@strapi/admin 5.27.0 → 5.29.0

package/dist/admin/src/utils/widgetLayout.d.ts

@@ -0,0 +1,78 @@
+/**
+ *
+ * Comprehensive utilities for widget layout operations including sizing, positioning, and layout calculations.
+ *
+ * Constraints:
+ * - Maximum 3 widgets per row (since minimum widget width is 4 columns)
+ * - Widget widths are snapped to discrete values: 4 (1/3), 6 (1/2), 8 (2/3), 12 (3/3)
+ */
+import type { Homepage } from '../../../shared/contracts/homepage';
+import type { WidgetWithUID } from '../core/apis/Widgets';
+export declare const WIDGET_SIZING: {
+    readonly TOTAL_COLUMNS: 12;
+    readonly MIN_WIDGET_WIDTH: 4;
+    readonly DISCRETE_SIZES: readonly [4, 6, 8, 12];
+};
+export declare const WIDGET_DATA_ATTRIBUTES: {
+    readonly WIDGET_ID: "data-strapi-widget-id";
+    readonly GRID_CONTAINER: "data-strapi-grid-container";
+};
+export declare const getWidgetElement: (uid: string) => HTMLElement | null;
+export declare const getWidgetGridContainer: () => HTMLElement | null;
+export interface WidgetRow {
+    widgets: WidgetWithUID[];
+    totalWidth: number;
+    startIndex: number;
+    endIndex: number;
+}
+/**
+ * Validates if a widget width is valid (within constraints)
+ */
+export declare const isValidWidgetWidth: (width: number) => boolean;
+/**
+ * Validates if a resize operation is allowed between two widgets
+ */
+export declare const isValidResizeOperation: (leftWidth: number, rightWidth: number) => boolean;
+/**
+ * Gets widget width with fallback to default value
+ */
+export declare const getWidgetWidth: (columnWidths: Record<string, number>, widgetId: string | undefined, defaultWidth?: number) => number;
+/**
+ * Calculates the current row structure from widgets and their widths
+ */
+export declare const calculateWidgetRows: (widgets: WidgetWithUID[], columnWidths: Record<string, number>) => WidgetRow[];
+/**
+ * Calculates optimal layout for a specific row based on widget count
+ * Only enforces constraints when necessary:
+ * - 1 widget in row: must be 3/3 (12 columns)
+ * - 3 widgets in row: must be 1/3+1/3+1/3 (4+4+4 columns)
+ * - 2 widgets in row: preserves existing proportions or uses 1/2+1/2
+ */
+export declare const calculateOptimalLayoutForRow: (widgetsInRow: WidgetWithUID[], currentColumnWidths: Record<string, number>) => Record<string, number>;
+export declare const moveWidgetInArray: (widgets: WidgetWithUID[], widgetId: string, insertIndex: number) => WidgetWithUID[];
+export declare const findRowContainingWidget: (widgetRows: WidgetRow[], widgetId: string, widgets: WidgetWithUID[]) => WidgetRow | undefined;
+export declare const resizeRowAfterRemoval: (row: WidgetRow | undefined, removedWidgetId: string, currentWidths: Record<string, number>) => Record<string, number>;
+export declare const resizeRowAfterAddition: (row: WidgetRow | undefined, addedWidget: WidgetWithUID, insertIndex: number, currentWidths: Record<string, number>) => Record<string, number>;
+export declare const isLastWidgetInRow: (widgetIndex: number, widgets: WidgetWithUID[], columnWidths: Record<string, number>) => boolean;
+export declare const canResizeBetweenWidgets: (leftWidgetId: string, rightWidgetId: string, columnWidths: Record<string, number>, widgets: WidgetWithUID[]) => boolean;
+/**
+ * Filters widgets to only include those present in the homepage layout
+ */
+export declare const filterWidgetsByHomepageLayout: (widgets: WidgetWithUID[], homepageLayout: Homepage.Layout) => WidgetWithUID[];
+/**
+ * Sorts widgets according to the homepage layout order
+ */
+export declare const sortWidgetsByHomepageLayout: (widgets: WidgetWithUID[], homepageLayout: Homepage.Layout) => WidgetWithUID[];
+/**
+ * Applies homepage layout to widgets (filters, sorts, and extracts widths)
+ */
+export declare const applyHomepageLayout: (authorizedWidgets: WidgetWithUID[], homepageLayout: Homepage.Layout) => {
+    filteredWidgets: WidgetWithUID[];
+    widths: Record<string, number>;
+};
+/**
+ * Creates default widget widths based on widget count
+ * Even count: all widgets get width 6
+ * Odd count: all widgets get width 6 except the last one which gets width 12
+ */
+export declare const createDefaultWidgetWidths: (widgets: WidgetWithUID[]) => Record<string, number>;

package/dist/ee/server/src/controllers/authentication-utils/middlewares.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAa1C,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,iBA0B/B,CAAC;AA4DF,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,iBAuDnC,CAAC;;;;;AAEF,wBAGE"}
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAa1C,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,iBA0B/B,CAAC;AA4DF,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,iBA0DnC,CAAC;;;;;AAEF,wBAGE"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js

@@ -108,11 +108,13 @@ const redirectWithAuth = async (ctx)=>{
             return ctx.redirect(redirectUrls.error);
         }
         const { token: accessToken } = accessResult;
-        const isProduction = strapi.config.get('environment') === 'production';
+        const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
+        const isProduction = process.env.NODE_ENV === 'production';
+        const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
         const domain = strapi.config.get('admin.auth.domain');
         ctx.cookies.set('jwtToken', accessToken, {
             httpOnly: false,
-            secure: isProduction,
+            secure: isSecure,
             overwrite: true,
             domain
         });

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const isProduction = strapi.config.get('environment') === 'production';\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isProduction,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","isProduction","config","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAM,CAAA,4BAAA,CAAA;AAExC,MAAMC,YAAuC,GAAA,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAU,EAAA,IAAA,EAAM,OAAOK,KAAOC,EAAAA,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAO,EAAA;gBACTG,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,gBAAAA,KAAAA,EAAOA,KAASX,IAAAA,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAuBC,GAAAA,uBAAAA;AAE/C,QAAA,OAAOF,QAASnB,CAAAA,GAAAA,EAAKC,IAAMe,CAAAA,CAAAA,IAAAA,IAAQP,OAASN,EAAAA,QAAAA,CAAAA;AAC9C,KAAA,CAAA,CAAGH,GAAKC,EAAAA,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBACJ,GAAA,CAACpB,GAAKC,EAAAA,IAAAA,GAAS,OAAOe,IAAWb,EAAAA,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAKM,CAAAA,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBACvCN,KAAO,EAAA,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAKO,CAAAA,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,KAAA;AAEF,MAAMoB,uBACJ,GAAA,CAACrB,GAAKC,EAAAA,IAAAA,GAAS,OAAOQ,OAAcN,EAAAA,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAK,EAAA;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAUK,CAAAA,WAAW,IAAIF,uBAAyB,EAAA;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM2B,WAAc,GAAA,MAAMlB,gBAAW,CAAA,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAa,EAAA;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;;QAGAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAW,CAAA,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAO,EAAA;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAU,EAAA,IAAA;YACViB,iBAAmB,EAAA;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAA+B,EAAA;YAClDE,IAAMhB,EAAAA,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,KAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAgB,EAAA;YACnB9B,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEA,MAAMmC,MAAAA,GAASC,MAAO5B,CAAAA,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAWC,GAAAA,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cACvD,CAAA,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAU,EAAA;YACvCM,IAAM,EAAA;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,yCAA6B,SAAWJ,EAAAA,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAe,GAAA,MAAMhB,cAAe,CAAA,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAc,EAAA;YAC3B9C,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,eAAejD,MAAOkD,CAAAA,MAAM,CAAC9B,GAAG,CAAC,aAAmB,CAAA,KAAA,YAAA;AAC1D,QAAA,MAAM+B,MAA6BnD,GAAAA,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAa,EAAA;YACvCI,QAAU,EAAA,KAAA;YACVC,MAAQJ,EAAAA,YAAAA;YACRK,SAAW,EAAA,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAgBjD,GAAAA,gBAAAA,CAAW,MAAQkD,CAAAA,CAAAA,YAAY,CAACnD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAsB,EAAA;YAAEE,IAAMkD,EAAAA,aAAAA;AAAe/D,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAagE,OAAO,CAAA;AACnC,KAAA,CAAE,OAAO5D,KAAO,EAAA;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAqDA,EAAAA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,YAAAA,KAAAA,EAAOA,KAAiBV,YAAAA,KAAAA,GAAQU,KAAQ,GAAA,IAAIV,KAAM,CAAA,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAE;;;;;;"}
+{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAM,CAAA,4BAAA,CAAA;AAExC,MAAMC,YAAuC,GAAA,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAU,EAAA,IAAA,EAAM,OAAOK,KAAOC,EAAAA,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAO,EAAA;gBACTG,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,gBAAAA,KAAAA,EAAOA,KAASX,IAAAA,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAuBC,GAAAA,uBAAAA;AAE/C,QAAA,OAAOF,QAASnB,CAAAA,GAAAA,EAAKC,IAAMe,CAAAA,CAAAA,IAAAA,IAAQP,OAASN,EAAAA,QAAAA,CAAAA;AAC9C,KAAA,CAAA,CAAGH,GAAKC,EAAAA,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBACJ,GAAA,CAACpB,GAAKC,EAAAA,IAAAA,GAAS,OAAOe,IAAWb,EAAAA,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAKM,CAAAA,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBACvCN,KAAO,EAAA,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAKO,CAAAA,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,KAAA;AAEF,MAAMoB,uBACJ,GAAA,CAACrB,GAAKC,EAAAA,IAAAA,GAAS,OAAOQ,OAAcN,EAAAA,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAK,EAAA;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAUK,CAAAA,WAAW,IAAIF,uBAAyB,EAAA;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM2B,WAAc,GAAA,MAAMlB,gBAAW,CAAA,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAa,EAAA;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;;QAGAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAW,CAAA,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAO,EAAA;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAU,EAAA,IAAA;YACViB,iBAAmB,EAAA;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAA+B,EAAA;YAClDE,IAAMhB,EAAAA,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,KAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAgB,EAAA;YACnB9B,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEA,MAAMmC,MAAAA,GAASC,MAAO5B,CAAAA,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAWC,GAAAA,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cACvD,CAAA,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAU,EAAA;YACvCM,IAAM,EAAA;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,yCAA6B,SAAWJ,EAAAA,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAe,GAAA,MAAMhB,cAAe,CAAA,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAc,EAAA;YAC3B9C,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAmBjD,GAAAA,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAeC,GAAAA,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAW,GAAA,OAAON,gBAAqB,KAAA,SAAA,GAAYA,gBAAmBE,GAAAA,YAAAA;AAE5E,QAAA,MAAMK,MAA6BxD,GAAAA,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAa,EAAA;YACvCS,QAAU,EAAA,KAAA;YACVC,MAAQH,EAAAA,QAAAA;YACRI,SAAW,EAAA,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAgBtD,GAAAA,gBAAAA,CAAW,MAAQuD,CAAAA,CAAAA,YAAY,CAACxD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAsB,EAAA;YAAEE,IAAMuD,EAAAA,aAAAA;AAAepE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaqE,OAAO,CAAA;AACnC,KAAA,CAAE,OAAOjE,KAAO,EAAA;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAqDA,EAAAA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,YAAAA,KAAAA,EAAOA,KAAiBV,YAAAA,KAAAA,GAAQU,KAAQ,GAAA,IAAIV,KAAM,CAAA,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAE;;;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs

@@ -104,11 +104,13 @@ const redirectWithAuth = async (ctx)=>{
             return ctx.redirect(redirectUrls.error);
         }
         const { token: accessToken } = accessResult;
-        const isProduction = strapi.config.get('environment') === 'production';
+        const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
+        const isProduction = process.env.NODE_ENV === 'production';
+        const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
         const domain = strapi.config.get('admin.auth.domain');
         ctx.cookies.set('jwtToken', accessToken, {
             httpOnly: false,
-            secure: isProduction,
+            secure: isSecure,
             overwrite: true,
             domain
         });

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const isProduction = strapi.config.get('environment') === 'production';\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isProduction,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","isProduction","config","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAM,CAAA,4BAAA,CAAA;AAExC,MAAMC,YAAuC,GAAA,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAU,EAAA,IAAA,EAAM,OAAOK,KAAOC,EAAAA,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAO,EAAA;gBACTG,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,gBAAAA,KAAAA,EAAOA,KAASX,IAAAA,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAuBC,GAAAA,uBAAAA;AAE/C,QAAA,OAAOF,QAASnB,CAAAA,GAAAA,EAAKC,IAAMe,CAAAA,CAAAA,IAAAA,IAAQP,OAASN,EAAAA,QAAAA,CAAAA;AAC9C,KAAA,CAAA,CAAGH,GAAKC,EAAAA,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBACJ,GAAA,CAACpB,GAAKC,EAAAA,IAAAA,GAAS,OAAOe,IAAWb,EAAAA,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAKM,CAAAA,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBACvCN,KAAO,EAAA,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAKO,CAAAA,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,KAAA;AAEF,MAAMoB,uBACJ,GAAA,CAACrB,GAAKC,EAAAA,IAAAA,GAAS,OAAOQ,OAAcN,EAAAA,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAK,EAAA;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAUK,CAAAA,WAAW,IAAIF,uBAAyB,EAAA;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM2B,WAAc,GAAA,MAAMlB,UAAW,CAAA,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAa,EAAA;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;;QAGAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAW,CAAA,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAO,EAAA;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAU,EAAA,IAAA;YACViB,iBAAmB,EAAA;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAA+B,EAAA;YAClDE,IAAMhB,EAAAA,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,KAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAiBC,GAAAA,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAgB,EAAA;YACnB9B,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEA,MAAMmC,MAAAA,GAASC,MAAO5B,CAAAA,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAWC,GAAAA,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cACvD,CAAA,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAU,EAAA;YACvCM,IAAM,EAAA;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,6BAA6B,SAAWJ,EAAAA,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,qBAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAe,GAAA,MAAMhB,cAAe,CAAA,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAc,EAAA;YAC3B9C,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,eAAejD,MAAOkD,CAAAA,MAAM,CAAC9B,GAAG,CAAC,aAAmB,CAAA,KAAA,YAAA;AAC1D,QAAA,MAAM+B,MAA6BnD,GAAAA,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAa,EAAA;YACvCI,QAAU,EAAA,KAAA;YACVC,MAAQJ,EAAAA,YAAAA;YACRK,SAAW,EAAA,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAgBjD,GAAAA,UAAAA,CAAW,MAAQkD,CAAAA,CAAAA,YAAY,CAACnD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAsB,EAAA;YAAEE,IAAMkD,EAAAA,aAAAA;AAAe/D,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAagE,OAAO,CAAA;AACnC,KAAA,CAAE,OAAO5D,KAAO,EAAA;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAqDA,EAAAA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,YAAAA,KAAAA,EAAOA,KAAiBV,YAAAA,KAAAA,GAAQU,KAAQ,GAAA,IAAIV,KAAM,CAAA,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAE;;;;"}
+{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAM,CAAA,4BAAA,CAAA;AAExC,MAAMC,YAAuC,GAAA,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAU,EAAA,IAAA,EAAM,OAAOK,KAAOC,EAAAA,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAO,EAAA;gBACTG,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,gBAAAA,KAAAA,EAAOA,KAASX,IAAAA,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAuBC,GAAAA,uBAAAA;AAE/C,QAAA,OAAOF,QAASnB,CAAAA,GAAAA,EAAKC,IAAMe,CAAAA,CAAAA,IAAAA,IAAQP,OAASN,EAAAA,QAAAA,CAAAA;AAC9C,KAAA,CAAA,CAAGH,GAAKC,EAAAA,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBACJ,GAAA,CAACpB,GAAKC,EAAAA,IAAAA,GAAS,OAAOe,IAAWb,EAAAA,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAKM,CAAAA,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBACvCN,KAAO,EAAA,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAKO,CAAAA,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,KAAA;AAEF,MAAMoB,uBACJ,GAAA,CAACrB,GAAKC,EAAAA,IAAAA,GAAS,OAAOQ,OAAcN,EAAAA,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAK,EAAA;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAUK,CAAAA,WAAW,IAAIF,uBAAyB,EAAA;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM2B,WAAc,GAAA,MAAMlB,UAAW,CAAA,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAa,EAAA;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;gBAAEN,KAAOX,EAAAA,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;;QAGAR,GAAIwB,CAAAA,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAW,CAAA,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAO,EAAA;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAU,EAAA,IAAA;YACViB,iBAAmB,EAAA;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAA+B,EAAA;YAClDE,IAAMhB,EAAAA,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,KAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAQ,EAAA,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAiBC,GAAAA,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAgB,EAAA;YACnB9B,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;QAEA,MAAMmC,MAAAA,GAASC,MAAO5B,CAAAA,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAWC,GAAAA,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cACvD,CAAA,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAU,EAAA;YACvCM,IAAM,EAAA;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,6BAA6B,SAAWJ,EAAAA,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,qBAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAe,GAAA,MAAMhB,cAAe,CAAA,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAc,EAAA;YAC3B9C,MAAOC,CAAAA,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAmBjD,GAAAA,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAeC,GAAAA,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAW,GAAA,OAAON,gBAAqB,KAAA,SAAA,GAAYA,gBAAmBE,GAAAA,YAAAA;AAE5E,QAAA,MAAMK,MAA6BxD,GAAAA,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAa,EAAA;YACvCS,QAAU,EAAA,KAAA;YACVC,MAAQH,EAAAA,QAAAA;YACRI,SAAW,EAAA,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAgBtD,GAAAA,UAAAA,CAAW,MAAQuD,CAAAA,CAAAA,YAAY,CAACxD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAsB,EAAA;YAAEE,IAAMuD,EAAAA,aAAAA;AAAepE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaqE,OAAO,CAAA;AACnC,KAAA,CAAE,OAAOjE,KAAO,EAAA;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAqDA,EAAAA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;AACvCN,YAAAA,KAAAA,EAAOA,KAAiBV,YAAAA,KAAAA,GAAQU,KAAQ,GAAA,IAAIV,KAAM,CAAA,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAIe,CAAAA,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAE;;;;"}

package/dist/server/server/src/bootstrap.js

@@ -115,6 +115,11 @@ var bootstrap = (async ({ strapi: strapi1 })=>{
         // Pass through all JWT options (includes privateKey, publicKey, and any other options)
         jwtOptions: options
     });
+    const isProduction = process.env.NODE_ENV === 'production';
+    const adminCookieSecure = strapi1.config.get('admin.auth.cookie.secure');
+    if (isProduction && adminCookieSecure === false) {
+        strapi1.log.warn('Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.');
+    }
     await registerAdminConditions();
     await registerPermissionActions();
     registerModelHooks();

package/dist/server/server/src/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport { getTokenOptions, expiresInToSeconds } from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    afterUpdate({ params }) {\n      if (params.data.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.count();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn if using deprecated legacy expiresIn for new session settings\n  const hasLegacyExpires = options?.expiresIn != null;\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","afterUpdate","params","data","preferedLanguage","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","id","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","query","findMany","map","unknownPermissions","uniq","difference","length","deleteMany","where","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasNewMaxRefresh","config","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;;;AAeA,MAAMA,wBAA2B,GAAA;IAC/BC,SAAW,EAAA;QACTC,YAAc,EAAA,KAAA;QACdC,WAAa,EAAA,IAAA;QACbC,cAAgB,EAAA;AAClB;AACF,CAAA;AAEA,MAAMC,yBAA4B,GAAA,UAAA;AAChC,IAAA,MAAMC,iBAAW,YAAcC,CAAAA,CAAAA,cAAc,CAACC,YAAY,CAACC,qBAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAA0B,GAAA,UAAA;AAC9B,IAAA,MAAML,iBAAW,YAAcM,CAAAA,CAAAA,iBAAiB,CAACJ,YAAY,CAACK,wBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAqB,GAAA,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,gBAAW,CAAA,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAQ,EAAA;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAaN,EAAAA,8BAAAA;QACbO,WAAaP,EAAAA,8BAAAA;QACbQ,WAAY,CAAA,CAAA,EAAEC,MAAM,EAAE,EAAA;AACpB,YAAA,IAAIA,MAAOC,CAAAA,IAAI,CAACC,gBAAgB,EAAE;AAChCX,gBAAAA,8BAAAA,EAAAA;AACF;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMY,gBAAmB,GAAA,UAAA;AACvB,IAAA,MAAMC,UAAa,GAAA,MAAMZ,MAAOa,CAAAA,KAAK,CAAC;QAAEC,IAAM,EAAA,MAAA;QAAQC,IAAM,EAAA;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAoB,GAAA,MAAMJ,UAAWK,CAAAA,GAAG,CAAC;QAAEC,GAAK,EAAA;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,SAAMrC,wBAA0BiC,EAAAA,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAa,GAAA,MAAMhC,gBAAW,CAAA,MAAA,CAAA,CAAQiC,MAAM,CAAC;QACjDC,EAAIJ,EAAAA,eAAAA,CAAgBnC,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACmC,UAAY,EAAA;QACfF,eAAgBnC,CAAAA,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C;IAEA,MAAM0B,UAAAA,CAAWY,GAAG,CAAC;QAAEN,GAAK,EAAA,MAAA;QAAQO,KAAON,EAAAA;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMO,wBAA2B,GAAA,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB3B,MAAO4B,CAAAA,UAAU,CAACC,WAAW,CAAC7C,SAAS,CAAC8C,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAkB,GAAA,MAAMC,WAAMC,CAAAA,IAAI,CACtClC,MAAAA,CAAOC,EAAE,CAACkC,KAAK,CAAC,6BAA+BC,CAAAA,CAAAA,QAAQ,EACvDC,MAAI,CAAA,QAAA,CAAA,CAAA,EAAA;IAGN,MAAMC,kBAAAA,GAAqBC,OAAKC,CAAAA,aAAAA,CAAWR,eAAiBL,EAAAA,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIW,kBAAAA,CAAmBG,MAAM,GAAG,CAAG,EAAA;AACjC,QAAA,MAAMzC,OAAOC,EAAE,CACZkC,KAAK,CAAC,6BAAA,CAAA,CACNO,UAAU,CAAC;YAAEC,KAAO,EAAA;gBAAEb,MAAQ,EAAA;oBAAEc,GAAKN,EAAAA;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMO,8BAAiC,GAAA,UAAA;AACrC,IAAA,MAAMC,cAAczD,gBAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,gBAAW,CAAA,WAAA,CAAA;IAEnC,MAAM2D,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBE,KAAK,EAAA;IAEjD,IAAID,UAAAA,KAAe,CAAKE,IAAAA,aAAAA,KAAkB,CAAG,EAAA;AAC3C,QAAA,KAAK,MAAMC,KAAAA,IAASC,SAAUC,CAAAA,kBAAkB,CAAE;YAChD,MAAMN,eAAAA,CAAgBO,MAAM,CAACH,KAAAA,CAAAA;AAC/B;AACF;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEnD,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEuD,OAAO,EAAE,GAAGC,qBAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,wBAAmBH,CAAAA,OAAAA,EAASI,SAAcC,CAAAA,IAAAA,8CAAAA;IAC5C,MAAMC,wBAAAA,GACJH,wBAAmBH,CAAAA,OAAAA,EAASI,SAAcG,CAAAA,IAAAA,wCAAAA;;IAG5C,MAAMC,gBAAAA,GAAmBR,SAASI,SAAa,IAAA,IAAA;AAC/C,IAAA,MAAMK,mBAAmBhE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,6CAAkD,CAAA,IAAA,IAAA;AAC7F,IAAA,MAAMiD,mBAAmBlE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,wCAA6C,CAAA,IAAA,IAAA;AAExF,IAAA,IAAI8C,qBAAqB,CAACC,gBAAoB,IAAA,CAACE,gBAAe,CAAI,EAAA;QAChElE,OAAOmE,CAAAA,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ;AAEApE,IAAAA,OAAAA,CAAOqE,cAAc,CAACC,YAAY,CAAC,OAAS,EAAA;AAC1CC,QAAAA,SAAAA,EAAWvE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,mBAAA,CAAA;AAC7BuD,QAAAA,mBAAAA,EAAqBxE,QAAOiE,MAAM,CAAChD,GAAG,CAAC,2CAA2C,EAAK,GAAA,EAAA,CAAA;AACvFwD,QAAAA,uBAAAA,EAAyBzE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACxC,6CACAwC,EAAAA,wBAAAA,CAAAA;AAEFiB,QAAAA,wBAAAA,EAA0B1E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACzC,8CACA0D,EAAAA,+CAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB5E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACnC,wCACA4C,EAAAA,wBAAAA,CAAAA;AAEFgB,QAAAA,mBAAAA,EAAqB7E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACpC,yCACA6D,EAAAA,yCAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWxB,OAASwB,EAAAA,SAAAA;;QAEpBC,UAAYzB,EAAAA;AACd,KAAA,CAAA;IAEA,MAAM7D,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMmF,oBAAoB5F,gBAAW,CAAA,YAAA,CAAA;AACrC,IAAA,MAAMyD,cAAczD,gBAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM6F,cAAc7F,gBAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,gBAAW,CAAA,WAAA,CAAA;AACnC,IAAA,MAAM8F,kBAAkB9F,gBAAW,CAAA,UAAA,CAAA;AACnC,IAAA,MAAM+F,eAAe/F,gBAAW,CAAA,OAAA,CAAA;AAEhC,IAAA,MAAM6F,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAM1C,YAAY2C,iCAAiC,EAAA;IAEnD,MAAM9E,gBAAAA,EAAAA;IACN,MAAMe,wBAAAA,EAAAA;IAEN,MAAMrC,gBAAAA,CAAW,SAAWqG,CAAAA,CAAAA,4BAA4B,CAAC1F,OAAAA,CAAAA;IACzDX,gBAAW,CAAA,SAAA,CAAA,CAAWsG,SAAS,CAAC3F,OAAAA,CAAAA;AAEhC+C,IAAAA,eAAAA,CAAgB6C,kBAAkB,EAAA;IAClCT,eAAgBhC,CAAAA,KAAK,CAACyC,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMhD,8BAAAA,EAAAA;AACR,CAAA;;;;"}
+{"version":3,"file":"bootstrap.js","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport { getTokenOptions, expiresInToSeconds } from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    afterUpdate({ params }) {\n      if (params.data.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.count();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn if using deprecated legacy expiresIn for new session settings\n  const hasLegacyExpires = options?.expiresIn != null;\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","afterUpdate","params","data","preferedLanguage","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","id","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","query","findMany","map","unknownPermissions","uniq","difference","length","deleteMany","where","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasNewMaxRefresh","config","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;;;AAeA,MAAMA,wBAA2B,GAAA;IAC/BC,SAAW,EAAA;QACTC,YAAc,EAAA,KAAA;QACdC,WAAa,EAAA,IAAA;QACbC,cAAgB,EAAA;AAClB;AACF,CAAA;AAEA,MAAMC,yBAA4B,GAAA,UAAA;AAChC,IAAA,MAAMC,iBAAW,YAAcC,CAAAA,CAAAA,cAAc,CAACC,YAAY,CAACC,qBAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAA0B,GAAA,UAAA;AAC9B,IAAA,MAAML,iBAAW,YAAcM,CAAAA,CAAAA,iBAAiB,CAACJ,YAAY,CAACK,wBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAqB,GAAA,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,gBAAW,CAAA,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAQ,EAAA;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAaN,EAAAA,8BAAAA;QACbO,WAAaP,EAAAA,8BAAAA;QACbQ,WAAY,CAAA,CAAA,EAAEC,MAAM,EAAE,EAAA;AACpB,YAAA,IAAIA,MAAOC,CAAAA,IAAI,CAACC,gBAAgB,EAAE;AAChCX,gBAAAA,8BAAAA,EAAAA;AACF;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMY,gBAAmB,GAAA,UAAA;AACvB,IAAA,MAAMC,UAAa,GAAA,MAAMZ,MAAOa,CAAAA,KAAK,CAAC;QAAEC,IAAM,EAAA,MAAA;QAAQC,IAAM,EAAA;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAoB,GAAA,MAAMJ,UAAWK,CAAAA,GAAG,CAAC;QAAEC,GAAK,EAAA;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,SAAMrC,wBAA0BiC,EAAAA,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAa,GAAA,MAAMhC,gBAAW,CAAA,MAAA,CAAA,CAAQiC,MAAM,CAAC;QACjDC,EAAIJ,EAAAA,eAAAA,CAAgBnC,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACmC,UAAY,EAAA;QACfF,eAAgBnC,CAAAA,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C;IAEA,MAAM0B,UAAAA,CAAWY,GAAG,CAAC;QAAEN,GAAK,EAAA,MAAA;QAAQO,KAAON,EAAAA;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMO,wBAA2B,GAAA,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB3B,MAAO4B,CAAAA,UAAU,CAACC,WAAW,CAAC7C,SAAS,CAAC8C,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAkB,GAAA,MAAMC,WAAMC,CAAAA,IAAI,CACtClC,MAAAA,CAAOC,EAAE,CAACkC,KAAK,CAAC,6BAA+BC,CAAAA,CAAAA,QAAQ,EACvDC,MAAI,CAAA,QAAA,CAAA,CAAA,EAAA;IAGN,MAAMC,kBAAAA,GAAqBC,OAAKC,CAAAA,aAAAA,CAAWR,eAAiBL,EAAAA,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIW,kBAAAA,CAAmBG,MAAM,GAAG,CAAG,EAAA;AACjC,QAAA,MAAMzC,OAAOC,EAAE,CACZkC,KAAK,CAAC,6BAAA,CAAA,CACNO,UAAU,CAAC;YAAEC,KAAO,EAAA;gBAAEb,MAAQ,EAAA;oBAAEc,GAAKN,EAAAA;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMO,8BAAiC,GAAA,UAAA;AACrC,IAAA,MAAMC,cAAczD,gBAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,gBAAW,CAAA,WAAA,CAAA;IAEnC,MAAM2D,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBE,KAAK,EAAA;IAEjD,IAAID,UAAAA,KAAe,CAAKE,IAAAA,aAAAA,KAAkB,CAAG,EAAA;AAC3C,QAAA,KAAK,MAAMC,KAAAA,IAASC,SAAUC,CAAAA,kBAAkB,CAAE;YAChD,MAAMN,eAAAA,CAAgBO,MAAM,CAACH,KAAAA,CAAAA;AAC/B;AACF;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEnD,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEuD,OAAO,EAAE,GAAGC,qBAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,wBAAmBH,CAAAA,OAAAA,EAASI,SAAcC,CAAAA,IAAAA,8CAAAA;IAC5C,MAAMC,wBAAAA,GACJH,wBAAmBH,CAAAA,OAAAA,EAASI,SAAcG,CAAAA,IAAAA,wCAAAA;;IAG5C,MAAMC,gBAAAA,GAAmBR,SAASI,SAAa,IAAA,IAAA;AAC/C,IAAA,MAAMK,mBAAmBhE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,6CAAkD,CAAA,IAAA,IAAA;AAC7F,IAAA,MAAMiD,mBAAmBlE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,wCAA6C,CAAA,IAAA,IAAA;AAExF,IAAA,IAAI8C,qBAAqB,CAACC,gBAAoB,IAAA,CAACE,gBAAe,CAAI,EAAA;QAChElE,OAAOmE,CAAAA,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ;AAEApE,IAAAA,OAAAA,CAAOqE,cAAc,CAACC,YAAY,CAAC,OAAS,EAAA;AAC1CC,QAAAA,SAAAA,EAAWvE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,mBAAA,CAAA;AAC7BuD,QAAAA,mBAAAA,EAAqBxE,QAAOiE,MAAM,CAAChD,GAAG,CAAC,2CAA2C,EAAK,GAAA,EAAA,CAAA;AACvFwD,QAAAA,uBAAAA,EAAyBzE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACxC,6CACAwC,EAAAA,wBAAAA,CAAAA;AAEFiB,QAAAA,wBAAAA,EAA0B1E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACzC,8CACA0D,EAAAA,+CAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB5E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACnC,wCACA4C,EAAAA,wBAAAA,CAAAA;AAEFgB,QAAAA,mBAAAA,EAAqB7E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACpC,yCACA6D,EAAAA,yCAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWxB,OAASwB,EAAAA,SAAAA;;QAEpBC,UAAYzB,EAAAA;AACd,KAAA,CAAA;AAEA,IAAA,MAAM0B,YAAeC,GAAAA,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAoBrF,GAAAA,OAAAA,CAAOiE,MAAM,CAAChD,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAIgE,YAAAA,IAAgBI,sBAAsB,KAAO,EAAA;QAC/CrF,OAAOmE,CAAAA,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ;IAEA,MAAM1E,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMwF,oBAAoBjG,gBAAW,CAAA,YAAA,CAAA;AACrC,IAAA,MAAMyD,cAAczD,gBAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAMkG,cAAclG,gBAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,gBAAW,CAAA,WAAA,CAAA;AACnC,IAAA,MAAMmG,kBAAkBnG,gBAAW,CAAA,UAAA,CAAA;AACnC,IAAA,MAAMoG,eAAepG,gBAAW,CAAA,OAAA,CAAA;AAEhC,IAAA,MAAMkG,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAM/C,YAAYgD,iCAAiC,EAAA;IAEnD,MAAMnF,gBAAAA,EAAAA;IACN,MAAMe,wBAAAA,EAAAA;IAEN,MAAMrC,gBAAAA,CAAW,SAAW0G,CAAAA,CAAAA,4BAA4B,CAAC/F,OAAAA,CAAAA;IACzDX,gBAAW,CAAA,SAAA,CAAA,CAAW2G,SAAS,CAAChG,OAAAA,CAAAA;AAEhC+C,IAAAA,eAAAA,CAAgBkD,kBAAkB,EAAA;IAClCT,eAAgBrC,CAAAA,KAAK,CAAC8C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMrD,8BAAAA,EAAAA;AACR,CAAA;;;;"}

package/dist/server/server/src/bootstrap.mjs

@@ -113,6 +113,11 @@ var bootstrap = (async ({ strapi: strapi1 })=>{
         // Pass through all JWT options (includes privateKey, publicKey, and any other options)
         jwtOptions: options
     });
+    const isProduction = process.env.NODE_ENV === 'production';
+    const adminCookieSecure = strapi1.config.get('admin.auth.cookie.secure');
+    if (isProduction && adminCookieSecure === false) {
+        strapi1.log.warn('Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.');
+    }
     await registerAdminConditions();
     await registerPermissionActions();
     registerModelHooks();

package/dist/server/server/src/bootstrap.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.mjs","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport { getTokenOptions, expiresInToSeconds } from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    afterUpdate({ params }) {\n      if (params.data.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.count();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn if using deprecated legacy expiresIn for new session settings\n  const hasLegacyExpires = options?.expiresIn != null;\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","afterUpdate","params","data","preferedLanguage","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","id","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","query","findMany","map","unknownPermissions","uniq","difference","length","deleteMany","where","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasNewMaxRefresh","config","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;AAeA,MAAMA,wBAA2B,GAAA;IAC/BC,SAAW,EAAA;QACTC,YAAc,EAAA,KAAA;QACdC,WAAa,EAAA,IAAA;QACbC,cAAgB,EAAA;AAClB;AACF,CAAA;AAEA,MAAMC,yBAA4B,GAAA,UAAA;AAChC,IAAA,MAAMC,WAAW,YAAcC,CAAAA,CAAAA,cAAc,CAACC,YAAY,CAACC,aAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAA0B,GAAA,UAAA;AAC9B,IAAA,MAAML,WAAW,YAAcM,CAAAA,CAAAA,iBAAiB,CAACJ,YAAY,CAACK,gBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAqB,GAAA,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,UAAW,CAAA,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAQ,EAAA;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAaN,EAAAA,8BAAAA;QACbO,WAAaP,EAAAA,8BAAAA;QACbQ,WAAY,CAAA,CAAA,EAAEC,MAAM,EAAE,EAAA;AACpB,YAAA,IAAIA,MAAOC,CAAAA,IAAI,CAACC,gBAAgB,EAAE;AAChCX,gBAAAA,8BAAAA,EAAAA;AACF;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMY,gBAAmB,GAAA,UAAA;AACvB,IAAA,MAAMC,UAAa,GAAA,MAAMZ,MAAOa,CAAAA,KAAK,CAAC;QAAEC,IAAM,EAAA,MAAA;QAAQC,IAAM,EAAA;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAoB,GAAA,MAAMJ,UAAWK,CAAAA,GAAG,CAAC;QAAEC,GAAK,EAAA;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,MAAMrC,wBAA0BiC,EAAAA,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAa,GAAA,MAAMhC,UAAW,CAAA,MAAA,CAAA,CAAQiC,MAAM,CAAC;QACjDC,EAAIJ,EAAAA,eAAAA,CAAgBnC,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACmC,UAAY,EAAA;QACfF,eAAgBnC,CAAAA,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C;IAEA,MAAM0B,UAAAA,CAAWY,GAAG,CAAC;QAAEN,GAAK,EAAA,MAAA;QAAQO,KAAON,EAAAA;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMO,wBAA2B,GAAA,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB3B,MAAO4B,CAAAA,UAAU,CAACC,WAAW,CAAC7C,SAAS,CAAC8C,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAkB,GAAA,MAAMC,KAAMC,CAAAA,IAAI,CACtClC,MAAAA,CAAOC,EAAE,CAACkC,KAAK,CAAC,6BAA+BC,CAAAA,CAAAA,QAAQ,EACvDC,GAAI,CAAA,QAAA,CAAA,CAAA,EAAA;IAGN,MAAMC,kBAAAA,GAAqBC,IAAKC,CAAAA,UAAAA,CAAWR,eAAiBL,EAAAA,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIW,kBAAAA,CAAmBG,MAAM,GAAG,CAAG,EAAA;AACjC,QAAA,MAAMzC,OAAOC,EAAE,CACZkC,KAAK,CAAC,6BAAA,CAAA,CACNO,UAAU,CAAC;YAAEC,KAAO,EAAA;gBAAEb,MAAQ,EAAA;oBAAEc,GAAKN,EAAAA;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMO,8BAAiC,GAAA,UAAA;AACrC,IAAA,MAAMC,cAAczD,UAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,UAAW,CAAA,WAAA,CAAA;IAEnC,MAAM2D,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBE,KAAK,EAAA;IAEjD,IAAID,UAAAA,KAAe,CAAKE,IAAAA,aAAAA,KAAkB,CAAG,EAAA;AAC3C,QAAA,KAAK,MAAMC,KAAAA,IAASC,SAAUC,CAAAA,kBAAkB,CAAE;YAChD,MAAMN,eAAAA,CAAgBO,MAAM,CAACH,KAAAA,CAAAA;AAC/B;AACF;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEnD,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEuD,OAAO,EAAE,GAAGC,eAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,kBAAmBH,CAAAA,OAAAA,EAASI,SAAcC,CAAAA,IAAAA,kCAAAA;IAC5C,MAAMC,wBAAAA,GACJH,kBAAmBH,CAAAA,OAAAA,EAASI,SAAcG,CAAAA,IAAAA,4BAAAA;;IAG5C,MAAMC,gBAAAA,GAAmBR,SAASI,SAAa,IAAA,IAAA;AAC/C,IAAA,MAAMK,mBAAmBhE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,6CAAkD,CAAA,IAAA,IAAA;AAC7F,IAAA,MAAMiD,mBAAmBlE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,wCAA6C,CAAA,IAAA,IAAA;AAExF,IAAA,IAAI8C,qBAAqB,CAACC,gBAAoB,IAAA,CAACE,gBAAe,CAAI,EAAA;QAChElE,OAAOmE,CAAAA,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ;AAEApE,IAAAA,OAAAA,CAAOqE,cAAc,CAACC,YAAY,CAAC,OAAS,EAAA;AAC1CC,QAAAA,SAAAA,EAAWvE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,mBAAA,CAAA;AAC7BuD,QAAAA,mBAAAA,EAAqBxE,QAAOiE,MAAM,CAAChD,GAAG,CAAC,2CAA2C,EAAK,GAAA,EAAA,CAAA;AACvFwD,QAAAA,uBAAAA,EAAyBzE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACxC,6CACAwC,EAAAA,wBAAAA,CAAAA;AAEFiB,QAAAA,wBAAAA,EAA0B1E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACzC,8CACA0D,EAAAA,mCAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB5E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACnC,wCACA4C,EAAAA,wBAAAA,CAAAA;AAEFgB,QAAAA,mBAAAA,EAAqB7E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACpC,yCACA6D,EAAAA,6BAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWxB,OAASwB,EAAAA,SAAAA;;QAEpBC,UAAYzB,EAAAA;AACd,KAAA,CAAA;IAEA,MAAM7D,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMmF,oBAAoB5F,UAAW,CAAA,YAAA,CAAA;AACrC,IAAA,MAAMyD,cAAczD,UAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM6F,cAAc7F,UAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,UAAW,CAAA,WAAA,CAAA;AACnC,IAAA,MAAM8F,kBAAkB9F,UAAW,CAAA,UAAA,CAAA;AACnC,IAAA,MAAM+F,eAAe/F,UAAW,CAAA,OAAA,CAAA;AAEhC,IAAA,MAAM6F,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAM1C,YAAY2C,iCAAiC,EAAA;IAEnD,MAAM9E,gBAAAA,EAAAA;IACN,MAAMe,wBAAAA,EAAAA;IAEN,MAAMrC,UAAAA,CAAW,SAAWqG,CAAAA,CAAAA,4BAA4B,CAAC1F,OAAAA,CAAAA;IACzDX,UAAW,CAAA,SAAA,CAAA,CAAWsG,SAAS,CAAC3F,OAAAA,CAAAA;AAEhC+C,IAAAA,eAAAA,CAAgB6C,kBAAkB,EAAA;IAClCT,eAAgBhC,CAAAA,KAAK,CAACyC,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMhD,8BAAAA,EAAAA;AACR,CAAA;;;;"}
+{"version":3,"file":"bootstrap.mjs","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport { getTokenOptions, expiresInToSeconds } from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    afterUpdate({ params }) {\n      if (params.data.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.count();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn if using deprecated legacy expiresIn for new session settings\n  const hasLegacyExpires = options?.expiresIn != null;\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","afterUpdate","params","data","preferedLanguage","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","id","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","query","findMany","map","unknownPermissions","uniq","difference","length","deleteMany","where","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasNewMaxRefresh","config","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;AAeA,MAAMA,wBAA2B,GAAA;IAC/BC,SAAW,EAAA;QACTC,YAAc,EAAA,KAAA;QACdC,WAAa,EAAA,IAAA;QACbC,cAAgB,EAAA;AAClB;AACF,CAAA;AAEA,MAAMC,yBAA4B,GAAA,UAAA;AAChC,IAAA,MAAMC,WAAW,YAAcC,CAAAA,CAAAA,cAAc,CAACC,YAAY,CAACC,aAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAA0B,GAAA,UAAA;AAC9B,IAAA,MAAML,WAAW,YAAcM,CAAAA,CAAAA,iBAAiB,CAACJ,YAAY,CAACK,gBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAqB,GAAA,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,UAAW,CAAA,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAQ,EAAA;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAaN,EAAAA,8BAAAA;QACbO,WAAaP,EAAAA,8BAAAA;QACbQ,WAAY,CAAA,CAAA,EAAEC,MAAM,EAAE,EAAA;AACpB,YAAA,IAAIA,MAAOC,CAAAA,IAAI,CAACC,gBAAgB,EAAE;AAChCX,gBAAAA,8BAAAA,EAAAA;AACF;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMY,gBAAmB,GAAA,UAAA;AACvB,IAAA,MAAMC,UAAa,GAAA,MAAMZ,MAAOa,CAAAA,KAAK,CAAC;QAAEC,IAAM,EAAA,MAAA;QAAQC,IAAM,EAAA;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAoB,GAAA,MAAMJ,UAAWK,CAAAA,GAAG,CAAC;QAAEC,GAAK,EAAA;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,MAAMrC,wBAA0BiC,EAAAA,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAa,GAAA,MAAMhC,UAAW,CAAA,MAAA,CAAA,CAAQiC,MAAM,CAAC;QACjDC,EAAIJ,EAAAA,eAAAA,CAAgBnC,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACmC,UAAY,EAAA;QACfF,eAAgBnC,CAAAA,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C;IAEA,MAAM0B,UAAAA,CAAWY,GAAG,CAAC;QAAEN,GAAK,EAAA,MAAA;QAAQO,KAAON,EAAAA;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMO,wBAA2B,GAAA,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB3B,MAAO4B,CAAAA,UAAU,CAACC,WAAW,CAAC7C,SAAS,CAAC8C,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAkB,GAAA,MAAMC,KAAMC,CAAAA,IAAI,CACtClC,MAAAA,CAAOC,EAAE,CAACkC,KAAK,CAAC,6BAA+BC,CAAAA,CAAAA,QAAQ,EACvDC,GAAI,CAAA,QAAA,CAAA,CAAA,EAAA;IAGN,MAAMC,kBAAAA,GAAqBC,IAAKC,CAAAA,UAAAA,CAAWR,eAAiBL,EAAAA,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIW,kBAAAA,CAAmBG,MAAM,GAAG,CAAG,EAAA;AACjC,QAAA,MAAMzC,OAAOC,EAAE,CACZkC,KAAK,CAAC,6BAAA,CAAA,CACNO,UAAU,CAAC;YAAEC,KAAO,EAAA;gBAAEb,MAAQ,EAAA;oBAAEc,GAAKN,EAAAA;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMO,8BAAiC,GAAA,UAAA;AACrC,IAAA,MAAMC,cAAczD,UAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,UAAW,CAAA,WAAA,CAAA;IAEnC,MAAM2D,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBE,KAAK,EAAA;IAEjD,IAAID,UAAAA,KAAe,CAAKE,IAAAA,aAAAA,KAAkB,CAAG,EAAA;AAC3C,QAAA,KAAK,MAAMC,KAAAA,IAASC,SAAUC,CAAAA,kBAAkB,CAAE;YAChD,MAAMN,eAAAA,CAAgBO,MAAM,CAACH,KAAAA,CAAAA;AAC/B;AACF;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEnD,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEuD,OAAO,EAAE,GAAGC,eAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,kBAAmBH,CAAAA,OAAAA,EAASI,SAAcC,CAAAA,IAAAA,kCAAAA;IAC5C,MAAMC,wBAAAA,GACJH,kBAAmBH,CAAAA,OAAAA,EAASI,SAAcG,CAAAA,IAAAA,4BAAAA;;IAG5C,MAAMC,gBAAAA,GAAmBR,SAASI,SAAa,IAAA,IAAA;AAC/C,IAAA,MAAMK,mBAAmBhE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,6CAAkD,CAAA,IAAA,IAAA;AAC7F,IAAA,MAAMiD,mBAAmBlE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,wCAA6C,CAAA,IAAA,IAAA;AAExF,IAAA,IAAI8C,qBAAqB,CAACC,gBAAoB,IAAA,CAACE,gBAAe,CAAI,EAAA;QAChElE,OAAOmE,CAAAA,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ;AAEApE,IAAAA,OAAAA,CAAOqE,cAAc,CAACC,YAAY,CAAC,OAAS,EAAA;AAC1CC,QAAAA,SAAAA,EAAWvE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CAAC,mBAAA,CAAA;AAC7BuD,QAAAA,mBAAAA,EAAqBxE,QAAOiE,MAAM,CAAChD,GAAG,CAAC,2CAA2C,EAAK,GAAA,EAAA,CAAA;AACvFwD,QAAAA,uBAAAA,EAAyBzE,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACxC,6CACAwC,EAAAA,wBAAAA,CAAAA;AAEFiB,QAAAA,wBAAAA,EAA0B1E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACzC,8CACA0D,EAAAA,mCAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB5E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACnC,wCACA4C,EAAAA,wBAAAA,CAAAA;AAEFgB,QAAAA,mBAAAA,EAAqB7E,OAAOiE,CAAAA,MAAM,CAAChD,GAAG,CACpC,yCACA6D,EAAAA,6BAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWxB,OAASwB,EAAAA,SAAAA;;QAEpBC,UAAYzB,EAAAA;AACd,KAAA,CAAA;AAEA,IAAA,MAAM0B,YAAeC,GAAAA,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAoBrF,GAAAA,OAAAA,CAAOiE,MAAM,CAAChD,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAIgE,YAAAA,IAAgBI,sBAAsB,KAAO,EAAA;QAC/CrF,OAAOmE,CAAAA,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ;IAEA,MAAM1E,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMwF,oBAAoBjG,UAAW,CAAA,YAAA,CAAA;AACrC,IAAA,MAAMyD,cAAczD,UAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAMkG,cAAclG,UAAW,CAAA,MAAA,CAAA;AAC/B,IAAA,MAAM0D,kBAAkB1D,UAAW,CAAA,WAAA,CAAA;AACnC,IAAA,MAAMmG,kBAAkBnG,UAAW,CAAA,UAAA,CAAA;AACnC,IAAA,MAAMoG,eAAepG,UAAW,CAAA,OAAA,CAAA;AAEhC,IAAA,MAAMkG,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAM/C,YAAYgD,iCAAiC,EAAA;IAEnD,MAAMnF,gBAAAA,EAAAA;IACN,MAAMe,wBAAAA,EAAAA;IAEN,MAAMrC,UAAAA,CAAW,SAAW0G,CAAAA,CAAAA,4BAA4B,CAAC/F,OAAAA,CAAAA;IACzDX,UAAW,CAAA,SAAA,CAAA,CAAW2G,SAAS,CAAChG,OAAAA,CAAAA;AAEhC+C,IAAAA,eAAAA,CAAgBkD,kBAAkB,EAAA;IAClCT,eAAgBrC,CAAAA,KAAK,CAAC8C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMrD,8BAAAA,EAAAA;AACR,CAAA;;;;"}

package/dist/server/server/src/controllers/authentication.js

@@ -63,7 +63,7 @@ var authentication = {
                 const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
                     type: rememberMe ? 'refresh' : 'session'
                 });
-                const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt);
+                const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt, ctx.request.secure);
                 ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
                 const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);
                 if ('error' in accessResult) {
@@ -108,7 +108,7 @@ var authentication = {
             const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
                 type: rememberMe ? 'refresh' : 'session'
             });
-            const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt);
+            const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt, ctx.request.secure);
             ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
             const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);
             if ('error' in accessResult) {
@@ -157,7 +157,7 @@ var authentication = {
             const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
                 type: rememberMe ? 'refresh' : 'session'
             });
-            const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt);
+            const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt, ctx.request.secure);
             ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
             const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);
             if ('error' in accessResult) {
@@ -200,7 +200,7 @@ var authentication = {
                 type: 'session'
             });
             // No rememberMe flow here; expire with session by default (session cookie)
-            const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry('session', absoluteExpiresAt);
+            const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry('session', absoluteExpiresAt, ctx.request.secure);
             ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
             const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);
             if ('error' in accessResult) {
@@ -240,7 +240,7 @@ var authentication = {
             }
             const { token } = result;
             // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt
-            const opts = sessionAuth.buildCookieOptionsWithExpiry(rotation.type, rotation.absoluteExpiresAt);
+            const opts = sessionAuth.buildCookieOptionsWithExpiry(rotation.type, rotation.absoluteExpiresAt, ctx.request.secure);
             ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, rotation.token, opts);
             ctx.body = {
                 data: {
@@ -261,7 +261,7 @@ var authentication = {
         const deviceId = typeof bodyDeviceId === 'string' ? bodyDeviceId : undefined;
         // Clear cookie regardless of token validity
         ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, '', {
-            ...sessionAuth.getRefreshCookieOptions(),
+            ...sessionAuth.getRefreshCookieOptions(ctx.request.secure),
             expires: new Date(0)
         });
         try {

package/dist/server/server/src/controllers/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError, ValidationError } = errors;\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          strapi.eventHub.emit('admin.auth.error', {\n            error: new Error(info.message),\n            provider: 'local',\n          });\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, { type: rememberMe ? 'refresh' : 'session' });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const hasAdmin = await getService('user').exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    const superAdminRole = await getService('role').getSuperAdmin();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const user = await getService('user').create({\n      ...input,\n      registrationToken: null,\n      isActive: true,\n      roles: superAdminRole ? [superAdminRole.id] : [],\n    });\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, { type: rememberMe ? 'refresh' : 'session' });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      };\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    getService('auth').forgotPassword(input);\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, { type: 'session' });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry('session', absoluteExpiresAt);\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(rotation.type, rotation.absoluteExpiresAt);\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    const bodyDeviceId = ctx.request.body?.deviceId as string | undefined;\n    const deviceId = typeof bodyDeviceId === 'string' ? bodyDeviceId : undefined;\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["ApplicationError","ValidationError","errors","login","compose","ctx","next","validateLoginSessionInput","request","body","passport","authenticate","session","err","user","info","strapi","eventHub","emit","error","provider","details","code","notImplemented","Error","message","query","state","sanitizedUser","getService","sanitizeUser","sessionManager","getSessionManager","internalServerError","userId","String","id","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","hasAdmin","exists","superAdminRole","getSuperAdmin","create","isActive","roles","telemetry","send","forgotPassword","validateForgotPasswordInput","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","bodyDeviceId","undefined","getRefreshCookieOptions","expires","Date"],"mappings":";;;;;;;;;;;;;AAiCA,MAAM,EAAEA,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAE9C,qBAAe;AACbC,IAAAA,KAAAA,EAAOC,OAAQ,CAAA;AACb,QAAA,OAAOC,GAAcC,EAAAA,IAAAA,GAAAA;AACnB,YAAA,MAAMC,MAA0BF,GAAIG,CAAAA,OAAO,CAACC,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOH,IAAAA,EAAAA;AACT,SAAA;AACA,QAAA,CAACD,GAAcC,EAAAA,IAAAA,GAAAA;YACb,OAAOI,QAAAA,CAASC,YAAY,CAAC,OAAS,EAAA;gBAAEC,OAAS,EAAA;aAAS,EAAA,CAACC,KAAKC,IAAMC,EAAAA,IAAAA,GAAAA;AACpE,gBAAA,IAAIF,GAAK,EAAA;AACPG,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;wBAAEC,KAAON,EAAAA,GAAAA;wBAAKO,QAAU,EAAA;AAAQ,qBAAA,CAAA;;AAEzE,oBAAA,IAAIP,GAAIQ,CAAAA,OAAO,EAAEC,IAAAA,KAAS,mBAAqB,EAAA;wBAC7C,MAAMT,GAAAA;AACR;;AAGA,oBAAA,OAAOR,IAAIkB,cAAc,EAAA;AAC3B;AAEA,gBAAA,IAAI,CAACT,IAAM,EAAA;AACTE,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;wBACvCC,KAAO,EAAA,IAAIK,KAAMT,CAAAA,IAAAA,CAAKU,OAAO,CAAA;wBAC7BL,QAAU,EAAA;AACZ,qBAAA,CAAA;oBACA,MAAM,IAAIpB,gBAAiBe,CAAAA,IAAAA,CAAKU,OAAO,CAAA;AACzC;gBAEA,MAAMC,KAAAA,GAAQrB,IAAIsB,KAAK;AACvBD,gBAAAA,KAAAA,CAAMZ,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAMc,aAAgBC,GAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,oBAAsB,EAAA;oBAAEJ,IAAMc,EAAAA,aAAAA;oBAAeR,QAAU,EAAA;AAAQ,iBAAA,CAAA;gBAEpF,OAAOd,IAAAA,EAAAA;AACT,aAAA,CAAA,CAAGD,GAAKC,EAAAA,IAAAA,CAAAA;AACV,SAAA;QACA,OAAOD,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAES,IAAI,EAAE,GAAGT,IAAIsB,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMI,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,oBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;gBACA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;gBAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAoBlC,CAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAY,GAAA;AACjC,iBAAA,CAAA;AAEA,gBAAA,MAAMO,aAAgBC,GAAAA,wCAAAA,CACpBR,UAAa,GAAA,SAAA,GAAY,SACzBI,EAAAA,iBAAAA,CAAAA;AAEFrC,gBAAAA,GAAAA,CAAI0C,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,gBAAA,MAAMK,YAAe,GAAA,MAAMnB,cAAe,CAAA,OAAA,CAAA,CAASoB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWS,YAAc,EAAA;AAC3B,oBAAA,OAAO7C,IAAI4B,mBAAmB,EAAA;AAChC;AAEA,gBAAA,MAAM,EAAEO,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B7C,gBAAAA,GAAAA,CAAII,IAAI,GAAG;oBACT4C,IAAM,EAAA;wBACJb,KAAOY,EAAAA,WAAAA;AACPA,wBAAAA,WAAAA;AACAtC,wBAAAA,IAAAA,EAAMe,iBAAW,MAAQC,CAAAA,CAAAA,YAAY,CAACzB,GAAIsB,CAAAA,KAAK,CAACb,IAAI;AACtD;AACF,iBAAA;AACF,aAAA,CAAE,OAAOK,KAAO,EAAA;AACdH,gBAAAA,MAAAA,CAAOsC,GAAG,CAACnC,KAAK,CAAC,wCAA0CA,EAAAA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC;AACF;AACD,KAAA,CAAA;AAED,IAAA,MAAMsB,kBAAiBlD,GAAY,EAAA;AACjC,QAAA,MAAMmD,sCAA8BnD,CAAAA,GAAAA,CAAIG,OAAO,CAACkB,KAAK,CAAA;AAErD,QAAA,MAAM,EAAE+B,iBAAiB,EAAE,GAAGpD,GAAIG,CAAAA,OAAO,CAACkB,KAAK;AAE/C,QAAA,MAAM6B,gBAAmB,GAAA,MAAM1B,gBAAW,CAAA,MAAA,CAAA,CAAQ6B,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAkB,EAAA;AACrB,YAAA,MAAM,IAAItD,eAAgB,CAAA,2BAAA,CAAA;AAC5B;AAEAI,QAAAA,GAAAA,CAAII,IAAI,GAAG;YAAE4C,IAAME,EAAAA;AAAiB,SAAA;AACtC,KAAA;AAEA,IAAA,MAAMI,UAAStD,GAAY,EAAA;AACzB,QAAA,MAAMuD,KAAQvD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMoD,kCAA0BD,CAAAA,KAAAA,CAAAA;AAEhC,QAAA,MAAM9C,IAAO,GAAA,MAAMe,gBAAW,CAAA,MAAA,CAAA,CAAQ8B,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAM7B,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;YACA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAoBlC,CAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;AAAEO,gBAAAA,IAAAA,EAAMN,aAAa,SAAY,GAAA;AAAU,aAAA,CAAA;AAEpF,YAAA,MAAMO,aAAgBC,GAAAA,wCAAAA,CACpBR,UAAa,GAAA,SAAA,GAAY,SACzBI,EAAAA,iBAAAA,CAAAA;AAEFrC,YAAAA,GAAAA,CAAI0C,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,YAAA,MAAMK,YAAe,GAAA,MAAMnB,cAAe,CAAA,OAAA,CAAA,CAASoB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWS,YAAc,EAAA;AAC3B,gBAAA,OAAO7C,IAAI4B,mBAAmB,EAAA;AAChC;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B7C,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT4C,IAAM,EAAA;oBACJb,KAAOY,EAAAA,WAAAA;AACPA,oBAAAA,WAAAA;oBACAtC,IAAMe,EAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,SAAA,CAAE,OAAOK,KAAO,EAAA;AACdH,YAAAA,MAAAA,CAAOsC,GAAG,CAACnC,KAAK,CAAC,wDAA0DA,EAAAA,KAAAA,CAAAA;AAC3E,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAM6B,eAAczD,GAAY,EAAA;AAC9B,QAAA,MAAMuD,KAAQvD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMsD,uCAA+BH,CAAAA,KAAAA,CAAAA;AAErC,QAAA,MAAMI,QAAW,GAAA,MAAMnC,gBAAW,CAAA,MAAA,CAAA,CAAQoC,MAAM,EAAA;AAEhD,QAAA,IAAID,QAAU,EAAA;AACZ,YAAA,MAAM,IAAIhE,gBAAiB,CAAA,uCAAA,CAAA;AAC7B;AAEA,QAAA,MAAMkE,cAAiB,GAAA,MAAMrC,gBAAW,CAAA,MAAA,CAAA,CAAQsC,aAAa,EAAA;AAE7D,QAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,YAAA,MAAM,IAAIlE,gBACR,CAAA,6EAAA,CAAA;AAEJ;AAEA,QAAA,MAAMc,IAAO,GAAA,MAAMe,gBAAW,CAAA,MAAA,CAAA,CAAQuC,MAAM,CAAC;AAC3C,YAAA,GAAGR,KAAK;YACRH,iBAAmB,EAAA,IAAA;YACnBY,QAAU,EAAA,IAAA;AACVC,YAAAA,KAAAA,EAAOJ,cAAiB,GAAA;AAACA,gBAAAA,cAAAA,CAAe9B;AAAG,aAAA,GAAG;AAChD,SAAA,CAAA;QAEApB,MAAOuD,CAAAA,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAMzC,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;YACA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAoBlC,CAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;AAAEO,gBAAAA,IAAAA,EAAMN,aAAa,SAAY,GAAA;AAAU,aAAA,CAAA;AAEpF,YAAA,MAAMO,aAAgBC,GAAAA,wCAAAA,CACpBR,UAAa,GAAA,SAAA,GAAY,SACzBI,EAAAA,iBAAAA,CAAAA;AAEFrC,YAAAA,GAAAA,CAAI0C,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,YAAA,MAAMK,YAAe,GAAA,MAAMnB,cAAe,CAAA,OAAA,CAAA,CAASoB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWS,YAAc,EAAA;AAC3B,gBAAA,OAAO7C,IAAI4B,mBAAmB,EAAA;AAChC;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B7C,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT4C,IAAM,EAAA;oBACJb,KAAOY,EAAAA,WAAAA;AACPA,oBAAAA,WAAAA;oBACAtC,IAAMe,EAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,SAAA,CAAE,OAAOK,KAAO,EAAA;AACdH,YAAAA,MAAAA,CAAOsC,GAAG,CAACnC,KAAK,CAAC,8DAAgEA,EAAAA,KAAAA,CAAAA;AACjF,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAMwC,gBAAepE,GAAY,EAAA;AAC/B,QAAA,MAAMuD,KAAQvD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMiE,cAA4Bd,CAAAA,KAAAA,CAAAA;QAElC/B,gBAAW,CAAA,MAAA,CAAA,CAAQ4C,cAAc,CAACb,KAAAA,CAAAA;AAElCvD,QAAAA,GAAAA,CAAIsE,MAAM,GAAG,GAAA;AACf,KAAA;AAEA,IAAA,MAAMC,eAAcvE,GAAY,EAAA;AAC9B,QAAA,MAAMuD,KAAQvD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMoE,aAA2BjB,CAAAA,KAAAA,CAAAA;AAEjC,QAAA,MAAM9C,IAAO,GAAA,MAAMe,gBAAW,CAAA,MAAA,CAAA,CAAQ+C,aAAa,CAAChB,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAM7B,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;YAEA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;AAC7B,YAAA,MAAMC,QAAWyC,GAAAA,4BAAAA,EAAAA;;YAGjB,MAAM/C,cAAAA,CAAe,OAASgD,CAAAA,CAAAA,sBAAsB,CAAC7C,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEM,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;gBAAEO,IAAM,EAAA;AAAU,aAAA,CAAA;;YAG3D,MAAMC,aAAAA,GAAgBC,yCAA6B,SAAWJ,EAAAA,iBAAAA,CAAAA;AAC9DrC,YAAAA,GAAAA,CAAI0C,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,YAAA,MAAMK,YAAe,GAAA,MAAMnB,cAAe,CAAA,OAAA,CAAA,CAASoB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWS,YAAc,EAAA;AAC3B,gBAAA,OAAO7C,IAAI4B,mBAAmB,EAAA;AAChC;YAEA,MAAM,EAAEO,KAAK,EAAE,GAAGU,YAAAA;AAElB7C,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT4C,IAAM,EAAA;AACJb,oBAAAA,KAAAA;oBACA1B,IAAMe,EAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,SAAA,CAAE,OAAOD,GAAK,EAAA;AACZG,YAAAA,MAAAA,CAAOsC,GAAG,CAACnC,KAAK,CAAC,8DAAgEN,EAAAA,GAAAA,CAAAA;AACjF,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAMmB,aAAY/C,GAAY,EAAA;AAC5B,QAAA,MAAMoC,YAAepC,GAAAA,GAAAA,CAAI0C,OAAO,CAACiC,GAAG,CAAC/B,+BAAAA,CAAAA;AAErC,QAAA,IAAI,CAACR,YAAc,EAAA;YACjB,OAAOpC,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B;QAEA,IAAI;AACF,YAAA,MAAMlD,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;;;AAIA,YAAA,MAAMiD,QAAW,GAAA,MAAMnD,cAAe,CAAA,OAAA,CAAA,CAASoD,kBAAkB,CAAC1C,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAWyC,QAAU,EAAA;gBACvB,OAAO7E,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B;AAEA,YAAA,MAAMG,SAAS,MAAMrD,cAAAA,CAAe,SAASoB,mBAAmB,CAAC+B,SAAS1C,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAW4C,MAAQ,EAAA;gBACrB,OAAO/E,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B;YAEA,MAAM,EAAEzC,KAAK,EAAE,GAAG4C,MAAAA;;AAElB,YAAA,MAAMC,OAAOvC,wCAA6BoC,CAAAA,QAAAA,CAAStC,IAAI,EAAEsC,SAASxC,iBAAiB,CAAA;AAEnFrC,YAAAA,GAAAA,CAAI0C,OAAO,CAACC,GAAG,CAACC,+BAAqBiC,EAAAA,QAAAA,CAAS1C,KAAK,EAAE6C,IAAAA,CAAAA;AACrDhF,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBAAE4C,IAAM,EAAA;AAAEb,oBAAAA;AAAM;AAAE,aAAA;AAC/B,SAAA,CAAE,OAAO3B,GAAK,EAAA;AACZG,YAAAA,MAAAA,CAAOsC,GAAG,CAACnC,KAAK,CAAC,oDAAsDN,EAAAA,GAAAA,CAAAA;AACvE,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAMqD,QAAOjF,GAAY,EAAA;QACvB,MAAMuB,aAAAA,GAAgBC,iBAAW,MAAQC,CAAAA,CAAAA,YAAY,CAACzB,GAAIsB,CAAAA,KAAK,CAACb,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,cAAgB,EAAA;YAAEJ,IAAMc,EAAAA;AAAc,SAAA,CAAA;AAE3D,QAAA,MAAM2D,YAAelF,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,EAAE4B,QAAAA;AACvC,QAAA,MAAMA,QAAW,GAAA,OAAOkD,YAAiB,KAAA,QAAA,GAAWA,YAAeC,GAAAA,SAAAA;;AAGnEnF,QAAAA,GAAAA,CAAI0C,OAAO,CAACC,GAAG,CAACC,iCAAqB,EAAI,EAAA;AACvC,YAAA,GAAGwC,mCAAyB,EAAA;AAC5BC,YAAAA,OAAAA,EAAS,IAAIC,IAAK,CAAA,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAM5D,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAID,cAAgB,EAAA;AAClB,gBAAA,MAAMG,SAASC,MAAO9B,CAAAA,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAACsB,EAAE,CAAA;AACvC,gBAAA,MAAML,cAAe,CAAA,OAAA,CAAA,CAASgD,sBAAsB,CAAC7C,MAAQG,EAAAA,QAAAA,CAAAA;AAC/D;AACF,SAAA,CAAE,OAAOxB,GAAK,EAAA;AACZG,YAAAA,MAAAA,CAAOsC,GAAG,CAACnC,KAAK,CAAC,+CAAiDN,EAAAA,GAAAA,CAAAA;AACpE;AAEAR,QAAAA,GAAAA,CAAII,IAAI,GAAG;AAAE4C,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB;AACF,CAAE;;;;"}
+{"version":3,"file":"authentication.js","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError, ValidationError } = errors;\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          strapi.eventHub.emit('admin.auth.error', {\n            error: new Error(info.message),\n            provider: 'local',\n          });\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt,\n          ctx.request.secure\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, { type: rememberMe ? 'refresh' : 'session' });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const hasAdmin = await getService('user').exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    const superAdminRole = await getService('role').getSuperAdmin();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const user = await getService('user').create({\n      ...input,\n      registrationToken: null,\n      isActive: true,\n      roles: superAdminRole ? [superAdminRole.id] : [],\n    });\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, { type: rememberMe ? 'refresh' : 'session' });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      };\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    getService('auth').forgotPassword(input);\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, { type: 'session' });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(\n        rotation.type,\n        rotation.absoluteExpiresAt,\n        ctx.request.secure\n      );\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    const bodyDeviceId = ctx.request.body?.deviceId as string | undefined;\n    const deviceId = typeof bodyDeviceId === 'string' ? bodyDeviceId : undefined;\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(ctx.request.secure),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["ApplicationError","ValidationError","errors","login","compose","ctx","next","validateLoginSessionInput","request","body","passport","authenticate","session","err","user","info","strapi","eventHub","emit","error","provider","details","code","notImplemented","Error","message","query","state","sanitizedUser","getService","sanitizeUser","sessionManager","getSessionManager","internalServerError","userId","String","id","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","secure","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","hasAdmin","exists","superAdminRole","getSuperAdmin","create","isActive","roles","telemetry","send","forgotPassword","validateForgotPasswordInput","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","bodyDeviceId","undefined","getRefreshCookieOptions","expires","Date"],"mappings":";;;;;;;;;;;;;AAiCA,MAAM,EAAEA,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAE9C,qBAAe;AACbC,IAAAA,KAAAA,EAAOC,OAAQ,CAAA;AACb,QAAA,OAAOC,GAAcC,EAAAA,IAAAA,GAAAA;AACnB,YAAA,MAAMC,MAA0BF,GAAIG,CAAAA,OAAO,CAACC,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOH,IAAAA,EAAAA;AACT,SAAA;AACA,QAAA,CAACD,GAAcC,EAAAA,IAAAA,GAAAA;YACb,OAAOI,QAAAA,CAASC,YAAY,CAAC,OAAS,EAAA;gBAAEC,OAAS,EAAA;aAAS,EAAA,CAACC,KAAKC,IAAMC,EAAAA,IAAAA,GAAAA;AACpE,gBAAA,IAAIF,GAAK,EAAA;AACPG,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;wBAAEC,KAAON,EAAAA,GAAAA;wBAAKO,QAAU,EAAA;AAAQ,qBAAA,CAAA;;AAEzE,oBAAA,IAAIP,GAAIQ,CAAAA,OAAO,EAAEC,IAAAA,KAAS,mBAAqB,EAAA;wBAC7C,MAAMT,GAAAA;AACR;;AAGA,oBAAA,OAAOR,IAAIkB,cAAc,EAAA;AAC3B;AAEA,gBAAA,IAAI,CAACT,IAAM,EAAA;AACTE,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAoB,EAAA;wBACvCC,KAAO,EAAA,IAAIK,KAAMT,CAAAA,IAAAA,CAAKU,OAAO,CAAA;wBAC7BL,QAAU,EAAA;AACZ,qBAAA,CAAA;oBACA,MAAM,IAAIpB,gBAAiBe,CAAAA,IAAAA,CAAKU,OAAO,CAAA;AACzC;gBAEA,MAAMC,KAAAA,GAAQrB,IAAIsB,KAAK;AACvBD,gBAAAA,KAAAA,CAAMZ,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAMc,aAAgBC,GAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,oBAAsB,EAAA;oBAAEJ,IAAMc,EAAAA,aAAAA;oBAAeR,QAAU,EAAA;AAAQ,iBAAA,CAAA;gBAEpF,OAAOd,IAAAA,EAAAA;AACT,aAAA,CAAA,CAAGD,GAAKC,EAAAA,IAAAA,CAAAA;AACV,SAAA;QACA,OAAOD,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAES,IAAI,EAAE,GAAGT,IAAIsB,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMI,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,oBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;gBACA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;gBAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAoBlC,CAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAY,GAAA;AACjC,iBAAA,CAAA;gBAEA,MAAMO,aAAAA,GAAgBC,yCACpBR,UAAa,GAAA,SAAA,GAAY,WACzBI,iBACArC,EAAAA,GAAAA,CAAIG,OAAO,CAACuC,MAAM,CAAA;AAEpB1C,gBAAAA,GAAAA,CAAI2C,OAAO,CAACC,GAAG,CAACC,iCAAqBT,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,gBAAA,MAAMM,YAAe,GAAA,MAAMpB,cAAe,CAAA,OAAA,CAAA,CAASqB,mBAAmB,CAACX,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWU,YAAc,EAAA;AAC3B,oBAAA,OAAO9C,IAAI4B,mBAAmB,EAAA;AAChC;AAEA,gBAAA,MAAM,EAAEO,KAAAA,EAAOa,WAAW,EAAE,GAAGF,YAAAA;AAE/B9C,gBAAAA,GAAAA,CAAII,IAAI,GAAG;oBACT6C,IAAM,EAAA;wBACJd,KAAOa,EAAAA,WAAAA;AACPA,wBAAAA,WAAAA;AACAvC,wBAAAA,IAAAA,EAAMe,iBAAW,MAAQC,CAAAA,CAAAA,YAAY,CAACzB,GAAIsB,CAAAA,KAAK,CAACb,IAAI;AACtD;AACF,iBAAA;AACF,aAAA,CAAE,OAAOK,KAAO,EAAA;AACdH,gBAAAA,MAAAA,CAAOuC,GAAG,CAACpC,KAAK,CAAC,wCAA0CA,EAAAA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC;AACF;AACD,KAAA,CAAA;AAED,IAAA,MAAMuB,kBAAiBnD,GAAY,EAAA;AACjC,QAAA,MAAMoD,sCAA8BpD,CAAAA,GAAAA,CAAIG,OAAO,CAACkB,KAAK,CAAA;AAErD,QAAA,MAAM,EAAEgC,iBAAiB,EAAE,GAAGrD,GAAIG,CAAAA,OAAO,CAACkB,KAAK;AAE/C,QAAA,MAAM8B,gBAAmB,GAAA,MAAM3B,gBAAW,CAAA,MAAA,CAAA,CAAQ8B,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAkB,EAAA;AACrB,YAAA,MAAM,IAAIvD,eAAgB,CAAA,2BAAA,CAAA;AAC5B;AAEAI,QAAAA,GAAAA,CAAII,IAAI,GAAG;YAAE6C,IAAME,EAAAA;AAAiB,SAAA;AACtC,KAAA;AAEA,IAAA,MAAMI,UAASvD,GAAY,EAAA;AACzB,QAAA,MAAMwD,KAAQxD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMqD,kCAA0BD,CAAAA,KAAAA,CAAAA;AAEhC,QAAA,MAAM/C,IAAO,GAAA,MAAMe,gBAAW,CAAA,MAAA,CAAA,CAAQ+B,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAM9B,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;YACA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAoBlC,CAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;AAAEO,gBAAAA,IAAAA,EAAMN,aAAa,SAAY,GAAA;AAAU,aAAA,CAAA;YAEpF,MAAMO,aAAAA,GAAgBC,yCACpBR,UAAa,GAAA,SAAA,GAAY,WACzBI,iBACArC,EAAAA,GAAAA,CAAIG,OAAO,CAACuC,MAAM,CAAA;AAEpB1C,YAAAA,GAAAA,CAAI2C,OAAO,CAACC,GAAG,CAACC,iCAAqBT,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAe,GAAA,MAAMpB,cAAe,CAAA,OAAA,CAAA,CAASqB,mBAAmB,CAACX,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWU,YAAc,EAAA;AAC3B,gBAAA,OAAO9C,IAAI4B,mBAAmB,EAAA;AAChC;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOa,WAAW,EAAE,GAAGF,YAAAA;AAE/B9C,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT6C,IAAM,EAAA;oBACJd,KAAOa,EAAAA,WAAAA;AACPA,oBAAAA,WAAAA;oBACAvC,IAAMe,EAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,SAAA,CAAE,OAAOK,KAAO,EAAA;AACdH,YAAAA,MAAAA,CAAOuC,GAAG,CAACpC,KAAK,CAAC,wDAA0DA,EAAAA,KAAAA,CAAAA;AAC3E,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAM8B,eAAc1D,GAAY,EAAA;AAC9B,QAAA,MAAMwD,KAAQxD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMuD,uCAA+BH,CAAAA,KAAAA,CAAAA;AAErC,QAAA,MAAMI,QAAW,GAAA,MAAMpC,gBAAW,CAAA,MAAA,CAAA,CAAQqC,MAAM,EAAA;AAEhD,QAAA,IAAID,QAAU,EAAA;AACZ,YAAA,MAAM,IAAIjE,gBAAiB,CAAA,uCAAA,CAAA;AAC7B;AAEA,QAAA,MAAMmE,cAAiB,GAAA,MAAMtC,gBAAW,CAAA,MAAA,CAAA,CAAQuC,aAAa,EAAA;AAE7D,QAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,YAAA,MAAM,IAAInE,gBACR,CAAA,6EAAA,CAAA;AAEJ;AAEA,QAAA,MAAMc,IAAO,GAAA,MAAMe,gBAAW,CAAA,MAAA,CAAA,CAAQwC,MAAM,CAAC;AAC3C,YAAA,GAAGR,KAAK;YACRH,iBAAmB,EAAA,IAAA;YACnBY,QAAU,EAAA,IAAA;AACVC,YAAAA,KAAAA,EAAOJ,cAAiB,GAAA;AAACA,gBAAAA,cAAAA,CAAe/B;AAAG,aAAA,GAAG;AAChD,SAAA,CAAA;QAEApB,MAAOwD,CAAAA,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAM1C,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;YACA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAoBlC,CAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;AAAEO,gBAAAA,IAAAA,EAAMN,aAAa,SAAY,GAAA;AAAU,aAAA,CAAA;YAEpF,MAAMO,aAAAA,GAAgBC,yCACpBR,UAAa,GAAA,SAAA,GAAY,WACzBI,iBACArC,EAAAA,GAAAA,CAAIG,OAAO,CAACuC,MAAM,CAAA;AAEpB1C,YAAAA,GAAAA,CAAI2C,OAAO,CAACC,GAAG,CAACC,iCAAqBT,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAe,GAAA,MAAMpB,cAAe,CAAA,OAAA,CAAA,CAASqB,mBAAmB,CAACX,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWU,YAAc,EAAA;AAC3B,gBAAA,OAAO9C,IAAI4B,mBAAmB,EAAA;AAChC;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOa,WAAW,EAAE,GAAGF,YAAAA;AAE/B9C,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT6C,IAAM,EAAA;oBACJd,KAAOa,EAAAA,WAAAA;AACPA,oBAAAA,WAAAA;oBACAvC,IAAMe,EAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,SAAA,CAAE,OAAOK,KAAO,EAAA;AACdH,YAAAA,MAAAA,CAAOuC,GAAG,CAACpC,KAAK,CAAC,8DAAgEA,EAAAA,KAAAA,CAAAA;AACjF,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAMyC,gBAAerE,GAAY,EAAA;AAC/B,QAAA,MAAMwD,KAAQxD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMkE,cAA4Bd,CAAAA,KAAAA,CAAAA;QAElChC,gBAAW,CAAA,MAAA,CAAA,CAAQ6C,cAAc,CAACb,KAAAA,CAAAA;AAElCxD,QAAAA,GAAAA,CAAIuE,MAAM,GAAG,GAAA;AACf,KAAA;AAEA,IAAA,MAAMC,eAAcxE,GAAY,EAAA;AAC9B,QAAA,MAAMwD,KAAQxD,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMqE,aAA2BjB,CAAAA,KAAAA,CAAAA;AAEjC,QAAA,MAAM/C,IAAO,GAAA,MAAMe,gBAAW,CAAA,MAAA,CAAA,CAAQgD,aAAa,CAAChB,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAM9B,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;YAEA,MAAMC,MAAAA,GAASC,MAAOrB,CAAAA,IAAAA,CAAKsB,EAAE,CAAA;AAC7B,YAAA,MAAMC,QAAW0C,GAAAA,4BAAAA,EAAAA;;YAGjB,MAAMhD,cAAAA,CAAe,OAASiD,CAAAA,CAAAA,sBAAsB,CAAC9C,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEM,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cACvD,CAAA,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAU,EAAA;gBAAEO,IAAM,EAAA;AAAU,aAAA,CAAA;;AAG3D,YAAA,MAAMC,gBAAgBC,wCACpB,CAAA,SAAA,EACAJ,mBACArC,GAAIG,CAAAA,OAAO,CAACuC,MAAM,CAAA;AAEpB1C,YAAAA,GAAAA,CAAI2C,OAAO,CAACC,GAAG,CAACC,iCAAqBT,YAAcI,EAAAA,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAe,GAAA,MAAMpB,cAAe,CAAA,OAAA,CAAA,CAASqB,mBAAmB,CAACX,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWU,YAAc,EAAA;AAC3B,gBAAA,OAAO9C,IAAI4B,mBAAmB,EAAA;AAChC;YAEA,MAAM,EAAEO,KAAK,EAAE,GAAGW,YAAAA;AAElB9C,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT6C,IAAM,EAAA;AACJd,oBAAAA,KAAAA;oBACA1B,IAAMe,EAAAA,gBAAAA,CAAW,MAAQC,CAAAA,CAAAA,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,SAAA,CAAE,OAAOD,GAAK,EAAA;AACZG,YAAAA,MAAAA,CAAOuC,GAAG,CAACpC,KAAK,CAAC,8DAAgEN,EAAAA,GAAAA,CAAAA;AACjF,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAMoB,aAAYhD,GAAY,EAAA;AAC5B,QAAA,MAAMoC,YAAepC,GAAAA,GAAAA,CAAI2C,OAAO,CAACiC,GAAG,CAAC/B,+BAAAA,CAAAA;AAErC,QAAA,IAAI,CAACT,YAAc,EAAA;YACjB,OAAOpC,GAAAA,CAAI6E,YAAY,CAAC,uBAAA,CAAA;AAC1B;QAEA,IAAI;AACF,YAAA,MAAMnD,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAgB,EAAA;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC;;;AAIA,YAAA,MAAMkD,QAAW,GAAA,MAAMpD,cAAe,CAAA,OAAA,CAAA,CAASqD,kBAAkB,CAAC3C,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAW0C,QAAU,EAAA;gBACvB,OAAO9E,GAAAA,CAAI6E,YAAY,CAAC,uBAAA,CAAA;AAC1B;AAEA,YAAA,MAAMG,SAAS,MAAMtD,cAAAA,CAAe,SAASqB,mBAAmB,CAAC+B,SAAS3C,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAW6C,MAAQ,EAAA;gBACrB,OAAOhF,GAAAA,CAAI6E,YAAY,CAAC,uBAAA,CAAA;AAC1B;YAEA,MAAM,EAAE1C,KAAK,EAAE,GAAG6C,MAAAA;;YAElB,MAAMC,IAAAA,GAAOxC,wCACXqC,CAAAA,QAAAA,CAASvC,IAAI,EACbuC,QAASzC,CAAAA,iBAAiB,EAC1BrC,GAAAA,CAAIG,OAAO,CAACuC,MAAM,CAAA;AAGpB1C,YAAAA,GAAAA,CAAI2C,OAAO,CAACC,GAAG,CAACC,+BAAqBiC,EAAAA,QAAAA,CAAS3C,KAAK,EAAE8C,IAAAA,CAAAA;AACrDjF,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBAAE6C,IAAM,EAAA;AAAEd,oBAAAA;AAAM;AAAE,aAAA;AAC/B,SAAA,CAAE,OAAO3B,GAAK,EAAA;AACZG,YAAAA,MAAAA,CAAOuC,GAAG,CAACpC,KAAK,CAAC,oDAAsDN,EAAAA,GAAAA,CAAAA;AACvE,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC;AACF,KAAA;AAEA,IAAA,MAAMsD,QAAOlF,GAAY,EAAA;QACvB,MAAMuB,aAAAA,GAAgBC,iBAAW,MAAQC,CAAAA,CAAAA,YAAY,CAACzB,GAAIsB,CAAAA,KAAK,CAACb,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,cAAgB,EAAA;YAAEJ,IAAMc,EAAAA;AAAc,SAAA,CAAA;AAE3D,QAAA,MAAM4D,YAAenF,GAAAA,GAAAA,CAAIG,OAAO,CAACC,IAAI,EAAE4B,QAAAA;AACvC,QAAA,MAAMA,QAAW,GAAA,OAAOmD,YAAiB,KAAA,QAAA,GAAWA,YAAeC,GAAAA,SAAAA;;AAGnEpF,QAAAA,GAAAA,CAAI2C,OAAO,CAACC,GAAG,CAACC,iCAAqB,EAAI,EAAA;AACvC,YAAA,GAAGwC,mCAAwBrF,CAAAA,GAAAA,CAAIG,OAAO,CAACuC,MAAM,CAAC;AAC9C4C,YAAAA,OAAAA,EAAS,IAAIC,IAAK,CAAA,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAM7D,cAAiBC,GAAAA,6BAAAA,EAAAA;AACvB,YAAA,IAAID,cAAgB,EAAA;AAClB,gBAAA,MAAMG,SAASC,MAAO9B,CAAAA,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAACsB,EAAE,CAAA;AACvC,gBAAA,MAAML,cAAe,CAAA,OAAA,CAAA,CAASiD,sBAAsB,CAAC9C,MAAQG,EAAAA,QAAAA,CAAAA;AAC/D;AACF,SAAA,CAAE,OAAOxB,GAAK,EAAA;AACZG,YAAAA,MAAAA,CAAOuC,GAAG,CAACpC,KAAK,CAAC,+CAAiDN,EAAAA,GAAAA,CAAAA;AACpE;AAEAR,QAAAA,GAAAA,CAAII,IAAI,GAAG;AAAE6C,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB;AACF,CAAE;;;;"}