@strapi/admin 5.0.0-rc.3 → 5.0.0-rc.30

package/dist/server/index.mjs

@@ -1,14 +1,14 @@
-import { merge, map, uniq, difference, isNil, castArray, pick, curry, pipe, prop, includes, isArray, set, omit, isEmpty, has, defaults, remove, eq, get, differenceWith, differenceBy, isEqual, toLower, isFunction, some, flatMap, isObject, cloneDeep, getOr, intersection, isPlainObject, matchesProperty, propEq, xor, startsWith, isString, isNumber, values, sumBy, trim, isUndefined, mapKeys } from "lodash/fp";
-import utils$1, { async, errors, yup, validateYupSchema, policy, arrays, hooks as hooks$1, dates, validateYupSchemaSync, providerFactory, sanitize, contentTypes, traverse, traverseEntity, validate, env, validateZod, strings } from "@strapi/utils";
+import * as _ from "lodash";
+import ___default, { pick as pick$1 } from "lodash";
+import { merge, map, uniq, difference, isNil, castArray, pick, curry, pipe, prop, includes, isArray, set, omit, isEmpty, has, defaults, remove, eq, get, differenceWith, differenceBy, isEqual, toLower, isFunction, some, flatMap, isObject, cloneDeep, getOr, intersection, isPlainObject, matchesProperty, propEq, xor, startsWith, isString, isNumber, values, sumBy, trim, isUndefined, mapKeys, toString, toNumber, assign, reverse, take, drop, mapValues } from "lodash/fp";
+import utils$2, { async, errors, yup, validateYupSchema, policy, arrays, hooks as hooks$1, dates, validateYupSchemaSync, providerFactory, sanitize, contentTypes as contentTypes$1, traverse, traverseEntity, validate, env, validateZod, strings } from "@strapi/utils";
 import path, { resolve, basename, join, extname } from "path";
 import fse, { exists as exists$4 } from "fs-extra";
 import koaStatic from "koa-static";
 import { differenceInHours, parseISO } from "date-fns";
 import "@strapi/types";
-import * as _ from "lodash";
-import ___default, { pick as pick$1 } from "lodash";
 import bcrypt from "bcryptjs";
-import passport$1 from "koa-passport";
+import passport$2 from "koa-passport";
 import { Strategy } from "passport-local";
 import crypto from "crypto";
 import jwt from "jsonwebtoken";
@@ -24,10 +24,11 @@ import compose from "koa-compose";
 import { strapi as strapi$1 } from "@strapi/data-transfer";
 import isLocalhostIp from "is-localhost-ip";
 import punycode from "punycode/";
-const getService = (name2) => {
+import { scheduleJob } from "node-schedule";
+const getService$1 = (name2) => {
   return strapi.service(`admin::${name2}`);
 };
-const actions = [
+const actions$1 = [
   {
     uid: "marketplace.read",
     displayName: "Access the marketplace",
@@ -78,7 +79,13 @@ const actions = [
     pluginName: "admin",
     section: "settings",
     category: "users and roles",
-    subCategory: "users"
+    subCategory: "users",
+    aliases: [
+      {
+        actionId: "plugin::content-manager.explorer.read",
+        subjects: ["admin::user"]
+      }
+    ]
   },
   {
     uid: "users.update",
@@ -110,7 +117,13 @@ const actions = [
     pluginName: "admin",
     section: "settings",
     category: "users and roles",
-    subCategory: "roles"
+    subCategory: "roles",
+    aliases: [
+      {
+        actionId: "plugin::content-manager.explorer.read",
+        subjects: ["admin::role"]
+      }
+    ]
   },
   {
     uid: "roles.update",
@@ -240,7 +253,7 @@ const actions = [
   }
 ];
 const adminActions = {
-  actions
+  actions: actions$1
 };
 const conditions = [
   {
@@ -275,13 +288,13 @@ const defaultAdminAuthSettings = {
   }
 };
 const registerPermissionActions = async () => {
-  await getService("permission").actionProvider.registerMany(adminActions.actions);
+  await getService$1("permission").actionProvider.registerMany(adminActions.actions);
 };
 const registerAdminConditions = async () => {
-  await getService("permission").conditionProvider.registerMany(adminConditions.conditions);
+  await getService$1("permission").conditionProvider.registerMany(adminConditions.conditions);
 };
 const registerModelHooks = () => {
-  const { sendDidChangeInterfaceLanguage: sendDidChangeInterfaceLanguage2 } = getService("metrics");
+  const { sendDidChangeInterfaceLanguage: sendDidChangeInterfaceLanguage2 } = getService$1("metrics");
   strapi.db.lifecycles.subscribe({
     models: ["admin::user"],
     afterCreate: sendDidChangeInterfaceLanguage2,
@@ -297,7 +310,7 @@ const syncAuthSettings = async () => {
   const adminStore = await strapi.store({ type: "core", name: "admin" });
   const adminAuthSettings = await adminStore.get({ key: "auth" });
   const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);
-  const roleExists = await getService("role").exists({
+  const roleExists = await getService$1("role").exists({
     id: newAuthSettings.providers.defaultRole
   });
   if (!roleExists) {
@@ -316,16 +329,16 @@ const syncAPITokensPermissions = async () => {
     await strapi.db.query("admin::api-token-permission").deleteMany({ where: { action: { $in: unknownPermissions } } });
   }
 };
-const bootstrap = async ({ strapi: strapi2 }) => {
+const bootstrap$1 = async ({ strapi: strapi2 }) => {
   await registerAdminConditions();
   await registerPermissionActions();
   registerModelHooks();
-  const permissionService = getService("permission");
-  const userService = getService("user");
-  const roleService = getService("role");
-  const apiTokenService = getService("api-token");
-  const transferService = getService("transfer");
-  const tokenService = getService("token");
+  const permissionService = getService$1("permission");
+  const userService = getService$1("user");
+  const roleService = getService$1("role");
+  const apiTokenService = getService$1("api-token");
+  const transferService = getService$1("transfer");
+  const tokenService = getService$1("token");
   await roleService.createRolesIfNoneExist();
   await roleService.resetSuperAdminPermissions();
   await roleService.displayWarningIfNoSuperAdmin();
@@ -333,8 +346,8 @@ const bootstrap = async ({ strapi: strapi2 }) => {
   await userService.displayWarningIfUsersDontHaveRole();
   await syncAuthSettings();
   await syncAPITokensPermissions();
-  await getService("metrics").sendUpdateProjectInformation(strapi2);
-  getService("metrics").startCron(strapi2);
+  await getService$1("metrics").sendUpdateProjectInformation(strapi2);
+  getService$1("metrics").startCron(strapi2);
   apiTokenService.checkSaltIsDefined();
   transferService.token.checkSaltIsDefined();
   tokenService.checkSecretIsDefined();
@@ -391,7 +404,7 @@ const serveStatic = (filesDir, koaStaticOptions = {}) => {
     ctx.path = prev;
   };
 };
-const authenticate$2 = async (ctx) => {
+const authenticate$3 = async (ctx) => {
   const { authorization } = ctx.request.header;
   if (!authorization) {
     return { authenticated: false };
@@ -401,7 +414,7 @@ const authenticate$2 = async (ctx) => {
     return { authenticated: false };
   }
   const token2 = parts[1];
-  const { payload, isValid } = getService("token").decodeJwtToken(token2);
+  const { payload, isValid } = getService$1("token").decodeJwtToken(token2);
   if (!isValid) {
     return { authenticated: false };
   }
@@ -409,7 +422,7 @@ const authenticate$2 = async (ctx) => {
   if (!user2 || !(user2.isActive === true)) {
     return { authenticated: false };
   }
-  const userAbility = await getService("permission").engine.generateUserAbility(user2);
+  const userAbility = await getService$1("permission").engine.generateUserAbility(user2);
   ctx.state.userAbility = userAbility;
   ctx.state.user = user2;
   return {
@@ -421,7 +434,7 @@ const authenticate$2 = async (ctx) => {
 const name$1 = "admin";
 const adminAuthStrategy = {
   name: name$1,
-  authenticate: authenticate$2
+  authenticate: authenticate$3
 };
 const DAY_IN_MS = 24 * 60 * 60 * 1e3;
 const constants$3 = {
@@ -461,7 +474,7 @@ const constants$4 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineP
   __proto__: null,
   default: constants$3
 }, Symbol.toStringTag, { value: "Module" }));
-const { UnauthorizedError: UnauthorizedError$2, ForbiddenError: ForbiddenError$1 } = errors;
+const { UnauthorizedError: UnauthorizedError$3, ForbiddenError: ForbiddenError$2 } = errors;
 const isReadScope = (scope) => scope.endsWith("find") || scope.endsWith("findOne");
 const extractToken$1 = (ctx) => {
   if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
@@ -473,8 +486,8 @@ const extractToken$1 = (ctx) => {
   }
   return null;
 };
-const authenticate$1 = async (ctx) => {
-  const apiTokenService = getService("api-token");
+const authenticate$2 = async (ctx) => {
+  const apiTokenService = getService$1("api-token");
   const token2 = extractToken$1(ctx);
   if (!token2) {
     return { authenticated: false };
@@ -489,7 +502,7 @@ const authenticate$1 = async (ctx) => {
   if (!isNil(apiToken2.expiresAt)) {
     const expirationDate = new Date(apiToken2.expiresAt);
     if (expirationDate < currentDate) {
-      return { authenticated: false, error: new UnauthorizedError$2("Token expired") };
+      return { authenticated: false, error: new UnauthorizedError$3("Token expired") };
     }
   }
   const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken2.lastUsedAt));
@@ -507,44 +520,44 @@ const authenticate$1 = async (ctx) => {
   }
   return { authenticated: true, credentials: apiToken2 };
 };
-const verify$2 = (auth2, config) => {
+const verify$2 = (auth2, config2) => {
   const { credentials: apiToken2, ability } = auth2;
   if (!apiToken2) {
-    throw new UnauthorizedError$2("Token not found");
+    throw new UnauthorizedError$3("Token not found");
   }
   const currentDate = /* @__PURE__ */ new Date();
   if (!isNil(apiToken2.expiresAt)) {
     const expirationDate = new Date(apiToken2.expiresAt);
     if (expirationDate < currentDate) {
-      throw new UnauthorizedError$2("Token expired");
+      throw new UnauthorizedError$3("Token expired");
     }
   }
   if (apiToken2.type === constants$3.API_TOKEN_TYPE.FULL_ACCESS) {
     return;
   }
   if (apiToken2.type === constants$3.API_TOKEN_TYPE.READ_ONLY) {
-    const scopes = castArray(config.scope);
-    if (config.scope && scopes.every(isReadScope)) {
+    const scopes = castArray(config2.scope);
+    if (config2.scope && scopes.every(isReadScope)) {
       return;
     }
   } else if (apiToken2.type === constants$3.API_TOKEN_TYPE.CUSTOM) {
     if (!ability) {
-      throw new ForbiddenError$1();
+      throw new ForbiddenError$2();
     }
-    const scopes = castArray(config.scope);
+    const scopes = castArray(config2.scope);
     const isAllowed = scopes.every((scope) => ability.can(scope));
     if (isAllowed) {
       return;
     }
   }
-  throw new ForbiddenError$1();
+  throw new ForbiddenError$2();
 };
 const apiTokenAuthStrategy = {
   name: "api-token",
-  authenticate: authenticate$1,
+  authenticate: authenticate$2,
   verify: verify$2
 };
-const register$1 = ({ strapi: strapi2 }) => {
+const register$2 = ({ strapi: strapi2 }) => {
   const passportMiddleware = strapi2.service("admin::passport").init();
   strapi2.server.api("admin").use(passportMiddleware);
   strapi2.get("auth").register("admin", adminAuthStrategy);
@@ -553,8 +566,8 @@ const register$1 = ({ strapi: strapi2 }) => {
     registerAdminPanelRoute({ strapi: strapi2 });
   }
 };
-const destroy = async () => {
-  const { conditionProvider: conditionProvider2, actionProvider: actionProvider2 } = getService("permission");
+const destroy$1 = async () => {
+  const { conditionProvider: conditionProvider2, actionProvider: actionProvider2 } = getService$1("permission");
   await conditionProvider2.clear();
   await actionProvider2.clear();
 };
@@ -574,11 +587,11 @@ But don’t worry! You can use the following link to reset your password:
 
 Thanks.`;
 const forgotPasswordTemplate = { subject, text, html };
-const forgotPassword$1 = {
+const forgotPassword$2 = {
   emailTemplate: forgotPasswordTemplate
 };
-const index$6 = {
-  forgotPassword: forgotPassword$1
+const config = {
+  forgotPassword: forgotPassword$2
 };
 const isAuthenticatedAdmin = (policyCtx) => {
   return Boolean(policyCtx.state.isAuthenticated);
@@ -620,8 +633,8 @@ const inputModifiers = [
 const hasPermissions = createPolicy$1({
   name: "admin::hasPermissions",
   validator: validateHasPermissionsInput,
-  handler(ctx, config) {
-    const { actions: actions2 } = config;
+  handler(ctx, config2) {
+    const { actions: actions2 } = config2;
     const { userAbility: ability } = ctx.state;
     const permissions2 = actions2.map(
       (action2) => inputModifiers.find((modifier) => modifier.check(action2))?.transform(action2)
@@ -641,8 +654,8 @@ const isTelemetryEnabled = createPolicy({
     }
   }
 });
-const index$5 = { isAuthenticatedAdmin, hasPermissions, isTelemetryEnabled };
-const admin$1 = [
+const policies = { isAuthenticatedAdmin, hasPermissions, isTelemetryEnabled };
+const admin$4 = [
   {
     method: "GET",
     path: "/init",
@@ -711,7 +724,7 @@ const admin$1 = [
     }
   }
 ];
-const authentication$1 = [
+const authentication$2 = [
   {
     method: "POST",
     path: "/login",
@@ -1140,7 +1153,7 @@ const contentApi$1 = [
     }
   }
 ];
-const { UnauthorizedError: UnauthorizedError$1, ForbiddenError } = errors;
+const { UnauthorizedError: UnauthorizedError$2, ForbiddenError: ForbiddenError$1 } = errors;
 const extractToken = (ctx) => {
   if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
     const parts = ctx.request.header.authorization.split(/\s+/);
@@ -1151,8 +1164,8 @@ const extractToken = (ctx) => {
   }
   return null;
 };
-const authenticate = async (ctx) => {
-  const { token: tokenService } = getService("transfer");
+const authenticate$1 = async (ctx) => {
+  const { token: tokenService } = getService$1("transfer");
   const token2 = extractToken(ctx);
   if (!token2) {
     return { authenticated: false };
@@ -1165,7 +1178,7 @@ const authenticate = async (ctx) => {
   if (!isNil(transferToken2.expiresAt)) {
     const expirationDate = new Date(transferToken2.expiresAt);
     if (expirationDate < currentDate) {
-      return { authenticated: false, error: new UnauthorizedError$1("Token expired") };
+      return { authenticated: false, error: new UnauthorizedError$2("Token expired") };
     }
   }
   const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(transferToken2.lastUsedAt));
@@ -1175,36 +1188,36 @@ const authenticate = async (ctx) => {
       data: { lastUsedAt: currentDate }
     });
   }
-  const ability = await getService("transfer").permission.engine.generateAbility(
+  const ability = await getService$1("transfer").permission.engine.generateAbility(
     transferToken2.permissions.map((action2) => ({ action: action2 }))
   );
   return { authenticated: true, ability, credentials: transferToken2 };
 };
-const verify$1 = async (auth2, config = {}) => {
+const verify$1 = async (auth2, config2 = {}) => {
   const { credentials: transferToken2, ability } = auth2;
   if (!transferToken2) {
-    throw new UnauthorizedError$1("Token not found");
+    throw new UnauthorizedError$2("Token not found");
   }
   const currentDate = /* @__PURE__ */ new Date();
   if (!isNil(transferToken2.expiresAt)) {
     const expirationDate = new Date(transferToken2.expiresAt);
     if (expirationDate < currentDate) {
-      throw new UnauthorizedError$1("Token expired");
+      throw new UnauthorizedError$2("Token expired");
     }
   }
   if (!ability) {
-    throw new ForbiddenError();
+    throw new ForbiddenError$1();
   }
-  const scopes = castArray(config.scope ?? []);
+  const scopes = castArray(config2.scope ?? []);
   const isAllowed = scopes.every((scope) => ability.can(scope));
   if (!isAllowed) {
-    throw new ForbiddenError();
+    throw new ForbiddenError$1();
   }
 };
 const name = "data-transfer";
 const dataTransferAuthStrategy = {
   name,
-  authenticate,
+  authenticate: authenticate$1,
   verify: verify$1
 };
 const transfer$2 = [
@@ -1305,12 +1318,12 @@ const transfer$2 = [
     }
   }
 ];
-const routes = {
+const routes$1 = {
   admin: {
     type: "admin",
     routes: [
-      ...admin$1,
-      ...authentication$1,
+      ...admin$4,
+      ...authentication$2,
       ...permissions,
       ...users,
       ...roles$1,
@@ -1321,7 +1334,7 @@ const routes = {
     ]
   }
 };
-const { ApplicationError: ApplicationError$7 } = errors;
+const { ApplicationError: ApplicationError$a } = errors;
 const hashPassword = (password2) => bcrypt.hash(password2, 10);
 const validatePassword = (password2, hash2) => bcrypt.compare(password2, hash2);
 const checkCredentials = async ({ email: email2, password: password2 }) => {
@@ -1338,13 +1351,13 @@ const checkCredentials = async ({ email: email2, password: password2 }) => {
   }
   return [null, user2];
 };
-const forgotPassword = async ({ email: email2 } = {}) => {
+const forgotPassword$1 = async ({ email: email2 } = {}) => {
   const user2 = await strapi.db.query("admin::user").findOne({ where: { email: email2, isActive: true } });
   if (!user2) {
     return;
   }
-  const resetPasswordToken = getService("token").createToken();
-  await getService("user").updateById(user2.id, { resetPasswordToken });
+  const resetPasswordToken = getService$1("token").createToken();
+  await getService$1("user").updateById(user2.id, { resetPasswordToken });
   const url = `${strapi.config.get(
     "admin.absoluteUrl"
   )}/auth/reset-password?code=${resetPasswordToken}`;
@@ -1363,18 +1376,18 @@ const forgotPassword = async ({ email: email2 } = {}) => {
     strapi.log.error(err);
   });
 };
-const resetPassword = async ({ resetPasswordToken, password: password2 } = {}) => {
+const resetPassword$1 = async ({ resetPasswordToken, password: password2 } = {}) => {
   const matchingUser = await strapi.db.query("admin::user").findOne({ where: { resetPasswordToken, isActive: true } });
   if (!matchingUser) {
-    throw new ApplicationError$7();
+    throw new ApplicationError$a();
   }
-  return getService("user").updateById(matchingUser.id, {
+  return getService$1("user").updateById(matchingUser.id, {
     password: password2,
     resetPasswordToken: null
   });
 };
-const auth = { checkCredentials, validatePassword, hashPassword, forgotPassword, resetPassword };
-const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$3 } = constants$3;
+const auth$1 = { checkCredentials, validatePassword, hashPassword, forgotPassword: forgotPassword$1, resetPassword: resetPassword$1 };
+const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$5 } = constants$3;
 function createUser(attributes) {
   return {
     roles: [],
@@ -1384,7 +1397,7 @@ function createUser(attributes) {
   };
 }
 const hasSuperAdminRole$1 = (user2) => {
-  return user2.roles.filter((role2) => role2.code === SUPER_ADMIN_CODE$3).length > 0;
+  return user2.roles.filter((role2) => role2.code === SUPER_ADMIN_CODE$5).length > 0;
 };
 const ADMIN_USER_ALLOWED_FIELDS = ["id", "firstname", "lastname", "username"];
 const getDefaultActionAttributes = () => ({
@@ -1400,7 +1413,8 @@ const actionFields = [
   "pluginName",
   "subjects",
   "options",
-  "actionId"
+  "actionId",
+  "aliases"
 ];
 const sanitizeActionAttributes = pick(actionFields);
 const computeActionId = (attributes) => {
@@ -1473,7 +1487,7 @@ const checkFieldsDontHaveDuplicates = (fields) => {
   return ___default.uniq(fields).length === fields.length;
 };
 const getActionFromProvider = (actionId) => {
-  return getService("permission").actionProvider.get(actionId);
+  return getService$1("permission").actionProvider.get(actionId);
 };
 const email = yup.string().email().lowercase();
 const firstname = yup.string().trim().min(1);
@@ -1528,7 +1542,7 @@ const permission$3 = yup.object().shape({
     if (isNil(action2.subjects)) {
       return isNil(subject2);
     }
-    if (isArray(action2.subjects)) {
+    if (isArray(action2.subjects) && !isNil(subject2)) {
       return action2.subjects.includes(subject2);
     }
     return false;
@@ -1593,46 +1607,46 @@ const validators = {
   permission: permission$3,
   updatePermissions
 };
-const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$2 } = constants$3;
-const { ValidationError: ValidationError$4 } = errors;
-const sanitizeUserRoles = (role2) => ___default.pick(role2, ["id", "name", "description", "code"]);
-const sanitizeUser = (user2) => {
+const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$4 } = constants$3;
+const { ValidationError: ValidationError$6 } = errors;
+const sanitizeUserRoles$1 = (role2) => ___default.pick(role2, ["id", "name", "description", "code"]);
+const sanitizeUser$1 = (user2) => {
   return {
     ...___default.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
-    roles: user2.roles && user2.roles.map(sanitizeUserRoles)
+    roles: user2.roles && user2.roles.map(sanitizeUserRoles$1)
   };
 };
 const create$5 = async (attributes) => {
   const userInfo = {
-    registrationToken: getService("token").createToken(),
+    registrationToken: getService$1("token").createToken(),
     ...attributes
   };
   if (___default.has(attributes, "password")) {
-    userInfo.password = await getService("auth").hashPassword(attributes.password);
+    userInfo.password = await getService$1("auth").hashPassword(attributes.password);
   }
   const user2 = createUser(userInfo);
   const createdUser = await strapi.db.query("admin::user").create({ data: user2, populate: ["roles"] });
-  getService("metrics").sendDidInviteUser();
-  strapi.eventHub.emit("user.create", { user: sanitizeUser(createdUser) });
+  getService$1("metrics").sendDidInviteUser();
+  strapi.eventHub.emit("user.create", { user: sanitizeUser$1(createdUser) });
   return createdUser;
 };
-const updateById = async (id, attributes) => {
+const updateById$1 = async (id, attributes) => {
   if (___default.has(attributes, "roles")) {
-    const lastAdminUser = await isLastSuperAdminUser(id);
-    const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+    const lastAdminUser = await isLastSuperAdminUser$1(id);
+    const superAdminRole = await getService$1("role").getSuperAdminWithUsersCount();
     const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);
     if (lastAdminUser && willRemoveSuperAdminRole) {
-      throw new ValidationError$4("You must have at least one user with super admin role.");
+      throw new ValidationError$6("You must have at least one user with super admin role.");
     }
   }
   if (attributes.isActive === false) {
-    const lastAdminUser = await isLastSuperAdminUser(id);
+    const lastAdminUser = await isLastSuperAdminUser$1(id);
     if (lastAdminUser) {
-      throw new ValidationError$4("You must have at least one user with super admin role.");
+      throw new ValidationError$6("You must have at least one user with super admin role.");
     }
   }
   if (___default.has(attributes, "password")) {
-    const hashedPassword = await getService("auth").hashPassword(attributes.password);
+    const hashedPassword = await getService$1("auth").hashPassword(attributes.password);
     const updatedUser2 = await strapi.db.query("admin::user").update({
       where: { id },
       data: {
@@ -1641,7 +1655,7 @@ const updateById = async (id, attributes) => {
       },
       populate: ["roles"]
     });
-    strapi.eventHub.emit("user.update", { user: sanitizeUser(updatedUser2) });
+    strapi.eventHub.emit("user.update", { user: sanitizeUser$1(updatedUser2) });
     return updatedUser2;
   }
   const updatedUser = await strapi.db.query("admin::user").update({
@@ -1650,7 +1664,7 @@ const updateById = async (id, attributes) => {
     populate: ["roles"]
   });
   if (updatedUser) {
-    strapi.eventHub.emit("user.update", { user: sanitizeUser(updatedUser) });
+    strapi.eventHub.emit("user.update", { user: sanitizeUser$1(updatedUser) });
   }
   return updatedUser;
 };
@@ -1662,17 +1676,17 @@ const resetPasswordByEmail = async (email2, password$1) => {
   try {
     await password.validate(password$1);
   } catch (error) {
-    throw new ValidationError$4(
+    throw new ValidationError$6(
       "Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter"
     );
   }
-  await updateById(user2.id, { password: password$1 });
+  await updateById$1(user2.id, { password: password$1 });
 };
-const isLastSuperAdminUser = async (userId) => {
-  const user2 = await findOne$1(userId);
+const isLastSuperAdminUser$1 = async (userId) => {
+  const user2 = await findOne$2(userId);
   if (!user2)
     return false;
-  const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+  const superAdminRole = await getService$1("role").getSuperAdminWithUsersCount();
   return superAdminRole.usersCount === 1 && hasSuperAdminRole$1(user2);
 };
 const exists$3 = async (attributes = {}) => {
@@ -1685,15 +1699,15 @@ const findRegistrationInfo = async (registrationToken) => {
   }
   return ___default.pick(user2, ["email", "firstname", "lastname"]);
 };
-const register = async ({
+const register$1 = async ({
   registrationToken,
   userInfo
 }) => {
   const matchingUser = await strapi.db.query("admin::user").findOne({ where: { registrationToken } });
   if (!matchingUser) {
-    throw new ValidationError$4("Invalid registration info");
+    throw new ValidationError$6("Invalid registration info");
   }
-  return getService("user").updateById(matchingUser.id, {
+  return getService$1("user").updateById(matchingUser.id, {
     password: userInfo.password,
     firstname: userInfo.firstname,
     lastname: userInfo.lastname,
@@ -1701,7 +1715,7 @@ const register = async ({
     isActive: true
   });
 };
-const findOne$1 = async (id, populate = ["roles"]) => {
+const findOne$2 = async (id, populate = ["roles"]) => {
   return strapi.db.query("admin::user").findOne({ where: { id }, populate });
 };
 const findOneByEmail = async (email2, populate = []) => {
@@ -1714,7 +1728,7 @@ const findPage = async (params = {}) => {
   const query = strapi.get("query-params").transform("admin::user", defaults({ populate: ["roles"] }, params));
   return strapi.db.query("admin::user").findPage(query);
 };
-const deleteById = async (id) => {
+const deleteById$1 = async (id) => {
   const userToDelete = await strapi.db.query("admin::user").findOne({
     where: { id },
     populate: ["roles"]
@@ -1723,19 +1737,19 @@ const deleteById = async (id) => {
     return null;
   }
   if (userToDelete) {
-    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE$2)) {
-      const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE$4)) {
+      const superAdminRole = await getService$1("role").getSuperAdminWithUsersCount();
       if (superAdminRole.usersCount === 1) {
-        throw new ValidationError$4("You must have at least one user with super admin role.");
+        throw new ValidationError$6("You must have at least one user with super admin role.");
       }
     }
   }
   const deletedUser = await strapi.db.query("admin::user").delete({ where: { id }, populate: ["roles"] });
-  strapi.eventHub.emit("user.delete", { user: sanitizeUser(deletedUser) });
+  strapi.eventHub.emit("user.delete", { user: sanitizeUser$1(deletedUser) });
   return deletedUser;
 };
-const deleteByIds$2 = async (ids) => {
-  const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+const deleteByIds$3 = async (ids) => {
+  const superAdminRole = await getService$1("role").getSuperAdminWithUsersCount();
   const nbOfSuperAdminToDelete = await strapi.db.query("admin::user").count({
     where: {
       id: ids,
@@ -1743,7 +1757,7 @@ const deleteByIds$2 = async (ids) => {
     }
   });
   if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {
-    throw new ValidationError$4("You must have at least one user with super admin role.");
+    throw new ValidationError$6("You must have at least one user with super admin role.");
   }
   const deletedUsers = [];
   for (const id of ids) {
@@ -1754,7 +1768,7 @@ const deleteByIds$2 = async (ids) => {
     deletedUsers.push(deletedUser);
   }
   strapi.eventHub.emit("user.delete", {
-    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser))
+    users: deletedUsers.map((deletedUser) => sanitizeUser$1(deletedUser))
   });
   return deletedUsers;
 };
@@ -1796,18 +1810,18 @@ const getLanguagesInUse = async () => {
   const users2 = await strapi.db.query("admin::user").findMany({ select: ["preferedLanguage"] });
   return users2.map((user2) => user2.preferedLanguage || "en");
 };
-const user$1 = {
+const user$3 = {
   create: create$5,
-  updateById,
+  updateById: updateById$1,
   exists: exists$3,
   findRegistrationInfo,
-  register,
-  sanitizeUser,
-  findOne: findOne$1,
+  register: register$1,
+  sanitizeUser: sanitizeUser$1,
+  findOne: findOne$2,
   findOneByEmail,
   findPage,
-  deleteById,
-  deleteByIds: deleteByIds$2,
+  deleteById: deleteById$1,
+  deleteByIds: deleteByIds$3,
   countUsersWithoutRole,
   count: count$1,
   assignARoleToAll,
@@ -1897,7 +1911,7 @@ const checkPermissionsSchema = yup.object().shape({
   )
 });
 const checkPermissionsExist = function(permissions2) {
-  const existingActions = getService("permission").actionProvider.values();
+  const existingActions = getService$1("permission").actionProvider.values();
   const failIndex = permissions2.findIndex(
     (permission2) => !existingActions.some(
       (action2) => action2.actionId === permission2.action && (action2.section !== "contentTypes" || action2.subjects.includes(permission2.subject))
@@ -1919,9 +1933,9 @@ const actionsExistSchema = yup.array().of(
 const validatePermissionsExist = validateYupSchema(actionsExistSchema);
 const validateCheckPermissionsInput = validateYupSchema(checkPermissionsSchema);
 const validatedUpdatePermissionsInput = validateYupSchema(validators.updatePermissions);
-const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$1, CONTENT_TYPE_SECTION } = constants$3;
+const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$3, CONTENT_TYPE_SECTION } = constants$3;
 const { createAsyncSeriesWaterfallHook } = hooks$1;
-const { ApplicationError: ApplicationError$6 } = errors;
+const { ApplicationError: ApplicationError$9 } = errors;
 const hooks = {
   willResetSuperAdminPermissions: createAsyncSeriesWaterfallHook()
 };
@@ -1944,7 +1958,7 @@ const arePermissionsEqual = (p1, p2) => {
 const create$3 = async (attributes) => {
   const alreadyExists = await exists$2({ name: attributes.name });
   if (alreadyExists) {
-    throw new ApplicationError$6(
+    throw new ApplicationError$9(
       `The name must be unique and a role with name \`${attributes.name}\` already exists.`
     );
   }
@@ -1957,7 +1971,7 @@ const create$3 = async (attributes) => {
   strapi.eventHub.emit("role.create", { role: sanitizeRole(result) });
   return result;
 };
-const findOne = (params = {}, populate) => {
+const findOne$1 = (params = {}, populate) => {
   return strapi.db.query("admin::role").findOne({ where: params, populate });
 };
 const findOneWithUsersCount = async (params = {}, populate) => {
@@ -1985,7 +1999,7 @@ const update$3 = async (params, attributes) => {
       id: { $ne: params.id }
     });
     if (alreadyExists) {
-      throw new ApplicationError$6(
+      throw new ApplicationError$9(
         `The name must be unique and a role with name \`${sanitizedAttributes.name}\` already exists.`
       );
     }
@@ -2004,18 +2018,18 @@ const count = async (params = {}) => {
 const checkRolesIdForDeletion = async (ids = []) => {
   const superAdminRole = await getSuperAdmin();
   if (superAdminRole && arrays.includesString(ids, superAdminRole.id)) {
-    throw new ApplicationError$6("You cannot delete the super admin role");
+    throw new ApplicationError$9("You cannot delete the super admin role");
   }
   for (const roleId of ids) {
     const usersCount = await getUsersCount(roleId);
     if (usersCount !== 0) {
-      throw new ApplicationError$6("Some roles are still assigned to some users");
+      throw new ApplicationError$9("Some roles are still assigned to some users");
     }
   }
 };
-const deleteByIds$1 = async (ids = []) => {
+const deleteByIds$2 = async (ids = []) => {
   await checkRolesIdForDeletion(ids);
-  await getService("permission").deleteByRolesIds(ids);
+  await getService$1("permission").deleteByRolesIds(ids);
   const deletedRoles = [];
   for (const id of ids) {
     const deletedRole = await strapi.db.query("admin::role").delete({ where: { id } });
@@ -2029,14 +2043,14 @@ const deleteByIds$1 = async (ids = []) => {
 const getUsersCount = async (roleId) => {
   return strapi.db.query("admin::user").count({ where: { roles: { id: roleId } } });
 };
-const getSuperAdmin = () => findOne({ code: SUPER_ADMIN_CODE$1 });
-const getSuperAdminWithUsersCount = () => findOneWithUsersCount({ code: SUPER_ADMIN_CODE$1 });
+const getSuperAdmin = () => findOne$1({ code: SUPER_ADMIN_CODE$3 });
+const getSuperAdminWithUsersCount = () => findOneWithUsersCount({ code: SUPER_ADMIN_CODE$3 });
 const createRolesIfNoneExist = async () => {
   const someRolesExist = await exists$2();
   if (someRolesExist) {
     return;
   }
-  const { actionProvider: actionProvider2 } = getService("permission");
+  const { actionProvider: actionProvider2 } = getService$1("permission");
   const allActions = actionProvider2.values();
   const contentTypesActions = allActions.filter((a) => a.section === "contentTypes");
   const superAdminRole = await create$3({
@@ -2044,7 +2058,7 @@ const createRolesIfNoneExist = async () => {
     code: "strapi-super-admin",
     description: "Super Admins can access and manage all features and settings."
   });
-  await getService("user").assignARoleToAll(superAdminRole.id);
+  await getService$1("user").assignARoleToAll(superAdminRole.id);
   const editorRole = await create$3({
     name: "Editor",
     code: "strapi-editor",
@@ -2055,7 +2069,7 @@ const createRolesIfNoneExist = async () => {
     code: "strapi-author",
     description: "Authors can manage the content they have created."
   });
-  const editorPermissions = getService("content-type").getPermissionsWithNestedFields(
+  const editorPermissions = getService$1("content-type").getPermissionsWithNestedFields(
     contentTypesActions,
     {
       restrictedSubjects: ["plugin::users-permissions.user"]
@@ -2082,7 +2096,7 @@ const getDefaultPluginPermissions = ({ isAuthor = false } = {}) => {
 };
 const displayWarningIfNoSuperAdmin = async () => {
   const superAdminRole = await getSuperAdminWithUsersCount();
-  const someUsersExists = await getService("user").exists();
+  const someUsersExists = await getService$1("user").exists();
   if (!superAdminRole) {
     strapi.log.warn("Your application doesn't have a super admin role.");
   } else if (someUsersExists && superAdminRole.usersCount === 0) {
@@ -2091,12 +2105,12 @@ const displayWarningIfNoSuperAdmin = async () => {
 };
 const assignPermissions = async (roleId, permissions2 = []) => {
   await validatePermissionsExist(permissions2);
-  const internalActions = getService("permission").actionProvider.values().filter((action2) => action2.section === "internal").map((action2) => action2.actionId);
-  const superAdmin = await getService("role").getSuperAdmin();
+  const internalActions = getService$1("permission").actionProvider.values().filter((action2) => action2.section === "internal").map((action2) => action2.actionId);
+  const superAdmin = await getService$1("role").getSuperAdmin();
   const isSuperAdmin = superAdmin && superAdmin.id === roleId;
   const assignRole = set("role", roleId);
   const permissionsWithRole = permissions2.map(assignRole).map(permissionDomain.create);
-  const existingPermissions = await getService("permission").findMany({
+  const existingPermissions = await getService$1("permission").findMany({
     where: { role: { id: roleId } },
     populate: ["role"]
   });
@@ -2112,31 +2126,31 @@ const assignPermissions = async (roleId, permissions2 = []) => {
   ).filter((permission2) => !internalActions.includes(permission2.action));
   const permissionsToReturn = differenceBy("id", permissionsToDelete, existingPermissions);
   if (permissionsToDelete.length > 0) {
-    await getService("permission").deleteByIds(permissionsToDelete.map(prop("id")));
+    await getService$1("permission").deleteByIds(permissionsToDelete.map(prop("id")));
   }
   if (permissionsToAdd.length > 0) {
     const newPermissions = await addPermissions(roleId, permissionsToAdd);
     permissionsToReturn.push(...newPermissions);
   }
   if (!isSuperAdmin && (permissionsToAdd.length || permissionsToDelete.length)) {
-    await getService("metrics").sendDidUpdateRolePermissions();
+    await getService$1("metrics").sendDidUpdateRolePermissions();
   }
   return permissionsToReturn;
 };
 const addPermissions = async (roleId, permissions2) => {
-  const { conditionProvider: conditionProvider2, createMany: createMany2 } = getService("permission");
+  const { conditionProvider: conditionProvider2, createMany: createMany2 } = getService$1("permission");
   const { sanitizeConditions: sanitizeConditions2 } = permissionDomain;
   const permissionsWithRole = permissions2.map(set("role", roleId)).map(sanitizeConditions2(conditionProvider2)).map(permissionDomain.create);
   return createMany2(permissionsWithRole);
 };
 const isContentTypeAction = (action2) => action2.section === CONTENT_TYPE_SECTION;
 const resetSuperAdminPermissions = async () => {
-  const superAdminRole = await getService("role").getSuperAdmin();
+  const superAdminRole = await getService$1("role").getSuperAdmin();
   if (!superAdminRole) {
     return;
   }
-  const permissionService = getService("permission");
-  const contentTypeService = getService("content-type");
+  const permissionService = getService$1("permission");
+  const contentTypeService = getService$1("content-type");
   const allActions = permissionService.actionProvider.values();
   const contentTypesActions = allActions.filter((action2) => isContentTypeAction(action2));
   const otherActions = allActions.filter((action2) => !isContentTypeAction(action2));
@@ -2162,23 +2176,23 @@ const resetSuperAdminPermissions = async () => {
 };
 const hasSuperAdminRole = (user2) => {
   const roles2 = ___default.get(user2, "roles", []);
-  return roles2.map(prop("code")).includes(SUPER_ADMIN_CODE$1);
+  return roles2.map(prop("code")).includes(SUPER_ADMIN_CODE$3);
 };
 const constants$2 = {
-  superAdminCode: SUPER_ADMIN_CODE$1
+  superAdminCode: SUPER_ADMIN_CODE$3
 };
-const role$1 = {
+const role$3 = {
   hooks,
   sanitizeRole,
   create: create$3,
-  findOne,
+  findOne: findOne$1,
   findOneWithUsersCount,
   find,
   findAllWithUsersCount,
   update: update$3,
   exists: exists$2,
   count,
-  deleteByIds: deleteByIds$1,
+  deleteByIds: deleteByIds$2,
   getUsersCount,
   getSuperAdmin,
   getSuperAdminWithUsersCount,
@@ -2199,7 +2213,7 @@ const createLocalStrategy = (strapi2, middleware) => {
       session: false
     },
     (email2, password2, done) => {
-      return getService("auth").checkCredentials({ email: toLower(email2), password: password2 }).then(async ([error, user2, message]) => {
+      return getService$1("auth").checkCredentials({ email: toLower(email2), password: password2 }).then(async ([error, user2, message]) => {
         if (middleware) {
           return middleware([error, user2, message], done);
         }
@@ -2216,7 +2230,7 @@ const valueIsFunctionType = ([, value]) => isFunction(value);
 const keyIsValidEventName = ([key]) => {
   return Object.keys(strapi.service("admin::passport").authEventsMapper).includes(key);
 };
-const getPassportStrategies = () => [createLocalStrategy(strapi)];
+const getPassportStrategies$1 = () => [createLocalStrategy(strapi)];
 const registerAuthEvents = () => {
   const { events = {} } = strapi.config.get("admin.auth", {});
   const { authEventsMapper: authEventsMapper2 } = strapi.service("admin::passport");
@@ -2226,14 +2240,14 @@ const registerAuthEvents = () => {
   }
 };
 const init = () => {
-  strapi.service("admin::passport").getPassportStrategies().forEach((strategy) => passport$1.use(strategy));
+  strapi.service("admin::passport").getPassportStrategies().forEach((strategy) => passport$2.use(strategy));
   registerAuthEvents();
-  return passport$1.initialize();
+  return passport$2.initialize();
 };
-const passport = { init, getPassportStrategies, authEventsMapper };
+const passport$1 = { init, getPassportStrategies: getPassportStrategies$1, authEventsMapper };
 const sendDidInviteUser = async () => {
-  const numberOfUsers = await getService("user").count();
-  const numberOfRoles = await getService("role").count();
+  const numberOfUsers = await getService$1("user").count();
+  const numberOfRoles = await getService$1("role").count();
   strapi.telemetry.send("didInviteUser", {
     groupProperties: { numberOfRoles, numberOfUsers }
   });
@@ -2242,27 +2256,27 @@ const sendDidUpdateRolePermissions = async () => {
   strapi.telemetry.send("didUpdateRolePermissions");
 };
 const sendDidChangeInterfaceLanguage = async () => {
-  const languagesInUse = await getService("user").getLanguagesInUse();
+  const languagesInUse = await getService$1("user").getLanguagesInUse();
   strapi.telemetry.send("didChangeInterfaceLanguage", { userProperties: { languagesInUse } });
 };
-const sendUpdateProjectInformation = async (strapi2) => {
-  const numberOfActiveAdminUsers = await getService("user").count({ isActive: true });
-  const numberOfAdminUsers = await getService("user").count();
+const sendUpdateProjectInformation$1 = async (strapi2) => {
+  const numberOfActiveAdminUsers = await getService$1("user").count({ isActive: true });
+  const numberOfAdminUsers = await getService$1("user").count();
   strapi2.telemetry.send("didUpdateProjectInformation", {
     groupProperties: { numberOfActiveAdminUsers, numberOfAdminUsers }
   });
 };
-const startCron = (strapi2) => {
+const startCron$1 = (strapi2) => {
   strapi2.cron.add({
-    "0 0 0 * * *": () => sendUpdateProjectInformation(strapi2)
+    "0 0 0 * * *": () => sendUpdateProjectInformation$1(strapi2)
   });
 };
-const metrics = {
+const metrics$1 = {
   sendDidInviteUser,
   sendDidUpdateRolePermissions,
   sendDidChangeInterfaceLanguage,
-  sendUpdateProjectInformation,
-  startCron
+  sendUpdateProjectInformation: sendUpdateProjectInformation$1,
+  startCron: startCron$1
 };
 const defaultJwtOptions = { expiresIn: "30d" };
 const getTokenOptions = () => {
@@ -2347,11 +2361,17 @@ const registerProviderActionSchema = yup.array().required().of(
     }),
     options: yup.object({
       applyToProperties: yup.array().of(yup.string())
-    })
+    }),
+    aliases: yup.array(
+      yup.object({
+        actionId: yup.string(),
+        subjects: yup.array(yup.string()).nullable()
+      })
+    ).nullable()
   }).noUnknown()
 );
 const validateRegisterProviderAction = validateYupSchemaSync(registerProviderActionSchema);
-const { ApplicationError: ApplicationError$5 } = errors;
+const { ApplicationError: ApplicationError$8 } = errors;
 const createActionProvider = (options) => {
   const provider = providerFactory(options);
   const actionHooks = {
@@ -2381,7 +2401,7 @@ const createActionProvider = (options) => {
     async appliesToProperty(property, actionId, subject2) {
       const action2 = provider.get(actionId);
       if (!action2) {
-        throw new ApplicationError$5(`No action found with id "${actionId}"`);
+        throw new ApplicationError$8(`No action found with id "${actionId}"`);
       }
       const appliesToAction = actionDomain.appliesToProperty(property, action2);
       if (!appliesToAction) {
@@ -2399,6 +2419,29 @@ const createActionProvider = (options) => {
         subject: subject2
       });
       return results.every((result) => result !== false);
+    },
+    /**
+     * @experimental
+     */
+    unstable_aliases(actionId, subject2) {
+      const isRegistered = this.has(actionId);
+      if (!isRegistered) {
+        return [];
+      }
+      return this.values().filter(
+        (action2) => action2.aliases?.some((alias) => {
+          if (alias.actionId !== actionId) {
+            return false;
+          }
+          if (!Array.isArray(alias.subjects)) {
+            return true;
+          }
+          if (!subject2) {
+            return false;
+          }
+          return alias.subjects.includes(subject2);
+        })
+      ).map((action2) => action2.actionId);
     }
   };
 };
@@ -2463,7 +2506,7 @@ const {
   getNonVisibleAttributes: getNonVisibleAttributes$1,
   getNonWritableAttributes,
   getWritableAttributes: getWritableAttributes$1
-} = contentTypes;
+} = contentTypes$1;
 const {
   ID_ATTRIBUTE: ID_ATTRIBUTE$1,
   DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$1,
@@ -2663,9 +2706,9 @@ const createSanitizeHelpers = ({ action: action2, ability, model }) => {
     sanitizeQuery: wrapSanitize(createSanitizeQuery)
   };
 };
-const { ValidationError: ValidationError$3 } = errors;
+const { ValidationError: ValidationError$5 } = errors;
 const { throwPassword, throwDisallowedFields } = validate.visitors;
-const { constants, isScalarAttribute, getNonVisibleAttributes, getWritableAttributes } = contentTypes;
+const { constants, isScalarAttribute, getNonVisibleAttributes, getWritableAttributes } = contentTypes$1;
 const {
   ID_ATTRIBUTE,
   DOC_ID_ATTRIBUTE,
@@ -2679,7 +2722,7 @@ const COMPONENT_FIELDS = ["__component"];
 const STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];
 const throwInvalidKey = ({ key, path: path2 }) => {
   const msg = path2 && path2 !== key ? `Invalid key ${key} at ${path2}` : `Invalid key ${key}`;
-  throw new ValidationError$3(msg);
+  throw new ValidationError$5(msg);
 };
 const createValidateHelpers = ({ action: action2, ability, model }) => {
   const schema = strapi.getModel(model);
@@ -2864,7 +2907,7 @@ const unwrapDeep = (obj) => {
     {}
   );
 };
-const index$4 = ({ ability, action: action2, model }) => ({
+const index = ({ ability, action: action2, model }) => ({
   ability,
   action: action2,
   model,
@@ -2937,7 +2980,7 @@ const createPermissionEngine = (params) => {
      * @param user
      */
     async generateUserAbility(user2) {
-      const permissions2 = await getService("permission").findUserPermissions(user2);
+      const permissions2 = await getService$1("permission").findUserPermissions(user2);
       return engine2.generateAbility(permissions2, user2);
     },
     /**
@@ -3057,7 +3100,7 @@ const toSubjectTemplate = (ct) => ({
   label: ct.info.singularName,
   properties: []
 });
-const { isVisibleAttribute } = contentTypes;
+const { isVisibleAttribute } = contentTypes$1;
 const settings = ({ action: action2, section }) => {
   const { category, subCategory, displayName, actionId } = action2;
   section.push({
@@ -3167,10 +3210,10 @@ const deleteByRolesIds = async (rolesIds) => {
     }
   });
   if (permissionsToDelete.length > 0) {
-    await deleteByIds(permissionsToDelete.map(prop("id")));
+    await deleteByIds$1(permissionsToDelete.map(prop("id")));
   }
 };
-const deleteByIds = async (ids) => {
+const deleteByIds$1 = async (ids) => {
   const result = [];
   for (const id of ids) {
     const queryResult = await strapi.db.query("admin::permission").delete({ where: { id } });
@@ -3202,7 +3245,7 @@ const findUserPermissions = async (user2) => {
   return findMany({ where: { role: { users: { id: user2.id } } } });
 };
 const filterPermissionsToRemove = async (permissions2) => {
-  const { actionProvider: actionProvider2 } = getService("permission");
+  const { actionProvider: actionProvider2 } = getService$1("permission");
   const permissionsToRemove = [];
   for (const permission2 of permissions2) {
     const { subjects, options = {} } = actionProvider2.get(permission2.action) || {};
@@ -3228,7 +3271,7 @@ const filterPermissionsToRemove = async (permissions2) => {
 };
 const cleanPermissionsInDatabase = async () => {
   const pageSize = 200;
-  const contentTypeService = getService("content-type");
+  const contentTypeService = getService$1("content-type");
   const total = await strapi.db.query("admin::permission").count();
   const pageCount = Math.ceil(total / pageSize);
   for (let page = 0; page < pageCount; page += 1) {
@@ -3253,7 +3296,7 @@ const cleanPermissionsInDatabase = async () => {
       return update$2({ id: permission2.id }, permission2);
     };
     await Promise.all([
-      deleteByIds(permissionsIdToRemove),
+      deleteByIds$1(permissionsIdToRemove),
       pmap(permissionsNeedingToBeUpdated, updatePromiseProvider, {
         concurrency: 100,
         stopOnError: true
@@ -3274,8 +3317,8 @@ const permission$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.define
   cleanPermissionsInDatabase,
   conditionProvider,
   createMany,
-  createPermissionsManager: index$4,
-  deleteByIds,
+  createPermissionsManager: index,
+  deleteByIds: deleteByIds$1,
   deleteByRolesIds,
   engine: engine$1,
   findMany,
@@ -3293,7 +3336,7 @@ const getNestedFields = (model, {
   if (nestingLevel === 0) {
     return prefix ? [prefix] : [];
   }
-  const nonAuthorizableFields = contentTypes.getNonVisibleAttributes(model);
+  const nonAuthorizableFields = contentTypes$1.getNonVisibleAttributes(model);
   return ___default.reduce(
     model.attributes,
     (fields, attr, key) => {
@@ -3330,7 +3373,7 @@ const getNestedFieldsWithIntermediate = (model, { prefix = "", nestingLevel = 15
   if (nestingLevel === 0) {
     return [];
   }
-  const nonAuthorizableFields = contentTypes.getNonVisibleAttributes(model);
+  const nonAuthorizableFields = contentTypes$1.getNonVisibleAttributes(model);
   return ___default.reduce(
     model.attributes,
     (fields, attr, key) => {
@@ -3372,7 +3415,7 @@ const getPermissionsWithNestedFields = (actions2, { nestingLevel, restrictedSubj
   }, []);
 };
 const cleanPermissionFields = (permissions2, { nestingLevel } = {}) => {
-  const { actionProvider: actionProvider2 } = getService("permission");
+  const { actionProvider: actionProvider2 } = getService$1("permission");
   return permissions2.map((permission2) => {
     const {
       action: actionId,
@@ -3411,7 +3454,7 @@ const contentType = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineP
   getPermissionsWithNestedFields
 }, Symbol.toStringTag, { value: "Module" }));
 const isValidCondition = (condition2) => {
-  const { conditionProvider: conditionProvider2 } = getService("permission");
+  const { conditionProvider: conditionProvider2 } = getService$1("permission");
   return isString(condition2) && conditionProvider2.has(condition2);
 };
 const condition = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -3421,9 +3464,9 @@ const condition = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePro
 const { AUTHOR_CODE, PUBLISH_ACTION } = constants$3;
 const { NotFoundError: NotFoundError$2 } = errors;
 const getAllowedActionsForRole = async (roleId) => {
-  const { actionProvider: actionProvider2 } = getService("permission");
+  const { actionProvider: actionProvider2 } = getService$1("permission");
   if (!isNil(roleId)) {
-    const role2 = await getService("role").findOne({ id: roleId });
+    const role2 = await getService$1("role").findOne({ id: roleId });
     if (!role2) {
       throw new NotFoundError$2("role.notFound");
     }
@@ -3437,7 +3480,7 @@ const action = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProper
   __proto__: null,
   getAllowedActionsForRole
 }, Symbol.toStringTag, { value: "Module" }));
-const { ValidationError: ValidationError$2, NotFoundError: NotFoundError$1 } = errors;
+const { ValidationError: ValidationError$4, NotFoundError: NotFoundError$1 } = errors;
 const SELECT_FIELDS$1 = [
   "id",
   "name",
@@ -3452,16 +3495,16 @@ const SELECT_FIELDS$1 = [
 const POPULATE_FIELDS$1 = ["permissions"];
 const assertCustomTokenPermissionsValidity = (type, permissions2) => {
   if (type !== constants$3.API_TOKEN_TYPE.CUSTOM && !isEmpty(permissions2)) {
-    throw new ValidationError$2("Non-custom tokens should not reference permissions");
+    throw new ValidationError$4("Non-custom tokens should not reference permissions");
   }
   if (type === constants$3.API_TOKEN_TYPE.CUSTOM && !isArray(permissions2)) {
-    throw new ValidationError$2("Missing permissions attribute for custom token");
+    throw new ValidationError$4("Missing permissions attribute for custom token");
   }
   if (type === constants$3.API_TOKEN_TYPE.CUSTOM) {
     const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
     const invalidPermissions = difference(permissions2, validPermissions);
     if (!isEmpty(invalidPermissions)) {
-      throw new ValidationError$2(`Unknown permissions provided: ${invalidPermissions.join(", ")}`);
+      throw new ValidationError$4(`Unknown permissions provided: ${invalidPermissions.join(", ")}`);
     }
   }
 };
@@ -3476,7 +3519,7 @@ const isValidLifespan$1 = (lifespan) => {
 };
 const assertValidLifespan$1 = (lifespan) => {
   if (!isValidLifespan$1(lifespan)) {
-    throw new ValidationError$2(
+    throw new ValidationError$4(
       `lifespan must be one of the following values:
       ${Object.values(constants$3.API_TOKEN_LIFESPANS).join(", ")}`
     );
@@ -3511,7 +3554,7 @@ const hash$1 = (accessKey) => {
 const getExpirationFields$1 = (lifespan) => {
   const isValidNumber = isNumber(lifespan) && Number.isFinite(lifespan) && lifespan > 0;
   if (!isValidNumber && !isNil(lifespan)) {
-    throw new ValidationError$2("lifespan must be a positive number or null");
+    throw new ValidationError$4("lifespan must be a positive number or null");
   }
   return {
     lifespan: lifespan || null,
@@ -3675,7 +3718,7 @@ const permission$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.define
   engine,
   providers
 }, Symbol.toStringTag, { value: "Module" }));
-const { ValidationError: ValidationError$1, NotFoundError } = errors;
+const { ValidationError: ValidationError$3, NotFoundError } = errors;
 const TRANSFER_TOKEN_UID = "admin::transfer-token";
 const TRANSFER_TOKEN_PERMISSION_UID = "admin::transfer-token-permission";
 const SELECT_FIELDS = [
@@ -3826,7 +3869,7 @@ const regenerate = async (id) => {
 const getExpirationFields = (lifespan) => {
   const isValidNumber = isNumber(lifespan) && Number.isFinite(lifespan) && lifespan > 0;
   if (!isValidNumber && !isNil(lifespan)) {
-    throw new ValidationError$1("lifespan must be a positive number or null");
+    throw new ValidationError$3("lifespan must be a positive number or null");
   }
   return {
     lifespan: lifespan || null,
@@ -3834,14 +3877,14 @@ const getExpirationFields = (lifespan) => {
   };
 };
 const hash = (accessKey) => {
-  const { hasValidTokenSalt: hasValidTokenSalt2 } = getService("transfer").utils;
+  const { hasValidTokenSalt: hasValidTokenSalt2 } = getService$1("transfer").utils;
   if (!hasValidTokenSalt2()) {
     throw new TypeError("Required token salt is not defined");
   }
   return crypto.createHmac("sha512", strapi.config.get("admin.transfer.token.salt")).update(accessKey).digest("hex");
 };
 const checkSaltIsDefined = () => {
-  const { hasValidTokenSalt: hasValidTokenSalt2 } = getService("transfer").utils;
+  const { hasValidTokenSalt: hasValidTokenSalt2 } = getService$1("transfer").utils;
   if (!strapi.config.get("server.transfer.remote.enabled")) {
     return;
   }
@@ -3867,7 +3910,7 @@ const assertTokenPermissionsValidity = (attributes) => {
   const validPermissions = permissionService.providers.action.keys();
   const invalidPermissions = difference(attributes.permissions, validPermissions);
   if (!isEmpty(invalidPermissions)) {
-    throw new ValidationError$1(`Unknown permissions provided: ${invalidPermissions.join(", ")}`);
+    throw new ValidationError$3(`Unknown permissions provided: ${invalidPermissions.join(", ")}`);
   }
 };
 const isValidLifespan = (lifespan) => {
@@ -3881,7 +3924,7 @@ const isValidLifespan = (lifespan) => {
 };
 const assertValidLifespan = (lifespan) => {
   if (!isValidLifespan(lifespan)) {
-    throw new ValidationError$1(
+    throw new ValidationError$3(
       `lifespan must be one of the following values:
       ${Object.values(constants$3.TRANSFER_TOKEN_LIFESPANS).join(", ")}`
     );
@@ -3907,7 +3950,7 @@ const hasValidTokenSalt = () => {
   return typeof salt === "string" && salt.length > 0;
 };
 const isRemoteTransferEnabled = () => {
-  const { utils: utils2 } = getService("transfer");
+  const { utils: utils2 } = getService$1("transfer");
   if (env.bool("STRAPI_DISABLE_REMOTE_DATA_TRANSFER") !== void 0) {
     strapi.log.warn(
       "STRAPI_DISABLE_REMOTE_DATA_TRANSFER is no longer supported. Instead, set transfer.remote.enabled to false in your server configuration"
@@ -3915,7 +3958,7 @@ const isRemoteTransferEnabled = () => {
   }
   return utils2.hasValidTokenSalt() && strapi.config.get("server.transfer.remote.enabled");
 };
-const utils = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+const utils$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
   hasValidTokenSalt,
   isRemoteTransferEnabled
@@ -3924,7 +3967,7 @@ const transfer$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
   __proto__: null,
   permission: permission$1,
   token: token$2,
-  utils
+  utils: utils$1
 }, Symbol.toStringTag, { value: "Module" }));
 const PROJECT_SETTINGS_FILE_INPUTS = ["menuLogo", "authLogo"];
 const parseFilesData = async (files) => {
@@ -4045,14 +4088,14 @@ const projectSettings = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.def
   parseFilesData,
   updateProjectSettings: updateProjectSettings$1
 }, Symbol.toStringTag, { value: "Module" }));
-const index$3 = {
-  auth,
-  user: user$1,
-  role: role$1,
-  passport,
+const services$1 = {
+  auth: auth$1,
+  user: user$3,
+  role: role$3,
+  passport: passport$1,
   token: token$3,
   permission: permission$2,
-  metrics,
+  metrics: metrics$1,
   "content-type": contentType,
   constants: constants$4,
   condition,
@@ -4091,7 +4134,7 @@ const validateUpdateProjectSettingsImagesDimensions = validateZod(
   updateProjectSettingsImagesDimensions
 );
 const { isUsingTypeScript } = tsUtils;
-const admin = {
+const admin$3 = {
   // TODO very temporary to check the switch ee/ce
   // When removing this we need to update the /admin/src/index.js file
   // whe,re we set the strapi.window.isEE value
@@ -4103,8 +4146,8 @@ const admin = {
   },
   async init() {
     let uuid = strapi.config.get("uuid", false);
-    const hasAdmin = await getService("user").exists();
-    const { menuLogo, authLogo } = await getService("project-settings").getProjectSettings();
+    const hasAdmin = await getService$1("user").exists();
+    const { menuLogo, authLogo } = await getService$1("project-settings").getProjectSettings();
     const telemetryDisabled = strapi.config.get(
       "packageJsonStrapi.telemetryDisabled",
       null
@@ -4122,7 +4165,7 @@ const admin = {
     };
   },
   async getProjectSettings() {
-    return getService(
+    return getService$1(
       "project-settings"
     ).getProjectSettings();
   },
@@ -4130,7 +4173,7 @@ const admin = {
     const {
       request: { files, body }
     } = ctx;
-    const projectSettingsService = getService("project-settings");
+    const projectSettingsService = getService$1("project-settings");
     await validateUpdateProjectSettings(body);
     await validateUpdateProjectSettingsFiles(files);
     const formatedFiles = await projectSettingsService.parseFilesData(files);
@@ -4229,11 +4272,11 @@ const apiTokenUpdateSchema = yup.object().shape({
 }).noUnknown().strict();
 const validateApiTokenCreationInput = validateYupSchema(apiTokenCreationSchema);
 const validateApiTokenUpdateInput = validateYupSchema(apiTokenUpdateSchema);
-const { ApplicationError: ApplicationError$4 } = errors;
+const { ApplicationError: ApplicationError$7 } = errors;
 const apiToken$1 = {
   async create(ctx) {
     const { body } = ctx.request;
-    const apiTokenService = getService("api-token");
+    const apiTokenService = getService$1("api-token");
     const attributes = {
       name: trim(body.name),
       description: trim(body.description),
@@ -4244,14 +4287,14 @@ const apiToken$1 = {
     await validateApiTokenCreationInput(attributes);
     const alreadyExists = await apiTokenService.exists({ name: attributes.name });
     if (alreadyExists) {
-      throw new ApplicationError$4("Name already taken");
+      throw new ApplicationError$7("Name already taken");
     }
     const apiToken2 = await apiTokenService.create(attributes);
     ctx.created({ data: apiToken2 });
   },
   async regenerate(ctx) {
     const { id } = ctx.params;
-    const apiTokenService = getService("api-token");
+    const apiTokenService = getService$1("api-token");
     const apiTokenExists = await apiTokenService.getById(id);
     if (!apiTokenExists) {
       ctx.notFound("API Token not found");
@@ -4261,19 +4304,19 @@ const apiToken$1 = {
     ctx.created({ data: accessToken });
   },
   async list(ctx) {
-    const apiTokenService = getService("api-token");
+    const apiTokenService = getService$1("api-token");
     const apiTokens2 = await apiTokenService.list();
     ctx.send({ data: apiTokens2 });
   },
   async revoke(ctx) {
     const { id } = ctx.params;
-    const apiTokenService = getService("api-token");
+    const apiTokenService = getService$1("api-token");
     const apiToken2 = await apiTokenService.revoke(id);
     ctx.deleted({ data: apiToken2 });
   },
   async get(ctx) {
     const { id } = ctx.params;
-    const apiTokenService = getService("api-token");
+    const apiTokenService = getService$1("api-token");
     const apiToken2 = await apiTokenService.getById(id);
     if (!apiToken2) {
       ctx.notFound("API Token not found");
@@ -4284,7 +4327,7 @@ const apiToken$1 = {
   async update(ctx) {
     const { body } = ctx.request;
     const { id } = ctx.params;
-    const apiTokenService = getService("api-token");
+    const apiTokenService = getService$1("api-token");
     const attributes = body;
     if (has("name", attributes)) {
       attributes.name = trim(body.name);
@@ -4300,14 +4343,14 @@ const apiToken$1 = {
     if (has("name", attributes)) {
       const nameAlreadyTaken = await apiTokenService.getByName(attributes.name);
       if (!!nameAlreadyTaken && !strings.isEqual(nameAlreadyTaken.id, id)) {
-        throw new ApplicationError$4("Name already taken");
+        throw new ApplicationError$7("Name already taken");
       }
     }
     const apiToken2 = await apiTokenService.update(id, attributes);
     ctx.send({ data: apiToken2 });
   },
   async getLayout(ctx) {
-    const apiTokenService = getService("api-token");
+    const apiTokenService = getService$1("api-token");
     const layout = await apiTokenService.getApiTokenLayout();
     ctx.send({ data: layout });
   }
@@ -4343,13 +4386,18 @@ const userUpdateSchema = yup.object().shape({
 const usersDeleteSchema = yup.object().shape({
   ids: yup.array().of(yup.strapiID()).min(1).required()
 }).noUnknown();
-const validateUserCreationInput = validateYupSchema(userCreationSchema);
+const validateUserCreationInput$1 = validateYupSchema(userCreationSchema);
 const validateProfileUpdateInput = validateYupSchema(profileUpdateSchema);
 const validateUserUpdateInput = validateYupSchema(userUpdateSchema);
 const validateUsersDeleteInput = validateYupSchema(usersDeleteSchema);
+const schemas = {
+  userCreationSchema,
+  usersDeleteSchema,
+  userUpdateSchema
+};
 const authenticatedUser = {
   async getMe(ctx) {
-    const userInfo = getService("user").sanitizeUser(ctx.state.user);
+    const userInfo = getService$1("user").sanitizeUser(ctx.state.user);
     ctx.body = {
       data: userInfo
     };
@@ -4357,8 +4405,8 @@ const authenticatedUser = {
   async updateMe(ctx) {
     const input = ctx.request.body;
     await validateProfileUpdateInput(input);
-    const userService = getService("user");
-    const authServer = getService("auth");
+    const userService = getService$1("user");
+    const authServer = getService$1("auth");
     const { currentPassword, ...userInfo } = input;
     if (currentPassword && userInfo.password) {
       const isValid = await authServer.validatePassword(currentPassword, ctx.state.user.password);
@@ -4374,7 +4422,7 @@ const authenticatedUser = {
     };
   },
   async getOwnPermissions(ctx) {
-    const { findUserPermissions: findUserPermissions2, sanitizePermission: sanitizePermission2 } = getService("permission");
+    const { findUserPermissions: findUserPermissions2, sanitizePermission: sanitizePermission2 } = getService$1("permission");
     const { user: user2 } = ctx.state;
     const userPermissions = await findUserPermissions2(user2);
     ctx.body = {
@@ -4414,11 +4462,11 @@ const resetPasswordSchema = yup.object().shape({
 const validateResetPasswordInput = validateYupSchema(resetPasswordSchema);
 const renewToken = yup.object().shape({ token: yup.string().required() }).required().noUnknown();
 const validateRenewTokenInput = validateYupSchema(renewToken);
-const { ApplicationError: ApplicationError$3, ValidationError } = errors;
-const authentication = {
+const { ApplicationError: ApplicationError$6, ValidationError: ValidationError$2 } = errors;
+const authentication$1 = {
   login: compose([
     (ctx, next) => {
-      return passport$1.authenticate("local", { session: false }, (err, user2, info) => {
+      return passport$2.authenticate("local", { session: false }, (err, user2, info) => {
         if (err) {
           strapi.eventHub.emit("admin.auth.error", { error: err, provider: "local" });
           if (err.details?.code === "LOGIN_NOT_ALLOWED") {
@@ -4431,11 +4479,11 @@ const authentication = {
             error: new Error(info.message),
             provider: "local"
           });
-          throw new ApplicationError$3(info.message);
+          throw new ApplicationError$6(info.message);
         }
         const query = ctx.state;
         query.user = user2;
-        const sanitizedUser = getService("user").sanitizeUser(user2);
+        const sanitizedUser = getService$1("user").sanitizeUser(user2);
         strapi.eventHub.emit("admin.auth.success", { user: sanitizedUser, provider: "local" });
         return next();
       })(ctx, next);
@@ -4444,8 +4492,8 @@ const authentication = {
       const { user: user2 } = ctx.state;
       ctx.body = {
         data: {
-          token: getService("token").createJwtToken(user2),
-          user: getService("user").sanitizeUser(ctx.state.user)
+          token: getService$1("token").createJwtToken(user2),
+          user: getService$1("user").sanitizeUser(ctx.state.user)
           // TODO: fetch more detailed info
         }
       };
@@ -4454,50 +4502,50 @@ const authentication = {
   async renewToken(ctx) {
     await validateRenewTokenInput(ctx.request.body);
     const { token: token2 } = ctx.request.body;
-    const { isValid, payload } = getService("token").decodeJwtToken(token2);
+    const { isValid, payload } = getService$1("token").decodeJwtToken(token2);
     if (!isValid) {
-      throw new ValidationError("Invalid token");
+      throw new ValidationError$2("Invalid token");
     }
     ctx.body = {
       data: {
-        token: getService("token").createJwtToken({ id: payload.id })
+        token: getService$1("token").createJwtToken({ id: payload.id })
       }
     };
   },
   async registrationInfo(ctx) {
     await validateRegistrationInfoQuery(ctx.request.query);
     const { registrationToken } = ctx.request.query;
-    const registrationInfo = await getService("user").findRegistrationInfo(registrationToken);
+    const registrationInfo = await getService$1("user").findRegistrationInfo(registrationToken);
     if (!registrationInfo) {
-      throw new ValidationError("Invalid registrationToken");
+      throw new ValidationError$2("Invalid registrationToken");
     }
     ctx.body = { data: registrationInfo };
   },
   async register(ctx) {
     const input = ctx.request.body;
     await validateRegistrationInput(input);
-    const user2 = await getService("user").register(input);
+    const user2 = await getService$1("user").register(input);
     ctx.body = {
       data: {
-        token: getService("token").createJwtToken(user2),
-        user: getService("user").sanitizeUser(user2)
+        token: getService$1("token").createJwtToken(user2),
+        user: getService$1("user").sanitizeUser(user2)
       }
     };
   },
   async registerAdmin(ctx) {
     const input = ctx.request.body;
     await validateAdminRegistrationInput(input);
-    const hasAdmin = await getService("user").exists();
+    const hasAdmin = await getService$1("user").exists();
     if (hasAdmin) {
-      throw new ApplicationError$3("You cannot register a new super admin");
+      throw new ApplicationError$6("You cannot register a new super admin");
     }
-    const superAdminRole = await getService("role").getSuperAdmin();
+    const superAdminRole = await getService$1("role").getSuperAdmin();
     if (!superAdminRole) {
-      throw new ApplicationError$3(
+      throw new ApplicationError$6(
         "Cannot register the first admin because the super admin role doesn't exist."
       );
     }
-    const user2 = await getService("user").create({
+    const user2 = await getService$1("user").create({
       ...input,
       registrationToken: null,
       isActive: true,
@@ -4506,30 +4554,30 @@ const authentication = {
     strapi.telemetry.send("didCreateFirstAdmin");
     ctx.body = {
       data: {
-        token: getService("token").createJwtToken(user2),
-        user: getService("user").sanitizeUser(user2)
+        token: getService$1("token").createJwtToken(user2),
+        user: getService$1("user").sanitizeUser(user2)
       }
     };
   },
   async forgotPassword(ctx) {
     const input = ctx.request.body;
     await validateForgotPasswordInput(input);
-    getService("auth").forgotPassword(input);
+    getService$1("auth").forgotPassword(input);
     ctx.status = 204;
   },
   async resetPassword(ctx) {
     const input = ctx.request.body;
     await validateResetPasswordInput(input);
-    const user2 = await getService("auth").resetPassword(input);
+    const user2 = await getService$1("auth").resetPassword(input);
     ctx.body = {
       data: {
-        token: getService("token").createJwtToken(user2),
-        user: getService("user").sanitizeUser(user2)
+        token: getService$1("token").createJwtToken(user2),
+        user: getService$1("user").sanitizeUser(user2)
       }
     };
   },
   logout(ctx) {
-    const sanitizedUser = getService("user").sanitizeUser(ctx.state.user);
+    const sanitizedUser = getService$1("user").sanitizeUser(ctx.state.user);
     strapi.eventHub.emit("admin.logout", { user: sanitizedUser });
     ctx.body = { data: {} };
   }
@@ -4545,7 +4593,7 @@ const permission = {
     const { body: input } = ctx.request;
     const { userAbility } = ctx.state;
     await validateCheckPermissionsInput(input);
-    const { engine: engine2 } = getService("permission");
+    const { engine: engine2 } = getService$1("permission");
     const checkPermissionsFn = engine2.checkMany(userAbility);
     ctx.body = {
       data: checkPermissionsFn(input.permissions)
@@ -4556,7 +4604,7 @@ const permission = {
    * @param {KoaContext} ctx - koa context
    */
   async getAll(ctx) {
-    const { sectionsBuilder: sectionsBuilder2, actionProvider: actionProvider2, conditionProvider: conditionProvider2 } = getService("permission");
+    const { sectionsBuilder: sectionsBuilder2, actionProvider: actionProvider2, conditionProvider: conditionProvider2 } = getService$1("permission");
     const actions2 = actionProvider2.values();
     const conditions2 = conditionProvider2.values();
     const sections = await sectionsBuilder2.build(actions2);
@@ -4569,11 +4617,11 @@ const permission = {
     };
   }
 };
-const roleCreateSchema = yup.object().shape({
+const roleCreateSchema$1 = yup.object().shape({
   name: yup.string().min(1).required(),
   description: yup.string().nullable()
 }).noUnknown();
-const rolesDeleteSchema = yup.object().shape({
+const rolesDeleteSchema$1 = yup.object().shape({
   ids: yup.array().of(yup.strapiID()).min(1).required().test("roles-deletion-checks", "Roles deletion checks have failed", async function(ids) {
     try {
       await strapi.service("admin::role").checkRolesIdForDeletion(ids);
@@ -4583,7 +4631,7 @@ const rolesDeleteSchema = yup.object().shape({
     return true;
   })
 }).noUnknown();
-const roleDeleteSchema = yup.strapiID().required().test("no-admin-single-delete", "Role deletion checks have failed", async function(id) {
+const roleDeleteSchema$1 = yup.strapiID().required().test("no-admin-single-delete", "Role deletion checks have failed", async function(id) {
   try {
     await strapi.service("admin::role").checkRolesIdForDeletion([id]);
   } catch (e) {
@@ -4595,21 +4643,21 @@ const roleUpdateSchema = yup.object().shape({
   name: yup.string().min(1),
   description: yup.string().nullable()
 }).noUnknown();
-const validateRoleCreateInput = validateYupSchema(roleCreateSchema);
+const validateRoleCreateInput$1 = validateYupSchema(roleCreateSchema$1);
 const validateRoleUpdateInput = validateYupSchema(roleUpdateSchema);
-const validateRolesDeleteInput = validateYupSchema(rolesDeleteSchema);
-const validateRoleDeleteInput = validateYupSchema(roleDeleteSchema);
-const { ApplicationError: ApplicationError$2 } = errors;
-const { SUPER_ADMIN_CODE } = constants$3;
-const role = {
+const validateRolesDeleteInput$1 = validateYupSchema(rolesDeleteSchema$1);
+const validateRoleDeleteInput$1 = validateYupSchema(roleDeleteSchema$1);
+const { ApplicationError: ApplicationError$5 } = errors;
+const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$2 } = constants$3;
+const role$2 = {
   /**
    * Create a new role
    * @param {KoaContext} ctx - koa context
    */
   async create(ctx) {
     const { body } = ctx.request;
-    await validateRoleCreateInput(body);
-    const roleService = getService("role");
+    await validateRoleCreateInput$1(body);
+    const roleService = getService$1("role");
     const role2 = await roleService.create(body);
     const sanitizedRole = roleService.sanitizeRole(role2);
     ctx.created({ data: sanitizedRole });
@@ -4620,7 +4668,7 @@ const role = {
    */
   async findOne(ctx) {
     const { id } = ctx.params;
-    const role2 = await getService("role").findOneWithUsersCount({ id });
+    const role2 = await getService$1("role").findOneWithUsersCount({ id });
     if (!role2) {
       return ctx.notFound("role.notFound");
     }
@@ -4634,13 +4682,13 @@ const role = {
    */
   async findAll(ctx) {
     const { query } = ctx.request;
-    const permissionsManager = getService("permission").createPermissionsManager({
+    const permissionsManager = getService$1("permission").createPermissionsManager({
       ability: ctx.state.userAbility,
       model: "admin::role"
     });
     await permissionsManager.validateQuery(query);
     const sanitizedQuery = await permissionsManager.sanitizeQuery(query);
-    const roles2 = await getService("role").findAllWithUsersCount(sanitizedQuery);
+    const roles2 = await getService$1("role").findAllWithUsersCount(sanitizedQuery);
     ctx.body = {
       data: roles2
     };
@@ -4652,14 +4700,14 @@ const role = {
   async update(ctx) {
     const { id } = ctx.params;
     const { body } = ctx.request;
-    const roleService = getService("role");
+    const roleService = getService$1("role");
     await validateRoleUpdateInput(body);
     const role2 = await roleService.findOne({ id });
     if (!role2) {
       return ctx.notFound("role.notFound");
     }
-    if (role2.code === SUPER_ADMIN_CODE) {
-      throw new ApplicationError$2("Super admin can't be edited.");
+    if (role2.code === SUPER_ADMIN_CODE$2) {
+      throw new ApplicationError$5("Super admin can't be edited.");
     }
     const updatedRole = await roleService.update({ id }, body);
     const sanitizedRole = roleService.sanitizeRole(updatedRole);
@@ -4673,8 +4721,8 @@ const role = {
    */
   async getPermissions(ctx) {
     const { id } = ctx.params;
-    const roleService = getService("role");
-    const permissionService = getService("permission");
+    const roleService = getService$1("role");
+    const permissionService = getService$1("permission");
     const role2 = await roleService.findOne({ id });
     if (!role2) {
       return ctx.notFound("role.notFound");
@@ -4693,14 +4741,14 @@ const role = {
   async updatePermissions(ctx) {
     const { id } = ctx.params;
     const { body: input } = ctx.request;
-    const roleService = getService("role");
-    const permissionService = getService("permission");
+    const roleService = getService$1("role");
+    const permissionService = getService$1("permission");
     const role2 = await roleService.findOne({ id });
     if (!role2) {
       return ctx.notFound("role.notFound");
     }
-    if (role2.code === SUPER_ADMIN_CODE) {
-      throw new ApplicationError$2("Super admin permissions can't be edited.");
+    if (role2.code === SUPER_ADMIN_CODE$2) {
+      throw new ApplicationError$5("Super admin permissions can't be edited.");
     }
     await validatedUpdatePermissionsInput(input);
     if (!role2) {
@@ -4718,8 +4766,8 @@ const role = {
    */
   async deleteOne(ctx) {
     const { id } = ctx.params;
-    await validateRoleDeleteInput(id);
-    const roleService = getService("role");
+    await validateRoleDeleteInput$1(id);
+    const roleService = getService$1("role");
     const roles2 = await roleService.deleteByIds([id]);
     const sanitizedRole = roles2.map((role2) => roleService.sanitizeRole(role2))[0] || null;
     return ctx.deleted({
@@ -4732,8 +4780,8 @@ const role = {
    */
   async deleteMany(ctx) {
     const { body } = ctx.request;
-    await validateRolesDeleteInput(body);
-    const roleService = getService("role");
+    await validateRolesDeleteInput$1(body);
+    const roleService = getService$1("role");
     const roles2 = await roleService.deleteByIds(body.ids);
     const sanitizedRoles = roles2.map(roleService.sanitizeRole);
     return ctx.deleted({
@@ -4746,11 +4794,11 @@ const {
     handlers: { createPushController, createPullController }
   }
 } = strapi$1;
-const { UnauthorizedError } = errors;
+const { UnauthorizedError: UnauthorizedError$1 } = errors;
 const verify = async (ctx, scope) => {
   const { auth: auth2 } = ctx.state;
   if (!auth2) {
-    throw new UnauthorizedError();
+    throw new UnauthorizedError$1();
   }
   await dataTransferAuthStrategy.verify(auth2, { scope });
 };
@@ -4777,17 +4825,17 @@ const token$1 = {
   validateTransferTokenCreationInput: validateTransferTokenCreationInput$1,
   validateTransferTokenUpdateInput: validateTransferTokenUpdateInput$1
 };
-const { ApplicationError: ApplicationError$1 } = errors;
+const { ApplicationError: ApplicationError$4 } = errors;
 const { validateTransferTokenCreationInput, validateTransferTokenUpdateInput } = token$1;
 const token = {
   async list(ctx) {
-    const transferService = getService("transfer");
+    const transferService = getService$1("transfer");
     const transferTokens = await transferService.token.list();
     ctx.body = { data: transferTokens };
   },
   async getById(ctx) {
     const { id } = ctx.params;
-    const tokenService = getService("transfer").token;
+    const tokenService = getService$1("transfer").token;
     const transferToken2 = await tokenService.getById(id);
     if (!transferToken2) {
       ctx.notFound("Transfer token not found");
@@ -4797,7 +4845,7 @@ const token = {
   },
   async create(ctx) {
     const { body } = ctx.request;
-    const { token: tokenService } = getService("transfer");
+    const { token: tokenService } = getService$1("transfer");
     const attributes = {
       name: trim(body.name),
       description: trim(body.description),
@@ -4807,7 +4855,7 @@ const token = {
     await validateTransferTokenCreationInput(attributes);
     const alreadyExists = await tokenService.exists({ name: attributes.name });
     if (alreadyExists) {
-      throw new ApplicationError$1("Name already taken");
+      throw new ApplicationError$4("Name already taken");
     }
     const transferTokens = await tokenService.create(attributes);
     ctx.created({ data: transferTokens });
@@ -4815,7 +4863,7 @@ const token = {
   async update(ctx) {
     const { body } = ctx.request;
     const { id } = ctx.params;
-    const { token: tokenService } = getService("transfer");
+    const { token: tokenService } = getService$1("transfer");
     const attributes = body;
     if (has("name", attributes)) {
       attributes.name = trim(body.name);
@@ -4831,7 +4879,7 @@ const token = {
     if (has("name", attributes)) {
       const nameAlreadyTaken = await tokenService.getByName(attributes.name);
       if (!!nameAlreadyTaken && !strings.isEqual(nameAlreadyTaken.id, id)) {
-        throw new ApplicationError$1("Name already taken");
+        throw new ApplicationError$4("Name already taken");
       }
     }
     const apiToken2 = await tokenService.update(id, attributes);
@@ -4839,13 +4887,13 @@ const token = {
   },
   async revoke(ctx) {
     const { id } = ctx.params;
-    const { token: tokenService } = getService("transfer");
+    const { token: tokenService } = getService$1("transfer");
     const transferToken2 = await tokenService.revoke(id);
     ctx.deleted({ data: transferToken2 });
   },
   async regenerate(ctx) {
     const { id } = ctx.params;
-    const { token: tokenService } = getService("transfer");
+    const { token: tokenService } = getService$1("transfer");
     const exists2 = await tokenService.getById(id);
     if (!exists2) {
       ctx.notFound("Transfer token not found");
@@ -4860,12 +4908,12 @@ const transfer = {
   ...prefixActionsName("runner", runner),
   ...prefixActionsName("token", token)
 };
-const { ApplicationError } = errors;
-const user = {
+const { ApplicationError: ApplicationError$3 } = errors;
+const user$2 = {
   async create(ctx) {
     const { body } = ctx.request;
     const cleanData = { ...body, email: _.get(body, `email`, ``).toLowerCase() };
-    await validateUserCreationInput(cleanData);
+    await validateUserCreationInput$1(cleanData);
     const attributes = _.pick(cleanData, [
       "firstname",
       "lastname",
@@ -4873,19 +4921,19 @@ const user = {
       "roles",
       "preferedLanguage"
     ]);
-    const userAlreadyExists = await getService("user").exists({
+    const userAlreadyExists = await getService$1("user").exists({
       email: attributes.email
     });
     if (userAlreadyExists) {
-      throw new ApplicationError("Email already taken");
+      throw new ApplicationError$3("Email already taken");
     }
-    const createdUser = await getService("user").create(attributes);
-    const userInfo = getService("user").sanitizeUser(createdUser);
+    const createdUser = await getService$1("user").create(attributes);
+    const userInfo = getService$1("user").sanitizeUser(createdUser);
     Object.assign(userInfo, { registrationToken: createdUser.registrationToken });
     ctx.created({ data: userInfo });
   },
   async find(ctx) {
-    const userService = getService("user");
+    const userService = getService$1("user");
     const permissionsManager = strapi.service("admin::permission").createPermissionsManager({
       ability: ctx.state.userAbility,
       model: "admin::user"
@@ -4902,12 +4950,12 @@ const user = {
   },
   async findOne(ctx) {
     const { id } = ctx.params;
-    const user2 = await getService("user").findOne(id);
+    const user2 = await getService$1("user").findOne(id);
     if (!user2) {
       return ctx.notFound("User does not exist");
     }
     ctx.body = {
-      data: getService("user").sanitizeUser(user2)
+      data: getService$1("user").sanitizeUser(user2)
     };
   },
   async update(ctx) {
@@ -4915,30 +4963,30 @@ const user = {
     const { body: input } = ctx.request;
     await validateUserUpdateInput(input);
     if (_.has(input, "email")) {
-      const uniqueEmailCheck = await getService("user").exists({
+      const uniqueEmailCheck = await getService$1("user").exists({
         id: { $ne: id },
         email: input.email
       });
       if (uniqueEmailCheck) {
-        throw new ApplicationError("A user with this email address already exists");
+        throw new ApplicationError$3("A user with this email address already exists");
       }
     }
-    const updatedUser = await getService("user").updateById(id, input);
+    const updatedUser = await getService$1("user").updateById(id, input);
     if (!updatedUser) {
       return ctx.notFound("User does not exist");
     }
     ctx.body = {
-      data: getService("user").sanitizeUser(updatedUser)
+      data: getService$1("user").sanitizeUser(updatedUser)
     };
   },
   async deleteOne(ctx) {
     const { id } = ctx.params;
-    const deletedUser = await getService("user").deleteById(id);
+    const deletedUser = await getService$1("user").deleteById(id);
     if (!deletedUser) {
       return ctx.notFound("User not found");
     }
     return ctx.deleted({
-      data: getService("user").sanitizeUser(deletedUser)
+      data: getService$1("user").sanitizeUser(deletedUser)
     });
   },
   /**
@@ -4948,8 +4996,8 @@ const user = {
   async deleteMany(ctx) {
     const { body } = ctx.request;
     await validateUsersDeleteInput(body);
-    const users2 = await getService("user").deleteByIds(body.ids);
-    const sanitizedUsers = users2.map(getService("user").sanitizeUser);
+    const users2 = await getService$1("user").deleteByIds(body.ids);
+    const sanitizedUsers = users2.map(getService$1("user").sanitizeUser);
     return ctx.deleted({
       data: sanitizedUsers
     });
@@ -5069,15 +5117,15 @@ const contentApi = {
     ctx.send({ data: routesMap });
   }
 };
-const index$2 = {
-  admin,
+const controllers$1 = {
+  admin: admin$3,
   "api-token": apiToken$1,
   "authenticated-user": authenticatedUser,
-  authentication,
+  authentication: authentication$1,
   permission,
-  role,
+  role: role$2,
   transfer,
-  user,
+  user: user$2,
   webhooks,
   "content-api": contentApi
 };
@@ -5502,7 +5550,7 @@ const transferTokenPermission = {
     }
   }
 };
-const index$1 = {
+const contentTypes = {
   permission: { schema: Permission },
   user: { schema: User },
   role: { schema: Role },
@@ -5511,8 +5559,8 @@ const index$1 = {
   "transfer-token": { schema: transferToken },
   "transfer-token-permission": { schema: transferTokenPermission }
 };
-const { RateLimitError } = utils$1.errors;
-const rateLimit = (config, { strapi: strapi2 }) => async (ctx, next) => {
+const { RateLimitError } = utils$2.errors;
+const rateLimit = (config2, { strapi: strapi2 }) => async (ctx, next) => {
   let rateLimitConfig = strapi2.config.get("admin.rateLimit");
   if (!rateLimitConfig) {
     rateLimitConfig = {
@@ -5535,14 +5583,14 @@ const rateLimit = (config, { strapi: strapi2 }) => async (ctx, next) => {
         throw new RateLimitError();
       },
       ...rateLimitConfig,
-      ...config
+      ...config2
     };
     return rateLimit2.middleware(loadConfig)(ctx, next);
   }
   return next();
 };
 const dataTransfer = () => async (ctx, next) => {
-  const transferUtils = getService("transfer").utils;
+  const transferUtils = getService$1("transfer").utils;
   const { hasValidTokenSalt: hasValidTokenSalt2, isRemoteTransferEnabled: isRemoteTransferEnabled2 } = transferUtils;
   if (isRemoteTransferEnabled2()) {
     return next();
@@ -5560,20 +5608,1368 @@ const dataTransfer = () => async (ctx, next) => {
   }
   throw new Error("Unexpected error while trying to access a data transfer route");
 };
-const index = {
+const middlewares$1 = {
   rateLimit,
   "data-transfer": dataTransfer
 };
+const register = async ({ strapi: strapi2 }) => {
+  await register$2({ strapi: strapi2 });
+};
+const getService = (name2, { strapi: strapi2 } = { strapi: global.strapi }) => {
+  return strapi2.service(`admin::${name2}`);
+};
+const actions = {
+  sso: [
+    {
+      uid: "provider-login.read",
+      displayName: "Read",
+      pluginName: "admin",
+      section: "settings",
+      category: "single sign on",
+      subCategory: "options"
+    },
+    {
+      uid: "provider-login.update",
+      displayName: "Update",
+      pluginName: "admin",
+      section: "settings",
+      category: "single sign on",
+      subCategory: "options"
+    }
+  ],
+  auditLogs: [
+    {
+      uid: "audit-logs.read",
+      displayName: "Read",
+      pluginName: "admin",
+      section: "settings",
+      category: "audit logs",
+      subCategory: "options"
+    }
+  ]
+};
+const transformTableName = (table) => {
+  if (typeof table === "string") {
+    return { name: table };
+  }
+  return table;
+};
+async function findTables({ strapi: strapi2 }, regex) {
+  const tables = await strapi2.db.dialect.schemaInspector.getTables();
+  return tables.filter((tableName) => regex.test(tableName));
+}
+async function addPersistTables({ strapi: strapi2 }, tableNames) {
+  const persistedTables = await getPersistedTables({ strapi: strapi2 });
+  const tables = tableNames.map(transformTableName);
+  const notPersistedTableNames = differenceWith(isEqual, tables, persistedTables);
+  const tablesToPersist = differenceWith(
+    (t1, t2) => t1.name === t2.name,
+    persistedTables,
+    notPersistedTableNames
+  );
+  if (!notPersistedTableNames.length) {
+    return;
+  }
+  tablesToPersist.push(...notPersistedTableNames);
+  await strapi2.store.set({
+    type: "core",
+    key: "persisted_tables",
+    value: tablesToPersist
+  });
+}
+async function getPersistedTables({ strapi: strapi2 }) {
+  const persistedTables = await strapi2.store.get({
+    type: "core",
+    key: "persisted_tables"
+  });
+  return (persistedTables || []).map(transformTableName);
+}
+const persistTablesWithPrefix = async (tableNamePrefix) => {
+  const tableNameRegex = new RegExp(`^${tableNamePrefix}.*`);
+  const tableNames = await findTables({ strapi }, tableNameRegex);
+  await addPersistTables({ strapi }, tableNames);
+};
+const bootstrap = async (args) => {
+  const { actionProvider: actionProvider2 } = getService("permission");
+  if (strapi.ee.features.isEnabled("sso")) {
+    await actionProvider2.registerMany(actions.sso);
+  }
+  if (strapi.ee.features.isEnabled("audit-logs")) {
+    await persistTablesWithPrefix("strapi_audit_logs");
+    await actionProvider2.registerMany(actions.auditLogs);
+  }
+  await getService("seat-enforcement").seatEnforcementWorkflow();
+  await bootstrap$1(args);
+};
+const destroy = async ({ strapi: strapi2 }) => {
+  await destroy$1();
+};
+const adminContentTypes = {};
+const isSsoLocked = async (user2) => {
+  if (!strapi.ee.features.isEnabled("sso")) {
+    return false;
+  }
+  if (!user2) {
+    throw new Error("Missing user object");
+  }
+  const adminStore = await strapi.store({ type: "core", name: "admin" });
+  const { providers: providers2 } = await adminStore.get({ key: "auth" });
+  const lockedRoles = providers2.ssoLockedRoles ?? [];
+  if (isEmpty(lockedRoles)) {
+    return false;
+  }
+  const roles2 = (
+    // If the roles are pre-loaded for the given user, then use them
+    user2.roles ?? // Otherwise, try to load the role based on the given user ID
+    await strapi.db.query("admin::user").load(user2, "roles", { roles: { fields: ["id"] } }) ?? // If the query fails somehow, default to an empty array
+    []
+  );
+  const isLocked = lockedRoles.some(
+    (lockedId) => (
+      // lockedRoles will be a string to avoid issues with frontend and bigints
+      roles2.some((role2) => lockedId === role2.id.toString())
+    )
+  );
+  return isLocked;
+};
+const { ApplicationError: ApplicationError$2 } = errors;
+const forgotPassword = async ({ email: email2 } = {}) => {
+  const user2 = await strapi.db.query("admin::user").findOne({ where: { email: email2, isActive: true } });
+  if (!user2 || await isSsoLocked(user2)) {
+    return;
+  }
+  const resetPasswordToken = getService("token").createToken();
+  await getService("user").updateById(user2.id, { resetPasswordToken });
+  const url = `${strapi.config.get(
+    "admin.absoluteUrl"
+  )}/auth/reset-password?code=${resetPasswordToken}`;
+  return strapi.plugin("email").service("email").sendTemplatedEmail(
+    {
+      to: user2.email,
+      from: strapi.config.get("admin.forgotPassword.from"),
+      replyTo: strapi.config.get("admin.forgotPassword.replyTo")
+    },
+    strapi.config.get("admin.forgotPassword.emailTemplate"),
+    {
+      url,
+      user: ___default.pick(user2, ["email", "firstname", "lastname", "username"])
+    }
+  ).catch((err) => {
+    strapi.log.error(err);
+  });
+};
+const resetPassword = async ({ resetPasswordToken, password: password2 } = {}) => {
+  const matchingUser = await strapi.db.query("admin::user").findOne({ where: { resetPasswordToken, isActive: true } });
+  if (!matchingUser || await isSsoLocked(matchingUser)) {
+    throw new ApplicationError$2();
+  }
+  return getService("user").updateById(matchingUser.id, {
+    password: password2,
+    resetPasswordToken: null
+  });
+};
+const auth = {
+  forgotPassword,
+  resetPassword
+};
+const createProviderRegistry = () => {
+  const registry = /* @__PURE__ */ new Map();
+  Object.assign(registry, {
+    register(provider) {
+      if (strapi.isLoaded) {
+        throw new Error(`You can't register new provider after the bootstrap`);
+      }
+      this.set(provider.uid, provider);
+    },
+    registerMany(providers2) {
+      providers2.forEach((provider) => {
+        this.register(provider);
+      });
+    },
+    getAll() {
+      return Array.from(this.values());
+    }
+  });
+  return registry;
+};
+const providerRegistry = createProviderRegistry();
+const errorMessage = "SSO is disabled. Its functionnalities cannot be accessed.";
+const getStrategyCallbackURL = (providerName) => {
+  if (!strapi.ee.features.isEnabled("sso")) {
+    throw new Error(errorMessage);
+  }
+  return `/admin/connect/${providerName}`;
+};
+const syncProviderRegistryWithConfig = () => {
+  if (!strapi.ee.features.isEnabled("sso")) {
+    throw new Error(errorMessage);
+  }
+  const { providers: providers2 = [] } = strapi.config.get("admin.auth", {});
+  providerRegistry.registerMany(providers2);
+};
+const SSOAuthEventsMapper = {
+  onSSOAutoRegistration: "admin.auth.autoRegistration"
+};
+const sso$1 = {
+  providerRegistry,
+  getStrategyCallbackURL,
+  syncProviderRegistryWithConfig,
+  authEventsMapper: { ...passport$1.authEventsMapper, ...SSOAuthEventsMapper }
+};
+const { UnauthorizedError } = errors;
+const localStrategyMiddleware = async ([error, user2, message], done) => {
+  if (user2 && !error && await isSsoLocked(user2)) {
+    return done(
+      new UnauthorizedError("Login not allowed, please contact your administrator", {
+        code: "LOGIN_NOT_ALLOWED"
+      }),
+      user2,
+      message
+    );
+  }
+  return done(error, user2, message);
+};
+const getPassportStrategies = () => {
+  if (!strapi.ee.features.isEnabled("sso")) {
+    return [createLocalStrategy(strapi)];
+  }
+  const localStrategy = createLocalStrategy(strapi, localStrategyMiddleware);
+  if (!strapi.isLoaded) {
+    sso$1.syncProviderRegistryWithConfig();
+  }
+  const providers2 = sso$1.providerRegistry.getAll();
+  const strategies = providers2.map((provider) => provider.createStrategy(strapi));
+  return [localStrategy, ...strategies];
+};
+const passport = {
+  getPassportStrategies,
+  ...sso$1
+};
+const { ApplicationError: ApplicationError$1 } = errors;
+const ssoCheckRolesIdForDeletion = async (ids) => {
+  const adminStore = await strapi.store({ type: "core", name: "admin" });
+  const {
+    providers: { defaultRole }
+  } = await adminStore.get({ key: "auth" });
+  for (const roleId of ids) {
+    if (defaultRole && toString(defaultRole) === toString(roleId)) {
+      throw new ApplicationError$1(
+        "This role is used as the default SSO role. Make sure to change this configuration before deleting the role"
+      );
+    }
+  }
+};
+const role$1 = {
+  ssoCheckRolesIdForDeletion
+};
+const { ValidationError: ValidationError$1 } = errors;
+const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$1 } = constants$3;
+const updateEEDisabledUsersList = async (id, input) => {
+  const disabledUsers = await getService("seat-enforcement").getDisabledUserList();
+  if (!disabledUsers) {
+    return;
+  }
+  const user2 = disabledUsers.find((user22) => user22.id === Number(id));
+  if (!user2) {
+    return;
+  }
+  if (user2.isActive !== input.isActive) {
+    const newDisabledUsersList = disabledUsers.filter((user22) => user22.id !== Number(id));
+    await strapi.store.set({
+      type: "ee",
+      key: "disabled_users",
+      value: newDisabledUsersList
+    });
+  }
+};
+const castNumberArray = pipe(castArray, map(toNumber));
+const removeFromEEDisabledUsersList = async (ids) => {
+  let idsToCheck;
+  if (typeof ids === "object") {
+    idsToCheck = castNumberArray(ids);
+  } else {
+    idsToCheck = [Number(ids)];
+  }
+  const disabledUsers = await getService("seat-enforcement").getDisabledUserList();
+  if (!disabledUsers) {
+    return;
+  }
+  const newDisabledUsersList = disabledUsers.filter((user2) => !idsToCheck.includes(user2.id));
+  await strapi.store.set({
+    type: "ee",
+    key: "disabled_users",
+    value: newDisabledUsersList
+  });
+};
+const updateById = async (id, attributes) => {
+  if (___default.has(attributes, "roles")) {
+    const lastAdminUser = await isLastSuperAdminUser(id);
+    const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);
+    if (lastAdminUser && willRemoveSuperAdminRole) {
+      throw new ValidationError$1("You must have at least one user with super admin role.");
+    }
+  }
+  if (attributes.isActive === false) {
+    const lastAdminUser = await isLastSuperAdminUser(id);
+    if (lastAdminUser) {
+      throw new ValidationError$1("You must have at least one user with super admin role.");
+    }
+  }
+  if (___default.has(attributes, "password")) {
+    const hashedPassword = await getService("auth").hashPassword(attributes.password);
+    const updatedUser2 = await strapi.db.query("admin::user").update({
+      where: { id },
+      data: {
+        ...attributes,
+        password: hashedPassword
+      },
+      populate: ["roles"]
+    });
+    strapi.eventHub.emit("user.update", { user: sanitizeUser(updatedUser2) });
+    return updatedUser2;
+  }
+  const updatedUser = await strapi.db.query("admin::user").update({
+    where: { id },
+    data: attributes,
+    populate: ["roles"]
+  });
+  await updateEEDisabledUsersList(id, attributes);
+  if (updatedUser) {
+    strapi.eventHub.emit("user.update", { user: sanitizeUser(updatedUser) });
+  }
+  return updatedUser;
+};
+const deleteById = async (id) => {
+  const userToDelete = await strapi.db.query("admin::user").findOne({
+    where: { id },
+    populate: ["roles"]
+  });
+  if (!userToDelete) {
+    return null;
+  }
+  if (userToDelete) {
+    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE$1)) {
+      const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+      if (superAdminRole.usersCount === 1) {
+        throw new ValidationError$1("You must have at least one user with super admin role.");
+      }
+    }
+  }
+  const deletedUser = await strapi.db.query("admin::user").delete({ where: { id }, populate: ["roles"] });
+  await removeFromEEDisabledUsersList(id);
+  strapi.eventHub.emit("user.delete", { user: sanitizeUser(deletedUser) });
+  return deletedUser;
+};
+const deleteByIds = async (ids) => {
+  const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+  const nbOfSuperAdminToDelete = await strapi.db.query("admin::user").count({
+    where: {
+      id: ids,
+      roles: { id: superAdminRole.id }
+    }
+  });
+  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {
+    throw new ValidationError$1("You must have at least one user with super admin role.");
+  }
+  const deletedUsers = [];
+  for (const id of ids) {
+    const deletedUser = await strapi.db.query("admin::user").delete({
+      where: { id },
+      populate: ["roles"]
+    });
+    deletedUsers.push(deletedUser);
+  }
+  await removeFromEEDisabledUsersList(ids);
+  strapi.eventHub.emit("user.delete", {
+    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser))
+  });
+  return deletedUsers;
+};
+const sanitizeUserRoles = (role2) => ___default.pick(role2, ["id", "name", "description", "code"]);
+const isLastSuperAdminUser = async (userId) => {
+  const user2 = await findOne(userId);
+  const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
+  return superAdminRole.usersCount === 1 && hasSuperAdminRole$1(user2);
+};
+const sanitizeUser = (user2) => {
+  return {
+    ...___default.omit(user2, ["password", "resetPasswordToken", "registrationToken", "roles"]),
+    roles: user2.roles && user2.roles.map(sanitizeUserRoles)
+  };
+};
+const findOne = async (id, populate = ["roles"]) => {
+  return strapi.db.query("admin::user").findOne({ where: { id }, populate });
+};
+const getCurrentActiveUserCount = async () => {
+  return strapi.db.query("admin::user").count({ where: { isActive: true } });
+};
+const user$1 = {
+  updateEEDisabledUsersList,
+  removeFromEEDisabledUsersList,
+  getCurrentActiveUserCount,
+  deleteByIds,
+  deleteById,
+  updateById
+};
+const getSSOProvidersList = async () => {
+  const { providerRegistry: providerRegistry2 } = strapi.service("admin::passport");
+  return providerRegistry2.getAll().map(({ uid }) => uid);
+};
+const sendUpdateProjectInformation = async (strapi2) => {
+  let groupProperties = {};
+  const numberOfActiveAdminUsers = await getService("user").count({ isActive: true });
+  const numberOfAdminUsers = await getService("user").count();
+  if (strapi2.ee.features.isEnabled("sso")) {
+    const SSOProviders = await getSSOProvidersList();
+    groupProperties = assign(groupProperties, {
+      SSOProviders,
+      isSSOConfigured: SSOProviders.length !== 0
+    });
+  }
+  if (strapi2.ee.features.isEnabled("cms-content-releases")) {
+    const numberOfContentReleases = await strapi2.db.query("plugin::content-releases.release").count();
+    const numberOfPublishedContentReleases = await strapi2.db.query("plugin::content-releases.release").count({
+      filters: { releasedAt: { $notNull: true } }
+    });
+    groupProperties = assign(groupProperties, {
+      numberOfContentReleases,
+      numberOfPublishedContentReleases
+    });
+  }
+  groupProperties = assign(groupProperties, { numberOfActiveAdminUsers, numberOfAdminUsers });
+  strapi2.telemetry.send("didUpdateProjectInformation", {
+    groupProperties
+  });
+};
+const startCron = (strapi2) => {
+  strapi2.cron.add({
+    "0 0 0 * * *": () => sendUpdateProjectInformation(strapi2)
+  });
+};
+const metrics = { startCron, getSSOProvidersList, sendUpdateProjectInformation };
+const { SUPER_ADMIN_CODE } = constants$3;
+const getDisabledUserList = async () => {
+  return strapi.store.get({ type: "ee", key: "disabled_users" });
+};
+const enableMaximumUserCount = async (numberOfUsersToEnable) => {
+  const disabledUsers = await getDisabledUserList();
+  const orderedDisabledUsers = reverse(disabledUsers);
+  const usersToEnable = take(numberOfUsersToEnable, orderedDisabledUsers);
+  await strapi.db.query("admin::user").updateMany({
+    where: { id: map(prop("id"), usersToEnable) },
+    data: { isActive: true }
+  });
+  const remainingDisabledUsers = drop(numberOfUsersToEnable, orderedDisabledUsers);
+  await strapi.store.set({
+    type: "ee",
+    key: "disabled_users",
+    value: remainingDisabledUsers
+  });
+};
+const disableUsersAboveLicenseLimit = async (numberOfUsersToDisable) => {
+  const currentlyDisabledUsers = await getDisabledUserList() ?? [];
+  const usersToDisable = [];
+  const nonSuperAdminUsersToDisable = await strapi.db.query("admin::user").findMany({
+    where: {
+      isActive: true,
+      roles: {
+        code: { $ne: SUPER_ADMIN_CODE }
+      }
+    },
+    orderBy: { createdAt: "DESC" },
+    limit: numberOfUsersToDisable
+  });
+  usersToDisable.push(...nonSuperAdminUsersToDisable);
+  if (nonSuperAdminUsersToDisable.length < numberOfUsersToDisable) {
+    const superAdminUsersToDisable = await strapi.db.query("admin::user").findMany({
+      where: {
+        isActive: true,
+        roles: { code: SUPER_ADMIN_CODE }
+      },
+      orderBy: { createdAt: "DESC" },
+      limit: numberOfUsersToDisable - nonSuperAdminUsersToDisable.length
+    });
+    usersToDisable.push(...superAdminUsersToDisable);
+  }
+  await strapi.db.query("admin::user").updateMany({
+    where: { id: map(prop("id"), usersToDisable) },
+    data: { isActive: false }
+  });
+  await strapi.store.set({
+    type: "ee",
+    key: "disabled_users",
+    value: currentlyDisabledUsers.concat(map(pick(["id", "isActive"]), usersToDisable))
+  });
+};
+const syncDisabledUserRecords = async () => {
+  const disabledUsers = await strapi.store.get({ type: "ee", key: "disabled_users" });
+  if (!disabledUsers) {
+    return;
+  }
+  await strapi.db.query("admin::user").updateMany({
+    where: { id: map(prop("id"), disabledUsers) },
+    data: { isActive: false }
+  });
+};
+const seatEnforcementWorkflow = async () => {
+  const adminSeats = strapi.ee.seats;
+  if (isNil(adminSeats)) {
+    return;
+  }
+  await syncDisabledUserRecords();
+  const currentActiveUserCount = await getService("user").getCurrentActiveUserCount();
+  const adminSeatsLeft = adminSeats - currentActiveUserCount;
+  if (adminSeatsLeft > 0) {
+    await enableMaximumUserCount(adminSeatsLeft);
+  } else if (adminSeatsLeft < 0) {
+    await disableUsersAboveLicenseLimit(-adminSeatsLeft);
+  }
+};
+const seatEnforcement = {
+  seatEnforcementWorkflow,
+  getDisabledUserList
+};
+const services = {
+  auth,
+  passport,
+  role: role$1,
+  user: user$1,
+  metrics,
+  "seat-enforcement": seatEnforcement
+};
+const providerOptionsUpdateSchema = yup.object().shape({
+  autoRegister: yup.boolean().required(),
+  defaultRole: yup.strapiID().when("autoRegister", (value, initSchema) => {
+    return value ? initSchema.required() : initSchema.nullable();
+  }).test("is-valid-role", "You must submit a valid default role", (roleId) => {
+    if (roleId === null) {
+      return true;
+    }
+    return strapi.service("admin::role").exists({ id: roleId });
+  }),
+  ssoLockedRoles: yup.array().nullable().of(
+    yup.strapiID().test(
+      "is-valid-role",
+      "You must submit a valid role for the SSO Locked roles",
+      (roleId) => {
+        return strapi.service("admin::role").exists({ id: roleId });
+      }
+    )
+  )
+});
+const validateProviderOptionsUpdate = validateYupSchema(providerOptionsUpdateSchema);
+const PROVIDER_REDIRECT_BASE = "/auth/login";
+const PROVIDER_REDIRECT_SUCCESS = `${PROVIDER_REDIRECT_BASE}/success`;
+const PROVIDER_REDIRECT_ERROR = `${PROVIDER_REDIRECT_BASE}/error`;
+const PROVIDER_URLS_MAP = {
+  success: PROVIDER_REDIRECT_SUCCESS,
+  error: PROVIDER_REDIRECT_ERROR
+};
+const getAdminStore = async () => strapi.store({ type: "core", name: "admin" });
+const getPrefixedRedirectUrls = () => {
+  const { url: adminUrl } = strapi.config.get("admin");
+  const prefixUrl = (url) => `${adminUrl || "/admin"}${url}`;
+  return mapValues(prefixUrl, PROVIDER_URLS_MAP);
+};
+const utils = {
+  getAdminStore,
+  getPrefixedRedirectUrls
+};
+const defaultConnectionError = () => new Error("Invalid connection payload");
+const authenticate = async (ctx, next) => {
+  const {
+    params: { provider }
+  } = ctx;
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+  return passport$2.authenticate(provider, null, async (error, profile) => {
+    if (error || !profile || !profile.email) {
+      if (error) {
+        strapi.log.error(error);
+      }
+      strapi.eventHub.emit("admin.auth.error", {
+        error: error || defaultConnectionError(),
+        provider
+      });
+      return ctx.redirect(redirectUrls.error);
+    }
+    const user2 = await getService("user").findOneByEmail(profile.email);
+    const scenario = user2 ? existingUserScenario : nonExistingUserScenario;
+    return scenario(ctx, next)(user2 || profile, provider);
+  })(ctx, next);
+};
+const existingUserScenario = (ctx, next) => async (user2, provider) => {
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+  if (!user2.isActive) {
+    strapi.eventHub.emit("admin.auth.error", {
+      error: new Error(`Deactivated user tried to login (${user2.id})`),
+      provider
+    });
+    return ctx.redirect(redirectUrls.error);
+  }
+  ctx.state.user = user2;
+  return next();
+};
+const nonExistingUserScenario = (ctx, next) => async (profile, provider) => {
+  const { email: email2, firstname: firstname2, lastname: lastname2, username: username2 } = profile;
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+  const adminStore = await utils.getAdminStore();
+  const { providers: providers2 } = await adminStore.get({ key: "auth" });
+  const isMissingRegisterFields = !username2 && (!firstname2 || !lastname2);
+  if (!providers2.autoRegister || !providers2.defaultRole || isMissingRegisterFields) {
+    strapi.eventHub.emit("admin.auth.error", { error: defaultConnectionError(), provider });
+    return ctx.redirect(redirectUrls.error);
+  }
+  const defaultRole = await getService("role").findOne({ id: providers2.defaultRole });
+  if (!defaultRole) {
+    strapi.eventHub.emit("admin.auth.error", { error: defaultConnectionError(), provider });
+    return ctx.redirect(redirectUrls.error);
+  }
+  ctx.state.user = await getService("user").create({
+    email: email2,
+    username: username2,
+    firstname: firstname2,
+    lastname: lastname2,
+    roles: [defaultRole.id],
+    isActive: true,
+    registrationToken: null
+  });
+  strapi.eventHub.emit("admin.auth.autoRegistration", {
+    user: ctx.state.user,
+    provider
+  });
+  return next();
+};
+const redirectWithAuth = (ctx) => {
+  const {
+    params: { provider }
+  } = ctx;
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+  const domain2 = strapi.config.get("admin.auth.domain");
+  const { user: user2 } = ctx.state;
+  const jwt2 = getService("token").createJwtToken(user2);
+  const isProduction = strapi.config.get("environment") === "production";
+  const cookiesOptions = { httpOnly: false, secure: isProduction, overwrite: true, domain: domain2 };
+  const sanitizedUser = getService("user").sanitizeUser(user2);
+  strapi.eventHub.emit("admin.auth.success", { user: sanitizedUser, provider });
+  ctx.cookies.set("jwtToken", jwt2, cookiesOptions);
+  ctx.redirect(redirectUrls.success);
+};
+const middlewares = {
+  authenticate,
+  redirectWithAuth
+};
+const toProviderDTO = pick(["uid", "displayName", "icon"]);
+const toProviderLoginOptionsDTO = pick(["autoRegister", "defaultRole", "ssoLockedRoles"]);
+const { ValidationError } = errors;
+const providerAuthenticationFlow = compose([
+  middlewares.authenticate,
+  middlewares.redirectWithAuth
+]);
+const authentication = {
+  async getProviders(ctx) {
+    const { providerRegistry: providerRegistry2 } = strapi.service("admin::passport");
+    ctx.body = providerRegistry2.getAll().map(toProviderDTO);
+  },
+  async getProviderLoginOptions(ctx) {
+    const adminStore = await utils.getAdminStore();
+    const { providers: providersOptions } = await adminStore.get({ key: "auth" });
+    ctx.body = {
+      data: toProviderLoginOptionsDTO(providersOptions)
+    };
+  },
+  async updateProviderLoginOptions(ctx) {
+    const {
+      request: { body }
+    } = ctx;
+    await validateProviderOptionsUpdate(body);
+    const adminStore = await utils.getAdminStore();
+    const currentAuthOptions = await adminStore.get({ key: "auth" });
+    const newAuthOptions = { ...currentAuthOptions, providers: body };
+    await adminStore.set({ key: "auth", value: newAuthOptions });
+    strapi.telemetry.send("didUpdateSSOSettings");
+    ctx.body = {
+      data: toProviderLoginOptionsDTO(newAuthOptions.providers)
+    };
+  },
+  providerLogin(ctx, next) {
+    const {
+      params: { provider: providerName }
+    } = ctx;
+    const { providerRegistry: providerRegistry2 } = strapi.service("admin::passport");
+    if (!providerRegistry2.has(providerName)) {
+      throw new ValidationError(`Invalid provider supplied: ${providerName}`);
+    }
+    return providerAuthenticationFlow(ctx, next);
+  }
+};
+const roleCreateSchema = yup.object().shape({
+  name: yup.string().min(1).required(),
+  description: yup.string().nullable()
+}).noUnknown();
+const rolesDeleteSchema = yup.object().shape({
+  ids: yup.array().of(yup.strapiID()).min(1).required().test(
+    "roles-deletion-checks",
+    "Roles deletion checks have failed",
+    async function rolesDeletionChecks(ids) {
+      try {
+        await strapi.service("admin::role").checkRolesIdForDeletion(ids);
+        if (strapi.ee.features.isEnabled("sso")) {
+          await strapi.service("admin::role").ssoCheckRolesIdForDeletion(ids);
+        }
+      } catch (e) {
+        return this.createError({ path: "ids", message: e.message });
+      }
+      return true;
+    }
+  )
+}).noUnknown();
+const roleDeleteSchema = yup.strapiID().required().test(
+  "no-admin-single-delete",
+  "Role deletion checks have failed",
+  async function noAdminSingleDelete(id) {
+    try {
+      await strapi.service("admin::role").checkRolesIdForDeletion([id]);
+      if (strapi.ee.features.isEnabled("sso")) {
+        await strapi.service("admin::role").ssoCheckRolesIdForDeletion([id]);
+      }
+    } catch (e) {
+      return this.createError({ path: "id", message: e.message });
+    }
+    return true;
+  }
+);
+const validateRoleCreateInput = validateYupSchema(roleCreateSchema);
+const validateRolesDeleteInput = validateYupSchema(rolesDeleteSchema);
+const validateRoleDeleteInput = validateYupSchema(roleDeleteSchema);
+const role = {
+  /**
+   * Create a new role
+   * @param {KoaContext} ctx - koa context
+   */
+  async create(ctx) {
+    await validateRoleCreateInput(ctx.request.body);
+    const roleService = getService("role");
+    const role2 = await roleService.create(ctx.request.body);
+    const sanitizedRole = roleService.sanitizeRole(role2);
+    ctx.created({ data: sanitizedRole });
+  },
+  /**
+   * Delete a role
+   * @param {KoaContext} ctx - koa context
+   */
+  async deleteOne(ctx) {
+    const { id } = ctx.params;
+    await validateRoleDeleteInput(id);
+    const roleService = getService("role");
+    const roles2 = await roleService.deleteByIds([id]);
+    const sanitizedRole = roles2.map((role2) => roleService.sanitizeRole(role2))[0] || null;
+    return ctx.deleted({
+      data: sanitizedRole
+    });
+  },
+  /**
+   * delete several roles
+   * @param {KoaContext} ctx - koa context
+   */
+  async deleteMany(ctx) {
+    const { body } = ctx.request;
+    await validateRolesDeleteInput(body);
+    const roleService = getService("role");
+    const roles2 = await roleService.deleteByIds(body.ids);
+    const sanitizedRoles = roles2.map(roleService.sanitizeRole);
+    return ctx.deleted({
+      data: sanitizedRoles
+    });
+  }
+};
+const ssoUserCreationInputExtension = yup.object().shape({
+  useSSORegistration: yup.boolean()
+}).noUnknown();
+const validateUserCreationInput = (data) => {
+  let schema = schemas.userCreationSchema;
+  if (strapi.ee.features.isEnabled("sso")) {
+    schema = schema.concat(ssoUserCreationInputExtension);
+  }
+  return validateYupSchema(schema)(data);
+};
+const { ApplicationError, ForbiddenError } = errors;
+const pickUserCreationAttributes = pick(["firstname", "lastname", "email", "roles"]);
+const hasAdminSeatsAvaialble = async () => {
+  if (!strapi.EE) {
+    return true;
+  }
+  const permittedSeats = strapi.ee.seats;
+  if (isNil(permittedSeats)) {
+    return true;
+  }
+  const userCount = await strapi.service("admin::user").getCurrentActiveUserCount();
+  if (userCount < permittedSeats) {
+    return true;
+  }
+};
+const user = {
+  async create(ctx) {
+    if (!await hasAdminSeatsAvaialble()) {
+      throw new ForbiddenError("License seat limit reached. You cannot create a new user");
+    }
+    const { body } = ctx.request;
+    const cleanData = { ...body, email: ___default.get(body, `email`, ``).toLowerCase() };
+    await validateUserCreationInput(cleanData);
+    const attributes = pickUserCreationAttributes(cleanData);
+    const { useSSORegistration } = cleanData;
+    const userAlreadyExists = await getService("user").exists({ email: attributes.email });
+    if (userAlreadyExists) {
+      throw new ApplicationError("Email already taken");
+    }
+    if (useSSORegistration) {
+      Object.assign(attributes, { registrationToken: null, isActive: true });
+    }
+    const createdUser = await getService("user").create(attributes);
+    const userInfo = getService("user").sanitizeUser(createdUser);
+    Object.assign(userInfo, { registrationToken: createdUser.registrationToken });
+    ctx.created({ data: userInfo });
+  },
+  async update(ctx) {
+    const { id } = ctx.params;
+    const { body: input } = ctx.request;
+    await validateUserUpdateInput(input);
+    if (___default.has(input, "email")) {
+      const uniqueEmailCheck = await getService("user").exists({
+        id: { $ne: id },
+        email: input.email
+      });
+      if (uniqueEmailCheck) {
+        throw new ApplicationError("A user with this email address already exists");
+      }
+    }
+    const user2 = await getService("user").findOne(id, null);
+    if (!await hasAdminSeatsAvaialble() && !user2.isActive && input.isActive) {
+      throw new ForbiddenError("License seat limit reached. You cannot active this user");
+    }
+    const updatedUser = await getService("user").updateById(id, input);
+    if (!updatedUser) {
+      return ctx.notFound("User does not exist");
+    }
+    ctx.body = {
+      data: getService("user").sanitizeUser(updatedUser)
+    };
+  },
+  async isSSOLocked(ctx) {
+    const { user: user2 } = ctx.state;
+    const isSSOLocked = await isSsoLocked(user2);
+    ctx.body = {
+      data: {
+        isSSOLocked
+      }
+    };
+  }
+};
+const admin$2 = {
+  // NOTE: Overrides CE admin controller
+  async getProjectType() {
+    const flags = strapi.config.get("admin.flags", {});
+    try {
+      return { data: { isEE: strapi.EE, features: strapi.ee.features.list(), flags } };
+    } catch (err) {
+      return { data: { isEE: false, features: [], flags } };
+    }
+  },
+  async licenseLimitInformation() {
+    const permittedSeats = strapi.ee.seats;
+    let shouldNotify = false;
+    let licenseLimitStatus = null;
+    let enforcementUserCount;
+    const currentActiveUserCount = await getService("user").getCurrentActiveUserCount();
+    const eeDisabledUsers = await getService("seat-enforcement").getDisabledUserList();
+    if (eeDisabledUsers) {
+      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;
+    } else {
+      enforcementUserCount = currentActiveUserCount;
+    }
+    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {
+      shouldNotify = true;
+      licenseLimitStatus = "OVER_LIMIT";
+    }
+    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {
+      shouldNotify = true;
+      licenseLimitStatus = "AT_LIMIT";
+    }
+    const data = {
+      enforcementUserCount,
+      currentActiveUserCount,
+      permittedSeats,
+      shouldNotify,
+      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,
+      licenseLimitStatus,
+      isHostedOnStrapiCloud: env("STRAPI_HOSTING", null) === "strapi.cloud",
+      features: strapi.ee.features.list() ?? []
+    };
+    return { data };
+  }
+};
+const controllers = {
+  authentication,
+  role,
+  user,
+  admin: admin$2
+};
+const enableFeatureMiddleware = (featureName) => (ctx, next) => {
+  if (strapi.ee.features.isEnabled(featureName)) {
+    return next();
+  }
+  ctx.status = 404;
+};
+const sso = {
+  type: "admin",
+  routes: [
+    {
+      method: "GET",
+      path: "/providers",
+      handler: "authentication.getProviders",
+      config: {
+        middlewares: [enableFeatureMiddleware("sso")],
+        auth: false
+      }
+    },
+    {
+      method: "GET",
+      path: "/connect/:provider",
+      handler: "authentication.providerLogin",
+      config: {
+        middlewares: [enableFeatureMiddleware("sso")],
+        auth: false
+      }
+    },
+    {
+      method: "POST",
+      path: "/connect/:provider",
+      handler: "authentication.providerLogin",
+      config: {
+        middlewares: [enableFeatureMiddleware("sso")],
+        auth: false
+      }
+    },
+    {
+      method: "GET",
+      path: "/providers/options",
+      handler: "authentication.getProviderLoginOptions",
+      config: {
+        middlewares: [enableFeatureMiddleware("sso")],
+        policies: [
+          "admin::isAuthenticatedAdmin",
+          { name: "admin::hasPermissions", config: { actions: ["admin::provider-login.read"] } }
+        ]
+      }
+    },
+    {
+      method: "PUT",
+      path: "/providers/options",
+      handler: "authentication.updateProviderLoginOptions",
+      config: {
+        middlewares: [enableFeatureMiddleware("sso")],
+        policies: [
+          "admin::isAuthenticatedAdmin",
+          { name: "admin::hasPermissions", config: { actions: ["admin::provider-login.update"] } }
+        ]
+      }
+    },
+    {
+      method: "GET",
+      path: "/providers/isSSOLocked",
+      handler: "user.isSSOLocked",
+      config: {
+        middlewares: [enableFeatureMiddleware("sso")],
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    }
+  ]
+};
+const licenseLimit = {
+  type: "admin",
+  routes: [
+    // License limit infos
+    {
+      method: "GET",
+      path: "/license-limit-information",
+      handler: "admin.licenseLimitInformation",
+      config: {
+        policies: [
+          "admin::isAuthenticatedAdmin",
+          {
+            name: "admin::hasPermissions",
+            config: {
+              actions: [
+                "admin::users.create",
+                "admin::users.read",
+                "admin::users.update",
+                "admin::users.delete"
+              ]
+            }
+          }
+        ]
+      }
+    }
+  ]
+};
+const routes = {
+  sso,
+  "license-limit": licenseLimit
+};
+const auditLogsRoutes = {
+  type: "admin",
+  routes: [
+    {
+      method: "GET",
+      path: "/audit-logs",
+      handler: "audit-logs.findMany",
+      config: {
+        middlewares: [enableFeatureMiddleware("audit-logs")],
+        policies: [
+          "admin::isAuthenticatedAdmin",
+          {
+            name: "admin::hasPermissions",
+            config: {
+              actions: ["admin::audit-logs.read"]
+            }
+          }
+        ]
+      }
+    },
+    {
+      method: "GET",
+      path: "/audit-logs/:id",
+      handler: "audit-logs.findOne",
+      config: {
+        middlewares: [enableFeatureMiddleware("audit-logs")],
+        policies: [
+          "admin::isAuthenticatedAdmin",
+          {
+            name: "admin::hasPermissions",
+            config: {
+              actions: ["admin::audit-logs.read"]
+            }
+          }
+        ]
+      }
+    }
+  ]
+};
+const ALLOWED_SORT_STRINGS = ["action:ASC", "action:DESC", "date:ASC", "date:DESC"];
+const validateFindManySchema = yup.object().shape({
+  page: yup.number().integer().min(1),
+  pageSize: yup.number().integer().min(1).max(100),
+  sort: yup.mixed().oneOf(ALLOWED_SORT_STRINGS)
+}).required();
+const validateFindMany = validateYupSchema(validateFindManySchema, { strict: false });
+const auditLogsController = {
+  async findMany(ctx) {
+    const { query } = ctx.request;
+    await validateFindMany(query);
+    const auditLogs = strapi.get("audit-logs");
+    const body = await auditLogs.findMany(query);
+    ctx.body = body;
+  },
+  async findOne(ctx) {
+    const { id } = ctx.params;
+    const auditLogs = strapi.get("audit-logs");
+    const body = await auditLogs.findOne(id);
+    ctx.body = body;
+    strapi.telemetry.send("didWatchAnAuditLog");
+  }
+};
+const getSanitizedUser = (user2) => {
+  let displayName = user2.email;
+  if (user2.username) {
+    displayName = user2.username;
+  } else if (user2.firstname && user2.lastname) {
+    displayName = `${user2.firstname} ${user2.lastname}`;
+  }
+  return {
+    id: user2.id,
+    email: user2.email,
+    displayName
+  };
+};
+const createAuditLogsService = (strapi2) => {
+  return {
+    async saveEvent(event) {
+      const { userId, ...rest } = event;
+      const auditLog2 = { ...rest, user: userId };
+      await strapi2.db?.query("admin::audit-log").create({ data: auditLog2 });
+      return this;
+    },
+    async findMany(query) {
+      const { results, pagination } = await strapi2.db?.query("admin::audit-log").findPage({
+        populate: ["user"],
+        select: ["action", "date", "payload"],
+        ...strapi2.get("query-params").transform("admin::audit-log", query)
+      });
+      const sanitizedResults = results.map((result) => {
+        const { user: user2, ...rest } = result;
+        return {
+          ...rest,
+          user: user2 ? getSanitizedUser(user2) : null
+        };
+      });
+      return {
+        results: sanitizedResults,
+        pagination
+      };
+    },
+    async findOne(id) {
+      const result = await strapi2.db?.query("admin::audit-log").findOne({
+        where: { id },
+        populate: ["user"],
+        select: ["action", "date", "payload"]
+      });
+      if (!result) {
+        return null;
+      }
+      const { user: user2, ...rest } = result;
+      return {
+        ...rest,
+        user: user2 ? getSanitizedUser(user2) : null
+      };
+    },
+    deleteExpiredEvents(expirationDate) {
+      return strapi2.db?.query("admin::audit-log").deleteMany({
+        where: {
+          date: {
+            $lt: expirationDate.toISOString()
+          }
+        }
+      });
+    }
+  };
+};
+const DEFAULT_RETENTION_DAYS = 90;
+const defaultEvents = [
+  "entry.create",
+  "entry.update",
+  "entry.delete",
+  "entry.publish",
+  "entry.unpublish",
+  "media.create",
+  "media.update",
+  "media.delete",
+  "media-folder.create",
+  "media-folder.update",
+  "media-folder.delete",
+  "user.create",
+  "user.update",
+  "user.delete",
+  "admin.auth.success",
+  "admin.logout",
+  "content-type.create",
+  "content-type.update",
+  "content-type.delete",
+  "component.create",
+  "component.update",
+  "component.delete",
+  "role.create",
+  "role.update",
+  "role.delete",
+  "permission.create",
+  "permission.update",
+  "permission.delete"
+];
+const getEventMap = (defaultEvents2) => {
+  const getDefaultPayload = (...args) => args[0];
+  return defaultEvents2.reduce((acc, event) => {
+    acc[event] = getDefaultPayload;
+    return acc;
+  }, {});
+};
+const getRetentionDays = (strapi2) => {
+  const featureConfig = strapi2.ee.features.get("audit-logs");
+  const licenseRetentionDays = typeof featureConfig === "object" && featureConfig?.options.retentionDays;
+  const userRetentionDays = strapi2.config.get("admin.auditLogs.retentionDays");
+  if (licenseRetentionDays == null) {
+    return userRetentionDays ?? DEFAULT_RETENTION_DAYS;
+  }
+  if (userRetentionDays && userRetentionDays < licenseRetentionDays) {
+    return userRetentionDays;
+  }
+  return licenseRetentionDays;
+};
+const createAuditLogsLifecycleService = (strapi2) => {
+  const state = {};
+  const auditLogsService = strapi2.get("audit-logs");
+  const eventMap = getEventMap(defaultEvents);
+  const processEvent = (name2, ...args) => {
+    const requestState = strapi2.requestContext.get()?.state;
+    const isUsingAdminAuth = requestState?.route.info.type === "admin";
+    const user2 = requestState?.user;
+    if (!isUsingAdminAuth || !user2) {
+      return null;
+    }
+    const getPayload = eventMap[name2];
+    if (!getPayload) {
+      return null;
+    }
+    const ignoredUids = ["plugin::upload.file", "plugin::upload.folder"];
+    if (ignoredUids.includes(args[0]?.uid)) {
+      return null;
+    }
+    return {
+      action: name2,
+      date: (/* @__PURE__ */ new Date()).toISOString(),
+      payload: getPayload(...args) || {},
+      userId: user2.id
+    };
+  };
+  const handleEvent = async (name2, ...args) => {
+    const processedEvent = processEvent(name2, ...args);
+    if (processedEvent) {
+      await auditLogsService.saveEvent(processedEvent);
+    }
+  };
+  return {
+    async register() {
+      if (!state.eeEnableUnsubscribe) {
+        state.eeEnableUnsubscribe = strapi2.eventHub.on("ee.enable", () => {
+          this.destroy();
+          this.register();
+        });
+      }
+      if (!state.eeUpdateUnsubscribe) {
+        state.eeUpdateUnsubscribe = strapi2.eventHub.on("ee.update", () => {
+          this.destroy();
+          this.register();
+        });
+      }
+      state.eeDisableUnsubscribe = strapi2.eventHub.on("ee.disable", () => {
+        this.destroy();
+      });
+      if (!strapi2.ee.features.isEnabled("audit-logs")) {
+        return this;
+      }
+      state.eventHubUnsubscribe = strapi2.eventHub.subscribe(handleEvent);
+      const retentionDays = getRetentionDays(strapi2);
+      state.deleteExpiredJob = scheduleJob("0 0 * * *", () => {
+        const expirationDate = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1e3);
+        auditLogsService.deleteExpiredEvents(expirationDate);
+      });
+      return this;
+    },
+    unsubscribe() {
+      if (state.eeDisableUnsubscribe) {
+        state.eeDisableUnsubscribe();
+      }
+      if (state.eventHubUnsubscribe) {
+        state.eventHubUnsubscribe();
+      }
+      if (state.deleteExpiredJob) {
+        state.deleteExpiredJob.cancel();
+      }
+      return this;
+    },
+    destroy() {
+      return this.unsubscribe();
+    }
+  };
+};
+const auditLog = {
+  schema: {
+    kind: "collectionType",
+    collectionName: "strapi_audit_logs",
+    info: {
+      singularName: "audit-log",
+      pluralName: "audit-logs",
+      displayName: "Audit Log"
+    },
+    options: {
+      timestamps: false
+    },
+    pluginOptions: {
+      "content-manager": {
+        visible: false
+      },
+      "content-type-builder": {
+        visible: false
+      }
+    },
+    attributes: {
+      action: {
+        type: "string",
+        required: true
+      },
+      date: {
+        type: "datetime",
+        required: true
+      },
+      user: {
+        type: "relation",
+        relation: "oneToOne",
+        target: "admin::user"
+      },
+      payload: {
+        type: "json"
+      }
+    }
+  }
+};
+const getAdminEE = () => {
+  const eeAdmin = {
+    register,
+    bootstrap,
+    destroy,
+    contentTypes: {
+      // Always register the audit-log content type to prevent data loss
+      "audit-log": auditLog,
+      ...adminContentTypes
+    },
+    services,
+    controllers,
+    routes
+  };
+  if (strapi.config.get("admin.auditLogs.enabled", true) && strapi.ee.features.isEnabled("audit-logs")) {
+    return {
+      ...eeAdmin,
+      controllers: {
+        ...eeAdmin.controllers,
+        "audit-logs": auditLogsController
+      },
+      routes: {
+        ...eeAdmin.routes,
+        "audit-logs": auditLogsRoutes
+      },
+      async register({ strapi: strapi2 }) {
+        await eeAdmin.register({ strapi: strapi2 });
+        strapi2.add("audit-logs", createAuditLogsService(strapi2));
+        const auditLogsLifecycle = createAuditLogsLifecycleService(strapi2);
+        strapi2.add("audit-logs-lifecycle", auditLogsLifecycle);
+        await auditLogsLifecycle.register();
+      },
+      async destroy({ strapi: strapi2 }) {
+        strapi2.get("audit-logs-lifecycle").destroy();
+        await eeAdmin.destroy({ strapi: strapi2 });
+      }
+    };
+  }
+  return eeAdmin;
+};
+let admin = {
+  bootstrap: bootstrap$1,
+  register: register$2,
+  destroy: destroy$1,
+  config,
+  policies,
+  routes: routes$1,
+  services: services$1,
+  controllers: controllers$1,
+  contentTypes,
+  middlewares: middlewares$1
+};
+const mergeRoutes = (a, b, key) => {
+  return ___default.isArray(a) && ___default.isArray(b) && key === "routes" ? a.concat(b) : void 0;
+};
+if (strapi.EE) {
+  admin = ___default.mergeWith({}, admin, getAdminEE(), mergeRoutes);
+}
+const admin$1 = admin;
 export {
-  bootstrap,
-  index$6 as config,
-  index$1 as contentTypes,
-  index$2 as controllers,
-  destroy,
-  index as middlewares,
-  index$5 as policies,
-  register$1 as register,
-  routes,
-  index$3 as services
+  admin$1 as default
 };
 //# sourceMappingURL=index.mjs.map