@strapi/admin 5.33.3 → 5.34.0

package/dist/server/server/src/services/permission/permissions-manager/sanitize.mjs

@@ -1,7 +1,7 @@
-import { detectSubjectType, subject } from '@casl/ability';
-import { permittedFieldsOf } from '@casl/ability/extra';
-import { omit, isArray, some, isNil, flatMap, prop, isEmpty, defaults, isObject, cloneDeep, getOr, pick, intersection, uniq } from 'lodash/fp';
-import { sanitize, contentTypes, async, traverse, traverseEntity } from '@strapi/utils';
+import { subject } from '@casl/ability';
+import { omit, isArray, defaults, isObject, isEmpty, cloneDeep, getOr, pick, intersection, uniq } from 'lodash/fp';
+import { sanitize, createModelCache, contentTypes, async, traverse, traverseEntity } from '@strapi/utils';
+import { createPermissionFieldsCache } from './permission-fields.mjs';
 import { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user.mjs';
 
 const { visitors: { removePassword, expandWildcardPopulate } } = sanitize;
@@ -17,9 +17,11 @@ const STATIC_FIELDS = [
 var createSanitizeHelpers = (({ action, ability, model })=>{
     const schema = strapi.getModel(model);
     const { removeDisallowedFields } = sanitize.visitors;
+    // Create request-scoped model cache to avoid redundant getModel() calls
+    const modelCache = createModelCache(strapi.getModel.bind(strapi));
     const ctx = {
         schema,
-        getModel: strapi.getModel.bind(strapi)
+        getModel: modelCache.getModel
     };
     const createSanitizeQuery = (options = {})=>{
         const { fields } = options;
@@ -85,6 +87,7 @@ var createSanitizeHelpers = (({ action, ability, model })=>{
         omitCreatorRoles);
     };
     const wrapSanitize = (createSanitizeFunction)=>{
+        const { getPermissionFields } = createPermissionFieldsCache(ability);
         // TODO
         // @ts-expect-error define the correct return type
         const wrappedSanitize = async (data, options = {})=>{
@@ -92,15 +95,11 @@ var createSanitizeHelpers = (({ action, ability, model })=>{
                 return Promise.all(data.map((entity)=>wrappedSanitize(entity, options)));
             }
             const { subject, action: actionOverride } = getDefaultOptions(data, options);
-            const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {
-                fieldsFrom: (rule)=>rule.fields || []
-            });
-            const hasAtLeastOneRegistered = some((fields)=>!isNil(fields), flatMap(prop('fields'), ability.rulesFor(actionOverride, detectSubjectType(subject))));
-            const shouldIncludeAllFields = isEmpty(permittedFields) && !hasAtLeastOneRegistered;
+            const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(actionOverride, subject);
             const sanitizeOptions = {
                 ...options,
                 fields: {
-                    shouldIncludeAll: shouldIncludeAllFields,
+                    shouldIncludeAll,
                     permitted: permittedFields,
                     hasAtLeastOneRegistered
                 }

package/dist/server/server/src/services/permission/permissions-manager/sanitize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/sanitize.ts"],"sourcesContent":["import { subject as asSubject, detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport {\n  defaults,\n  omit,\n  isArray,\n  isEmpty,\n  isNil,\n  flatMap,\n  some,\n  prop,\n  uniq,\n  intersection,\n  pick,\n  getOr,\n  isObject,\n  cloneDeep,\n} from 'lodash/fp';\n\nimport type { UID } from '@strapi/types';\n\nimport { contentTypes, traverseEntity, sanitize, async, traverse } from '@strapi/utils';\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst {\n  visitors: { removePassword, expandWildcardPopulate },\n} = sanitize;\n\nconst {\n  constants,\n  isScalarAttribute,\n  getNonVisibleAttributes,\n  getNonWritableAttributes,\n  getWritableAttributes,\n} = contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  const { removeDisallowedFields } = sanitize.visitors;\n\n  const ctx = {\n    schema,\n    getModel: strapi.getModel.bind(strapi),\n  };\n\n  const createSanitizeQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: sanitize relations to admin users in all sanitizers\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const sanitizeFilters = async.pipe(\n      traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryFilters(omitHiddenFields, ctx),\n      traverse.traverseQueryFilters(removePassword, ctx),\n      traverse.traverseQueryFilters(({ key, value }, { remove }) => {\n        if (isObject(value) && isEmpty(value)) {\n          remove(key);\n        }\n      }, ctx)\n    );\n\n    const sanitizeSort = async.pipe(\n      traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQuerySort(omitHiddenFields, ctx),\n      traverse.traverseQuerySort(removePassword, ctx),\n      traverse.traverseQuerySort(({ key, attribute, value }, { remove }) => {\n        if (!isScalarAttribute(attribute) && isEmpty(value)) {\n          remove(key);\n        }\n      }, ctx)\n    );\n\n    const sanitizePopulate = async.pipe(\n      traverse.traverseQueryPopulate(expandWildcardPopulate, ctx),\n      traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(omitHiddenFields, ctx),\n      traverse.traverseQueryPopulate(removePassword, ctx)\n    );\n\n    const sanitizeFields = async.pipe(\n      traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFields(omitHiddenFields, ctx),\n      traverse.traverseQueryFields(removePassword, ctx)\n    );\n\n    return async (query: any) => {\n      const sanitizedQuery = cloneDeep(query);\n\n      if (query.filters) {\n        Object.assign(sanitizedQuery, { filters: await sanitizeFilters(query.filters) });\n      }\n\n      if (query.sort) {\n        Object.assign(sanitizedQuery, { sort: await sanitizeSort(query.sort) });\n      }\n\n      if (query.populate) {\n        Object.assign(sanitizedQuery, { populate: await sanitizePopulate(query.populate) });\n      }\n\n      if (query.fields) {\n        Object.assign(sanitizedQuery, { fields: await sanitizeFields(query.fields) });\n      }\n\n      return sanitizedQuery;\n    };\n  };\n\n  const createSanitizeOutput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getOutputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove unallowed fields from admin::user relations\n      traverseEntity(pickAllowedAdminUserFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove all fields of type 'password'\n      sanitize.sanitizers.sanitizePasswords({\n        schema,\n        getModel(uid: string) {\n          return strapi.getModel(uid as UID.Schema);\n        },\n      })\n    );\n  };\n\n  const createSanitizeInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapSanitize = (createSanitizeFunction: any) => {\n    // TODO\n    // @ts-expect-error define the correct return type\n    const wrappedSanitize = async (data: unknown, options = {} as any) => {\n      if (isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedSanitize(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = some(\n        (fields) => !isNil(fields),\n        flatMap(prop('fields'), ability.rulesFor(actionOverride, detectSubjectType(subject)))\n      );\n      const shouldIncludeAllFields = isEmpty(permittedFields) && !hasAtLeastOneRegistered;\n\n      const sanitizeOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll: shouldIncludeAllFields,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const sanitizeFunction = createSanitizeFunction(sanitizeOptions);\n\n      return sanitizeFunction(data);\n    };\n\n    return wrappedSanitize;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({ subject: asSubject(model, data), action }, options);\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const omitHiddenFields = ({ key, schema }: any, { remove }: any) => {\n    const isHidden = getOr(false, ['config', 'attributes', key, 'hidden'], schema);\n\n    if (isHidden) {\n      remove(key);\n    }\n  };\n\n  /**\n   * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const pickAllowedAdminUserFields = ({ attribute, key, value }: any, { set }: any) => {\n    const pickAllowedFields = pick(ADMIN_USER_ALLOWED_FIELDS);\n    if (!attribute) {\n      return;\n    }\n\n    if (attribute.type === 'relation' && attribute.target === 'admin::user' && value) {\n      if (Array.isArray(value)) {\n        set(key, value.map(pickAllowedFields));\n      } else {\n        set(key, pickAllowedFields(value));\n      }\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const omitDisallowedAdminUserFields = ({ key, attribute, schema }: any, { remove }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      remove(key);\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes]);\n  };\n\n  const getOutputFields = (fields = []) => {\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      ...nonWritableAttributes,\n      ...nonVisibleAttributes,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n    ]);\n  };\n\n  const getQueryFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      ...nonVisibleWritableAttributes,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n      PUBLISHED_AT_ATTRIBUTE,\n      CREATED_BY_ATTRIBUTE,\n      UPDATED_BY_ATTRIBUTE,\n    ]);\n  };\n\n  return {\n    sanitizeOutput: wrapSanitize(createSanitizeOutput),\n    sanitizeInput: wrapSanitize(createSanitizeInput),\n    sanitizeQuery: wrapSanitize(createSanitizeQuery),\n  };\n};\n"],"names":["visitors","removePassword","expandWildcardPopulate","sanitize","constants","isScalarAttribute","getNonVisibleAttributes","getNonWritableAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","action","ability","model","schema","strapi","getModel","removeDisallowedFields","ctx","bind","createSanitizeQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","sanitizeFilters","async","pipe","traverse","traverseQueryFilters","omitDisallowedAdminUserFields","omitHiddenFields","key","value","remove","isObject","isEmpty","sanitizeSort","traverseQuerySort","attribute","sanitizePopulate","traverseQueryPopulate","sanitizeFields","traverseQueryFields","query","sanitizedQuery","cloneDeep","filters","Object","assign","sort","populate","createSanitizeOutput","getOutputFields","traverseEntity","pickAllowedAdminUserFields","sanitizers","sanitizePasswords","uid","createSanitizeInput","getInputFields","omitCreatorRoles","wrapSanitize","createSanitizeFunction","wrappedSanitize","data","isArray","Promise","all","map","entity","subject","actionOverride","getDefaultOptions","permittedFieldsOf","fieldsFrom","rule","hasAtLeastOneRegistered","some","isNil","flatMap","prop","rulesFor","detectSubjectType","shouldIncludeAllFields","sanitizeOptions","sanitizeFunction","defaults","asSubject","omit","isHidden","getOr","set","pickAllowedFields","pick","ADMIN_USER_ALLOWED_FIELDS","type","target","Array","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","uniq","nonWritableAttributes","sanitizeOutput","sanitizeInput","sanitizeQuery"],"mappings":";;;;;;AAwBA,MAAM,EACJA,UAAU,EAAEC,cAAc,EAAEC,sBAAsB,EAAE,EACrD,GAAGC,QAAAA;AAEJ,MAAM,EACJC,SAAS,EACTC,iBAAiB,EACjBC,uBAAuB,EACvBC,wBAAwB,EACxBC,qBAAqB,EACtB,GAAGC,YAAAA;AACJ,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGZ,SAAAA;AAEJ,MAAMa,gBAAmB,GAAA;AAAC,IAAA;AAAc,CAAA;AACxC,MAAMC,aAAgB,GAAA;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,4BAAe,CAAA,CAAC,EAAEQ,MAAM,EAAEC,OAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAOC,CAAAA,QAAQ,CAACH,KAAAA,CAAAA;AAE/B,IAAA,MAAM,EAAEI,sBAAsB,EAAE,GAAGtB,SAASH,QAAQ;AAEpD,IAAA,MAAM0B,GAAM,GAAA;AACVJ,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUD,MAAOC,CAAAA,QAAQ,CAACG,IAAI,CAACJ,MAAAA;AACjC,KAAA;AAEA,IAAA,MAAMK,mBAAsB,GAAA,CAACC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOC,GAAAA,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,kBAAkBC,KAAMC,CAAAA,IAAI,CAChCC,QAAAA,CAASC,oBAAoB,CAACd,sBAAAA,CAAuBM,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA,EACvEY,SAASC,oBAAoB,CAACC,6BAA+Bd,EAAAA,GAAAA,CAAAA,EAC7DY,SAASC,oBAAoB,CAACE,gBAAkBf,EAAAA,GAAAA,CAAAA,EAChDY,SAASC,oBAAoB,CAACtC,cAAgByB,EAAAA,GAAAA,CAAAA,EAC9CY,SAASC,oBAAoB,CAAC,CAAC,EAAEG,GAAG,EAAEC,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;YACvD,IAAIC,QAAAA,CAASF,KAAUG,CAAAA,IAAAA,OAAAA,CAAQH,KAAQ,CAAA,EAAA;gBACrCC,MAAOF,CAAAA,GAAAA,CAAAA;AACT;SACChB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMqB,eAAeX,KAAMC,CAAAA,IAAI,CAC7BC,QAAAA,CAASU,iBAAiB,CAACvB,sBAAAA,CAAuBM,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA,EACpEY,SAASU,iBAAiB,CAACR,+BAA+Bd,GAC1DY,CAAAA,EAAAA,QAAAA,CAASU,iBAAiB,CAACP,gBAAAA,EAAkBf,GAC7CY,CAAAA,EAAAA,QAAAA,CAASU,iBAAiB,CAAC/C,cAAAA,EAAgByB,MAC3CY,QAASU,CAAAA,iBAAiB,CAAC,CAAC,EAAEN,GAAG,EAAEO,SAAS,EAAEN,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;AAC/D,YAAA,IAAI,CAACvC,iBAAAA,CAAkB4C,SAAcH,CAAAA,IAAAA,OAAAA,CAAQH,KAAQ,CAAA,EAAA;gBACnDC,MAAOF,CAAAA,GAAAA,CAAAA;AACT;SACChB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMwB,gBAAmBd,GAAAA,KAAAA,CAAMC,IAAI,CACjCC,QAASa,CAAAA,qBAAqB,CAACjD,sBAAAA,EAAwBwB,GACvDY,CAAAA,EAAAA,QAAAA,CAASa,qBAAqB,CAAC1B,sBAAuBM,CAAAA,eAAAA,CAAAA,EAAkBL,GACxEY,CAAAA,EAAAA,QAAAA,CAASa,qBAAqB,CAACX,6BAA+Bd,EAAAA,GAAAA,CAAAA,EAC9DY,QAASa,CAAAA,qBAAqB,CAACV,gBAAAA,EAAkBf,GACjDY,CAAAA,EAAAA,QAAAA,CAASa,qBAAqB,CAAClD,cAAgByB,EAAAA,GAAAA,CAAAA,CAAAA;AAGjD,QAAA,MAAM0B,iBAAiBhB,KAAMC,CAAAA,IAAI,CAC/BC,QAASe,CAAAA,mBAAmB,CAAC5B,sBAAuBM,CAAAA,eAAAA,CAAAA,EAAkBL,GACtEY,CAAAA,EAAAA,QAAAA,CAASe,mBAAmB,CAACZ,gBAAAA,EAAkBf,MAC/CY,QAASe,CAAAA,mBAAmB,CAACpD,cAAgByB,EAAAA,GAAAA,CAAAA,CAAAA;AAG/C,QAAA,OAAO,OAAO4B,KAAAA,GAAAA;AACZ,YAAA,MAAMC,iBAAiBC,SAAUF,CAAAA,KAAAA,CAAAA;YAEjC,IAAIA,KAAAA,CAAMG,OAAO,EAAE;gBACjBC,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEE,OAAS,EAAA,MAAMtB,eAAgBmB,CAAAA,KAAAA,CAAMG,OAAO;AAAE,iBAAA,CAAA;AAChF;YAEA,IAAIH,KAAAA,CAAMM,IAAI,EAAE;gBACdF,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEK,IAAM,EAAA,MAAMb,YAAaO,CAAAA,KAAAA,CAAMM,IAAI;AAAE,iBAAA,CAAA;AACvE;YAEA,IAAIN,KAAAA,CAAMO,QAAQ,EAAE;gBAClBH,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEM,QAAU,EAAA,MAAMX,gBAAiBI,CAAAA,KAAAA,CAAMO,QAAQ;AAAE,iBAAA,CAAA;AACnF;YAEA,IAAIP,KAAAA,CAAMxB,MAAM,EAAE;gBAChB4B,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEzB,MAAQ,EAAA,MAAMsB,cAAeE,CAAAA,KAAAA,CAAMxB,MAAM;AAAE,iBAAA,CAAA;AAC7E;YAEA,OAAOyB,cAAAA;AACT,SAAA;AACF,KAAA;AAEA,IAAA,MAAMO,oBAAuB,GAAA,CAACjC,OAAU,GAAA,EAAS,GAAA;QAC/C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAO+B,GAAAA,eAAAA,CAAgBjC,OAAOI,SAAS,CAAA;QAEzF,OAAOE,KAAAA,CAAMC,IAAI;QAEf2B,cAAevB,CAAAA,gBAAAA,EAAkBf;QAEjCsC,cAAeC,CAAAA,0BAAAA,EAA4BvC;QAE3CsC,cAAevC,CAAAA,sBAAAA,CAAuBM,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA;QAExDvB,QAAS+D,CAAAA,UAAU,CAACC,iBAAiB,CAAC;AACpC7C,YAAAA,MAAAA;AACAE,YAAAA,QAAAA,CAAAA,CAAS4C,GAAW,EAAA;gBAClB,OAAO7C,MAAAA,CAAOC,QAAQ,CAAC4C,GAAAA,CAAAA;AACzB;AACF,SAAA,CAAA,CAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,mBAAsB,GAAA,CAACxC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOsC,GAAAA,cAAAA,CAAexC,OAAOI,SAAS,CAAA;QAExF,OAAOE,KAAAA,CAAMC,IAAI;QAEf2B,cAAevB,CAAAA,gBAAAA,EAAkBf;QAEjCsC,cAAevC,CAAAA,sBAAAA,CAAuBM,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA;AAExD6C,QAAAA,gBAAAA,CAAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;;;AAGpB,QAAA,MAAMC,eAAkB,GAAA,OAAOC,IAAe9C,EAAAA,OAAAA,GAAU,EAAS,GAAA;AAC/D,YAAA,IAAI+C,QAAQD,IAAO,CAAA,EAAA;gBACjB,OAAOE,OAAAA,CAAQC,GAAG,CAACH,IAAAA,CAAKI,GAAG,CAAC,CAACC,MAAoBN,GAAAA,eAAAA,CAAgBM,MAAQnD,EAAAA,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E;YAEA,MAAM,EAAEoD,OAAO,EAAE9D,MAAAA,EAAQ+D,cAAc,EAAE,GAAGC,kBAAkBR,IAAM9C,EAAAA,OAAAA,CAAAA;AAEpE,YAAA,MAAME,eAAkBqD,GAAAA,iBAAAA,CAAkBhE,OAAS8D,EAAAA,cAAAA,EAAgBD,OAAS,EAAA;AAC1EI,gBAAAA,UAAAA,EAAY,CAACC,IAAAA,GAASA,IAAKxD,CAAAA,MAAM,IAAI;AACvC,aAAA,CAAA;AAEA,YAAA,MAAMyD,uBAA0BC,GAAAA,IAAAA,CAC9B,CAAC1D,MAAAA,GAAW,CAAC2D,KAAM3D,CAAAA,MAAAA,CAAAA,EACnB4D,OAAQC,CAAAA,IAAAA,CAAK,QAAWvE,CAAAA,EAAAA,OAAAA,CAAQwE,QAAQ,CAACV,gBAAgBW,iBAAkBZ,CAAAA,OAAAA,CAAAA,CAAAA,CAAAA,CAAAA;YAE7E,MAAMa,sBAAAA,GAAyBhD,OAAQf,CAAAA,eAAAA,CAAAA,IAAoB,CAACwD,uBAAAA;AAE5D,YAAA,MAAMQ,eAAkB,GAAA;AACtB,gBAAA,GAAGlE,OAAO;gBACVC,MAAQ,EAAA;oBACNE,gBAAkB8D,EAAAA,sBAAAA;oBAClB5D,SAAWH,EAAAA,eAAAA;AACXwD,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAMS,mBAAmBvB,sBAAuBsB,CAAAA,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAiBrB,CAAAA,IAAAA,CAAAA;AAC1B,SAAA;QAEA,OAAOD,eAAAA;AACT,KAAA;IAEA,MAAMS,iBAAAA,GAAoB,CAACR,IAAW9C,EAAAA,OAAAA,GAAAA;AACpC,QAAA,OAAOoE,QAAS,CAAA;AAAEhB,YAAAA,OAAAA,EAASiB,QAAU7E,KAAOsD,EAAAA,IAAAA,CAAAA;AAAOxD,YAAAA;SAAUU,EAAAA,OAAAA,CAAAA;AAC/D,KAAA;AAEA;;MAGA,MAAM0C,mBAAmB4B,IAAK,CAAA;QAAC,CAAGpF,EAAAA,oBAAAA,CAAqB,MAAM,CAAC;QAAE,CAAGC,EAAAA,oBAAAA,CAAqB,MAAM;AAAE,KAAA,CAAA;AAEhG;;MAGA,MAAMyB,gBAAmB,GAAA,CAAC,EAAEC,GAAG,EAAEpB,MAAM,EAAO,EAAE,EAAEsB,MAAM,EAAO,GAAA;QAC7D,MAAMwD,QAAAA,GAAWC,MAAM,KAAO,EAAA;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAc3D,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAEpB,MAAAA,CAAAA;AAEvE,QAAA,IAAI8E,QAAU,EAAA;YACZxD,MAAOF,CAAAA,GAAAA,CAAAA;AACT;AACF,KAAA;AAEA;;AAEC,MACD,MAAMuB,0BAAAA,GAA6B,CAAC,EAAEhB,SAAS,EAAEP,GAAG,EAAEC,KAAK,EAAO,EAAE,EAAE2D,GAAG,EAAO,GAAA;AAC9E,QAAA,MAAMC,oBAAoBC,IAAKC,CAAAA,yBAAAA,CAAAA;AAC/B,QAAA,IAAI,CAACxD,SAAW,EAAA;AACd,YAAA;AACF;QAEA,IAAIA,SAAAA,CAAUyD,IAAI,KAAK,UAAA,IAAczD,UAAU0D,MAAM,KAAK,iBAAiBhE,KAAO,EAAA;YAChF,IAAIiE,KAAAA,CAAMhC,OAAO,CAACjC,KAAQ,CAAA,EAAA;gBACxB2D,GAAI5D,CAAAA,GAAAA,EAAKC,KAAMoC,CAAAA,GAAG,CAACwB,iBAAAA,CAAAA,CAAAA;aACd,MAAA;AACLD,gBAAAA,GAAAA,CAAI5D,KAAK6D,iBAAkB5D,CAAAA,KAAAA,CAAAA,CAAAA;AAC7B;AACF;AACF,KAAA;AAEA;;AAEC,MACD,MAAMH,6BAAAA,GAAgC,CAAC,EAAEE,GAAG,EAAEO,SAAS,EAAE3B,MAAM,EAAO,EAAE,EAAEsB,MAAM,EAAO,GAAA;QACrF,IAAItB,MAAAA,CAAO8C,GAAG,KAAK,aAAA,IAAiBnB,aAAa,CAACwD,yBAAAA,CAA0BI,QAAQ,CAACnE,GAAM,CAAA,EAAA;YACzFE,MAAOF,CAAAA,GAAAA,CAAAA;AACT;AACF,KAAA;IAEA,MAAM4B,cAAAA,GAAiB,CAACxC,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMgF,uBAAuBxG,uBAAwBgB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMyF,qBAAqBvG,qBAAsBc,CAAAA,MAAAA,CAAAA;QAEjD,MAAM0F,4BAAAA,GAA+BC,aAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,IAAK,CAAA;AAAIpF,YAAAA,GAAAA,MAAAA;AAAWb,YAAAA,GAAAA,gBAAAA;AAAqB+F,YAAAA,GAAAA;AAA6B,SAAA,CAAA;AAC/E,KAAA;IAEA,MAAMjD,eAAAA,GAAkB,CAACjC,MAAAA,GAAS,EAAE,GAAA;AAClC,QAAA,MAAMqF,wBAAwB5G,wBAAyBe,CAAAA,MAAAA,CAAAA;AACvD,QAAA,MAAMwF,uBAAuBxG,uBAAwBgB,CAAAA,MAAAA,CAAAA;AAErD,QAAA,OAAO4F,IAAK,CAAA;AACPpF,YAAAA,GAAAA,MAAAA;AACAZ,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACAkG,YAAAA,GAAAA,qBAAAA;AACAL,YAAAA,GAAAA,oBAAAA;AACHlG,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,MAAMoB,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMgF,uBAAuBxG,uBAAwBgB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMyF,qBAAqBvG,qBAAsBc,CAAAA,MAAAA,CAAAA;QAEjD,MAAM0F,4BAAAA,GAA+BC,aAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,IAAK,CAAA;AACPpF,YAAAA,GAAAA,MAAAA;AACAZ,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACA+F,YAAAA,GAAAA,4BAAAA;AACHpG,YAAAA,oBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,OAAO;AACLoG,QAAAA,cAAAA,EAAgB5C,YAAaV,CAAAA,oBAAAA,CAAAA;AAC7BuD,QAAAA,aAAAA,EAAe7C,YAAaH,CAAAA,mBAAAA,CAAAA;AAC5BiD,QAAAA,aAAAA,EAAe9C,YAAa5C,CAAAA,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"sanitize.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/sanitize.ts"],"sourcesContent":["import { subject as asSubject } from '@casl/ability';\nimport {\n  defaults,\n  omit,\n  isArray,\n  isEmpty,\n  uniq,\n  intersection,\n  pick,\n  getOr,\n  isObject,\n  cloneDeep,\n} from 'lodash/fp';\n\nimport type { UID } from '@strapi/types';\n\nimport {\n  contentTypes,\n  traverseEntity,\n  sanitize,\n  async,\n  traverse,\n  createModelCache,\n} from '@strapi/utils';\nimport { createPermissionFieldsCache } from './permission-fields';\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst {\n  visitors: { removePassword, expandWildcardPopulate },\n} = sanitize;\n\nconst {\n  constants,\n  isScalarAttribute,\n  getNonVisibleAttributes,\n  getNonWritableAttributes,\n  getWritableAttributes,\n} = contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  const { removeDisallowedFields } = sanitize.visitors;\n\n  // Create request-scoped model cache to avoid redundant getModel() calls\n  const modelCache = createModelCache(strapi.getModel.bind(strapi));\n\n  const ctx = {\n    schema,\n    getModel: modelCache.getModel,\n  };\n\n  const createSanitizeQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: sanitize relations to admin users in all sanitizers\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const sanitizeFilters = async.pipe(\n      traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryFilters(omitHiddenFields, ctx),\n      traverse.traverseQueryFilters(removePassword, ctx),\n      traverse.traverseQueryFilters(({ key, value }, { remove }) => {\n        if (isObject(value) && isEmpty(value)) {\n          remove(key);\n        }\n      }, ctx)\n    );\n\n    const sanitizeSort = async.pipe(\n      traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQuerySort(omitHiddenFields, ctx),\n      traverse.traverseQuerySort(removePassword, ctx),\n      traverse.traverseQuerySort(({ key, attribute, value }, { remove }) => {\n        if (!isScalarAttribute(attribute) && isEmpty(value)) {\n          remove(key);\n        }\n      }, ctx)\n    );\n\n    const sanitizePopulate = async.pipe(\n      traverse.traverseQueryPopulate(expandWildcardPopulate, ctx),\n      traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(omitHiddenFields, ctx),\n      traverse.traverseQueryPopulate(removePassword, ctx)\n    );\n\n    const sanitizeFields = async.pipe(\n      traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFields(omitHiddenFields, ctx),\n      traverse.traverseQueryFields(removePassword, ctx)\n    );\n\n    return async (query: any) => {\n      const sanitizedQuery = cloneDeep(query);\n\n      if (query.filters) {\n        Object.assign(sanitizedQuery, { filters: await sanitizeFilters(query.filters) });\n      }\n\n      if (query.sort) {\n        Object.assign(sanitizedQuery, { sort: await sanitizeSort(query.sort) });\n      }\n\n      if (query.populate) {\n        Object.assign(sanitizedQuery, { populate: await sanitizePopulate(query.populate) });\n      }\n\n      if (query.fields) {\n        Object.assign(sanitizedQuery, { fields: await sanitizeFields(query.fields) });\n      }\n\n      return sanitizedQuery;\n    };\n  };\n\n  const createSanitizeOutput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getOutputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove unallowed fields from admin::user relations\n      traverseEntity(pickAllowedAdminUserFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove all fields of type 'password'\n      sanitize.sanitizers.sanitizePasswords({\n        schema,\n        getModel(uid: string) {\n          return strapi.getModel(uid as UID.Schema);\n        },\n      })\n    );\n  };\n\n  const createSanitizeInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapSanitize = (createSanitizeFunction: any) => {\n    const { getPermissionFields } = createPermissionFieldsCache(ability);\n\n    // TODO\n    // @ts-expect-error define the correct return type\n    const wrappedSanitize = async (data: unknown, options = {} as any) => {\n      if (isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedSanitize(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(\n        actionOverride,\n        subject\n      );\n\n      const sanitizeOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const sanitizeFunction = createSanitizeFunction(sanitizeOptions);\n\n      return sanitizeFunction(data);\n    };\n\n    return wrappedSanitize;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({ subject: asSubject(model, data), action }, options);\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const omitHiddenFields = ({ key, schema }: any, { remove }: any) => {\n    const isHidden = getOr(false, ['config', 'attributes', key, 'hidden'], schema);\n\n    if (isHidden) {\n      remove(key);\n    }\n  };\n\n  /**\n   * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const pickAllowedAdminUserFields = ({ attribute, key, value }: any, { set }: any) => {\n    const pickAllowedFields = pick(ADMIN_USER_ALLOWED_FIELDS);\n    if (!attribute) {\n      return;\n    }\n\n    if (attribute.type === 'relation' && attribute.target === 'admin::user' && value) {\n      if (Array.isArray(value)) {\n        set(key, value.map(pickAllowedFields));\n      } else {\n        set(key, pickAllowedFields(value));\n      }\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const omitDisallowedAdminUserFields = ({ key, attribute, schema }: any, { remove }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      remove(key);\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes]);\n  };\n\n  const getOutputFields = (fields = []) => {\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      ...nonWritableAttributes,\n      ...nonVisibleAttributes,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n    ]);\n  };\n\n  const getQueryFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      ...nonVisibleWritableAttributes,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n      PUBLISHED_AT_ATTRIBUTE,\n      CREATED_BY_ATTRIBUTE,\n      UPDATED_BY_ATTRIBUTE,\n    ]);\n  };\n\n  return {\n    sanitizeOutput: wrapSanitize(createSanitizeOutput),\n    sanitizeInput: wrapSanitize(createSanitizeInput),\n    sanitizeQuery: wrapSanitize(createSanitizeQuery),\n  };\n};\n"],"names":["visitors","removePassword","expandWildcardPopulate","sanitize","constants","isScalarAttribute","getNonVisibleAttributes","getNonWritableAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","action","ability","model","schema","strapi","getModel","removeDisallowedFields","modelCache","createModelCache","bind","ctx","createSanitizeQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","sanitizeFilters","async","pipe","traverse","traverseQueryFilters","omitDisallowedAdminUserFields","omitHiddenFields","key","value","remove","isObject","isEmpty","sanitizeSort","traverseQuerySort","attribute","sanitizePopulate","traverseQueryPopulate","sanitizeFields","traverseQueryFields","query","sanitizedQuery","cloneDeep","filters","Object","assign","sort","populate","createSanitizeOutput","getOutputFields","traverseEntity","pickAllowedAdminUserFields","sanitizers","sanitizePasswords","uid","createSanitizeInput","getInputFields","omitCreatorRoles","wrapSanitize","createSanitizeFunction","getPermissionFields","createPermissionFieldsCache","wrappedSanitize","data","isArray","Promise","all","map","entity","subject","actionOverride","getDefaultOptions","hasAtLeastOneRegistered","sanitizeOptions","sanitizeFunction","defaults","asSubject","omit","isHidden","getOr","set","pickAllowedFields","pick","ADMIN_USER_ALLOWED_FIELDS","type","target","Array","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","uniq","nonWritableAttributes","sanitizeOutput","sanitizeInput","sanitizeQuery"],"mappings":";;;;;;AA2BA,MAAM,EACJA,UAAU,EAAEC,cAAc,EAAEC,sBAAsB,EAAE,EACrD,GAAGC,QAAAA;AAEJ,MAAM,EACJC,SAAS,EACTC,iBAAiB,EACjBC,uBAAuB,EACvBC,wBAAwB,EACxBC,qBAAqB,EACtB,GAAGC,YAAAA;AACJ,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGZ,SAAAA;AAEJ,MAAMa,gBAAmB,GAAA;AAAC,IAAA;AAAc,CAAA;AACxC,MAAMC,aAAgB,GAAA;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,4BAAe,CAAA,CAAC,EAAEQ,MAAM,EAAEC,OAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAOC,CAAAA,QAAQ,CAACH,KAAAA,CAAAA;AAE/B,IAAA,MAAM,EAAEI,sBAAsB,EAAE,GAAGtB,SAASH,QAAQ;;AAGpD,IAAA,MAAM0B,aAAaC,gBAAiBJ,CAAAA,MAAAA,CAAOC,QAAQ,CAACI,IAAI,CAACL,MAAAA,CAAAA,CAAAA;AAEzD,IAAA,MAAMM,GAAM,GAAA;AACVP,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUE,WAAWF;AACvB,KAAA;AAEA,IAAA,MAAMM,mBAAsB,GAAA,CAACC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOC,GAAAA,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,kBAAkBC,KAAMC,CAAAA,IAAI,CAChCC,QAAAA,CAASC,oBAAoB,CAAChB,sBAAAA,CAAuBQ,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA,EACvEW,SAASC,oBAAoB,CAACC,6BAA+Bb,EAAAA,GAAAA,CAAAA,EAC7DW,SAASC,oBAAoB,CAACE,gBAAkBd,EAAAA,GAAAA,CAAAA,EAChDW,SAASC,oBAAoB,CAACxC,cAAgB4B,EAAAA,GAAAA,CAAAA,EAC9CW,SAASC,oBAAoB,CAAC,CAAC,EAAEG,GAAG,EAAEC,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;YACvD,IAAIC,QAAAA,CAASF,KAAUG,CAAAA,IAAAA,OAAAA,CAAQH,KAAQ,CAAA,EAAA;gBACrCC,MAAOF,CAAAA,GAAAA,CAAAA;AACT;SACCf,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMoB,eAAeX,KAAMC,CAAAA,IAAI,CAC7BC,QAAAA,CAASU,iBAAiB,CAACzB,sBAAAA,CAAuBQ,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA,EACpEW,SAASU,iBAAiB,CAACR,+BAA+Bb,GAC1DW,CAAAA,EAAAA,QAAAA,CAASU,iBAAiB,CAACP,gBAAAA,EAAkBd,GAC7CW,CAAAA,EAAAA,QAAAA,CAASU,iBAAiB,CAACjD,cAAAA,EAAgB4B,MAC3CW,QAASU,CAAAA,iBAAiB,CAAC,CAAC,EAAEN,GAAG,EAAEO,SAAS,EAAEN,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;AAC/D,YAAA,IAAI,CAACzC,iBAAAA,CAAkB8C,SAAcH,CAAAA,IAAAA,OAAAA,CAAQH,KAAQ,CAAA,EAAA;gBACnDC,MAAOF,CAAAA,GAAAA,CAAAA;AACT;SACCf,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMuB,gBAAmBd,GAAAA,KAAAA,CAAMC,IAAI,CACjCC,QAASa,CAAAA,qBAAqB,CAACnD,sBAAAA,EAAwB2B,GACvDW,CAAAA,EAAAA,QAAAA,CAASa,qBAAqB,CAAC5B,sBAAuBQ,CAAAA,eAAAA,CAAAA,EAAkBJ,GACxEW,CAAAA,EAAAA,QAAAA,CAASa,qBAAqB,CAACX,6BAA+Bb,EAAAA,GAAAA,CAAAA,EAC9DW,QAASa,CAAAA,qBAAqB,CAACV,gBAAAA,EAAkBd,GACjDW,CAAAA,EAAAA,QAAAA,CAASa,qBAAqB,CAACpD,cAAgB4B,EAAAA,GAAAA,CAAAA,CAAAA;AAGjD,QAAA,MAAMyB,iBAAiBhB,KAAMC,CAAAA,IAAI,CAC/BC,QAASe,CAAAA,mBAAmB,CAAC9B,sBAAuBQ,CAAAA,eAAAA,CAAAA,EAAkBJ,GACtEW,CAAAA,EAAAA,QAAAA,CAASe,mBAAmB,CAACZ,gBAAAA,EAAkBd,MAC/CW,QAASe,CAAAA,mBAAmB,CAACtD,cAAgB4B,EAAAA,GAAAA,CAAAA,CAAAA;AAG/C,QAAA,OAAO,OAAO2B,KAAAA,GAAAA;AACZ,YAAA,MAAMC,iBAAiBC,SAAUF,CAAAA,KAAAA,CAAAA;YAEjC,IAAIA,KAAAA,CAAMG,OAAO,EAAE;gBACjBC,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEE,OAAS,EAAA,MAAMtB,eAAgBmB,CAAAA,KAAAA,CAAMG,OAAO;AAAE,iBAAA,CAAA;AAChF;YAEA,IAAIH,KAAAA,CAAMM,IAAI,EAAE;gBACdF,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEK,IAAM,EAAA,MAAMb,YAAaO,CAAAA,KAAAA,CAAMM,IAAI;AAAE,iBAAA,CAAA;AACvE;YAEA,IAAIN,KAAAA,CAAMO,QAAQ,EAAE;gBAClBH,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEM,QAAU,EAAA,MAAMX,gBAAiBI,CAAAA,KAAAA,CAAMO,QAAQ;AAAE,iBAAA,CAAA;AACnF;YAEA,IAAIP,KAAAA,CAAMxB,MAAM,EAAE;gBAChB4B,MAAOC,CAAAA,MAAM,CAACJ,cAAgB,EAAA;oBAAEzB,MAAQ,EAAA,MAAMsB,cAAeE,CAAAA,KAAAA,CAAMxB,MAAM;AAAE,iBAAA,CAAA;AAC7E;YAEA,OAAOyB,cAAAA;AACT,SAAA;AACF,KAAA;AAEA,IAAA,MAAMO,oBAAuB,GAAA,CAACjC,OAAU,GAAA,EAAS,GAAA;QAC/C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAO+B,GAAAA,eAAAA,CAAgBjC,OAAOI,SAAS,CAAA;QAEzF,OAAOE,KAAAA,CAAMC,IAAI;QAEf2B,cAAevB,CAAAA,gBAAAA,EAAkBd;QAEjCqC,cAAeC,CAAAA,0BAAAA,EAA4BtC;QAE3CqC,cAAezC,CAAAA,sBAAAA,CAAuBQ,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA;QAExD1B,QAASiE,CAAAA,UAAU,CAACC,iBAAiB,CAAC;AACpC/C,YAAAA,MAAAA;AACAE,YAAAA,QAAAA,CAAAA,CAAS8C,GAAW,EAAA;gBAClB,OAAO/C,MAAAA,CAAOC,QAAQ,CAAC8C,GAAAA,CAAAA;AACzB;AACF,SAAA,CAAA,CAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,mBAAsB,GAAA,CAACxC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOsC,GAAAA,cAAAA,CAAexC,OAAOI,SAAS,CAAA;QAExF,OAAOE,KAAAA,CAAMC,IAAI;QAEf2B,cAAevB,CAAAA,gBAAAA,EAAkBd;QAEjCqC,cAAezC,CAAAA,sBAAAA,CAAuBQ,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA;AAExD4C,QAAAA,gBAAAA,CAAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;AACpB,QAAA,MAAM,EAAEC,mBAAmB,EAAE,GAAGC,2BAA4BzD,CAAAA,OAAAA,CAAAA;;;AAI5D,QAAA,MAAM0D,eAAkB,GAAA,OAAOC,IAAehD,EAAAA,OAAAA,GAAU,EAAS,GAAA;AAC/D,YAAA,IAAIiD,QAAQD,IAAO,CAAA,EAAA;gBACjB,OAAOE,OAAAA,CAAQC,GAAG,CAACH,IAAAA,CAAKI,GAAG,CAAC,CAACC,MAAoBN,GAAAA,eAAAA,CAAgBM,MAAQrD,EAAAA,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E;YAEA,MAAM,EAAEsD,OAAO,EAAElE,MAAAA,EAAQmE,cAAc,EAAE,GAAGC,kBAAkBR,IAAMhD,EAAAA,OAAAA,CAAAA;YAEpE,MAAM,EAAEE,eAAe,EAAEuD,uBAAuB,EAAEtD,gBAAgB,EAAE,GAAG0C,mBAAAA,CACrEU,cACAD,EAAAA,OAAAA,CAAAA;AAGF,YAAA,MAAMI,eAAkB,GAAA;AACtB,gBAAA,GAAG1D,OAAO;gBACVC,MAAQ,EAAA;AACNE,oBAAAA,gBAAAA;oBACAE,SAAWH,EAAAA,eAAAA;AACXuD,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAME,mBAAmBf,sBAAuBc,CAAAA,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAiBX,CAAAA,IAAAA,CAAAA;AAC1B,SAAA;QAEA,OAAOD,eAAAA;AACT,KAAA;IAEA,MAAMS,iBAAAA,GAAoB,CAACR,IAAWhD,EAAAA,OAAAA,GAAAA;AACpC,QAAA,OAAO4D,QAAS,CAAA;AAAEN,YAAAA,OAAAA,EAASO,QAAUvE,KAAO0D,EAAAA,IAAAA,CAAAA;AAAO5D,YAAAA;SAAUY,EAAAA,OAAAA,CAAAA;AAC/D,KAAA;AAEA;;MAGA,MAAM0C,mBAAmBoB,IAAK,CAAA;QAAC,CAAG9E,EAAAA,oBAAAA,CAAqB,MAAM,CAAC;QAAE,CAAGC,EAAAA,oBAAAA,CAAqB,MAAM;AAAE,KAAA,CAAA;AAEhG;;MAGA,MAAM2B,gBAAmB,GAAA,CAAC,EAAEC,GAAG,EAAEtB,MAAM,EAAO,EAAE,EAAEwB,MAAM,EAAO,GAAA;QAC7D,MAAMgD,QAAAA,GAAWC,MAAM,KAAO,EAAA;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAcnD,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAEtB,MAAAA,CAAAA;AAEvE,QAAA,IAAIwE,QAAU,EAAA;YACZhD,MAAOF,CAAAA,GAAAA,CAAAA;AACT;AACF,KAAA;AAEA;;AAEC,MACD,MAAMuB,0BAAAA,GAA6B,CAAC,EAAEhB,SAAS,EAAEP,GAAG,EAAEC,KAAK,EAAO,EAAE,EAAEmD,GAAG,EAAO,GAAA;AAC9E,QAAA,MAAMC,oBAAoBC,IAAKC,CAAAA,yBAAAA,CAAAA;AAC/B,QAAA,IAAI,CAAChD,SAAW,EAAA;AACd,YAAA;AACF;QAEA,IAAIA,SAAAA,CAAUiD,IAAI,KAAK,UAAA,IAAcjD,UAAUkD,MAAM,KAAK,iBAAiBxD,KAAO,EAAA;YAChF,IAAIyD,KAAAA,CAAMtB,OAAO,CAACnC,KAAQ,CAAA,EAAA;gBACxBmD,GAAIpD,CAAAA,GAAAA,EAAKC,KAAMsC,CAAAA,GAAG,CAACc,iBAAAA,CAAAA,CAAAA;aACd,MAAA;AACLD,gBAAAA,GAAAA,CAAIpD,KAAKqD,iBAAkBpD,CAAAA,KAAAA,CAAAA,CAAAA;AAC7B;AACF;AACF,KAAA;AAEA;;AAEC,MACD,MAAMH,6BAAAA,GAAgC,CAAC,EAAEE,GAAG,EAAEO,SAAS,EAAE7B,MAAM,EAAO,EAAE,EAAEwB,MAAM,EAAO,GAAA;QACrF,IAAIxB,MAAAA,CAAOgD,GAAG,KAAK,aAAA,IAAiBnB,aAAa,CAACgD,yBAAAA,CAA0BI,QAAQ,CAAC3D,GAAM,CAAA,EAAA;YACzFE,MAAOF,CAAAA,GAAAA,CAAAA;AACT;AACF,KAAA;IAEA,MAAM4B,cAAAA,GAAiB,CAACxC,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMwE,uBAAuBlG,uBAAwBgB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMmF,qBAAqBjG,qBAAsBc,CAAAA,MAAAA,CAAAA;QAEjD,MAAMoF,4BAAAA,GAA+BC,aAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,IAAK,CAAA;AAAI5E,YAAAA,GAAAA,MAAAA;AAAWf,YAAAA,GAAAA,gBAAAA;AAAqByF,YAAAA,GAAAA;AAA6B,SAAA,CAAA;AAC/E,KAAA;IAEA,MAAMzC,eAAAA,GAAkB,CAACjC,MAAAA,GAAS,EAAE,GAAA;AAClC,QAAA,MAAM6E,wBAAwBtG,wBAAyBe,CAAAA,MAAAA,CAAAA;AACvD,QAAA,MAAMkF,uBAAuBlG,uBAAwBgB,CAAAA,MAAAA,CAAAA;AAErD,QAAA,OAAOsF,IAAK,CAAA;AACP5E,YAAAA,GAAAA,MAAAA;AACAd,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACA4F,YAAAA,GAAAA,qBAAAA;AACAL,YAAAA,GAAAA,oBAAAA;AACH5F,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,MAAMsB,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMwE,uBAAuBlG,uBAAwBgB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMmF,qBAAqBjG,qBAAsBc,CAAAA,MAAAA,CAAAA;QAEjD,MAAMoF,4BAAAA,GAA+BC,aAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,IAAK,CAAA;AACP5E,YAAAA,GAAAA,MAAAA;AACAd,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACAyF,YAAAA,GAAAA,4BAAAA;AACH9F,YAAAA,oBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,OAAO;AACL8F,QAAAA,cAAAA,EAAgBpC,YAAaV,CAAAA,oBAAAA,CAAAA;AAC7B+C,QAAAA,aAAAA,EAAerC,YAAaH,CAAAA,mBAAAA,CAAAA;AAC5ByC,QAAAA,aAAAA,EAAetC,YAAa5C,CAAAA,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/validate.js

@@ -1,9 +1,9 @@
 'use strict';
 
 var ability = require('@casl/ability');
-var extra = require('@casl/ability/extra');
 var fp = require('lodash/fp');
 var utils = require('@strapi/utils');
+var permissionFields = require('./permission-fields.js');
 var user = require('../../../domain/user.js');
 
 const { ValidationError } = utils.errors;
@@ -23,9 +23,11 @@ const throwInvalidKey = ({ key, path })=>{
 };
 var createValidateHelpers = (({ action, ability: ability$1, model })=>{
     const schema = strapi.getModel(model);
+    // Create request-scoped model cache to avoid redundant getModel() calls
+    const modelCache = utils.createModelCache(strapi.getModel.bind(strapi));
     const ctx = {
         schema,
-        getModel: strapi.getModel.bind(strapi)
+        getModel: modelCache.getModel
     };
     const createValidateQuery = (options = {})=>{
         const { fields } = options;
@@ -75,6 +77,7 @@ var createValidateHelpers = (({ action, ability: ability$1, model })=>{
         omitCreatorRoles);
     };
     const wrapValidate = (createValidateFunction)=>{
+        const { getPermissionFields } = permissionFields.createPermissionFieldsCache(ability$1);
         // TODO
         // @ts-expect-error define the correct return type
         const wrappedValidate = async (data, options = {})=>{
@@ -82,15 +85,11 @@ var createValidateHelpers = (({ action, ability: ability$1, model })=>{
                 return Promise.all(data.map((entity)=>wrappedValidate(entity, options)));
             }
             const { subject, action: actionOverride } = getDefaultOptions(data, options);
-            const permittedFields = extra.permittedFieldsOf(ability$1, actionOverride, subject, {
-                fieldsFrom: (rule)=>rule.fields || []
-            });
-            const hasAtLeastOneRegistered = fp.some((fields)=>!fp.isNil(fields), fp.flatMap(fp.prop('fields'), ability$1.rulesFor(actionOverride, ability.detectSubjectType(subject))));
-            const shouldIncludeAllFields = fp.isEmpty(permittedFields) && !hasAtLeastOneRegistered;
+            const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(actionOverride, subject);
             const validateOptions = {
                 ...options,
                 fields: {
-                    shouldIncludeAll: shouldIncludeAllFields,
+                    shouldIncludeAll,
                     permitted: permittedFields,
                     hasAtLeastOneRegistered
                 }

package/dist/server/server/src/services/permission/permissions-manager/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/validate.ts"],"sourcesContent":["import { subject as asSubject, detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport {\n  defaults,\n  omit,\n  isArray,\n  isEmpty,\n  isNil,\n  flatMap,\n  some,\n  prop,\n  uniq,\n  intersection,\n  getOr,\n  isObject,\n} from 'lodash/fp';\n\nimport { contentTypes, traverseEntity, traverse, validate, async, errors } from '@strapi/utils';\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst { ValidationError } = errors;\nconst { throwPassword, throwDisallowedFields } = validate.visitors;\n\nconst { constants, isScalarAttribute, getNonVisibleAttributes, getWritableAttributes } =\n  contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\n\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nconst throwInvalidKey = ({ key, path }: { key: string; path?: string | null }) => {\n  const msg = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n\n  throw new ValidationError(msg);\n};\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  const ctx = {\n    schema,\n    getModel: strapi.getModel.bind(strapi),\n  };\n\n  const createValidateQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: validate relations to admin users in all validators\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const validateFilters = async.pipe(\n      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryFilters(throwPassword, ctx),\n      traverse.traverseQueryFilters(({ key, value, path }) => {\n        if (isObject(value) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateSort = async.pipe(\n      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQuerySort(throwPassword, ctx),\n      traverse.traverseQuerySort(({ key, attribute, value, path }) => {\n        if (!isScalarAttribute(attribute) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateFields = async.pipe(\n      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFields(throwPassword, ctx)\n    );\n\n    const validatePopulate = async.pipe(\n      traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(throwHiddenFields, ctx),\n      traverse.traverseQueryPopulate(throwPassword, ctx)\n    );\n\n    return async (query: any) => {\n      if (query.filters) {\n        await validateFilters(query.filters);\n      }\n\n      if (query.sort) {\n        await validateSort(query.sort);\n      }\n\n      if (query.fields) {\n        await validateFields(query.fields);\n      }\n\n      // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n      if (query.populate && query.populate !== '*') {\n        await validatePopulate(query.populate);\n      }\n\n      return true;\n    };\n  };\n\n  const createValidateInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(throwHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(throwDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapValidate = (createValidateFunction: any) => {\n    // TODO\n    // @ts-expect-error define the correct return type\n    const wrappedValidate = async (data, options = {}): Promise<unknown> => {\n      if (isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedValidate(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = some(\n        (fields) => !isNil(fields),\n        flatMap(prop('fields'), ability.rulesFor(actionOverride, detectSubjectType(subject)))\n      );\n      const shouldIncludeAllFields = isEmpty(permittedFields) && !hasAtLeastOneRegistered;\n\n      const validateOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll: shouldIncludeAllFields,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const validateFunction = createValidateFunction(validateOptions);\n\n      return validateFunction(data);\n    };\n\n    return wrappedValidate;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({ subject: asSubject(model, data), action }, options);\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const throwHiddenFields = ({ key, schema, path }: any) => {\n    const isHidden = getOr(false, ['config', 'attributes', key, 'hidden'], schema);\n\n    if (isHidden) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const throwDisallowedAdminUserFields = ({ key, attribute, schema, path }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes]);\n  };\n\n  const getQueryFields = (fields = []) => {\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n      PUBLISHED_AT_ATTRIBUTE,\n    ]);\n  };\n\n  return {\n    validateQuery: wrapValidate(createValidateQuery),\n    validateInput: wrapValidate(createValidateInput),\n  };\n};\n"],"names":["ValidationError","errors","throwPassword","throwDisallowedFields","validate","visitors","constants","isScalarAttribute","getNonVisibleAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","throwInvalidKey","key","path","msg","action","ability","model","schema","strapi","getModel","ctx","bind","createValidateQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","validateFilters","async","pipe","traverse","traverseQueryFilters","throwDisallowedAdminUserFields","value","isObject","isEmpty","attribute","validateSort","traverseQuerySort","validateFields","traverseQueryFields","validatePopulate","traverseQueryPopulate","throwHiddenFields","query","filters","sort","populate","createValidateInput","getInputFields","traverseEntity","omitCreatorRoles","wrapValidate","createValidateFunction","wrappedValidate","data","isArray","Promise","all","map","entity","subject","actionOverride","getDefaultOptions","permittedFieldsOf","fieldsFrom","rule","hasAtLeastOneRegistered","some","isNil","flatMap","prop","rulesFor","detectSubjectType","shouldIncludeAllFields","validateOptions","validateFunction","defaults","asSubject","omit","isHidden","getOr","uid","ADMIN_USER_ALLOWED_FIELDS","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","uniq","validateQuery","validateInput"],"mappings":";;;;;;;;AAoBA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,aAAa,EAAEC,qBAAqB,EAAE,GAAGC,eAASC,QAAQ;AAElE,MAAM,EAAEC,SAAS,EAAEC,iBAAiB,EAAEC,uBAAuB,EAAEC,qBAAqB,EAAE,GACpFC,kBAAAA;AACF,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGX,SAAAA;AAEJ,MAAMY,gBAAmB,GAAA;AAAC,IAAA;AAAc,CAAA;AAExC,MAAMC,aAAgB,GAAA;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,MAAMQ,kBAAkB,CAAC,EAAEC,GAAG,EAAEC,IAAI,EAAyC,GAAA;AAC3E,IAAA,MAAMC,GAAMD,GAAAA,IAAAA,IAAQA,IAASD,KAAAA,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAI,CAAA,IAAI,EAAEC,IAAM,CAAA,CAAA,GAAG,CAAC,YAAY,EAAED,GAAK,CAAA,CAAA;AAEzF,IAAA,MAAM,IAAIrB,eAAgBuB,CAAAA,GAAAA,CAAAA;AAC5B,CAAA;AAEA,4BAAe,CAAA,CAAC,EAAEC,MAAM,WAAEC,SAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAOC,CAAAA,QAAQ,CAACH,KAAAA,CAAAA;AAE/B,IAAA,MAAMI,GAAM,GAAA;AACVH,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUD,MAAOC,CAAAA,QAAQ,CAACE,IAAI,CAACH,MAAAA;AACjC,KAAA;AAEA,IAAA,MAAMI,mBAAsB,GAAA,CAACC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOC,GAAAA,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,eAAkBC,GAAAA,WAAAA,CAAMC,IAAI,CAChCC,cAASC,CAAAA,oBAAoB,CAACxC,qBAAAA,CAAsBgC,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA,EACtEY,cAASC,CAAAA,oBAAoB,CAACC,8BAAgCd,EAAAA,GAAAA,CAAAA,EAC9DY,cAASC,CAAAA,oBAAoB,CAACzC,aAAAA,EAAe4B,GAC7CY,CAAAA,EAAAA,cAAAA,CAASC,oBAAoB,CAAC,CAAC,EAAEtB,GAAG,EAAEwB,KAAK,EAAEvB,IAAI,EAAE,GAAA;YACjD,IAAIwB,WAAAA,CAASD,KAAUE,CAAAA,IAAAA,UAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACrCzB,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,iBAAA,CAAA;AAC9C;SACClB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMmB,YAAeT,GAAAA,WAAAA,CAAMC,IAAI,CAC7BC,eAASQ,iBAAiB,CAAC/C,qBAAsBgC,CAAAA,eAAAA,CAAAA,EAAkBL,GACnEY,CAAAA,EAAAA,cAAAA,CAASQ,iBAAiB,CAACN,gCAAgCd,GAC3DY,CAAAA,EAAAA,cAAAA,CAASQ,iBAAiB,CAAChD,aAAe4B,EAAAA,GAAAA,CAAAA,EAC1CY,cAASQ,CAAAA,iBAAiB,CAAC,CAAC,EAAE7B,GAAG,EAAE2B,SAAS,EAAEH,KAAK,EAAEvB,IAAI,EAAE,GAAA;AACzD,YAAA,IAAI,CAACf,iBAAAA,CAAkByC,SAAcD,CAAAA,IAAAA,UAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACnDzB,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,iBAAA,CAAA;AAC9C;SACClB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMqB,cAAiBX,GAAAA,WAAAA,CAAMC,IAAI,CAC/BC,cAASU,CAAAA,mBAAmB,CAACjD,qBAAAA,CAAsBgC,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA,EACrEY,cAASU,CAAAA,mBAAmB,CAAClD,aAAe4B,EAAAA,GAAAA,CAAAA,CAAAA;QAG9C,MAAMuB,gBAAAA,GAAmBb,YAAMC,IAAI,CACjCC,eAASY,qBAAqB,CAACnD,qBAAsBgC,CAAAA,eAAAA,CAAAA,EAAkBL,GACvEY,CAAAA,EAAAA,cAAAA,CAASY,qBAAqB,CAACV,8BAAAA,EAAgCd,GAC/DY,CAAAA,EAAAA,cAAAA,CAASY,qBAAqB,CAACC,mBAAmBzB,GAClDY,CAAAA,EAAAA,cAAAA,CAASY,qBAAqB,CAACpD,aAAe4B,EAAAA,GAAAA,CAAAA,CAAAA;AAGhD,QAAA,OAAO,OAAO0B,KAAAA,GAAAA;YACZ,IAAIA,KAAAA,CAAMC,OAAO,EAAE;gBACjB,MAAMlB,eAAAA,CAAgBiB,MAAMC,OAAO,CAAA;AACrC;YAEA,IAAID,KAAAA,CAAME,IAAI,EAAE;gBACd,MAAMT,YAAAA,CAAaO,MAAME,IAAI,CAAA;AAC/B;YAEA,IAAIF,KAAAA,CAAMtB,MAAM,EAAE;gBAChB,MAAMiB,cAAAA,CAAeK,MAAMtB,MAAM,CAAA;AACnC;;AAGA,YAAA,IAAIsB,MAAMG,QAAQ,IAAIH,KAAMG,CAAAA,QAAQ,KAAK,GAAK,EAAA;gBAC5C,MAAMN,gBAAAA,CAAiBG,MAAMG,QAAQ,CAAA;AACvC;YAEA,OAAO,IAAA;AACT,SAAA;AACF,KAAA;AAEA,IAAA,MAAMC,mBAAsB,GAAA,CAAC3B,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOyB,GAAAA,cAAAA,CAAe3B,OAAOI,SAAS,CAAA;QAExF,OAAOE,WAAAA,CAAMC,IAAI;QAEfqB,oBAAeP,CAAAA,iBAAAA,EAAmBzB;QAElCgC,oBAAe3D,CAAAA,qBAAAA,CAAsBgC,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA;AAEvDiC,QAAAA,gBAAAA,CAAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;;;AAGpB,QAAA,MAAMC,eAAkB,GAAA,OAAOC,IAAMlC,EAAAA,OAAAA,GAAU,EAAE,GAAA;AAC/C,YAAA,IAAImC,WAAQD,IAAO,CAAA,EAAA;gBACjB,OAAOE,OAAAA,CAAQC,GAAG,CAACH,IAAAA,CAAKI,GAAG,CAAC,CAACC,MAAoBN,GAAAA,eAAAA,CAAgBM,MAAQvC,EAAAA,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E;YAEA,MAAM,EAAEwC,OAAO,EAAEjD,MAAAA,EAAQkD,cAAc,EAAE,GAAGC,kBAAkBR,IAAMlC,EAAAA,OAAAA,CAAAA;AAEpE,YAAA,MAAME,eAAkByC,GAAAA,uBAAAA,CAAkBnD,SAASiD,EAAAA,cAAAA,EAAgBD,OAAS,EAAA;AAC1EI,gBAAAA,UAAAA,EAAY,CAACC,IAAAA,GAASA,IAAK5C,CAAAA,MAAM,IAAI;AACvC,aAAA,CAAA;AAEA,YAAA,MAAM6C,uBAA0BC,GAAAA,OAAAA,CAC9B,CAAC9C,MAAAA,GAAW,CAAC+C,QAAM/C,CAAAA,MAAAA,CAAAA,EACnBgD,UAAQC,CAAAA,OAAAA,CAAK,QAAW1D,CAAAA,EAAAA,SAAAA,CAAQ2D,QAAQ,CAACV,gBAAgBW,yBAAkBZ,CAAAA,OAAAA,CAAAA,CAAAA,CAAAA,CAAAA;YAE7E,MAAMa,sBAAAA,GAAyBvC,UAAQZ,CAAAA,eAAAA,CAAAA,IAAoB,CAAC4C,uBAAAA;AAE5D,YAAA,MAAMQ,eAAkB,GAAA;AACtB,gBAAA,GAAGtD,OAAO;gBACVC,MAAQ,EAAA;oBACNE,gBAAkBkD,EAAAA,sBAAAA;oBAClBhD,SAAWH,EAAAA,eAAAA;AACX4C,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAMS,mBAAmBvB,sBAAuBsB,CAAAA,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAiBrB,CAAAA,IAAAA,CAAAA;AAC1B,SAAA;QAEA,OAAOD,eAAAA;AACT,KAAA;IAEA,MAAMS,iBAAAA,GAAoB,CAACR,IAAWlC,EAAAA,OAAAA,GAAAA;AACpC,QAAA,OAAOwD,WAAS,CAAA;AAAEhB,YAAAA,OAAAA,EAASiB,gBAAUhE,KAAOyC,EAAAA,IAAAA,CAAAA;AAAO3C,YAAAA;SAAUS,EAAAA,OAAAA,CAAAA;AAC/D,KAAA;AAEA;;MAGA,MAAM8B,mBAAmB4B,OAAK,CAAA;QAAC,CAAG3E,EAAAA,oBAAAA,CAAqB,MAAM,CAAC;QAAE,CAAGC,EAAAA,oBAAAA,CAAqB,MAAM;AAAE,KAAA,CAAA;AAEhG;;MAGA,MAAMsC,oBAAoB,CAAC,EAAElC,GAAG,EAAEM,MAAM,EAAEL,IAAI,EAAO,GAAA;QACnD,MAAMsE,QAAAA,GAAWC,SAAM,KAAO,EAAA;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAcxE,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAEM,MAAAA,CAAAA;AAEvE,QAAA,IAAIiE,QAAU,EAAA;YACZxE,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;AAEA;;MAGA,MAAMJ,8BAAiC,GAAA,CAAC,EAAEvB,GAAG,EAAE2B,SAAS,EAAErB,MAAM,EAAEL,IAAI,EAAO,GAAA;QAC3E,IAAIK,MAAAA,CAAOmE,GAAG,KAAK,aAAA,IAAiB9C,aAAa,CAAC+C,8BAAAA,CAA0BC,QAAQ,CAAC3E,GAAM,CAAA,EAAA;YACzFD,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;IAEA,MAAMa,cAAAA,GAAiB,CAAC3B,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAM+D,uBAAuBzF,uBAAwBmB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMuE,qBAAqBzF,qBAAsBkB,CAAAA,MAAAA,CAAAA;QAEjD,MAAMwE,4BAAAA,GAA+BC,gBAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,OAAK,CAAA;AAAInE,YAAAA,GAAAA,MAAAA;AAAWhB,YAAAA,GAAAA,gBAAAA;AAAqBiF,YAAAA,GAAAA;AAA6B,SAAA,CAAA;AAC/E,KAAA;IAEA,MAAM9D,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,OAAOmE,OAAK,CAAA;AACPnE,YAAAA,GAAAA,MAAAA;AACAf,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACHL,YAAAA,oBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,OAAO;AACLuF,QAAAA,aAAAA,EAAetC,YAAahC,CAAAA,mBAAAA,CAAAA;AAC5BuE,QAAAA,aAAAA,EAAevC,YAAaJ,CAAAA,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"validate.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/validate.ts"],"sourcesContent":["import { subject as asSubject } from '@casl/ability';\nimport { defaults, omit, isArray, isEmpty, uniq, intersection, getOr, isObject } from 'lodash/fp';\n\nimport {\n  contentTypes,\n  traverseEntity,\n  traverse,\n  validate,\n  async,\n  errors,\n  createModelCache,\n} from '@strapi/utils';\nimport { createPermissionFieldsCache } from './permission-fields';\n\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst { ValidationError } = errors;\nconst { throwPassword, throwDisallowedFields } = validate.visitors;\n\nconst { constants, isScalarAttribute, getNonVisibleAttributes, getWritableAttributes } =\n  contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\n\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nconst throwInvalidKey = ({ key, path }: { key: string; path?: string | null }) => {\n  const msg = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n\n  throw new ValidationError(msg);\n};\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  // Create request-scoped model cache to avoid redundant getModel() calls\n  const modelCache = createModelCache(strapi.getModel.bind(strapi));\n\n  const ctx = {\n    schema,\n    getModel: modelCache.getModel,\n  };\n\n  const createValidateQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: validate relations to admin users in all validators\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const validateFilters = async.pipe(\n      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryFilters(throwPassword, ctx),\n      traverse.traverseQueryFilters(({ key, value, path }) => {\n        if (isObject(value) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateSort = async.pipe(\n      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQuerySort(throwPassword, ctx),\n      traverse.traverseQuerySort(({ key, attribute, value, path }) => {\n        if (!isScalarAttribute(attribute) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateFields = async.pipe(\n      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFields(throwPassword, ctx)\n    );\n\n    const validatePopulate = async.pipe(\n      traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(throwHiddenFields, ctx),\n      traverse.traverseQueryPopulate(throwPassword, ctx)\n    );\n\n    return async (query: any) => {\n      if (query.filters) {\n        await validateFilters(query.filters);\n      }\n\n      if (query.sort) {\n        await validateSort(query.sort);\n      }\n\n      if (query.fields) {\n        await validateFields(query.fields);\n      }\n\n      // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n      if (query.populate && query.populate !== '*') {\n        await validatePopulate(query.populate);\n      }\n\n      return true;\n    };\n  };\n\n  const createValidateInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(throwHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(throwDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapValidate = (createValidateFunction: any) => {\n    const { getPermissionFields } = createPermissionFieldsCache(ability);\n\n    // TODO\n    // @ts-expect-error define the correct return type\n    const wrappedValidate = async (data, options = {}): Promise<unknown> => {\n      if (isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedValidate(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(\n        actionOverride,\n        subject\n      );\n\n      const validateOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const validateFunction = createValidateFunction(validateOptions);\n\n      return validateFunction(data);\n    };\n\n    return wrappedValidate;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({ subject: asSubject(model, data), action }, options);\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const throwHiddenFields = ({ key, schema, path }: any) => {\n    const isHidden = getOr(false, ['config', 'attributes', key, 'hidden'], schema);\n\n    if (isHidden) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const throwDisallowedAdminUserFields = ({ key, attribute, schema, path }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes]);\n  };\n\n  const getQueryFields = (fields = []) => {\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n      PUBLISHED_AT_ATTRIBUTE,\n    ]);\n  };\n\n  return {\n    validateQuery: wrapValidate(createValidateQuery),\n    validateInput: wrapValidate(createValidateInput),\n  };\n};\n"],"names":["ValidationError","errors","throwPassword","throwDisallowedFields","validate","visitors","constants","isScalarAttribute","getNonVisibleAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","throwInvalidKey","key","path","msg","action","ability","model","schema","strapi","getModel","modelCache","createModelCache","bind","ctx","createValidateQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","validateFilters","async","pipe","traverse","traverseQueryFilters","throwDisallowedAdminUserFields","value","isObject","isEmpty","attribute","validateSort","traverseQuerySort","validateFields","traverseQueryFields","validatePopulate","traverseQueryPopulate","throwHiddenFields","query","filters","sort","populate","createValidateInput","getInputFields","traverseEntity","omitCreatorRoles","wrapValidate","createValidateFunction","getPermissionFields","createPermissionFieldsCache","wrappedValidate","data","isArray","Promise","all","map","entity","subject","actionOverride","getDefaultOptions","hasAtLeastOneRegistered","validateOptions","validateFunction","defaults","asSubject","omit","isHidden","getOr","uid","ADMIN_USER_ALLOWED_FIELDS","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","uniq","validateQuery","validateInput"],"mappings":";;;;;;;;AAgBA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,aAAa,EAAEC,qBAAqB,EAAE,GAAGC,eAASC,QAAQ;AAElE,MAAM,EAAEC,SAAS,EAAEC,iBAAiB,EAAEC,uBAAuB,EAAEC,qBAAqB,EAAE,GACpFC,kBAAAA;AACF,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGX,SAAAA;AAEJ,MAAMY,gBAAmB,GAAA;AAAC,IAAA;AAAc,CAAA;AAExC,MAAMC,aAAgB,GAAA;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,MAAMQ,kBAAkB,CAAC,EAAEC,GAAG,EAAEC,IAAI,EAAyC,GAAA;AAC3E,IAAA,MAAMC,GAAMD,GAAAA,IAAAA,IAAQA,IAASD,KAAAA,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAI,CAAA,IAAI,EAAEC,IAAM,CAAA,CAAA,GAAG,CAAC,YAAY,EAAED,GAAK,CAAA,CAAA;AAEzF,IAAA,MAAM,IAAIrB,eAAgBuB,CAAAA,GAAAA,CAAAA;AAC5B,CAAA;AAEA,4BAAe,CAAA,CAAC,EAAEC,MAAM,WAAEC,SAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAOC,CAAAA,QAAQ,CAACH,KAAAA,CAAAA;;AAG/B,IAAA,MAAMI,aAAaC,sBAAiBH,CAAAA,MAAAA,CAAOC,QAAQ,CAACG,IAAI,CAACJ,MAAAA,CAAAA,CAAAA;AAEzD,IAAA,MAAMK,GAAM,GAAA;AACVN,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUC,WAAWD;AACvB,KAAA;AAEA,IAAA,MAAMK,mBAAsB,GAAA,CAACC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOC,GAAAA,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,eAAkBC,GAAAA,WAAAA,CAAMC,IAAI,CAChCC,cAASC,CAAAA,oBAAoB,CAAC1C,qBAAAA,CAAsBkC,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA,EACtEW,cAASC,CAAAA,oBAAoB,CAACC,8BAAgCb,EAAAA,GAAAA,CAAAA,EAC9DW,cAASC,CAAAA,oBAAoB,CAAC3C,aAAAA,EAAe+B,GAC7CW,CAAAA,EAAAA,cAAAA,CAASC,oBAAoB,CAAC,CAAC,EAAExB,GAAG,EAAE0B,KAAK,EAAEzB,IAAI,EAAE,GAAA;YACjD,IAAI0B,WAAAA,CAASD,KAAUE,CAAAA,IAAAA,UAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACrC3B,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,iBAAA,CAAA;AAC9C;SACCjB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMkB,YAAeT,GAAAA,WAAAA,CAAMC,IAAI,CAC7BC,eAASQ,iBAAiB,CAACjD,qBAAsBkC,CAAAA,eAAAA,CAAAA,EAAkBJ,GACnEW,CAAAA,EAAAA,cAAAA,CAASQ,iBAAiB,CAACN,gCAAgCb,GAC3DW,CAAAA,EAAAA,cAAAA,CAASQ,iBAAiB,CAAClD,aAAe+B,EAAAA,GAAAA,CAAAA,EAC1CW,cAASQ,CAAAA,iBAAiB,CAAC,CAAC,EAAE/B,GAAG,EAAE6B,SAAS,EAAEH,KAAK,EAAEzB,IAAI,EAAE,GAAA;AACzD,YAAA,IAAI,CAACf,iBAAAA,CAAkB2C,SAAcD,CAAAA,IAAAA,UAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACnD3B,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,iBAAA,CAAA;AAC9C;SACCjB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMoB,cAAiBX,GAAAA,WAAAA,CAAMC,IAAI,CAC/BC,cAASU,CAAAA,mBAAmB,CAACnD,qBAAAA,CAAsBkC,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA,EACrEW,cAASU,CAAAA,mBAAmB,CAACpD,aAAe+B,EAAAA,GAAAA,CAAAA,CAAAA;QAG9C,MAAMsB,gBAAAA,GAAmBb,YAAMC,IAAI,CACjCC,eAASY,qBAAqB,CAACrD,qBAAsBkC,CAAAA,eAAAA,CAAAA,EAAkBJ,GACvEW,CAAAA,EAAAA,cAAAA,CAASY,qBAAqB,CAACV,8BAAAA,EAAgCb,GAC/DW,CAAAA,EAAAA,cAAAA,CAASY,qBAAqB,CAACC,mBAAmBxB,GAClDW,CAAAA,EAAAA,cAAAA,CAASY,qBAAqB,CAACtD,aAAe+B,EAAAA,GAAAA,CAAAA,CAAAA;AAGhD,QAAA,OAAO,OAAOyB,KAAAA,GAAAA;YACZ,IAAIA,KAAAA,CAAMC,OAAO,EAAE;gBACjB,MAAMlB,eAAAA,CAAgBiB,MAAMC,OAAO,CAAA;AACrC;YAEA,IAAID,KAAAA,CAAME,IAAI,EAAE;gBACd,MAAMT,YAAAA,CAAaO,MAAME,IAAI,CAAA;AAC/B;YAEA,IAAIF,KAAAA,CAAMtB,MAAM,EAAE;gBAChB,MAAMiB,cAAAA,CAAeK,MAAMtB,MAAM,CAAA;AACnC;;AAGA,YAAA,IAAIsB,MAAMG,QAAQ,IAAIH,KAAMG,CAAAA,QAAQ,KAAK,GAAK,EAAA;gBAC5C,MAAMN,gBAAAA,CAAiBG,MAAMG,QAAQ,CAAA;AACvC;YAEA,OAAO,IAAA;AACT,SAAA;AACF,KAAA;AAEA,IAAA,MAAMC,mBAAsB,GAAA,CAAC3B,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOyB,GAAAA,cAAAA,CAAe3B,OAAOI,SAAS,CAAA;QAExF,OAAOE,WAAAA,CAAMC,IAAI;QAEfqB,oBAAeP,CAAAA,iBAAAA,EAAmBxB;QAElC+B,oBAAe7D,CAAAA,qBAAAA,CAAsBkC,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA;AAEvDgC,QAAAA,gBAAAA,CAAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;AACpB,QAAA,MAAM,EAAEC,mBAAmB,EAAE,GAAGC,4CAA4B5C,CAAAA,SAAAA,CAAAA;;;AAI5D,QAAA,MAAM6C,eAAkB,GAAA,OAAOC,IAAMpC,EAAAA,OAAAA,GAAU,EAAE,GAAA;AAC/C,YAAA,IAAIqC,WAAQD,IAAO,CAAA,EAAA;gBACjB,OAAOE,OAAAA,CAAQC,GAAG,CAACH,IAAAA,CAAKI,GAAG,CAAC,CAACC,MAAoBN,GAAAA,eAAAA,CAAgBM,MAAQzC,EAAAA,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E;YAEA,MAAM,EAAE0C,OAAO,EAAErD,MAAAA,EAAQsD,cAAc,EAAE,GAAGC,kBAAkBR,IAAMpC,EAAAA,OAAAA,CAAAA;YAEpE,MAAM,EAAEE,eAAe,EAAE2C,uBAAuB,EAAE1C,gBAAgB,EAAE,GAAG8B,mBAAAA,CACrEU,cACAD,EAAAA,OAAAA,CAAAA;AAGF,YAAA,MAAMI,eAAkB,GAAA;AACtB,gBAAA,GAAG9C,OAAO;gBACVC,MAAQ,EAAA;AACNE,oBAAAA,gBAAAA;oBACAE,SAAWH,EAAAA,eAAAA;AACX2C,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAME,mBAAmBf,sBAAuBc,CAAAA,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAiBX,CAAAA,IAAAA,CAAAA;AAC1B,SAAA;QAEA,OAAOD,eAAAA;AACT,KAAA;IAEA,MAAMS,iBAAAA,GAAoB,CAACR,IAAWpC,EAAAA,OAAAA,GAAAA;AACpC,QAAA,OAAOgD,WAAS,CAAA;AAAEN,YAAAA,OAAAA,EAASO,gBAAU1D,KAAO6C,EAAAA,IAAAA,CAAAA;AAAO/C,YAAAA;SAAUW,EAAAA,OAAAA,CAAAA;AAC/D,KAAA;AAEA;;MAGA,MAAM8B,mBAAmBoB,OAAK,CAAA;QAAC,CAAGrE,EAAAA,oBAAAA,CAAqB,MAAM,CAAC;QAAE,CAAGC,EAAAA,oBAAAA,CAAqB,MAAM;AAAE,KAAA,CAAA;AAEhG;;MAGA,MAAMwC,oBAAoB,CAAC,EAAEpC,GAAG,EAAEM,MAAM,EAAEL,IAAI,EAAO,GAAA;QACnD,MAAMgE,QAAAA,GAAWC,SAAM,KAAO,EAAA;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAclE,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAEM,MAAAA,CAAAA;AAEvE,QAAA,IAAI2D,QAAU,EAAA;YACZlE,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;AAEA;;MAGA,MAAMJ,8BAAiC,GAAA,CAAC,EAAEzB,GAAG,EAAE6B,SAAS,EAAEvB,MAAM,EAAEL,IAAI,EAAO,GAAA;QAC3E,IAAIK,MAAAA,CAAO6D,GAAG,KAAK,aAAA,IAAiBtC,aAAa,CAACuC,8BAAAA,CAA0BC,QAAQ,CAACrE,GAAM,CAAA,EAAA;YACzFD,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;IAEA,MAAMa,cAAAA,GAAiB,CAAC3B,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMuD,uBAAuBnF,uBAAwBmB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMiE,qBAAqBnF,qBAAsBkB,CAAAA,MAAAA,CAAAA;QAEjD,MAAMkE,4BAAAA,GAA+BC,gBAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,OAAK,CAAA;AAAI3D,YAAAA,GAAAA,MAAAA;AAAWlB,YAAAA,GAAAA,gBAAAA;AAAqB2E,YAAAA,GAAAA;AAA6B,SAAA,CAAA;AAC/E,KAAA;IAEA,MAAMtD,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,OAAO2D,OAAK,CAAA;AACP3D,YAAAA,GAAAA,MAAAA;AACAjB,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACHL,YAAAA,oBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,OAAO;AACLiF,QAAAA,aAAAA,EAAe9B,YAAahC,CAAAA,mBAAAA,CAAAA;AAC5B+D,QAAAA,aAAAA,EAAe/B,YAAaJ,CAAAA,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/validate.mjs

@@ -1,7 +1,7 @@
-import { detectSubjectType, subject } from '@casl/ability';
-import { permittedFieldsOf } from '@casl/ability/extra';
-import { omit, isArray, some, isNil, flatMap, prop, isEmpty, defaults, isObject, getOr, intersection, uniq } from 'lodash/fp';
-import { validate, contentTypes, async, traverse, traverseEntity, errors } from '@strapi/utils';
+import { subject } from '@casl/ability';
+import { omit, isArray, defaults, isObject, isEmpty, getOr, intersection, uniq } from 'lodash/fp';
+import { validate, createModelCache, contentTypes, async, traverse, traverseEntity, errors } from '@strapi/utils';
+import { createPermissionFieldsCache } from './permission-fields.mjs';
 import { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user.mjs';
 
 const { ValidationError } = errors;
@@ -21,9 +21,11 @@ const throwInvalidKey = ({ key, path })=>{
 };
 var createValidateHelpers = (({ action, ability, model })=>{
     const schema = strapi.getModel(model);
+    // Create request-scoped model cache to avoid redundant getModel() calls
+    const modelCache = createModelCache(strapi.getModel.bind(strapi));
     const ctx = {
         schema,
-        getModel: strapi.getModel.bind(strapi)
+        getModel: modelCache.getModel
     };
     const createValidateQuery = (options = {})=>{
         const { fields } = options;
@@ -73,6 +75,7 @@ var createValidateHelpers = (({ action, ability, model })=>{
         omitCreatorRoles);
     };
     const wrapValidate = (createValidateFunction)=>{
+        const { getPermissionFields } = createPermissionFieldsCache(ability);
         // TODO
         // @ts-expect-error define the correct return type
         const wrappedValidate = async (data, options = {})=>{
@@ -80,15 +83,11 @@ var createValidateHelpers = (({ action, ability, model })=>{
                 return Promise.all(data.map((entity)=>wrappedValidate(entity, options)));
             }
             const { subject, action: actionOverride } = getDefaultOptions(data, options);
-            const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {
-                fieldsFrom: (rule)=>rule.fields || []
-            });
-            const hasAtLeastOneRegistered = some((fields)=>!isNil(fields), flatMap(prop('fields'), ability.rulesFor(actionOverride, detectSubjectType(subject))));
-            const shouldIncludeAllFields = isEmpty(permittedFields) && !hasAtLeastOneRegistered;
+            const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(actionOverride, subject);
             const validateOptions = {
                 ...options,
                 fields: {
-                    shouldIncludeAll: shouldIncludeAllFields,
+                    shouldIncludeAll,
                     permitted: permittedFields,
                     hasAtLeastOneRegistered
                 }

package/dist/server/server/src/services/permission/permissions-manager/validate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validate.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/validate.ts"],"sourcesContent":["import { subject as asSubject, detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport {\n  defaults,\n  omit,\n  isArray,\n  isEmpty,\n  isNil,\n  flatMap,\n  some,\n  prop,\n  uniq,\n  intersection,\n  getOr,\n  isObject,\n} from 'lodash/fp';\n\nimport { contentTypes, traverseEntity, traverse, validate, async, errors } from '@strapi/utils';\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst { ValidationError } = errors;\nconst { throwPassword, throwDisallowedFields } = validate.visitors;\n\nconst { constants, isScalarAttribute, getNonVisibleAttributes, getWritableAttributes } =\n  contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\n\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nconst throwInvalidKey = ({ key, path }: { key: string; path?: string | null }) => {\n  const msg = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n\n  throw new ValidationError(msg);\n};\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  const ctx = {\n    schema,\n    getModel: strapi.getModel.bind(strapi),\n  };\n\n  const createValidateQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: validate relations to admin users in all validators\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const validateFilters = async.pipe(\n      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryFilters(throwPassword, ctx),\n      traverse.traverseQueryFilters(({ key, value, path }) => {\n        if (isObject(value) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateSort = async.pipe(\n      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQuerySort(throwPassword, ctx),\n      traverse.traverseQuerySort(({ key, attribute, value, path }) => {\n        if (!isScalarAttribute(attribute) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateFields = async.pipe(\n      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFields(throwPassword, ctx)\n    );\n\n    const validatePopulate = async.pipe(\n      traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(throwHiddenFields, ctx),\n      traverse.traverseQueryPopulate(throwPassword, ctx)\n    );\n\n    return async (query: any) => {\n      if (query.filters) {\n        await validateFilters(query.filters);\n      }\n\n      if (query.sort) {\n        await validateSort(query.sort);\n      }\n\n      if (query.fields) {\n        await validateFields(query.fields);\n      }\n\n      // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n      if (query.populate && query.populate !== '*') {\n        await validatePopulate(query.populate);\n      }\n\n      return true;\n    };\n  };\n\n  const createValidateInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(throwHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(throwDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapValidate = (createValidateFunction: any) => {\n    // TODO\n    // @ts-expect-error define the correct return type\n    const wrappedValidate = async (data, options = {}): Promise<unknown> => {\n      if (isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedValidate(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = some(\n        (fields) => !isNil(fields),\n        flatMap(prop('fields'), ability.rulesFor(actionOverride, detectSubjectType(subject)))\n      );\n      const shouldIncludeAllFields = isEmpty(permittedFields) && !hasAtLeastOneRegistered;\n\n      const validateOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll: shouldIncludeAllFields,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const validateFunction = createValidateFunction(validateOptions);\n\n      return validateFunction(data);\n    };\n\n    return wrappedValidate;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({ subject: asSubject(model, data), action }, options);\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const throwHiddenFields = ({ key, schema, path }: any) => {\n    const isHidden = getOr(false, ['config', 'attributes', key, 'hidden'], schema);\n\n    if (isHidden) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const throwDisallowedAdminUserFields = ({ key, attribute, schema, path }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes]);\n  };\n\n  const getQueryFields = (fields = []) => {\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n      PUBLISHED_AT_ATTRIBUTE,\n    ]);\n  };\n\n  return {\n    validateQuery: wrapValidate(createValidateQuery),\n    validateInput: wrapValidate(createValidateInput),\n  };\n};\n"],"names":["ValidationError","errors","throwPassword","throwDisallowedFields","validate","visitors","constants","isScalarAttribute","getNonVisibleAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","throwInvalidKey","key","path","msg","action","ability","model","schema","strapi","getModel","ctx","bind","createValidateQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","validateFilters","async","pipe","traverse","traverseQueryFilters","throwDisallowedAdminUserFields","value","isObject","isEmpty","attribute","validateSort","traverseQuerySort","validateFields","traverseQueryFields","validatePopulate","traverseQueryPopulate","throwHiddenFields","query","filters","sort","populate","createValidateInput","getInputFields","traverseEntity","omitCreatorRoles","wrapValidate","createValidateFunction","wrappedValidate","data","isArray","Promise","all","map","entity","subject","actionOverride","getDefaultOptions","permittedFieldsOf","fieldsFrom","rule","hasAtLeastOneRegistered","some","isNil","flatMap","prop","rulesFor","detectSubjectType","shouldIncludeAllFields","validateOptions","validateFunction","defaults","asSubject","omit","isHidden","getOr","uid","ADMIN_USER_ALLOWED_FIELDS","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","uniq","validateQuery","validateInput"],"mappings":";;;;;;AAoBA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,aAAa,EAAEC,qBAAqB,EAAE,GAAGC,SAASC,QAAQ;AAElE,MAAM,EAAEC,SAAS,EAAEC,iBAAiB,EAAEC,uBAAuB,EAAEC,qBAAqB,EAAE,GACpFC,YAAAA;AACF,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGX,SAAAA;AAEJ,MAAMY,gBAAmB,GAAA;AAAC,IAAA;AAAc,CAAA;AAExC,MAAMC,aAAgB,GAAA;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,MAAMQ,kBAAkB,CAAC,EAAEC,GAAG,EAAEC,IAAI,EAAyC,GAAA;AAC3E,IAAA,MAAMC,GAAMD,GAAAA,IAAAA,IAAQA,IAASD,KAAAA,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAI,CAAA,IAAI,EAAEC,IAAM,CAAA,CAAA,GAAG,CAAC,YAAY,EAAED,GAAK,CAAA,CAAA;AAEzF,IAAA,MAAM,IAAIrB,eAAgBuB,CAAAA,GAAAA,CAAAA;AAC5B,CAAA;AAEA,4BAAe,CAAA,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAOC,CAAAA,QAAQ,CAACH,KAAAA,CAAAA;AAE/B,IAAA,MAAMI,GAAM,GAAA;AACVH,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUD,MAAOC,CAAAA,QAAQ,CAACE,IAAI,CAACH,MAAAA;AACjC,KAAA;AAEA,IAAA,MAAMI,mBAAsB,GAAA,CAACC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOC,GAAAA,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,eAAkBC,GAAAA,KAAAA,CAAMC,IAAI,CAChCC,QAASC,CAAAA,oBAAoB,CAACxC,qBAAAA,CAAsBgC,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA,EACtEY,QAASC,CAAAA,oBAAoB,CAACC,8BAAgCd,EAAAA,GAAAA,CAAAA,EAC9DY,QAASC,CAAAA,oBAAoB,CAACzC,aAAAA,EAAe4B,GAC7CY,CAAAA,EAAAA,QAAAA,CAASC,oBAAoB,CAAC,CAAC,EAAEtB,GAAG,EAAEwB,KAAK,EAAEvB,IAAI,EAAE,GAAA;YACjD,IAAIwB,QAAAA,CAASD,KAAUE,CAAAA,IAAAA,OAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACrCzB,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,iBAAA,CAAA;AAC9C;SACClB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMmB,YAAeT,GAAAA,KAAAA,CAAMC,IAAI,CAC7BC,SAASQ,iBAAiB,CAAC/C,qBAAsBgC,CAAAA,eAAAA,CAAAA,EAAkBL,GACnEY,CAAAA,EAAAA,QAAAA,CAASQ,iBAAiB,CAACN,gCAAgCd,GAC3DY,CAAAA,EAAAA,QAAAA,CAASQ,iBAAiB,CAAChD,aAAe4B,EAAAA,GAAAA,CAAAA,EAC1CY,QAASQ,CAAAA,iBAAiB,CAAC,CAAC,EAAE7B,GAAG,EAAE2B,SAAS,EAAEH,KAAK,EAAEvB,IAAI,EAAE,GAAA;AACzD,YAAA,IAAI,CAACf,iBAAAA,CAAkByC,SAAcD,CAAAA,IAAAA,OAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACnDzB,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,iBAAA,CAAA;AAC9C;SACClB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMqB,cAAiBX,GAAAA,KAAAA,CAAMC,IAAI,CAC/BC,QAASU,CAAAA,mBAAmB,CAACjD,qBAAAA,CAAsBgC,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA,EACrEY,QAASU,CAAAA,mBAAmB,CAAClD,aAAe4B,EAAAA,GAAAA,CAAAA,CAAAA;QAG9C,MAAMuB,gBAAAA,GAAmBb,MAAMC,IAAI,CACjCC,SAASY,qBAAqB,CAACnD,qBAAsBgC,CAAAA,eAAAA,CAAAA,EAAkBL,GACvEY,CAAAA,EAAAA,QAAAA,CAASY,qBAAqB,CAACV,8BAAAA,EAAgCd,GAC/DY,CAAAA,EAAAA,QAAAA,CAASY,qBAAqB,CAACC,mBAAmBzB,GAClDY,CAAAA,EAAAA,QAAAA,CAASY,qBAAqB,CAACpD,aAAe4B,EAAAA,GAAAA,CAAAA,CAAAA;AAGhD,QAAA,OAAO,OAAO0B,KAAAA,GAAAA;YACZ,IAAIA,KAAAA,CAAMC,OAAO,EAAE;gBACjB,MAAMlB,eAAAA,CAAgBiB,MAAMC,OAAO,CAAA;AACrC;YAEA,IAAID,KAAAA,CAAME,IAAI,EAAE;gBACd,MAAMT,YAAAA,CAAaO,MAAME,IAAI,CAAA;AAC/B;YAEA,IAAIF,KAAAA,CAAMtB,MAAM,EAAE;gBAChB,MAAMiB,cAAAA,CAAeK,MAAMtB,MAAM,CAAA;AACnC;;AAGA,YAAA,IAAIsB,MAAMG,QAAQ,IAAIH,KAAMG,CAAAA,QAAQ,KAAK,GAAK,EAAA;gBAC5C,MAAMN,gBAAAA,CAAiBG,MAAMG,QAAQ,CAAA;AACvC;YAEA,OAAO,IAAA;AACT,SAAA;AACF,KAAA;AAEA,IAAA,MAAMC,mBAAsB,GAAA,CAAC3B,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOyB,GAAAA,cAAAA,CAAe3B,OAAOI,SAAS,CAAA;QAExF,OAAOE,KAAAA,CAAMC,IAAI;QAEfqB,cAAeP,CAAAA,iBAAAA,EAAmBzB;QAElCgC,cAAe3D,CAAAA,qBAAAA,CAAsBgC,eAAkBL,CAAAA,EAAAA,GAAAA,CAAAA;AAEvDiC,QAAAA,gBAAAA,CAAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;;;AAGpB,QAAA,MAAMC,eAAkB,GAAA,OAAOC,IAAMlC,EAAAA,OAAAA,GAAU,EAAE,GAAA;AAC/C,YAAA,IAAImC,QAAQD,IAAO,CAAA,EAAA;gBACjB,OAAOE,OAAAA,CAAQC,GAAG,CAACH,IAAAA,CAAKI,GAAG,CAAC,CAACC,MAAoBN,GAAAA,eAAAA,CAAgBM,MAAQvC,EAAAA,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E;YAEA,MAAM,EAAEwC,OAAO,EAAEjD,MAAAA,EAAQkD,cAAc,EAAE,GAAGC,kBAAkBR,IAAMlC,EAAAA,OAAAA,CAAAA;AAEpE,YAAA,MAAME,eAAkByC,GAAAA,iBAAAA,CAAkBnD,OAASiD,EAAAA,cAAAA,EAAgBD,OAAS,EAAA;AAC1EI,gBAAAA,UAAAA,EAAY,CAACC,IAAAA,GAASA,IAAK5C,CAAAA,MAAM,IAAI;AACvC,aAAA,CAAA;AAEA,YAAA,MAAM6C,uBAA0BC,GAAAA,IAAAA,CAC9B,CAAC9C,MAAAA,GAAW,CAAC+C,KAAM/C,CAAAA,MAAAA,CAAAA,EACnBgD,OAAQC,CAAAA,IAAAA,CAAK,QAAW1D,CAAAA,EAAAA,OAAAA,CAAQ2D,QAAQ,CAACV,gBAAgBW,iBAAkBZ,CAAAA,OAAAA,CAAAA,CAAAA,CAAAA,CAAAA;YAE7E,MAAMa,sBAAAA,GAAyBvC,OAAQZ,CAAAA,eAAAA,CAAAA,IAAoB,CAAC4C,uBAAAA;AAE5D,YAAA,MAAMQ,eAAkB,GAAA;AACtB,gBAAA,GAAGtD,OAAO;gBACVC,MAAQ,EAAA;oBACNE,gBAAkBkD,EAAAA,sBAAAA;oBAClBhD,SAAWH,EAAAA,eAAAA;AACX4C,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAMS,mBAAmBvB,sBAAuBsB,CAAAA,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAiBrB,CAAAA,IAAAA,CAAAA;AAC1B,SAAA;QAEA,OAAOD,eAAAA;AACT,KAAA;IAEA,MAAMS,iBAAAA,GAAoB,CAACR,IAAWlC,EAAAA,OAAAA,GAAAA;AACpC,QAAA,OAAOwD,QAAS,CAAA;AAAEhB,YAAAA,OAAAA,EAASiB,QAAUhE,KAAOyC,EAAAA,IAAAA,CAAAA;AAAO3C,YAAAA;SAAUS,EAAAA,OAAAA,CAAAA;AAC/D,KAAA;AAEA;;MAGA,MAAM8B,mBAAmB4B,IAAK,CAAA;QAAC,CAAG3E,EAAAA,oBAAAA,CAAqB,MAAM,CAAC;QAAE,CAAGC,EAAAA,oBAAAA,CAAqB,MAAM;AAAE,KAAA,CAAA;AAEhG;;MAGA,MAAMsC,oBAAoB,CAAC,EAAElC,GAAG,EAAEM,MAAM,EAAEL,IAAI,EAAO,GAAA;QACnD,MAAMsE,QAAAA,GAAWC,MAAM,KAAO,EAAA;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAcxE,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAEM,MAAAA,CAAAA;AAEvE,QAAA,IAAIiE,QAAU,EAAA;YACZxE,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;AAEA;;MAGA,MAAMJ,8BAAiC,GAAA,CAAC,EAAEvB,GAAG,EAAE2B,SAAS,EAAErB,MAAM,EAAEL,IAAI,EAAO,GAAA;QAC3E,IAAIK,MAAAA,CAAOmE,GAAG,KAAK,aAAA,IAAiB9C,aAAa,CAAC+C,yBAAAA,CAA0BC,QAAQ,CAAC3E,GAAM,CAAA,EAAA;YACzFD,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK0B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;IAEA,MAAMa,cAAAA,GAAiB,CAAC3B,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAM+D,uBAAuBzF,uBAAwBmB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMuE,qBAAqBzF,qBAAsBkB,CAAAA,MAAAA,CAAAA;QAEjD,MAAMwE,4BAAAA,GAA+BC,aAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,IAAK,CAAA;AAAInE,YAAAA,GAAAA,MAAAA;AAAWhB,YAAAA,GAAAA,gBAAAA;AAAqBiF,YAAAA,GAAAA;AAA6B,SAAA,CAAA;AAC/E,KAAA;IAEA,MAAM9D,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,OAAOmE,IAAK,CAAA;AACPnE,YAAAA,GAAAA,MAAAA;AACAf,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACHL,YAAAA,oBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,OAAO;AACLuF,QAAAA,aAAAA,EAAetC,YAAahC,CAAAA,mBAAAA,CAAAA;AAC5BuE,QAAAA,aAAAA,EAAevC,YAAaJ,CAAAA,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"validate.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/validate.ts"],"sourcesContent":["import { subject as asSubject } from '@casl/ability';\nimport { defaults, omit, isArray, isEmpty, uniq, intersection, getOr, isObject } from 'lodash/fp';\n\nimport {\n  contentTypes,\n  traverseEntity,\n  traverse,\n  validate,\n  async,\n  errors,\n  createModelCache,\n} from '@strapi/utils';\nimport { createPermissionFieldsCache } from './permission-fields';\n\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst { ValidationError } = errors;\nconst { throwPassword, throwDisallowedFields } = validate.visitors;\n\nconst { constants, isScalarAttribute, getNonVisibleAttributes, getWritableAttributes } =\n  contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\n\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nconst throwInvalidKey = ({ key, path }: { key: string; path?: string | null }) => {\n  const msg = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n\n  throw new ValidationError(msg);\n};\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  // Create request-scoped model cache to avoid redundant getModel() calls\n  const modelCache = createModelCache(strapi.getModel.bind(strapi));\n\n  const ctx = {\n    schema,\n    getModel: modelCache.getModel,\n  };\n\n  const createValidateQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: validate relations to admin users in all validators\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const validateFilters = async.pipe(\n      traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryFilters(throwPassword, ctx),\n      traverse.traverseQueryFilters(({ key, value, path }) => {\n        if (isObject(value) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateSort = async.pipe(\n      traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQuerySort(throwPassword, ctx),\n      traverse.traverseQuerySort(({ key, attribute, value, path }) => {\n        if (!isScalarAttribute(attribute) && isEmpty(value)) {\n          throwInvalidKey({ key, path: path.attribute });\n        }\n      }, ctx)\n    );\n\n    const validateFields = async.pipe(\n      traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryFields(throwPassword, ctx)\n    );\n\n    const validatePopulate = async.pipe(\n      traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(throwHiddenFields, ctx),\n      traverse.traverseQueryPopulate(throwPassword, ctx)\n    );\n\n    return async (query: any) => {\n      if (query.filters) {\n        await validateFilters(query.filters);\n      }\n\n      if (query.sort) {\n        await validateSort(query.sort);\n      }\n\n      if (query.fields) {\n        await validateFields(query.fields);\n      }\n\n      // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n      if (query.populate && query.populate !== '*') {\n        await validatePopulate(query.populate);\n      }\n\n      return true;\n    };\n  };\n\n  const createValidateInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(throwHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(throwDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapValidate = (createValidateFunction: any) => {\n    const { getPermissionFields } = createPermissionFieldsCache(ability);\n\n    // TODO\n    // @ts-expect-error define the correct return type\n    const wrappedValidate = async (data, options = {}): Promise<unknown> => {\n      if (isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedValidate(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(\n        actionOverride,\n        subject\n      );\n\n      const validateOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const validateFunction = createValidateFunction(validateOptions);\n\n      return validateFunction(data);\n    };\n\n    return wrappedValidate;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({ subject: asSubject(model, data), action }, options);\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const throwHiddenFields = ({ key, schema, path }: any) => {\n    const isHidden = getOr(false, ['config', 'attributes', key, 'hidden'], schema);\n\n    if (isHidden) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const throwDisallowedAdminUserFields = ({ key, attribute, schema, path }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      throwInvalidKey({ key, path: path.attribute });\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes]);\n  };\n\n  const getQueryFields = (fields = []) => {\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n      PUBLISHED_AT_ATTRIBUTE,\n    ]);\n  };\n\n  return {\n    validateQuery: wrapValidate(createValidateQuery),\n    validateInput: wrapValidate(createValidateInput),\n  };\n};\n"],"names":["ValidationError","errors","throwPassword","throwDisallowedFields","validate","visitors","constants","isScalarAttribute","getNonVisibleAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","throwInvalidKey","key","path","msg","action","ability","model","schema","strapi","getModel","modelCache","createModelCache","bind","ctx","createValidateQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","validateFilters","async","pipe","traverse","traverseQueryFilters","throwDisallowedAdminUserFields","value","isObject","isEmpty","attribute","validateSort","traverseQuerySort","validateFields","traverseQueryFields","validatePopulate","traverseQueryPopulate","throwHiddenFields","query","filters","sort","populate","createValidateInput","getInputFields","traverseEntity","omitCreatorRoles","wrapValidate","createValidateFunction","getPermissionFields","createPermissionFieldsCache","wrappedValidate","data","isArray","Promise","all","map","entity","subject","actionOverride","getDefaultOptions","hasAtLeastOneRegistered","validateOptions","validateFunction","defaults","asSubject","omit","isHidden","getOr","uid","ADMIN_USER_ALLOWED_FIELDS","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","uniq","validateQuery","validateInput"],"mappings":";;;;;;AAgBA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,aAAa,EAAEC,qBAAqB,EAAE,GAAGC,SAASC,QAAQ;AAElE,MAAM,EAAEC,SAAS,EAAEC,iBAAiB,EAAEC,uBAAuB,EAAEC,qBAAqB,EAAE,GACpFC,YAAAA;AACF,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGX,SAAAA;AAEJ,MAAMY,gBAAmB,GAAA;AAAC,IAAA;AAAc,CAAA;AAExC,MAAMC,aAAgB,GAAA;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,MAAMQ,kBAAkB,CAAC,EAAEC,GAAG,EAAEC,IAAI,EAAyC,GAAA;AAC3E,IAAA,MAAMC,GAAMD,GAAAA,IAAAA,IAAQA,IAASD,KAAAA,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAI,CAAA,IAAI,EAAEC,IAAM,CAAA,CAAA,GAAG,CAAC,YAAY,EAAED,GAAK,CAAA,CAAA;AAEzF,IAAA,MAAM,IAAIrB,eAAgBuB,CAAAA,GAAAA,CAAAA;AAC5B,CAAA;AAEA,4BAAe,CAAA,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAOC,CAAAA,QAAQ,CAACH,KAAAA,CAAAA;;AAG/B,IAAA,MAAMI,aAAaC,gBAAiBH,CAAAA,MAAAA,CAAOC,QAAQ,CAACG,IAAI,CAACJ,MAAAA,CAAAA,CAAAA;AAEzD,IAAA,MAAMK,GAAM,GAAA;AACVN,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUC,WAAWD;AACvB,KAAA;AAEA,IAAA,MAAMK,mBAAsB,GAAA,CAACC,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOC,GAAAA,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,eAAkBC,GAAAA,KAAAA,CAAMC,IAAI,CAChCC,QAASC,CAAAA,oBAAoB,CAAC1C,qBAAAA,CAAsBkC,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA,EACtEW,QAASC,CAAAA,oBAAoB,CAACC,8BAAgCb,EAAAA,GAAAA,CAAAA,EAC9DW,QAASC,CAAAA,oBAAoB,CAAC3C,aAAAA,EAAe+B,GAC7CW,CAAAA,EAAAA,QAAAA,CAASC,oBAAoB,CAAC,CAAC,EAAExB,GAAG,EAAE0B,KAAK,EAAEzB,IAAI,EAAE,GAAA;YACjD,IAAI0B,QAAAA,CAASD,KAAUE,CAAAA,IAAAA,OAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACrC3B,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,iBAAA,CAAA;AAC9C;SACCjB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMkB,YAAeT,GAAAA,KAAAA,CAAMC,IAAI,CAC7BC,SAASQ,iBAAiB,CAACjD,qBAAsBkC,CAAAA,eAAAA,CAAAA,EAAkBJ,GACnEW,CAAAA,EAAAA,QAAAA,CAASQ,iBAAiB,CAACN,gCAAgCb,GAC3DW,CAAAA,EAAAA,QAAAA,CAASQ,iBAAiB,CAAClD,aAAe+B,EAAAA,GAAAA,CAAAA,EAC1CW,QAASQ,CAAAA,iBAAiB,CAAC,CAAC,EAAE/B,GAAG,EAAE6B,SAAS,EAAEH,KAAK,EAAEzB,IAAI,EAAE,GAAA;AACzD,YAAA,IAAI,CAACf,iBAAAA,CAAkB2C,SAAcD,CAAAA,IAAAA,OAAAA,CAAQF,KAAQ,CAAA,EAAA;gBACnD3B,eAAgB,CAAA;AAAEC,oBAAAA,GAAAA;AAAKC,oBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,iBAAA,CAAA;AAC9C;SACCjB,EAAAA,GAAAA,CAAAA,CAAAA;AAGL,QAAA,MAAMoB,cAAiBX,GAAAA,KAAAA,CAAMC,IAAI,CAC/BC,QAASU,CAAAA,mBAAmB,CAACnD,qBAAAA,CAAsBkC,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA,EACrEW,QAASU,CAAAA,mBAAmB,CAACpD,aAAe+B,EAAAA,GAAAA,CAAAA,CAAAA;QAG9C,MAAMsB,gBAAAA,GAAmBb,MAAMC,IAAI,CACjCC,SAASY,qBAAqB,CAACrD,qBAAsBkC,CAAAA,eAAAA,CAAAA,EAAkBJ,GACvEW,CAAAA,EAAAA,QAAAA,CAASY,qBAAqB,CAACV,8BAAAA,EAAgCb,GAC/DW,CAAAA,EAAAA,QAAAA,CAASY,qBAAqB,CAACC,mBAAmBxB,GAClDW,CAAAA,EAAAA,QAAAA,CAASY,qBAAqB,CAACtD,aAAe+B,EAAAA,GAAAA,CAAAA,CAAAA;AAGhD,QAAA,OAAO,OAAOyB,KAAAA,GAAAA;YACZ,IAAIA,KAAAA,CAAMC,OAAO,EAAE;gBACjB,MAAMlB,eAAAA,CAAgBiB,MAAMC,OAAO,CAAA;AACrC;YAEA,IAAID,KAAAA,CAAME,IAAI,EAAE;gBACd,MAAMT,YAAAA,CAAaO,MAAME,IAAI,CAAA;AAC/B;YAEA,IAAIF,KAAAA,CAAMtB,MAAM,EAAE;gBAChB,MAAMiB,cAAAA,CAAeK,MAAMtB,MAAM,CAAA;AACnC;;AAGA,YAAA,IAAIsB,MAAMG,QAAQ,IAAIH,KAAMG,CAAAA,QAAQ,KAAK,GAAK,EAAA;gBAC5C,MAAMN,gBAAAA,CAAiBG,MAAMG,QAAQ,CAAA;AACvC;YAEA,OAAO,IAAA;AACT,SAAA;AACF,KAAA;AAEA,IAAA,MAAMC,mBAAsB,GAAA,CAAC3B,OAAU,GAAA,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAOE,CAAAA,gBAAgB,GAAG,IAAOyB,GAAAA,cAAAA,CAAe3B,OAAOI,SAAS,CAAA;QAExF,OAAOE,KAAAA,CAAMC,IAAI;QAEfqB,cAAeP,CAAAA,iBAAAA,EAAmBxB;QAElC+B,cAAe7D,CAAAA,qBAAAA,CAAsBkC,eAAkBJ,CAAAA,EAAAA,GAAAA,CAAAA;AAEvDgC,QAAAA,gBAAAA,CAAAA;AAEJ,KAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;AACpB,QAAA,MAAM,EAAEC,mBAAmB,EAAE,GAAGC,2BAA4B5C,CAAAA,OAAAA,CAAAA;;;AAI5D,QAAA,MAAM6C,eAAkB,GAAA,OAAOC,IAAMpC,EAAAA,OAAAA,GAAU,EAAE,GAAA;AAC/C,YAAA,IAAIqC,QAAQD,IAAO,CAAA,EAAA;gBACjB,OAAOE,OAAAA,CAAQC,GAAG,CAACH,IAAAA,CAAKI,GAAG,CAAC,CAACC,MAAoBN,GAAAA,eAAAA,CAAgBM,MAAQzC,EAAAA,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E;YAEA,MAAM,EAAE0C,OAAO,EAAErD,MAAAA,EAAQsD,cAAc,EAAE,GAAGC,kBAAkBR,IAAMpC,EAAAA,OAAAA,CAAAA;YAEpE,MAAM,EAAEE,eAAe,EAAE2C,uBAAuB,EAAE1C,gBAAgB,EAAE,GAAG8B,mBAAAA,CACrEU,cACAD,EAAAA,OAAAA,CAAAA;AAGF,YAAA,MAAMI,eAAkB,GAAA;AACtB,gBAAA,GAAG9C,OAAO;gBACVC,MAAQ,EAAA;AACNE,oBAAAA,gBAAAA;oBACAE,SAAWH,EAAAA,eAAAA;AACX2C,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAME,mBAAmBf,sBAAuBc,CAAAA,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAiBX,CAAAA,IAAAA,CAAAA;AAC1B,SAAA;QAEA,OAAOD,eAAAA;AACT,KAAA;IAEA,MAAMS,iBAAAA,GAAoB,CAACR,IAAWpC,EAAAA,OAAAA,GAAAA;AACpC,QAAA,OAAOgD,QAAS,CAAA;AAAEN,YAAAA,OAAAA,EAASO,QAAU1D,KAAO6C,EAAAA,IAAAA,CAAAA;AAAO/C,YAAAA;SAAUW,EAAAA,OAAAA,CAAAA;AAC/D,KAAA;AAEA;;MAGA,MAAM8B,mBAAmBoB,IAAK,CAAA;QAAC,CAAGrE,EAAAA,oBAAAA,CAAqB,MAAM,CAAC;QAAE,CAAGC,EAAAA,oBAAAA,CAAqB,MAAM;AAAE,KAAA,CAAA;AAEhG;;MAGA,MAAMwC,oBAAoB,CAAC,EAAEpC,GAAG,EAAEM,MAAM,EAAEL,IAAI,EAAO,GAAA;QACnD,MAAMgE,QAAAA,GAAWC,MAAM,KAAO,EAAA;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAclE,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAEM,MAAAA,CAAAA;AAEvE,QAAA,IAAI2D,QAAU,EAAA;YACZlE,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;AAEA;;MAGA,MAAMJ,8BAAiC,GAAA,CAAC,EAAEzB,GAAG,EAAE6B,SAAS,EAAEvB,MAAM,EAAEL,IAAI,EAAO,GAAA;QAC3E,IAAIK,MAAAA,CAAO6D,GAAG,KAAK,aAAA,IAAiBtC,aAAa,CAACuC,yBAAAA,CAA0BC,QAAQ,CAACrE,GAAM,CAAA,EAAA;YACzFD,eAAgB,CAAA;AAAEC,gBAAAA,GAAAA;AAAKC,gBAAAA,IAAAA,EAAMA,KAAK4B;AAAU,aAAA,CAAA;AAC9C;AACF,KAAA;IAEA,MAAMa,cAAAA,GAAiB,CAAC3B,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMuD,uBAAuBnF,uBAAwBmB,CAAAA,MAAAA,CAAAA;AACrD,QAAA,MAAMiE,qBAAqBnF,qBAAsBkB,CAAAA,MAAAA,CAAAA;QAEjD,MAAMkE,4BAAAA,GAA+BC,aAAaH,oBAAsBC,EAAAA,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,IAAK,CAAA;AAAI3D,YAAAA,GAAAA,MAAAA;AAAWlB,YAAAA,GAAAA,gBAAAA;AAAqB2E,YAAAA,GAAAA;AAA6B,SAAA,CAAA;AAC/E,KAAA;IAEA,MAAMtD,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,OAAO2D,IAAK,CAAA;AACP3D,YAAAA,GAAAA,MAAAA;AACAjB,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACHL,YAAAA,oBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,KAAA;IAEA,OAAO;AACLiF,QAAAA,aAAAA,EAAe9B,YAAahC,CAAAA,mBAAAA,CAAAA;AAC5B+D,QAAAA,aAAAA,EAAe/B,YAAaJ,CAAAA,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}

package/dist/server/src/controllers/admin.d.ts

@@ -29,7 +29,6 @@ declare const _default: {
             useTypescriptOnServer: any;
             useTypescriptOnAdmin: any;
             isHostedOnStrapiCloud: boolean;
-            aiLicenseKey: string | undefined;
             numberOfAllContentTypes: number;
             numberOfComponents: number;
             numberOfDynamicZones: number;

package/dist/server/src/controllers/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAgBnC,OAAO,KAAK,EAEV,kBAAkB,EAMnB,MAAM,iCAAiC,CAAC;AAIzC;;GAEG;;;;;;;;;;;;;;;;;;;;;+BA2CgC,OAAO;6BAmBT,OAAO;;;;;;;;;;;;;;;;;;;;;;;iBA+DnB,OAAO;;;;2BAmCG,OAAO;;;;;;;AA/JtC,wBAyKE"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAgBnC,OAAO,KAAK,EAEV,kBAAkB,EAMnB,MAAM,iCAAiC,CAAC;AAIzC;;GAEG;;;;;;;;;;;;;;;;;;;;;+BA2CgC,OAAO;6BAmBT,OAAO;;;;;;;;;;;;;;;;;;;;;;iBA6DnB,OAAO;;;;2BAmCG,OAAO;;;;;;;AA7JtC,wBAuKE"}

package/dist/server/src/controllers/index.d.ts

@@ -26,7 +26,6 @@ declare const _default: {
                 useTypescriptOnServer: any;
                 useTypescriptOnAdmin: any;
                 isHostedOnStrapiCloud: boolean;
-                aiLicenseKey: string | undefined;
                 numberOfAllContentTypes: number;
                 numberOfComponents: number;
                 numberOfDynamicZones: number;

package/dist/server/src/controllers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,wBAYE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,wBAYE"}

package/dist/server/src/index.d.ts

@@ -247,7 +247,6 @@ declare let admin: {
                     useTypescriptOnServer: any;
                     useTypescriptOnAdmin: any;
                     isHostedOnStrapiCloud: boolean;
-                    aiLicenseKey: string | undefined;
                     numberOfAllContentTypes: number;
                     numberOfComponents: number;
                     numberOfDynamicZones: number;

package/dist/server/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/src/index.ts"],"names":[],"mappings":";AAeA,QAAA,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWR,CAAC;AAUF,eAAe,KAAK,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/src/index.ts"],"names":[],"mappings":";AAeA,QAAA,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWR,CAAC;AAUF,eAAe,KAAK,CAAC"}

package/dist/server/src/services/permission/permissions-manager/permission-fields.d.ts

@@ -0,0 +1,21 @@
+import type { Ability } from '@casl/ability';
+export interface PermissionFieldsResult {
+    permittedFields: string[];
+    hasAtLeastOneRegistered: boolean;
+    shouldIncludeAll: boolean;
+}
+/**
+ * Creates a cached permission fields calculator for a given CASL ability.
+ *
+ * The cache stores permission field calculations per action+subjectType combination.
+ * Results are only cached when rules have no entity-specific conditions, as those
+ * must be computed per entity.
+ *
+ * @param ability - The CASL ability instance to use for permission checks
+ * @returns Object with getPermissionFields function and cache
+ */
+export declare const createPermissionFieldsCache: (ability: Ability) => {
+    getPermissionFields: (actionOverride: string, subject: any) => PermissionFieldsResult;
+    clearCache: () => void;
+};
+//# sourceMappingURL=permission-fields.d.ts.map

package/dist/server/src/services/permission/permissions-manager/permission-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-fields.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uBAAuB,EAAE,OAAO,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,YAAa,OAAO;0CAGb,MAAM,WAAW,GAAG,KAAG,sBAAsB;;CA6C3F,CAAC"}

package/dist/server/src/services/permission/permissions-manager/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/permissions-manager/sanitize.ts"],"names":[],"mappings":"qDAgD4C,GAAG;2BAqHN,OAAO;0BAAP,OAAO;0BAAP,OAAO;;AArHhD,wBAsPE"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/permissions-manager/sanitize.ts"],"names":[],"mappings":"qDAmD4C,GAAG;2BA0HN,OAAO;0BAAP,OAAO;0BAAP,OAAO;;AA1HhD,wBAsPE"}

package/dist/server/src/services/permission/permissions-manager/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/permissions-manager/validate.ts"],"names":[],"mappings":"qDA6C4C,GAAG;gDAwFS,QAAQ,OAAO,CAAC;gDAAhB,QAAQ,OAAO,CAAC;;AAxFxE,wBA+KE"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/permissions-manager/validate.ts"],"names":[],"mappings":"qDAyC4C,GAAG;gDA6FS,QAAQ,OAAO,CAAC;gDAAhB,QAAQ,OAAO,CAAC;;AA7FxE,wBA+KE"}

package/dist/shared/contracts/admin.d.ts

@@ -97,7 +97,6 @@ export declare namespace TelemetryProperties {
             useTypescriptOnServer: boolean;
             useTypescriptOnAdmin: boolean;
             isHostedOnStrapiCloud: boolean;
-            aiLicenseKey?: string;
             numberOfAllContentTypes: number;
             numberOfComponents: number;
             numberOfDynamicZones: number;

package/dist/shared/contracts/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../shared/contracts/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;YACrB,QAAQ,EAAE,OAAO,CAAC;YAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;YACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;SACzB,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,kBAAkB,CAAC;IAC1C,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,qBAAqB,CAAC;IAC7C,UAAiB,OAAO;QACtB,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;YACtB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;SACvB,CAAC;QACF,KAAK,EAAE,EAAE,CAAC;QACV,KAAK,EAAE;YACL,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;YACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;SACxB,CAAC;KACH;IACD,UAAiB,QAAQ;QACvB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KAC7D;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,kBAAkB,EAAE,MAAM,CAAC;YAC3B,UAAU,EAAE,OAAO,CAAC;YACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;YAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YACzB,WAAW,EAAE,MAAM,CAAC;YACpB,gBAAgB,EAAE,OAAO,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC;SAClB,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,mBAAmB,CAAC;IAC3C,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,qBAAqB,EAAE,OAAO,CAAC;YAC/B,oBAAoB,EAAE,OAAO,CAAC;YAC9B,qBAAqB,EAAE,OAAO,CAAC;YAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,uBAAuB,EAAE,MAAM,CAAC;YAChC,kBAAkB,EAAE,MAAM,CAAC;YAC3B,oBAAoB,EAAE,MAAM,CAAC;SAC9B,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,UAAU,MAAM;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB;IAED,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,UAAU,kBAAkB;QAC1B,YAAY,EAAE,OAAO,CAAC;QACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;KACjC;IACD,UAAiB,OAAO;QACtB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC;KACtF;CACF;AAED;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,KAAK,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,CAAC,EAAE;QAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAClF;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,CAAC,EAAE;QACR,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,CAAC,OAAO,WAAW,0BAA0B,CAAC;IAClD,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,sBAAsB,EAAE,MAAM,CAAC;YAC/B,oBAAoB,EAAE,MAAM,CAAC;YAC7B,QAAQ,EAAE,CACN,UAAU,GACV,gBAAgB,GAChB,sBAAsB,GACtB,sBAAsB,GACtB,qBAAqB,CACxB,EAAE,CAAC;YACJ,qBAAqB,EAAE,OAAO,CAAC;YAC/B,kBAAkB,EAAE,OAAO,CAAC;YAC5B,cAAc,EAAE,MAAM,CAAC;YACvB,YAAY,EAAE,OAAO,CAAC;YACtB,gBAAgB,EAAE,OAAO,CAAC;YAC1B,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,OAAO,CAAC;SAClB,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,iBAAiB,CAAC;IACzC,UAAiB,OAAO;KAAG;IAE3B,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,qBAAqB,EAAE,OAAO,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;SAC5D,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../shared/contracts/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;YACrB,QAAQ,EAAE,OAAO,CAAC;YAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;YACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;SACzB,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,kBAAkB,CAAC;IAC1C,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,IAAI,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,qBAAqB,CAAC;IAC7C,UAAiB,OAAO;QACtB,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;YACtB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;SACvB,CAAC;QACF,KAAK,EAAE,EAAE,CAAC;QACV,KAAK,EAAE;YACL,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;YACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;SACxB,CAAC;KACH;IACD,UAAiB,QAAQ;QACvB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KAC7D;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,kBAAkB,EAAE,MAAM,CAAC;YAC3B,UAAU,EAAE,OAAO,CAAC;YACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;YAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YACzB,WAAW,EAAE,MAAM,CAAC;YACpB,gBAAgB,EAAE,OAAO,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC;SAClB,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,mBAAmB,CAAC;IAC3C,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,qBAAqB,EAAE,OAAO,CAAC;YAC/B,oBAAoB,EAAE,OAAO,CAAC;YAC9B,qBAAqB,EAAE,OAAO,CAAC;YAC/B,uBAAuB,EAAE,MAAM,CAAC;YAChC,kBAAkB,EAAE,MAAM,CAAC;YAC3B,oBAAoB,EAAE,MAAM,CAAC;SAC9B,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,UAAU,MAAM;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB;IAED,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,UAAU,kBAAkB;QAC1B,YAAY,EAAE,OAAO,CAAC;QACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;KACjC;IACD,UAAiB,OAAO;QACtB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC;KACtF;CACF;AAED;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,KAAK,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,CAAC,EAAE;QAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAClF;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,CAAC,EAAE;QACR,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,CAAC,OAAO,WAAW,0BAA0B,CAAC;IAClD,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IACD,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,sBAAsB,EAAE,MAAM,CAAC;YAC/B,oBAAoB,EAAE,MAAM,CAAC;YAC7B,QAAQ,EAAE,CACN,UAAU,GACV,gBAAgB,GAChB,sBAAsB,GACtB,sBAAsB,GACtB,qBAAqB,CACxB,EAAE,CAAC;YACJ,qBAAqB,EAAE,OAAO,CAAC;YAC/B,kBAAkB,EAAE,OAAO,CAAC;YAC5B,cAAc,EAAE,MAAM,CAAC;YACvB,YAAY,EAAE,OAAO,CAAC;YACtB,gBAAgB,EAAE,OAAO,CAAC;YAC1B,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,OAAO,CAAC;SAClB,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,iBAAiB,CAAC;IACzC,UAAiB,OAAO;KAAG;IAE3B,UAAiB,QAAQ;QACvB,IAAI,EAAE;YACJ,qBAAqB,EAAE,OAAO,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;SAC5D,CAAC;QACF,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/admin",
-  "version": "5.33.3",
+  "version": "5.34.0",
   "description": "Strapi Admin",
   "repository": {
     "type": "git",
@@ -84,12 +84,12 @@
     "@radix-ui/react-context": "1.0.1",
     "@radix-ui/react-toolbar": "1.0.4",
     "@reduxjs/toolkit": "1.9.7",
-    "@strapi/design-system": "2.0.1",
-    "@strapi/icons": "2.0.1",
-    "@strapi/permissions": "5.33.3",
-    "@strapi/types": "5.33.3",
-    "@strapi/typescript-utils": "5.33.3",
-    "@strapi/utils": "5.33.3",
+    "@strapi/design-system": "2.1.2",
+    "@strapi/icons": "2.1.2",
+    "@strapi/permissions": "5.34.0",
+    "@strapi/types": "5.34.0",
+    "@strapi/typescript-utils": "5.34.0",
+    "@strapi/utils": "5.34.0",
     "@testing-library/dom": "10.4.1",
     "@testing-library/react": "16.3.0",
     "@testing-library/user-event": "14.6.1",
@@ -145,8 +145,8 @@
     "zod": "3.25.67"
   },
   "devDependencies": {
-    "@strapi/admin-test-utils": "5.33.3",
-    "@strapi/data-transfer": "5.33.3",
+    "@strapi/admin-test-utils": "5.34.0",
+    "@strapi/data-transfer": "5.34.0",
     "@types/codemirror5": "npm:@types/codemirror@^5.60.15",
     "@types/fs-extra": "11.0.4",
     "@types/invariant": "2.2.36",