@strapi/admin 4.26.1 → 4.26.2

package/dist/server/index.mjs

@@ -1,11 +1,11 @@
-import { merge, map, uniq, difference, isNil, castArray, pick, curry, pipe, prop, includes, isArray, set, omit, isEmpty, has, defaults, remove, eq, get, differenceWith, differenceBy, toLower, isFunction, some, flatMap, isObject, cloneDeep, getOr, intersection, isPlainObject, matchesProperty, propEq, xor, startsWith, isString, isNumber, values, sumBy, trim, isUndefined, mapKeys } from "lodash/fp";
+import { merge, map, uniq, difference, isNil, castArray, pick, curry, pipe, prop, includes, isArray, set, omit, isEmpty, has, defaults, remove, eq, get, differenceWith, differenceBy, toLower, isFunction, some, flatMap, cloneDeep, intersection, isObject, getOr, isPlainObject, matchesProperty, propEq, xor, startsWith, isString, isNumber, values, sumBy, trim, isUndefined, mapKeys } from "lodash/fp";
 import utils$1, { pipeAsync, errors, yup, validateYupSchema, policy, getAbsoluteAdminUrl, stringIncludes, hooks as hooks$1, generateTimestampCode, validateYupSchemaSync, providerFactory, sanitize, contentTypes, traverse, traverseEntity, validate, env, stringEquals } from "@strapi/utils";
 import "@strapi/types";
-import path, { resolve, basename, join, extname } from "path";
+import path, { resolve, join, basename, extname } from "path";
 import fse, { exists as exists$4 } from "fs-extra";
 import koaStatic from "koa-static";
 import { differenceInHours, parseISO } from "date-fns";
-import _$1, { pick as pick$1 } from "lodash";
+import _$2, { pick as pick$1 } from "lodash";
 import bcrypt from "bcryptjs";
 import deepEqual from "fast-deep-equal";
 import passport$1 from "koa-passport";
@@ -600,10 +600,10 @@ const hasPermissionsSchema = yup.object({
   actions: yup.array().of(
     // @ts-expect-error yup types
     yup.lazy((val) => {
-      if (_$1.isArray(val)) {
+      if (_$2.isArray(val)) {
         return yup.array().of(yup.string()).min(1).max(2);
       }
-      if (_$1.isString(val)) {
+      if (_$2.isString(val)) {
         return yup.string().required();
       }
       return yup.object().shape({
@@ -617,16 +617,16 @@ const validateHasPermissionsInput = validateYupSchema(hasPermissionsSchema);
 const { createPolicy: createPolicy$1 } = policy;
 const inputModifiers = [
   {
-    check: _$1.isString,
+    check: _$2.isString,
     transform: (action2) => ({ action: action2 })
   },
   {
-    check: _$1.isArray,
+    check: _$2.isArray,
     transform: (arr) => ({ action: arr[0], subject: arr[1] })
   },
   {
     // Has to be after the isArray check since _.isObject also matches arrays
-    check: _$1.isObject,
+    check: _$2.isObject,
     transform: (perm) => perm
   }
 ];
@@ -1370,7 +1370,7 @@ const forgotPassword = async ({ email: email2 } = {}) => {
     strapi.config.get("admin.forgotPassword.emailTemplate"),
     {
       url,
-      user: _$1.pick(user2, ["email", "firstname", "lastname", "username"])
+      user: _$2.pick(user2, ["email", "firstname", "lastname", "username"])
     }
   ).catch((err) => {
     strapi.log.error(err);
@@ -1405,7 +1405,7 @@ const getDefaultActionAttributes = () => ({
     applyToProperties: null
   }
 });
-const actionFields = [
+const actionFields$1 = [
   "section",
   "displayName",
   "category",
@@ -1416,7 +1416,7 @@ const actionFields = [
   "actionId",
   "aliases"
 ];
-const sanitizeActionAttributes = pick(actionFields);
+const sanitizeActionAttributes = pick(actionFields$1);
 const computeActionId = (attributes) => {
   const { pluginName, uid } = attributes;
   if (!pluginName) {
@@ -1450,7 +1450,7 @@ const create$6 = pipe(
   merge(getDefaultActionAttributes())
 );
 const actionDomain = {
-  actionFields,
+  actionFields: actionFields$1,
   appliesToProperty,
   appliesToSubject,
   assignActionId,
@@ -1461,7 +1461,7 @@ const actionDomain = {
   sanitizeActionAttributes
 };
 const checkFieldsAreCorrectlyNested = (fields) => {
-  if (_$1.isNil(fields)) {
+  if (_$2.isNil(fields)) {
     return true;
   }
   if (!Array.isArray(fields)) {
@@ -1472,20 +1472,20 @@ const checkFieldsAreCorrectlyNested = (fields) => {
     failed = fields.slice(indexA + 1).some(
       (fieldB) => fieldB.startsWith(`${fields[indexA]}.`) || fields[indexA].startsWith(`${fieldB}.`)
     );
-    if (failed)
-      break;
+    if (failed) break;
   }
   return !failed;
 };
 const checkFieldsDontHaveDuplicates = (fields) => {
-  if (_$1.isNil(fields)) {
+  if (_$2.isNil(fields)) {
     return true;
   }
   if (!Array.isArray(fields)) {
     return false;
   }
-  return _$1.uniq(fields).length === fields.length;
+  return _$2.uniq(fields).length === fields.length;
 };
+const { actionFields } = actionDomain;
 const getActionFromProvider = (actionId) => {
   return getService("permission").actionProvider.get(actionId);
 };
@@ -1498,11 +1498,11 @@ const roles = yup.array(yup.strapiID()).min(1);
 const isAPluginName = yup.string().test("is-a-plugin-name", "is not a plugin name", function(value) {
   return [void 0, "admin", ...Object.keys(strapi.plugins)].includes(value) ? true : this.createError({ path: this.path, message: `${this.path} is not an existing plugin` });
 });
-const arrayOfConditionNames = yup.array().of(yup.string()).test("is-an-array-of-conditions", "is not a plugin name", function(value) {
+yup.array().of(yup.string()).test("is-an-array-of-conditions", "is not a plugin name", function(value) {
   const ids = strapi.admin.services.permission.conditionProvider.keys();
-  return _$1.isUndefined(value) || _$1.difference(value, ids).length === 0 ? true : this.createError({ path: this.path, message: `contains conditions that don't exist` });
+  return _$2.isUndefined(value) || _$2.difference(value, ids).length === 0 ? true : this.createError({ path: this.path, message: `contains conditions that don't exist` });
 });
-const permissionsAreEquals = (a, b) => a.action === b.action && (a.subject === b.subject || _$1.isNil(a.subject) && _$1.isNil(b.subject));
+const permissionsAreEquals = (a, b) => a.action === b.action && (a.subject === b.subject || _$2.isNil(a.subject) && _$2.isNil(b.subject));
 const checkNoDuplicatedPermissions = (permissions2) => !Array.isArray(permissions2) || permissions2.every(
   (permA, i) => permissions2.slice(i + 1).every((permB) => !permissionsAreEquals(permA, permB))
 );
@@ -1603,16 +1603,14 @@ const validators = {
   password,
   roles,
   isAPluginName,
-  arrayOfConditionNames,
-  permission: permission$3,
   updatePermissions
 };
 const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$2 } = constants$3;
 const { ValidationError: ValidationError$4 } = errors;
-const sanitizeUserRoles = (role2) => _$1.pick(role2, ["id", "name", "description", "code"]);
+const sanitizeUserRoles = (role2) => _$2.pick(role2, ["id", "name", "description", "code"]);
 const sanitizeUser = (user2) => {
   return {
-    ..._$1.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
+    ..._$2.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
     roles: user2.roles && user2.roles.map(sanitizeUserRoles)
   };
 };
@@ -1621,7 +1619,7 @@ const create$5 = async (attributes) => {
     registrationToken: getService("token").createToken(),
     ...attributes
   };
-  if (_$1.has(attributes, "password")) {
+  if (_$2.has(attributes, "password")) {
     userInfo.password = await getService("auth").hashPassword(attributes.password);
   }
   const user2 = createUser(userInfo);
@@ -1631,7 +1629,7 @@ const create$5 = async (attributes) => {
   return createdUser;
 };
 const updateById = async (id, attributes) => {
-  if (_$1.has(attributes, "roles")) {
+  if (_$2.has(attributes, "roles")) {
     const lastAdminUser = await isLastSuperAdminUser(id);
     const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
     const willRemoveSuperAdminRole = !stringIncludes(attributes.roles, superAdminRole.id);
@@ -1645,7 +1643,7 @@ const updateById = async (id, attributes) => {
       throw new ValidationError$4("You must have at least one user with super admin role.");
     }
   }
-  if (_$1.has(attributes, "password")) {
+  if (_$2.has(attributes, "password")) {
     const hashedPassword = await getService("auth").hashPassword(attributes.password);
     const updatedUser2 = await strapi.query("admin::user").update({
       where: { id },
@@ -1684,8 +1682,7 @@ const resetPasswordByEmail = async (email2, password$1) => {
 };
 const isLastSuperAdminUser = async (userId) => {
   const user2 = await findOne$1(userId);
-  if (!user2)
-    return false;
+  if (!user2) return false;
   const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
   return superAdminRole.usersCount === 1 && hasSuperAdminRole$1(user2);
 };
@@ -1697,7 +1694,7 @@ const findRegistrationInfo = async (registrationToken) => {
   if (!user2) {
     return void 0;
   }
-  return _$1.pick(user2, ["email", "firstname", "lastname"]);
+  return _$2.pick(user2, ["email", "firstname", "lastname"]);
 };
 const register = async ({
   registrationToken,
@@ -1960,7 +1957,7 @@ const create$3 = async (attributes) => {
       `The name must be unique and a role with name \`${attributes.name}\` already exists.`
     );
   }
-  const autoGeneratedCode = `${_$1.kebabCase(attributes.name)}-${generateTimestampCode()}`;
+  const autoGeneratedCode = `${_$2.kebabCase(attributes.name)}-${generateTimestampCode()}`;
   const rolesWithCode = {
     ...attributes,
     code: attributes.code || autoGeneratedCode
@@ -1993,8 +1990,8 @@ const findAllWithUsersCount = async (params) => {
   return roles2;
 };
 const update$3 = async (params, attributes) => {
-  const sanitizedAttributes = _$1.omit(attributes, ["code"]);
-  if (_$1.has(params, "id") && _$1.has(sanitizedAttributes, "name")) {
+  const sanitizedAttributes = _$2.omit(attributes, ["code"]);
+  if (_$2.has(params, "id") && _$2.has(sanitizedAttributes, "name")) {
     const alreadyExists = await exists$2({
       name: sanitizedAttributes.name,
       id: { $ne: params.id }
@@ -2176,7 +2173,7 @@ const resetSuperAdminPermissions = async () => {
   await assignPermissions(superAdminRole.id, transformedPermissions);
 };
 const hasSuperAdminRole = (user2) => {
-  const roles2 = _$1.get(user2, "roles", []);
+  const roles2 = _$2.get(user2, "roles", []);
   return roles2.map(prop("code")).includes(SUPER_ADMIN_CODE$1);
 };
 const constants$2 = {
@@ -2215,9 +2212,6 @@ const createLocalStrategy = (strapi2, middleware) => {
     },
     (email2, password2, done) => {
       return getService("auth").checkCredentials({ email: toLower(email2), password: password2 }).then(async ([error, user2, message]) => {
-        if (middleware) {
-          return middleware([error, user2, message], done);
-        }
         return done(error, user2, message);
       }).catch((error) => done(error));
     }
@@ -2287,7 +2281,7 @@ const getTokenOptions = () => {
   );
   return {
     secret,
-    options: _$1.merge(defaultJwtOptions, options)
+    options: _$2.merge(defaultJwtOptions, options)
   };
 };
 const createToken = () => {
@@ -2524,44 +2518,57 @@ const createSanitizeHelpers = ({ action: action2, ability, model }) => {
   const createSanitizeQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
-    const sanitizeFilters = pipeAsync(
-      traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, { schema }),
-      traverse.traverseQueryFilters(omitHiddenFields, { schema }),
-      traverse.traverseQueryFilters(removePassword, { schema }),
-      traverse.traverseQueryFilters(
-        ({ key, value }, { remove: remove2 }) => {
-          if (isObject(value) && isEmpty(value)) {
-            remove2(key);
-          }
-        },
-        { schema }
-      )
+    const createSanitizeFilters = (ctx) => pipeAsync(
+      traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),
+      traverse.traverseQueryFilters(omitHiddenFields, ctx),
+      traverse.traverseQueryFilters(removePassword, ctx),
+      traverse.traverseQueryFilters(({ key, value }, { remove: remove2 }) => {
+        if (isObject(value) && isEmpty(value)) {
+          remove2(key);
+        }
+      }, ctx)
     );
-    const sanitizeSort = pipeAsync(
-      traverse.traverseQuerySort(removeDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQuerySort(omitDisallowedAdminUserFields, { schema }),
-      traverse.traverseQuerySort(omitHiddenFields, { schema }),
-      traverse.traverseQuerySort(removePassword, { schema }),
-      traverse.traverseQuerySort(
-        ({ key, attribute, value }, { remove: remove2 }) => {
-          if (!isScalarAttribute$1(attribute) && isEmpty(value)) {
-            remove2(key);
-          }
-        },
-        { schema }
-      )
+    const createSanitizeSort = (ctx) => pipeAsync(
+      traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),
+      traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),
+      traverse.traverseQuerySort(omitHiddenFields, ctx),
+      traverse.traverseQuerySort(removePassword, ctx),
+      traverse.traverseQuerySort(({ key, attribute, value }, { remove: remove2 }) => {
+        if (!isScalarAttribute$1(attribute) && isEmpty(value)) {
+          remove2(key);
+        }
+      }, ctx)
+    );
+    const createSanitizeFields = (ctx) => pipeAsync(
+      traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFields(omitHiddenFields, ctx),
+      traverse.traverseQueryFields(removePassword, ctx)
     );
+    const sanitizeFilters = createSanitizeFilters({ schema });
+    const sanitizeSort = createSanitizeSort({ schema });
+    const sanitizeFields = createSanitizeFields({ schema });
+    const sanitizeNestedPopulate = async ({ key, value, schema: schema2, attribute }, { set: set2 }) => {
+      if (attribute) {
+        return;
+      }
+      const nestedCtx = { schema: schema2 };
+      if (key === "sort") {
+        set2(key, await createSanitizeSort(nestedCtx)(value));
+      }
+      if (key === "filters") {
+        set2(key, await createSanitizeFilters(nestedCtx)(value));
+      }
+      if (key === "fields") {
+        set2(key, await createSanitizeFields(nestedCtx)(value));
+      }
+    };
     const sanitizePopulate = pipeAsync(
       traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), { schema }),
       traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, { schema }),
       traverse.traverseQueryPopulate(omitHiddenFields, { schema }),
-      traverse.traverseQueryPopulate(removePassword, { schema })
-    );
-    const sanitizeFields = pipeAsync(
-      traverse.traverseQueryFields(removeDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFields(omitHiddenFields, { schema }),
-      traverse.traverseQueryFields(removePassword, { schema })
+      traverse.traverseQueryPopulate(removePassword, { schema }),
+      traverse.traverseQueryPopulate(sanitizeNestedPopulate, { schema })
     );
     return async (query) => {
       const sanitizedQuery = cloneDeep(query);
@@ -2722,35 +2729,53 @@ const createValidateHelpers = ({ action: action2, ability, model }) => {
   const createValidateQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
-    const validateFilters = pipeAsync(
-      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, { schema }),
-      traverse.traverseQueryFilters(throwPassword, { schema }),
-      traverse.traverseQueryFilters(
-        ({ key, value }) => {
-          if (isObject(value) && isEmpty(value)) {
-            throwInvalidParam({ key });
-          }
-        },
-        { schema }
-      )
+    const createValidateFilters = (ctx) => pipeAsync(
+      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),
+      traverse.traverseQueryFilters(throwPassword, ctx),
+      traverse.traverseQueryFilters(({ key, value }) => {
+        if (isObject(value) && isEmpty(value)) {
+          throwInvalidParam({ key });
+        }
+      }, ctx)
     );
-    const validateSort = pipeAsync(
-      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQuerySort(throwDisallowedAdminUserFields, { schema }),
-      traverse.traverseQuerySort(throwPassword, { schema }),
-      traverse.traverseQuerySort(
-        ({ key, attribute, value }) => {
-          if (!isScalarAttribute(attribute) && isEmpty(value)) {
-            throwInvalidParam({ key });
-          }
-        },
-        { schema }
-      )
+    const createValidateSort = (ctx) => pipeAsync(
+      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),
+      traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),
+      traverse.traverseQuerySort(throwPassword, ctx),
+      traverse.traverseQuerySort(({ key, attribute, value }) => {
+        if (!isScalarAttribute(attribute) && isEmpty(value)) {
+          throwInvalidParam({ key });
+        }
+      }, ctx)
+    );
+    const createValidateFields = (ctx) => pipeAsync(
+      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFields(throwPassword, ctx)
     );
-    const validateFields = pipeAsync(
-      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFields(throwPassword, { schema })
+    const validateFilters = createValidateFilters({ schema });
+    const validateSort = createValidateSort({ schema });
+    const validateFields = createValidateFields({ schema });
+    const validateNestedPopulate = async ({ key, value, schema: schema2, attribute }) => {
+      if (attribute) {
+        return;
+      }
+      const nestedCtx = { schema: schema2 };
+      if (key === "sort") {
+        await createValidateSort(nestedCtx)(value);
+      }
+      if (key === "filters") {
+        await createValidateFilters(nestedCtx)(value);
+      }
+      if (key === "fields") {
+        await createValidateFields(nestedCtx)(value);
+      }
+    };
+    const validatePopulate = pipeAsync(
+      traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), { schema }),
+      traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, { schema }),
+      traverse.traverseQueryPopulate(throwPassword, { schema }),
+      traverse.traverseQueryPopulate(validateNestedPopulate, { schema })
     );
     return async (query) => {
       if (query.filters) {
@@ -2762,6 +2787,9 @@ const createValidateHelpers = ({ action: action2, ability, model }) => {
       if (query.fields) {
         await validateFields(query.fields);
       }
+      if (query.populate) {
+        await validatePopulate(query.populate);
+      }
       return true;
     };
   };
@@ -2856,7 +2884,7 @@ const operatorsMap = {
   $not: "$not"
 };
 const mapKey = (key) => {
-  if (_$1.isString(key) && key.startsWith("$") && key in operatorsMap) {
+  if (_$2.isString(key) && key.startsWith("$") && key in operatorsMap) {
     return operatorsMap[key];
   }
   return key;
@@ -2868,26 +2896,26 @@ const buildStrapiQuery = (caslQuery) => {
   return unwrapDeep(caslQuery);
 };
 const unwrapDeep = (obj) => {
-  if (!_$1.isPlainObject(obj) && !_$1.isArray(obj)) {
+  if (!_$2.isPlainObject(obj) && !_$2.isArray(obj)) {
     return obj;
   }
-  if (_$1.isArray(obj)) {
+  if (_$2.isArray(obj)) {
     return obj.map((v) => unwrapDeep(v));
   }
-  return _$1.reduce(
+  return _$2.reduce(
     obj,
     (acc, v, k) => {
       const key = mapKey(k);
-      if (_$1.isPlainObject(v)) {
+      if (_$2.isPlainObject(v)) {
         if ("$elemMatch" in v) {
-          _$1.setWith(acc, key, unwrapDeep(v.$elemMatch));
+          _$2.setWith(acc, key, unwrapDeep(v.$elemMatch));
         } else {
-          _$1.setWith(acc, key, unwrapDeep(v));
+          _$2.setWith(acc, key, unwrapDeep(v));
         }
-      } else if (_$1.isArray(v)) {
-        _$1.setWith(acc, key, v.map((v2) => unwrapDeep(v2)));
+      } else if (_$2.isArray(v)) {
+        _$2.setWith(acc, key, v.map((v2) => unwrapDeep(v2)));
       } else {
-        _$1.setWith(acc, key, v);
+        _$2.setWith(acc, key, v);
       }
       return acc;
     },
@@ -2908,7 +2936,7 @@ const index$4 = ({ ability, action: action2, model }) => ({
     return this.sanitizeInput(data, options);
   },
   getQuery(queryAction = action2) {
-    if (_$1.isUndefined(queryAction)) {
+    if (_$2.isUndefined(queryAction)) {
       throw new Error("Action must be defined to build a permission query");
     }
     return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));
@@ -3322,11 +3350,10 @@ const getNestedFields = (model, {
     return prefix ? [prefix] : [];
   }
   const nonAuthorizableFields = contentTypes.getNonVisibleAttributes(model);
-  return _$1.reduce(
+  return _$2.reduce(
     model.attributes,
     (fields, attr, key) => {
-      if (nonAuthorizableFields.includes(key))
-        return fields;
+      if (nonAuthorizableFields.includes(key)) return fields;
       const fieldPath = prefix ? `${prefix}.${key}` : key;
       const shouldBeIncluded = !requiredOnly || attr.required === true;
       const insideExistingFields = existingFields && existingFields.some(startsWith(fieldPath));
@@ -3359,11 +3386,10 @@ const getNestedFieldsWithIntermediate = (model, { prefix = "", nestingLevel = 15
     return [];
   }
   const nonAuthorizableFields = contentTypes.getNonVisibleAttributes(model);
-  return _$1.reduce(
+  return _$2.reduce(
     model.attributes,
     (fields, attr, key) => {
-      if (nonAuthorizableFields.includes(key))
-        return fields;
+      if (nonAuthorizableFields.includes(key)) return fields;
       const fieldPath = prefix ? `${prefix}.${key}` : key;
       fields.push(fieldPath);
       if (attr.type === "component") {
@@ -3735,8 +3761,7 @@ const list = async () => {
     populate: POPULATE_FIELDS,
     orderBy: { name: "ASC" }
   });
-  if (!tokens)
-    return tokens;
+  if (!tokens) return tokens;
   return tokens.map((token2) => flattenTokenPermissions(token2));
 };
 const generateRandomAccessKey = () => crypto.randomBytes(128).toString("hex");
@@ -4202,8 +4227,8 @@ const admin = {
       path.join(strapi.dirs.app.root, "src", "admin")
     );
     const isHostedOnStrapiCloud = env("STRAPI_HOSTING", null) === "strapi.cloud";
-    const numberOfAllContentTypes = _$1.size(strapi.contentTypes);
-    const numberOfComponents = _$1.size(strapi.components);
+    const numberOfAllContentTypes = _$2.size(strapi.contentTypes);
+    const numberOfComponents = _$2.size(strapi.components);
     const getNumberOfDynamicZones = () => {
       return pipe(
         map("attributes"),
@@ -4355,6 +4380,12 @@ const apiToken$1 = {
     ctx.send({ data: layout });
   }
 };
+function mergeValidatedBody(input, validatedPayload) {
+  if (validatedPayload !== null && typeof validatedPayload === "object" && !Array.isArray(validatedPayload)) {
+    return { ...input, ...validatedPayload };
+  }
+  return { ...input };
+}
 const userCreationSchema = yup.object().shape({
   email: validators.email.required(),
   firstname: validators.firstname.required(),
@@ -4387,9 +4418,33 @@ const usersDeleteSchema = yup.object().shape({
   ids: yup.array().of(yup.strapiID()).min(1).required()
 }).noUnknown();
 const validateUserCreationInput = validateYupSchema(userCreationSchema);
-const validateProfileUpdateInput = validateYupSchema(profileUpdateSchema);
-const validateUserUpdateInput = validateYupSchema(userUpdateSchema);
+const normalizeUpdateInput = (input) => {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    return input;
+  }
+  const data = { ...input };
+  if (typeof data.email === "string") {
+    data.email = data.email.toLowerCase();
+  }
+  if (typeof data.firstname === "string") {
+    data.firstname = data.firstname.trim();
+  }
+  return data;
+};
+const runProfileUpdateValidation = validateYupSchema(profileUpdateSchema);
+const runUserUpdateValidation = validateYupSchema(userUpdateSchema);
+const validateProfileUpdateInput = async (input) => {
+  const data = normalizeUpdateInput(input);
+  const validated = await runProfileUpdateValidation(data);
+  return mergeValidatedBody(data, validated);
+};
+const validateUserUpdateInput = async (input) => {
+  const data = normalizeUpdateInput(input);
+  const validated = await runUserUpdateValidation(data);
+  return mergeValidatedBody(data, validated);
+};
 const validateUsersDeleteInput = validateYupSchema(usersDeleteSchema);
+const _$1 = require("lodash");
 const authenticatedUser = {
   async getMe(ctx) {
     const userInfo = getService("user").sanitizeUser(ctx.state.user);
@@ -4399,10 +4454,10 @@ const authenticatedUser = {
   },
   async updateMe(ctx) {
     const input = ctx.request.body;
-    await validateProfileUpdateInput(input);
+    const data = await validateProfileUpdateInput(input);
     const userService = getService("user");
     const authServer = getService("auth");
-    const { currentPassword, ...userInfo } = input;
+    const { currentPassword, ...userInfo } = data;
     if (currentPassword && userInfo.password) {
       const isValid = await authServer.validatePassword(currentPassword, ctx.state.user.password);
       if (!isValid) {
@@ -4411,6 +4466,17 @@ const authenticatedUser = {
         });
       }
     }
+    if (_$1.has(userInfo, "email")) {
+      const uniqueEmailCheck = await userService.exists({
+        id: { $ne: ctx.state.user.id },
+        email: userInfo.email
+      });
+      if (uniqueEmailCheck) {
+        return ctx.badRequest("ValidationError", {
+          email: ["Email already taken"]
+        });
+      }
+    }
     const updatedUser = await userService.updateById(ctx.state.user.id, userInfo);
     ctx.body = {
       data: userService.sanitizeUser(updatedUser)
@@ -4957,17 +5023,17 @@ const user = {
   async update(ctx) {
     const { id } = ctx.params;
     const { body: input } = ctx.request;
-    await validateUserUpdateInput(input);
-    if (_.has(input, "email")) {
+    const data = await validateUserUpdateInput(input);
+    if (_.has(data, "email")) {
       const uniqueEmailCheck = await getService("user").exists({
         id: { $ne: id },
-        email: input.email
+        email: data.email
       });
       if (uniqueEmailCheck) {
         throw new ApplicationError("A user with this email address already exists");
       }
     }
-    const updatedUser = await getService("user").updateById(id, input);
+    const updatedUser = await getService("user").updateById(id, data);
     if (!updatedUser) {
       return ctx.notFound("User does not exist");
     }
@@ -5024,7 +5090,7 @@ const webhookValidator = yup.object({
     }
     return yup.object(
       // @ts-expect-error lodash types
-      _$1.mapValues(data, () => {
+      _$2.mapValues(data, () => {
         yup.string().min(1).required();
       })
     ).required();