__ */ _interopDefault(_$1);
 const bcrypt__default = /* @__PURE__ */ _interopDefault(bcrypt);
-const deepEqual__default = /* @__PURE__ */ _interopDefault(deepEqual);
 const passport__default = /* @__PURE__ */ _interopDefault(passport$1);
 const crypto__default = /* @__PURE__ */ _interopDefault(crypto);
 const jwt__default = /* @__PURE__ */ _interopDefault(jwt);
@@ -324,14 +321,13 @@ const syncAuthSettings = async () => {
 };
 const syncAPITokensPermissions = async () => {
   const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
-  const permissionsInDB = await utils$1.pipeAsync(
-    strapi.query("admin::api-token-permission").findMany,
-    // @ts-expect-error lodash types
+  const permissionsInDB = await utils$1.async.pipe(
+    strapi.db.query("admin::api-token-permission").findMany,
     fp.map("action")
   )();
   const unknownPermissions = fp.uniq(fp.difference(permissionsInDB, validPermissions));
   if (unknownPermissions.length > 0) {
-    await strapi.query("admin::api-token-permission").deleteMany({ where: { action: { $in: unknownPermissions } } });
+    await strapi.db.query("admin::api-token-permission").deleteMany({ where: { action: { $in: unknownPermissions } } });
   }
 };
 const bootstrap = async ({ strapi: strapi2 }) => {
@@ -351,7 +347,7 @@ const bootstrap = async ({ strapi: strapi2 }) => {
   await userService.displayWarningIfUsersDontHaveRole();
   await syncAuthSettings();
   await syncAPITokensPermissions();
-  getService("metrics").sendUpdateProjectInformation();
+  getService("metrics").sendUpdateProjectInformation(strapi2);
   getService("metrics").startCron(strapi2);
   apiTokenService.checkSaltIsDefined();
   transferService.token.checkSaltIsDefined();
@@ -423,7 +419,7 @@ const authenticate$2 = async (ctx) => {
   if (!isValid) {
     return { authenticated: false };
   }
-  const user2 = await strapi.query("admin::user").findOne({ where: { id: payload.id }, populate: ["roles"] });
+  const user2 = await strapi.db.query("admin::user").findOne({ where: { id: payload.id }, populate: ["roles"] });
   if (!user2 || !(user2.isActive === true)) {
     return { authenticated: false };
   }
@@ -512,7 +508,7 @@ const authenticate$1 = async (ctx) => {
   }
   const hoursSinceLastUsed = dateFns.differenceInHours(currentDate, dateFns.parseISO(apiToken2.lastUsedAt));
   if (hoursSinceLastUsed >= 1) {
-    await strapi.query("admin::api-token").update({
+    await strapi.db.query("admin::api-token").update({
       where: { id: apiToken2.id },
       data: { lastUsedAt: currentDate }
     });
@@ -565,9 +561,9 @@ const apiTokenAuthStrategy = {
 const register$1 = ({ strapi: strapi2 }) => {
   const passportMiddleware = strapi2.admin?.services.passport.init();
   strapi2.server.api("admin").use(passportMiddleware);
-  strapi2.container.get("auth").register("admin", adminAuthStrategy);
-  strapi2.container.get("auth").register("content-api", apiTokenAuthStrategy);
-  if (strapi2.config.serveAdminPanel) {
+  strapi2.get("auth").register("admin", adminAuthStrategy);
+  strapi2.get("auth").register("content-api", apiTokenAuthStrategy);
+  if (strapi2.config.get("admin.serveAdminPanel")) {
     registerAdminPanelRoute({ strapi: strapi2 });
   }
 };
@@ -1188,7 +1184,7 @@ const authenticate = async (ctx) => {
   }
   const hoursSinceLastUsed = dateFns.differenceInHours(currentDate, dateFns.parseISO(transferToken2.lastUsedAt));
   if (hoursSinceLastUsed >= 1) {
-    await strapi.query("admin::api-token").update({
+    await strapi.db.query("admin::api-token").update({
       where: { id: transferToken2.id },
       data: { lastUsedAt: currentDate }
     });
@@ -1343,7 +1339,7 @@ const { ApplicationError: ApplicationError$7 } = utils$1.errors;
 const hashPassword = (password2) => bcrypt__default.default.hash(password2, 10);
 const validatePassword = (password2, hash2) => bcrypt__default.default.compare(password2, hash2);
 const checkCredentials = async ({ email: email2, password: password2 }) => {
-  const user2 = await strapi.query("admin::user").findOne({ where: { email: email2 } });
+  const user2 = await strapi.db.query("admin::user").findOne({ where: { email: email2 } });
   if (!user2 || !user2.password) {
     return [null, false, { message: "Invalid credentials" }];
   }
@@ -1357,14 +1353,14 @@ const checkCredentials = async ({ email: email2, password: password2 }) => {
   return [null, user2];
 };
 const forgotPassword = async ({ email: email2 } = {}) => {
-  const user2 = await strapi.query("admin::user").findOne({ where: { email: email2, isActive: true } });
+  const user2 = await strapi.db.query("admin::user").findOne({ where: { email: email2, isActive: true } });
   if (!user2) {
     return;
   }
   const resetPasswordToken = getService("token").createToken();
   await getService("user").updateById(user2.id, { resetPasswordToken });
-  const url = `${utils$1.getAbsoluteAdminUrl(
-    strapi.config
+  const url = `${strapi.config.get(
+    "admin.absoluteUrl"
   )}/auth/reset-password?code=${resetPasswordToken}`;
   return strapi.plugin("email").service("email").sendTemplatedEmail(
     {
@@ -1382,7 +1378,7 @@ const forgotPassword = async ({ email: email2 } = {}) => {
   });
 };
 const resetPassword = async ({ resetPasswordToken, password: password2 } = {}) => {
-  const matchingUser = await strapi.query("admin::user").findOne({ where: { resetPasswordToken, isActive: true } });
+  const matchingUser = await strapi.db.query("admin::user").findOne({ where: { resetPasswordToken, isActive: true } });
   if (!matchingUser) {
     throw new ApplicationError$7();
   }
@@ -1629,7 +1625,7 @@ const create$5 = async (attributes) => {
     userInfo.password = await getService("auth").hashPassword(attributes.password);
   }
   const user2 = createUser(userInfo);
-  const createdUser = await strapi.query("admin::user").create({ data: user2, populate: ["roles"] });
+  const createdUser = await strapi.db.query("admin::user").create({ data: user2, populate: ["roles"] });
   getService("metrics").sendDidInviteUser();
   strapi.eventHub.emit("user.create", { user: sanitizeUser(createdUser) });
   return createdUser;
@@ -1638,7 +1634,7 @@ const updateById = async (id, attributes) => {
   if (___default.default.has(attributes, "roles")) {
     const lastAdminUser = await isLastSuperAdminUser(id);
     const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
-    const willRemoveSuperAdminRole = !utils$1.stringIncludes(attributes.roles, superAdminRole.id);
+    const willRemoveSuperAdminRole = !utils$1.arrays.includesString(attributes.roles, superAdminRole.id);
     if (lastAdminUser && willRemoveSuperAdminRole) {
       throw new ValidationError$4("You must have at least one user with super admin role.");
     }
@@ -1651,7 +1647,7 @@ const updateById = async (id, attributes) => {
   }
   if (___default.default.has(attributes, "password")) {
     const hashedPassword = await getService("auth").hashPassword(attributes.password);
-    const updatedUser2 = await strapi.query("admin::user").update({
+    const updatedUser2 = await strapi.db.query("admin::user").update({
       where: { id },
       data: {
         ...attributes,
@@ -1662,7 +1658,7 @@ const updateById = async (id, attributes) => {
     strapi.eventHub.emit("user.update", { user: sanitizeUser(updatedUser2) });
     return updatedUser2;
   }
-  const updatedUser = await strapi.query("admin::user").update({
+  const updatedUser = await strapi.db.query("admin::user").update({
     where: { id },
     data: attributes,
     populate: ["roles"]
@@ -1673,7 +1669,7 @@ const updateById = async (id, attributes) => {
   return updatedUser;
 };
 const resetPasswordByEmail = async (email2, password$1) => {
-  const user2 = await strapi.query("admin::user").findOne({ where: { email: email2 }, populate: ["roles"] });
+  const user2 = await strapi.db.query("admin::user").findOne({ where: { email: email2 }, populate: ["roles"] });
   if (!user2) {
     throw new Error(`User not found for email: ${email2}`);
   }
@@ -1694,10 +1690,10 @@ const isLastSuperAdminUser = async (userId) => {
   return superAdminRole.usersCount === 1 && hasSuperAdminRole$1(user2);
 };
 const exists$3 = async (attributes = {}) => {
-  return await strapi.query("admin::user").count({ where: attributes }) > 0;
+  return await strapi.db.query("admin::user").count({ where: attributes }) > 0;
 };
 const findRegistrationInfo = async (registrationToken) => {
-  const user2 = await strapi.query("admin::user").findOne({ where: { registrationToken } });
+  const user2 = await strapi.db.query("admin::user").findOne({ where: { registrationToken } });
   if (!user2) {
     return void 0;
   }
@@ -1707,7 +1703,7 @@ const register = async ({
   registrationToken,
   userInfo
 }) => {
-  const matchingUser = await strapi.query("admin::user").findOne({ where: { registrationToken } });
+  const matchingUser = await strapi.db.query("admin::user").findOne({ where: { registrationToken } });
   if (!matchingUser) {
     throw new ValidationError$4("Invalid registration info");
   }
@@ -1720,20 +1716,23 @@ const register = async ({
   });
 };
 const findOne$1 = async (id, populate = ["roles"]) => {
-  return strapi.entityService.findOne("admin::user", id, { populate });
+  return strapi.db.query("admin::user").findOne({ where: { id }, populate });
 };
 const findOneByEmail = async (email2, populate = []) => {
-  return strapi.query("admin::user").findOne({
+  return strapi.db.query("admin::user").findOne({
     where: { email: { $eqi: email2 } },
     populate
   });
 };
-const findPage = async (query = {}) => {
-  const enrichedQuery = fp.defaults({ populate: ["roles"] }, query);
-  return strapi.entityService.findPage("admin::user", enrichedQuery);
+const findPage = async (params = {}) => {
+  const query = utils$1.convertQueryParams.transformParamsToQuery(
+    "admin::user",
+    fp.defaults({ populate: ["roles"] }, params)
+  );
+  return strapi.db.query("admin::user").findPage(query);
 };
 const deleteById = async (id) => {
-  const userToDelete = await strapi.query("admin::user").findOne({
+  const userToDelete = await strapi.db.query("admin::user").findOne({
     where: { id },
     populate: ["roles"]
   });
@@ -1748,13 +1747,13 @@ const deleteById = async (id) => {
       }
     }
   }
-  const deletedUser = await strapi.query("admin::user").delete({ where: { id }, populate: ["roles"] });
+  const deletedUser = await strapi.db.query("admin::user").delete({ where: { id }, populate: ["roles"] });
   strapi.eventHub.emit("user.delete", { user: sanitizeUser(deletedUser) });
   return deletedUser;
 };
 const deleteByIds$2 = async (ids) => {
   const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
-  const nbOfSuperAdminToDelete = await strapi.query("admin::user").count({
+  const nbOfSuperAdminToDelete = await strapi.db.query("admin::user").count({
     where: {
       id: ids,
       roles: { id: superAdminRole.id }
@@ -1765,7 +1764,7 @@ const deleteByIds$2 = async (ids) => {
   }
   const deletedUsers = [];
   for (const id of ids) {
-    const deletedUser = await strapi.query("admin::user").delete({
+    const deletedUser = await strapi.db.query("admin::user").delete({
       where: { id },
       populate: ["roles"]
     });
@@ -1777,7 +1776,7 @@ const deleteByIds$2 = async (ids) => {
   return deletedUsers;
 };
 const countUsersWithoutRole = async () => {
-  return strapi.query("admin::user").count({
+  return strapi.db.query("admin::user").count({
     where: {
       roles: {
         id: { $null: true }
@@ -1786,10 +1785,10 @@ const countUsersWithoutRole = async () => {
   });
 };
 const count$1 = async (where = {}) => {
-  return strapi.query("admin::user").count({ where });
+  return strapi.db.query("admin::user").count({ where });
 };
 const assignARoleToAll = async (roleId) => {
-  const users2 = await strapi.query("admin::user").findMany({
+  const users2 = await strapi.db.query("admin::user").findMany({
     select: ["id"],
     where: {
       roles: { id: { $null: true } }
@@ -1797,7 +1796,7 @@ const assignARoleToAll = async (roleId) => {
   });
   await Promise.all(
     users2.map((user2) => {
-      return strapi.query("admin::user").update({
+      return strapi.db.query("admin::user").update({
         where: { id: user2.id },
         data: { roles: [roleId] }
       });
@@ -1811,7 +1810,7 @@ const displayWarningIfUsersDontHaveRole = async () => {
   }
 };
 const getLanguagesInUse = async () => {
-  const users2 = await strapi.query("admin::user").findMany({ select: ["preferedLanguage"] });
+  const users2 = await strapi.db.query("admin::user").findMany({ select: ["preferedLanguage"] });
   return users2.map((user2) => user2.preferedLanguage || "en");
 };
 const user$1 = {
@@ -1886,10 +1885,12 @@ const sanitizeConditions = fp.curry(
     );
   }
 );
-const toPermission = (payload) => (
-  // @ts-expect-error
-  fp.isArray(payload) ? fp.map(create$4, payload) : create$4(payload)
-);
+function toPermission(payload) {
+  if (fp.isArray(payload)) {
+    return fp.map((value) => create$4(value), payload);
+  }
+  return create$4(payload);
+}
 const permissionDomain = {
   addCondition,
   removeCondition,
@@ -1953,7 +1954,7 @@ const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
 const jsonClean = (data) => JSON.parse(JSON.stringify(data));
 const arePermissionsEqual = (p1, p2) => {
   if (p1.action === p2.action) {
-    return deepEqual__default.default(jsonClean(pickComparableFields(p1)), jsonClean(pickComparableFields(p2)));
+    return fp.isEqual(jsonClean(pickComparableFields(p1)), jsonClean(pickComparableFields(p2)));
   }
   return false;
 };
@@ -1964,33 +1965,30 @@ const create$3 = async (attributes) => {
       `The name must be unique and a role with name \`${attributes.name}\` already exists.`
     );
   }
-  const autoGeneratedCode = `${___default.default.kebabCase(attributes.name)}-${utils$1.generateTimestampCode()}`;
+  const autoGeneratedCode = `${___default.default.kebabCase(attributes.name)}-${utils$1.dates.timestampCode()}`;
   const rolesWithCode = {
     ...attributes,
     code: attributes.code || autoGeneratedCode
   };
-  const result = await strapi.query("admin::role").create({ data: rolesWithCode });
+  const result = await strapi.db.query("admin::role").create({ data: rolesWithCode });
   strapi.eventHub.emit("role.create", { role: sanitizeRole(result) });
   return result;
 };
 const findOne = (params = {}, populate) => {
-  return strapi.query("admin::role").findOne({ where: params, populate });
+  return strapi.db.query("admin::role").findOne({ where: params, populate });
 };
 const findOneWithUsersCount = async (params = {}, populate) => {
-  const role2 = await strapi.query("admin::role").findOne({ where: params, populate });
+  const role2 = await strapi.db.query("admin::role").findOne({ where: params, populate });
   if (role2) {
     role2.usersCount = await getUsersCount(role2.id);
   }
   return role2;
 };
 const find = (params = {}, populate) => {
-  return strapi.query("admin::role").findMany({ where: params, populate });
+  return strapi.db.query("admin::role").findMany({ where: params, populate });
 };
 const findAllWithUsersCount = async (params) => {
-  const roles2 = await strapi.entityService.findMany(
-    "admin::role",
-    params
-  );
+  const roles2 = await strapi.db.query("admin::role").findMany(utils$1.convertQueryParams.transformParamsToQuery("admin::role", params));
   for (const role2 of roles2) {
     role2.usersCount = await getUsersCount(role2.id);
   }
@@ -2009,20 +2007,20 @@ const update$3 = async (params, attributes) => {
       );
     }
   }
-  const result = await strapi.query("admin::role").update({ where: params, data: sanitizedAttributes });
+  const result = await strapi.db.query("admin::role").update({ where: params, data: sanitizedAttributes });
   strapi.eventHub.emit("role.update", { role: sanitizeRole(result) });
   return result;
 };
 const exists$2 = async (params = {}) => {
-  const count2 = await strapi.query("admin::role").count({ where: params });
+  const count2 = await strapi.db.query("admin::role").count({ where: params });
   return count2 > 0;
 };
 const count = async (params = {}) => {
-  return strapi.query("admin::role").count(params);
+  return strapi.db.query("admin::role").count(params);
 };
 const checkRolesIdForDeletion = async (ids = []) => {
   const superAdminRole = await getSuperAdmin();
-  if (superAdminRole && utils$1.stringIncludes(ids, superAdminRole.id)) {
+  if (superAdminRole && utils$1.arrays.includesString(ids, superAdminRole.id)) {
     throw new ApplicationError$6("You cannot delete the super admin role");
   }
   for (const roleId of ids) {
@@ -2037,7 +2035,7 @@ const deleteByIds$1 = async (ids = []) => {
   await getService("permission").deleteByRolesIds(ids);
   const deletedRoles = [];
   for (const id of ids) {
-    const deletedRole = await strapi.query("admin::role").delete({ where: { id } });
+    const deletedRole = await strapi.db.query("admin::role").delete({ where: { id } });
     if (deletedRole) {
       strapi.eventHub.emit("role.delete", { role: deletedRole });
       deletedRoles.push(deletedRole);
@@ -2046,7 +2044,7 @@ const deleteByIds$1 = async (ids = []) => {
   return deletedRoles;
 };
 const getUsersCount = async (roleId) => {
-  return strapi.query("admin::user").count({ where: { roles: { id: roleId } } });
+  return strapi.db.query("admin::user").count({ where: { roles: { id: roleId } } });
 };
 const getSuperAdmin = () => findOne({ code: SUPER_ADMIN_CODE$1 });
 const getSuperAdminWithUsersCount = () => findOneWithUsersCount({ code: SUPER_ADMIN_CODE$1 });
@@ -2278,7 +2276,7 @@ const decodeJwtToken = (token2) => {
   }
 };
 const checkSecretIsDefined = () => {
-  if (strapi.config.serveAdminPanel && !strapi.config.get("admin.auth.secret")) {
+  if (strapi.config.get("admin.serveAdminPanel") && !strapi.config.get("admin.auth.secret")) {
     throw new Error(
       `Missing auth.secret. Please set auth.secret in config/admin.js (ex: you can generate one using Node with \`crypto.randomBytes(16).toString('base64')\`).
 For security reasons, prefer storing the secret in an environment variable and read it in config/admin.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`
@@ -2441,7 +2439,7 @@ const createConditionProvider = () => {
   };
 };
 const {
-  visitors: { removePassword }
+  visitors: { removePassword, expandWildcardPopulate }
 } = utils$1.sanitize;
 const {
   constants: constants$1,
@@ -2452,6 +2450,7 @@ const {
 } = utils$1.contentTypes;
 const {
   ID_ATTRIBUTE: ID_ATTRIBUTE$1,
+  DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$1,
   CREATED_AT_ATTRIBUTE: CREATED_AT_ATTRIBUTE$1,
   UPDATED_AT_ATTRIBUTE: UPDATED_AT_ATTRIBUTE$1,
   PUBLISHED_AT_ATTRIBUTE: PUBLISHED_AT_ATTRIBUTE$1,
@@ -2459,14 +2458,14 @@ const {
   UPDATED_BY_ATTRIBUTE: UPDATED_BY_ATTRIBUTE$1
 } = constants$1;
 const COMPONENT_FIELDS$1 = ["__component"];
-const STATIC_FIELDS$1 = [ID_ATTRIBUTE$1];
+const STATIC_FIELDS$1 = [ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE$1];
 const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) => {
   const schema = strapi.getModel(model);
   const { removeDisallowedFields } = utils$1.sanitize.visitors;
   const createSanitizeQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
-    const sanitizeFilters = utils$1.pipeAsync(
+    const sanitizeFilters = utils$1.async.pipe(
       utils$1.traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQueryFilters(omitDisallowedAdminUserFields, { schema }),
       utils$1.traverse.traverseQueryFilters(omitHiddenFields, { schema }),
@@ -2480,7 +2479,7 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
         { schema }
       )
     );
-    const sanitizeSort = utils$1.pipeAsync(
+    const sanitizeSort = utils$1.async.pipe(
       utils$1.traverse.traverseQuerySort(removeDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQuerySort(omitDisallowedAdminUserFields, { schema }),
       utils$1.traverse.traverseQuerySort(omitHiddenFields, { schema }),
@@ -2494,13 +2493,14 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
         { schema }
       )
     );
-    const sanitizePopulate = utils$1.pipeAsync(
+    const sanitizePopulate = utils$1.async.pipe(
+      utils$1.traverse.traverseQueryPopulate(expandWildcardPopulate, { schema }),
       utils$1.traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, { schema }),
       utils$1.traverse.traverseQueryPopulate(omitHiddenFields, { schema }),
       utils$1.traverse.traverseQueryPopulate(removePassword, { schema })
     );
-    const sanitizeFields = utils$1.pipeAsync(
+    const sanitizeFields = utils$1.async.pipe(
       utils$1.traverse.traverseQueryFields(removeDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQueryFields(omitHiddenFields, { schema }),
       utils$1.traverse.traverseQueryFields(removePassword, { schema })
@@ -2525,11 +2525,10 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
   const createSanitizeOutput = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getOutputFields(fields.permitted);
-    return utils$1.pipeAsync(
+    return utils$1.async.pipe(
       // Remove fields hidden from the admin
       utils$1.traverseEntity(omitHiddenFields, { schema }),
       // Remove unallowed fields from admin::user relations
-      // @ts-expect-error lodash types
       utils$1.traverseEntity(pickAllowedAdminUserFields, { schema }),
       // Remove not allowed fields (RBAC)
       utils$1.traverseEntity(removeDisallowedFields(permittedFields), { schema }),
@@ -2540,11 +2539,10 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
   const createSanitizeInput = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);
-    return utils$1.pipeAsync(
+    return utils$1.async.pipe(
       // Remove fields hidden from the admin
       utils$1.traverseEntity(omitHiddenFields, { schema }),
       // Remove not allowed fields (RBAC)
-      // @ts-expect-error lodash types
       utils$1.traverseEntity(removeDisallowedFields(permittedFields), { schema }),
       // Remove roles from createdBy & updateBy fields
       omitCreatorRoles
@@ -2648,6 +2646,7 @@ const { throwPassword, throwDisallowedFields } = utils$1.validate.visitors;
 const { constants, isScalarAttribute, getNonVisibleAttributes, getWritableAttributes } = utils$1.contentTypes;
 const {
   ID_ATTRIBUTE,
+  DOC_ID_ATTRIBUTE,
   CREATED_AT_ATTRIBUTE,
   UPDATED_AT_ATTRIBUTE,
   PUBLISHED_AT_ATTRIBUTE,
@@ -2655,45 +2654,52 @@ const {
   UPDATED_BY_ATTRIBUTE
 } = constants;
 const COMPONENT_FIELDS = ["__component"];
-const STATIC_FIELDS = [ID_ATTRIBUTE];
-const throwInvalidParam = ({ key }) => {
-  throw new ValidationError$3(`Invalid parameter ${key}`);
+const STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];
+const throwInvalidParam = ({ key, path: path2 }) => {
+  const msg = path2 && path2 !== key ? `Invalid parameter ${key} at ${path2}` : `Invalid parameter ${key}`;
+  throw new ValidationError$3(msg);
 };
 const createValidateHelpers = ({ action: action2, ability: ability$1, model }) => {
   const schema = strapi.getModel(model);
   const createValidateQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
-    const validateFilters = utils$1.pipeAsync(
+    const validateFilters = utils$1.async.pipe(
       utils$1.traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQueryFilters(throwDisallowedAdminUserFields, { schema }),
       utils$1.traverse.traverseQueryFilters(throwPassword, { schema }),
       utils$1.traverse.traverseQueryFilters(
-        ({ key, value }) => {
+        ({ key, value, path: path2 }) => {
           if (fp.isObject(value) && fp.isEmpty(value)) {
-            throwInvalidParam({ key });
+            throwInvalidParam({ key, path: path2.attribute });
           }
         },
         { schema }
       )
     );
-    const validateSort = utils$1.pipeAsync(
+    const validateSort = utils$1.async.pipe(
       utils$1.traverse.traverseQuerySort(throwDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQuerySort(throwDisallowedAdminUserFields, { schema }),
       utils$1.traverse.traverseQuerySort(throwPassword, { schema }),
       utils$1.traverse.traverseQuerySort(
-        ({ key, attribute, value }) => {
+        ({ key, attribute, value, path: path2 }) => {
           if (!isScalarAttribute(attribute) && fp.isEmpty(value)) {
-            throwInvalidParam({ key });
+            throwInvalidParam({ key, path: path2.attribute });
           }
         },
         { schema }
       )
     );
-    const validateFields = utils$1.pipeAsync(
+    const validateFields = utils$1.async.pipe(
       utils$1.traverse.traverseQueryFields(throwDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQueryFields(throwPassword, { schema })
     );
+    const validatePopulate = utils$1.async.pipe(
+      utils$1.traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), { schema }),
+      utils$1.traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, { schema }),
+      utils$1.traverse.traverseQueryPopulate(throwHiddenFields, { schema }),
+      utils$1.traverse.traverseQueryPopulate(throwPassword, { schema })
+    );
     return async (query) => {
       if (query.filters) {
         await validateFilters(query.filters);
@@ -2704,17 +2710,19 @@ const createValidateHelpers = ({ action: action2, ability: ability$1, model }) =
       if (query.fields) {
         await validateFields(query.fields);
       }
+      if (query.populate && query.populate !== "*") {
+        await validatePopulate(query.populate);
+      }
       return true;
     };
   };
   const createValidateInput = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);
-    return utils$1.pipeAsync(
+    return utils$1.async.pipe(
       // Remove fields hidden from the admin
       utils$1.traverseEntity(throwHiddenFields, { schema }),
       // Remove not allowed fields (RBAC)
-      // @ts-expect-error lodash types
       utils$1.traverseEntity(throwDisallowedFields(permittedFields), { schema }),
       // Remove roles from createdBy & updatedBy fields
       omitCreatorRoles
@@ -2751,15 +2759,15 @@ const createValidateHelpers = ({ action: action2, ability: ability$1, model }) =
     return fp.defaults({ subject: ability.subject(model, data), action: action2 }, options);
   };
   const omitCreatorRoles = fp.omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);
-  const throwHiddenFields = ({ key, schema: schema2 }) => {
+  const throwHiddenFields = ({ key, schema: schema2, path: path2 }) => {
     const isHidden = fp.getOr(false, ["config", "attributes", key, "hidden"], schema2);
     if (isHidden) {
-      throwInvalidParam({ key });
+      throwInvalidParam({ key, path: path2.attribute });
     }
   };
-  const throwDisallowedAdminUserFields = ({ key, attribute, schema: schema2 }) => {
+  const throwDisallowedAdminUserFields = ({ key, attribute, schema: schema2, path: path2 }) => {
     if (schema2.uid === "admin::user" && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {
-      throwInvalidParam({ key });
+      throwInvalidParam({ key, path: path2.attribute });
     }
   };
   const getInputFields = (fields = []) => {
@@ -3130,7 +3138,7 @@ const createDefaultSectionBuilder = () => {
   return builder;
 };
 const deleteByRolesIds = async (rolesIds) => {
-  const permissionsToDelete = await strapi.query("admin::permission").findMany({
+  const permissionsToDelete = await strapi.db.query("admin::permission").findMany({
     select: ["id"],
     where: {
       role: { id: rolesIds }
@@ -3143,7 +3151,7 @@ const deleteByRolesIds = async (rolesIds) => {
 const deleteByIds = async (ids) => {
   const result = [];
   for (const id of ids) {
-    const queryResult = await strapi.query("admin::permission").delete({ where: { id } });
+    const queryResult = await strapi.db.query("admin::permission").delete({ where: { id } });
     result.push(queryResult);
   }
   strapi.eventHub.emit("permission.delete", { permissions: result });
@@ -3151,7 +3159,7 @@ const deleteByIds = async (ids) => {
 const createMany = async (permissions2) => {
   const createdPermissions = [];
   for (const permission2 of permissions2) {
-    const newPerm = await strapi.query("admin::permission").create({ data: permission2 });
+    const newPerm = await strapi.db.query("admin::permission").create({ data: permission2 });
     createdPermissions.push(newPerm);
   }
   const permissionsToReturn = permissionDomain.toPermission(createdPermissions);
@@ -3159,13 +3167,13 @@ const createMany = async (permissions2) => {
   return permissionsToReturn;
 };
 const update$2 = async (params, attributes) => {
-  const updatedPermission = await strapi.query("admin::permission").update({ where: params, data: attributes });
+  const updatedPermission = await strapi.db.query("admin::permission").update({ where: params, data: attributes });
   const permissionToReturn = permissionDomain.toPermission(updatedPermission);
   strapi.eventHub.emit("permission.update", { permissions: permissionToReturn });
   return permissionToReturn;
 };
 const findMany = async (params = {}) => {
-  const rawPermissions = await strapi.query("admin::permission").findMany(params);
+  const rawPermissions = await strapi.db.query("admin::permission").findMany(params);
   return permissionDomain.toPermission(rawPermissions);
 };
 const findUserPermissions = async (user2) => {
@@ -3199,10 +3207,10 @@ const filterPermissionsToRemove = async (permissions2) => {
 const cleanPermissionsInDatabase = async () => {
   const pageSize = 200;
   const contentTypeService = getService("content-type");
-  const total = await strapi.query("admin::permission").count();
+  const total = await strapi.db.query("admin::permission").count();
   const pageCount = Math.ceil(total / pageSize);
   for (let page = 0; page < pageCount; page += 1) {
-    const results = await strapi.query("admin::permission").findMany({ limit: pageSize, offset: page * pageSize });
+    const results = await strapi.db.query("admin::permission").findMany({ limit: pageSize, offset: page * pageSize });
     const permissions2 = permissionDomain.toPermission(results);
     const permissionsToRemove = await filterPermissionsToRemove(permissions2);
     const permissionsIdToRemove = fp.map(fp.prop("id"), permissionsToRemove);
@@ -3267,16 +3275,16 @@ const sendDidChangeInterfaceLanguage = async () => {
   const languagesInUse = await getService("user").getLanguagesInUse();
   strapi.telemetry.send("didChangeInterfaceLanguage", { userProperties: { languagesInUse } });
 };
-const sendUpdateProjectInformation = async () => {
+const sendUpdateProjectInformation = async (strapi2) => {
   const numberOfActiveAdminUsers = await getService("user").count({ isActive: true });
   const numberOfAdminUsers = await getService("user").count();
-  strapi.telemetry.send("didUpdateProjectInformation", {
+  strapi2.telemetry.send("didUpdateProjectInformation", {
     groupProperties: { numberOfActiveAdminUsers, numberOfAdminUsers }
   });
 };
 const startCron = (strapi2) => {
   strapi2.cron.add({
-    "0 0 0 * * *": () => sendUpdateProjectInformation()
+    "0 0 0 * * *": () => sendUpdateProjectInformation(strapi2)
   });
 };
 const metrics = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -3481,7 +3489,7 @@ const isValidLifespan$1 = (lifespan) => {
 const assertValidLifespan$1 = (lifespan) => {
   if (!isValidLifespan$1(lifespan)) {
     throw new ValidationError$2(
-      `lifespan must be one of the following values: 
+      `lifespan must be one of the following values:
       ${Object.values(constants$3.API_TOKEN_LIFESPANS).join(", ")}`
     );
   }
@@ -3499,7 +3507,7 @@ const getBy$1 = async (whereParams = {}) => {
   if (Object.keys(whereParams).length === 0) {
     return null;
   }
-  const token2 = await strapi.query("admin::api-token").findOne({ select: SELECT_FIELDS$1, populate: POPULATE_FIELDS$1, where: whereParams });
+  const token2 = await strapi.db.query("admin::api-token").findOne({ select: SELECT_FIELDS$1, populate: POPULATE_FIELDS$1, where: whereParams });
   if (!token2) {
     return token2;
   }
@@ -3526,7 +3534,7 @@ const create$1 = async (attributes) => {
   const accessKey = crypto__default.default.randomBytes(128).toString("hex");
   assertCustomTokenPermissionsValidity(attributes.type, attributes.permissions);
   assertValidLifespan$1(attributes.lifespan);
-  const apiToken2 = await strapi.query("admin::api-token").create({
+  const apiToken2 = await strapi.db.query("admin::api-token").create({
     select: SELECT_FIELDS$1,
     populate: POPULATE_FIELDS$1,
     data: {
@@ -3539,16 +3547,12 @@ const create$1 = async (attributes) => {
   if (attributes.type === constants$3.API_TOKEN_TYPE.CUSTOM) {
     await Promise.all(
       fp.uniq(attributes.permissions).map(
-        (action2) => strapi.query("admin::api-token-permission").create({
+        (action2) => strapi.db.query("admin::api-token-permission").create({
           data: { action: action2, token: apiToken2 }
         })
       )
     );
-    const currentPermissions = await strapi.entityService.load(
-      "admin::api-token",
-      apiToken2,
-      "permissions"
-    );
+    const currentPermissions = await strapi.db.query("admin::api-token").load(apiToken2, "permissions");
     if (currentPermissions) {
       Object.assign(result, { permissions: fp.map("action", currentPermissions) });
     }
@@ -3557,7 +3561,7 @@ const create$1 = async (attributes) => {
 };
 const regenerate$1 = async (id) => {
   const accessKey = crypto__default.default.randomBytes(128).toString("hex");
-  const apiToken2 = await strapi.query("admin::api-token").update({
+  const apiToken2 = await strapi.db.query("admin::api-token").update({
     select: ["id", "accessKey"],
     where: { id },
     data: {
@@ -3587,7 +3591,7 @@ For security reasons, prefer storing the secret in an environment variable and r
   }
 };
 const list$1 = async () => {
-  const tokens = await strapi.query("admin::api-token").findMany({
+  const tokens = await strapi.db.query("admin::api-token").findMany({
     select: SELECT_FIELDS$1,
     populate: POPULATE_FIELDS$1,
     orderBy: { name: "ASC" }
@@ -3598,7 +3602,7 @@ const list$1 = async () => {
   return tokens.map((token2) => flattenTokenPermissions$1(token2));
 };
 const revoke$1 = async (id) => {
-  return strapi.query("admin::api-token").delete({ select: SELECT_FIELDS$1, populate: POPULATE_FIELDS$1, where: { id } });
+  return strapi.db.query("admin::api-token").delete({ select: SELECT_FIELDS$1, populate: POPULATE_FIELDS$1, where: { id } });
 };
 const getById$1 = async (id) => {
   return getBy$1({ id });
@@ -3607,7 +3611,7 @@ const getByName$1 = async (name2) => {
   return getBy$1({ name: name2 });
 };
 const update$1 = async (id, attributes) => {
-  const originalToken = await strapi.query("admin::api-token").findOne({ where: { id } });
+  const originalToken = await strapi.db.query("admin::api-token").findOne({ where: { id } });
   if (!originalToken) {
     throw new NotFoundError$1("Token not found");
   }
@@ -3619,45 +3623,37 @@ const update$1 = async (id, attributes) => {
     );
   }
   assertValidLifespan$1(attributes.lifespan);
-  const updatedToken = await strapi.query("admin::api-token").update({
+  const updatedToken = await strapi.db.query("admin::api-token").update({
     select: SELECT_FIELDS$1,
     where: { id },
     data: fp.omit("permissions", attributes)
   });
   if (updatedToken.type === constants$3.API_TOKEN_TYPE.CUSTOM && attributes.permissions) {
-    const currentPermissionsResult = await strapi.entityService.load(
-      "admin::api-token",
-      updatedToken,
-      "permissions"
-    );
+    const currentPermissionsResult = await strapi.db.query("admin::api-token").load(updatedToken, "permissions");
     const currentPermissions = fp.map("action", currentPermissionsResult || []);
     const newPermissions = fp.uniq(attributes.permissions);
     const actionsToDelete = fp.difference(currentPermissions, newPermissions);
     const actionsToAdd = fp.difference(newPermissions, currentPermissions);
     await Promise.all(
       actionsToDelete.map(
-        (action2) => strapi.query("admin::api-token-permission").delete({
+        (action2) => strapi.db.query("admin::api-token-permission").delete({
           where: { action: action2, token: id }
         })
       )
     );
     await Promise.all(
       actionsToAdd.map(
-        (action2) => strapi.query("admin::api-token-permission").create({
+        (action2) => strapi.db.query("admin::api-token-permission").create({
           data: { action: action2, token: id }
         })
       )
     );
   } else if (updatedToken.type !== constants$3.API_TOKEN_TYPE.CUSTOM) {
-    await strapi.query("admin::api-token-permission").delete({
+    await strapi.db.query("admin::api-token-permission").delete({
       where: { token: id }
     });
   }
-  const permissionsFromDb = await strapi.entityService.load(
-    "admin::api-token",
-    updatedToken,
-    "permissions"
-  );
+  const permissionsFromDb = await strapi.db.query("admin::api-token").load(updatedToken, "permissions");
   return {
     ...updatedToken,
     permissions: permissionsFromDb ? permissionsFromDb.map((p) => p.action) : void 0
@@ -3706,7 +3702,7 @@ const SELECT_FIELDS = [
 ];
 const POPULATE_FIELDS = ["permissions"];
 const list = async () => {
-  const tokens = await strapi.query(TRANSFER_TOKEN_UID).findMany({
+  const tokens = await strapi.db.query(TRANSFER_TOKEN_UID).findMany({
     select: SELECT_FIELDS,
     populate: POPULATE_FIELDS,
     orderBy: { name: "ASC" }
@@ -3730,7 +3726,7 @@ const create = async (attributes) => {
   assertTokenPermissionsValidity(attributes);
   assertValidLifespan(attributes.lifespan);
   const result = await strapi.db.transaction(async () => {
-    const transferToken2 = await strapi.query(TRANSFER_TOKEN_UID).create({
+    const transferToken2 = await strapi.db.query(TRANSFER_TOKEN_UID).create({
       select: SELECT_FIELDS,
       populate: POPULATE_FIELDS,
       data: {
@@ -3741,14 +3737,10 @@ const create = async (attributes) => {
     });
     await Promise.all(
       fp.uniq(attributes.permissions).map(
-        (action2) => strapi.query(TRANSFER_TOKEN_PERMISSION_UID).create({ data: { action: action2, token: transferToken2 } })
+        (action2) => strapi.db.query(TRANSFER_TOKEN_PERMISSION_UID).create({ data: { action: action2, token: transferToken2 } })
       )
     );
-    const currentPermissions = await strapi.entityService.load(
-      TRANSFER_TOKEN_UID,
-      transferToken2,
-      "permissions"
-    );
+    const currentPermissions = await strapi.db.query(TRANSFER_TOKEN_UID).load(transferToken2, "permissions");
     if (currentPermissions) {
       Object.assign(transferToken2, { permissions: fp.map("action", currentPermissions) });
     }
@@ -3757,14 +3749,14 @@ const create = async (attributes) => {
   return { ...result, accessKey };
 };
 const update = async (id, attributes) => {
-  const originalToken = await strapi.query(TRANSFER_TOKEN_UID).findOne({ where: { id } });
+  const originalToken = await strapi.db.query(TRANSFER_TOKEN_UID).findOne({ where: { id } });
   if (!originalToken) {
     throw new NotFoundError("Token not found");
   }
   assertTokenPermissionsValidity(attributes);
   assertValidLifespan(attributes.lifespan);
   return strapi.db.transaction(async () => {
-    const updatedToken = await strapi.query(TRANSFER_TOKEN_UID).update({
+    const updatedToken = await strapi.db.query(TRANSFER_TOKEN_UID).update({
       select: SELECT_FIELDS,
       where: { id },
       data: {
@@ -3772,35 +3764,27 @@ const update = async (id, attributes) => {
       }
     });
     if (attributes.permissions) {
-      const currentPermissionsResult = await strapi.entityService.load(
-        TRANSFER_TOKEN_UID,
-        updatedToken,
-        "permissions"
-      );
+      const currentPermissionsResult = await strapi.db.query(TRANSFER_TOKEN_UID).load(updatedToken, "permissions");
       const currentPermissions = fp.map("action", currentPermissionsResult || []);
       const newPermissions = fp.uniq(attributes.permissions);
       const actionsToDelete = fp.difference(currentPermissions, newPermissions);
       const actionsToAdd = fp.difference(newPermissions, currentPermissions);
       await Promise.all(
         actionsToDelete.map(
-          (action2) => strapi.query(TRANSFER_TOKEN_PERMISSION_UID).delete({
+          (action2) => strapi.db.query(TRANSFER_TOKEN_PERMISSION_UID).delete({
             where: { action: action2, token: id }
           })
         )
       );
       await Promise.all(
         actionsToAdd.map(
-          (action2) => strapi.query(TRANSFER_TOKEN_PERMISSION_UID).create({
+          (action2) => strapi.db.query(TRANSFER_TOKEN_PERMISSION_UID).create({
             data: { action: action2, token: id }
           })
         )
       );
     }
-    const permissionsFromDb = await strapi.entityService.load(
-      TRANSFER_TOKEN_UID,
-      updatedToken,
-      "permissions"
-    );
+    const permissionsFromDb = await strapi.db.query(TRANSFER_TOKEN_UID).load(updatedToken, "permissions");
     return {
       ...updatedToken,
       permissions: permissionsFromDb ? permissionsFromDb.map((p) => p.action) : void 0
@@ -3809,14 +3793,14 @@ const update = async (id, attributes) => {
 };
 const revoke = async (id) => {
   return strapi.db.transaction(
-    async () => strapi.query(TRANSFER_TOKEN_UID).delete({ select: SELECT_FIELDS, populate: POPULATE_FIELDS, where: { id } })
+    async () => strapi.db.query(TRANSFER_TOKEN_UID).delete({ select: SELECT_FIELDS, populate: POPULATE_FIELDS, where: { id } })
   );
 };
 const getBy = async (whereParams = {}) => {
   if (Object.keys(whereParams).length === 0) {
     return null;
   }
-  const token2 = await strapi.query(TRANSFER_TOKEN_UID).findOne({ select: SELECT_FIELDS, populate: POPULATE_FIELDS, where: whereParams });
+  const token2 = await strapi.db.query(TRANSFER_TOKEN_UID).findOne({ select: SELECT_FIELDS, populate: POPULATE_FIELDS, where: whereParams });
   if (!token2) {
     return token2;
   }
@@ -3835,7 +3819,7 @@ const exists = async (whereParams = {}) => {
 const regenerate = async (id) => {
   const accessKey = crypto__default.default.randomBytes(128).toString("hex");
   const transferToken2 = await strapi.db.transaction(
-    async () => strapi.query(TRANSFER_TOKEN_UID).update({
+    async () => strapi.db.query(TRANSFER_TOKEN_UID).update({
       select: ["id", "accessKey"],
       where: { id },
       data: {
@@ -3869,8 +3853,8 @@ const hash = (accessKey) => {
   return crypto__default.default.createHmac("sha512", strapi.config.get("admin.transfer.token.salt")).update(accessKey).digest("hex");
 };
 const checkSaltIsDefined = () => {
-  const { hasValidTokenSalt: hasValidTokenSalt2, isDisabledFromEnv: isDisabledFromEnv2 } = getService("transfer").utils;
-  if (isDisabledFromEnv2()) {
+  const { hasValidTokenSalt: hasValidTokenSalt2 } = getService("transfer").utils;
+  if (!strapi.config.get("server.transfer.remote.enabled")) {
     return;
   }
   if (!hasValidTokenSalt2()) {
@@ -3910,7 +3894,7 @@ const isValidLifespan = (lifespan) => {
 const assertValidLifespan = (lifespan) => {
   if (!isValidLifespan(lifespan)) {
     throw new ValidationError$1(
-      `lifespan must be one of the following values: 
+      `lifespan must be one of the following values:
       ${Object.values(constants$3.TRANSFER_TOKEN_LIFESPANS).join(", ")}`
     );
   }
@@ -3930,22 +3914,23 @@ const token$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePrope
   revoke,
   update
 }, Symbol.toStringTag, { value: "Module" }));
-const isDisabledFromEnv = () => {
-  return utils$1.env.bool("STRAPI_DISABLE_REMOTE_DATA_TRANSFER", false);
-};
 const hasValidTokenSalt = () => {
   const salt = strapi.config.get("admin.transfer.token.salt", null);
   return typeof salt === "string" && salt.length > 0;
 };
-const isDataTransferEnabled = () => {
+const isRemoteTransferEnabled = () => {
   const { utils: utils2 } = getService("transfer");
-  return !utils2.isDisabledFromEnv() && utils2.hasValidTokenSalt();
+  if (utils$1.env.bool("STRAPI_DISABLE_REMOTE_DATA_TRANSFER") !== void 0) {
+    strapi.log.warn(
+      "STRAPI_DISABLE_REMOTE_DATA_TRANSFER is no longer supported. Instead, set transfer.remote.enabled to false in your server configuration"
+    );
+  }
+  return utils2.hasValidTokenSalt() && strapi.config.get("server.transfer.remote.enabled");
 };
 const utils = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
   hasValidTokenSalt,
-  isDataTransferEnabled,
-  isDisabledFromEnv
+  isRemoteTransferEnabled
 }, Symbol.toStringTag, { value: "Module" }));
 const transfer$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
@@ -3977,7 +3962,7 @@ const parseFilesData = async (files) => {
         tmpPath: file.path,
         // TODO
         // @ts-expect-error define the correct return type
-        provider: strapi.config.get("plugin.upload").provider
+        provider: strapi.config.get("plugin::upload").provider
       });
     })
   );
@@ -4026,7 +4011,7 @@ const deleteOldFiles = async ({ previousSettings, newSettings }) => {
       if (newSettings[inputName] && previousSettings[inputName].hash === newSettings[inputName].hash) {
         return;
       }
-      if (strapi.config.get("plugin.upload").provider !== previousSettings[inputName].provider) {
+      if (strapi.config.get("plugin::upload").provider !== previousSettings[inputName].provider) {
         return;
       }
       strapi.plugin("upload").provider.delete(previousSettings[inputName]);
@@ -4318,7 +4303,7 @@ const apiToken$1 = {
     }
     if (fp.has("name", attributes)) {
       const nameAlreadyTaken = await apiTokenService.getByName(attributes.name);
-      if (!!nameAlreadyTaken && !utils$1.stringEquals(nameAlreadyTaken.id, id)) {
+      if (!!nameAlreadyTaken && !utils$1.strings.isEqual(nameAlreadyTaken.id, id)) {
         throw new ApplicationError$4("Name already taken");
       }
     }
@@ -4849,7 +4834,7 @@ const token = {
     }
     if (fp.has("name", attributes)) {
       const nameAlreadyTaken = await tokenService.getByName(attributes.name);
-      if (!!nameAlreadyTaken && !utils$1.stringEquals(nameAlreadyTaken.id, id)) {
+      if (!!nameAlreadyTaken && !utils$1.strings.isEqual(nameAlreadyTaken.id, id)) {
         throw new ApplicationError$1("Name already taken");
       }
     }
@@ -5529,7 +5514,8 @@ const rateLimit = (config, { strapi: strapi2 }) => async (ctx, next) => {
   }
   if (rateLimitConfig.enabled === true) {
     const rateLimit2 = require("koa2-ratelimit").RateLimit;
-    const userEmail = fp.toLower(ctx.request.body.email) || "unknownEmail";
+    const requestEmail = fp.get("request.body.email")(ctx);
+    const userEmail = fp.isString(requestEmail) ? requestEmail.toLowerCase() : "unknownEmail";
     const requestPath = fp.isString(ctx.request.path) ? fp.toLower(path__default.default.normalize(ctx.request.path)).replace(/\/$/, "") : "invalidPath";
     const loadConfig = {
       interval: { min: 5 },
@@ -5547,22 +5533,21 @@ const rateLimit = (config, { strapi: strapi2 }) => async (ctx, next) => {
 };
 const dataTransfer = () => async (ctx, next) => {
   const transferUtils = getService("transfer").utils;
-  const { hasValidTokenSalt: hasValidTokenSalt2, isDataTransferEnabled: isDataTransferEnabled2, isDisabledFromEnv: isDisabledFromEnv2 } = transferUtils;
-  if (isDataTransferEnabled2()) {
+  const { hasValidTokenSalt: hasValidTokenSalt2, isRemoteTransferEnabled: isRemoteTransferEnabled2 } = transferUtils;
+  if (isRemoteTransferEnabled2()) {
     return next();
   }
+  if (strapi.config.get("server.transfer.remote.enabled") === false) {
+    return ctx.notFound();
+  }
   if (!hasValidTokenSalt2()) {
     return ctx.notImplemented(
       "The server configuration for data transfer is invalid. Please contact your server administrator.",
-      // @ts-expect-error have to pass multiple arguments to surface the error details
       {
         code: "INVALID_TOKEN_SALT"
       }
     );
   }
-  if (isDisabledFromEnv2()) {
-    return ctx.notFound();
-  }
   throw new Error("Unexpected error while trying to access a data transfer route");
 };
 const index = {