@strapi/admin 5.0.0-beta.0 → 5.0.0-beta.10

package/dist/server/index.mjs

@@ -1,11 +1,12 @@
 import { merge, map, uniq, difference, isNil, castArray, pick, curry, pipe, prop, includes, isArray, set, omit, isEmpty, has, defaults, remove, eq, get, differenceWith, differenceBy, isEqual, toLower, isFunction, some, flatMap, isObject, cloneDeep, getOr, intersection, isPlainObject, matchesProperty, propEq, xor, startsWith, isString, isNumber, values, sumBy, trim, isUndefined, mapKeys } from "lodash/fp";
-import utils$1, { async, errors, yup, validateYupSchema, policy, arrays, convertQueryParams, hooks as hooks$1, dates, validateYupSchemaSync, providerFactory, sanitize, contentTypes, traverse, traverseEntity, validate, env, strings } from "@strapi/utils";
-import "@strapi/types";
+import utils$1, { async, errors, yup, validateYupSchema, policy, arrays, hooks as hooks$1, dates, validateYupSchemaSync, providerFactory, sanitize, contentTypes, traverse, traverseEntity, validate, env, validateZod, strings } from "@strapi/utils";
 import path, { resolve, basename, join, extname } from "path";
 import fse, { exists as exists$4 } from "fs-extra";
 import koaStatic from "koa-static";
 import { differenceInHours, parseISO } from "date-fns";
-import _$1, { pick as pick$1 } from "lodash";
+import "@strapi/types";
+import * as _ from "lodash";
+import ___default, { pick as pick$1 } from "lodash";
 import bcrypt from "bcryptjs";
 import passport$1 from "koa-passport";
 import { Strategy } from "passport-local";
@@ -18,6 +19,7 @@ import pmap from "p-map";
 import assert from "assert";
 import fs from "fs";
 import tsUtils from "@strapi/typescript-utils";
+import { z } from "zod";
 import compose from "koa-compose";
 import { strapi as strapi$1 } from "@strapi/data-transfer";
 const getService = (name2) => {
@@ -329,7 +331,7 @@ const bootstrap = async ({ strapi: strapi2 }) => {
   await userService.displayWarningIfUsersDontHaveRole();
   await syncAuthSettings();
   await syncAPITokensPermissions();
-  getService("metrics").sendUpdateProjectInformation(strapi2);
+  await getService("metrics").sendUpdateProjectInformation(strapi2);
   getService("metrics").startCron(strapi2);
   apiTokenService.checkSaltIsDefined();
   transferService.token.checkSaltIsDefined();
@@ -541,7 +543,7 @@ const apiTokenAuthStrategy = {
   verify: verify$2
 };
 const register$1 = ({ strapi: strapi2 }) => {
-  const passportMiddleware = strapi2.admin?.services.passport.init();
+  const passportMiddleware = strapi2.service("admin::passport").init();
   strapi2.server.api("admin").use(passportMiddleware);
   strapi2.get("auth").register("admin", adminAuthStrategy);
   strapi2.get("auth").register("content-api", apiTokenAuthStrategy);
@@ -583,10 +585,10 @@ const hasPermissionsSchema = yup.object({
   actions: yup.array().of(
     // @ts-expect-error yup types
     yup.lazy((val) => {
-      if (_$1.isArray(val)) {
+      if (___default.isArray(val)) {
         return yup.array().of(yup.string()).min(1).max(2);
       }
-      if (_$1.isString(val)) {
+      if (___default.isString(val)) {
         return yup.string().required();
       }
       return yup.object().shape({
@@ -600,16 +602,16 @@ const validateHasPermissionsInput = validateYupSchema(hasPermissionsSchema);
 const { createPolicy: createPolicy$1 } = policy;
 const inputModifiers = [
   {
-    check: _$1.isString,
+    check: ___default.isString,
     transform: (action2) => ({ action: action2 })
   },
   {
-    check: _$1.isArray,
+    check: ___default.isArray,
     transform: (arr) => ({ action: arr[0], subject: arr[1] })
   },
   {
     // Has to be after the isArray check since _.isObject also matches arrays
-    check: _$1.isObject,
+    check: ___default.isObject,
     transform: (perm) => perm
   }
 ];
@@ -1353,7 +1355,7 @@ const forgotPassword = async ({ email: email2 } = {}) => {
     strapi.config.get("admin.forgotPassword.emailTemplate"),
     {
       url,
-      user: _$1.pick(user2, ["email", "firstname", "lastname", "username"])
+      user: ___default.pick(user2, ["email", "firstname", "lastname", "username"])
     }
   ).catch((err) => {
     strapi.log.error(err);
@@ -1443,7 +1445,7 @@ const actionDomain = {
   sanitizeActionAttributes
 };
 const checkFieldsAreCorrectlyNested = (fields) => {
-  if (_$1.isNil(fields)) {
+  if (___default.isNil(fields)) {
     return true;
   }
   if (!Array.isArray(fields)) {
@@ -1460,13 +1462,13 @@ const checkFieldsAreCorrectlyNested = (fields) => {
   return !failed;
 };
 const checkFieldsDontHaveDuplicates = (fields) => {
-  if (_$1.isNil(fields)) {
+  if (___default.isNil(fields)) {
     return true;
   }
   if (!Array.isArray(fields)) {
     return false;
   }
-  return _$1.uniq(fields).length === fields.length;
+  return ___default.uniq(fields).length === fields.length;
 };
 const getActionFromProvider = (actionId) => {
   return getService("permission").actionProvider.get(actionId);
@@ -1481,10 +1483,10 @@ const isAPluginName = yup.string().test("is-a-plugin-name", "is not a plugin nam
   return [void 0, "admin", ...Object.keys(strapi.plugins)].includes(value) ? true : this.createError({ path: this.path, message: `${this.path} is not an existing plugin` });
 });
 const arrayOfConditionNames = yup.array().of(yup.string()).test("is-an-array-of-conditions", "is not a plugin name", function(value) {
-  const ids = strapi.admin.services.permission.conditionProvider.keys();
-  return _$1.isUndefined(value) || _$1.difference(value, ids).length === 0 ? true : this.createError({ path: this.path, message: `contains conditions that don't exist` });
+  const ids = strapi.service("admin::permission").conditionProvider.keys();
+  return ___default.isUndefined(value) || ___default.difference(value, ids).length === 0 ? true : this.createError({ path: this.path, message: `contains conditions that don't exist` });
 });
-const permissionsAreEquals = (a, b) => a.action === b.action && (a.subject === b.subject || _$1.isNil(a.subject) && _$1.isNil(b.subject));
+const permissionsAreEquals = (a, b) => a.action === b.action && (a.subject === b.subject || ___default.isNil(a.subject) && ___default.isNil(b.subject));
 const checkNoDuplicatedPermissions = (permissions2) => !Array.isArray(permissions2) || permissions2.every(
   (permA, i) => permissions2.slice(i + 1).every((permB) => !permissionsAreEquals(permA, permB))
 );
@@ -1591,10 +1593,10 @@ const validators = {
 };
 const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$2 } = constants$3;
 const { ValidationError: ValidationError$4 } = errors;
-const sanitizeUserRoles = (role2) => _$1.pick(role2, ["id", "name", "description", "code"]);
+const sanitizeUserRoles = (role2) => ___default.pick(role2, ["id", "name", "description", "code"]);
 const sanitizeUser = (user2) => {
   return {
-    ..._$1.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
+    ...___default.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
     roles: user2.roles && user2.roles.map(sanitizeUserRoles)
   };
 };
@@ -1603,7 +1605,7 @@ const create$5 = async (attributes) => {
     registrationToken: getService("token").createToken(),
     ...attributes
   };
-  if (_$1.has(attributes, "password")) {
+  if (___default.has(attributes, "password")) {
     userInfo.password = await getService("auth").hashPassword(attributes.password);
   }
   const user2 = createUser(userInfo);
@@ -1613,7 +1615,7 @@ const create$5 = async (attributes) => {
   return createdUser;
 };
 const updateById = async (id, attributes) => {
-  if (_$1.has(attributes, "roles")) {
+  if (___default.has(attributes, "roles")) {
     const lastAdminUser = await isLastSuperAdminUser(id);
     const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
     const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);
@@ -1627,7 +1629,7 @@ const updateById = async (id, attributes) => {
       throw new ValidationError$4("You must have at least one user with super admin role.");
     }
   }
-  if (_$1.has(attributes, "password")) {
+  if (___default.has(attributes, "password")) {
     const hashedPassword = await getService("auth").hashPassword(attributes.password);
     const updatedUser2 = await strapi.db.query("admin::user").update({
       where: { id },
@@ -1679,7 +1681,7 @@ const findRegistrationInfo = async (registrationToken) => {
   if (!user2) {
     return void 0;
   }
-  return _$1.pick(user2, ["email", "firstname", "lastname"]);
+  return ___default.pick(user2, ["email", "firstname", "lastname"]);
 };
 const register = async ({
   registrationToken,
@@ -1707,10 +1709,7 @@ const findOneByEmail = async (email2, populate = []) => {
   });
 };
 const findPage = async (params = {}) => {
-  const query = convertQueryParams.transformParamsToQuery(
-    "admin::user",
-    defaults({ populate: ["roles"] }, params)
-  );
+  const query = strapi.get("query-params").transform("admin::user", defaults({ populate: ["roles"] }, params));
   return strapi.db.query("admin::user").findPage(query);
 };
 const deleteById = async (id) => {
@@ -1947,7 +1946,7 @@ const create$3 = async (attributes) => {
       `The name must be unique and a role with name \`${attributes.name}\` already exists.`
     );
   }
-  const autoGeneratedCode = `${_$1.kebabCase(attributes.name)}-${dates.timestampCode()}`;
+  const autoGeneratedCode = `${___default.kebabCase(attributes.name)}-${dates.timestampCode()}`;
   const rolesWithCode = {
     ...attributes,
     code: attributes.code || autoGeneratedCode
@@ -1970,15 +1969,15 @@ const find = (params = {}, populate) => {
   return strapi.db.query("admin::role").findMany({ where: params, populate });
 };
 const findAllWithUsersCount = async (params) => {
-  const roles2 = await strapi.db.query("admin::role").findMany(convertQueryParams.transformParamsToQuery("admin::role", params));
+  const roles2 = await strapi.db.query("admin::role").findMany(strapi.get("query-params").transform("admin::role", params));
   for (const role2 of roles2) {
     role2.usersCount = await getUsersCount(role2.id);
   }
   return roles2;
 };
 const update$3 = async (params, attributes) => {
-  const sanitizedAttributes = _$1.omit(attributes, ["code"]);
-  if (_$1.has(params, "id") && _$1.has(sanitizedAttributes, "name")) {
+  const sanitizedAttributes = ___default.omit(attributes, ["code"]);
+  if (___default.has(params, "id") && ___default.has(sanitizedAttributes, "name")) {
     const alreadyExists = await exists$2({
       name: sanitizedAttributes.name,
       id: { $ne: params.id }
@@ -2160,7 +2159,7 @@ const resetSuperAdminPermissions = async () => {
   await assignPermissions(superAdminRole.id, transformedPermissions);
 };
 const hasSuperAdminRole = (user2) => {
-  const roles2 = _$1.get(user2, "roles", []);
+  const roles2 = ___default.get(user2, "roles", []);
   return roles2.map(prop("code")).includes(SUPER_ADMIN_CODE$1);
 };
 const constants$2 = {
@@ -2213,23 +2212,56 @@ const authEventsMapper = {
 };
 const valueIsFunctionType = ([, value]) => isFunction(value);
 const keyIsValidEventName = ([key]) => {
-  return Object.keys(strapi.admin.services.passport.authEventsMapper).includes(key);
+  return Object.keys(strapi.service("admin::passport").authEventsMapper).includes(key);
 };
 const getPassportStrategies = () => [createLocalStrategy(strapi)];
 const registerAuthEvents = () => {
   const { events = {} } = strapi.config.get("admin.auth", {});
-  const { authEventsMapper: authEventsMapper2 } = strapi.admin.services.passport;
+  const { authEventsMapper: authEventsMapper2 } = strapi.service("admin::passport");
   const eventList = Object.entries(events).filter(keyIsValidEventName).filter(valueIsFunctionType);
   for (const [eventName, handler] of eventList) {
     strapi.eventHub.on(authEventsMapper2[eventName], handler);
   }
 };
 const init = () => {
-  strapi.admin.services.passport.getPassportStrategies().forEach((strategy) => passport$1.use(strategy));
+  strapi.service("admin::passport").getPassportStrategies().forEach((strategy) => passport$1.use(strategy));
   registerAuthEvents();
   return passport$1.initialize();
 };
 const passport = { init, getPassportStrategies, authEventsMapper };
+const sendDidInviteUser = async () => {
+  const numberOfUsers = await getService("user").count();
+  const numberOfRoles = await getService("role").count();
+  strapi.telemetry.send("didInviteUser", {
+    groupProperties: { numberOfRoles, numberOfUsers }
+  });
+};
+const sendDidUpdateRolePermissions = async () => {
+  strapi.telemetry.send("didUpdateRolePermissions");
+};
+const sendDidChangeInterfaceLanguage = async () => {
+  const languagesInUse = await getService("user").getLanguagesInUse();
+  strapi.telemetry.send("didChangeInterfaceLanguage", { userProperties: { languagesInUse } });
+};
+const sendUpdateProjectInformation = async (strapi2) => {
+  const numberOfActiveAdminUsers = await getService("user").count({ isActive: true });
+  const numberOfAdminUsers = await getService("user").count();
+  strapi2.telemetry.send("didUpdateProjectInformation", {
+    groupProperties: { numberOfActiveAdminUsers, numberOfAdminUsers }
+  });
+};
+const startCron = (strapi2) => {
+  strapi2.cron.add({
+    "0 0 0 * * *": () => sendUpdateProjectInformation(strapi2)
+  });
+};
+const metrics = {
+  sendDidInviteUser,
+  sendDidUpdateRolePermissions,
+  sendDidChangeInterfaceLanguage,
+  sendUpdateProjectInformation,
+  startCron
+};
 const defaultJwtOptions = { expiresIn: "30d" };
 const getTokenOptions = () => {
   const { options, secret } = strapi.config.get(
@@ -2238,7 +2270,7 @@ const getTokenOptions = () => {
   );
   return {
     secret,
-    options: _$1.merge(defaultJwtOptions, options)
+    options: ___default.merge(defaultJwtOptions, options)
   };
 };
 const createToken = () => {
@@ -2444,48 +2476,46 @@ const STATIC_FIELDS$1 = [ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE$1];
 const createSanitizeHelpers = ({ action: action2, ability, model }) => {
   const schema = strapi.getModel(model);
   const { removeDisallowedFields } = sanitize.visitors;
+  const ctx = {
+    schema,
+    getModel: strapi.getModel.bind(strapi)
+  };
   const createSanitizeQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
     const sanitizeFilters = async.pipe(
-      traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, { schema }),
-      traverse.traverseQueryFilters(omitHiddenFields, { schema }),
-      traverse.traverseQueryFilters(removePassword, { schema }),
-      traverse.traverseQueryFilters(
-        ({ key, value }, { remove: remove2 }) => {
-          if (isObject(value) && isEmpty(value)) {
-            remove2(key);
-          }
-        },
-        { schema }
-      )
+      traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),
+      traverse.traverseQueryFilters(omitHiddenFields, ctx),
+      traverse.traverseQueryFilters(removePassword, ctx),
+      traverse.traverseQueryFilters(({ key, value }, { remove: remove2 }) => {
+        if (isObject(value) && isEmpty(value)) {
+          remove2(key);
+        }
+      }, ctx)
     );
     const sanitizeSort = async.pipe(
-      traverse.traverseQuerySort(removeDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQuerySort(omitDisallowedAdminUserFields, { schema }),
-      traverse.traverseQuerySort(omitHiddenFields, { schema }),
-      traverse.traverseQuerySort(removePassword, { schema }),
-      traverse.traverseQuerySort(
-        ({ key, attribute, value }, { remove: remove2 }) => {
-          if (!isScalarAttribute$1(attribute) && isEmpty(value)) {
-            remove2(key);
-          }
-        },
-        { schema }
-      )
+      traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),
+      traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),
+      traverse.traverseQuerySort(omitHiddenFields, ctx),
+      traverse.traverseQuerySort(removePassword, ctx),
+      traverse.traverseQuerySort(({ key, attribute, value }, { remove: remove2 }) => {
+        if (!isScalarAttribute$1(attribute) && isEmpty(value)) {
+          remove2(key);
+        }
+      }, ctx)
     );
     const sanitizePopulate = async.pipe(
-      traverse.traverseQueryPopulate(expandWildcardPopulate, { schema }),
-      traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, { schema }),
-      traverse.traverseQueryPopulate(omitHiddenFields, { schema }),
-      traverse.traverseQueryPopulate(removePassword, { schema })
+      traverse.traverseQueryPopulate(expandWildcardPopulate, ctx),
+      traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx),
+      traverse.traverseQueryPopulate(omitHiddenFields, ctx),
+      traverse.traverseQueryPopulate(removePassword, ctx)
     );
     const sanitizeFields = async.pipe(
-      traverse.traverseQueryFields(removeDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFields(omitHiddenFields, { schema }),
-      traverse.traverseQueryFields(removePassword, { schema })
+      traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFields(omitHiddenFields, ctx),
+      traverse.traverseQueryFields(removePassword, ctx)
     );
     return async (query) => {
       const sanitizedQuery = cloneDeep(query);
@@ -2509,13 +2539,18 @@ const createSanitizeHelpers = ({ action: action2, ability, model }) => {
     const permittedFields = fields.shouldIncludeAll ? null : getOutputFields(fields.permitted);
     return async.pipe(
       // Remove fields hidden from the admin
-      traverseEntity(omitHiddenFields, { schema }),
+      traverseEntity(omitHiddenFields, ctx),
       // Remove unallowed fields from admin::user relations
-      traverseEntity(pickAllowedAdminUserFields, { schema }),
+      traverseEntity(pickAllowedAdminUserFields, ctx),
       // Remove not allowed fields (RBAC)
-      traverseEntity(removeDisallowedFields(permittedFields), { schema }),
+      traverseEntity(removeDisallowedFields(permittedFields), ctx),
       // Remove all fields of type 'password'
-      sanitize.sanitizers.sanitizePasswords(schema)
+      sanitize.sanitizers.sanitizePasswords({
+        schema,
+        getModel(uid) {
+          return strapi.getModel(uid);
+        }
+      })
     );
   };
   const createSanitizeInput = (options = {}) => {
@@ -2523,10 +2558,10 @@ const createSanitizeHelpers = ({ action: action2, ability, model }) => {
     const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);
     return async.pipe(
       // Remove fields hidden from the admin
-      traverseEntity(omitHiddenFields, { schema }),
+      traverseEntity(omitHiddenFields, ctx),
       // Remove not allowed fields (RBAC)
-      traverseEntity(removeDisallowedFields(permittedFields), { schema }),
-      // Remove roles from createdBy & updateBy fields
+      traverseEntity(removeDisallowedFields(permittedFields), ctx),
+      // Remove roles from createdBy & updatedBy fields
       omitCreatorRoles
     );
   };
@@ -2569,6 +2604,9 @@ const createSanitizeHelpers = ({ action: action2, ability, model }) => {
   };
   const pickAllowedAdminUserFields = ({ attribute, key, value }, { set: set2 }) => {
     const pickAllowedFields = pick(ADMIN_USER_ALLOWED_FIELDS);
+    if (!attribute) {
+      return;
+    }
     if (attribute.type === "relation" && attribute.target === "admin::user" && value) {
       if (Array.isArray(value)) {
         set2(key, value.map(pickAllowedFields));
@@ -2637,50 +2675,48 @@ const {
 } = constants;
 const COMPONENT_FIELDS = ["__component"];
 const STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];
-const throwInvalidParam = ({ key, path: path2 }) => {
-  const msg = path2 && path2 !== key ? `Invalid parameter ${key} at ${path2}` : `Invalid parameter ${key}`;
+const throwInvalidKey = ({ key, path: path2 }) => {
+  const msg = path2 && path2 !== key ? `Invalid key ${key} at ${path2}` : `Invalid key ${key}`;
   throw new ValidationError$3(msg);
 };
 const createValidateHelpers = ({ action: action2, ability, model }) => {
   const schema = strapi.getModel(model);
+  const ctx = {
+    schema,
+    getModel: strapi.getModel.bind(strapi)
+  };
   const createValidateQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
     const validateFilters = async.pipe(
-      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, { schema }),
-      traverse.traverseQueryFilters(throwPassword, { schema }),
-      traverse.traverseQueryFilters(
-        ({ key, value, path: path2 }) => {
-          if (isObject(value) && isEmpty(value)) {
-            throwInvalidParam({ key, path: path2.attribute });
-          }
-        },
-        { schema }
-      )
+      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),
+      traverse.traverseQueryFilters(throwPassword, ctx),
+      traverse.traverseQueryFilters(({ key, value, path: path2 }) => {
+        if (isObject(value) && isEmpty(value)) {
+          throwInvalidKey({ key, path: path2.attribute });
+        }
+      }, ctx)
     );
     const validateSort = async.pipe(
-      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQuerySort(throwDisallowedAdminUserFields, { schema }),
-      traverse.traverseQuerySort(throwPassword, { schema }),
-      traverse.traverseQuerySort(
-        ({ key, attribute, value, path: path2 }) => {
-          if (!isScalarAttribute(attribute) && isEmpty(value)) {
-            throwInvalidParam({ key, path: path2.attribute });
-          }
-        },
-        { schema }
-      )
+      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),
+      traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),
+      traverse.traverseQuerySort(throwPassword, ctx),
+      traverse.traverseQuerySort(({ key, attribute, value, path: path2 }) => {
+        if (!isScalarAttribute(attribute) && isEmpty(value)) {
+          throwInvalidKey({ key, path: path2.attribute });
+        }
+      }, ctx)
     );
     const validateFields = async.pipe(
-      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryFields(throwPassword, { schema })
+      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryFields(throwPassword, ctx)
     );
     const validatePopulate = async.pipe(
-      traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), { schema }),
-      traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, { schema }),
-      traverse.traverseQueryPopulate(throwHiddenFields, { schema }),
-      traverse.traverseQueryPopulate(throwPassword, { schema })
+      traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), ctx),
+      traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, ctx),
+      traverse.traverseQueryPopulate(throwHiddenFields, ctx),
+      traverse.traverseQueryPopulate(throwPassword, ctx)
     );
     return async (query) => {
       if (query.filters) {
@@ -2703,9 +2739,9 @@ const createValidateHelpers = ({ action: action2, ability, model }) => {
     const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);
     return async.pipe(
       // Remove fields hidden from the admin
-      traverseEntity(throwHiddenFields, { schema }),
+      traverseEntity(throwHiddenFields, ctx),
       // Remove not allowed fields (RBAC)
-      traverseEntity(throwDisallowedFields(permittedFields), { schema }),
+      traverseEntity(throwDisallowedFields(permittedFields), ctx),
       // Remove roles from createdBy & updatedBy fields
       omitCreatorRoles
     );
@@ -2744,12 +2780,12 @@ const createValidateHelpers = ({ action: action2, ability, model }) => {
   const throwHiddenFields = ({ key, schema: schema2, path: path2 }) => {
     const isHidden = getOr(false, ["config", "attributes", key, "hidden"], schema2);
     if (isHidden) {
-      throwInvalidParam({ key, path: path2.attribute });
+      throwInvalidKey({ key, path: path2.attribute });
     }
   };
   const throwDisallowedAdminUserFields = ({ key, attribute, schema: schema2, path: path2 }) => {
     if (schema2.uid === "admin::user" && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {
-      throwInvalidParam({ key, path: path2.attribute });
+      throwInvalidKey({ key, path: path2.attribute });
     }
   };
   const getInputFields = (fields = []) => {
@@ -2788,7 +2824,7 @@ const operatorsMap = {
   $not: "$not"
 };
 const mapKey = (key) => {
-  if (_$1.isString(key) && key.startsWith("$") && key in operatorsMap) {
+  if (___default.isString(key) && key.startsWith("$") && key in operatorsMap) {
     return operatorsMap[key];
   }
   return key;
@@ -2800,26 +2836,26 @@ const buildStrapiQuery = (caslQuery) => {
   return unwrapDeep(caslQuery);
 };
 const unwrapDeep = (obj) => {
-  if (!_$1.isPlainObject(obj) && !_$1.isArray(obj)) {
+  if (!___default.isPlainObject(obj) && !___default.isArray(obj)) {
     return obj;
   }
-  if (_$1.isArray(obj)) {
+  if (___default.isArray(obj)) {
     return obj.map((v) => unwrapDeep(v));
   }
-  return _$1.reduce(
+  return ___default.reduce(
     obj,
     (acc, v, k) => {
       const key = mapKey(k);
-      if (_$1.isPlainObject(v)) {
+      if (___default.isPlainObject(v)) {
         if ("$elemMatch" in v) {
-          _$1.setWith(acc, key, unwrapDeep(v.$elemMatch));
+          ___default.setWith(acc, key, unwrapDeep(v.$elemMatch));
         } else {
-          _$1.setWith(acc, key, unwrapDeep(v));
+          ___default.setWith(acc, key, unwrapDeep(v));
         }
-      } else if (_$1.isArray(v)) {
-        _$1.setWith(acc, key, v.map((v2) => unwrapDeep(v2)));
+      } else if (___default.isArray(v)) {
+        ___default.setWith(acc, key, v.map((v2) => unwrapDeep(v2)));
       } else {
-        _$1.setWith(acc, key, v);
+        ___default.setWith(acc, key, v);
       }
       return acc;
     },
@@ -2840,7 +2876,7 @@ const index$4 = ({ ability, action: action2, model }) => ({
     return this.sanitizeInput(data, options);
   },
   getQuery(queryAction = action2) {
-    if (_$1.isUndefined(queryAction)) {
+    if (___default.isUndefined(queryAction)) {
       throw new Error("Action must be defined to build a permission query");
     }
     return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));
@@ -3006,7 +3042,9 @@ const createSectionBuilder = () => {
   };
 };
 const isOfKind = (kind) => matchesProperty("kind", kind);
-const resolveContentType = (uid) => strapi.contentTypes[uid];
+const resolveContentType = (uid) => {
+  return strapi.contentTypes[uid];
+};
 const isNotInSubjects = (subjects) => (uid) => !subjects.find((subject2) => subject2.uid === uid);
 const hasProperty = curry((property, subject2) => {
   return !!subject2.properties.find((prop2) => prop2.value === property);
@@ -3053,7 +3091,7 @@ const contentTypesBase = ({
   });
 };
 const subjectsHandlerFor = (kind) => ({ action: action2, section: contentTypesSection }) => {
-  const { subjects } = action2;
+  const subjects = action2.subjects;
   if (!subjects?.length) {
     return;
   }
@@ -3243,40 +3281,6 @@ const permission$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.define
   sanitizePermission,
   sectionsBuilder
 }, Symbol.toStringTag, { value: "Module" }));
-const sendDidInviteUser = async () => {
-  const numberOfUsers = await getService("user").count();
-  const numberOfRoles = await getService("role").count();
-  strapi.telemetry.send("didInviteUser", {
-    groupProperties: { numberOfRoles, numberOfUsers }
-  });
-};
-const sendDidUpdateRolePermissions = async () => {
-  strapi.telemetry.send("didUpdateRolePermissions");
-};
-const sendDidChangeInterfaceLanguage = async () => {
-  const languagesInUse = await getService("user").getLanguagesInUse();
-  strapi.telemetry.send("didChangeInterfaceLanguage", { userProperties: { languagesInUse } });
-};
-const sendUpdateProjectInformation = async (strapi2) => {
-  const numberOfActiveAdminUsers = await getService("user").count({ isActive: true });
-  const numberOfAdminUsers = await getService("user").count();
-  strapi2.telemetry.send("didUpdateProjectInformation", {
-    groupProperties: { numberOfActiveAdminUsers, numberOfAdminUsers }
-  });
-};
-const startCron = (strapi2) => {
-  strapi2.cron.add({
-    "0 0 0 * * *": () => sendUpdateProjectInformation(strapi2)
-  });
-};
-const metrics = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  sendDidChangeInterfaceLanguage,
-  sendDidInviteUser,
-  sendDidUpdateRolePermissions,
-  sendUpdateProjectInformation,
-  startCron
-}, Symbol.toStringTag, { value: "Module" }));
 const getNestedFields = (model, {
   prefix = "",
   nestingLevel = 15,
@@ -3288,7 +3292,7 @@ const getNestedFields = (model, {
     return prefix ? [prefix] : [];
   }
   const nonAuthorizableFields = contentTypes.getNonVisibleAttributes(model);
-  return _$1.reduce(
+  return ___default.reduce(
     model.attributes,
     (fields, attr, key) => {
       if (nonAuthorizableFields.includes(key))
@@ -3325,7 +3329,7 @@ const getNestedFieldsWithIntermediate = (model, { prefix = "", nestingLevel = 15
     return [];
   }
   const nonAuthorizableFields = contentTypes.getNonVisibleAttributes(model);
-  return _$1.reduce(
+  return ___default.reduce(
     model.attributes,
     (fields, attr, key) => {
       if (nonAuthorizableFields.includes(key))
@@ -3857,7 +3861,7 @@ const flattenTokenPermissions = (token2) => {
   };
 };
 const assertTokenPermissionsValidity = (attributes) => {
-  const permissionService = strapi.admin.services.transfer.permission;
+  const permissionService = strapi.service("admin::transfer").permission;
   const validPermissions = permissionService.providers.action.keys();
   const invalidPermissions = difference(attributes.permissions, validPermissions);
   if (!isEmpty(invalidPermissions)) {
@@ -3929,10 +3933,10 @@ const parseFilesData = async (files) => {
       if (!file) {
         return;
       }
-      const getStream = () => fs.createReadStream(file.path);
+      const getStream = () => fs.createReadStream(file.filepath);
       formatedFilesData[inputName] = await strapi.plugin("upload").service("upload").formatFileInfo({
-        filename: file.name,
-        type: file.type,
+        filename: file.originalFilename,
+        type: file.mimetype,
         size: file.size
       });
       Object.assign(
@@ -3941,7 +3945,7 @@ const parseFilesData = async (files) => {
       );
       Object.assign(formatedFilesData[inputName], {
         stream: getStream(),
-        tmpPath: file.path,
+        tmpPath: file.filepath,
         // TODO
         // @ts-expect-error define the correct return type
         provider: strapi.config.get("plugin::upload").provider
@@ -4058,31 +4062,30 @@ const index$3 = {
 const MAX_IMAGE_WIDTH = 750;
 const MAX_IMAGE_HEIGHT = MAX_IMAGE_WIDTH;
 const MAX_IMAGE_FILE_SIZE = 1024 * 1024;
-const ALLOWED_IMAGE_FILE_TYPES = ["image/jpeg", "image/png", "image/svg+xml"];
-const updateProjectSettings = yup.object({
-  menuLogo: yup.string(),
-  authLogo: yup.string()
-}).noUnknown();
-const updateProjectSettingsLogo = yup.object({
-  name: yup.string(),
-  type: yup.string().oneOf(ALLOWED_IMAGE_FILE_TYPES),
-  size: yup.number().max(MAX_IMAGE_FILE_SIZE)
+const updateProjectSettings = z.object({
+  menuLogo: z.string().nullish(),
+  authLogo: z.string().nullish()
+}).strict();
+const updateProjectSettingsLogo = z.object({
+  originalFilename: z.string().nullish(),
+  mimetype: z.enum(["image/jpeg", "image/png", "image/svg+xml"]),
+  size: z.number().max(MAX_IMAGE_FILE_SIZE).nullish()
 });
-const updateProjectSettingsFiles = yup.object({
-  menuLogo: updateProjectSettingsLogo,
-  authLogo: updateProjectSettingsLogo
-}).noUnknown();
-const logoDimensions = yup.object({
-  width: yup.number().max(MAX_IMAGE_WIDTH),
-  height: yup.number().max(MAX_IMAGE_HEIGHT)
+const updateProjectSettingsFiles = z.object({
+  menuLogo: updateProjectSettingsLogo.nullish(),
+  authLogo: updateProjectSettingsLogo.nullish()
+}).strict();
+const logoDimensions = z.object({
+  width: z.number().max(MAX_IMAGE_WIDTH).nullish(),
+  height: z.number().max(MAX_IMAGE_HEIGHT).nullish()
 });
-const updateProjectSettingsImagesDimensions = yup.object({
-  menuLogo: logoDimensions,
-  authLogo: logoDimensions
-}).noUnknown();
-const validateUpdateProjectSettings = validateYupSchemaSync(updateProjectSettings);
-const validateUpdateProjectSettingsFiles = validateYupSchemaSync(updateProjectSettingsFiles);
-const validateUpdateProjectSettingsImagesDimensions = validateYupSchemaSync(
+const updateProjectSettingsImagesDimensions = z.object({
+  menuLogo: logoDimensions.nullish(),
+  authLogo: logoDimensions.nullish()
+}).strict();
+const validateUpdateProjectSettings = validateZod(updateProjectSettings);
+const validateUpdateProjectSettingsFiles = validateZod(updateProjectSettingsFiles);
+const validateUpdateProjectSettingsImagesDimensions = validateZod(
   updateProjectSettingsImagesDimensions
 );
 const { isUsingTypeScript } = tsUtils;
@@ -4145,8 +4148,8 @@ const admin = {
       path.join(strapi.dirs.app.root, "src", "admin")
     );
     const isHostedOnStrapiCloud = env("STRAPI_HOSTING", null) === "strapi.cloud";
-    const numberOfAllContentTypes = _$1.size(strapi.contentTypes);
-    const numberOfComponents = _$1.size(strapi.components);
+    const numberOfAllContentTypes = ___default.size(strapi.contentTypes);
+    const numberOfComponents = ___default.size(strapi.components);
     const getNumberOfDynamicZones = () => {
       return pipe(
         map("attributes"),
@@ -4191,7 +4194,16 @@ const admin = {
   },
   async plugins(ctx) {
     const enabledPlugins = strapi.config.get("enabledPlugins");
-    const plugins2 = Object.entries(enabledPlugins).map(([key, plugin]) => ({
+    const CORE_PLUGINS = [
+      "content-manager",
+      "content-type-builder",
+      "email",
+      "upload",
+      "i18n",
+      "content-releases",
+      "review-workflows"
+    ];
+    const plugins2 = Object.entries(enabledPlugins).filter(([key]) => !CORE_PLUGINS.includes(key)).map(([key, plugin]) => ({
       name: plugin.info.name || key,
       displayName: plugin.info.displayName || plugin.info.name || key,
       description: plugin.info.description || "",
@@ -4562,7 +4574,7 @@ const roleCreateSchema = yup.object().shape({
 const rolesDeleteSchema = yup.object().shape({
   ids: yup.array().of(yup.strapiID()).min(1).required().test("roles-deletion-checks", "Roles deletion checks have failed", async function(ids) {
     try {
-      await strapi.admin.services.role.checkRolesIdForDeletion(ids);
+      await strapi.service("admin::role").checkRolesIdForDeletion(ids);
     } catch (e) {
       return this.createError({ path: "ids", message: e.message });
     }
@@ -4571,7 +4583,7 @@ const rolesDeleteSchema = yup.object().shape({
 }).noUnknown();
 const roleDeleteSchema = yup.strapiID().required().test("no-admin-single-delete", "Role deletion checks have failed", async function(id) {
   try {
-    await strapi.admin.services.role.checkRolesIdForDeletion([id]);
+    await strapi.service("admin::role").checkRolesIdForDeletion([id]);
   } catch (e) {
     return this.createError({ path: "id", message: e.message });
   }
@@ -4846,7 +4858,6 @@ const transfer = {
   ...prefixActionsName("runner", runner),
   ...prefixActionsName("token", token)
 };
-const _ = require("lodash");
 const { ApplicationError } = errors;
 const user = {
   async create(ctx) {
@@ -4873,7 +4884,7 @@ const user = {
   },
   async find(ctx) {
     const userService = getService("user");
-    const permissionsManager = strapi.admin.services.permission.createPermissionsManager({
+    const permissionsManager = strapi.service("admin::permission").createPermissionsManager({
       ability: ctx.state.userAbility,
       model: "admin::user"
     });
@@ -4952,7 +4963,7 @@ const webhookValidator = yup.object({
     }
     return yup.object(
       // @ts-expect-error lodash types
-      _$1.mapValues(data, () => {
+      ___default.mapValues(data, () => {
         yup.string().min(1).required();
       })
     ).required();
@@ -4964,12 +4975,12 @@ const updateWebhookValidator = webhookValidator.shape({
 });
 const webhooks = {
   async listWebhooks(ctx) {
-    const webhooks2 = await strapi.webhookStore.findWebhooks();
+    const webhooks2 = await strapi.get("webhookStore").findWebhooks();
     ctx.send({ data: webhooks2 });
   },
   async getWebhook(ctx) {
     const { id } = ctx.params;
-    const webhook = await strapi.webhookStore.findWebhook(id);
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
     if (!webhook) {
       return ctx.notFound("webhook.notFound");
     }
@@ -4978,36 +4989,36 @@ const webhooks = {
   async createWebhook(ctx) {
     const { body } = ctx.request;
     await validateYupSchema(webhookValidator)(body);
-    const webhook = await strapi.webhookStore.createWebhook(body);
-    strapi.webhookRunner.add(webhook);
+    const webhook = await strapi.get("webhookStore").createWebhook(body);
+    strapi.get("webhookRunner").add(webhook);
     ctx.created({ data: webhook });
   },
   async updateWebhook(ctx) {
     const { id } = ctx.params;
     const { body } = ctx.request;
     await validateYupSchema(updateWebhookValidator)(body);
-    const webhook = await strapi.webhookStore.findWebhook(id);
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
     if (!webhook) {
       return ctx.notFound("webhook.notFound");
     }
-    const updatedWebhook = await strapi.webhookStore.updateWebhook(id, {
+    const updatedWebhook = await strapi.get("webhookStore").updateWebhook(id, {
       ...webhook,
       ...body
     });
     if (!updatedWebhook) {
       return ctx.notFound("webhook.notFound");
     }
-    strapi.webhookRunner.update(updatedWebhook);
+    strapi.get("webhookRunner").update(updatedWebhook);
     ctx.send({ data: updatedWebhook });
   },
   async deleteWebhook(ctx) {
     const { id } = ctx.params;
-    const webhook = await strapi.webhookStore.findWebhook(id);
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
     if (!webhook) {
       return ctx.notFound("webhook.notFound");
     }
-    await strapi.webhookStore.deleteWebhook(id);
-    strapi.webhookRunner.remove(webhook);
+    await strapi.get("webhookStore").deleteWebhook(id);
+    strapi.get("webhookRunner").remove(webhook);
     ctx.body = { data: webhook };
   },
   async deleteWebhooks(ctx) {
@@ -5016,18 +5027,18 @@ const webhooks = {
       return ctx.badRequest("ids must be an array of id");
     }
     for (const id of ids) {
-      const webhook = await strapi.webhookStore.findWebhook(id);
+      const webhook = await strapi.get("webhookStore").findWebhook(id);
       if (webhook) {
-        await strapi.webhookStore.deleteWebhook(id);
-        strapi.webhookRunner.remove(webhook);
+        await strapi.get("webhookStore").deleteWebhook(id);
+        strapi.get("webhookRunner").remove(webhook);
       }
     }
     ctx.send({ data: ids });
   },
   async triggerWebhook(ctx) {
     const { id } = ctx.params;
-    const webhook = await strapi.webhookStore.findWebhook(id);
-    const response = await strapi.webhookRunner.run(webhook, "trigger-test", {});
+    const webhook = await strapi.get("webhookStore").findWebhook(id);
+    const response = await strapi.get("webhookRunner").run(webhook, "trigger-test", {});
     ctx.body = { data: response };
   }
 };