@strapi/admin 5.44.0 → 5.45.0

package/dist/server/server/src/strategies/admin-token.js

@@ -0,0 +1,110 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var utils = require('@strapi/utils');
+var index = require('../utils/index.js');
+var apiTokenUtils = require('./api-token-utils.js');
+require('@strapi/types');
+
+const { UnauthorizedError } = utils.errors;
+/**
+ * Authenticate an admin token. Rejects tokens with kind !== 'admin'.
+ */ const authenticate = async (ctx)=>{
+    if (strapi.features.future.isEnabled('adminTokens') !== true) {
+        return {
+            authenticated: false
+        };
+    }
+    const apiTokenService = index.getService('api-token-admin');
+    const token = apiTokenUtils.extractToken(ctx);
+    if (token === null) {
+        return {
+            authenticated: false
+        };
+    }
+    const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));
+    if (apiToken === null || apiToken === undefined) {
+        return {
+            authenticated: false
+        };
+    }
+    // Defensive kind check — only handle admin tokens
+    if (apiToken.kind !== 'admin') {
+        return {
+            authenticated: false
+        };
+    }
+    const expiryError = apiTokenUtils.checkExpiry(apiToken);
+    if (expiryError !== null) {
+        return {
+            authenticated: false,
+            error: expiryError
+        };
+    }
+    await apiTokenUtils.updateLastUsedAt(apiToken);
+    const owner = apiToken.adminUserOwner;
+    const ownerId = // eslint-disable-next-line no-nested-ternary
+    owner === null || owner === undefined ? null : typeof owner === 'object' ? owner.id : owner;
+    if (ownerId === null) {
+        return {
+            authenticated: false,
+            error: new UnauthorizedError('Token owner not found')
+        };
+    }
+    // Token populate does not load `roles`; reload the user like session auth (`admin` strategy)
+    // so `isSuperAdmin` and permission ceiling logic see the full admin user.
+    const user = await strapi.db.query('admin::user').findOne({
+        where: {
+            id: ownerId
+        },
+        populate: [
+            'roles'
+        ]
+    });
+    if (user === null || user === undefined) {
+        return {
+            authenticated: false,
+            error: new UnauthorizedError('Token owner not found')
+        };
+    }
+    if (user.isActive !== true || user.blocked === true) {
+        return {
+            authenticated: false,
+            error: new UnauthorizedError('Token owner is deactivated')
+        };
+    }
+    const ability = await index.getService('permission').engine.generateTokenAbility(apiToken.adminPermissions ?? [], user);
+    ctx.state.userAbility = ability;
+    ctx.state.user = user;
+    return {
+        authenticated: true,
+        credentials: apiToken,
+        ability
+    };
+};
+/**
+ * Re-check presence and expiry at verify time.
+ * Authorization is handled by isAuthenticatedAdmin + hasPermissions policies.
+ *
+ * @type {import('.').VerifyFunction}
+ */ const verify = (auth)=>{
+    const { credentials: apiToken } = auth;
+    if (apiToken === null || apiToken === undefined) {
+        throw new UnauthorizedError('Token not found');
+    }
+    const expiryError = apiTokenUtils.checkExpiry(apiToken);
+    if (expiryError !== null) {
+        throw expiryError;
+    }
+};
+var adminTokenAuthStrategy = {
+    name: 'admin-token',
+    authenticate,
+    verify
+};
+
+exports.authenticate = authenticate;
+exports.default = adminTokenAuthStrategy;
+exports.verify = verify;
+//# sourceMappingURL=admin-token.js.map

package/dist/server/server/src/strategies/admin-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-token.js","sources":["../../../../../server/src/strategies/admin-token.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { extractToken, checkExpiry, updateLastUsedAt } from './api-token-utils';\nimport '@strapi/types';\n\nconst { UnauthorizedError } = errors;\n\n/**\n * Authenticate an admin token. Rejects tokens with kind !== 'admin'.\n */\nexport const authenticate = async (ctx: Context) => {\n  if (strapi.features.future.isEnabled('adminTokens') !== true) {\n    return { authenticated: false };\n  }\n\n  const apiTokenService = getService('api-token-admin');\n  const token = extractToken(ctx);\n\n  if (token === null) {\n    return { authenticated: false };\n  }\n\n  const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));\n\n  if (apiToken === null || apiToken === undefined) {\n    return { authenticated: false };\n  }\n\n  // Defensive kind check — only handle admin tokens\n  if (apiToken.kind !== 'admin') {\n    return { authenticated: false };\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    return { authenticated: false, error: expiryError };\n  }\n\n  await updateLastUsedAt(apiToken);\n\n  const owner = apiToken.adminUserOwner;\n  const ownerId =\n    // eslint-disable-next-line no-nested-ternary\n    owner === null || owner === undefined ? null : typeof owner === 'object' ? owner.id : owner;\n\n  if (ownerId === null) {\n    return { authenticated: false, error: new UnauthorizedError('Token owner not found') };\n  }\n\n  // Token populate does not load `roles`; reload the user like session auth (`admin` strategy)\n  // so `isSuperAdmin` and permission ceiling logic see the full admin user.\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { id: ownerId }, populate: ['roles'] });\n\n  if (user === null || user === undefined) {\n    return { authenticated: false, error: new UnauthorizedError('Token owner not found') };\n  }\n\n  if (user.isActive !== true || user.blocked === true) {\n    return { authenticated: false, error: new UnauthorizedError('Token owner is deactivated') };\n  }\n\n  const ability = await getService('permission').engine.generateTokenAbility(\n    apiToken.adminPermissions ?? [],\n    user\n  );\n\n  ctx.state.userAbility = ability;\n  ctx.state.user = user;\n\n  return { authenticated: true, credentials: apiToken, ability };\n};\n\n/**\n * Re-check presence and expiry at verify time.\n * Authorization is handled by isAuthenticatedAdmin + hasPermissions policies.\n *\n * @type {import('.').VerifyFunction}\n */\nexport const verify = (auth: any): void => {\n  const { credentials: apiToken } = auth;\n\n  if (apiToken === null || apiToken === undefined) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    throw expiryError;\n  }\n};\n\nexport default {\n  name: 'admin-token',\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","errors","authenticate","ctx","strapi","features","future","isEnabled","authenticated","apiTokenService","getService","token","extractToken","apiToken","getByAccessKey","hash","undefined","kind","expiryError","checkExpiry","error","updateLastUsedAt","owner","adminUserOwner","ownerId","id","user","db","query","findOne","where","populate","isActive","blocked","ability","engine","generateTokenAbility","adminPermissions","state","userAbility","credentials","verify","auth","name"],"mappings":";;;;;;;;;AAMA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,YAAAA;AAE9B;;IAGO,MAAMC,YAAAA,GAAe,OAAOC,GAAAA,GAAAA;IACjC,IAAIC,MAAAA,CAAOC,QAAQ,CAACC,MAAM,CAACC,SAAS,CAAC,mBAAmB,IAAA,EAAM;QAC5D,OAAO;YAAEC,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AACnC,IAAA,MAAMC,QAAQC,0BAAAA,CAAaT,GAAAA,CAAAA;AAE3B,IAAA,IAAIQ,UAAU,IAAA,EAAM;QAClB,OAAO;YAAEH,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMK,WAAW,MAAMJ,eAAAA,CAAgBK,cAAc,CAACL,eAAAA,CAAgBM,IAAI,CAACJ,KAAAA,CAAAA,CAAAA;IAE3E,IAAIE,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;QAC/C,OAAO;YAAER,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;IAGA,IAAIK,QAAAA,CAASI,IAAI,KAAK,OAAA,EAAS;QAC7B,OAAO;YAAET,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMU,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,OAAO;YAAEV,aAAAA,EAAe,KAAA;YAAOY,KAAAA,EAAOF;AAAY,SAAA;AACpD,IAAA;AAEA,IAAA,MAAMG,8BAAAA,CAAiBR,QAAAA,CAAAA;IAEvB,MAAMS,KAAAA,GAAQT,SAASU,cAAc;AACrC,IAAA,MAAMC;IAEJF,KAAAA,KAAU,IAAA,IAAQA,UAAUN,SAAAA,GAAY,IAAA,GAAO,OAAOM,KAAAA,KAAU,QAAA,GAAWA,KAAAA,CAAMG,EAAE,GAAGH,KAAAA;AAExF,IAAA,IAAIE,YAAY,IAAA,EAAM;QACpB,OAAO;YAAEhB,aAAAA,EAAe,KAAA;AAAOY,YAAAA,KAAAA,EAAO,IAAIpB,iBAAAA,CAAkB,uBAAA;AAAyB,SAAA;AACvF,IAAA;;;IAIA,MAAM0B,IAAAA,GAAO,MAAMtB,MAAAA,CAAOuB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;YAAEL,EAAAA,EAAID;AAAQ,SAAA;QAAGO,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAEzD,IAAIL,IAAAA,KAAS,IAAA,IAAQA,IAAAA,KAASV,SAAAA,EAAW;QACvC,OAAO;YAAER,aAAAA,EAAe,KAAA;AAAOY,YAAAA,KAAAA,EAAO,IAAIpB,iBAAAA,CAAkB,uBAAA;AAAyB,SAAA;AACvF,IAAA;AAEA,IAAA,IAAI0B,KAAKM,QAAQ,KAAK,QAAQN,IAAAA,CAAKO,OAAO,KAAK,IAAA,EAAM;QACnD,OAAO;YAAEzB,aAAAA,EAAe,KAAA;AAAOY,YAAAA,KAAAA,EAAO,IAAIpB,iBAAAA,CAAkB,4BAAA;AAA8B,SAAA;AAC5F,IAAA;AAEA,IAAA,MAAMkC,OAAAA,GAAU,MAAMxB,gBAAAA,CAAW,YAAA,CAAA,CAAcyB,MAAM,CAACC,oBAAoB,CACxEvB,QAAAA,CAASwB,gBAAgB,IAAI,EAAE,EAC/BX,IAAAA,CAAAA;IAGFvB,GAAAA,CAAImC,KAAK,CAACC,WAAW,GAAGL,OAAAA;IACxB/B,GAAAA,CAAImC,KAAK,CAACZ,IAAI,GAAGA,IAAAA;IAEjB,OAAO;QAAElB,aAAAA,EAAe,IAAA;QAAMgC,WAAAA,EAAa3B,QAAAA;AAAUqB,QAAAA;AAAQ,KAAA;AAC/D;AAEA;;;;;IAMO,MAAMO,MAAAA,GAAS,CAACC,IAAAA,GAAAA;AACrB,IAAA,MAAM,EAAEF,WAAAA,EAAa3B,QAAQ,EAAE,GAAG6B,IAAAA;IAElC,IAAI7B,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;AAC/C,QAAA,MAAM,IAAIhB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMkB,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,MAAMA,WAAAA;AACR,IAAA;AACF;AAEA,6BAAe;IACbyB,IAAAA,EAAM,aAAA;AACNzC,IAAAA,YAAAA;AACAuC,IAAAA;AACF,CAAA;;;;;;"}

package/dist/server/server/src/strategies/admin-token.mjs

@@ -0,0 +1,104 @@
+import { errors } from '@strapi/utils';
+import { getService } from '../utils/index.mjs';
+import { checkExpiry, extractToken, updateLastUsedAt } from './api-token-utils.mjs';
+import '@strapi/types';
+
+const { UnauthorizedError } = errors;
+/**
+ * Authenticate an admin token. Rejects tokens with kind !== 'admin'.
+ */ const authenticate = async (ctx)=>{
+    if (strapi.features.future.isEnabled('adminTokens') !== true) {
+        return {
+            authenticated: false
+        };
+    }
+    const apiTokenService = getService('api-token-admin');
+    const token = extractToken(ctx);
+    if (token === null) {
+        return {
+            authenticated: false
+        };
+    }
+    const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));
+    if (apiToken === null || apiToken === undefined) {
+        return {
+            authenticated: false
+        };
+    }
+    // Defensive kind check — only handle admin tokens
+    if (apiToken.kind !== 'admin') {
+        return {
+            authenticated: false
+        };
+    }
+    const expiryError = checkExpiry(apiToken);
+    if (expiryError !== null) {
+        return {
+            authenticated: false,
+            error: expiryError
+        };
+    }
+    await updateLastUsedAt(apiToken);
+    const owner = apiToken.adminUserOwner;
+    const ownerId = // eslint-disable-next-line no-nested-ternary
+    owner === null || owner === undefined ? null : typeof owner === 'object' ? owner.id : owner;
+    if (ownerId === null) {
+        return {
+            authenticated: false,
+            error: new UnauthorizedError('Token owner not found')
+        };
+    }
+    // Token populate does not load `roles`; reload the user like session auth (`admin` strategy)
+    // so `isSuperAdmin` and permission ceiling logic see the full admin user.
+    const user = await strapi.db.query('admin::user').findOne({
+        where: {
+            id: ownerId
+        },
+        populate: [
+            'roles'
+        ]
+    });
+    if (user === null || user === undefined) {
+        return {
+            authenticated: false,
+            error: new UnauthorizedError('Token owner not found')
+        };
+    }
+    if (user.isActive !== true || user.blocked === true) {
+        return {
+            authenticated: false,
+            error: new UnauthorizedError('Token owner is deactivated')
+        };
+    }
+    const ability = await getService('permission').engine.generateTokenAbility(apiToken.adminPermissions ?? [], user);
+    ctx.state.userAbility = ability;
+    ctx.state.user = user;
+    return {
+        authenticated: true,
+        credentials: apiToken,
+        ability
+    };
+};
+/**
+ * Re-check presence and expiry at verify time.
+ * Authorization is handled by isAuthenticatedAdmin + hasPermissions policies.
+ *
+ * @type {import('.').VerifyFunction}
+ */ const verify = (auth)=>{
+    const { credentials: apiToken } = auth;
+    if (apiToken === null || apiToken === undefined) {
+        throw new UnauthorizedError('Token not found');
+    }
+    const expiryError = checkExpiry(apiToken);
+    if (expiryError !== null) {
+        throw expiryError;
+    }
+};
+var adminTokenAuthStrategy = {
+    name: 'admin-token',
+    authenticate,
+    verify
+};
+
+export { authenticate, adminTokenAuthStrategy as default, verify };
+//# sourceMappingURL=admin-token.mjs.map

package/dist/server/server/src/strategies/admin-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-token.mjs","sources":["../../../../../server/src/strategies/admin-token.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { extractToken, checkExpiry, updateLastUsedAt } from './api-token-utils';\nimport '@strapi/types';\n\nconst { UnauthorizedError } = errors;\n\n/**\n * Authenticate an admin token. Rejects tokens with kind !== 'admin'.\n */\nexport const authenticate = async (ctx: Context) => {\n  if (strapi.features.future.isEnabled('adminTokens') !== true) {\n    return { authenticated: false };\n  }\n\n  const apiTokenService = getService('api-token-admin');\n  const token = extractToken(ctx);\n\n  if (token === null) {\n    return { authenticated: false };\n  }\n\n  const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));\n\n  if (apiToken === null || apiToken === undefined) {\n    return { authenticated: false };\n  }\n\n  // Defensive kind check — only handle admin tokens\n  if (apiToken.kind !== 'admin') {\n    return { authenticated: false };\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    return { authenticated: false, error: expiryError };\n  }\n\n  await updateLastUsedAt(apiToken);\n\n  const owner = apiToken.adminUserOwner;\n  const ownerId =\n    // eslint-disable-next-line no-nested-ternary\n    owner === null || owner === undefined ? null : typeof owner === 'object' ? owner.id : owner;\n\n  if (ownerId === null) {\n    return { authenticated: false, error: new UnauthorizedError('Token owner not found') };\n  }\n\n  // Token populate does not load `roles`; reload the user like session auth (`admin` strategy)\n  // so `isSuperAdmin` and permission ceiling logic see the full admin user.\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { id: ownerId }, populate: ['roles'] });\n\n  if (user === null || user === undefined) {\n    return { authenticated: false, error: new UnauthorizedError('Token owner not found') };\n  }\n\n  if (user.isActive !== true || user.blocked === true) {\n    return { authenticated: false, error: new UnauthorizedError('Token owner is deactivated') };\n  }\n\n  const ability = await getService('permission').engine.generateTokenAbility(\n    apiToken.adminPermissions ?? [],\n    user\n  );\n\n  ctx.state.userAbility = ability;\n  ctx.state.user = user;\n\n  return { authenticated: true, credentials: apiToken, ability };\n};\n\n/**\n * Re-check presence and expiry at verify time.\n * Authorization is handled by isAuthenticatedAdmin + hasPermissions policies.\n *\n * @type {import('.').VerifyFunction}\n */\nexport const verify = (auth: any): void => {\n  const { credentials: apiToken } = auth;\n\n  if (apiToken === null || apiToken === undefined) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    throw expiryError;\n  }\n};\n\nexport default {\n  name: 'admin-token',\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","errors","authenticate","ctx","strapi","features","future","isEnabled","authenticated","apiTokenService","getService","token","extractToken","apiToken","getByAccessKey","hash","undefined","kind","expiryError","checkExpiry","error","updateLastUsedAt","owner","adminUserOwner","ownerId","id","user","db","query","findOne","where","populate","isActive","blocked","ability","engine","generateTokenAbility","adminPermissions","state","userAbility","credentials","verify","auth","name"],"mappings":";;;;;AAMA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,MAAAA;AAE9B;;IAGO,MAAMC,YAAAA,GAAe,OAAOC,GAAAA,GAAAA;IACjC,IAAIC,MAAAA,CAAOC,QAAQ,CAACC,MAAM,CAACC,SAAS,CAAC,mBAAmB,IAAA,EAAM;QAC5D,OAAO;YAAEC,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,kBAAkBC,UAAAA,CAAW,iBAAA,CAAA;AACnC,IAAA,MAAMC,QAAQC,YAAAA,CAAaT,GAAAA,CAAAA;AAE3B,IAAA,IAAIQ,UAAU,IAAA,EAAM;QAClB,OAAO;YAAEH,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMK,WAAW,MAAMJ,eAAAA,CAAgBK,cAAc,CAACL,eAAAA,CAAgBM,IAAI,CAACJ,KAAAA,CAAAA,CAAAA;IAE3E,IAAIE,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;QAC/C,OAAO;YAAER,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;IAGA,IAAIK,QAAAA,CAASI,IAAI,KAAK,OAAA,EAAS;QAC7B,OAAO;YAAET,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMU,cAAcC,WAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,OAAO;YAAEV,aAAAA,EAAe,KAAA;YAAOY,KAAAA,EAAOF;AAAY,SAAA;AACpD,IAAA;AAEA,IAAA,MAAMG,gBAAAA,CAAiBR,QAAAA,CAAAA;IAEvB,MAAMS,KAAAA,GAAQT,SAASU,cAAc;AACrC,IAAA,MAAMC;IAEJF,KAAAA,KAAU,IAAA,IAAQA,UAAUN,SAAAA,GAAY,IAAA,GAAO,OAAOM,KAAAA,KAAU,QAAA,GAAWA,KAAAA,CAAMG,EAAE,GAAGH,KAAAA;AAExF,IAAA,IAAIE,YAAY,IAAA,EAAM;QACpB,OAAO;YAAEhB,aAAAA,EAAe,KAAA;AAAOY,YAAAA,KAAAA,EAAO,IAAIpB,iBAAAA,CAAkB,uBAAA;AAAyB,SAAA;AACvF,IAAA;;;IAIA,MAAM0B,IAAAA,GAAO,MAAMtB,MAAAA,CAAOuB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;YAAEL,EAAAA,EAAID;AAAQ,SAAA;QAAGO,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAEzD,IAAIL,IAAAA,KAAS,IAAA,IAAQA,IAAAA,KAASV,SAAAA,EAAW;QACvC,OAAO;YAAER,aAAAA,EAAe,KAAA;AAAOY,YAAAA,KAAAA,EAAO,IAAIpB,iBAAAA,CAAkB,uBAAA;AAAyB,SAAA;AACvF,IAAA;AAEA,IAAA,IAAI0B,KAAKM,QAAQ,KAAK,QAAQN,IAAAA,CAAKO,OAAO,KAAK,IAAA,EAAM;QACnD,OAAO;YAAEzB,aAAAA,EAAe,KAAA;AAAOY,YAAAA,KAAAA,EAAO,IAAIpB,iBAAAA,CAAkB,4BAAA;AAA8B,SAAA;AAC5F,IAAA;AAEA,IAAA,MAAMkC,OAAAA,GAAU,MAAMxB,UAAAA,CAAW,YAAA,CAAA,CAAcyB,MAAM,CAACC,oBAAoB,CACxEvB,QAAAA,CAASwB,gBAAgB,IAAI,EAAE,EAC/BX,IAAAA,CAAAA;IAGFvB,GAAAA,CAAImC,KAAK,CAACC,WAAW,GAAGL,OAAAA;IACxB/B,GAAAA,CAAImC,KAAK,CAACZ,IAAI,GAAGA,IAAAA;IAEjB,OAAO;QAAElB,aAAAA,EAAe,IAAA;QAAMgC,WAAAA,EAAa3B,QAAAA;AAAUqB,QAAAA;AAAQ,KAAA;AAC/D;AAEA;;;;;IAMO,MAAMO,MAAAA,GAAS,CAACC,IAAAA,GAAAA;AACrB,IAAA,MAAM,EAAEF,WAAAA,EAAa3B,QAAQ,EAAE,GAAG6B,IAAAA;IAElC,IAAI7B,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;AAC/C,QAAA,MAAM,IAAIhB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMkB,cAAcC,WAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,MAAMA,WAAAA;AACR,IAAA;AACF;AAEA,6BAAe;IACbyB,IAAAA,EAAM,aAAA;AACNzC,IAAAA,YAAAA;AACAuC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/strategies/api-token-utils.js

@@ -0,0 +1,56 @@
+'use strict';
+
+var fp = require('lodash/fp');
+var dateFns = require('date-fns');
+var utils = require('@strapi/utils');
+
+const { UnauthorizedError } = utils.errors;
+const extractToken = (ctx)=>{
+    if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
+        const parts = ctx.request.header.authorization.split(/\s+/);
+        if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
+            return null;
+        }
+        return parts[1];
+    }
+    return null;
+};
+const checkExpiry = (apiToken)=>{
+    if (!fp.isNil(apiToken.expiresAt)) {
+        const expirationDate = new Date(apiToken.expiresAt);
+        if (expirationDate < new Date()) {
+            return new UnauthorizedError('Token expired');
+        }
+    }
+    return null;
+};
+const updateLastUsedAt = async (apiToken)=>{
+    const currentDate = new Date();
+    if (!fp.isNil(apiToken.lastUsedAt)) {
+        const hoursSinceLastUsed = dateFns.differenceInHours(currentDate, dateFns.parseISO(apiToken.lastUsedAt));
+        if (hoursSinceLastUsed >= 1) {
+            await strapi.db.query('admin::api-token').update({
+                where: {
+                    id: apiToken.id
+                },
+                data: {
+                    lastUsedAt: currentDate
+                }
+            });
+        }
+    } else {
+        await strapi.db.query('admin::api-token').update({
+            where: {
+                id: apiToken.id
+            },
+            data: {
+                lastUsedAt: currentDate
+            }
+        });
+    }
+};
+
+exports.checkExpiry = checkExpiry;
+exports.extractToken = extractToken;
+exports.updateLastUsedAt = updateLastUsedAt;
+//# sourceMappingURL=api-token-utils.js.map

package/dist/server/server/src/strategies/api-token-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-utils.js","sources":["../../../../../server/src/strategies/api-token-utils.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\n\nconst { UnauthorizedError } = errors;\n\nexport const extractToken = (ctx: Context): string | null => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\nexport const checkExpiry = (apiToken: {\n  expiresAt?: string | number | null;\n}): InstanceType<typeof UnauthorizedError> | null => {\n  if (!isNil(apiToken.expiresAt)) {\n    const expirationDate = new Date(apiToken.expiresAt);\n    if (expirationDate < new Date()) {\n      return new UnauthorizedError('Token expired');\n    }\n  }\n\n  return null;\n};\n\nexport const updateLastUsedAt = async (apiToken: {\n  id: number | string;\n  lastUsedAt?: string | null;\n}): Promise<void> => {\n  const currentDate = new Date();\n\n  if (!isNil(apiToken.lastUsedAt)) {\n    const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));\n    if (hoursSinceLastUsed >= 1) {\n      await strapi.db.query('admin::api-token').update({\n        where: { id: apiToken.id },\n        data: { lastUsedAt: currentDate },\n      });\n    }\n  } else {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: apiToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n};\n"],"names":["UnauthorizedError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","checkExpiry","apiToken","isNil","expiresAt","expirationDate","Date","updateLastUsedAt","currentDate","lastUsedAt","hoursSinceLastUsed","differenceInHours","parseISO","strapi","db","query","update","where","id","data"],"mappings":";;;;;;AAKA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,YAAAA;AAEvB,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AAC3B,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMI,cAAc,CAACC,QAAAA,GAAAA;AAG1B,IAAA,IAAI,CAACC,QAAAA,CAAMD,QAAAA,CAASE,SAAS,CAAA,EAAG;AAC9B,QAAA,MAAMC,cAAAA,GAAiB,IAAIC,IAAAA,CAAKJ,QAAAA,CAASE,SAAS,CAAA;QAClD,IAAIC,cAAAA,GAAiB,IAAIC,IAAAA,EAAAA,EAAQ;AAC/B,YAAA,OAAO,IAAIhB,iBAAAA,CAAkB,eAAA,CAAA;AAC/B,QAAA;AACF,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMiB,mBAAmB,OAAOL,QAAAA,GAAAA;AAIrC,IAAA,MAAMM,cAAc,IAAIF,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACH,QAAAA,CAAMD,QAAAA,CAASO,UAAU,CAAA,EAAG;AAC/B,QAAA,MAAMC,kBAAAA,GAAqBC,yBAAAA,CAAkBH,WAAAA,EAAaI,gBAAAA,CAASV,SAASO,UAAU,CAAA,CAAA;AACtF,QAAA,IAAIC,sBAAsB,CAAA,EAAG;AAC3B,YAAA,MAAMG,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;gBAC/CC,KAAAA,EAAO;AAAEC,oBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,iBAAA;gBACzBC,IAAAA,EAAM;oBAAEV,UAAAA,EAAYD;AAAY;AAClC,aAAA,CAAA;AACF,QAAA;IACF,CAAA,MAAO;AACL,QAAA,MAAMK,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,aAAA;YACzBC,IAAAA,EAAM;gBAAEV,UAAAA,EAAYD;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;AACF;;;;;;"}

package/dist/server/server/src/strategies/api-token-utils.mjs

@@ -0,0 +1,52 @@
+import { isNil } from 'lodash/fp';
+import { differenceInHours, parseISO } from 'date-fns';
+import { errors } from '@strapi/utils';
+
+const { UnauthorizedError } = errors;
+const extractToken = (ctx)=>{
+    if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
+        const parts = ctx.request.header.authorization.split(/\s+/);
+        if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
+            return null;
+        }
+        return parts[1];
+    }
+    return null;
+};
+const checkExpiry = (apiToken)=>{
+    if (!isNil(apiToken.expiresAt)) {
+        const expirationDate = new Date(apiToken.expiresAt);
+        if (expirationDate < new Date()) {
+            return new UnauthorizedError('Token expired');
+        }
+    }
+    return null;
+};
+const updateLastUsedAt = async (apiToken)=>{
+    const currentDate = new Date();
+    if (!isNil(apiToken.lastUsedAt)) {
+        const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));
+        if (hoursSinceLastUsed >= 1) {
+            await strapi.db.query('admin::api-token').update({
+                where: {
+                    id: apiToken.id
+                },
+                data: {
+                    lastUsedAt: currentDate
+                }
+            });
+        }
+    } else {
+        await strapi.db.query('admin::api-token').update({
+            where: {
+                id: apiToken.id
+            },
+            data: {
+                lastUsedAt: currentDate
+            }
+        });
+    }
+};
+
+export { checkExpiry, extractToken, updateLastUsedAt };
+//# sourceMappingURL=api-token-utils.mjs.map

package/dist/server/server/src/strategies/api-token-utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-utils.mjs","sources":["../../../../../server/src/strategies/api-token-utils.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\n\nconst { UnauthorizedError } = errors;\n\nexport const extractToken = (ctx: Context): string | null => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\nexport const checkExpiry = (apiToken: {\n  expiresAt?: string | number | null;\n}): InstanceType<typeof UnauthorizedError> | null => {\n  if (!isNil(apiToken.expiresAt)) {\n    const expirationDate = new Date(apiToken.expiresAt);\n    if (expirationDate < new Date()) {\n      return new UnauthorizedError('Token expired');\n    }\n  }\n\n  return null;\n};\n\nexport const updateLastUsedAt = async (apiToken: {\n  id: number | string;\n  lastUsedAt?: string | null;\n}): Promise<void> => {\n  const currentDate = new Date();\n\n  if (!isNil(apiToken.lastUsedAt)) {\n    const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));\n    if (hoursSinceLastUsed >= 1) {\n      await strapi.db.query('admin::api-token').update({\n        where: { id: apiToken.id },\n        data: { lastUsedAt: currentDate },\n      });\n    }\n  } else {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: apiToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n};\n"],"names":["UnauthorizedError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","checkExpiry","apiToken","isNil","expiresAt","expirationDate","Date","updateLastUsedAt","currentDate","lastUsedAt","hoursSinceLastUsed","differenceInHours","parseISO","strapi","db","query","update","where","id","data"],"mappings":";;;;AAKA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,MAAAA;AAEvB,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AAC3B,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMI,cAAc,CAACC,QAAAA,GAAAA;AAG1B,IAAA,IAAI,CAACC,KAAAA,CAAMD,QAAAA,CAASE,SAAS,CAAA,EAAG;AAC9B,QAAA,MAAMC,cAAAA,GAAiB,IAAIC,IAAAA,CAAKJ,QAAAA,CAASE,SAAS,CAAA;QAClD,IAAIC,cAAAA,GAAiB,IAAIC,IAAAA,EAAAA,EAAQ;AAC/B,YAAA,OAAO,IAAIhB,iBAAAA,CAAkB,eAAA,CAAA;AAC/B,QAAA;AACF,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMiB,mBAAmB,OAAOL,QAAAA,GAAAA;AAIrC,IAAA,MAAMM,cAAc,IAAIF,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACH,KAAAA,CAAMD,QAAAA,CAASO,UAAU,CAAA,EAAG;AAC/B,QAAA,MAAMC,kBAAAA,GAAqBC,iBAAAA,CAAkBH,WAAAA,EAAaI,QAAAA,CAASV,SAASO,UAAU,CAAA,CAAA;AACtF,QAAA,IAAIC,sBAAsB,CAAA,EAAG;AAC3B,YAAA,MAAMG,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;gBAC/CC,KAAAA,EAAO;AAAEC,oBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,iBAAA;gBACzBC,IAAAA,EAAM;oBAAEV,UAAAA,EAAYD;AAAY;AAClC,aAAA,CAAA;AACF,QAAA;IACF,CAAA,MAAO;AACL,QAAA,MAAMK,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,aAAA;YACzBC,IAAAA,EAAM;gBAAEV,UAAAA,EAAYD;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;AACF;;;;"}

package/dist/server/server/src/strategies/content-api-token.js

@@ -0,0 +1,104 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var fp = require('lodash/fp');
+var utils = require('@strapi/utils');
+var constants = require('../services/constants.js');
+var index = require('../utils/index.js');
+var apiTokenUtils = require('./api-token-utils.js');
+require('@strapi/types');
+
+const { UnauthorizedError, ForbiddenError } = utils.errors;
+const isReadScope = (scope)=>scope.endsWith('find') || scope.endsWith('findOne');
+/**
+ * Authenticate a content-api token. Rejects tokens with kind !== 'content-api'.
+ */ const authenticate = async (ctx)=>{
+    const apiTokenService = index.getService('api-token-admin');
+    const token = apiTokenUtils.extractToken(ctx);
+    if (token === null) {
+        return {
+            authenticated: false
+        };
+    }
+    const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));
+    if (apiToken === null || apiToken === undefined) {
+        return {
+            authenticated: false
+        };
+    }
+    // Defensive kind check — only handle content-api tokens.
+    // null kind is allowed: tokens created before the kind field was introduced are implicitly content-api.
+    if (apiToken.kind !== 'content-api' && apiToken.kind !== null) {
+        return {
+            authenticated: false
+        };
+    }
+    const expiryError = apiTokenUtils.checkExpiry(apiToken);
+    if (expiryError !== null) {
+        return {
+            authenticated: false,
+            error: expiryError
+        };
+    }
+    await apiTokenUtils.updateLastUsedAt(apiToken);
+    if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {
+        const ability = await strapi.contentAPI.permissions.engine.generateAbility(apiToken.permissions.map((action)=>({
+                action
+            })));
+        return {
+            authenticated: true,
+            ability,
+            credentials: apiToken
+        };
+    }
+    return {
+        authenticated: true,
+        credentials: apiToken
+    };
+};
+/**
+ * Verify the token has the required abilities for the requested scope.
+ *
+ * @type {import('.').VerifyFunction}
+ */ const verify = (auth, config)=>{
+    const { credentials: apiToken, ability } = auth;
+    if (apiToken === null || apiToken === undefined) {
+        throw new UnauthorizedError('Token not found');
+    }
+    const expiryError = apiTokenUtils.checkExpiry(apiToken);
+    if (expiryError !== null) {
+        throw expiryError;
+    }
+    // Full access
+    if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {
+        return;
+    }
+    // Read only
+    if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {
+        const scopes = fp.castArray(config.scope);
+        if (config.scope && scopes.every(isReadScope)) {
+            return;
+        }
+    } else if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {
+        if (ability === null || ability === undefined) {
+            throw new ForbiddenError();
+        }
+        const scopes = fp.castArray(config.scope);
+        const isAllowed = scopes.every((scope)=>ability.can(scope));
+        if (isAllowed === true) {
+            return;
+        }
+    }
+    throw new ForbiddenError();
+};
+var contentApiTokenAuthStrategy = {
+    name: 'content-api-token',
+    authenticate,
+    verify
+};
+
+exports.authenticate = authenticate;
+exports.default = contentApiTokenAuthStrategy;
+exports.verify = verify;
+//# sourceMappingURL=content-api-token.js.map

package/dist/server/server/src/strategies/content-api-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-api-token.js","sources":["../../../../../server/src/strategies/content-api-token.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { castArray } from 'lodash/fp';\nimport { errors } from '@strapi/utils';\nimport constants from '../services/constants';\nimport { getService } from '../utils';\nimport { extractToken, checkExpiry, updateLastUsedAt } from './api-token-utils';\nimport '@strapi/types';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst isReadScope = (scope: string) => scope.endsWith('find') || scope.endsWith('findOne');\n\n/**\n * Authenticate a content-api token. Rejects tokens with kind !== 'content-api'.\n */\nexport const authenticate = async (ctx: Context) => {\n  const apiTokenService = getService('api-token-admin');\n  const token = extractToken(ctx);\n\n  if (token === null) {\n    return { authenticated: false };\n  }\n\n  const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));\n\n  if (apiToken === null || apiToken === undefined) {\n    return { authenticated: false };\n  }\n\n  // Defensive kind check — only handle content-api tokens.\n  // null kind is allowed: tokens created before the kind field was introduced are implicitly content-api.\n  if (apiToken.kind !== 'content-api' && apiToken.kind !== null) {\n    return { authenticated: false };\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    return { authenticated: false, error: expiryError };\n  }\n\n  await updateLastUsedAt(apiToken);\n\n  if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(\n      apiToken.permissions.map((action: string) => ({ action }))\n    );\n\n    return { authenticated: true, ability, credentials: apiToken };\n  }\n\n  return { authenticated: true, credentials: apiToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope.\n *\n * @type {import('.').VerifyFunction}\n */\nexport const verify = (auth: any, config: any) => {\n  const { credentials: apiToken, ability } = auth;\n\n  if (apiToken === null || apiToken === undefined) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    throw expiryError;\n  }\n\n  // Full access\n  if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {\n    return;\n  }\n\n  // Read only\n  if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {\n    const scopes = castArray(config.scope);\n\n    if (config.scope && scopes.every(isReadScope)) {\n      return;\n    }\n  }\n\n  // Custom\n  else if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    if (ability === null || ability === undefined) {\n      throw new ForbiddenError();\n    }\n\n    const scopes = castArray(config.scope);\n    const isAllowed = scopes.every((scope: string) => ability.can(scope));\n\n    if (isAllowed === true) {\n      return;\n    }\n  }\n\n  throw new ForbiddenError();\n};\n\nexport default {\n  name: 'content-api-token',\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","isReadScope","scope","endsWith","authenticate","ctx","apiTokenService","getService","token","extractToken","authenticated","apiToken","getByAccessKey","hash","undefined","kind","expiryError","checkExpiry","error","updateLastUsedAt","type","constants","API_TOKEN_TYPE","CUSTOM","ability","strapi","contentAPI","permissions","engine","generateAbility","map","action","credentials","verify","auth","config","FULL_ACCESS","READ_ONLY","scopes","castArray","every","isAllowed","can","name"],"mappings":";;;;;;;;;;;AAQA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,YAAAA;AAE9C,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GAAkBA,KAAAA,CAAMC,QAAQ,CAAC,MAAA,CAAA,IAAWD,KAAAA,CAAMC,QAAQ,CAAC,SAAA,CAAA;AAEhF;;IAGO,MAAMC,YAAAA,GAAe,OAAOC,GAAAA,GAAAA;AACjC,IAAA,MAAMC,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AACnC,IAAA,MAAMC,QAAQC,0BAAAA,CAAaJ,GAAAA,CAAAA;AAE3B,IAAA,IAAIG,UAAU,IAAA,EAAM;QAClB,OAAO;YAAEE,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,WAAW,MAAML,eAAAA,CAAgBM,cAAc,CAACN,eAAAA,CAAgBO,IAAI,CAACL,KAAAA,CAAAA,CAAAA;IAE3E,IAAIG,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;QAC/C,OAAO;YAAEJ,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;;AAIA,IAAA,IAAIC,SAASI,IAAI,KAAK,iBAAiBJ,QAAAA,CAASI,IAAI,KAAK,IAAA,EAAM;QAC7D,OAAO;YAAEL,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMM,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,OAAO;YAAEN,aAAAA,EAAe,KAAA;YAAOQ,KAAAA,EAAOF;AAAY,SAAA;AACpD,IAAA;AAEA,IAAA,MAAMG,8BAAAA,CAAiBR,QAAAA,CAAAA;AAEvB,IAAA,IAAIA,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;AACrD,QAAA,MAAMC,UAAU,MAAMC,MAAAA,CAAOC,UAAU,CAACC,WAAW,CAACC,MAAM,CAACC,eAAe,CACxElB,SAASgB,WAAW,CAACG,GAAG,CAAC,CAACC,UAAoB;AAAEA,gBAAAA;aAAO,CAAA,CAAA,CAAA;QAGzD,OAAO;YAAErB,aAAAA,EAAe,IAAA;AAAMc,YAAAA,OAAAA;YAASQ,WAAAA,EAAarB;AAAS,SAAA;AAC/D,IAAA;IAEA,OAAO;QAAED,aAAAA,EAAe,IAAA;QAAMsB,WAAAA,EAAarB;AAAS,KAAA;AACtD;AAEA;;;;AAIC,IACM,MAAMsB,MAAAA,GAAS,CAACC,IAAAA,EAAWC,MAAAA,GAAAA;AAChC,IAAA,MAAM,EAAEH,WAAAA,EAAarB,QAAQ,EAAEa,OAAO,EAAE,GAAGU,IAAAA;IAE3C,IAAIvB,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;AAC/C,QAAA,MAAM,IAAIhB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMkB,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,MAAMA,WAAAA;AACR,IAAA;;AAGA,IAAA,IAAIL,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACc,WAAW,EAAE;AAC1D,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIzB,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACe,SAAS,EAAE;QACxD,MAAMC,MAAAA,GAASC,YAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;AAErC,QAAA,IAAIiC,OAAOjC,KAAK,IAAIoC,MAAAA,CAAOE,KAAK,CAACvC,WAAAA,CAAAA,EAAc;AAC7C,YAAA;AACF,QAAA;IACF,CAAA,MAGK,IAAIU,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;QAC1D,IAAIC,OAAAA,KAAY,IAAA,IAAQA,OAAAA,KAAYV,SAAAA,EAAW;AAC7C,YAAA,MAAM,IAAIf,cAAAA,EAAAA;AACZ,QAAA;QAEA,MAAMuC,MAAAA,GAASC,YAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;QACrC,MAAMuC,SAAAA,GAAYH,OAAOE,KAAK,CAAC,CAACtC,KAAAA,GAAkBsB,OAAAA,CAAQkB,GAAG,CAACxC,KAAAA,CAAAA,CAAAA;AAE9D,QAAA,IAAIuC,cAAc,IAAA,EAAM;AACtB,YAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAI1C,cAAAA,EAAAA;AACZ;AAEA,kCAAe;IACb4C,IAAAA,EAAM,mBAAA;AACNvC,IAAAA,YAAAA;AACA6B,IAAAA;AACF,CAAA;;;;;;"}

package/dist/server/server/src/strategies/content-api-token.mjs

@@ -0,0 +1,98 @@
+import { castArray } from 'lodash/fp';
+import { errors } from '@strapi/utils';
+import constants from '../services/constants.mjs';
+import { getService } from '../utils/index.mjs';
+import { checkExpiry, extractToken, updateLastUsedAt } from './api-token-utils.mjs';
+import '@strapi/types';
+
+const { UnauthorizedError, ForbiddenError } = errors;
+const isReadScope = (scope)=>scope.endsWith('find') || scope.endsWith('findOne');
+/**
+ * Authenticate a content-api token. Rejects tokens with kind !== 'content-api'.
+ */ const authenticate = async (ctx)=>{
+    const apiTokenService = getService('api-token-admin');
+    const token = extractToken(ctx);
+    if (token === null) {
+        return {
+            authenticated: false
+        };
+    }
+    const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));
+    if (apiToken === null || apiToken === undefined) {
+        return {
+            authenticated: false
+        };
+    }
+    // Defensive kind check — only handle content-api tokens.
+    // null kind is allowed: tokens created before the kind field was introduced are implicitly content-api.
+    if (apiToken.kind !== 'content-api' && apiToken.kind !== null) {
+        return {
+            authenticated: false
+        };
+    }
+    const expiryError = checkExpiry(apiToken);
+    if (expiryError !== null) {
+        return {
+            authenticated: false,
+            error: expiryError
+        };
+    }
+    await updateLastUsedAt(apiToken);
+    if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {
+        const ability = await strapi.contentAPI.permissions.engine.generateAbility(apiToken.permissions.map((action)=>({
+                action
+            })));
+        return {
+            authenticated: true,
+            ability,
+            credentials: apiToken
+        };
+    }
+    return {
+        authenticated: true,
+        credentials: apiToken
+    };
+};
+/**
+ * Verify the token has the required abilities for the requested scope.
+ *
+ * @type {import('.').VerifyFunction}
+ */ const verify = (auth, config)=>{
+    const { credentials: apiToken, ability } = auth;
+    if (apiToken === null || apiToken === undefined) {
+        throw new UnauthorizedError('Token not found');
+    }
+    const expiryError = checkExpiry(apiToken);
+    if (expiryError !== null) {
+        throw expiryError;
+    }
+    // Full access
+    if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {
+        return;
+    }
+    // Read only
+    if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {
+        const scopes = castArray(config.scope);
+        if (config.scope && scopes.every(isReadScope)) {
+            return;
+        }
+    } else if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {
+        if (ability === null || ability === undefined) {
+            throw new ForbiddenError();
+        }
+        const scopes = castArray(config.scope);
+        const isAllowed = scopes.every((scope)=>ability.can(scope));
+        if (isAllowed === true) {
+            return;
+        }
+    }
+    throw new ForbiddenError();
+};
+var contentApiTokenAuthStrategy = {
+    name: 'content-api-token',
+    authenticate,
+    verify
+};
+
+export { authenticate, contentApiTokenAuthStrategy as default, verify };
+//# sourceMappingURL=content-api-token.mjs.map

package/dist/server/server/src/strategies/content-api-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-api-token.mjs","sources":["../../../../../server/src/strategies/content-api-token.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { castArray } from 'lodash/fp';\nimport { errors } from '@strapi/utils';\nimport constants from '../services/constants';\nimport { getService } from '../utils';\nimport { extractToken, checkExpiry, updateLastUsedAt } from './api-token-utils';\nimport '@strapi/types';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst isReadScope = (scope: string) => scope.endsWith('find') || scope.endsWith('findOne');\n\n/**\n * Authenticate a content-api token. Rejects tokens with kind !== 'content-api'.\n */\nexport const authenticate = async (ctx: Context) => {\n  const apiTokenService = getService('api-token-admin');\n  const token = extractToken(ctx);\n\n  if (token === null) {\n    return { authenticated: false };\n  }\n\n  const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));\n\n  if (apiToken === null || apiToken === undefined) {\n    return { authenticated: false };\n  }\n\n  // Defensive kind check — only handle content-api tokens.\n  // null kind is allowed: tokens created before the kind field was introduced are implicitly content-api.\n  if (apiToken.kind !== 'content-api' && apiToken.kind !== null) {\n    return { authenticated: false };\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    return { authenticated: false, error: expiryError };\n  }\n\n  await updateLastUsedAt(apiToken);\n\n  if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(\n      apiToken.permissions.map((action: string) => ({ action }))\n    );\n\n    return { authenticated: true, ability, credentials: apiToken };\n  }\n\n  return { authenticated: true, credentials: apiToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope.\n *\n * @type {import('.').VerifyFunction}\n */\nexport const verify = (auth: any, config: any) => {\n  const { credentials: apiToken, ability } = auth;\n\n  if (apiToken === null || apiToken === undefined) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    throw expiryError;\n  }\n\n  // Full access\n  if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {\n    return;\n  }\n\n  // Read only\n  if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {\n    const scopes = castArray(config.scope);\n\n    if (config.scope && scopes.every(isReadScope)) {\n      return;\n    }\n  }\n\n  // Custom\n  else if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    if (ability === null || ability === undefined) {\n      throw new ForbiddenError();\n    }\n\n    const scopes = castArray(config.scope);\n    const isAllowed = scopes.every((scope: string) => ability.can(scope));\n\n    if (isAllowed === true) {\n      return;\n    }\n  }\n\n  throw new ForbiddenError();\n};\n\nexport default {\n  name: 'content-api-token',\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","isReadScope","scope","endsWith","authenticate","ctx","apiTokenService","getService","token","extractToken","authenticated","apiToken","getByAccessKey","hash","undefined","kind","expiryError","checkExpiry","error","updateLastUsedAt","type","constants","API_TOKEN_TYPE","CUSTOM","ability","strapi","contentAPI","permissions","engine","generateAbility","map","action","credentials","verify","auth","config","FULL_ACCESS","READ_ONLY","scopes","castArray","every","isAllowed","can","name"],"mappings":";;;;;;;AAQA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,MAAAA;AAE9C,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GAAkBA,KAAAA,CAAMC,QAAQ,CAAC,MAAA,CAAA,IAAWD,KAAAA,CAAMC,QAAQ,CAAC,SAAA,CAAA;AAEhF;;IAGO,MAAMC,YAAAA,GAAe,OAAOC,GAAAA,GAAAA;AACjC,IAAA,MAAMC,kBAAkBC,UAAAA,CAAW,iBAAA,CAAA;AACnC,IAAA,MAAMC,QAAQC,YAAAA,CAAaJ,GAAAA,CAAAA;AAE3B,IAAA,IAAIG,UAAU,IAAA,EAAM;QAClB,OAAO;YAAEE,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,WAAW,MAAML,eAAAA,CAAgBM,cAAc,CAACN,eAAAA,CAAgBO,IAAI,CAACL,KAAAA,CAAAA,CAAAA;IAE3E,IAAIG,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;QAC/C,OAAO;YAAEJ,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;;AAIA,IAAA,IAAIC,SAASI,IAAI,KAAK,iBAAiBJ,QAAAA,CAASI,IAAI,KAAK,IAAA,EAAM;QAC7D,OAAO;YAAEL,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMM,cAAcC,WAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,OAAO;YAAEN,aAAAA,EAAe,KAAA;YAAOQ,KAAAA,EAAOF;AAAY,SAAA;AACpD,IAAA;AAEA,IAAA,MAAMG,gBAAAA,CAAiBR,QAAAA,CAAAA;AAEvB,IAAA,IAAIA,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;AACrD,QAAA,MAAMC,UAAU,MAAMC,MAAAA,CAAOC,UAAU,CAACC,WAAW,CAACC,MAAM,CAACC,eAAe,CACxElB,SAASgB,WAAW,CAACG,GAAG,CAAC,CAACC,UAAoB;AAAEA,gBAAAA;aAAO,CAAA,CAAA,CAAA;QAGzD,OAAO;YAAErB,aAAAA,EAAe,IAAA;AAAMc,YAAAA,OAAAA;YAASQ,WAAAA,EAAarB;AAAS,SAAA;AAC/D,IAAA;IAEA,OAAO;QAAED,aAAAA,EAAe,IAAA;QAAMsB,WAAAA,EAAarB;AAAS,KAAA;AACtD;AAEA;;;;AAIC,IACM,MAAMsB,MAAAA,GAAS,CAACC,IAAAA,EAAWC,MAAAA,GAAAA;AAChC,IAAA,MAAM,EAAEH,WAAAA,EAAarB,QAAQ,EAAEa,OAAO,EAAE,GAAGU,IAAAA;IAE3C,IAAIvB,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;AAC/C,QAAA,MAAM,IAAIhB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMkB,cAAcC,WAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,MAAMA,WAAAA;AACR,IAAA;;AAGA,IAAA,IAAIL,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACc,WAAW,EAAE;AAC1D,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIzB,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACe,SAAS,EAAE;QACxD,MAAMC,MAAAA,GAASC,SAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;AAErC,QAAA,IAAIiC,OAAOjC,KAAK,IAAIoC,MAAAA,CAAOE,KAAK,CAACvC,WAAAA,CAAAA,EAAc;AAC7C,YAAA;AACF,QAAA;IACF,CAAA,MAGK,IAAIU,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;QAC1D,IAAIC,OAAAA,KAAY,IAAA,IAAQA,OAAAA,KAAYV,SAAAA,EAAW;AAC7C,YAAA,MAAM,IAAIf,cAAAA,EAAAA;AACZ,QAAA;QAEA,MAAMuC,MAAAA,GAASC,SAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;QACrC,MAAMuC,SAAAA,GAAYH,OAAOE,KAAK,CAAC,CAACtC,KAAAA,GAAkBsB,OAAAA,CAAQkB,GAAG,CAACxC,KAAAA,CAAAA,CAAAA;AAE9D,QAAA,IAAIuC,cAAc,IAAA,EAAM;AACtB,YAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAI1C,cAAAA,EAAAA;AACZ;AAEA,kCAAe;IACb4C,IAAAA,EAAM,mBAAA;AACNvC,IAAAA,YAAAA;AACA6B,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/validation/admin-tokens.js

@@ -0,0 +1,28 @@
+'use strict';
+
+var utils = require('@strapi/utils');
+var constants = require('../services/constants.js');
+var commonValidators = require('./common-validators.js');
+
+const adminTokenCreationSchema = utils.yup.object().shape({
+    kind: utils.yup.string().oneOf([
+        'admin'
+    ]).optional(),
+    name: utils.yup.string().min(1).required(),
+    description: utils.yup.string().optional(),
+    lifespan: utils.yup.number().min(1).oneOf(Object.values(constants.API_TOKEN_LIFESPANS)).nullable(),
+    adminPermissions: utils.yup.array().of(commonValidators.permission),
+    // adminUserOwner is set by the controller from ctx.state.user (full user object) or a strapiID from body
+    adminUserOwner: utils.yup.mixed().nullable()
+}).noUnknown().strict();
+const adminTokenUpdateSchema = utils.yup.object().shape({
+    name: utils.yup.string().min(1).notNull(),
+    description: utils.yup.string().nullable(),
+    adminPermissions: utils.yup.array().of(commonValidators.permission).nullable()
+}).noUnknown().strict();
+const validateAdminTokenCreationInput = utils.validateYupSchema(adminTokenCreationSchema);
+const validateAdminTokenUpdateInput = utils.validateYupSchema(adminTokenUpdateSchema);
+
+exports.validateAdminTokenCreationInput = validateAdminTokenCreationInput;
+exports.validateAdminTokenUpdateInput = validateAdminTokenUpdateInput;
+//# sourceMappingURL=admin-tokens.js.map

package/dist/server/server/src/validation/admin-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-tokens.js","sources":["../../../../../server/src/validation/admin-tokens.ts"],"sourcesContent":["import { yup, validateYupSchema } from '@strapi/utils';\nimport constants from '../services/constants';\nimport { permission } from './common-validators';\n\nconst adminTokenCreationSchema = yup\n  .object()\n  .shape({\n    kind: yup.string().oneOf(['admin']).optional(),\n    name: yup.string().min(1).required(),\n    description: yup.string().optional(),\n    lifespan: yup.number().min(1).oneOf(Object.values(constants.API_TOKEN_LIFESPANS)).nullable(),\n    adminPermissions: yup.array().of(permission),\n    // adminUserOwner is set by the controller from ctx.state.user (full user object) or a strapiID from body\n    adminUserOwner: yup.mixed().nullable(),\n  })\n  .noUnknown()\n  .strict();\n\nconst adminTokenUpdateSchema = yup\n  .object()\n  .shape({\n    name: yup.string().min(1).notNull(),\n    description: yup.string().nullable(),\n    adminPermissions: yup.array().of(permission).nullable(),\n  })\n  .noUnknown()\n  .strict();\n\nexport const validateAdminTokenCreationInput = validateYupSchema(adminTokenCreationSchema);\nexport const validateAdminTokenUpdateInput = validateYupSchema(adminTokenUpdateSchema);\n"],"names":["adminTokenCreationSchema","yup","object","shape","kind","string","oneOf","optional","name","min","required","description","lifespan","number","Object","values","constants","API_TOKEN_LIFESPANS","nullable","adminPermissions","array","of","permission","adminUserOwner","mixed","noUnknown","strict","adminTokenUpdateSchema","notNull","validateAdminTokenCreationInput","validateYupSchema","validateAdminTokenUpdateInput"],"mappings":";;;;;;AAIA,MAAMA,wBAAAA,GAA2BC,SAAAA,CAC9BC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLC,IAAAA,IAAAA,EAAMH,SAAAA,CAAII,MAAM,EAAA,CAAGC,KAAK,CAAC;AAAC,QAAA;AAAQ,KAAA,CAAA,CAAEC,QAAQ,EAAA;AAC5CC,IAAAA,IAAAA,EAAMP,UAAII,MAAM,EAAA,CAAGI,GAAG,CAAC,GAAGC,QAAQ,EAAA;IAClCC,WAAAA,EAAaV,SAAAA,CAAII,MAAM,EAAA,CAAGE,QAAQ,EAAA;AAClCK,IAAAA,QAAAA,EAAUX,SAAAA,CAAIY,MAAM,EAAA,CAAGJ,GAAG,CAAC,CAAA,CAAA,CAAGH,KAAK,CAACQ,MAAAA,CAAOC,MAAM,CAACC,SAAAA,CAAUC,mBAAmB,GAAGC,QAAQ,EAAA;AAC1FC,IAAAA,gBAAAA,EAAkBlB,SAAAA,CAAImB,KAAK,EAAA,CAAGC,EAAE,CAACC,2BAAAA,CAAAA;;IAEjCC,cAAAA,EAAgBtB,SAAAA,CAAIuB,KAAK,EAAA,CAAGN,QAAQ;AACtC,CAAA,CAAA,CACCO,SAAS,GACTC,MAAM,EAAA;AAET,MAAMC,sBAAAA,GAAyB1B,SAAAA,CAC5BC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLK,IAAAA,IAAAA,EAAMP,UAAII,MAAM,EAAA,CAAGI,GAAG,CAAC,GAAGmB,OAAO,EAAA;IACjCjB,WAAAA,EAAaV,SAAAA,CAAII,MAAM,EAAA,CAAGa,QAAQ,EAAA;AAClCC,IAAAA,gBAAAA,EAAkBlB,UAAImB,KAAK,EAAA,CAAGC,EAAE,CAACC,6BAAYJ,QAAQ;AACvD,CAAA,CAAA,CACCO,SAAS,GACTC,MAAM,EAAA;AAEF,MAAMG,+BAAAA,GAAkCC,uBAAAA,CAAkB9B,wBAAAA;AAC1D,MAAM+B,6BAAAA,GAAgCD,uBAAAA,CAAkBH,sBAAAA;;;;;"}