@strapi/admin 5.0.0-beta.0 → 5.0.0-beta.10

package/dist/server/index.js

@@ -2,12 +2,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const fp = require("lodash/fp");
 const utils$1 = require("@strapi/utils");
-require("@strapi/types");
 const path = require("path");
 const fse = require("fs-extra");
 const koaStatic = require("koa-static");
 const dateFns = require("date-fns");
-const _$1 = require("lodash");
+require("@strapi/types");
+const _ = require("lodash");
 const bcrypt = require("bcryptjs");
 const passport$1 = require("koa-passport");
 const passportLocal = require("passport-local");
@@ -20,14 +20,33 @@ const pmap = require("p-map");
 const assert = require("assert");
 const fs = require("fs");
 const tsUtils = require("@strapi/typescript-utils");
+const zod = require("zod");
 const compose = require("koa-compose");
 const dataTransfer$1 = require("@strapi/data-transfer");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
+function _interopNamespace(e) {
+  if (e && e.__esModule)
+    return e;
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
 const utils__default = /* @__PURE__ */ _interopDefault(utils$1);
 const path__default = /* @__PURE__ */ _interopDefault(path);
 const fse__default = /* @__PURE__ */ _interopDefault(fse);
 const koaStatic__default = /* @__PURE__ */ _interopDefault(koaStatic);
-const ___default = /* @__PURE__ */ _interopDefault(_$1);
+const ___namespace = /* @__PURE__ */ _interopNamespace(_);
 const bcrypt__default = /* @__PURE__ */ _interopDefault(bcrypt);
 const passport__default = /* @__PURE__ */ _interopDefault(passport$1);
 const crypto__default = /* @__PURE__ */ _interopDefault(crypto);
@@ -347,7 +366,7 @@ const bootstrap = async ({ strapi: strapi2 }) => {
   await userService.displayWarningIfUsersDontHaveRole();
   await syncAuthSettings();
   await syncAPITokensPermissions();
-  getService("metrics").sendUpdateProjectInformation(strapi2);
+  await getService("metrics").sendUpdateProjectInformation(strapi2);
   getService("metrics").startCron(strapi2);
   apiTokenService.checkSaltIsDefined();
   transferService.token.checkSaltIsDefined();
@@ -559,7 +578,7 @@ const apiTokenAuthStrategy = {
   verify: verify$2
 };
 const register$1 = ({ strapi: strapi2 }) => {
-  const passportMiddleware = strapi2.admin?.services.passport.init();
+  const passportMiddleware = strapi2.service("admin::passport").init();
   strapi2.server.api("admin").use(passportMiddleware);
   strapi2.get("auth").register("admin", adminAuthStrategy);
   strapi2.get("auth").register("content-api", apiTokenAuthStrategy);
@@ -601,10 +620,10 @@ const hasPermissionsSchema = utils$1.yup.object({
   actions: utils$1.yup.array().of(
     // @ts-expect-error yup types
     utils$1.yup.lazy((val) => {
-      if (___default.default.isArray(val)) {
+      if (___namespace.default.isArray(val)) {
         return utils$1.yup.array().of(utils$1.yup.string()).min(1).max(2);
       }
-      if (___default.default.isString(val)) {
+      if (___namespace.default.isString(val)) {
         return utils$1.yup.string().required();
       }
       return utils$1.yup.object().shape({
@@ -618,16 +637,16 @@ const validateHasPermissionsInput = utils$1.validateYupSchema(hasPermissionsSche
 const { createPolicy: createPolicy$1 } = utils$1.policy;
 const inputModifiers = [
   {
-    check: ___default.default.isString,
+    check: ___namespace.default.isString,
     transform: (action2) => ({ action: action2 })
   },
   {
-    check: ___default.default.isArray,
+    check: ___namespace.default.isArray,
     transform: (arr) => ({ action: arr[0], subject: arr[1] })
   },
   {
     // Has to be after the isArray check since _.isObject also matches arrays
-    check: ___default.default.isObject,
+    check: ___namespace.default.isObject,
     transform: (perm) => perm
   }
 ];
@@ -1371,7 +1390,7 @@ const forgotPassword = async ({ email: email2 } = {}) => {
     strapi.config.get("admin.forgotPassword.emailTemplate"),
     {
       url,
-      user: ___default.default.pick(user2, ["email", "firstname", "lastname", "username"])
+      user: ___namespace.default.pick(user2, ["email", "firstname", "lastname", "username"])
     }
   ).catch((err) => {
     strapi.log.error(err);
@@ -1461,7 +1480,7 @@ const actionDomain = {
   sanitizeActionAttributes
 };
 const checkFieldsAreCorrectlyNested = (fields) => {
-  if (___default.default.isNil(fields)) {
+  if (___namespace.default.isNil(fields)) {
     return true;
   }
   if (!Array.isArray(fields)) {
@@ -1478,13 +1497,13 @@ const checkFieldsAreCorrectlyNested = (fields) => {
   return !failed;
 };
 const checkFieldsDontHaveDuplicates = (fields) => {
-  if (___default.default.isNil(fields)) {
+  if (___namespace.default.isNil(fields)) {
     return true;
   }
   if (!Array.isArray(fields)) {
     return false;
   }
-  return ___default.default.uniq(fields).length === fields.length;
+  return ___namespace.default.uniq(fields).length === fields.length;
 };
 const getActionFromProvider = (actionId) => {
   return getService("permission").actionProvider.get(actionId);
@@ -1499,10 +1518,10 @@ const isAPluginName = utils$1.yup.string().test("is-a-plugin-name", "is not a pl
   return [void 0, "admin", ...Object.keys(strapi.plugins)].includes(value) ? true : this.createError({ path: this.path, message: `${this.path} is not an existing plugin` });
 });
 const arrayOfConditionNames = utils$1.yup.array().of(utils$1.yup.string()).test("is-an-array-of-conditions", "is not a plugin name", function(value) {
-  const ids = strapi.admin.services.permission.conditionProvider.keys();
-  return ___default.default.isUndefined(value) || ___default.default.difference(value, ids).length === 0 ? true : this.createError({ path: this.path, message: `contains conditions that don't exist` });
+  const ids = strapi.service("admin::permission").conditionProvider.keys();
+  return ___namespace.default.isUndefined(value) || ___namespace.default.difference(value, ids).length === 0 ? true : this.createError({ path: this.path, message: `contains conditions that don't exist` });
 });
-const permissionsAreEquals = (a, b) => a.action === b.action && (a.subject === b.subject || ___default.default.isNil(a.subject) && ___default.default.isNil(b.subject));
+const permissionsAreEquals = (a, b) => a.action === b.action && (a.subject === b.subject || ___namespace.default.isNil(a.subject) && ___namespace.default.isNil(b.subject));
 const checkNoDuplicatedPermissions = (permissions2) => !Array.isArray(permissions2) || permissions2.every(
   (permA, i) => permissions2.slice(i + 1).every((permB) => !permissionsAreEquals(permA, permB))
 );
@@ -1609,10 +1628,10 @@ const validators = {
 };
 const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$2 } = constants$3;
 const { ValidationError: ValidationError$4 } = utils$1.errors;
-const sanitizeUserRoles = (role2) => ___default.default.pick(role2, ["id", "name", "description", "code"]);
+const sanitizeUserRoles = (role2) => ___namespace.default.pick(role2, ["id", "name", "description", "code"]);
 const sanitizeUser = (user2) => {
   return {
-    ...___default.default.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
+    ...___namespace.default.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
     roles: user2.roles && user2.roles.map(sanitizeUserRoles)
   };
 };
@@ -1621,7 +1640,7 @@ const create$5 = async (attributes) => {
     registrationToken: getService("token").createToken(),
     ...attributes
   };
-  if (___default.default.has(attributes, "password")) {
+  if (___namespace.default.has(attributes, "password")) {
     userInfo.password = await getService("auth").hashPassword(attributes.password);
   }
   const user2 = createUser(userInfo);
@@ -1631,7 +1650,7 @@ const create$5 = async (attributes) => {
   return createdUser;
 };
 const updateById = async (id, attributes) => {
-  if (___default.default.has(attributes, "roles")) {
+  if (___namespace.default.has(attributes, "roles")) {
     const lastAdminUser = await isLastSuperAdminUser(id);
     const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
     const willRemoveSuperAdminRole = !utils$1.arrays.includesString(attributes.roles, superAdminRole.id);
@@ -1645,7 +1664,7 @@ const updateById = async (id, attributes) => {
       throw new ValidationError$4("You must have at least one user with super admin role.");
     }
   }
-  if (___default.default.has(attributes, "password")) {
+  if (___namespace.default.has(attributes, "password")) {
     const hashedPassword = await getService("auth").hashPassword(attributes.password);
     const updatedUser2 = await strapi.db.query("admin::user").update({
       where: { id },
@@ -1697,7 +1716,7 @@ const findRegistrationInfo = async (registrationToken) => {
   if (!user2) {
     return void 0;
   }
-  return ___default.default.pick(user2, ["email", "firstname", "lastname"]);
+  return ___namespace.default.pick(user2, ["email", "firstname", "lastname"]);
 };
 const register = async ({
   registrationToken,
@@ -1725,10 +1744,7 @@ const findOneByEmail = async (email2, populate = []) => {
   });
 };
 const findPage = async (params = {}) => {
-  const query = utils$1.convertQueryParams.transformParamsToQuery(
-    "admin::user",
-    fp.defaults({ populate: ["roles"] }, params)
-  );
+  const query = strapi.get("query-params").transform("admin::user", fp.defaults({ populate: ["roles"] }, params));
   return strapi.db.query("admin::user").findPage(query);
 };
 const deleteById = async (id) => {
@@ -1965,7 +1981,7 @@ const create$3 = async (attributes) => {
       `The name must be unique and a role with name \`${attributes.name}\` already exists.`
     );
   }
-  const autoGeneratedCode = `${___default.default.kebabCase(attributes.name)}-${utils$1.dates.timestampCode()}`;
+  const autoGeneratedCode = `${___namespace.default.kebabCase(attributes.name)}-${utils$1.dates.timestampCode()}`;
   const rolesWithCode = {
     ...attributes,
     code: attributes.code || autoGeneratedCode
@@ -1988,15 +2004,15 @@ const find = (params = {}, populate) => {
   return strapi.db.query("admin::role").findMany({ where: params, populate });
 };
 const findAllWithUsersCount = async (params) => {
-  const roles2 = await strapi.db.query("admin::role").findMany(utils$1.convertQueryParams.transformParamsToQuery("admin::role", params));
+  const roles2 = await strapi.db.query("admin::role").findMany(strapi.get("query-params").transform("admin::role", params));
   for (const role2 of roles2) {
     role2.usersCount = await getUsersCount(role2.id);
   }
   return roles2;
 };
 const update$3 = async (params, attributes) => {
-  const sanitizedAttributes = ___default.default.omit(attributes, ["code"]);
-  if (___default.default.has(params, "id") && ___default.default.has(sanitizedAttributes, "name")) {
+  const sanitizedAttributes = ___namespace.default.omit(attributes, ["code"]);
+  if (___namespace.default.has(params, "id") && ___namespace.default.has(sanitizedAttributes, "name")) {
     const alreadyExists = await exists$2({
       name: sanitizedAttributes.name,
       id: { $ne: params.id }
@@ -2178,7 +2194,7 @@ const resetSuperAdminPermissions = async () => {
   await assignPermissions(superAdminRole.id, transformedPermissions);
 };
 const hasSuperAdminRole = (user2) => {
-  const roles2 = ___default.default.get(user2, "roles", []);
+  const roles2 = ___namespace.default.get(user2, "roles", []);
   return roles2.map(fp.prop("code")).includes(SUPER_ADMIN_CODE$1);
 };
 const constants$2 = {
@@ -2231,23 +2247,56 @@ const authEventsMapper = {
 };
 const valueIsFunctionType = ([, value]) => fp.isFunction(value);
 const keyIsValidEventName = ([key]) => {
-  return Object.keys(strapi.admin.services.passport.authEventsMapper).includes(key);
+  return Object.keys(strapi.service("admin::passport").authEventsMapper).includes(key);
 };
 const getPassportStrategies = () => [createLocalStrategy(strapi)];
 const registerAuthEvents = () => {
   const { events = {} } = strapi.config.get("admin.auth", {});
-  const { authEventsMapper: authEventsMapper2 } = strapi.admin.services.passport;
+  const { authEventsMapper: authEventsMapper2 } = strapi.service("admin::passport");
   const eventList = Object.entries(events).filter(keyIsValidEventName).filter(valueIsFunctionType);
   for (const [eventName, handler] of eventList) {
     strapi.eventHub.on(authEventsMapper2[eventName], handler);
   }
 };
 const init = () => {
-  strapi.admin.services.passport.getPassportStrategies().forEach((strategy) => passport__default.default.use(strategy));
+  strapi.service("admin::passport").getPassportStrategies().forEach((strategy) => passport__default.default.use(strategy));
   registerAuthEvents();
   return passport__default.default.initialize();
 };
 const passport = { init, getPassportStrategies, authEventsMapper };
+const sendDidInviteUser = async () => {
+  const numberOfUsers = await getService("user").count();
+  const numberOfRoles = await getService("role").count();
+  strapi.telemetry.send("didInviteUser", {
+    groupProperties: { numberOfRoles, numberOfUsers }
+  });
+};
+const sendDidUpdateRolePermissions = async () => {
+  strapi.telemetry.send("didUpdateRolePermissions");
+};
+const sendDidChangeInterfaceLanguage = async () => {
+  const languagesInUse = await getService("user").getLanguagesInUse();
+  strapi.telemetry.send("didChangeInterfaceLanguage", { userProperties: { languagesInUse } });
+};
+const sendUpdateProjectInformation = async (strapi2) => {
+  const numberOfActiveAdminUsers = await getService("user").count({ isActive: true });
+  const numberOfAdminUsers = await getService("user").count();
+  strapi2.telemetry.send("didUpdateProjectInformation", {
+    groupProperties: { numberOfActiveAdminUsers, numberOfAdminUsers }
+  });
+};
+const startCron = (strapi2) => {
+  strapi2.cron.add({
+    "0 0 0 * * *": () => sendUpdateProjectInformation(strapi2)
+  });
+};
+const metrics = {
+  sendDidInviteUser,
+  sendDidUpdateRolePermissions,
+  sendDidChangeInterfaceLanguage,
+  sendUpdateProjectInformation,
+  startCron
+};
 const defaultJwtOptions = { expiresIn: "30d" };
 const getTokenOptions = () => {
   const { options, secret } = strapi.config.get(
@@ -2256,7 +2305,7 @@ const getTokenOptions = () => {
   );
   return {
     secret,
-    options: ___default.default.merge(defaultJwtOptions, options)
+    options: ___namespace.default.merge(defaultJwtOptions, options)
   };
 };
 const createToken = () => {
@@ -2462,48 +2511,46 @@ const STATIC_FIELDS$1 = [ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE$1];
 const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) => {
   const schema = strapi.getModel(model);
   const { removeDisallowedFields } = utils$1.sanitize.visitors;
+  const ctx = {
+    schema,
+    getModel: strapi.getModel.bind(strapi)
+  };
   const createSanitizeQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
     const sanitizeFilters = utils$1.async.pipe(
-      utils$1.traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFilters(omitDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQueryFilters(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQueryFilters(removePassword, { schema }),
-      utils$1.traverse.traverseQueryFilters(
-        ({ key, value }, { remove }) => {
-          if (fp.isObject(value) && fp.isEmpty(value)) {
-            remove(key);
-          }
-        },
-        { schema }
-      )
+      utils$1.traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQueryFilters(omitHiddenFields, ctx),
+      utils$1.traverse.traverseQueryFilters(removePassword, ctx),
+      utils$1.traverse.traverseQueryFilters(({ key, value }, { remove }) => {
+        if (fp.isObject(value) && fp.isEmpty(value)) {
+          remove(key);
+        }
+      }, ctx)
     );
     const sanitizeSort = utils$1.async.pipe(
-      utils$1.traverse.traverseQuerySort(removeDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQuerySort(omitDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQuerySort(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQuerySort(removePassword, { schema }),
-      utils$1.traverse.traverseQuerySort(
-        ({ key, attribute, value }, { remove }) => {
-          if (!isScalarAttribute$1(attribute) && fp.isEmpty(value)) {
-            remove(key);
-          }
-        },
-        { schema }
-      )
+      utils$1.traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQuerySort(omitHiddenFields, ctx),
+      utils$1.traverse.traverseQuerySort(removePassword, ctx),
+      utils$1.traverse.traverseQuerySort(({ key, attribute, value }, { remove }) => {
+        if (!isScalarAttribute$1(attribute) && fp.isEmpty(value)) {
+          remove(key);
+        }
+      }, ctx)
     );
     const sanitizePopulate = utils$1.async.pipe(
-      utils$1.traverse.traverseQueryPopulate(expandWildcardPopulate, { schema }),
-      utils$1.traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQueryPopulate(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQueryPopulate(removePassword, { schema })
+      utils$1.traverse.traverseQueryPopulate(expandWildcardPopulate, ctx),
+      utils$1.traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQueryPopulate(omitHiddenFields, ctx),
+      utils$1.traverse.traverseQueryPopulate(removePassword, ctx)
     );
     const sanitizeFields = utils$1.async.pipe(
-      utils$1.traverse.traverseQueryFields(removeDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFields(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQueryFields(removePassword, { schema })
+      utils$1.traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFields(omitHiddenFields, ctx),
+      utils$1.traverse.traverseQueryFields(removePassword, ctx)
     );
     return async (query) => {
       const sanitizedQuery = fp.cloneDeep(query);
@@ -2527,13 +2574,18 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
     const permittedFields = fields.shouldIncludeAll ? null : getOutputFields(fields.permitted);
     return utils$1.async.pipe(
       // Remove fields hidden from the admin
-      utils$1.traverseEntity(omitHiddenFields, { schema }),
+      utils$1.traverseEntity(omitHiddenFields, ctx),
       // Remove unallowed fields from admin::user relations
-      utils$1.traverseEntity(pickAllowedAdminUserFields, { schema }),
+      utils$1.traverseEntity(pickAllowedAdminUserFields, ctx),
       // Remove not allowed fields (RBAC)
-      utils$1.traverseEntity(removeDisallowedFields(permittedFields), { schema }),
+      utils$1.traverseEntity(removeDisallowedFields(permittedFields), ctx),
       // Remove all fields of type 'password'
-      utils$1.sanitize.sanitizers.sanitizePasswords(schema)
+      utils$1.sanitize.sanitizers.sanitizePasswords({
+        schema,
+        getModel(uid) {
+          return strapi.getModel(uid);
+        }
+      })
     );
   };
   const createSanitizeInput = (options = {}) => {
@@ -2541,10 +2593,10 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
     const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);
     return utils$1.async.pipe(
       // Remove fields hidden from the admin
-      utils$1.traverseEntity(omitHiddenFields, { schema }),
+      utils$1.traverseEntity(omitHiddenFields, ctx),
       // Remove not allowed fields (RBAC)
-      utils$1.traverseEntity(removeDisallowedFields(permittedFields), { schema }),
-      // Remove roles from createdBy & updateBy fields
+      utils$1.traverseEntity(removeDisallowedFields(permittedFields), ctx),
+      // Remove roles from createdBy & updatedBy fields
       omitCreatorRoles
     );
   };
@@ -2587,6 +2639,9 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
   };
   const pickAllowedAdminUserFields = ({ attribute, key, value }, { set }) => {
     const pickAllowedFields = fp.pick(ADMIN_USER_ALLOWED_FIELDS);
+    if (!attribute) {
+      return;
+    }
     if (attribute.type === "relation" && attribute.target === "admin::user" && value) {
       if (Array.isArray(value)) {
         set(key, value.map(pickAllowedFields));
@@ -2655,50 +2710,48 @@ const {
 } = constants;
 const COMPONENT_FIELDS = ["__component"];
 const STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];
-const throwInvalidParam = ({ key, path: path2 }) => {
-  const msg = path2 && path2 !== key ? `Invalid parameter ${key} at ${path2}` : `Invalid parameter ${key}`;
+const throwInvalidKey = ({ key, path: path2 }) => {
+  const msg = path2 && path2 !== key ? `Invalid key ${key} at ${path2}` : `Invalid key ${key}`;
   throw new ValidationError$3(msg);
 };
 const createValidateHelpers = ({ action: action2, ability: ability$1, model }) => {
   const schema = strapi.getModel(model);
+  const ctx = {
+    schema,
+    getModel: strapi.getModel.bind(strapi)
+  };
   const createValidateQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
     const validateFilters = utils$1.async.pipe(
-      utils$1.traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFilters(throwDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQueryFilters(throwPassword, { schema }),
-      utils$1.traverse.traverseQueryFilters(
-        ({ key, value, path: path2 }) => {
-          if (fp.isObject(value) && fp.isEmpty(value)) {
-            throwInvalidParam({ key, path: path2.attribute });
-          }
-        },
-        { schema }
-      )
+      utils$1.traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQueryFilters(throwPassword, ctx),
+      utils$1.traverse.traverseQueryFilters(({ key, value, path: path2 }) => {
+        if (fp.isObject(value) && fp.isEmpty(value)) {
+          throwInvalidKey({ key, path: path2.attribute });
+        }
+      }, ctx)
     );
     const validateSort = utils$1.async.pipe(
-      utils$1.traverse.traverseQuerySort(throwDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQuerySort(throwDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQuerySort(throwPassword, { schema }),
-      utils$1.traverse.traverseQuerySort(
-        ({ key, attribute, value, path: path2 }) => {
-          if (!isScalarAttribute(attribute) && fp.isEmpty(value)) {
-            throwInvalidParam({ key, path: path2.attribute });
-          }
-        },
-        { schema }
-      )
+      utils$1.traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQuerySort(throwPassword, ctx),
+      utils$1.traverse.traverseQuerySort(({ key, attribute, value, path: path2 }) => {
+        if (!isScalarAttribute(attribute) && fp.isEmpty(value)) {
+          throwInvalidKey({ key, path: path2.attribute });
+        }
+      }, ctx)
     );
     const validateFields = utils$1.async.pipe(
-      utils$1.traverse.traverseQueryFields(throwDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFields(throwPassword, { schema })
+      utils$1.traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFields(throwPassword, ctx)
     );
     const validatePopulate = utils$1.async.pipe(
-      utils$1.traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQueryPopulate(throwHiddenFields, { schema }),
-      utils$1.traverse.traverseQueryPopulate(throwPassword, { schema })
+      utils$1.traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQueryPopulate(throwHiddenFields, ctx),
+      utils$1.traverse.traverseQueryPopulate(throwPassword, ctx)
     );
     return async (query) => {
       if (query.filters) {
@@ -2721,9 +2774,9 @@ const createValidateHelpers = ({ action: action2, ability: ability$1, model }) =
     const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);
     return utils$1.async.pipe(
       // Remove fields hidden from the admin
-      utils$1.traverseEntity(throwHiddenFields, { schema }),
+      utils$1.traverseEntity(throwHiddenFields, ctx),
       // Remove not allowed fields (RBAC)
-      utils$1.traverseEntity(throwDisallowedFields(permittedFields), { schema }),
+      utils$1.traverseEntity(throwDisallowedFields(permittedFields), ctx),
       // Remove roles from createdBy & updatedBy fields
       omitCreatorRoles
     );
@@ -2762,12 +2815,12 @@ const createValidateHelpers = ({ action: action2, ability: ability$1, model }) =
   const throwHiddenFields = ({ key, schema: schema2, path: path2 }) => {
     const isHidden = fp.getOr(false, ["config", "attributes", key, "hidden"], schema2);
     if (isHidden) {
-      throwInvalidParam({ key, path: path2.attribute });
+      throwInvalidKey({ key, path: path2.attribute });
     }
   };
   const throwDisallowedAdminUserFields = ({ key, attribute, schema: schema2, path: path2 }) => {
     if (schema2.uid === "admin::user" && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {
-      throwInvalidParam({ key, path: path2.attribute });
+      throwInvalidKey({ key, path: path2.attribute });
     }
   };
   const getInputFields = (fields = []) => {
@@ -2806,7 +2859,7 @@ const operatorsMap = {
   $not: "$not"
 };
 const mapKey = (key) => {
-  if (___default.default.isString(key) && key.startsWith("$") && key in operatorsMap) {
+  if (___namespace.default.isString(key) && key.startsWith("$") && key in operatorsMap) {
     return operatorsMap[key];
   }
   return key;
@@ -2818,26 +2871,26 @@ const buildStrapiQuery = (caslQuery) => {
   return unwrapDeep(caslQuery);
 };
 const unwrapDeep = (obj) => {
-  if (!___default.default.isPlainObject(obj) && !___default.default.isArray(obj)) {
+  if (!___namespace.default.isPlainObject(obj) && !___namespace.default.isArray(obj)) {
     return obj;
   }
-  if (___default.default.isArray(obj)) {
+  if (___namespace.default.isArray(obj)) {
     return obj.map((v) => unwrapDeep(v));
   }
-  return ___default.default.reduce(
+  return ___namespace.default.reduce(
     obj,
     (acc, v, k) => {
       const key = mapKey(k);
-      if (___default.default.isPlainObject(v)) {
+      if (___namespace.default.isPlainObject(v)) {
         if ("$elemMatch" in v) {
-          ___default.default.setWith(acc, key, unwrapDeep(v.$elemMatch));
+          ___namespace.default.setWith(acc, key, unwrapDeep(v.$elemMatch));
         } else {
-          ___default.default.setWith(acc, key, unwrapDeep(v));
+          ___namespace.default.setWith(acc, key, unwrapDeep(v));
         }
-      } else if (___default.default.isArray(v)) {
-        ___default.default.setWith(acc, key, v.map((v2) => unwrapDeep(v2)));
+      } else if (___namespace.default.isArray(v)) {
+        ___namespace.default.setWith(acc, key, v.map((v2) => unwrapDeep(v2)));
       } else {
-        ___default.default.setWith(acc, key, v);
+        ___namespace.default.setWith(acc, key, v);
       }
       return acc;
     },
@@ -2858,7 +2911,7 @@ const index$4 = ({ ability: ability$1, action: action2, model }) => ({
     return this.sanitizeInput(data, options);
   },
   getQuery(queryAction = action2) {
-    if (___default.default.isUndefined(queryAction)) {
+    if (___namespace.default.isUndefined(queryAction)) {
       throw new Error("Action must be defined to build a permission query");
     }
     return buildStrapiQuery(buildCaslQuery(ability$1, queryAction, model));
@@ -3024,7 +3077,9 @@ const createSectionBuilder = () => {
   };
 };
 const isOfKind = (kind) => fp.matchesProperty("kind", kind);
-const resolveContentType = (uid) => strapi.contentTypes[uid];
+const resolveContentType = (uid) => {
+  return strapi.contentTypes[uid];
+};
 const isNotInSubjects = (subjects) => (uid) => !subjects.find((subject2) => subject2.uid === uid);
 const hasProperty = fp.curry((property, subject2) => {
   return !!subject2.properties.find((prop) => prop.value === property);
@@ -3071,7 +3126,7 @@ const contentTypesBase = ({
   });
 };
 const subjectsHandlerFor = (kind) => ({ action: action2, section: contentTypesSection }) => {
-  const { subjects } = action2;
+  const subjects = action2.subjects;
   if (!subjects?.length) {
     return;
   }
@@ -3261,40 +3316,6 @@ const permission$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.define
   sanitizePermission,
   sectionsBuilder
 }, Symbol.toStringTag, { value: "Module" }));
-const sendDidInviteUser = async () => {
-  const numberOfUsers = await getService("user").count();
-  const numberOfRoles = await getService("role").count();
-  strapi.telemetry.send("didInviteUser", {
-    groupProperties: { numberOfRoles, numberOfUsers }
-  });
-};
-const sendDidUpdateRolePermissions = async () => {
-  strapi.telemetry.send("didUpdateRolePermissions");
-};
-const sendDidChangeInterfaceLanguage = async () => {
-  const languagesInUse = await getService("user").getLanguagesInUse();
-  strapi.telemetry.send("didChangeInterfaceLanguage", { userProperties: { languagesInUse } });
-};
-const sendUpdateProjectInformation = async (strapi2) => {
-  const numberOfActiveAdminUsers = await getService("user").count({ isActive: true });
-  const numberOfAdminUsers = await getService("user").count();
-  strapi2.telemetry.send("didUpdateProjectInformation", {
-    groupProperties: { numberOfActiveAdminUsers, numberOfAdminUsers }
-  });
-};
-const startCron = (strapi2) => {
-  strapi2.cron.add({
-    "0 0 0 * * *": () => sendUpdateProjectInformation(strapi2)
-  });
-};
-const metrics = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  sendDidChangeInterfaceLanguage,
-  sendDidInviteUser,
-  sendDidUpdateRolePermissions,
-  sendUpdateProjectInformation,
-  startCron
-}, Symbol.toStringTag, { value: "Module" }));
 const getNestedFields = (model, {
   prefix = "",
   nestingLevel = 15,
@@ -3306,7 +3327,7 @@ const getNestedFields = (model, {
     return prefix ? [prefix] : [];
   }
   const nonAuthorizableFields = utils$1.contentTypes.getNonVisibleAttributes(model);
-  return ___default.default.reduce(
+  return ___namespace.default.reduce(
     model.attributes,
     (fields, attr, key) => {
       if (nonAuthorizableFields.includes(key))
@@ -3343,7 +3364,7 @@ const getNestedFieldsWithIntermediate = (model, { prefix = "", nestingLevel = 15
     return [];
   }
   const nonAuthorizableFields = utils$1.contentTypes.getNonVisibleAttributes(model);
-  return ___default.default.reduce(
+  return ___namespace.default.reduce(
     model.attributes,
     (fields, attr, key) => {
       if (nonAuthorizableFields.includes(key))
@@ -3875,7 +3896,7 @@ const flattenTokenPermissions = (token2) => {
   };
 };
 const assertTokenPermissionsValidity = (attributes) => {
-  const permissionService = strapi.admin.services.transfer.permission;
+  const permissionService = strapi.service("admin::transfer").permission;
   const validPermissions = permissionService.providers.action.keys();
   const invalidPermissions = fp.difference(attributes.permissions, validPermissions);
   if (!fp.isEmpty(invalidPermissions)) {
@@ -3947,10 +3968,10 @@ const parseFilesData = async (files) => {
       if (!file) {
         return;
       }
-      const getStream = () => fs__default.default.createReadStream(file.path);
+      const getStream = () => fs__default.default.createReadStream(file.filepath);
       formatedFilesData[inputName] = await strapi.plugin("upload").service("upload").formatFileInfo({
-        filename: file.name,
-        type: file.type,
+        filename: file.originalFilename,
+        type: file.mimetype,
         size: file.size
       });
       Object.assign(
@@ -3959,7 +3980,7 @@ const parseFilesData = async (files) => {
       );
       Object.assign(formatedFilesData[inputName], {
         stream: getStream(),
-        tmpPath: file.path,
+        tmpPath: file.filepath,
         // TODO
         // @ts-expect-error define the correct return type
         provider: strapi.config.get("plugin::upload").provider
@@ -3983,7 +4004,7 @@ const getProjectSettings = async () => {
     if (!projectSettings2[inputName]) {
       return;
     }
-    projectSettings2[inputName] = _$1.pick(projectSettings2[inputName], [
+    projectSettings2[inputName] = _.pick(projectSettings2[inputName], [
       "name",
       "url",
       "width",
@@ -4021,7 +4042,7 @@ const deleteOldFiles = async ({ previousSettings, newSettings }) => {
 const updateProjectSettings$1 = async (newSettings) => {
   const store = strapi.store({ type: "core", name: "admin" });
   const previousSettings = await store.get({ key: "project-settings" });
-  const files = _$1.pick(newSettings, PROJECT_SETTINGS_FILE_INPUTS);
+  const files = _.pick(newSettings, PROJECT_SETTINGS_FILE_INPUTS);
   await uploadFiles(files);
   PROJECT_SETTINGS_FILE_INPUTS.forEach((inputName) => {
     if (newSettings[inputName] !== void 0 && !(typeof newSettings[inputName] === "object")) {
@@ -4032,7 +4053,7 @@ const updateProjectSettings$1 = async (newSettings) => {
       newSettings[inputName] = previousSettings[inputName];
       return;
     }
-    newSettings[inputName] = _$1.pick(newSettings[inputName], [
+    newSettings[inputName] = _.pick(newSettings[inputName], [
       "name",
       "hash",
       "url",
@@ -4076,31 +4097,30 @@ const index$3 = {
 const MAX_IMAGE_WIDTH = 750;
 const MAX_IMAGE_HEIGHT = MAX_IMAGE_WIDTH;
 const MAX_IMAGE_FILE_SIZE = 1024 * 1024;
-const ALLOWED_IMAGE_FILE_TYPES = ["image/jpeg", "image/png", "image/svg+xml"];
-const updateProjectSettings = utils$1.yup.object({
-  menuLogo: utils$1.yup.string(),
-  authLogo: utils$1.yup.string()
-}).noUnknown();
-const updateProjectSettingsLogo = utils$1.yup.object({
-  name: utils$1.yup.string(),
-  type: utils$1.yup.string().oneOf(ALLOWED_IMAGE_FILE_TYPES),
-  size: utils$1.yup.number().max(MAX_IMAGE_FILE_SIZE)
+const updateProjectSettings = zod.z.object({
+  menuLogo: zod.z.string().nullish(),
+  authLogo: zod.z.string().nullish()
+}).strict();
+const updateProjectSettingsLogo = zod.z.object({
+  originalFilename: zod.z.string().nullish(),
+  mimetype: zod.z.enum(["image/jpeg", "image/png", "image/svg+xml"]),
+  size: zod.z.number().max(MAX_IMAGE_FILE_SIZE).nullish()
 });
-const updateProjectSettingsFiles = utils$1.yup.object({
-  menuLogo: updateProjectSettingsLogo,
-  authLogo: updateProjectSettingsLogo
-}).noUnknown();
-const logoDimensions = utils$1.yup.object({
-  width: utils$1.yup.number().max(MAX_IMAGE_WIDTH),
-  height: utils$1.yup.number().max(MAX_IMAGE_HEIGHT)
+const updateProjectSettingsFiles = zod.z.object({
+  menuLogo: updateProjectSettingsLogo.nullish(),
+  authLogo: updateProjectSettingsLogo.nullish()
+}).strict();
+const logoDimensions = zod.z.object({
+  width: zod.z.number().max(MAX_IMAGE_WIDTH).nullish(),
+  height: zod.z.number().max(MAX_IMAGE_HEIGHT).nullish()
 });
-const updateProjectSettingsImagesDimensions = utils$1.yup.object({
-  menuLogo: logoDimensions,
-  authLogo: logoDimensions
-}).noUnknown();
-const validateUpdateProjectSettings = utils$1.validateYupSchemaSync(updateProjectSettings);
-const validateUpdateProjectSettingsFiles = utils$1.validateYupSchemaSync(updateProjectSettingsFiles);
-const validateUpdateProjectSettingsImagesDimensions = utils$1.validateYupSchemaSync(
+const updateProjectSettingsImagesDimensions = zod.z.object({
+  menuLogo: logoDimensions.nullish(),
+  authLogo: logoDimensions.nullish()
+}).strict();
+const validateUpdateProjectSettings = utils$1.validateZod(updateProjectSettings);
+const validateUpdateProjectSettingsFiles = utils$1.validateZod(updateProjectSettingsFiles);
+const validateUpdateProjectSettingsImagesDimensions = utils$1.validateZod(
   updateProjectSettingsImagesDimensions
 );
 const { isUsingTypeScript } = tsUtils__default.default;
@@ -4163,8 +4183,8 @@ const admin = {
       path__default.default.join(strapi.dirs.app.root, "src", "admin")
     );
     const isHostedOnStrapiCloud = utils$1.env("STRAPI_HOSTING", null) === "strapi.cloud";
-    const numberOfAllContentTypes = ___default.default.size(strapi.contentTypes);
-    const numberOfComponents = ___default.default.size(strapi.components);
+    const numberOfAllContentTypes = ___namespace.default.size(strapi.contentTypes);
+    const numberOfComponents = ___namespace.default.size(strapi.components);
     const getNumberOfDynamicZones = () => {
       return fp.pipe(
         fp.map("attributes"),
@@ -4209,7 +4229,16 @@ const admin = {
   },
   async plugins(ctx) {
     const enabledPlugins = strapi.config.get("enabledPlugins");
-    const plugins2 = Object.entries(enabledPlugins).map(([key, plugin]) => ({
+    const CORE_PLUGINS = [
+      "content-manager",
+      "content-type-builder",
+      "email",
+      "upload",
+      "i18n",
+      "content-releases",
+      "review-workflows"
+    ];
+    const plugins2 = Object.entries(enabledPlugins).filter(([key]) => !CORE_PLUGINS.includes(key)).map(([key, plugin]) => ({
       name: plugin.info.name || key,
       displayName: plugin.info.displayName || plugin.info.name || key,
       description: plugin.info.description || "",
@@ -4580,7 +4609,7 @@ const roleCreateSchema = utils$1.yup.object().shape({
 const rolesDeleteSchema = utils$1.yup.object().shape({
   ids: utils$1.yup.array().of(utils$1.yup.strapiID()).min(1).required().test("roles-deletion-checks", "Roles deletion checks have failed", async function(ids) {
     try {
-      await strapi.admin.services.role.checkRolesIdForDeletion(ids);
+      await strapi.service("admin::role").checkRolesIdForDeletion(ids);
     } catch (e) {
       return this.createError({ path: "ids", message: e.message });
     }
@@ -4589,7 +4618,7 @@ const rolesDeleteSchema = utils$1.yup.object().shape({
 }).noUnknown();
 const roleDeleteSchema = utils$1.yup.strapiID().required().test("no-admin-single-delete", "Role deletion checks have failed", async function(id) {
   try {
-    await strapi.admin.services.role.checkRolesIdForDeletion([id]);
+    await strapi.service("admin::role").checkRolesIdForDeletion([id]);
   } catch (e) {
     return this.createError({ path: "id", message: e.message });
   }
@@ -4864,14 +4893,13 @@ const transfer = {
   ...prefixActionsName("runner", runner),
   ...prefixActionsName("token", token)
 };
-const _ = require("lodash");
 const { ApplicationError } = utils$1.errors;
 const user = {
   async create(ctx) {
     const { body } = ctx.request;
-    const cleanData = { ...body, email: _.get(body, `email`, ``).toLowerCase() };
+    const cleanData = { ...body, email: ___namespace.get(body, `email`, ``).toLowerCase() };
     await validateUserCreationInput(cleanData);
-    const attributes = _.pick(cleanData, [
+    const attributes = ___namespace.pick(cleanData, [
       "firstname",
       "lastname",
       "email",
@@ -4891,7 +4919,7 @@ const user = {
   },
   async find(ctx) {
     const userService = getService("user");
-    const permissionsManager = strapi.admin.services.permission.createPermissionsManager({
+    const permissionsManager = strapi.service("admin::permission").createPermissionsManager({
       ability: ctx.state.userAbility,
       model: "admin::user"
     });
@@ -4919,7 +4947,7 @@ const user = {
     const { id } = ctx.params;
     const { body: input } = ctx.request;
     await validateUserUpdateInput(input);
-    if (_.has(input, "email")) {
+    if (___namespace.has(input, "email")) {
       const uniqueEmailCheck = await getService("user").exists({
         id: { $ne: id },
         email: input.email
@@ -4970,7 +4998,7 @@ const webhookValidator = utils$1.yup.object({
     }
     return utils$1.yup.object(
       // @ts-expect-error lodash types
-      ___default.default.mapValues(data, () => {
+      ___namespace.default.mapValues(data, () => {
         utils$1.yup.string().min(1).required();
       })
     ).required();
@@ -4982,12 +5010,12 @@ const updateWebhookValidator = webhookValidator.shape({
 });
 const webhooks = {
   async listWebhooks(ctx) {
-    const webhooks2 = await strapi.webhookStore.findWebhooks();
+    const webhooks2 = await strapi.get("webhookStore").findWebhooks();
     ctx.send({ data: webhooks2 });
   },
   async getWebhook(ctx) {
     const { id } = ctx.params;
-    const webhook = await strapi.webhookStore.findWebhook(id);
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
     if (!webhook) {
       return ctx.notFound("webhook.notFound");
     }
@@ -4996,36 +5024,36 @@ const webhooks = {
   async createWebhook(ctx) {
     const { body } = ctx.request;
     await utils$1.validateYupSchema(webhookValidator)(body);
-    const webhook = await strapi.webhookStore.createWebhook(body);
-    strapi.webhookRunner.add(webhook);
+    const webhook = await strapi.get("webhookStore").createWebhook(body);
+    strapi.get("webhookRunner").add(webhook);
     ctx.created({ data: webhook });
   },
   async updateWebhook(ctx) {
     const { id } = ctx.params;
     const { body } = ctx.request;
     await utils$1.validateYupSchema(updateWebhookValidator)(body);
-    const webhook = await strapi.webhookStore.findWebhook(id);
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
     if (!webhook) {
       return ctx.notFound("webhook.notFound");
     }
-    const updatedWebhook = await strapi.webhookStore.updateWebhook(id, {
+    const updatedWebhook = await strapi.get("webhookStore").updateWebhook(id, {
       ...webhook,
       ...body
     });
     if (!updatedWebhook) {
       return ctx.notFound("webhook.notFound");
     }
-    strapi.webhookRunner.update(updatedWebhook);
+    strapi.get("webhookRunner").update(updatedWebhook);
     ctx.send({ data: updatedWebhook });
   },
   async deleteWebhook(ctx) {
     const { id } = ctx.params;
-    const webhook = await strapi.webhookStore.findWebhook(id);
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
     if (!webhook) {
       return ctx.notFound("webhook.notFound");
     }
-    await strapi.webhookStore.deleteWebhook(id);
-    strapi.webhookRunner.remove(webhook);
+    await strapi.get("webhookStore").deleteWebhook(id);
+    strapi.get("webhookRunner").remove(webhook);
     ctx.body = { data: webhook };
   },
   async deleteWebhooks(ctx) {
@@ -5034,18 +5062,18 @@ const webhooks = {
       return ctx.badRequest("ids must be an array of id");
     }
     for (const id of ids) {
-      const webhook = await strapi.webhookStore.findWebhook(id);
+      const webhook = await strapi.get("webhookStore").findWebhook(id);
       if (webhook) {
-        await strapi.webhookStore.deleteWebhook(id);
-        strapi.webhookRunner.remove(webhook);
+        await strapi.get("webhookStore").deleteWebhook(id);
+        strapi.get("webhookRunner").remove(webhook);
       }
     }
     ctx.send({ data: ids });
   },
   async triggerWebhook(ctx) {
     const { id } = ctx.params;
-    const webhook = await strapi.webhookStore.findWebhook(id);
-    const response = await strapi.webhookRunner.run(webhook, "trigger-test", {});
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
+    const response = await strapi.get("webhookRunner").run(webhook, "trigger-test", {});
     ctx.body = { data: response };
   }
 };