@strapi/admin 5.41.1 → 5.42.0

package/dist/admin/admin/src/features/Auth.js

@@ -32,6 +32,21 @@ function _interopNamespaceDefault(e) {
 
 var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
 
+/**
+ * ensure the Auth context never exposes a non-function for checkUserHasPermissions.
+ * When this is undefined (e.g. context timing in production builds), consumers would throw
+ * "p is not a function" / "checkUserHasPermissions is not a function". By always passing
+ * a function here, all current and future consumers are protected without per-call-site guards.
+ *
+ * When would the fallback run? Only if the real checkUserHasPermissions were ever undefined
+ * when we pass to the Provider (e.g. a rare timing/build edge case). In normal runs it is
+ * always defined (useCallback), so the real function is passed and behavior is unchanged.
+ *
+ * If the fallback ever did run: it returns [] so consumers (which use .length > 0) treat it
+ * as "no permission" for that render—under-permissive. On the next AuthProvider re-render we
+ * pass the real function again, so the context updates and the view corrects quickly.
+ * @see https://github.com/strapi/strapi/issues/24384
+ */ const NOOP_CHECK_USER_HAS_PERMISSIONS = async ()=>[];
 const [Provider, useAuth] = Context.createContext('Auth');
 const STORAGE_KEYS = {
     STATUS: 'isLoggedIn'
@@ -207,7 +222,7 @@ const AuthProvider = ({ children, _defaultPermissions = [], _disableRenewToken =
         login: login,
         logout: logout,
         permissions: userPermissions,
-        checkUserHasPermissions: checkUserHasPermissions,
+        checkUserHasPermissions: checkUserHasPermissions ?? NOOP_CHECK_USER_HAS_PERMISSIONS,
         refetchPermissions: refetchPermissions,
         isLoading: isLoading,
         children: children

package/dist/admin/admin/src/features/Auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"Auth.js","sources":["../../../../../admin/src/features/Auth.tsx"],"sourcesContent":["import * as React from 'react';\n\nimport { useLocation, useNavigate } from 'react-router-dom';\n\nimport { Login } from '../../../shared/contracts/authentication';\nimport { createContext } from '../components/Context';\nimport { useTypedDispatch, useTypedSelector } from '../core/store/hooks';\nimport { useStrapiApp } from '../features/StrapiApp';\nimport { useQueryParams } from '../hooks/useQueryParams';\nimport { login as loginAction, logout as logoutAction, setLocale, setToken } from '../reducer';\nimport { adminApi } from '../services/api';\nimport {\n  useGetMeQuery,\n  useGetMyPermissionsQuery,\n  useLazyCheckPermissionsQuery,\n  useLoginMutation,\n  useLogoutMutation,\n} from '../services/auth';\nimport { getOrCreateDeviceId } from '../utils/deviceId';\nimport { setOnTokenUpdate } from '../utils/getFetchClient';\n\nimport type {\n  Permission as PermissionContract,\n  SanitizedAdminUser,\n} from '../../../shared/contracts/shared';\n\ninterface Permission\n  extends Pick<PermissionContract, 'action' | 'subject'>,\n    Partial<Omit<PermissionContract, 'action' | 'subject'>> {}\n\ninterface User\n  extends Pick<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>,\n    Partial<Omit<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>> {}\n\ninterface AuthContextValue {\n  login: (\n    body: Login.Request['body'] & { rememberMe: boolean }\n  ) => Promise<Awaited<ReturnType<ReturnType<typeof useLoginMutation>[0]>>>;\n  logout: () => Promise<void>;\n  /**\n   * @alpha\n   * @description given a list of permissions, this function checks\n   * those against the current user's permissions or those passed as\n   * the second argument, if the user has those permissions the complete\n   * permission object form the API is returned. Therefore, if the list is\n   * empty, the user does not have any of those permissions.\n   */\n  checkUserHasPermissions: (\n    permissions?: Array<Pick<Permission, 'action'> & Partial<Omit<Permission, 'action'>>>,\n    passedPermissions?: Permission[],\n    rawQueryContext?: string\n  ) => Promise<Permission[]>;\n  isLoading: boolean;\n  permissions: Permission[];\n  refetchPermissions: () => Promise<void>;\n  token: string | null;\n  user?: User;\n}\n\nconst [Provider, useAuth] = createContext<AuthContextValue>('Auth');\n\ninterface AuthProviderProps {\n  children: React.ReactNode;\n  /**\n   * @internal could be removed at any time.\n   */\n  _defaultPermissions?: Permission[];\n\n  // NOTE: this is used for testing purposed only\n  _disableRenewToken?: boolean;\n}\n\nconst STORAGE_KEYS = {\n  TOKEN: 'jwtToken',\n  STATUS: 'isLoggedIn',\n};\n\nconst AuthProvider = ({\n  children,\n  _defaultPermissions = [],\n  _disableRenewToken = false,\n}: AuthProviderProps) => {\n  const dispatch = useTypedDispatch();\n  const runRbacMiddleware = useStrapiApp('AuthProvider', (state) => state.rbac.run);\n  const location = useLocation();\n  const [{ rawQuery }] = useQueryParams();\n\n  const locationRef = React.useRef(location);\n\n  // Update ref without causing re-render\n  React.useEffect(() => {\n    locationRef.current = location;\n  }, [location]);\n\n  const token = useTypedSelector((state) => state.admin_app.token ?? null);\n\n  const { data: user, isLoading: isLoadingUser } = useGetMeQuery(undefined, {\n    /**\n     * If there's no token, we don't try to fetch\n     * the user data because it will fail.\n     */\n    skip: !token,\n  });\n\n  const {\n    data: userPermissions = _defaultPermissions,\n    refetch,\n    isUninitialized,\n    isLoading: isLoadingPermissions,\n  } = useGetMyPermissionsQuery(undefined, {\n    skip: !token,\n  });\n\n  const navigate = useNavigate();\n\n  const [loginMutation] = useLoginMutation();\n  const [logoutMutation] = useLogoutMutation();\n\n  const clearStateAndLogout = React.useCallback(() => {\n    dispatch(adminApi.util.resetApiState());\n    dispatch(logoutAction());\n    navigate('/auth/login');\n  }, [dispatch, navigate]);\n\n  React.useEffect(() => {\n    if (user) {\n      if (user.preferedLanguage) {\n        dispatch(setLocale(user.preferedLanguage));\n      }\n    }\n  }, [dispatch, user]);\n\n  /**\n   * Register a callback to update Redux state when the token is refreshed.\n   * This ensures the app state stays in sync with the token stored in localStorage/cookies.\n   */\n  React.useEffect(() => {\n    setOnTokenUpdate((newToken) => {\n      dispatch(setToken(newToken));\n    });\n\n    return () => {\n      setOnTokenUpdate(null);\n    };\n  }, [dispatch]);\n\n  React.useEffect(() => {\n    /**\n     * This will log a user out of all tabs if they log out in one tab.\n     */\n    const handleUserStorageChange = (event: StorageEvent) => {\n      if (event.key === STORAGE_KEYS.STATUS && event.newValue === null) {\n        clearStateAndLogout();\n      }\n    };\n\n    window.addEventListener('storage', handleUserStorageChange);\n\n    return () => {\n      window.removeEventListener('storage', handleUserStorageChange);\n    };\n  });\n\n  const login = React.useCallback<AuthContextValue['login']>(\n    async ({ rememberMe, ...body }) => {\n      const res = await loginMutation({ ...body, deviceId: getOrCreateDeviceId(), rememberMe });\n\n      /**\n       * There will always be a `data` key in the response\n       * because if something fails, it will throw an error.\n       */\n      if ('data' in res) {\n        const { token } = res.data;\n\n        dispatch(\n          loginAction({\n            token,\n            persist: rememberMe,\n          })\n        );\n      }\n\n      return res;\n    },\n    [dispatch, loginMutation]\n  );\n\n  const logout = React.useCallback(async () => {\n    await logoutMutation({ deviceId: getOrCreateDeviceId() });\n    clearStateAndLogout();\n  }, [clearStateAndLogout, logoutMutation]);\n\n  const refetchPermissions = React.useCallback(async () => {\n    if (!isUninitialized) {\n      await refetch();\n    }\n  }, [isUninitialized, refetch]);\n\n  const [checkPermissions] = useLazyCheckPermissionsQuery();\n  const checkUserHasPermissions: AuthContextValue['checkUserHasPermissions'] = React.useCallback(\n    async (\n      permissions,\n      passedPermissions,\n      // TODO:\n      // Here we have parameterised checkUserHasPermissions in order to pass\n      // query context from elsewhere in the application.\n      // See packages/core/content-manager/admin/src/features/DocumentRBAC.tsx\n\n      // This is in order to calculate permissions on accurate query params.\n      // We should be able to rely on the query params in this provider\n      // If we need to pass additional context to the RBAC middleware\n      // we should define a better context type.\n      rawQueryContext\n    ) => {\n      /**\n       * If there's no permissions to check, then we allow it to\n       * pass to preserve existing behaviours.\n       *\n       * TODO: should we review this? it feels more dangerous than useful.\n       */\n      if (!permissions || permissions.length === 0) {\n        return [{ action: '', subject: '' }];\n      }\n\n      /**\n       * Given the provided permissions, return the permissions from either passedPermissions\n       * or userPermissions as this is expected to be the full permission entity.\n       */\n      const actualUserPermissions = passedPermissions ?? userPermissions;\n\n      const matchingPermissions = actualUserPermissions.filter(\n        (permission) =>\n          permissions.findIndex(\n            (perm) =>\n              perm.action === permission.action &&\n              // Only check the subject if it's provided\n              (perm.subject == undefined || perm.subject === permission.subject)\n          ) >= 0\n      );\n\n      const middlewaredPermissions = await runRbacMiddleware(\n        {\n          user,\n          permissions: userPermissions,\n          pathname: locationRef.current.pathname,\n          search: (rawQueryContext || rawQuery).split('?')[1] ?? '',\n        },\n        matchingPermissions\n      );\n\n      const shouldCheckConditions = middlewaredPermissions.some(\n        (perm) => Array.isArray(perm.conditions) && perm.conditions.length > 0\n      );\n\n      if (!shouldCheckConditions) {\n        return middlewaredPermissions;\n      }\n\n      const { data, error } = await checkPermissions({\n        permissions: middlewaredPermissions.map((perm) => ({\n          action: perm.action,\n          subject: perm.subject,\n        })),\n      });\n\n      if (error) {\n        throw error;\n      } else {\n        return middlewaredPermissions.filter((_, index) => data?.data[index] === true);\n      }\n    },\n    [checkPermissions, rawQuery, runRbacMiddleware, user, userPermissions]\n  );\n\n  const isLoading = isLoadingUser || isLoadingPermissions;\n\n  return (\n    <Provider\n      token={token}\n      user={user}\n      login={login}\n      logout={logout}\n      permissions={userPermissions}\n      checkUserHasPermissions={checkUserHasPermissions}\n      refetchPermissions={refetchPermissions}\n      isLoading={isLoading}\n    >\n      {children}\n    </Provider>\n  );\n};\n\nexport { AuthProvider, useAuth, STORAGE_KEYS };\nexport type { AuthContextValue, Permission, User };\n"],"names":["Provider","useAuth","createContext","STORAGE_KEYS","STATUS","AuthProvider","children","_defaultPermissions","_disableRenewToken","dispatch","useTypedDispatch","runRbacMiddleware","useStrapiApp","state","rbac","run","location","useLocation","rawQuery","useQueryParams","locationRef","React","useRef","useEffect","current","token","useTypedSelector","admin_app","data","user","isLoading","isLoadingUser","useGetMeQuery","undefined","skip","userPermissions","refetch","isUninitialized","isLoadingPermissions","useGetMyPermissionsQuery","navigate","useNavigate","loginMutation","useLoginMutation","logoutMutation","useLogoutMutation","clearStateAndLogout","useCallback","adminApi","util","resetApiState","logoutAction","preferedLanguage","setLocale","setOnTokenUpdate","newToken","setToken","handleUserStorageChange","event","key","newValue","window","addEventListener","removeEventListener","login","rememberMe","body","res","deviceId","getOrCreateDeviceId","loginAction","persist","logout","refetchPermissions","checkPermissions","useLazyCheckPermissionsQuery","checkUserHasPermissions","permissions","passedPermissions","rawQueryContext","length","action","subject","actualUserPermissions","matchingPermissions","filter","permission","findIndex","perm","middlewaredPermissions","pathname","search","split","shouldCheckConditions","some","Array","isArray","conditions","error","map","_","index","_jsx"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,MAAM,CAACA,QAAAA,EAAUC,OAAAA,CAAQ,GAAGC,qBAAAA,CAAgC,MAAA;AAa5D,MAAMC,YAAAA,GAAe;IAEnBC,MAAAA,EAAQ;AACV;AAEA,MAAMC,YAAAA,GAAe,CAAC,EACpBC,QAAQ,EACRC,sBAAsB,EAAE,EACxBC,kBAAAA,GAAqB,KAAK,EACR,GAAA;AAClB,IAAA,MAAMC,QAAAA,GAAWC,sBAAAA,EAAAA;IACjB,MAAMC,iBAAAA,GAAoBC,uBAAa,cAAA,EAAgB,CAACC,QAAUA,KAAAA,CAAMC,IAAI,CAACC,GAAG,CAAA;AAChF,IAAA,MAAMC,QAAAA,GAAWC,0BAAAA,EAAAA;AACjB,IAAA,MAAM,CAAC,EAAEC,QAAQ,EAAE,CAAC,GAAGC,6BAAAA,EAAAA;IAEvB,MAAMC,WAAAA,GAAcC,gBAAAA,CAAMC,MAAM,CAACN,QAAAA,CAAAA;;AAGjCK,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACdH,QAAAA,WAAAA,CAAYI,OAAO,GAAGR,QAAAA;IACxB,CAAA,EAAG;AAACA,QAAAA;AAAS,KAAA,CAAA;IAEb,MAAMS,KAAAA,GAAQC,uBAAiB,CAACb,KAAAA,GAAUA,MAAMc,SAAS,CAACF,KAAK,IAAI,IAAA,CAAA;IAEnE,MAAM,EAAEG,MAAMC,IAAI,EAAEC,WAAWC,aAAa,EAAE,GAAGC,kBAAAA,CAAcC,SAAAA,EAAW;AACxE;;;AAGC,QACDC,MAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAM,EACJG,IAAAA,EAAMO,eAAAA,GAAkB5B,mBAAmB,EAC3C6B,OAAO,EACPC,eAAe,EACfP,SAAAA,EAAWQ,oBAAoB,EAChC,GAAGC,8BAAyBN,SAAAA,EAAW;AACtCC,QAAAA,IAAAA,EAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAMe,QAAAA,GAAWC,0BAAAA,EAAAA;IAEjB,MAAM,CAACC,cAAc,GAAGC,qBAAAA,EAAAA;IACxB,MAAM,CAACC,eAAe,GAAGC,sBAAAA,EAAAA;IAEzB,MAAMC,mBAAAA,GAAsBzB,gBAAAA,CAAM0B,WAAW,CAAC,IAAA;QAC5CtC,QAAAA,CAASuC,YAAAA,CAASC,IAAI,CAACC,aAAa,EAAA,CAAA;QACpCzC,QAAAA,CAAS0C,cAAAA,EAAAA,CAAAA;QACTX,QAAAA,CAAS,aAAA,CAAA;IACX,CAAA,EAAG;AAAC/B,QAAAA,QAAAA;AAAU+B,QAAAA;AAAS,KAAA,CAAA;AAEvBnB,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACd,QAAA,IAAIM,IAAAA,EAAM;YACR,IAAIA,IAAAA,CAAKuB,gBAAgB,EAAE;gBACzB3C,QAAAA,CAAS4C,iBAAAA,CAAUxB,KAAKuB,gBAAgB,CAAA,CAAA;AAC1C,YAAA;AACF,QAAA;IACF,CAAA,EAAG;AAAC3C,QAAAA,QAAAA;AAAUoB,QAAAA;AAAK,KAAA,CAAA;AAEnB;;;MAIAR,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACd+B,QAAAA,+BAAAA,CAAiB,CAACC,QAAAA,GAAAA;AAChB9C,YAAAA,QAAAA,CAAS+C,gBAAAA,CAASD,QAAAA,CAAAA,CAAAA;AACpB,QAAA,CAAA,CAAA;QAEA,OAAO,IAAA;YACLD,+BAAAA,CAAiB,IAAA,CAAA;AACnB,QAAA,CAAA;IACF,CAAA,EAAG;AAAC7C,QAAAA;AAAS,KAAA,CAAA;AAEbY,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACd;;QAGA,MAAMkC,0BAA0B,CAACC,KAAAA,GAAAA;YAC/B,IAAIA,KAAAA,CAAMC,GAAG,KAAKxD,YAAAA,CAAaC,MAAM,IAAIsD,KAAAA,CAAME,QAAQ,KAAK,IAAA,EAAM;AAChEd,gBAAAA,mBAAAA,EAAAA;AACF,YAAA;AACF,QAAA,CAAA;QAEAe,MAAAA,CAAOC,gBAAgB,CAAC,SAAA,EAAWL,uBAAAA,CAAAA;QAEnC,OAAO,IAAA;YACLI,MAAAA,CAAOE,mBAAmB,CAAC,SAAA,EAAWN,uBAAAA,CAAAA;AACxC,QAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEA,MAAMO,KAAAA,GAAQ3C,iBAAM0B,WAAW,CAC7B,OAAO,EAAEkB,UAAU,EAAE,GAAGC,IAAAA,EAAM,GAAA;QAC5B,MAAMC,GAAAA,GAAM,MAAMzB,aAAAA,CAAc;AAAE,YAAA,GAAGwB,IAAI;YAAEE,QAAAA,EAAUC,4BAAAA,EAAAA;AAAuBJ,YAAAA;AAAW,SAAA,CAAA;AAEvF;;;UAIA,IAAI,UAAUE,GAAAA,EAAK;AACjB,YAAA,MAAM,EAAE1C,KAAK,EAAE,GAAG0C,IAAIvC,IAAI;AAE1BnB,YAAAA,QAAAA,CACE6D,aAAAA,CAAY;AACV7C,gBAAAA,KAAAA;gBACA8C,OAAAA,EAASN;AACX,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,OAAOE,GAAAA;IACT,CAAA,EACA;AAAC1D,QAAAA,QAAAA;AAAUiC,QAAAA;AAAc,KAAA,CAAA;IAG3B,MAAM8B,MAAAA,GAASnD,gBAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC/B,QAAA,MAAMH,cAAAA,CAAe;YAAEwB,QAAAA,EAAUC,4BAAAA;AAAsB,SAAA,CAAA;AACvDvB,QAAAA,mBAAAA,EAAAA;IACF,CAAA,EAAG;AAACA,QAAAA,mBAAAA;AAAqBF,QAAAA;AAAe,KAAA,CAAA;IAExC,MAAM6B,kBAAAA,GAAqBpD,gBAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC3C,QAAA,IAAI,CAACV,eAAAA,EAAiB;YACpB,MAAMD,OAAAA,EAAAA;AACR,QAAA;IACF,CAAA,EAAG;AAACC,QAAAA,eAAAA;AAAiBD,QAAAA;AAAQ,KAAA,CAAA;IAE7B,MAAM,CAACsC,iBAAiB,GAAGC,iCAAAA,EAAAA;AAC3B,IAAA,MAAMC,0BAAuEvD,gBAAAA,CAAM0B,WAAW,CAC5F,OACE8B,WAAAA,EACAC;;;;;;;;AAUAC,IAAAA,eAAAA,GAAAA;AAEA;;;;;AAKC,UACD,IAAI,CAACF,WAAAA,IAAeA,WAAAA,CAAYG,MAAM,KAAK,CAAA,EAAG;YAC5C,OAAO;AAAC,gBAAA;oBAAEC,MAAAA,EAAQ,EAAA;oBAAIC,OAAAA,EAAS;AAAG;AAAE,aAAA;AACtC,QAAA;AAEA;;;UAIA,MAAMC,wBAAwBL,iBAAAA,IAAqB3C,eAAAA;AAEnD,QAAA,MAAMiD,sBAAsBD,qBAAAA,CAAsBE,MAAM,CACtD,CAACC,aACCT,WAAAA,CAAYU,SAAS,CACnB,CAACC,OACCA,IAAAA,CAAKP,MAAM,KAAKK,UAAAA,CAAWL,MAAM;iBAEhCO,IAAAA,CAAKN,OAAO,IAAIjD,SAAAA,IAAauD,IAAAA,CAAKN,OAAO,KAAKI,UAAAA,CAAWJ,OAAM,CAAA,CAAA,IAC/D,CAAA,CAAA;QAGT,MAAMO,sBAAAA,GAAyB,MAAM9E,iBAAAA,CACnC;AACEkB,YAAAA,IAAAA;YACAgD,WAAAA,EAAa1C,eAAAA;YACbuD,QAAAA,EAAUtE,WAAAA,CAAYI,OAAO,CAACkE,QAAQ;YACtCC,MAAAA,EAASZ,CAAAA,eAAAA,IAAmB7D,QAAO,EAAG0E,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI;SACzD,EACAR,mBAAAA,CAAAA;AAGF,QAAA,MAAMS,wBAAwBJ,sBAAAA,CAAuBK,IAAI,CACvD,CAACN,OAASO,KAAAA,CAAMC,OAAO,CAACR,IAAAA,CAAKS,UAAU,CAAA,IAAKT,IAAAA,CAAKS,UAAU,CAACjB,MAAM,GAAG,CAAA,CAAA;AAGvE,QAAA,IAAI,CAACa,qBAAAA,EAAuB;YAC1B,OAAOJ,sBAAAA;AACT,QAAA;AAEA,QAAA,MAAM,EAAE7D,IAAI,EAAEsE,KAAK,EAAE,GAAG,MAAMxB,gBAAAA,CAAiB;AAC7CG,YAAAA,WAAAA,EAAaY,sBAAAA,CAAuBU,GAAG,CAAC,CAACX,QAAU;AACjDP,oBAAAA,MAAAA,EAAQO,KAAKP,MAAM;AACnBC,oBAAAA,OAAAA,EAASM,KAAKN;iBAChB,CAAA;AACF,SAAA,CAAA;AAEA,QAAA,IAAIgB,KAAAA,EAAO;YACT,MAAMA,KAAAA;QACR,CAAA,MAAO;YACL,OAAOT,sBAAAA,CAAuBJ,MAAM,CAAC,CAACe,CAAAA,EAAGC,QAAUzE,IAAAA,EAAMA,IAAI,CAACyE,KAAAA,CAAM,KAAK,IAAA,CAAA;AAC3E,QAAA;IACF,CAAA,EACA;AAAC3B,QAAAA,gBAAAA;AAAkBxD,QAAAA,QAAAA;AAAUP,QAAAA,iBAAAA;AAAmBkB,QAAAA,IAAAA;AAAMM,QAAAA;AAAgB,KAAA,CAAA;AAGxE,IAAA,MAAML,YAAYC,aAAAA,IAAiBO,oBAAAA;AAEnC,IAAA,qBACEgE,cAAA,CAACtG,QAAAA,EAAAA;QACCyB,KAAAA,EAAOA,KAAAA;QACPI,IAAAA,EAAMA,IAAAA;QACNmC,KAAAA,EAAOA,KAAAA;QACPQ,MAAAA,EAAQA,MAAAA;QACRK,WAAAA,EAAa1C,eAAAA;QACbyC,uBAAAA,EAAyBA,uBAAAA;QACzBH,kBAAAA,EAAoBA,kBAAAA;QACpB3C,SAAAA,EAAWA,SAAAA;AAEVxB,QAAAA,QAAAA,EAAAA;;AAGP;;;;;;"}
+{"version":3,"file":"Auth.js","sources":["../../../../../admin/src/features/Auth.tsx"],"sourcesContent":["import * as React from 'react';\n\nimport { useLocation, useNavigate } from 'react-router-dom';\n\nimport { Login } from '../../../shared/contracts/authentication';\nimport { createContext } from '../components/Context';\nimport { useTypedDispatch, useTypedSelector } from '../core/store/hooks';\nimport { useStrapiApp } from '../features/StrapiApp';\nimport { useQueryParams } from '../hooks/useQueryParams';\nimport { login as loginAction, logout as logoutAction, setLocale, setToken } from '../reducer';\nimport { adminApi } from '../services/api';\nimport {\n  useGetMeQuery,\n  useGetMyPermissionsQuery,\n  useLazyCheckPermissionsQuery,\n  useLoginMutation,\n  useLogoutMutation,\n} from '../services/auth';\nimport { getOrCreateDeviceId } from '../utils/deviceId';\nimport { setOnTokenUpdate } from '../utils/getFetchClient';\n\nimport type {\n  Permission as PermissionContract,\n  SanitizedAdminUser,\n} from '../../../shared/contracts/shared';\n\ninterface Permission\n  extends Pick<PermissionContract, 'action' | 'subject'>,\n    Partial<Omit<PermissionContract, 'action' | 'subject'>> {}\n\ninterface User\n  extends Pick<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>,\n    Partial<Omit<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>> {}\n\ninterface AuthContextValue {\n  login: (\n    body: Login.Request['body'] & { rememberMe: boolean }\n  ) => Promise<Awaited<ReturnType<ReturnType<typeof useLoginMutation>[0]>>>;\n  logout: () => Promise<void>;\n  /**\n   * @alpha\n   * @description given a list of permissions, this function checks\n   * those against the current user's permissions or those passed as\n   * the second argument, if the user has those permissions the complete\n   * permission object form the API is returned. Therefore, if the list is\n   * empty, the user does not have any of those permissions.\n   */\n  checkUserHasPermissions: (\n    permissions?: Array<Pick<Permission, 'action'> & Partial<Omit<Permission, 'action'>>>,\n    passedPermissions?: Permission[],\n    rawQueryContext?: string\n  ) => Promise<Permission[]>;\n  isLoading: boolean;\n  permissions: Permission[];\n  refetchPermissions: () => Promise<void>;\n  token: string | null;\n  user?: User;\n}\n\n/**\n * ensure the Auth context never exposes a non-function for checkUserHasPermissions.\n * When this is undefined (e.g. context timing in production builds), consumers would throw\n * \"p is not a function\" / \"checkUserHasPermissions is not a function\". By always passing\n * a function here, all current and future consumers are protected without per-call-site guards.\n *\n * When would the fallback run? Only if the real checkUserHasPermissions were ever undefined\n * when we pass to the Provider (e.g. a rare timing/build edge case). In normal runs it is\n * always defined (useCallback), so the real function is passed and behavior is unchanged.\n *\n * If the fallback ever did run: it returns [] so consumers (which use .length > 0) treat it\n * as \"no permission\" for that render—under-permissive. On the next AuthProvider re-render we\n * pass the real function again, so the context updates and the view corrects quickly.\n * @see https://github.com/strapi/strapi/issues/24384\n */\nconst NOOP_CHECK_USER_HAS_PERMISSIONS: AuthContextValue['checkUserHasPermissions'] = async () => [];\n\nconst [Provider, useAuth] = createContext<AuthContextValue>('Auth');\n\ninterface AuthProviderProps {\n  children: React.ReactNode;\n  /**\n   * @internal could be removed at any time.\n   */\n  _defaultPermissions?: Permission[];\n\n  // NOTE: this is used for testing purposed only\n  _disableRenewToken?: boolean;\n}\n\nconst STORAGE_KEYS = {\n  TOKEN: 'jwtToken',\n  STATUS: 'isLoggedIn',\n};\n\nconst AuthProvider = ({\n  children,\n  _defaultPermissions = [],\n  _disableRenewToken = false,\n}: AuthProviderProps) => {\n  const dispatch = useTypedDispatch();\n  const runRbacMiddleware = useStrapiApp('AuthProvider', (state) => state.rbac.run);\n  const location = useLocation();\n  const [{ rawQuery }] = useQueryParams();\n\n  const locationRef = React.useRef(location);\n\n  // Update ref without causing re-render\n  React.useEffect(() => {\n    locationRef.current = location;\n  }, [location]);\n\n  const token = useTypedSelector((state) => state.admin_app.token ?? null);\n\n  const { data: user, isLoading: isLoadingUser } = useGetMeQuery(undefined, {\n    /**\n     * If there's no token, we don't try to fetch\n     * the user data because it will fail.\n     */\n    skip: !token,\n  });\n\n  const {\n    data: userPermissions = _defaultPermissions,\n    refetch,\n    isUninitialized,\n    isLoading: isLoadingPermissions,\n  } = useGetMyPermissionsQuery(undefined, {\n    skip: !token,\n  });\n\n  const navigate = useNavigate();\n\n  const [loginMutation] = useLoginMutation();\n  const [logoutMutation] = useLogoutMutation();\n\n  const clearStateAndLogout = React.useCallback(() => {\n    dispatch(adminApi.util.resetApiState());\n    dispatch(logoutAction());\n    navigate('/auth/login');\n  }, [dispatch, navigate]);\n\n  React.useEffect(() => {\n    if (user) {\n      if (user.preferedLanguage) {\n        dispatch(setLocale(user.preferedLanguage));\n      }\n    }\n  }, [dispatch, user]);\n\n  /**\n   * Register a callback to update Redux state when the token is refreshed.\n   * This ensures the app state stays in sync with the token stored in localStorage/cookies.\n   */\n  React.useEffect(() => {\n    setOnTokenUpdate((newToken) => {\n      dispatch(setToken(newToken));\n    });\n\n    return () => {\n      setOnTokenUpdate(null);\n    };\n  }, [dispatch]);\n\n  React.useEffect(() => {\n    /**\n     * This will log a user out of all tabs if they log out in one tab.\n     */\n    const handleUserStorageChange = (event: StorageEvent) => {\n      if (event.key === STORAGE_KEYS.STATUS && event.newValue === null) {\n        clearStateAndLogout();\n      }\n    };\n\n    window.addEventListener('storage', handleUserStorageChange);\n\n    return () => {\n      window.removeEventListener('storage', handleUserStorageChange);\n    };\n  });\n\n  const login = React.useCallback<AuthContextValue['login']>(\n    async ({ rememberMe, ...body }) => {\n      const res = await loginMutation({ ...body, deviceId: getOrCreateDeviceId(), rememberMe });\n\n      /**\n       * There will always be a `data` key in the response\n       * because if something fails, it will throw an error.\n       */\n      if ('data' in res) {\n        const { token } = res.data;\n\n        dispatch(\n          loginAction({\n            token,\n            persist: rememberMe,\n          })\n        );\n      }\n\n      return res;\n    },\n    [dispatch, loginMutation]\n  );\n\n  const logout = React.useCallback(async () => {\n    await logoutMutation({ deviceId: getOrCreateDeviceId() });\n    clearStateAndLogout();\n  }, [clearStateAndLogout, logoutMutation]);\n\n  const refetchPermissions = React.useCallback(async () => {\n    if (!isUninitialized) {\n      await refetch();\n    }\n  }, [isUninitialized, refetch]);\n\n  const [checkPermissions] = useLazyCheckPermissionsQuery();\n  const checkUserHasPermissions: AuthContextValue['checkUserHasPermissions'] = React.useCallback(\n    async (\n      permissions,\n      passedPermissions,\n      // TODO:\n      // Here we have parameterised checkUserHasPermissions in order to pass\n      // query context from elsewhere in the application.\n      // See packages/core/content-manager/admin/src/features/DocumentRBAC.tsx\n\n      // This is in order to calculate permissions on accurate query params.\n      // We should be able to rely on the query params in this provider\n      // If we need to pass additional context to the RBAC middleware\n      // we should define a better context type.\n      rawQueryContext\n    ) => {\n      /**\n       * If there's no permissions to check, then we allow it to\n       * pass to preserve existing behaviours.\n       *\n       * TODO: should we review this? it feels more dangerous than useful.\n       */\n      if (!permissions || permissions.length === 0) {\n        return [{ action: '', subject: '' }];\n      }\n\n      /**\n       * Given the provided permissions, return the permissions from either passedPermissions\n       * or userPermissions as this is expected to be the full permission entity.\n       */\n      const actualUserPermissions = passedPermissions ?? userPermissions;\n\n      const matchingPermissions = actualUserPermissions.filter(\n        (permission) =>\n          permissions.findIndex(\n            (perm) =>\n              perm.action === permission.action &&\n              // Only check the subject if it's provided\n              (perm.subject == undefined || perm.subject === permission.subject)\n          ) >= 0\n      );\n\n      const middlewaredPermissions = await runRbacMiddleware(\n        {\n          user,\n          permissions: userPermissions,\n          pathname: locationRef.current.pathname,\n          search: (rawQueryContext || rawQuery).split('?')[1] ?? '',\n        },\n        matchingPermissions\n      );\n\n      const shouldCheckConditions = middlewaredPermissions.some(\n        (perm) => Array.isArray(perm.conditions) && perm.conditions.length > 0\n      );\n\n      if (!shouldCheckConditions) {\n        return middlewaredPermissions;\n      }\n\n      const { data, error } = await checkPermissions({\n        permissions: middlewaredPermissions.map((perm) => ({\n          action: perm.action,\n          subject: perm.subject,\n        })),\n      });\n\n      if (error) {\n        throw error;\n      } else {\n        return middlewaredPermissions.filter((_, index) => data?.data[index] === true);\n      }\n    },\n    [checkPermissions, rawQuery, runRbacMiddleware, user, userPermissions]\n  );\n\n  const isLoading = isLoadingUser || isLoadingPermissions;\n\n  return (\n    <Provider\n      token={token}\n      user={user}\n      login={login}\n      logout={logout}\n      permissions={userPermissions}\n      checkUserHasPermissions={checkUserHasPermissions ?? NOOP_CHECK_USER_HAS_PERMISSIONS}\n      refetchPermissions={refetchPermissions}\n      isLoading={isLoading}\n    >\n      {children}\n    </Provider>\n  );\n};\n\nexport { AuthProvider, useAuth, STORAGE_KEYS };\nexport type { AuthContextValue, Permission, User };\n"],"names":["NOOP_CHECK_USER_HAS_PERMISSIONS","Provider","useAuth","createContext","STORAGE_KEYS","STATUS","AuthProvider","children","_defaultPermissions","_disableRenewToken","dispatch","useTypedDispatch","runRbacMiddleware","useStrapiApp","state","rbac","run","location","useLocation","rawQuery","useQueryParams","locationRef","React","useRef","useEffect","current","token","useTypedSelector","admin_app","data","user","isLoading","isLoadingUser","useGetMeQuery","undefined","skip","userPermissions","refetch","isUninitialized","isLoadingPermissions","useGetMyPermissionsQuery","navigate","useNavigate","loginMutation","useLoginMutation","logoutMutation","useLogoutMutation","clearStateAndLogout","useCallback","adminApi","util","resetApiState","logoutAction","preferedLanguage","setLocale","setOnTokenUpdate","newToken","setToken","handleUserStorageChange","event","key","newValue","window","addEventListener","removeEventListener","login","rememberMe","body","res","deviceId","getOrCreateDeviceId","loginAction","persist","logout","refetchPermissions","checkPermissions","useLazyCheckPermissionsQuery","checkUserHasPermissions","permissions","passedPermissions","rawQueryContext","length","action","subject","actualUserPermissions","matchingPermissions","filter","permission","findIndex","perm","middlewaredPermissions","pathname","search","split","shouldCheckConditions","some","Array","isArray","conditions","error","map","_","index","_jsx"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA;;;;;;;;;;;;;;IAeA,MAAMA,+BAAAA,GAA+E,UAAY,EAAE;AAEnG,MAAM,CAACC,QAAAA,EAAUC,OAAAA,CAAQ,GAAGC,qBAAAA,CAAgC,MAAA;AAa5D,MAAMC,YAAAA,GAAe;IAEnBC,MAAAA,EAAQ;AACV;AAEA,MAAMC,YAAAA,GAAe,CAAC,EACpBC,QAAQ,EACRC,sBAAsB,EAAE,EACxBC,kBAAAA,GAAqB,KAAK,EACR,GAAA;AAClB,IAAA,MAAMC,QAAAA,GAAWC,sBAAAA,EAAAA;IACjB,MAAMC,iBAAAA,GAAoBC,uBAAa,cAAA,EAAgB,CAACC,QAAUA,KAAAA,CAAMC,IAAI,CAACC,GAAG,CAAA;AAChF,IAAA,MAAMC,QAAAA,GAAWC,0BAAAA,EAAAA;AACjB,IAAA,MAAM,CAAC,EAAEC,QAAQ,EAAE,CAAC,GAAGC,6BAAAA,EAAAA;IAEvB,MAAMC,WAAAA,GAAcC,gBAAAA,CAAMC,MAAM,CAACN,QAAAA,CAAAA;;AAGjCK,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACdH,QAAAA,WAAAA,CAAYI,OAAO,GAAGR,QAAAA;IACxB,CAAA,EAAG;AAACA,QAAAA;AAAS,KAAA,CAAA;IAEb,MAAMS,KAAAA,GAAQC,uBAAiB,CAACb,KAAAA,GAAUA,MAAMc,SAAS,CAACF,KAAK,IAAI,IAAA,CAAA;IAEnE,MAAM,EAAEG,MAAMC,IAAI,EAAEC,WAAWC,aAAa,EAAE,GAAGC,kBAAAA,CAAcC,SAAAA,EAAW;AACxE;;;AAGC,QACDC,MAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAM,EACJG,IAAAA,EAAMO,eAAAA,GAAkB5B,mBAAmB,EAC3C6B,OAAO,EACPC,eAAe,EACfP,SAAAA,EAAWQ,oBAAoB,EAChC,GAAGC,8BAAyBN,SAAAA,EAAW;AACtCC,QAAAA,IAAAA,EAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAMe,QAAAA,GAAWC,0BAAAA,EAAAA;IAEjB,MAAM,CAACC,cAAc,GAAGC,qBAAAA,EAAAA;IACxB,MAAM,CAACC,eAAe,GAAGC,sBAAAA,EAAAA;IAEzB,MAAMC,mBAAAA,GAAsBzB,gBAAAA,CAAM0B,WAAW,CAAC,IAAA;QAC5CtC,QAAAA,CAASuC,YAAAA,CAASC,IAAI,CAACC,aAAa,EAAA,CAAA;QACpCzC,QAAAA,CAAS0C,cAAAA,EAAAA,CAAAA;QACTX,QAAAA,CAAS,aAAA,CAAA;IACX,CAAA,EAAG;AAAC/B,QAAAA,QAAAA;AAAU+B,QAAAA;AAAS,KAAA,CAAA;AAEvBnB,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACd,QAAA,IAAIM,IAAAA,EAAM;YACR,IAAIA,IAAAA,CAAKuB,gBAAgB,EAAE;gBACzB3C,QAAAA,CAAS4C,iBAAAA,CAAUxB,KAAKuB,gBAAgB,CAAA,CAAA;AAC1C,YAAA;AACF,QAAA;IACF,CAAA,EAAG;AAAC3C,QAAAA,QAAAA;AAAUoB,QAAAA;AAAK,KAAA,CAAA;AAEnB;;;MAIAR,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACd+B,QAAAA,+BAAAA,CAAiB,CAACC,QAAAA,GAAAA;AAChB9C,YAAAA,QAAAA,CAAS+C,gBAAAA,CAASD,QAAAA,CAAAA,CAAAA;AACpB,QAAA,CAAA,CAAA;QAEA,OAAO,IAAA;YACLD,+BAAAA,CAAiB,IAAA,CAAA;AACnB,QAAA,CAAA;IACF,CAAA,EAAG;AAAC7C,QAAAA;AAAS,KAAA,CAAA;AAEbY,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;AACd;;QAGA,MAAMkC,0BAA0B,CAACC,KAAAA,GAAAA;YAC/B,IAAIA,KAAAA,CAAMC,GAAG,KAAKxD,YAAAA,CAAaC,MAAM,IAAIsD,KAAAA,CAAME,QAAQ,KAAK,IAAA,EAAM;AAChEd,gBAAAA,mBAAAA,EAAAA;AACF,YAAA;AACF,QAAA,CAAA;QAEAe,MAAAA,CAAOC,gBAAgB,CAAC,SAAA,EAAWL,uBAAAA,CAAAA;QAEnC,OAAO,IAAA;YACLI,MAAAA,CAAOE,mBAAmB,CAAC,SAAA,EAAWN,uBAAAA,CAAAA;AACxC,QAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEA,MAAMO,KAAAA,GAAQ3C,iBAAM0B,WAAW,CAC7B,OAAO,EAAEkB,UAAU,EAAE,GAAGC,IAAAA,EAAM,GAAA;QAC5B,MAAMC,GAAAA,GAAM,MAAMzB,aAAAA,CAAc;AAAE,YAAA,GAAGwB,IAAI;YAAEE,QAAAA,EAAUC,4BAAAA,EAAAA;AAAuBJ,YAAAA;AAAW,SAAA,CAAA;AAEvF;;;UAIA,IAAI,UAAUE,GAAAA,EAAK;AACjB,YAAA,MAAM,EAAE1C,KAAK,EAAE,GAAG0C,IAAIvC,IAAI;AAE1BnB,YAAAA,QAAAA,CACE6D,aAAAA,CAAY;AACV7C,gBAAAA,KAAAA;gBACA8C,OAAAA,EAASN;AACX,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,OAAOE,GAAAA;IACT,CAAA,EACA;AAAC1D,QAAAA,QAAAA;AAAUiC,QAAAA;AAAc,KAAA,CAAA;IAG3B,MAAM8B,MAAAA,GAASnD,gBAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC/B,QAAA,MAAMH,cAAAA,CAAe;YAAEwB,QAAAA,EAAUC,4BAAAA;AAAsB,SAAA,CAAA;AACvDvB,QAAAA,mBAAAA,EAAAA;IACF,CAAA,EAAG;AAACA,QAAAA,mBAAAA;AAAqBF,QAAAA;AAAe,KAAA,CAAA;IAExC,MAAM6B,kBAAAA,GAAqBpD,gBAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC3C,QAAA,IAAI,CAACV,eAAAA,EAAiB;YACpB,MAAMD,OAAAA,EAAAA;AACR,QAAA;IACF,CAAA,EAAG;AAACC,QAAAA,eAAAA;AAAiBD,QAAAA;AAAQ,KAAA,CAAA;IAE7B,MAAM,CAACsC,iBAAiB,GAAGC,iCAAAA,EAAAA;AAC3B,IAAA,MAAMC,0BAAuEvD,gBAAAA,CAAM0B,WAAW,CAC5F,OACE8B,WAAAA,EACAC;;;;;;;;AAUAC,IAAAA,eAAAA,GAAAA;AAEA;;;;;AAKC,UACD,IAAI,CAACF,WAAAA,IAAeA,WAAAA,CAAYG,MAAM,KAAK,CAAA,EAAG;YAC5C,OAAO;AAAC,gBAAA;oBAAEC,MAAAA,EAAQ,EAAA;oBAAIC,OAAAA,EAAS;AAAG;AAAE,aAAA;AACtC,QAAA;AAEA;;;UAIA,MAAMC,wBAAwBL,iBAAAA,IAAqB3C,eAAAA;AAEnD,QAAA,MAAMiD,sBAAsBD,qBAAAA,CAAsBE,MAAM,CACtD,CAACC,aACCT,WAAAA,CAAYU,SAAS,CACnB,CAACC,OACCA,IAAAA,CAAKP,MAAM,KAAKK,UAAAA,CAAWL,MAAM;iBAEhCO,IAAAA,CAAKN,OAAO,IAAIjD,SAAAA,IAAauD,IAAAA,CAAKN,OAAO,KAAKI,UAAAA,CAAWJ,OAAM,CAAA,CAAA,IAC/D,CAAA,CAAA;QAGT,MAAMO,sBAAAA,GAAyB,MAAM9E,iBAAAA,CACnC;AACEkB,YAAAA,IAAAA;YACAgD,WAAAA,EAAa1C,eAAAA;YACbuD,QAAAA,EAAUtE,WAAAA,CAAYI,OAAO,CAACkE,QAAQ;YACtCC,MAAAA,EAASZ,CAAAA,eAAAA,IAAmB7D,QAAO,EAAG0E,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI;SACzD,EACAR,mBAAAA,CAAAA;AAGF,QAAA,MAAMS,wBAAwBJ,sBAAAA,CAAuBK,IAAI,CACvD,CAACN,OAASO,KAAAA,CAAMC,OAAO,CAACR,IAAAA,CAAKS,UAAU,CAAA,IAAKT,IAAAA,CAAKS,UAAU,CAACjB,MAAM,GAAG,CAAA,CAAA;AAGvE,QAAA,IAAI,CAACa,qBAAAA,EAAuB;YAC1B,OAAOJ,sBAAAA;AACT,QAAA;AAEA,QAAA,MAAM,EAAE7D,IAAI,EAAEsE,KAAK,EAAE,GAAG,MAAMxB,gBAAAA,CAAiB;AAC7CG,YAAAA,WAAAA,EAAaY,sBAAAA,CAAuBU,GAAG,CAAC,CAACX,QAAU;AACjDP,oBAAAA,MAAAA,EAAQO,KAAKP,MAAM;AACnBC,oBAAAA,OAAAA,EAASM,KAAKN;iBAChB,CAAA;AACF,SAAA,CAAA;AAEA,QAAA,IAAIgB,KAAAA,EAAO;YACT,MAAMA,KAAAA;QACR,CAAA,MAAO;YACL,OAAOT,sBAAAA,CAAuBJ,MAAM,CAAC,CAACe,CAAAA,EAAGC,QAAUzE,IAAAA,EAAMA,IAAI,CAACyE,KAAAA,CAAM,KAAK,IAAA,CAAA;AAC3E,QAAA;IACF,CAAA,EACA;AAAC3B,QAAAA,gBAAAA;AAAkBxD,QAAAA,QAAAA;AAAUP,QAAAA,iBAAAA;AAAmBkB,QAAAA,IAAAA;AAAMM,QAAAA;AAAgB,KAAA,CAAA;AAGxE,IAAA,MAAML,YAAYC,aAAAA,IAAiBO,oBAAAA;AAEnC,IAAA,qBACEgE,cAAA,CAACtG,QAAAA,EAAAA;QACCyB,KAAAA,EAAOA,KAAAA;QACPI,IAAAA,EAAMA,IAAAA;QACNmC,KAAAA,EAAOA,KAAAA;QACPQ,MAAAA,EAAQA,MAAAA;QACRK,WAAAA,EAAa1C,eAAAA;AACbyC,QAAAA,uBAAAA,EAAyBA,uBAAAA,IAA2B7E,+BAAAA;QACpD0E,kBAAAA,EAAoBA,kBAAAA;QACpB3C,SAAAA,EAAWA,SAAAA;AAEVxB,QAAAA,QAAAA,EAAAA;;AAGP;;;;;;"}

package/dist/admin/admin/src/features/Auth.mjs

@@ -11,6 +11,21 @@ import { useGetMeQuery, useGetMyPermissionsQuery, useLoginMutation, useLogoutMut
 import { getOrCreateDeviceId } from '../utils/deviceId.mjs';
 import { setOnTokenUpdate } from '../utils/getFetchClient.mjs';
 
+/**
+ * ensure the Auth context never exposes a non-function for checkUserHasPermissions.
+ * When this is undefined (e.g. context timing in production builds), consumers would throw
+ * "p is not a function" / "checkUserHasPermissions is not a function". By always passing
+ * a function here, all current and future consumers are protected without per-call-site guards.
+ *
+ * When would the fallback run? Only if the real checkUserHasPermissions were ever undefined
+ * when we pass to the Provider (e.g. a rare timing/build edge case). In normal runs it is
+ * always defined (useCallback), so the real function is passed and behavior is unchanged.
+ *
+ * If the fallback ever did run: it returns [] so consumers (which use .length > 0) treat it
+ * as "no permission" for that render—under-permissive. On the next AuthProvider re-render we
+ * pass the real function again, so the context updates and the view corrects quickly.
+ * @see https://github.com/strapi/strapi/issues/24384
+ */ const NOOP_CHECK_USER_HAS_PERMISSIONS = async ()=>[];
 const [Provider, useAuth] = createContext('Auth');
 const STORAGE_KEYS = {
     STATUS: 'isLoggedIn'
@@ -186,7 +201,7 @@ const AuthProvider = ({ children, _defaultPermissions = [], _disableRenewToken =
         login: login$1,
         logout: logout$1,
         permissions: userPermissions,
-        checkUserHasPermissions: checkUserHasPermissions,
+        checkUserHasPermissions: checkUserHasPermissions ?? NOOP_CHECK_USER_HAS_PERMISSIONS,
         refetchPermissions: refetchPermissions,
         isLoading: isLoading,
         children: children

package/dist/admin/admin/src/features/Auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Auth.mjs","sources":["../../../../../admin/src/features/Auth.tsx"],"sourcesContent":["import * as React from 'react';\n\nimport { useLocation, useNavigate } from 'react-router-dom';\n\nimport { Login } from '../../../shared/contracts/authentication';\nimport { createContext } from '../components/Context';\nimport { useTypedDispatch, useTypedSelector } from '../core/store/hooks';\nimport { useStrapiApp } from '../features/StrapiApp';\nimport { useQueryParams } from '../hooks/useQueryParams';\nimport { login as loginAction, logout as logoutAction, setLocale, setToken } from '../reducer';\nimport { adminApi } from '../services/api';\nimport {\n  useGetMeQuery,\n  useGetMyPermissionsQuery,\n  useLazyCheckPermissionsQuery,\n  useLoginMutation,\n  useLogoutMutation,\n} from '../services/auth';\nimport { getOrCreateDeviceId } from '../utils/deviceId';\nimport { setOnTokenUpdate } from '../utils/getFetchClient';\n\nimport type {\n  Permission as PermissionContract,\n  SanitizedAdminUser,\n} from '../../../shared/contracts/shared';\n\ninterface Permission\n  extends Pick<PermissionContract, 'action' | 'subject'>,\n    Partial<Omit<PermissionContract, 'action' | 'subject'>> {}\n\ninterface User\n  extends Pick<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>,\n    Partial<Omit<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>> {}\n\ninterface AuthContextValue {\n  login: (\n    body: Login.Request['body'] & { rememberMe: boolean }\n  ) => Promise<Awaited<ReturnType<ReturnType<typeof useLoginMutation>[0]>>>;\n  logout: () => Promise<void>;\n  /**\n   * @alpha\n   * @description given a list of permissions, this function checks\n   * those against the current user's permissions or those passed as\n   * the second argument, if the user has those permissions the complete\n   * permission object form the API is returned. Therefore, if the list is\n   * empty, the user does not have any of those permissions.\n   */\n  checkUserHasPermissions: (\n    permissions?: Array<Pick<Permission, 'action'> & Partial<Omit<Permission, 'action'>>>,\n    passedPermissions?: Permission[],\n    rawQueryContext?: string\n  ) => Promise<Permission[]>;\n  isLoading: boolean;\n  permissions: Permission[];\n  refetchPermissions: () => Promise<void>;\n  token: string | null;\n  user?: User;\n}\n\nconst [Provider, useAuth] = createContext<AuthContextValue>('Auth');\n\ninterface AuthProviderProps {\n  children: React.ReactNode;\n  /**\n   * @internal could be removed at any time.\n   */\n  _defaultPermissions?: Permission[];\n\n  // NOTE: this is used for testing purposed only\n  _disableRenewToken?: boolean;\n}\n\nconst STORAGE_KEYS = {\n  TOKEN: 'jwtToken',\n  STATUS: 'isLoggedIn',\n};\n\nconst AuthProvider = ({\n  children,\n  _defaultPermissions = [],\n  _disableRenewToken = false,\n}: AuthProviderProps) => {\n  const dispatch = useTypedDispatch();\n  const runRbacMiddleware = useStrapiApp('AuthProvider', (state) => state.rbac.run);\n  const location = useLocation();\n  const [{ rawQuery }] = useQueryParams();\n\n  const locationRef = React.useRef(location);\n\n  // Update ref without causing re-render\n  React.useEffect(() => {\n    locationRef.current = location;\n  }, [location]);\n\n  const token = useTypedSelector((state) => state.admin_app.token ?? null);\n\n  const { data: user, isLoading: isLoadingUser } = useGetMeQuery(undefined, {\n    /**\n     * If there's no token, we don't try to fetch\n     * the user data because it will fail.\n     */\n    skip: !token,\n  });\n\n  const {\n    data: userPermissions = _defaultPermissions,\n    refetch,\n    isUninitialized,\n    isLoading: isLoadingPermissions,\n  } = useGetMyPermissionsQuery(undefined, {\n    skip: !token,\n  });\n\n  const navigate = useNavigate();\n\n  const [loginMutation] = useLoginMutation();\n  const [logoutMutation] = useLogoutMutation();\n\n  const clearStateAndLogout = React.useCallback(() => {\n    dispatch(adminApi.util.resetApiState());\n    dispatch(logoutAction());\n    navigate('/auth/login');\n  }, [dispatch, navigate]);\n\n  React.useEffect(() => {\n    if (user) {\n      if (user.preferedLanguage) {\n        dispatch(setLocale(user.preferedLanguage));\n      }\n    }\n  }, [dispatch, user]);\n\n  /**\n   * Register a callback to update Redux state when the token is refreshed.\n   * This ensures the app state stays in sync with the token stored in localStorage/cookies.\n   */\n  React.useEffect(() => {\n    setOnTokenUpdate((newToken) => {\n      dispatch(setToken(newToken));\n    });\n\n    return () => {\n      setOnTokenUpdate(null);\n    };\n  }, [dispatch]);\n\n  React.useEffect(() => {\n    /**\n     * This will log a user out of all tabs if they log out in one tab.\n     */\n    const handleUserStorageChange = (event: StorageEvent) => {\n      if (event.key === STORAGE_KEYS.STATUS && event.newValue === null) {\n        clearStateAndLogout();\n      }\n    };\n\n    window.addEventListener('storage', handleUserStorageChange);\n\n    return () => {\n      window.removeEventListener('storage', handleUserStorageChange);\n    };\n  });\n\n  const login = React.useCallback<AuthContextValue['login']>(\n    async ({ rememberMe, ...body }) => {\n      const res = await loginMutation({ ...body, deviceId: getOrCreateDeviceId(), rememberMe });\n\n      /**\n       * There will always be a `data` key in the response\n       * because if something fails, it will throw an error.\n       */\n      if ('data' in res) {\n        const { token } = res.data;\n\n        dispatch(\n          loginAction({\n            token,\n            persist: rememberMe,\n          })\n        );\n      }\n\n      return res;\n    },\n    [dispatch, loginMutation]\n  );\n\n  const logout = React.useCallback(async () => {\n    await logoutMutation({ deviceId: getOrCreateDeviceId() });\n    clearStateAndLogout();\n  }, [clearStateAndLogout, logoutMutation]);\n\n  const refetchPermissions = React.useCallback(async () => {\n    if (!isUninitialized) {\n      await refetch();\n    }\n  }, [isUninitialized, refetch]);\n\n  const [checkPermissions] = useLazyCheckPermissionsQuery();\n  const checkUserHasPermissions: AuthContextValue['checkUserHasPermissions'] = React.useCallback(\n    async (\n      permissions,\n      passedPermissions,\n      // TODO:\n      // Here we have parameterised checkUserHasPermissions in order to pass\n      // query context from elsewhere in the application.\n      // See packages/core/content-manager/admin/src/features/DocumentRBAC.tsx\n\n      // This is in order to calculate permissions on accurate query params.\n      // We should be able to rely on the query params in this provider\n      // If we need to pass additional context to the RBAC middleware\n      // we should define a better context type.\n      rawQueryContext\n    ) => {\n      /**\n       * If there's no permissions to check, then we allow it to\n       * pass to preserve existing behaviours.\n       *\n       * TODO: should we review this? it feels more dangerous than useful.\n       */\n      if (!permissions || permissions.length === 0) {\n        return [{ action: '', subject: '' }];\n      }\n\n      /**\n       * Given the provided permissions, return the permissions from either passedPermissions\n       * or userPermissions as this is expected to be the full permission entity.\n       */\n      const actualUserPermissions = passedPermissions ?? userPermissions;\n\n      const matchingPermissions = actualUserPermissions.filter(\n        (permission) =>\n          permissions.findIndex(\n            (perm) =>\n              perm.action === permission.action &&\n              // Only check the subject if it's provided\n              (perm.subject == undefined || perm.subject === permission.subject)\n          ) >= 0\n      );\n\n      const middlewaredPermissions = await runRbacMiddleware(\n        {\n          user,\n          permissions: userPermissions,\n          pathname: locationRef.current.pathname,\n          search: (rawQueryContext || rawQuery).split('?')[1] ?? '',\n        },\n        matchingPermissions\n      );\n\n      const shouldCheckConditions = middlewaredPermissions.some(\n        (perm) => Array.isArray(perm.conditions) && perm.conditions.length > 0\n      );\n\n      if (!shouldCheckConditions) {\n        return middlewaredPermissions;\n      }\n\n      const { data, error } = await checkPermissions({\n        permissions: middlewaredPermissions.map((perm) => ({\n          action: perm.action,\n          subject: perm.subject,\n        })),\n      });\n\n      if (error) {\n        throw error;\n      } else {\n        return middlewaredPermissions.filter((_, index) => data?.data[index] === true);\n      }\n    },\n    [checkPermissions, rawQuery, runRbacMiddleware, user, userPermissions]\n  );\n\n  const isLoading = isLoadingUser || isLoadingPermissions;\n\n  return (\n    <Provider\n      token={token}\n      user={user}\n      login={login}\n      logout={logout}\n      permissions={userPermissions}\n      checkUserHasPermissions={checkUserHasPermissions}\n      refetchPermissions={refetchPermissions}\n      isLoading={isLoading}\n    >\n      {children}\n    </Provider>\n  );\n};\n\nexport { AuthProvider, useAuth, STORAGE_KEYS };\nexport type { AuthContextValue, Permission, User };\n"],"names":["Provider","useAuth","createContext","STORAGE_KEYS","STATUS","AuthProvider","children","_defaultPermissions","_disableRenewToken","dispatch","useTypedDispatch","runRbacMiddleware","useStrapiApp","state","rbac","run","location","useLocation","rawQuery","useQueryParams","locationRef","React","useRef","useEffect","current","token","useTypedSelector","admin_app","data","user","isLoading","isLoadingUser","useGetMeQuery","undefined","skip","userPermissions","refetch","isUninitialized","isLoadingPermissions","useGetMyPermissionsQuery","navigate","useNavigate","loginMutation","useLoginMutation","logoutMutation","useLogoutMutation","clearStateAndLogout","useCallback","adminApi","util","resetApiState","logoutAction","preferedLanguage","setLocale","setOnTokenUpdate","newToken","setToken","handleUserStorageChange","event","key","newValue","window","addEventListener","removeEventListener","login","rememberMe","body","res","deviceId","getOrCreateDeviceId","loginAction","persist","logout","refetchPermissions","checkPermissions","useLazyCheckPermissionsQuery","checkUserHasPermissions","permissions","passedPermissions","rawQueryContext","length","action","subject","actualUserPermissions","matchingPermissions","filter","permission","findIndex","perm","middlewaredPermissions","pathname","search","split","shouldCheckConditions","some","Array","isArray","conditions","error","map","_","index","_jsx"],"mappings":";;;;;;;;;;;;;AA2DA,MAAM,CAACA,QAAAA,EAAUC,OAAAA,CAAQ,GAAGC,aAAAA,CAAgC,MAAA;AAa5D,MAAMC,YAAAA,GAAe;IAEnBC,MAAAA,EAAQ;AACV;AAEA,MAAMC,YAAAA,GAAe,CAAC,EACpBC,QAAQ,EACRC,sBAAsB,EAAE,EACxBC,kBAAAA,GAAqB,KAAK,EACR,GAAA;AAClB,IAAA,MAAMC,QAAAA,GAAWC,gBAAAA,EAAAA;IACjB,MAAMC,iBAAAA,GAAoBC,aAAa,cAAA,EAAgB,CAACC,QAAUA,KAAAA,CAAMC,IAAI,CAACC,GAAG,CAAA;AAChF,IAAA,MAAMC,QAAAA,GAAWC,WAAAA,EAAAA;AACjB,IAAA,MAAM,CAAC,EAAEC,QAAQ,EAAE,CAAC,GAAGC,cAAAA,EAAAA;IAEvB,MAAMC,WAAAA,GAAcC,KAAAA,CAAMC,MAAM,CAACN,QAAAA,CAAAA;;AAGjCK,IAAAA,KAAAA,CAAME,SAAS,CAAC,IAAA;AACdH,QAAAA,WAAAA,CAAYI,OAAO,GAAGR,QAAAA;IACxB,CAAA,EAAG;AAACA,QAAAA;AAAS,KAAA,CAAA;IAEb,MAAMS,KAAAA,GAAQC,iBAAiB,CAACb,KAAAA,GAAUA,MAAMc,SAAS,CAACF,KAAK,IAAI,IAAA,CAAA;IAEnE,MAAM,EAAEG,MAAMC,IAAI,EAAEC,WAAWC,aAAa,EAAE,GAAGC,aAAAA,CAAcC,SAAAA,EAAW;AACxE;;;AAGC,QACDC,MAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAM,EACJG,IAAAA,EAAMO,eAAAA,GAAkB5B,mBAAmB,EAC3C6B,OAAO,EACPC,eAAe,EACfP,SAAAA,EAAWQ,oBAAoB,EAChC,GAAGC,yBAAyBN,SAAAA,EAAW;AACtCC,QAAAA,IAAAA,EAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAMe,QAAAA,GAAWC,WAAAA,EAAAA;IAEjB,MAAM,CAACC,cAAc,GAAGC,gBAAAA,EAAAA;IACxB,MAAM,CAACC,eAAe,GAAGC,iBAAAA,EAAAA;IAEzB,MAAMC,mBAAAA,GAAsBzB,KAAAA,CAAM0B,WAAW,CAAC,IAAA;QAC5CtC,QAAAA,CAASuC,QAAAA,CAASC,IAAI,CAACC,aAAa,EAAA,CAAA;QACpCzC,QAAAA,CAAS0C,MAAAA,EAAAA,CAAAA;QACTX,QAAAA,CAAS,aAAA,CAAA;IACX,CAAA,EAAG;AAAC/B,QAAAA,QAAAA;AAAU+B,QAAAA;AAAS,KAAA,CAAA;AAEvBnB,IAAAA,KAAAA,CAAME,SAAS,CAAC,IAAA;AACd,QAAA,IAAIM,IAAAA,EAAM;YACR,IAAIA,IAAAA,CAAKuB,gBAAgB,EAAE;gBACzB3C,QAAAA,CAAS4C,SAAAA,CAAUxB,KAAKuB,gBAAgB,CAAA,CAAA;AAC1C,YAAA;AACF,QAAA;IACF,CAAA,EAAG;AAAC3C,QAAAA,QAAAA;AAAUoB,QAAAA;AAAK,KAAA,CAAA;AAEnB;;;MAIAR,KAAAA,CAAME,SAAS,CAAC,IAAA;AACd+B,QAAAA,gBAAAA,CAAiB,CAACC,QAAAA,GAAAA;AAChB9C,YAAAA,QAAAA,CAAS+C,QAAAA,CAASD,QAAAA,CAAAA,CAAAA;AACpB,QAAA,CAAA,CAAA;QAEA,OAAO,IAAA;YACLD,gBAAAA,CAAiB,IAAA,CAAA;AACnB,QAAA,CAAA;IACF,CAAA,EAAG;AAAC7C,QAAAA;AAAS,KAAA,CAAA;AAEbY,IAAAA,KAAAA,CAAME,SAAS,CAAC,IAAA;AACd;;QAGA,MAAMkC,0BAA0B,CAACC,KAAAA,GAAAA;YAC/B,IAAIA,KAAAA,CAAMC,GAAG,KAAKxD,YAAAA,CAAaC,MAAM,IAAIsD,KAAAA,CAAME,QAAQ,KAAK,IAAA,EAAM;AAChEd,gBAAAA,mBAAAA,EAAAA;AACF,YAAA;AACF,QAAA,CAAA;QAEAe,MAAAA,CAAOC,gBAAgB,CAAC,SAAA,EAAWL,uBAAAA,CAAAA;QAEnC,OAAO,IAAA;YACLI,MAAAA,CAAOE,mBAAmB,CAAC,SAAA,EAAWN,uBAAAA,CAAAA;AACxC,QAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEA,MAAMO,OAAAA,GAAQ3C,MAAM0B,WAAW,CAC7B,OAAO,EAAEkB,UAAU,EAAE,GAAGC,IAAAA,EAAM,GAAA;QAC5B,MAAMC,GAAAA,GAAM,MAAMzB,aAAAA,CAAc;AAAE,YAAA,GAAGwB,IAAI;YAAEE,QAAAA,EAAUC,mBAAAA,EAAAA;AAAuBJ,YAAAA;AAAW,SAAA,CAAA;AAEvF;;;UAIA,IAAI,UAAUE,GAAAA,EAAK;AACjB,YAAA,MAAM,EAAE1C,KAAK,EAAE,GAAG0C,IAAIvC,IAAI;AAE1BnB,YAAAA,QAAAA,CACE6D,KAAAA,CAAY;AACV7C,gBAAAA,KAAAA;gBACA8C,OAAAA,EAASN;AACX,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,OAAOE,GAAAA;IACT,CAAA,EACA;AAAC1D,QAAAA,QAAAA;AAAUiC,QAAAA;AAAc,KAAA,CAAA;IAG3B,MAAM8B,QAAAA,GAASnD,KAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC/B,QAAA,MAAMH,cAAAA,CAAe;YAAEwB,QAAAA,EAAUC,mBAAAA;AAAsB,SAAA,CAAA;AACvDvB,QAAAA,mBAAAA,EAAAA;IACF,CAAA,EAAG;AAACA,QAAAA,mBAAAA;AAAqBF,QAAAA;AAAe,KAAA,CAAA;IAExC,MAAM6B,kBAAAA,GAAqBpD,KAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC3C,QAAA,IAAI,CAACV,eAAAA,EAAiB;YACpB,MAAMD,OAAAA,EAAAA;AACR,QAAA;IACF,CAAA,EAAG;AAACC,QAAAA,eAAAA;AAAiBD,QAAAA;AAAQ,KAAA,CAAA;IAE7B,MAAM,CAACsC,iBAAiB,GAAGC,4BAAAA,EAAAA;AAC3B,IAAA,MAAMC,0BAAuEvD,KAAAA,CAAM0B,WAAW,CAC5F,OACE8B,WAAAA,EACAC;;;;;;;;AAUAC,IAAAA,eAAAA,GAAAA;AAEA;;;;;AAKC,UACD,IAAI,CAACF,WAAAA,IAAeA,WAAAA,CAAYG,MAAM,KAAK,CAAA,EAAG;YAC5C,OAAO;AAAC,gBAAA;oBAAEC,MAAAA,EAAQ,EAAA;oBAAIC,OAAAA,EAAS;AAAG;AAAE,aAAA;AACtC,QAAA;AAEA;;;UAIA,MAAMC,wBAAwBL,iBAAAA,IAAqB3C,eAAAA;AAEnD,QAAA,MAAMiD,sBAAsBD,qBAAAA,CAAsBE,MAAM,CACtD,CAACC,aACCT,WAAAA,CAAYU,SAAS,CACnB,CAACC,OACCA,IAAAA,CAAKP,MAAM,KAAKK,UAAAA,CAAWL,MAAM;iBAEhCO,IAAAA,CAAKN,OAAO,IAAIjD,SAAAA,IAAauD,IAAAA,CAAKN,OAAO,KAAKI,UAAAA,CAAWJ,OAAM,CAAA,CAAA,IAC/D,CAAA,CAAA;QAGT,MAAMO,sBAAAA,GAAyB,MAAM9E,iBAAAA,CACnC;AACEkB,YAAAA,IAAAA;YACAgD,WAAAA,EAAa1C,eAAAA;YACbuD,QAAAA,EAAUtE,WAAAA,CAAYI,OAAO,CAACkE,QAAQ;YACtCC,MAAAA,EAASZ,CAAAA,eAAAA,IAAmB7D,QAAO,EAAG0E,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI;SACzD,EACAR,mBAAAA,CAAAA;AAGF,QAAA,MAAMS,wBAAwBJ,sBAAAA,CAAuBK,IAAI,CACvD,CAACN,OAASO,KAAAA,CAAMC,OAAO,CAACR,IAAAA,CAAKS,UAAU,CAAA,IAAKT,IAAAA,CAAKS,UAAU,CAACjB,MAAM,GAAG,CAAA,CAAA;AAGvE,QAAA,IAAI,CAACa,qBAAAA,EAAuB;YAC1B,OAAOJ,sBAAAA;AACT,QAAA;AAEA,QAAA,MAAM,EAAE7D,IAAI,EAAEsE,KAAK,EAAE,GAAG,MAAMxB,gBAAAA,CAAiB;AAC7CG,YAAAA,WAAAA,EAAaY,sBAAAA,CAAuBU,GAAG,CAAC,CAACX,QAAU;AACjDP,oBAAAA,MAAAA,EAAQO,KAAKP,MAAM;AACnBC,oBAAAA,OAAAA,EAASM,KAAKN;iBAChB,CAAA;AACF,SAAA,CAAA;AAEA,QAAA,IAAIgB,KAAAA,EAAO;YACT,MAAMA,KAAAA;QACR,CAAA,MAAO;YACL,OAAOT,sBAAAA,CAAuBJ,MAAM,CAAC,CAACe,CAAAA,EAAGC,QAAUzE,IAAAA,EAAMA,IAAI,CAACyE,KAAAA,CAAM,KAAK,IAAA,CAAA;AAC3E,QAAA;IACF,CAAA,EACA;AAAC3B,QAAAA,gBAAAA;AAAkBxD,QAAAA,QAAAA;AAAUP,QAAAA,iBAAAA;AAAmBkB,QAAAA,IAAAA;AAAMM,QAAAA;AAAgB,KAAA,CAAA;AAGxE,IAAA,MAAML,YAAYC,aAAAA,IAAiBO,oBAAAA;AAEnC,IAAA,qBACEgE,GAAA,CAACtG,QAAAA,EAAAA;QACCyB,KAAAA,EAAOA,KAAAA;QACPI,IAAAA,EAAMA,IAAAA;QACNmC,KAAAA,EAAOA,OAAAA;QACPQ,MAAAA,EAAQA,QAAAA;QACRK,WAAAA,EAAa1C,eAAAA;QACbyC,uBAAAA,EAAyBA,uBAAAA;QACzBH,kBAAAA,EAAoBA,kBAAAA;QACpB3C,SAAAA,EAAWA,SAAAA;AAEVxB,QAAAA,QAAAA,EAAAA;;AAGP;;;;"}
+{"version":3,"file":"Auth.mjs","sources":["../../../../../admin/src/features/Auth.tsx"],"sourcesContent":["import * as React from 'react';\n\nimport { useLocation, useNavigate } from 'react-router-dom';\n\nimport { Login } from '../../../shared/contracts/authentication';\nimport { createContext } from '../components/Context';\nimport { useTypedDispatch, useTypedSelector } from '../core/store/hooks';\nimport { useStrapiApp } from '../features/StrapiApp';\nimport { useQueryParams } from '../hooks/useQueryParams';\nimport { login as loginAction, logout as logoutAction, setLocale, setToken } from '../reducer';\nimport { adminApi } from '../services/api';\nimport {\n  useGetMeQuery,\n  useGetMyPermissionsQuery,\n  useLazyCheckPermissionsQuery,\n  useLoginMutation,\n  useLogoutMutation,\n} from '../services/auth';\nimport { getOrCreateDeviceId } from '../utils/deviceId';\nimport { setOnTokenUpdate } from '../utils/getFetchClient';\n\nimport type {\n  Permission as PermissionContract,\n  SanitizedAdminUser,\n} from '../../../shared/contracts/shared';\n\ninterface Permission\n  extends Pick<PermissionContract, 'action' | 'subject'>,\n    Partial<Omit<PermissionContract, 'action' | 'subject'>> {}\n\ninterface User\n  extends Pick<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>,\n    Partial<Omit<SanitizedAdminUser, 'email' | 'firstname' | 'lastname' | 'username' | 'roles'>> {}\n\ninterface AuthContextValue {\n  login: (\n    body: Login.Request['body'] & { rememberMe: boolean }\n  ) => Promise<Awaited<ReturnType<ReturnType<typeof useLoginMutation>[0]>>>;\n  logout: () => Promise<void>;\n  /**\n   * @alpha\n   * @description given a list of permissions, this function checks\n   * those against the current user's permissions or those passed as\n   * the second argument, if the user has those permissions the complete\n   * permission object form the API is returned. Therefore, if the list is\n   * empty, the user does not have any of those permissions.\n   */\n  checkUserHasPermissions: (\n    permissions?: Array<Pick<Permission, 'action'> & Partial<Omit<Permission, 'action'>>>,\n    passedPermissions?: Permission[],\n    rawQueryContext?: string\n  ) => Promise<Permission[]>;\n  isLoading: boolean;\n  permissions: Permission[];\n  refetchPermissions: () => Promise<void>;\n  token: string | null;\n  user?: User;\n}\n\n/**\n * ensure the Auth context never exposes a non-function for checkUserHasPermissions.\n * When this is undefined (e.g. context timing in production builds), consumers would throw\n * \"p is not a function\" / \"checkUserHasPermissions is not a function\". By always passing\n * a function here, all current and future consumers are protected without per-call-site guards.\n *\n * When would the fallback run? Only if the real checkUserHasPermissions were ever undefined\n * when we pass to the Provider (e.g. a rare timing/build edge case). In normal runs it is\n * always defined (useCallback), so the real function is passed and behavior is unchanged.\n *\n * If the fallback ever did run: it returns [] so consumers (which use .length > 0) treat it\n * as \"no permission\" for that render—under-permissive. On the next AuthProvider re-render we\n * pass the real function again, so the context updates and the view corrects quickly.\n * @see https://github.com/strapi/strapi/issues/24384\n */\nconst NOOP_CHECK_USER_HAS_PERMISSIONS: AuthContextValue['checkUserHasPermissions'] = async () => [];\n\nconst [Provider, useAuth] = createContext<AuthContextValue>('Auth');\n\ninterface AuthProviderProps {\n  children: React.ReactNode;\n  /**\n   * @internal could be removed at any time.\n   */\n  _defaultPermissions?: Permission[];\n\n  // NOTE: this is used for testing purposed only\n  _disableRenewToken?: boolean;\n}\n\nconst STORAGE_KEYS = {\n  TOKEN: 'jwtToken',\n  STATUS: 'isLoggedIn',\n};\n\nconst AuthProvider = ({\n  children,\n  _defaultPermissions = [],\n  _disableRenewToken = false,\n}: AuthProviderProps) => {\n  const dispatch = useTypedDispatch();\n  const runRbacMiddleware = useStrapiApp('AuthProvider', (state) => state.rbac.run);\n  const location = useLocation();\n  const [{ rawQuery }] = useQueryParams();\n\n  const locationRef = React.useRef(location);\n\n  // Update ref without causing re-render\n  React.useEffect(() => {\n    locationRef.current = location;\n  }, [location]);\n\n  const token = useTypedSelector((state) => state.admin_app.token ?? null);\n\n  const { data: user, isLoading: isLoadingUser } = useGetMeQuery(undefined, {\n    /**\n     * If there's no token, we don't try to fetch\n     * the user data because it will fail.\n     */\n    skip: !token,\n  });\n\n  const {\n    data: userPermissions = _defaultPermissions,\n    refetch,\n    isUninitialized,\n    isLoading: isLoadingPermissions,\n  } = useGetMyPermissionsQuery(undefined, {\n    skip: !token,\n  });\n\n  const navigate = useNavigate();\n\n  const [loginMutation] = useLoginMutation();\n  const [logoutMutation] = useLogoutMutation();\n\n  const clearStateAndLogout = React.useCallback(() => {\n    dispatch(adminApi.util.resetApiState());\n    dispatch(logoutAction());\n    navigate('/auth/login');\n  }, [dispatch, navigate]);\n\n  React.useEffect(() => {\n    if (user) {\n      if (user.preferedLanguage) {\n        dispatch(setLocale(user.preferedLanguage));\n      }\n    }\n  }, [dispatch, user]);\n\n  /**\n   * Register a callback to update Redux state when the token is refreshed.\n   * This ensures the app state stays in sync with the token stored in localStorage/cookies.\n   */\n  React.useEffect(() => {\n    setOnTokenUpdate((newToken) => {\n      dispatch(setToken(newToken));\n    });\n\n    return () => {\n      setOnTokenUpdate(null);\n    };\n  }, [dispatch]);\n\n  React.useEffect(() => {\n    /**\n     * This will log a user out of all tabs if they log out in one tab.\n     */\n    const handleUserStorageChange = (event: StorageEvent) => {\n      if (event.key === STORAGE_KEYS.STATUS && event.newValue === null) {\n        clearStateAndLogout();\n      }\n    };\n\n    window.addEventListener('storage', handleUserStorageChange);\n\n    return () => {\n      window.removeEventListener('storage', handleUserStorageChange);\n    };\n  });\n\n  const login = React.useCallback<AuthContextValue['login']>(\n    async ({ rememberMe, ...body }) => {\n      const res = await loginMutation({ ...body, deviceId: getOrCreateDeviceId(), rememberMe });\n\n      /**\n       * There will always be a `data` key in the response\n       * because if something fails, it will throw an error.\n       */\n      if ('data' in res) {\n        const { token } = res.data;\n\n        dispatch(\n          loginAction({\n            token,\n            persist: rememberMe,\n          })\n        );\n      }\n\n      return res;\n    },\n    [dispatch, loginMutation]\n  );\n\n  const logout = React.useCallback(async () => {\n    await logoutMutation({ deviceId: getOrCreateDeviceId() });\n    clearStateAndLogout();\n  }, [clearStateAndLogout, logoutMutation]);\n\n  const refetchPermissions = React.useCallback(async () => {\n    if (!isUninitialized) {\n      await refetch();\n    }\n  }, [isUninitialized, refetch]);\n\n  const [checkPermissions] = useLazyCheckPermissionsQuery();\n  const checkUserHasPermissions: AuthContextValue['checkUserHasPermissions'] = React.useCallback(\n    async (\n      permissions,\n      passedPermissions,\n      // TODO:\n      // Here we have parameterised checkUserHasPermissions in order to pass\n      // query context from elsewhere in the application.\n      // See packages/core/content-manager/admin/src/features/DocumentRBAC.tsx\n\n      // This is in order to calculate permissions on accurate query params.\n      // We should be able to rely on the query params in this provider\n      // If we need to pass additional context to the RBAC middleware\n      // we should define a better context type.\n      rawQueryContext\n    ) => {\n      /**\n       * If there's no permissions to check, then we allow it to\n       * pass to preserve existing behaviours.\n       *\n       * TODO: should we review this? it feels more dangerous than useful.\n       */\n      if (!permissions || permissions.length === 0) {\n        return [{ action: '', subject: '' }];\n      }\n\n      /**\n       * Given the provided permissions, return the permissions from either passedPermissions\n       * or userPermissions as this is expected to be the full permission entity.\n       */\n      const actualUserPermissions = passedPermissions ?? userPermissions;\n\n      const matchingPermissions = actualUserPermissions.filter(\n        (permission) =>\n          permissions.findIndex(\n            (perm) =>\n              perm.action === permission.action &&\n              // Only check the subject if it's provided\n              (perm.subject == undefined || perm.subject === permission.subject)\n          ) >= 0\n      );\n\n      const middlewaredPermissions = await runRbacMiddleware(\n        {\n          user,\n          permissions: userPermissions,\n          pathname: locationRef.current.pathname,\n          search: (rawQueryContext || rawQuery).split('?')[1] ?? '',\n        },\n        matchingPermissions\n      );\n\n      const shouldCheckConditions = middlewaredPermissions.some(\n        (perm) => Array.isArray(perm.conditions) && perm.conditions.length > 0\n      );\n\n      if (!shouldCheckConditions) {\n        return middlewaredPermissions;\n      }\n\n      const { data, error } = await checkPermissions({\n        permissions: middlewaredPermissions.map((perm) => ({\n          action: perm.action,\n          subject: perm.subject,\n        })),\n      });\n\n      if (error) {\n        throw error;\n      } else {\n        return middlewaredPermissions.filter((_, index) => data?.data[index] === true);\n      }\n    },\n    [checkPermissions, rawQuery, runRbacMiddleware, user, userPermissions]\n  );\n\n  const isLoading = isLoadingUser || isLoadingPermissions;\n\n  return (\n    <Provider\n      token={token}\n      user={user}\n      login={login}\n      logout={logout}\n      permissions={userPermissions}\n      checkUserHasPermissions={checkUserHasPermissions ?? NOOP_CHECK_USER_HAS_PERMISSIONS}\n      refetchPermissions={refetchPermissions}\n      isLoading={isLoading}\n    >\n      {children}\n    </Provider>\n  );\n};\n\nexport { AuthProvider, useAuth, STORAGE_KEYS };\nexport type { AuthContextValue, Permission, User };\n"],"names":["NOOP_CHECK_USER_HAS_PERMISSIONS","Provider","useAuth","createContext","STORAGE_KEYS","STATUS","AuthProvider","children","_defaultPermissions","_disableRenewToken","dispatch","useTypedDispatch","runRbacMiddleware","useStrapiApp","state","rbac","run","location","useLocation","rawQuery","useQueryParams","locationRef","React","useRef","useEffect","current","token","useTypedSelector","admin_app","data","user","isLoading","isLoadingUser","useGetMeQuery","undefined","skip","userPermissions","refetch","isUninitialized","isLoadingPermissions","useGetMyPermissionsQuery","navigate","useNavigate","loginMutation","useLoginMutation","logoutMutation","useLogoutMutation","clearStateAndLogout","useCallback","adminApi","util","resetApiState","logoutAction","preferedLanguage","setLocale","setOnTokenUpdate","newToken","setToken","handleUserStorageChange","event","key","newValue","window","addEventListener","removeEventListener","login","rememberMe","body","res","deviceId","getOrCreateDeviceId","loginAction","persist","logout","refetchPermissions","checkPermissions","useLazyCheckPermissionsQuery","checkUserHasPermissions","permissions","passedPermissions","rawQueryContext","length","action","subject","actualUserPermissions","matchingPermissions","filter","permission","findIndex","perm","middlewaredPermissions","pathname","search","split","shouldCheckConditions","some","Array","isArray","conditions","error","map","_","index","_jsx"],"mappings":";;;;;;;;;;;;;AA2DA;;;;;;;;;;;;;;IAeA,MAAMA,+BAAAA,GAA+E,UAAY,EAAE;AAEnG,MAAM,CAACC,QAAAA,EAAUC,OAAAA,CAAQ,GAAGC,aAAAA,CAAgC,MAAA;AAa5D,MAAMC,YAAAA,GAAe;IAEnBC,MAAAA,EAAQ;AACV;AAEA,MAAMC,YAAAA,GAAe,CAAC,EACpBC,QAAQ,EACRC,sBAAsB,EAAE,EACxBC,kBAAAA,GAAqB,KAAK,EACR,GAAA;AAClB,IAAA,MAAMC,QAAAA,GAAWC,gBAAAA,EAAAA;IACjB,MAAMC,iBAAAA,GAAoBC,aAAa,cAAA,EAAgB,CAACC,QAAUA,KAAAA,CAAMC,IAAI,CAACC,GAAG,CAAA;AAChF,IAAA,MAAMC,QAAAA,GAAWC,WAAAA,EAAAA;AACjB,IAAA,MAAM,CAAC,EAAEC,QAAQ,EAAE,CAAC,GAAGC,cAAAA,EAAAA;IAEvB,MAAMC,WAAAA,GAAcC,KAAAA,CAAMC,MAAM,CAACN,QAAAA,CAAAA;;AAGjCK,IAAAA,KAAAA,CAAME,SAAS,CAAC,IAAA;AACdH,QAAAA,WAAAA,CAAYI,OAAO,GAAGR,QAAAA;IACxB,CAAA,EAAG;AAACA,QAAAA;AAAS,KAAA,CAAA;IAEb,MAAMS,KAAAA,GAAQC,iBAAiB,CAACb,KAAAA,GAAUA,MAAMc,SAAS,CAACF,KAAK,IAAI,IAAA,CAAA;IAEnE,MAAM,EAAEG,MAAMC,IAAI,EAAEC,WAAWC,aAAa,EAAE,GAAGC,aAAAA,CAAcC,SAAAA,EAAW;AACxE;;;AAGC,QACDC,MAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAM,EACJG,IAAAA,EAAMO,eAAAA,GAAkB5B,mBAAmB,EAC3C6B,OAAO,EACPC,eAAe,EACfP,SAAAA,EAAWQ,oBAAoB,EAChC,GAAGC,yBAAyBN,SAAAA,EAAW;AACtCC,QAAAA,IAAAA,EAAM,CAACT;AACT,KAAA,CAAA;AAEA,IAAA,MAAMe,QAAAA,GAAWC,WAAAA,EAAAA;IAEjB,MAAM,CAACC,cAAc,GAAGC,gBAAAA,EAAAA;IACxB,MAAM,CAACC,eAAe,GAAGC,iBAAAA,EAAAA;IAEzB,MAAMC,mBAAAA,GAAsBzB,KAAAA,CAAM0B,WAAW,CAAC,IAAA;QAC5CtC,QAAAA,CAASuC,QAAAA,CAASC,IAAI,CAACC,aAAa,EAAA,CAAA;QACpCzC,QAAAA,CAAS0C,MAAAA,EAAAA,CAAAA;QACTX,QAAAA,CAAS,aAAA,CAAA;IACX,CAAA,EAAG;AAAC/B,QAAAA,QAAAA;AAAU+B,QAAAA;AAAS,KAAA,CAAA;AAEvBnB,IAAAA,KAAAA,CAAME,SAAS,CAAC,IAAA;AACd,QAAA,IAAIM,IAAAA,EAAM;YACR,IAAIA,IAAAA,CAAKuB,gBAAgB,EAAE;gBACzB3C,QAAAA,CAAS4C,SAAAA,CAAUxB,KAAKuB,gBAAgB,CAAA,CAAA;AAC1C,YAAA;AACF,QAAA;IACF,CAAA,EAAG;AAAC3C,QAAAA,QAAAA;AAAUoB,QAAAA;AAAK,KAAA,CAAA;AAEnB;;;MAIAR,KAAAA,CAAME,SAAS,CAAC,IAAA;AACd+B,QAAAA,gBAAAA,CAAiB,CAACC,QAAAA,GAAAA;AAChB9C,YAAAA,QAAAA,CAAS+C,QAAAA,CAASD,QAAAA,CAAAA,CAAAA;AACpB,QAAA,CAAA,CAAA;QAEA,OAAO,IAAA;YACLD,gBAAAA,CAAiB,IAAA,CAAA;AACnB,QAAA,CAAA;IACF,CAAA,EAAG;AAAC7C,QAAAA;AAAS,KAAA,CAAA;AAEbY,IAAAA,KAAAA,CAAME,SAAS,CAAC,IAAA;AACd;;QAGA,MAAMkC,0BAA0B,CAACC,KAAAA,GAAAA;YAC/B,IAAIA,KAAAA,CAAMC,GAAG,KAAKxD,YAAAA,CAAaC,MAAM,IAAIsD,KAAAA,CAAME,QAAQ,KAAK,IAAA,EAAM;AAChEd,gBAAAA,mBAAAA,EAAAA;AACF,YAAA;AACF,QAAA,CAAA;QAEAe,MAAAA,CAAOC,gBAAgB,CAAC,SAAA,EAAWL,uBAAAA,CAAAA;QAEnC,OAAO,IAAA;YACLI,MAAAA,CAAOE,mBAAmB,CAAC,SAAA,EAAWN,uBAAAA,CAAAA;AACxC,QAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEA,MAAMO,OAAAA,GAAQ3C,MAAM0B,WAAW,CAC7B,OAAO,EAAEkB,UAAU,EAAE,GAAGC,IAAAA,EAAM,GAAA;QAC5B,MAAMC,GAAAA,GAAM,MAAMzB,aAAAA,CAAc;AAAE,YAAA,GAAGwB,IAAI;YAAEE,QAAAA,EAAUC,mBAAAA,EAAAA;AAAuBJ,YAAAA;AAAW,SAAA,CAAA;AAEvF;;;UAIA,IAAI,UAAUE,GAAAA,EAAK;AACjB,YAAA,MAAM,EAAE1C,KAAK,EAAE,GAAG0C,IAAIvC,IAAI;AAE1BnB,YAAAA,QAAAA,CACE6D,KAAAA,CAAY;AACV7C,gBAAAA,KAAAA;gBACA8C,OAAAA,EAASN;AACX,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,OAAOE,GAAAA;IACT,CAAA,EACA;AAAC1D,QAAAA,QAAAA;AAAUiC,QAAAA;AAAc,KAAA,CAAA;IAG3B,MAAM8B,QAAAA,GAASnD,KAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC/B,QAAA,MAAMH,cAAAA,CAAe;YAAEwB,QAAAA,EAAUC,mBAAAA;AAAsB,SAAA,CAAA;AACvDvB,QAAAA,mBAAAA,EAAAA;IACF,CAAA,EAAG;AAACA,QAAAA,mBAAAA;AAAqBF,QAAAA;AAAe,KAAA,CAAA;IAExC,MAAM6B,kBAAAA,GAAqBpD,KAAAA,CAAM0B,WAAW,CAAC,UAAA;AAC3C,QAAA,IAAI,CAACV,eAAAA,EAAiB;YACpB,MAAMD,OAAAA,EAAAA;AACR,QAAA;IACF,CAAA,EAAG;AAACC,QAAAA,eAAAA;AAAiBD,QAAAA;AAAQ,KAAA,CAAA;IAE7B,MAAM,CAACsC,iBAAiB,GAAGC,4BAAAA,EAAAA;AAC3B,IAAA,MAAMC,0BAAuEvD,KAAAA,CAAM0B,WAAW,CAC5F,OACE8B,WAAAA,EACAC;;;;;;;;AAUAC,IAAAA,eAAAA,GAAAA;AAEA;;;;;AAKC,UACD,IAAI,CAACF,WAAAA,IAAeA,WAAAA,CAAYG,MAAM,KAAK,CAAA,EAAG;YAC5C,OAAO;AAAC,gBAAA;oBAAEC,MAAAA,EAAQ,EAAA;oBAAIC,OAAAA,EAAS;AAAG;AAAE,aAAA;AACtC,QAAA;AAEA;;;UAIA,MAAMC,wBAAwBL,iBAAAA,IAAqB3C,eAAAA;AAEnD,QAAA,MAAMiD,sBAAsBD,qBAAAA,CAAsBE,MAAM,CACtD,CAACC,aACCT,WAAAA,CAAYU,SAAS,CACnB,CAACC,OACCA,IAAAA,CAAKP,MAAM,KAAKK,UAAAA,CAAWL,MAAM;iBAEhCO,IAAAA,CAAKN,OAAO,IAAIjD,SAAAA,IAAauD,IAAAA,CAAKN,OAAO,KAAKI,UAAAA,CAAWJ,OAAM,CAAA,CAAA,IAC/D,CAAA,CAAA;QAGT,MAAMO,sBAAAA,GAAyB,MAAM9E,iBAAAA,CACnC;AACEkB,YAAAA,IAAAA;YACAgD,WAAAA,EAAa1C,eAAAA;YACbuD,QAAAA,EAAUtE,WAAAA,CAAYI,OAAO,CAACkE,QAAQ;YACtCC,MAAAA,EAASZ,CAAAA,eAAAA,IAAmB7D,QAAO,EAAG0E,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI;SACzD,EACAR,mBAAAA,CAAAA;AAGF,QAAA,MAAMS,wBAAwBJ,sBAAAA,CAAuBK,IAAI,CACvD,CAACN,OAASO,KAAAA,CAAMC,OAAO,CAACR,IAAAA,CAAKS,UAAU,CAAA,IAAKT,IAAAA,CAAKS,UAAU,CAACjB,MAAM,GAAG,CAAA,CAAA;AAGvE,QAAA,IAAI,CAACa,qBAAAA,EAAuB;YAC1B,OAAOJ,sBAAAA;AACT,QAAA;AAEA,QAAA,MAAM,EAAE7D,IAAI,EAAEsE,KAAK,EAAE,GAAG,MAAMxB,gBAAAA,CAAiB;AAC7CG,YAAAA,WAAAA,EAAaY,sBAAAA,CAAuBU,GAAG,CAAC,CAACX,QAAU;AACjDP,oBAAAA,MAAAA,EAAQO,KAAKP,MAAM;AACnBC,oBAAAA,OAAAA,EAASM,KAAKN;iBAChB,CAAA;AACF,SAAA,CAAA;AAEA,QAAA,IAAIgB,KAAAA,EAAO;YACT,MAAMA,KAAAA;QACR,CAAA,MAAO;YACL,OAAOT,sBAAAA,CAAuBJ,MAAM,CAAC,CAACe,CAAAA,EAAGC,QAAUzE,IAAAA,EAAMA,IAAI,CAACyE,KAAAA,CAAM,KAAK,IAAA,CAAA;AAC3E,QAAA;IACF,CAAA,EACA;AAAC3B,QAAAA,gBAAAA;AAAkBxD,QAAAA,QAAAA;AAAUP,QAAAA,iBAAAA;AAAmBkB,QAAAA,IAAAA;AAAMM,QAAAA;AAAgB,KAAA,CAAA;AAGxE,IAAA,MAAML,YAAYC,aAAAA,IAAiBO,oBAAAA;AAEnC,IAAA,qBACEgE,GAAA,CAACtG,QAAAA,EAAAA;QACCyB,KAAAA,EAAOA,KAAAA;QACPI,IAAAA,EAAMA,IAAAA;QACNmC,KAAAA,EAAOA,OAAAA;QACPQ,MAAAA,EAAQA,QAAAA;QACRK,WAAAA,EAAa1C,eAAAA;AACbyC,QAAAA,uBAAAA,EAAyBA,uBAAAA,IAA2B7E,+BAAAA;QACpD0E,kBAAAA,EAAoBA,kBAAAA;QACpB3C,SAAAA,EAAWA,SAAAA;AAEVxB,QAAAA,QAAAA,EAAAA;;AAGP;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/admin",
-  "version": "5.41.1",
+  "version": "5.42.0",
   "description": "Strapi Admin",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -91,10 +91,10 @@
     "@reduxjs/toolkit": "1.9.7",
     "@strapi/design-system": "2.2.0",
     "@strapi/icons": "2.2.0",
-    "@strapi/permissions": "5.41.1",
-    "@strapi/types": "5.41.1",
-    "@strapi/typescript-utils": "5.41.1",
-    "@strapi/utils": "5.41.1",
+    "@strapi/permissions": "5.42.0",
+    "@strapi/types": "5.42.0",
+    "@strapi/typescript-utils": "5.42.0",
+    "@strapi/utils": "5.42.0",
     "@testing-library/dom": "10.4.1",
     "@testing-library/react": "16.3.0",
     "@testing-library/user-event": "14.6.1",
@@ -150,8 +150,8 @@
     "zod": "3.25.67"
   },
   "devDependencies": {
-    "@strapi/admin-test-utils": "5.41.1",
-    "@strapi/data-transfer": "5.41.1",
+    "@strapi/admin-test-utils": "5.42.0",
+    "@strapi/data-transfer": "5.42.0",
     "@types/codemirror5": "npm:@types/codemirror@^5.60.15",
     "@types/fs-extra": "11.0.4",
     "@types/invariant": "2.2.36",