@strapi/admin 5.50.0 → 5.50.2

package/dist/ee/server/src/services/index.d.ts

@@ -26,9 +26,9 @@ declare const _default: {
         updateById: (id: any, attributes: any) => Promise<any>;
     };
     metrics: {
-        startCron: (strapi: import("@strapi/types/dist/core").Strapi) => void;
+        startCron: (strapi: import("@strapi/types/dist/core/strapi.js").Strapi) => void;
         getSSOProvidersList: () => Promise<any>;
-        sendUpdateProjectInformation: (strapi: import("@strapi/types/dist/core").Strapi) => Promise<void>;
+        sendUpdateProjectInformation: (strapi: import("@strapi/types/dist/core/strapi.js").Strapi) => Promise<void>;
     };
     'seat-enforcement': {
         seatEnforcementWorkflow: () => Promise<void>;

package/dist/server/ee/server/src/controllers/admin.js

@@ -20,6 +20,7 @@ var admin = {
                     features: strapi.ee.features.list(),
                     flags,
                     type: strapi.ee.type,
+                    planPriceId: strapi.ee.planPriceId,
                     ai: {
                         enabled: isAILicense && isAIConfigured.enabled
                     }

package/dist/server/ee/server/src/controllers/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,EAAAA,EAAI;wBACFP,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOQ,GAAAA,EAAK;YACZ,OAAO;gBAAEP,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOgB,EAAAA,EAAI;wBAAEP,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMS,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBlB,MAAAA,CAAOI,EAAE,CAACe,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,gBAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMZ,IAAAA,GAAO;AACXa,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,QAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,SAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDlB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin.js","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,gBAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,QAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,SAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/admin.mjs

@@ -18,6 +18,7 @@ var admin = {
                     features: strapi.ee.features.list(),
                     flags,
                     type: strapi.ee.type,
+                    planPriceId: strapi.ee.planPriceId,
                     ai: {
                         enabled: isAILicense && isAIConfigured.enabled
                     }

package/dist/server/ee/server/src/controllers/admin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,EAAAA,EAAI;wBACFP,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOQ,GAAAA,EAAK;YACZ,OAAO;gBAAEP,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOgB,EAAAA,EAAI;wBAAEP,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMS,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBlB,MAAAA,CAAOI,EAAE,CAACe,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMZ,IAAAA,GAAO;AACXa,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,KAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDlB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,KAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js

@@ -116,7 +116,7 @@ const redirectWithAuth = async (ctx)=>{
         const isProduction = process.env.NODE_ENV === 'production';
         const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
         const domain = strapi.config.get('admin.auth.domain');
-        ctx.cookies.set('jwtToken', accessToken, {
+        ctx.cookies.set(sessionAuth.getAccessCookieName(), accessToken, {
             httpOnly: false,
             secure: isSecure,
             overwrite: true,

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAAA,EAAa;YACvCS,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQH,QAAAA;YACRI,SAAAA,EAAW,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAAA,GAAgBtD,gBAAAA,CAAW,MAAA,CAAA,CAAQuD,YAAY,CAACxD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMuD,aAAAA;AAAepE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaqE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOjE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;;;"}
+{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getAccessCookieName,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;AAYA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACa,mCAAuBT,WAAAA,EAAa;YAClDU,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQJ,QAAAA;YACRK,SAAAA,EAAW,IAAA;AACXJ,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMK,aAAAA,GAAgBvD,gBAAAA,CAAW,MAAA,CAAA,CAAQwD,YAAY,CAACzD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMwD,aAAAA;AAAerE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAasE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOlE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs

@@ -1,7 +1,7 @@
 import passport from 'koa-passport';
 import { getService } from '../../utils/index.mjs';
 import utils from './utils.mjs';
-import { getSessionManager, generateDeviceId, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME } from '../../../../../shared/utils/session-auth.mjs';
+import { getSessionManager, generateDeviceId, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getAccessCookieName } from '../../../../../shared/utils/session-auth.mjs';
 
 const defaultConnectionError = ()=>new Error('Invalid connection payload');
 const authenticate = async (ctx, next)=>{
@@ -108,7 +108,7 @@ const redirectWithAuth = async (ctx)=>{
         const isProduction = process.env.NODE_ENV === 'production';
         const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
         const domain = strapi.config.get('admin.auth.domain');
-        ctx.cookies.set('jwtToken', accessToken, {
+        ctx.cookies.set(getAccessCookieName(), accessToken, {
             httpOnly: false,
             secure: isSecure,
             overwrite: true,

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,qBAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAAA,EAAa;YACvCS,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQH,QAAAA;YACRI,SAAAA,EAAW,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAAA,GAAgBtD,UAAAA,CAAW,MAAA,CAAA,CAAQuD,YAAY,CAACxD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMuD,aAAAA;AAAepE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaqE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOjE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getAccessCookieName,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAYA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,qBAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACa,uBAAuBT,WAAAA,EAAa;YAClDU,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQJ,QAAAA;YACRK,SAAAA,EAAW,IAAA;AACXJ,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMK,aAAAA,GAAgBvD,UAAAA,CAAW,MAAA,CAAA,CAAQwD,YAAY,CAACzD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMwD,aAAAA;AAAerE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAasE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOlE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/permission/sections-builder/handlers.js

@@ -45,11 +45,15 @@ const { isVisibleAttribute } = utils.contentTypes;
  * @param {ContentTypesSection} section
  */ const contentTypesBase = ({ action, section })=>{
     const { displayName, actionId, subjects, options } = action;
+    // Strip non-displayed content types so they don't appear as configurable subjects
+    // in the roles UI (e.g. plugin::users-permissions.role).
+    const allContentTypes = strapi.contentTypes;
+    const filteredSubjects = subjects?.filter((uid)=>allContentTypes[uid]?.pluginOptions?.['content-manager']?.visible !== false);
     section.actions.push({
         // @ts-expect-error - label should be displayName, TODO: Investigate at which point the label property
         label: displayName,
         actionId,
-        subjects,
+        subjects: filteredSubjects,
         ...utils$1.getValidOptions(options)
     });
 };
@@ -64,7 +68,10 @@ const { isVisibleAttribute } = utils.contentTypes;
         const newSubjects = subjects// Ignore already added subjects
         .filter(utils$1.isNotInSubjects(contentTypesSection.subjects))// Transform UIDs into content-types
         .map(utils$1.resolveContentType)// Only keep specific kind of content-types
-        .filter(utils$1.isOfKind(kind))// Transform the content-types into section's subjects
+        .filter(utils$1.isOfKind(kind))// Exclude content types hidden from the content manager (e.g. plugin::users-permissions.role).
+        // Those types are valid explorer.read subjects so that super admin can read relation targets,
+        // but they should not appear as configurable permissions in the roles UI.
+        .filter((ct)=>ct?.pluginOptions?.['content-manager']?.visible !== false)// Transform the content-types into section's subjects
         .map(utils$1.toSubjectTemplate);
         contentTypesSection.subjects.push(...newSubjects);
     };

package/dist/server/server/src/services/permission/sections-builder/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sources":["../../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"sourcesContent":["import type { Internal } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\nimport {\n  toSubjectTemplate,\n  getValidOptions,\n  hasProperty,\n  isNotInSubjects,\n  resolveContentType,\n  isOfKind,\n} from './utils';\nimport type { Action } from '../../../domain/action';\n\nconst { isVisibleAttribute } = contentTypes;\n\nexport type ContentTypesSection = {\n  actions: Action[];\n  subjects: any[];\n};\n\nexport type ActionArraySection = Action[];\n\n/**\n * Transforms & adds the given  setting action to the section\n * Note: The action is transformed to a setting specific format\n * @param options\n * @param options.action\n * @param section\n */\nconst settings = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { category, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    category,\n    subCategory,\n    // TODO: Investigate at which point the action property is transformed to actionId\n    // @ts-expect-error - action should be actionID\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given plugin action to the section\n * Note: The action is transformed to a plugin specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ActionArraySection} section\n */\nconst plugins = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { pluginName, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    // @ts-expect-error - plugin should be pluginName, TODO: Investigate at which point the plugin property\n    plugin: pluginName,\n    subCategory,\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given action to the section's actions field\n * Note: The action is transformed to a content-type specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ContentTypesSection} section\n */\nconst contentTypesBase = ({\n  action,\n  section,\n}: {\n  action: Action;\n  section: ContentTypesSection;\n}) => {\n  const { displayName, actionId, subjects, options } = action;\n\n  section.actions.push({\n    // @ts-expect-error - label should be displayName, TODO: Investigate at which point the label property\n    label: displayName,\n    actionId,\n    subjects,\n    ...getValidOptions(options),\n  });\n};\n\n/**\n * Initialize the subjects array of a section based on the action's subjects\n */\nconst subjectsHandlerFor =\n  (kind: string) =>\n  ({ action, section: contentTypesSection }: { action: Action; section: ContentTypesSection }) => {\n    // TODO: add a type guard for UID.ContentType\n    const subjects = action.subjects as Internal.UID.ContentType[];\n\n    if (!subjects?.length) {\n      return;\n    }\n\n    const newSubjects = subjects\n      // Ignore already added subjects\n      .filter(isNotInSubjects(contentTypesSection.subjects))\n      // Transform UIDs into content-types\n      .map(resolveContentType)\n      // Only keep specific kind of content-types\n      .filter(isOfKind(kind))\n      // Transform the content-types into section's subjects\n      .map(toSubjectTemplate);\n\n    contentTypesSection.subjects.push(...newSubjects);\n  };\n\nconst buildNode = (model: any, attributeName: string, attribute: any) => {\n  if (!isVisibleAttribute(model, attributeName)) {\n    return null;\n  }\n\n  const node = { label: attributeName, value: attributeName };\n\n  if (attribute.required) {\n    Object.assign(node, { required: true });\n  }\n\n  if (attribute.type === 'component') {\n    const component = strapi.components[attribute.component];\n    return { ...node, children: buildDeepAttributesCollection(component) };\n  }\n\n  return node;\n};\n\nconst buildDeepAttributesCollection = (model: any): unknown => {\n  return Object.entries(model.attributes)\n    .map(([attributeName, attribute]) => buildNode(model, attributeName, attribute))\n    .filter((node) => node !== null);\n};\n\n/**\n * Create and populate the fields property for section's subjects based on the action's subjects list\n */\nconst fieldsProperty = ({ action, section }: { action: Action; section: ContentTypesSection }) => {\n  const { subjects } = action;\n\n  section.subjects\n    .filter((subject) => subjects?.includes(subject.uid))\n    .forEach((subject) => {\n      const { uid } = subject;\n      const contentType = resolveContentType(uid);\n\n      if (hasProperty('fields', subject)) {\n        return;\n      }\n\n      const fields = buildDeepAttributesCollection(contentType);\n      const fieldsProp = { label: 'Fields', value: 'fields', children: fields };\n\n      subject.properties.push(fieldsProp);\n    });\n};\n\nexport { plugins, settings, subjectsHandlerFor, contentTypesBase, fieldsProperty };\n"],"names":["isVisibleAttribute","contentTypes","settings","action","section","category","subCategory","displayName","actionId","push","plugins","pluginName","plugin","contentTypesBase","subjects","options","actions","label","getValidOptions","subjectsHandlerFor","kind","contentTypesSection","length","newSubjects","filter","isNotInSubjects","map","resolveContentType","isOfKind","toSubjectTemplate","buildNode","model","attributeName","attribute","node","value","required","Object","assign","type","component","strapi","components","children","buildDeepAttributesCollection","entries","attributes","fieldsProperty","subject","includes","uid","forEach","contentType","hasProperty","fields","fieldsProp","properties"],"mappings":";;;;;AAYA,MAAM,EAAEA,kBAAkB,EAAE,GAAGC,kBAAAA;AAS/B;;;;;;AAMC,UACKC,QAAAA,GAAW,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACpF,MAAM,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAEzDC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;AACAF,QAAAA,QAAAA;AACAC,QAAAA,WAAAA;;;QAGAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKE,OAAAA,GAAU,CAAC,EAAEP,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACnF,MAAM,EAAEO,UAAU,EAAEL,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAE3DC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;;QAEAK,MAAAA,EAAQD,UAAAA;AACRL,QAAAA,WAAAA;QACAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKK,gBAAAA,GAAmB,CAAC,EACxBV,MAAM,EACNC,OAAO,EAIR,GAAA;IACC,MAAM,EAAEG,WAAW,EAAEC,QAAQ,EAAEM,QAAQ,EAAEC,OAAO,EAAE,GAAGZ,MAAAA;IAErDC,OAAAA,CAAQY,OAAO,CAACP,IAAI,CAAC;;QAEnBQ,KAAAA,EAAOV,WAAAA;AACPC,QAAAA,QAAAA;AACAM,QAAAA,QAAAA;AACA,QAAA,GAAGI,wBAAgBH,OAAAA;AACrB,KAAA,CAAA;AACF;AAEA;;IAGA,MAAMI,kBAAAA,GACJ,CAACC,IAAAA,GACD,CAAC,EAAEjB,MAAM,EAAEC,OAAAA,EAASiB,mBAAmB,EAAoD,GAAA;;QAEzF,MAAMP,QAAAA,GAAWX,OAAOW,QAAQ;QAEhC,IAAI,CAACA,UAAUQ,MAAAA,EAAQ;AACrB,YAAA;AACF,QAAA;QAEA,MAAMC,WAAAA,GAAcT,QAClB;AACCU,SAAAA,MAAM,CAACC,uBAAAA,CAAgBJ,mBAAAA,CAAoBP,QAAQ,EACpD;SACCY,GAAG,CAACC,2BACL;SACCH,MAAM,CAACI,gBAAAA,CAASR,IAAAA,CAAAA,CACjB;AACCM,SAAAA,GAAG,CAACG,yBAAAA,CAAAA;QAEPR,mBAAAA,CAAoBP,QAAQ,CAACL,IAAI,CAAA,GAAIc,WAAAA,CAAAA;AACvC,IAAA;AAEF,MAAMO,SAAAA,GAAY,CAACC,KAAAA,EAAYC,aAAAA,EAAuBC,SAAAA,GAAAA;IACpD,IAAI,CAACjC,kBAAAA,CAAmB+B,KAAAA,EAAOC,aAAAA,CAAAA,EAAgB;QAC7C,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAME,IAAAA,GAAO;QAAEjB,KAAAA,EAAOe,aAAAA;QAAeG,KAAAA,EAAOH;AAAc,KAAA;IAE1D,IAAIC,SAAAA,CAAUG,QAAQ,EAAE;QACtBC,MAAAA,CAAOC,MAAM,CAACJ,IAAAA,EAAM;YAAEE,QAAAA,EAAU;AAAK,SAAA,CAAA;AACvC,IAAA;IAEA,IAAIH,SAAAA,CAAUM,IAAI,KAAK,WAAA,EAAa;AAClC,QAAA,MAAMC,YAAYC,MAAAA,CAAOC,UAAU,CAACT,SAAAA,CAAUO,SAAS,CAAC;QACxD,OAAO;AAAE,YAAA,GAAGN,IAAI;AAAES,YAAAA,QAAAA,EAAUC,6BAAAA,CAA8BJ,SAAAA;AAAW,SAAA;AACvE,IAAA;IAEA,OAAON,IAAAA;AACT,CAAA;AAEA,MAAMU,gCAAgC,CAACb,KAAAA,GAAAA;IACrC,OAAOM,MAAAA,CAAOQ,OAAO,CAACd,KAAAA,CAAMe,UAAU,CAAA,CACnCpB,GAAG,CAAC,CAAC,CAACM,eAAeC,SAAAA,CAAU,GAAKH,UAAUC,KAAAA,EAAOC,aAAAA,EAAeC,YACpET,MAAM,CAAC,CAACU,IAAAA,GAASA,IAAAA,KAAS,IAAA,CAAA;AAC/B,CAAA;AAEA;;AAEC,UACKa,cAAAA,GAAiB,CAAC,EAAE5C,MAAM,EAAEC,OAAO,EAAoD,GAAA;IAC3F,MAAM,EAAEU,QAAQ,EAAE,GAAGX,MAAAA;AAErBC,IAAAA,OAAAA,CAAQU,QAAQ,CACbU,MAAM,CAAC,CAACwB,OAAAA,GAAYlC,QAAAA,EAAUmC,QAAAA,CAASD,OAAAA,CAAQE,GAAG,CAAA,CAAA,CAClDC,OAAO,CAAC,CAACH,OAAAA,GAAAA;QACR,MAAM,EAAEE,GAAG,EAAE,GAAGF,OAAAA;AAChB,QAAA,MAAMI,cAAczB,0BAAAA,CAAmBuB,GAAAA,CAAAA;QAEvC,IAAIG,mBAAAA,CAAY,UAAUL,OAAAA,CAAAA,EAAU;AAClC,YAAA;AACF,QAAA;AAEA,QAAA,MAAMM,SAASV,6BAAAA,CAA8BQ,WAAAA,CAAAA;AAC7C,QAAA,MAAMG,UAAAA,GAAa;YAAEtC,KAAAA,EAAO,QAAA;YAAUkB,KAAAA,EAAO,QAAA;YAAUQ,QAAAA,EAAUW;AAAO,SAAA;QAExEN,OAAAA,CAAQQ,UAAU,CAAC/C,IAAI,CAAC8C,UAAAA,CAAAA;AAC1B,IAAA,CAAA,CAAA;AACJ;;;;;;;;"}
+{"version":3,"file":"handlers.js","sources":["../../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"sourcesContent":["import type { Internal } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\nimport {\n  toSubjectTemplate,\n  getValidOptions,\n  hasProperty,\n  isNotInSubjects,\n  resolveContentType,\n  isOfKind,\n} from './utils';\nimport type { Action } from '../../../domain/action';\n\nconst { isVisibleAttribute } = contentTypes;\n\nexport type ContentTypesSection = {\n  actions: Action[];\n  subjects: any[];\n};\n\nexport type ActionArraySection = Action[];\n\n/**\n * Transforms & adds the given  setting action to the section\n * Note: The action is transformed to a setting specific format\n * @param options\n * @param options.action\n * @param section\n */\nconst settings = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { category, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    category,\n    subCategory,\n    // TODO: Investigate at which point the action property is transformed to actionId\n    // @ts-expect-error - action should be actionID\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given plugin action to the section\n * Note: The action is transformed to a plugin specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ActionArraySection} section\n */\nconst plugins = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { pluginName, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    // @ts-expect-error - plugin should be pluginName, TODO: Investigate at which point the plugin property\n    plugin: pluginName,\n    subCategory,\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given action to the section's actions field\n * Note: The action is transformed to a content-type specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ContentTypesSection} section\n */\nconst contentTypesBase = ({\n  action,\n  section,\n}: {\n  action: Action;\n  section: ContentTypesSection;\n}) => {\n  const { displayName, actionId, subjects, options } = action;\n\n  // Strip non-displayed content types so they don't appear as configurable subjects\n  // in the roles UI (e.g. plugin::users-permissions.role).\n  const allContentTypes = strapi.contentTypes as Record<string, any>;\n  const filteredSubjects = subjects?.filter(\n    (uid) =>\n      (\n        allContentTypes[uid as string]?.pluginOptions?.['content-manager'] as\n          | { visible?: boolean }\n          | undefined\n      )?.visible !== false\n  );\n\n  section.actions.push({\n    // @ts-expect-error - label should be displayName, TODO: Investigate at which point the label property\n    label: displayName,\n    actionId,\n    subjects: filteredSubjects,\n    ...getValidOptions(options),\n  });\n};\n\n/**\n * Initialize the subjects array of a section based on the action's subjects\n */\nconst subjectsHandlerFor =\n  (kind: string) =>\n  ({ action, section: contentTypesSection }: { action: Action; section: ContentTypesSection }) => {\n    // TODO: add a type guard for UID.ContentType\n    const subjects = action.subjects as Internal.UID.ContentType[];\n\n    if (!subjects?.length) {\n      return;\n    }\n\n    const newSubjects = subjects\n      // Ignore already added subjects\n      .filter(isNotInSubjects(contentTypesSection.subjects))\n      // Transform UIDs into content-types\n      .map(resolveContentType)\n      // Only keep specific kind of content-types\n      .filter(isOfKind(kind))\n      // Exclude content types hidden from the content manager (e.g. plugin::users-permissions.role).\n      // Those types are valid explorer.read subjects so that super admin can read relation targets,\n      // but they should not appear as configurable permissions in the roles UI.\n      .filter(\n        (ct) =>\n          (ct?.pluginOptions?.['content-manager'] as { visible?: boolean } | undefined)?.visible !==\n          false\n      )\n      // Transform the content-types into section's subjects\n      .map(toSubjectTemplate);\n\n    contentTypesSection.subjects.push(...newSubjects);\n  };\n\nconst buildNode = (model: any, attributeName: string, attribute: any) => {\n  if (!isVisibleAttribute(model, attributeName)) {\n    return null;\n  }\n\n  const node = { label: attributeName, value: attributeName };\n\n  if (attribute.required) {\n    Object.assign(node, { required: true });\n  }\n\n  if (attribute.type === 'component') {\n    const component = strapi.components[attribute.component];\n    return { ...node, children: buildDeepAttributesCollection(component) };\n  }\n\n  return node;\n};\n\nconst buildDeepAttributesCollection = (model: any): unknown => {\n  return Object.entries(model.attributes)\n    .map(([attributeName, attribute]) => buildNode(model, attributeName, attribute))\n    .filter((node) => node !== null);\n};\n\n/**\n * Create and populate the fields property for section's subjects based on the action's subjects list\n */\nconst fieldsProperty = ({ action, section }: { action: Action; section: ContentTypesSection }) => {\n  const { subjects } = action;\n\n  section.subjects\n    .filter((subject) => subjects?.includes(subject.uid))\n    .forEach((subject) => {\n      const { uid } = subject;\n      const contentType = resolveContentType(uid);\n\n      if (hasProperty('fields', subject)) {\n        return;\n      }\n\n      const fields = buildDeepAttributesCollection(contentType);\n      const fieldsProp = { label: 'Fields', value: 'fields', children: fields };\n\n      subject.properties.push(fieldsProp);\n    });\n};\n\nexport { plugins, settings, subjectsHandlerFor, contentTypesBase, fieldsProperty };\n"],"names":["isVisibleAttribute","contentTypes","settings","action","section","category","subCategory","displayName","actionId","push","plugins","pluginName","plugin","contentTypesBase","subjects","options","allContentTypes","strapi","filteredSubjects","filter","uid","pluginOptions","visible","actions","label","getValidOptions","subjectsHandlerFor","kind","contentTypesSection","length","newSubjects","isNotInSubjects","map","resolveContentType","isOfKind","ct","toSubjectTemplate","buildNode","model","attributeName","attribute","node","value","required","Object","assign","type","component","components","children","buildDeepAttributesCollection","entries","attributes","fieldsProperty","subject","includes","forEach","contentType","hasProperty","fields","fieldsProp","properties"],"mappings":";;;;;AAYA,MAAM,EAAEA,kBAAkB,EAAE,GAAGC,kBAAAA;AAS/B;;;;;;AAMC,UACKC,QAAAA,GAAW,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACpF,MAAM,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAEzDC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;AACAF,QAAAA,QAAAA;AACAC,QAAAA,WAAAA;;;QAGAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKE,OAAAA,GAAU,CAAC,EAAEP,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACnF,MAAM,EAAEO,UAAU,EAAEL,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAE3DC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;;QAEAK,MAAAA,EAAQD,UAAAA;AACRL,QAAAA,WAAAA;QACAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKK,gBAAAA,GAAmB,CAAC,EACxBV,MAAM,EACNC,OAAO,EAIR,GAAA;IACC,MAAM,EAAEG,WAAW,EAAEC,QAAQ,EAAEM,QAAQ,EAAEC,OAAO,EAAE,GAAGZ,MAAAA;;;IAIrD,MAAMa,eAAAA,GAAkBC,OAAOhB,YAAY;AAC3C,IAAA,MAAMiB,gBAAAA,GAAmBJ,QAAAA,EAAUK,MAAAA,CACjC,CAACC,MACC,eACiB,CAACA,GAAAA,CAAc,EAAEC,aAAAA,GAAgB,iBAAA,CAAkB,EAGjEC,OAAAA,KAAY,KAAA,CAAA;IAGnBlB,OAAAA,CAAQmB,OAAO,CAACd,IAAI,CAAC;;QAEnBe,KAAAA,EAAOjB,WAAAA;AACPC,QAAAA,QAAAA;QACAM,QAAAA,EAAUI,gBAAAA;AACV,QAAA,GAAGO,wBAAgBV,OAAAA;AACrB,KAAA,CAAA;AACF;AAEA;;IAGA,MAAMW,kBAAAA,GACJ,CAACC,IAAAA,GACD,CAAC,EAAExB,MAAM,EAAEC,OAAAA,EAASwB,mBAAmB,EAAoD,GAAA;;QAEzF,MAAMd,QAAAA,GAAWX,OAAOW,QAAQ;QAEhC,IAAI,CAACA,UAAUe,MAAAA,EAAQ;AACrB,YAAA;AACF,QAAA;QAEA,MAAMC,WAAAA,GAAchB,QAClB;AACCK,SAAAA,MAAM,CAACY,uBAAAA,CAAgBH,mBAAAA,CAAoBd,QAAQ,EACpD;SACCkB,GAAG,CAACC,2BACL;SACCd,MAAM,CAACe,gBAAAA,CAASP,IAAAA,CAAAA,CACjB;;;SAGCR,MAAM,CACL,CAACgB,EAAAA,GACC,EAACA,EAAId,aAAAA,GAAgB,iBAAA,CAAkB,EAAwCC,OAAAA,KAC/E,KAAA,CAEJ;AACCU,SAAAA,GAAG,CAACI,yBAAAA,CAAAA;QAEPR,mBAAAA,CAAoBd,QAAQ,CAACL,IAAI,CAAA,GAAIqB,WAAAA,CAAAA;AACvC,IAAA;AAEF,MAAMO,SAAAA,GAAY,CAACC,KAAAA,EAAYC,aAAAA,EAAuBC,SAAAA,GAAAA;IACpD,IAAI,CAACxC,kBAAAA,CAAmBsC,KAAAA,EAAOC,aAAAA,CAAAA,EAAgB;QAC7C,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAME,IAAAA,GAAO;QAAEjB,KAAAA,EAAOe,aAAAA;QAAeG,KAAAA,EAAOH;AAAc,KAAA;IAE1D,IAAIC,SAAAA,CAAUG,QAAQ,EAAE;QACtBC,MAAAA,CAAOC,MAAM,CAACJ,IAAAA,EAAM;YAAEE,QAAAA,EAAU;AAAK,SAAA,CAAA;AACvC,IAAA;IAEA,IAAIH,SAAAA,CAAUM,IAAI,KAAK,WAAA,EAAa;AAClC,QAAA,MAAMC,YAAY9B,MAAAA,CAAO+B,UAAU,CAACR,SAAAA,CAAUO,SAAS,CAAC;QACxD,OAAO;AAAE,YAAA,GAAGN,IAAI;AAAEQ,YAAAA,QAAAA,EAAUC,6BAAAA,CAA8BH,SAAAA;AAAW,SAAA;AACvE,IAAA;IAEA,OAAON,IAAAA;AACT,CAAA;AAEA,MAAMS,gCAAgC,CAACZ,KAAAA,GAAAA;IACrC,OAAOM,MAAAA,CAAOO,OAAO,CAACb,KAAAA,CAAMc,UAAU,CAAA,CACnCpB,GAAG,CAAC,CAAC,CAACO,eAAeC,SAAAA,CAAU,GAAKH,UAAUC,KAAAA,EAAOC,aAAAA,EAAeC,YACpErB,MAAM,CAAC,CAACsB,IAAAA,GAASA,IAAAA,KAAS,IAAA,CAAA;AAC/B,CAAA;AAEA;;AAEC,UACKY,cAAAA,GAAiB,CAAC,EAAElD,MAAM,EAAEC,OAAO,EAAoD,GAAA;IAC3F,MAAM,EAAEU,QAAQ,EAAE,GAAGX,MAAAA;AAErBC,IAAAA,OAAAA,CAAQU,QAAQ,CACbK,MAAM,CAAC,CAACmC,OAAAA,GAAYxC,QAAAA,EAAUyC,QAAAA,CAASD,OAAAA,CAAQlC,GAAG,CAAA,CAAA,CAClDoC,OAAO,CAAC,CAACF,OAAAA,GAAAA;QACR,MAAM,EAAElC,GAAG,EAAE,GAAGkC,OAAAA;AAChB,QAAA,MAAMG,cAAcxB,0BAAAA,CAAmBb,GAAAA,CAAAA;QAEvC,IAAIsC,mBAAAA,CAAY,UAAUJ,OAAAA,CAAAA,EAAU;AAClC,YAAA;AACF,QAAA;AAEA,QAAA,MAAMK,SAAST,6BAAAA,CAA8BO,WAAAA,CAAAA;AAC7C,QAAA,MAAMG,UAAAA,GAAa;YAAEpC,KAAAA,EAAO,QAAA;YAAUkB,KAAAA,EAAO,QAAA;YAAUO,QAAAA,EAAUU;AAAO,SAAA;QAExEL,OAAAA,CAAQO,UAAU,CAACpD,IAAI,CAACmD,UAAAA,CAAAA;AAC1B,IAAA,CAAA,CAAA;AACJ;;;;;;;;"}

package/dist/server/server/src/services/permission/sections-builder/handlers.mjs

@@ -43,11 +43,15 @@ const { isVisibleAttribute } = contentTypes;
  * @param {ContentTypesSection} section
  */ const contentTypesBase = ({ action, section })=>{
     const { displayName, actionId, subjects, options } = action;
+    // Strip non-displayed content types so they don't appear as configurable subjects
+    // in the roles UI (e.g. plugin::users-permissions.role).
+    const allContentTypes = strapi.contentTypes;
+    const filteredSubjects = subjects?.filter((uid)=>allContentTypes[uid]?.pluginOptions?.['content-manager']?.visible !== false);
     section.actions.push({
         // @ts-expect-error - label should be displayName, TODO: Investigate at which point the label property
         label: displayName,
         actionId,
-        subjects,
+        subjects: filteredSubjects,
         ...getValidOptions(options)
     });
 };
@@ -62,7 +66,10 @@ const { isVisibleAttribute } = contentTypes;
         const newSubjects = subjects// Ignore already added subjects
         .filter(isNotInSubjects(contentTypesSection.subjects))// Transform UIDs into content-types
         .map(resolveContentType)// Only keep specific kind of content-types
-        .filter(isOfKind(kind))// Transform the content-types into section's subjects
+        .filter(isOfKind(kind))// Exclude content types hidden from the content manager (e.g. plugin::users-permissions.role).
+        // Those types are valid explorer.read subjects so that super admin can read relation targets,
+        // but they should not appear as configurable permissions in the roles UI.
+        .filter((ct)=>ct?.pluginOptions?.['content-manager']?.visible !== false)// Transform the content-types into section's subjects
         .map(toSubjectTemplate);
         contentTypesSection.subjects.push(...newSubjects);
     };

package/dist/server/server/src/services/permission/sections-builder/handlers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.mjs","sources":["../../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"sourcesContent":["import type { Internal } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\nimport {\n  toSubjectTemplate,\n  getValidOptions,\n  hasProperty,\n  isNotInSubjects,\n  resolveContentType,\n  isOfKind,\n} from './utils';\nimport type { Action } from '../../../domain/action';\n\nconst { isVisibleAttribute } = contentTypes;\n\nexport type ContentTypesSection = {\n  actions: Action[];\n  subjects: any[];\n};\n\nexport type ActionArraySection = Action[];\n\n/**\n * Transforms & adds the given  setting action to the section\n * Note: The action is transformed to a setting specific format\n * @param options\n * @param options.action\n * @param section\n */\nconst settings = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { category, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    category,\n    subCategory,\n    // TODO: Investigate at which point the action property is transformed to actionId\n    // @ts-expect-error - action should be actionID\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given plugin action to the section\n * Note: The action is transformed to a plugin specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ActionArraySection} section\n */\nconst plugins = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { pluginName, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    // @ts-expect-error - plugin should be pluginName, TODO: Investigate at which point the plugin property\n    plugin: pluginName,\n    subCategory,\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given action to the section's actions field\n * Note: The action is transformed to a content-type specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ContentTypesSection} section\n */\nconst contentTypesBase = ({\n  action,\n  section,\n}: {\n  action: Action;\n  section: ContentTypesSection;\n}) => {\n  const { displayName, actionId, subjects, options } = action;\n\n  section.actions.push({\n    // @ts-expect-error - label should be displayName, TODO: Investigate at which point the label property\n    label: displayName,\n    actionId,\n    subjects,\n    ...getValidOptions(options),\n  });\n};\n\n/**\n * Initialize the subjects array of a section based on the action's subjects\n */\nconst subjectsHandlerFor =\n  (kind: string) =>\n  ({ action, section: contentTypesSection }: { action: Action; section: ContentTypesSection }) => {\n    // TODO: add a type guard for UID.ContentType\n    const subjects = action.subjects as Internal.UID.ContentType[];\n\n    if (!subjects?.length) {\n      return;\n    }\n\n    const newSubjects = subjects\n      // Ignore already added subjects\n      .filter(isNotInSubjects(contentTypesSection.subjects))\n      // Transform UIDs into content-types\n      .map(resolveContentType)\n      // Only keep specific kind of content-types\n      .filter(isOfKind(kind))\n      // Transform the content-types into section's subjects\n      .map(toSubjectTemplate);\n\n    contentTypesSection.subjects.push(...newSubjects);\n  };\n\nconst buildNode = (model: any, attributeName: string, attribute: any) => {\n  if (!isVisibleAttribute(model, attributeName)) {\n    return null;\n  }\n\n  const node = { label: attributeName, value: attributeName };\n\n  if (attribute.required) {\n    Object.assign(node, { required: true });\n  }\n\n  if (attribute.type === 'component') {\n    const component = strapi.components[attribute.component];\n    return { ...node, children: buildDeepAttributesCollection(component) };\n  }\n\n  return node;\n};\n\nconst buildDeepAttributesCollection = (model: any): unknown => {\n  return Object.entries(model.attributes)\n    .map(([attributeName, attribute]) => buildNode(model, attributeName, attribute))\n    .filter((node) => node !== null);\n};\n\n/**\n * Create and populate the fields property for section's subjects based on the action's subjects list\n */\nconst fieldsProperty = ({ action, section }: { action: Action; section: ContentTypesSection }) => {\n  const { subjects } = action;\n\n  section.subjects\n    .filter((subject) => subjects?.includes(subject.uid))\n    .forEach((subject) => {\n      const { uid } = subject;\n      const contentType = resolveContentType(uid);\n\n      if (hasProperty('fields', subject)) {\n        return;\n      }\n\n      const fields = buildDeepAttributesCollection(contentType);\n      const fieldsProp = { label: 'Fields', value: 'fields', children: fields };\n\n      subject.properties.push(fieldsProp);\n    });\n};\n\nexport { plugins, settings, subjectsHandlerFor, contentTypesBase, fieldsProperty };\n"],"names":["isVisibleAttribute","contentTypes","settings","action","section","category","subCategory","displayName","actionId","push","plugins","pluginName","plugin","contentTypesBase","subjects","options","actions","label","getValidOptions","subjectsHandlerFor","kind","contentTypesSection","length","newSubjects","filter","isNotInSubjects","map","resolveContentType","isOfKind","toSubjectTemplate","buildNode","model","attributeName","attribute","node","value","required","Object","assign","type","component","strapi","components","children","buildDeepAttributesCollection","entries","attributes","fieldsProperty","subject","includes","uid","forEach","contentType","hasProperty","fields","fieldsProp","properties"],"mappings":";;;AAYA,MAAM,EAAEA,kBAAkB,EAAE,GAAGC,YAAAA;AAS/B;;;;;;AAMC,UACKC,QAAAA,GAAW,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACpF,MAAM,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAEzDC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;AACAF,QAAAA,QAAAA;AACAC,QAAAA,WAAAA;;;QAGAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKE,OAAAA,GAAU,CAAC,EAAEP,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACnF,MAAM,EAAEO,UAAU,EAAEL,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAE3DC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;;QAEAK,MAAAA,EAAQD,UAAAA;AACRL,QAAAA,WAAAA;QACAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKK,gBAAAA,GAAmB,CAAC,EACxBV,MAAM,EACNC,OAAO,EAIR,GAAA;IACC,MAAM,EAAEG,WAAW,EAAEC,QAAQ,EAAEM,QAAQ,EAAEC,OAAO,EAAE,GAAGZ,MAAAA;IAErDC,OAAAA,CAAQY,OAAO,CAACP,IAAI,CAAC;;QAEnBQ,KAAAA,EAAOV,WAAAA;AACPC,QAAAA,QAAAA;AACAM,QAAAA,QAAAA;AACA,QAAA,GAAGI,gBAAgBH,OAAAA;AACrB,KAAA,CAAA;AACF;AAEA;;IAGA,MAAMI,kBAAAA,GACJ,CAACC,IAAAA,GACD,CAAC,EAAEjB,MAAM,EAAEC,OAAAA,EAASiB,mBAAmB,EAAoD,GAAA;;QAEzF,MAAMP,QAAAA,GAAWX,OAAOW,QAAQ;QAEhC,IAAI,CAACA,UAAUQ,MAAAA,EAAQ;AACrB,YAAA;AACF,QAAA;QAEA,MAAMC,WAAAA,GAAcT,QAClB;AACCU,SAAAA,MAAM,CAACC,eAAAA,CAAgBJ,mBAAAA,CAAoBP,QAAQ,EACpD;SACCY,GAAG,CAACC,mBACL;SACCH,MAAM,CAACI,QAAAA,CAASR,IAAAA,CAAAA,CACjB;AACCM,SAAAA,GAAG,CAACG,iBAAAA,CAAAA;QAEPR,mBAAAA,CAAoBP,QAAQ,CAACL,IAAI,CAAA,GAAIc,WAAAA,CAAAA;AACvC,IAAA;AAEF,MAAMO,SAAAA,GAAY,CAACC,KAAAA,EAAYC,aAAAA,EAAuBC,SAAAA,GAAAA;IACpD,IAAI,CAACjC,kBAAAA,CAAmB+B,KAAAA,EAAOC,aAAAA,CAAAA,EAAgB;QAC7C,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAME,IAAAA,GAAO;QAAEjB,KAAAA,EAAOe,aAAAA;QAAeG,KAAAA,EAAOH;AAAc,KAAA;IAE1D,IAAIC,SAAAA,CAAUG,QAAQ,EAAE;QACtBC,MAAAA,CAAOC,MAAM,CAACJ,IAAAA,EAAM;YAAEE,QAAAA,EAAU;AAAK,SAAA,CAAA;AACvC,IAAA;IAEA,IAAIH,SAAAA,CAAUM,IAAI,KAAK,WAAA,EAAa;AAClC,QAAA,MAAMC,YAAYC,MAAAA,CAAOC,UAAU,CAACT,SAAAA,CAAUO,SAAS,CAAC;QACxD,OAAO;AAAE,YAAA,GAAGN,IAAI;AAAES,YAAAA,QAAAA,EAAUC,6BAAAA,CAA8BJ,SAAAA;AAAW,SAAA;AACvE,IAAA;IAEA,OAAON,IAAAA;AACT,CAAA;AAEA,MAAMU,gCAAgC,CAACb,KAAAA,GAAAA;IACrC,OAAOM,MAAAA,CAAOQ,OAAO,CAACd,KAAAA,CAAMe,UAAU,CAAA,CACnCpB,GAAG,CAAC,CAAC,CAACM,eAAeC,SAAAA,CAAU,GAAKH,UAAUC,KAAAA,EAAOC,aAAAA,EAAeC,YACpET,MAAM,CAAC,CAACU,IAAAA,GAASA,IAAAA,KAAS,IAAA,CAAA;AAC/B,CAAA;AAEA;;AAEC,UACKa,cAAAA,GAAiB,CAAC,EAAE5C,MAAM,EAAEC,OAAO,EAAoD,GAAA;IAC3F,MAAM,EAAEU,QAAQ,EAAE,GAAGX,MAAAA;AAErBC,IAAAA,OAAAA,CAAQU,QAAQ,CACbU,MAAM,CAAC,CAACwB,OAAAA,GAAYlC,QAAAA,EAAUmC,QAAAA,CAASD,OAAAA,CAAQE,GAAG,CAAA,CAAA,CAClDC,OAAO,CAAC,CAACH,OAAAA,GAAAA;QACR,MAAM,EAAEE,GAAG,EAAE,GAAGF,OAAAA;AAChB,QAAA,MAAMI,cAAczB,kBAAAA,CAAmBuB,GAAAA,CAAAA;QAEvC,IAAIG,WAAAA,CAAY,UAAUL,OAAAA,CAAAA,EAAU;AAClC,YAAA;AACF,QAAA;AAEA,QAAA,MAAMM,SAASV,6BAAAA,CAA8BQ,WAAAA,CAAAA;AAC7C,QAAA,MAAMG,UAAAA,GAAa;YAAEtC,KAAAA,EAAO,QAAA;YAAUkB,KAAAA,EAAO,QAAA;YAAUQ,QAAAA,EAAUW;AAAO,SAAA;QAExEN,OAAAA,CAAQQ,UAAU,CAAC/C,IAAI,CAAC8C,UAAAA,CAAAA;AAC1B,IAAA,CAAA,CAAA;AACJ;;;;"}
+{"version":3,"file":"handlers.mjs","sources":["../../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"sourcesContent":["import type { Internal } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\nimport {\n  toSubjectTemplate,\n  getValidOptions,\n  hasProperty,\n  isNotInSubjects,\n  resolveContentType,\n  isOfKind,\n} from './utils';\nimport type { Action } from '../../../domain/action';\n\nconst { isVisibleAttribute } = contentTypes;\n\nexport type ContentTypesSection = {\n  actions: Action[];\n  subjects: any[];\n};\n\nexport type ActionArraySection = Action[];\n\n/**\n * Transforms & adds the given  setting action to the section\n * Note: The action is transformed to a setting specific format\n * @param options\n * @param options.action\n * @param section\n */\nconst settings = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { category, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    category,\n    subCategory,\n    // TODO: Investigate at which point the action property is transformed to actionId\n    // @ts-expect-error - action should be actionID\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given plugin action to the section\n * Note: The action is transformed to a plugin specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ActionArraySection} section\n */\nconst plugins = ({ action, section }: { action: Action; section: ActionArraySection }) => {\n  const { pluginName, subCategory, displayName, actionId } = action;\n\n  section.push({\n    displayName,\n    // @ts-expect-error - plugin should be pluginName, TODO: Investigate at which point the plugin property\n    plugin: pluginName,\n    subCategory,\n    action: actionId,\n  });\n};\n\n/**\n * Transforms & adds the given action to the section's actions field\n * Note: The action is transformed to a content-type specific format\n * @param {object} options\n * @param {Action} options.action\n * @param {ContentTypesSection} section\n */\nconst contentTypesBase = ({\n  action,\n  section,\n}: {\n  action: Action;\n  section: ContentTypesSection;\n}) => {\n  const { displayName, actionId, subjects, options } = action;\n\n  // Strip non-displayed content types so they don't appear as configurable subjects\n  // in the roles UI (e.g. plugin::users-permissions.role).\n  const allContentTypes = strapi.contentTypes as Record<string, any>;\n  const filteredSubjects = subjects?.filter(\n    (uid) =>\n      (\n        allContentTypes[uid as string]?.pluginOptions?.['content-manager'] as\n          | { visible?: boolean }\n          | undefined\n      )?.visible !== false\n  );\n\n  section.actions.push({\n    // @ts-expect-error - label should be displayName, TODO: Investigate at which point the label property\n    label: displayName,\n    actionId,\n    subjects: filteredSubjects,\n    ...getValidOptions(options),\n  });\n};\n\n/**\n * Initialize the subjects array of a section based on the action's subjects\n */\nconst subjectsHandlerFor =\n  (kind: string) =>\n  ({ action, section: contentTypesSection }: { action: Action; section: ContentTypesSection }) => {\n    // TODO: add a type guard for UID.ContentType\n    const subjects = action.subjects as Internal.UID.ContentType[];\n\n    if (!subjects?.length) {\n      return;\n    }\n\n    const newSubjects = subjects\n      // Ignore already added subjects\n      .filter(isNotInSubjects(contentTypesSection.subjects))\n      // Transform UIDs into content-types\n      .map(resolveContentType)\n      // Only keep specific kind of content-types\n      .filter(isOfKind(kind))\n      // Exclude content types hidden from the content manager (e.g. plugin::users-permissions.role).\n      // Those types are valid explorer.read subjects so that super admin can read relation targets,\n      // but they should not appear as configurable permissions in the roles UI.\n      .filter(\n        (ct) =>\n          (ct?.pluginOptions?.['content-manager'] as { visible?: boolean } | undefined)?.visible !==\n          false\n      )\n      // Transform the content-types into section's subjects\n      .map(toSubjectTemplate);\n\n    contentTypesSection.subjects.push(...newSubjects);\n  };\n\nconst buildNode = (model: any, attributeName: string, attribute: any) => {\n  if (!isVisibleAttribute(model, attributeName)) {\n    return null;\n  }\n\n  const node = { label: attributeName, value: attributeName };\n\n  if (attribute.required) {\n    Object.assign(node, { required: true });\n  }\n\n  if (attribute.type === 'component') {\n    const component = strapi.components[attribute.component];\n    return { ...node, children: buildDeepAttributesCollection(component) };\n  }\n\n  return node;\n};\n\nconst buildDeepAttributesCollection = (model: any): unknown => {\n  return Object.entries(model.attributes)\n    .map(([attributeName, attribute]) => buildNode(model, attributeName, attribute))\n    .filter((node) => node !== null);\n};\n\n/**\n * Create and populate the fields property for section's subjects based on the action's subjects list\n */\nconst fieldsProperty = ({ action, section }: { action: Action; section: ContentTypesSection }) => {\n  const { subjects } = action;\n\n  section.subjects\n    .filter((subject) => subjects?.includes(subject.uid))\n    .forEach((subject) => {\n      const { uid } = subject;\n      const contentType = resolveContentType(uid);\n\n      if (hasProperty('fields', subject)) {\n        return;\n      }\n\n      const fields = buildDeepAttributesCollection(contentType);\n      const fieldsProp = { label: 'Fields', value: 'fields', children: fields };\n\n      subject.properties.push(fieldsProp);\n    });\n};\n\nexport { plugins, settings, subjectsHandlerFor, contentTypesBase, fieldsProperty };\n"],"names":["isVisibleAttribute","contentTypes","settings","action","section","category","subCategory","displayName","actionId","push","plugins","pluginName","plugin","contentTypesBase","subjects","options","allContentTypes","strapi","filteredSubjects","filter","uid","pluginOptions","visible","actions","label","getValidOptions","subjectsHandlerFor","kind","contentTypesSection","length","newSubjects","isNotInSubjects","map","resolveContentType","isOfKind","ct","toSubjectTemplate","buildNode","model","attributeName","attribute","node","value","required","Object","assign","type","component","components","children","buildDeepAttributesCollection","entries","attributes","fieldsProperty","subject","includes","forEach","contentType","hasProperty","fields","fieldsProp","properties"],"mappings":";;;AAYA,MAAM,EAAEA,kBAAkB,EAAE,GAAGC,YAAAA;AAS/B;;;;;;AAMC,UACKC,QAAAA,GAAW,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACpF,MAAM,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAEzDC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;AACAF,QAAAA,QAAAA;AACAC,QAAAA,WAAAA;;;QAGAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKE,OAAAA,GAAU,CAAC,EAAEP,MAAM,EAAEC,OAAO,EAAmD,GAAA;IACnF,MAAM,EAAEO,UAAU,EAAEL,WAAW,EAAEC,WAAW,EAAEC,QAAQ,EAAE,GAAGL,MAAAA;AAE3DC,IAAAA,OAAAA,CAAQK,IAAI,CAAC;AACXF,QAAAA,WAAAA;;QAEAK,MAAAA,EAAQD,UAAAA;AACRL,QAAAA,WAAAA;QACAH,MAAAA,EAAQK;AACV,KAAA,CAAA;AACF;AAEA;;;;;;AAMC,UACKK,gBAAAA,GAAmB,CAAC,EACxBV,MAAM,EACNC,OAAO,EAIR,GAAA;IACC,MAAM,EAAEG,WAAW,EAAEC,QAAQ,EAAEM,QAAQ,EAAEC,OAAO,EAAE,GAAGZ,MAAAA;;;IAIrD,MAAMa,eAAAA,GAAkBC,OAAOhB,YAAY;AAC3C,IAAA,MAAMiB,gBAAAA,GAAmBJ,QAAAA,EAAUK,MAAAA,CACjC,CAACC,MACC,eACiB,CAACA,GAAAA,CAAc,EAAEC,aAAAA,GAAgB,iBAAA,CAAkB,EAGjEC,OAAAA,KAAY,KAAA,CAAA;IAGnBlB,OAAAA,CAAQmB,OAAO,CAACd,IAAI,CAAC;;QAEnBe,KAAAA,EAAOjB,WAAAA;AACPC,QAAAA,QAAAA;QACAM,QAAAA,EAAUI,gBAAAA;AACV,QAAA,GAAGO,gBAAgBV,OAAAA;AACrB,KAAA,CAAA;AACF;AAEA;;IAGA,MAAMW,kBAAAA,GACJ,CAACC,IAAAA,GACD,CAAC,EAAExB,MAAM,EAAEC,OAAAA,EAASwB,mBAAmB,EAAoD,GAAA;;QAEzF,MAAMd,QAAAA,GAAWX,OAAOW,QAAQ;QAEhC,IAAI,CAACA,UAAUe,MAAAA,EAAQ;AACrB,YAAA;AACF,QAAA;QAEA,MAAMC,WAAAA,GAAchB,QAClB;AACCK,SAAAA,MAAM,CAACY,eAAAA,CAAgBH,mBAAAA,CAAoBd,QAAQ,EACpD;SACCkB,GAAG,CAACC,mBACL;SACCd,MAAM,CAACe,QAAAA,CAASP,IAAAA,CAAAA,CACjB;;;SAGCR,MAAM,CACL,CAACgB,EAAAA,GACC,EAACA,EAAId,aAAAA,GAAgB,iBAAA,CAAkB,EAAwCC,OAAAA,KAC/E,KAAA,CAEJ;AACCU,SAAAA,GAAG,CAACI,iBAAAA,CAAAA;QAEPR,mBAAAA,CAAoBd,QAAQ,CAACL,IAAI,CAAA,GAAIqB,WAAAA,CAAAA;AACvC,IAAA;AAEF,MAAMO,SAAAA,GAAY,CAACC,KAAAA,EAAYC,aAAAA,EAAuBC,SAAAA,GAAAA;IACpD,IAAI,CAACxC,kBAAAA,CAAmBsC,KAAAA,EAAOC,aAAAA,CAAAA,EAAgB;QAC7C,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAME,IAAAA,GAAO;QAAEjB,KAAAA,EAAOe,aAAAA;QAAeG,KAAAA,EAAOH;AAAc,KAAA;IAE1D,IAAIC,SAAAA,CAAUG,QAAQ,EAAE;QACtBC,MAAAA,CAAOC,MAAM,CAACJ,IAAAA,EAAM;YAAEE,QAAAA,EAAU;AAAK,SAAA,CAAA;AACvC,IAAA;IAEA,IAAIH,SAAAA,CAAUM,IAAI,KAAK,WAAA,EAAa;AAClC,QAAA,MAAMC,YAAY9B,MAAAA,CAAO+B,UAAU,CAACR,SAAAA,CAAUO,SAAS,CAAC;QACxD,OAAO;AAAE,YAAA,GAAGN,IAAI;AAAEQ,YAAAA,QAAAA,EAAUC,6BAAAA,CAA8BH,SAAAA;AAAW,SAAA;AACvE,IAAA;IAEA,OAAON,IAAAA;AACT,CAAA;AAEA,MAAMS,gCAAgC,CAACZ,KAAAA,GAAAA;IACrC,OAAOM,MAAAA,CAAOO,OAAO,CAACb,KAAAA,CAAMc,UAAU,CAAA,CACnCpB,GAAG,CAAC,CAAC,CAACO,eAAeC,SAAAA,CAAU,GAAKH,UAAUC,KAAAA,EAAOC,aAAAA,EAAeC,YACpErB,MAAM,CAAC,CAACsB,IAAAA,GAASA,IAAAA,KAAS,IAAA,CAAA;AAC/B,CAAA;AAEA;;AAEC,UACKY,cAAAA,GAAiB,CAAC,EAAElD,MAAM,EAAEC,OAAO,EAAoD,GAAA;IAC3F,MAAM,EAAEU,QAAQ,EAAE,GAAGX,MAAAA;AAErBC,IAAAA,OAAAA,CAAQU,QAAQ,CACbK,MAAM,CAAC,CAACmC,OAAAA,GAAYxC,QAAAA,EAAUyC,QAAAA,CAASD,OAAAA,CAAQlC,GAAG,CAAA,CAAA,CAClDoC,OAAO,CAAC,CAACF,OAAAA,GAAAA;QACR,MAAM,EAAElC,GAAG,EAAE,GAAGkC,OAAAA;AAChB,QAAA,MAAMG,cAAcxB,kBAAAA,CAAmBb,GAAAA,CAAAA;QAEvC,IAAIsC,WAAAA,CAAY,UAAUJ,OAAAA,CAAAA,EAAU;AAClC,YAAA;AACF,QAAA;AAEA,QAAA,MAAMK,SAAST,6BAAAA,CAA8BO,WAAAA,CAAAA;AAC7C,QAAA,MAAMG,UAAAA,GAAa;YAAEpC,KAAAA,EAAO,QAAA;YAAUkB,KAAAA,EAAO,QAAA;YAAUO,QAAAA,EAAUU;AAAO,SAAA;QAExEL,OAAAA,CAAQO,UAAU,CAACpD,IAAI,CAACmD,UAAAA,CAAAA;AAC1B,IAAA,CAAA,CAAA;AACJ;;;;"}

package/dist/server/server/src/services/role.js

@@ -237,9 +237,13 @@ const jsonClean = (data)=>JSON.parse(JSON.stringify(data));
         description: 'Authors can manage the content they have created.'
     });
     // create content-type permissions for each role
+    // Exclude non-displayed content types (e.g. plugin::users-permissions.role) from Editor/Author
+    // since those types are in explorer.read subjects only for super admin relation reads.
+    const nonDisplayedUids = Object.values(strapi.contentTypes).filter((ct)=>ct?.pluginOptions?.['content-manager']?.visible === false).map((ct)=>ct.uid);
     const editorPermissions = index.getService('content-type').getPermissionsWithNestedFields(contentTypesActions, {
         restrictedSubjects: [
-            'plugin::users-permissions.user'
+            'plugin::users-permissions.user',
+            ...nonDisplayedUids
         ]
     });
     const authorPermissions = editorPermissions.filter(({ action })=>action !== ACTIONS.publish).map((permission)=>index$1.default.create({

package/dist/server/server/src/services/role.js.map

@@ -1 +1 @@
-{"version":3,"file":"role.js","sources":["../../../../../server/src/services/role.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */ // TODO: TS - Use database parameters interface when they are ready\n/* eslint-disable @typescript-eslint/default-param-last */\nimport _ from 'lodash';\nimport { set, omit, pick, prop, isArray, differenceWith, differenceBy, isEqual } from 'lodash/fp';\n\nimport { dates, arrays, hooks as hooksUtils, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\n\nimport permissionDomain from '../domain/permission';\nimport type { AdminUser, AdminRole, Permission } from '../../../shared/contracts/shared';\nimport type { Action } from '../domain/action';\n\nimport { validatePermissionsExist } from '../validation/permission';\nimport roleConstants from './constants';\nimport { getService } from '../utils';\n\nconst { SUPER_ADMIN_CODE, CONTENT_TYPE_SECTION } = roleConstants;\n\nconst { createAsyncSeriesWaterfallHook } = hooksUtils;\nconst { ApplicationError } = errors;\n\nconst hooks = {\n  willResetSuperAdminPermissions: createAsyncSeriesWaterfallHook(),\n  willValidateUpdatePermissions: createAsyncSeriesWaterfallHook(),\n};\n\nconst ACTIONS = {\n  publish: 'plugin::content-manager.explorer.publish',\n};\n\n// @ts-expect-error lodash types\nconst sanitizeRole: <T extends object>(obj: T) => Omit<T, 'users' | 'permissions'> = omit([\n  'users',\n  'permissions',\n] as const);\n\nexport type AdminRoleWithUsersCount = AdminRole & { usersCount: number };\n\nconst COMPARABLE_FIELDS = ['conditions', 'properties', 'subject', 'action', 'actionParameters'];\nconst pickComparableFields = pick(COMPARABLE_FIELDS);\n\nconst jsonClean = <T extends object>(data: T): T => JSON.parse(JSON.stringify(data));\n\n/**\n * Compare two permissions\n */\nconst arePermissionsEqual = (p1: Permission, p2: Permission): boolean => {\n  if (p1.action === p2.action) {\n    return isEqual(jsonClean(pickComparableFields(p1)), jsonClean(pickComparableFields(p2)));\n  }\n\n  return false;\n};\n\n/**\n * Create and save a role in database\n * @param attributes A partial role object\n */\nconst create = async (attributes: Partial<AdminRole>): Promise<AdminRole> => {\n  const alreadyExists = await exists({ name: attributes.name });\n\n  if (alreadyExists) {\n    throw new ApplicationError(\n      `The name must be unique and a role with name \\`${attributes.name}\\` already exists.`\n    );\n  }\n  const autoGeneratedCode = `${_.kebabCase(attributes.name)}-${dates.timestampCode()}`;\n\n  const rolesWithCode = {\n    ...attributes,\n    code: attributes.code || autoGeneratedCode,\n  };\n\n  const result = await strapi.db.query('admin::role').create({ data: rolesWithCode });\n  strapi.eventHub.emit('role.create', { role: sanitizeRole(result) });\n\n  return result;\n};\n\n/**\n * Find a role in database\n * @param params query params to find the role\n * @param populate\n */\nconst findOne = (params = {}, populate?: unknown): Promise<AdminRole> => {\n  return strapi.db.query('admin::role').findOne({ where: params, populate });\n};\n\n/**\n * Find a role in database with usersCounts\n * @param params query params to find the role\n * @param populate\n */\nconst findOneWithUsersCount = async (\n  params = {},\n  populate?: unknown\n): Promise<AdminRoleWithUsersCount> => {\n  const role = await strapi.db.query('admin::role').findOne({ where: params, populate });\n\n  if (role) {\n    role.usersCount = await getUsersCount(role.id);\n  }\n\n  return role;\n};\n\n/**\n * Find roles in database\n * @param params query params to find the roles\n * @param populate\n */\nconst find = (params = {}, populate: unknown): Promise<AdminRole[]> => {\n  return strapi.db.query('admin::role').findMany({ where: params, populate });\n};\n\n/**\n * Find all roles in database\n */\nconst findAllWithUsersCount = async (params: any): Promise<AdminRoleWithUsersCount[]> => {\n  const roles: AdminRoleWithUsersCount[] = await strapi.db\n    .query('admin::role')\n    .findMany(strapi.get('query-params').transform('admin::role', params));\n\n  for (const role of roles) {\n    role.usersCount = await getUsersCount(role.id);\n  }\n\n  return roles;\n};\n\n/**\n * Update a role in database\n * @param params query params to find the role to update\n * @param attributes A partial role object\n */\nconst update = async (params: any, attributes: Partial<AdminRole>): Promise<AdminRole> => {\n  const sanitizedAttributes = _.omit(attributes, ['code']);\n\n  if (_.has(params, 'id') && _.has(sanitizedAttributes, 'name')) {\n    const alreadyExists = await exists({\n      name: sanitizedAttributes.name,\n      id: { $ne: params.id },\n    });\n    if (alreadyExists) {\n      throw new ApplicationError(\n        `The name must be unique and a role with name \\`${sanitizedAttributes.name}\\` already exists.`\n      );\n    }\n  }\n\n  const result = await strapi.db\n    .query('admin::role')\n    .update({ where: params, data: sanitizedAttributes });\n\n  strapi.eventHub.emit('role.update', { role: sanitizeRole(result) });\n\n  return result;\n};\n\n/**\n * Check if a role exists in database\n * @param params query params to find the role\n */\nconst exists = async (params = {} as unknown): Promise<boolean> => {\n  const count = await strapi.db.query('admin::role').count({ where: params });\n  return count > 0;\n};\n\n/**\n * Count the number of roles based on search params\n * @param params params used for the query\n */\nconst count = async (params = {} as any): Promise<number> => {\n  return strapi.db.query('admin::role').count(params);\n};\n\n/**\n * Check if the given roles id can be deleted safely, throw otherwise\n * @param ids\n */\nconst checkRolesIdForDeletion = async (ids = [] as Data.ID[]) => {\n  const superAdminRole = await getSuperAdmin();\n\n  if (superAdminRole && arrays.includesString(ids, superAdminRole.id)) {\n    throw new ApplicationError('You cannot delete the super admin role');\n  }\n\n  for (const roleId of ids) {\n    const usersCount = await getUsersCount(roleId);\n    if (usersCount !== 0) {\n      throw new ApplicationError('Some roles are still assigned to some users');\n    }\n  }\n};\n\n/**\n * Delete roles in database if they have no user assigned\n * @param ids query params to find the roles\n */\nconst deleteByIds = async (ids = [] as Data.ID[]): Promise<AdminRole[]> => {\n  await checkRolesIdForDeletion(ids);\n\n  await getService('permission').deleteByRolesIds(ids);\n\n  const deletedRoles: AdminRole[] = [];\n  for (const id of ids) {\n    const deletedRole = await strapi.db.query('admin::role').delete({ where: { id } });\n\n    if (deletedRole) {\n      strapi.eventHub.emit('role.delete', { role: deletedRole });\n      deletedRoles.push(deletedRole);\n    }\n  }\n\n  return deletedRoles;\n};\n\n/** Count the number of users for some roles\n */\nconst getUsersCount = async (roleId: Data.ID): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where: { roles: { id: roleId } } });\n};\n\n/** Returns admin role\n */\nconst getSuperAdmin = (): Promise<AdminRole | undefined> => findOne({ code: SUPER_ADMIN_CODE });\n\n/** Returns admin role with userCount\n * @returns {Promise<role>}\n */\nconst getSuperAdminWithUsersCount = () => findOneWithUsersCount({ code: SUPER_ADMIN_CODE });\n\n/** Create superAdmin, Author and Editor role is no role already exist\n */\nconst createRolesIfNoneExist = async () => {\n  const someRolesExist = await exists();\n  if (someRolesExist) {\n    return;\n  }\n\n  const { actionProvider } = getService('permission');\n\n  const allActions = actionProvider.values();\n  const contentTypesActions = allActions.filter((a) => a.section === 'contentTypes');\n\n  // create 3 roles\n  const superAdminRole = await create({\n    name: 'Super Admin',\n    code: 'strapi-super-admin',\n    description: 'Super Admins can access and manage all features and settings.',\n  });\n\n  await getService('user').assignARoleToAll(superAdminRole.id);\n\n  const editorRole = await create({\n    name: 'Editor',\n    code: 'strapi-editor',\n    description: 'Editors can manage and publish contents including those of other users.',\n  });\n\n  const authorRole = await create({\n    name: 'Author',\n    code: 'strapi-author',\n    description: 'Authors can manage the content they have created.',\n  });\n\n  // create content-type permissions for each role\n  const editorPermissions = getService('content-type').getPermissionsWithNestedFields(\n    contentTypesActions,\n    {\n      restrictedSubjects: ['plugin::users-permissions.user'],\n    }\n  );\n\n  const authorPermissions = editorPermissions\n    .filter(({ action }: any) => action !== ACTIONS.publish)\n    .map((permission: any) =>\n      permissionDomain.create({ ...permission, conditions: ['admin::is-creator'] })\n    );\n\n  editorPermissions.push(...getDefaultPluginPermissions());\n  authorPermissions.push(...getDefaultPluginPermissions({ isAuthor: true }));\n\n  // assign permissions to roles\n  await addPermissions(editorRole.id, editorPermissions);\n  await addPermissions(authorRole.id, authorPermissions);\n};\n\nconst getDefaultPluginPermissions = ({ isAuthor = false } = {}) => {\n  const conditions = isAuthor ? ['admin::is-creator'] : [];\n\n  // add plugin permissions for each role\n  return [\n    { action: 'plugin::upload.read', conditions },\n    { action: 'plugin::upload.configure-view' },\n    { action: 'plugin::upload.assets.create' },\n    { action: 'plugin::upload.assets.update', conditions },\n    { action: 'plugin::upload.assets.download' },\n    { action: 'plugin::upload.assets.copy-link' },\n  ].map(permissionDomain.create);\n};\n\n/** Display a warning if the role superAdmin doesn't exist\n *  or if the role is not assigned to at least one user\n */\nconst displayWarningIfNoSuperAdmin = async () => {\n  const superAdminRole = await getSuperAdminWithUsersCount();\n  const someUsersExists = await getService('user').exists();\n\n  if (!superAdminRole) {\n    strapi.log.warn(\"Your application doesn't have a super admin role.\");\n  } else if (someUsersExists && superAdminRole.usersCount === 0) {\n    strapi.log.warn(\"Your application doesn't have a super admin user.\");\n  }\n};\n\n/**\n * Assign permissions to a role\n * @param roleId - role Data.ID\n * @param {Array<Permission{action,subject,fields,conditions}>} permissions - permissions to assign to the role\n */\nconst assignPermissions = async (\n  roleId: Data.ID,\n  permissions: Array<Pick<Permission, 'action' | 'subject' | 'conditions'>> = []\n) => {\n  await validatePermissionsExist(permissions);\n\n  // Internal actions are not handled by the role service, so any permission\n  // with an internal action is filtered out\n  const internalActions = getService('permission')\n    .actionProvider.values()\n    .filter((action) => action.section === 'internal')\n    .map((action) => action.actionId);\n\n  const superAdmin = await getService('role').getSuperAdmin();\n  const isSuperAdmin = superAdmin && superAdmin.id === roleId;\n  const assignRole = set('role', roleId);\n\n  const permissionsWithRole = permissions\n    // Add the role attribute to every permission\n    .map(assignRole)\n    // Transform each permission into a Permission instance\n    // @ts-expect-error - lodash set doesn't resolve the type appropriately\n    .map(permissionDomain.create);\n\n  const existingPermissions = await getService('permission').findMany({\n    where: { role: { id: roleId } },\n    populate: ['role'],\n  });\n\n  const permissionsToAdd = differenceWith(\n    arePermissionsEqual,\n    permissionsWithRole,\n    existingPermissions\n  ).filter((permission: Permission) => !internalActions.includes(permission.action));\n\n  const permissionsToDelete = differenceWith(\n    arePermissionsEqual,\n    existingPermissions,\n    permissionsWithRole\n  ).filter((permission: Permission) => !internalActions.includes(permission.action));\n\n  const permissionsToReturn = differenceBy('id', permissionsToDelete, existingPermissions);\n\n  if (permissionsToDelete.length > 0) {\n    // @ts-expect-error - lodash prop doesn't resolve the type appropriately\n    await getService('permission').deleteByIds(permissionsToDelete.map(prop('id')));\n  }\n\n  if (permissionsToAdd.length > 0) {\n    const newPermissions = await addPermissions(roleId, permissionsToAdd);\n    permissionsToReturn.push(...newPermissions);\n  }\n\n  if (!isSuperAdmin && (permissionsToAdd.length || permissionsToDelete.length)) {\n    await getService('metrics').sendDidUpdateRolePermissions();\n  }\n\n  if (permissionsToAdd.length > 0 || permissionsToDelete.length > 0) {\n    await getService('api-token-admin').syncPermissionsForRole(roleId);\n  }\n\n  return permissionsToReturn;\n};\n\nconst addPermissions = async (roleId: Data.ID, permissions: any) => {\n  const { conditionProvider, createMany } = getService('permission');\n  const { sanitizeConditions } = permissionDomain;\n\n  const permissionsWithRole = permissions\n    .map(set('role', roleId))\n    // @ts-expect-error - refactor domain/permission Condition type, as it's now expecting\n    // a string but it should be a Condition interface\n    .map(sanitizeConditions(conditionProvider))\n    .map(permissionDomain.create);\n\n  return createMany(permissionsWithRole);\n};\n\nconst isContentTypeAction = (action: Action) => action.section === CONTENT_TYPE_SECTION;\n\n/**\n * Reset super admin permissions (giving it all permissions)\n */\nconst resetSuperAdminPermissions = async () => {\n  const superAdminRole = await getService('role').getSuperAdmin();\n  if (!superAdminRole) {\n    return;\n  }\n\n  const permissionService = getService('permission');\n  const contentTypeService = getService('content-type');\n\n  const allActions = permissionService.actionProvider.values() as Action[];\n\n  const contentTypesActions = allActions.filter((action) => isContentTypeAction(action));\n  const otherActions = allActions.filter((action) => !isContentTypeAction(action));\n\n  // First, get the content-types permissions\n  const permissions = contentTypeService.getPermissionsWithNestedFields(\n    contentTypesActions\n  ) as Permission[];\n\n  // Then add every other permission\n  const otherPermissions = otherActions.reduce((acc, action) => {\n    const { actionId, subjects } = action;\n\n    if (isArray(subjects)) {\n      acc.push(\n        ...subjects.map((subject) => permissionDomain.create({ action: actionId, subject }))\n      );\n    } else {\n      acc.push(permissionDomain.create({ action: actionId }));\n    }\n\n    return acc;\n  }, [] as Permission[]);\n\n  permissions.push(...otherPermissions);\n\n  const transformedPermissions = (await hooks.willResetSuperAdminPermissions.call(\n    permissions\n  )) as Permission[];\n\n  await assignPermissions(superAdminRole.id, transformedPermissions);\n};\n\n/**\n * Check if a user object includes the super admin role\n */\nconst hasSuperAdminRole = (user: AdminUser): boolean => {\n  const roles = _.get(user, 'roles', []) as AdminRole[];\n\n  return roles.map(prop('code')).includes(SUPER_ADMIN_CODE);\n};\n\nconst constants = {\n  superAdminCode: SUPER_ADMIN_CODE,\n};\n\nexport default {\n  hooks,\n  sanitizeRole,\n  create,\n  findOne,\n  findOneWithUsersCount,\n  find,\n  findAllWithUsersCount,\n  update,\n  exists,\n  count,\n  deleteByIds,\n  getUsersCount,\n  getSuperAdmin,\n  getSuperAdminWithUsersCount,\n  createRolesIfNoneExist,\n  displayWarningIfNoSuperAdmin,\n  addPermissions,\n  hasSuperAdminRole,\n  assignPermissions,\n  resetSuperAdminPermissions,\n  checkRolesIdForDeletion,\n  constants,\n};\n"],"names":["SUPER_ADMIN_CODE","CONTENT_TYPE_SECTION","roleConstants","createAsyncSeriesWaterfallHook","hooksUtils","ApplicationError","errors","hooks","willResetSuperAdminPermissions","willValidateUpdatePermissions","ACTIONS","publish","sanitizeRole","omit","COMPARABLE_FIELDS","pickComparableFields","pick","jsonClean","data","JSON","parse","stringify","arePermissionsEqual","p1","p2","action","isEqual","create","attributes","alreadyExists","exists","name","autoGeneratedCode","_","kebabCase","dates","timestampCode","rolesWithCode","code","result","strapi","db","query","eventHub","emit","role","findOne","params","populate","where","findOneWithUsersCount","usersCount","getUsersCount","id","find","findMany","findAllWithUsersCount","roles","get","transform","update","sanitizedAttributes","has","$ne","count","checkRolesIdForDeletion","ids","superAdminRole","getSuperAdmin","arrays","includesString","roleId","deleteByIds","getService","deleteByRolesIds","deletedRoles","deletedRole","delete","push","getSuperAdminWithUsersCount","createRolesIfNoneExist","someRolesExist","actionProvider","allActions","values","contentTypesActions","filter","a","section","description","assignARoleToAll","editorRole","authorRole","editorPermissions","getPermissionsWithNestedFields","restrictedSubjects","authorPermissions","map","permission","permissionDomain","conditions","getDefaultPluginPermissions","isAuthor","addPermissions","displayWarningIfNoSuperAdmin","someUsersExists","log","warn","assignPermissions","permissions","validatePermissionsExist","internalActions","actionId","superAdmin","isSuperAdmin","assignRole","set","permissionsWithRole","existingPermissions","permissionsToAdd","differenceWith","includes","permissionsToDelete","permissionsToReturn","differenceBy","length","prop","newPermissions","sendDidUpdateRolePermissions","syncPermissionsForRole","conditionProvider","createMany","sanitizeConditions","isContentTypeAction","resetSuperAdminPermissions","permissionService","contentTypeService","otherActions","otherPermissions","reduce","acc","subjects","isArray","subject","transformedPermissions","call","hasSuperAdminRole","user","constants","superAdminCode"],"mappings":";;;;;;;;;;;;;;AAAA;AAgBA,MAAM,EAAEA,gBAAgB,EAAEC,oBAAoB,EAAE,GAAGC,WAAAA;AAEnD,MAAM,EAAEC,8BAA8B,EAAE,GAAGC,WAAAA;AAC3C,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,YAAAA;AAE7B,MAAMC,KAAAA,GAAQ;IACZC,8BAAAA,EAAgCL,8BAAAA,EAAAA;IAChCM,6BAAAA,EAA+BN,8BAAAA;AACjC,CAAA;AAEA,MAAMO,OAAAA,GAAU;IACdC,OAAAA,EAAS;AACX,CAAA;AAEA;AACA,MAAMC,eAA+EC,OAAAA,CAAK;AACxF,IAAA,OAAA;AACA,IAAA;AACD,CAAA,CAAA;AAID,MAAMC,iBAAAA,GAAoB;AAAC,IAAA,YAAA;AAAc,IAAA,YAAA;AAAc,IAAA,SAAA;AAAW,IAAA,QAAA;AAAU,IAAA;AAAmB,CAAA;AAC/F,MAAMC,uBAAuBC,OAAAA,CAAKF,iBAAAA,CAAAA;AAElC,MAAMG,SAAAA,GAAY,CAAmBC,IAAAA,GAAeC,IAAAA,CAAKC,KAAK,CAACD,IAAAA,CAAKE,SAAS,CAACH,IAAAA,CAAAA,CAAAA;AAE9E;;IAGA,MAAMI,mBAAAA,GAAsB,CAACC,EAAAA,EAAgBC,EAAAA,GAAAA;AAC3C,IAAA,IAAID,EAAAA,CAAGE,MAAM,KAAKD,EAAAA,CAAGC,MAAM,EAAE;AAC3B,QAAA,OAAOC,UAAAA,CAAQT,SAAAA,CAAUF,oBAAAA,CAAqBQ,EAAAA,CAAAA,CAAAA,EAAMN,UAAUF,oBAAAA,CAAqBS,EAAAA,CAAAA,CAAAA,CAAAA;AACrF,IAAA;IAEA,OAAO,KAAA;AACT,CAAA;AAEA;;;IAIA,MAAMG,SAAS,OAAOC,UAAAA,GAAAA;IACpB,MAAMC,aAAAA,GAAgB,MAAMC,MAAAA,CAAO;AAAEC,QAAAA,IAAAA,EAAMH,WAAWG;AAAK,KAAA,CAAA;AAE3D,IAAA,IAAIF,aAAAA,EAAe;QACjB,MAAM,IAAIxB,iBACR,CAAC,+CAA+C,EAAEuB,UAAAA,CAAWG,IAAI,CAAC,kBAAkB,CAAC,CAAA;AAEzF,IAAA;AACA,IAAA,MAAMC,iBAAAA,GAAoB,CAAA,EAAGC,kBAAAA,CAAEC,SAAS,CAACN,UAAAA,CAAWG,IAAI,CAAA,CAAE,CAAC,EAAEI,WAAAA,CAAMC,aAAa,EAAA,CAAA,CAAI;AAEpF,IAAA,MAAMC,aAAAA,GAAgB;AACpB,QAAA,GAAGT,UAAU;QACbU,IAAAA,EAAMV,UAAAA,CAAWU,IAAI,IAAIN;AAC3B,KAAA;IAEA,MAAMO,MAAAA,GAAS,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAef,MAAM,CAAC;QAAET,IAAAA,EAAMmB;AAAc,KAAA,CAAA;AACjFG,IAAAA,MAAAA,CAAOG,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEC,QAAAA,IAAAA,EAAMjC,YAAAA,CAAa2B,MAAAA;AAAQ,KAAA,CAAA;IAEjE,OAAOA,MAAAA;AACT,CAAA;AAEA;;;;AAIC,IACD,MAAMO,OAAAA,GAAU,CAACC,MAAAA,GAAS,EAAE,EAAEC,QAAAA,GAAAA;AAC5B,IAAA,OAAOR,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeI,OAAO,CAAC;QAAEG,KAAAA,EAAOF,MAAAA;AAAQC,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;AAIC,IACD,MAAME,qBAAAA,GAAwB,OAC5BH,MAAAA,GAAS,EAAE,EACXC,QAAAA,GAAAA;IAEA,MAAMH,IAAAA,GAAO,MAAML,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeI,OAAO,CAAC;QAAEG,KAAAA,EAAOF,MAAAA;AAAQC,QAAAA;AAAS,KAAA,CAAA;AAEpF,IAAA,IAAIH,IAAAA,EAAM;AACRA,QAAAA,IAAAA,CAAKM,UAAU,GAAG,MAAMC,aAAAA,CAAcP,KAAKQ,EAAE,CAAA;AAC/C,IAAA;IAEA,OAAOR,IAAAA;AACT,CAAA;AAEA;;;;AAIC,IACD,MAAMS,IAAAA,GAAO,CAACP,MAAAA,GAAS,EAAE,EAAEC,QAAAA,GAAAA;AACzB,IAAA,OAAOR,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAea,QAAQ,CAAC;QAAEN,KAAAA,EAAOF,MAAAA;AAAQC,QAAAA;AAAS,KAAA,CAAA;AAC3E,CAAA;AAEA;;IAGA,MAAMQ,wBAAwB,OAAOT,MAAAA,GAAAA;AACnC,IAAA,MAAMU,QAAmC,MAAMjB,MAAAA,CAAOC,EAAE,CACrDC,KAAK,CAAC,aAAA,CAAA,CACNa,QAAQ,CAACf,OAAOkB,GAAG,CAAC,cAAA,CAAA,CAAgBC,SAAS,CAAC,aAAA,EAAeZ,MAAAA,CAAAA,CAAAA;IAEhE,KAAK,MAAMF,QAAQY,KAAAA,CAAO;AACxBZ,QAAAA,IAAAA,CAAKM,UAAU,GAAG,MAAMC,aAAAA,CAAcP,KAAKQ,EAAE,CAAA;AAC/C,IAAA;IAEA,OAAOI,KAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAMG,MAAAA,GAAS,OAAOb,MAAAA,EAAanB,UAAAA,GAAAA;AACjC,IAAA,MAAMiC,mBAAAA,GAAsB5B,kBAAAA,CAAEpB,IAAI,CAACe,UAAAA,EAAY;AAAC,QAAA;AAAO,KAAA,CAAA;IAEvD,IAAIK,kBAAAA,CAAE6B,GAAG,CAACf,MAAAA,EAAQ,SAASd,kBAAAA,CAAE6B,GAAG,CAACD,mBAAAA,EAAqB,MAAA,CAAA,EAAS;QAC7D,MAAMhC,aAAAA,GAAgB,MAAMC,MAAAA,CAAO;AACjCC,YAAAA,IAAAA,EAAM8B,oBAAoB9B,IAAI;YAC9BsB,EAAAA,EAAI;AAAEU,gBAAAA,GAAAA,EAAKhB,OAAOM;AAAG;AACvB,SAAA,CAAA;AACA,QAAA,IAAIxB,aAAAA,EAAe;YACjB,MAAM,IAAIxB,iBACR,CAAC,+CAA+C,EAAEwD,mBAAAA,CAAoB9B,IAAI,CAAC,kBAAkB,CAAC,CAAA;AAElG,QAAA;AACF,IAAA;IAEA,MAAMQ,MAAAA,GAAS,MAAMC,MAAAA,CAAOC,EAAE,CAC3BC,KAAK,CAAC,aAAA,CAAA,CACNkB,MAAM,CAAC;QAAEX,KAAAA,EAAOF,MAAAA;QAAQ7B,IAAAA,EAAM2C;AAAoB,KAAA,CAAA;AAErDrB,IAAAA,MAAAA,CAAOG,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEC,QAAAA,IAAAA,EAAMjC,YAAAA,CAAa2B,MAAAA;AAAQ,KAAA,CAAA;IAEjE,OAAOA,MAAAA;AACT,CAAA;AAEA;;;AAGC,IACD,MAAMT,MAAAA,GAAS,OAAOiB,MAAAA,GAAS,EAAa,GAAA;IAC1C,MAAMiB,KAAAA,GAAQ,MAAMxB,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEf,KAAAA,EAAOF;AAAO,KAAA,CAAA;AACzE,IAAA,OAAOiB,KAAAA,GAAQ,CAAA;AACjB,CAAA;AAEA;;;AAGC,IACD,MAAMA,KAAAA,GAAQ,OAAOjB,MAAAA,GAAS,EAAS,GAAA;AACrC,IAAA,OAAOP,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAACjB,MAAAA,CAAAA;AAC9C,CAAA;AAEA;;;AAGC,IACD,MAAMkB,uBAAAA,GAA0B,OAAOC,GAAAA,GAAM,EAAE,GAAa;AAC1D,IAAA,MAAMC,iBAAiB,MAAMC,aAAAA,EAAAA;AAE7B,IAAA,IAAID,kBAAkBE,YAAAA,CAAOC,cAAc,CAACJ,GAAAA,EAAKC,cAAAA,CAAed,EAAE,CAAA,EAAG;AACnE,QAAA,MAAM,IAAIhD,gBAAAA,CAAiB,wCAAA,CAAA;AAC7B,IAAA;IAEA,KAAK,MAAMkE,UAAUL,GAAAA,CAAK;QACxB,MAAMf,UAAAA,GAAa,MAAMC,aAAAA,CAAcmB,MAAAA,CAAAA;AACvC,QAAA,IAAIpB,eAAe,CAAA,EAAG;AACpB,YAAA,MAAM,IAAI9C,gBAAAA,CAAiB,6CAAA,CAAA;AAC7B,QAAA;AACF,IAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMmE,WAAAA,GAAc,OAAON,GAAAA,GAAM,EAAE,GAAa;AAC9C,IAAA,MAAMD,uBAAAA,CAAwBC,GAAAA,CAAAA;IAE9B,MAAMO,gBAAAA,CAAW,YAAA,CAAA,CAAcC,gBAAgB,CAACR,GAAAA,CAAAA;AAEhD,IAAA,MAAMS,eAA4B,EAAE;IACpC,KAAK,MAAMtB,MAAMa,GAAAA,CAAK;QACpB,MAAMU,WAAAA,GAAc,MAAMpC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemC,MAAM,CAAC;YAAE5B,KAAAA,EAAO;AAAEI,gBAAAA;AAAG;AAAE,SAAA,CAAA;AAEhF,QAAA,IAAIuB,WAAAA,EAAa;AACfpC,YAAAA,MAAAA,CAAOG,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;gBAAEC,IAAAA,EAAM+B;AAAY,aAAA,CAAA;AACxDD,YAAAA,YAAAA,CAAaG,IAAI,CAACF,WAAAA,CAAAA;AACpB,QAAA;AACF,IAAA;IAEA,OAAOD,YAAAA;AACT,CAAA;AAEA;IAEA,MAAMvB,gBAAgB,OAAOmB,MAAAA,GAAAA;AAC3B,IAAA,OAAO/B,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEf,KAAAA,EAAO;YAAEQ,KAAAA,EAAO;gBAAEJ,EAAAA,EAAIkB;AAAO;AAAE;AAAE,KAAA,CAAA;AACjF,CAAA;AAEA;IAEA,MAAMH,aAAAA,GAAgB,IAAsCtB,OAAAA,CAAQ;QAAER,IAAAA,EAAMtC;AAAiB,KAAA,CAAA;AAE7F;;IAGA,MAAM+E,2BAAAA,GAA8B,IAAM7B,qBAAAA,CAAsB;QAAEZ,IAAAA,EAAMtC;AAAiB,KAAA,CAAA;AAEzF;AACC,IACD,MAAMgF,sBAAAA,GAAyB,UAAA;AAC7B,IAAA,MAAMC,iBAAiB,MAAMnD,MAAAA,EAAAA;AAC7B,IAAA,IAAImD,cAAAA,EAAgB;AAClB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGT,gBAAAA,CAAW,YAAA,CAAA;IAEtC,MAAMU,UAAAA,GAAaD,eAAeE,MAAM,EAAA;IACxC,MAAMC,mBAAAA,GAAsBF,WAAWG,MAAM,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAEC,OAAO,KAAK,cAAA,CAAA;;IAGnE,MAAMrB,cAAAA,GAAiB,MAAMxC,MAAAA,CAAO;QAClCI,IAAAA,EAAM,aAAA;QACNO,IAAAA,EAAM,oBAAA;QACNmD,WAAAA,EAAa;AACf,KAAA,CAAA;AAEA,IAAA,MAAMhB,gBAAAA,CAAW,MAAA,CAAA,CAAQiB,gBAAgB,CAACvB,eAAed,EAAE,CAAA;IAE3D,MAAMsC,UAAAA,GAAa,MAAMhE,MAAAA,CAAO;QAC9BI,IAAAA,EAAM,QAAA;QACNO,IAAAA,EAAM,eAAA;QACNmD,WAAAA,EAAa;AACf,KAAA,CAAA;IAEA,MAAMG,UAAAA,GAAa,MAAMjE,MAAAA,CAAO;QAC9BI,IAAAA,EAAM,QAAA;QACNO,IAAAA,EAAM,eAAA;QACNmD,WAAAA,EAAa;AACf,KAAA,CAAA;;AAGA,IAAA,MAAMI,iBAAAA,GAAoBpB,gBAAAA,CAAW,cAAA,CAAA,CAAgBqB,8BAA8B,CACjFT,mBAAAA,EACA;QACEU,kBAAAA,EAAoB;AAAC,YAAA;AAAiC;AACxD,KAAA,CAAA;AAGF,IAAA,MAAMC,oBAAoBH,iBAAAA,CACvBP,MAAM,CAAC,CAAC,EAAE7D,MAAM,EAAO,GAAKA,WAAWf,OAAAA,CAAQC,OAAO,EACtDsF,GAAG,CAAC,CAACC,UAAAA,GACJC,eAAAA,CAAiBxE,MAAM,CAAC;AAAE,YAAA,GAAGuE,UAAU;YAAEE,UAAAA,EAAY;AAAC,gBAAA;AAAoB;AAAC,SAAA,CAAA,CAAA;AAG/EP,IAAAA,iBAAAA,CAAkBf,IAAI,CAAA,GAAIuB,2BAAAA,EAAAA,CAAAA;IAC1BL,iBAAAA,CAAkBlB,IAAI,IAAIuB,2BAAAA,CAA4B;QAAEC,QAAAA,EAAU;AAAK,KAAA,CAAA,CAAA;;IAGvE,MAAMC,cAAAA,CAAeZ,UAAAA,CAAWtC,EAAE,EAAEwC,iBAAAA,CAAAA;IACpC,MAAMU,cAAAA,CAAeX,UAAAA,CAAWvC,EAAE,EAAE2C,iBAAAA,CAAAA;AACtC,CAAA;AAEA,MAAMK,2BAAAA,GAA8B,CAAC,EAAEC,QAAAA,GAAW,KAAK,EAAE,GAAG,EAAE,GAAA;AAC5D,IAAA,MAAMF,aAAaE,QAAAA,GAAW;AAAC,QAAA;AAAoB,KAAA,GAAG,EAAE;;IAGxD,OAAO;AACL,QAAA;YAAE7E,MAAAA,EAAQ,qBAAA;AAAuB2E,YAAAA;AAAW,SAAA;AAC5C,QAAA;YAAE3E,MAAAA,EAAQ;AAAgC,SAAA;AAC1C,QAAA;YAAEA,MAAAA,EAAQ;AAA+B,SAAA;AACzC,QAAA;YAAEA,MAAAA,EAAQ,8BAAA;AAAgC2E,YAAAA;AAAW,SAAA;AACrD,QAAA;YAAE3E,MAAAA,EAAQ;AAAiC,SAAA;AAC3C,QAAA;YAAEA,MAAAA,EAAQ;AAAkC;KAC7C,CAACwE,GAAG,CAACE,eAAAA,CAAiBxE,MAAM,CAAA;AAC/B,CAAA;AAEA;;AAEC,IACD,MAAM6E,4BAAAA,GAA+B,UAAA;AACnC,IAAA,MAAMrC,iBAAiB,MAAMY,2BAAAA,EAAAA;AAC7B,IAAA,MAAM0B,eAAAA,GAAkB,MAAMhC,gBAAAA,CAAW,MAAA,CAAA,CAAQ3C,MAAM,EAAA;AAEvD,IAAA,IAAI,CAACqC,cAAAA,EAAgB;QACnB3B,MAAAA,CAAOkE,GAAG,CAACC,IAAI,CAAC,mDAAA,CAAA;AAClB,IAAA,CAAA,MAAO,IAAIF,eAAAA,IAAmBtC,cAAAA,CAAehB,UAAU,KAAK,CAAA,EAAG;QAC7DX,MAAAA,CAAOkE,GAAG,CAACC,IAAI,CAAC,mDAAA,CAAA;AAClB,IAAA;AACF,CAAA;AAEA;;;;AAIC,IACD,MAAMC,iBAAAA,GAAoB,OACxBrC,MAAAA,EACAsC,cAA4E,EAAE,GAAA;AAE9E,IAAA,MAAMC,mCAAAA,CAAyBD,WAAAA,CAAAA;;;IAI/B,MAAME,eAAAA,GAAkBtC,iBAAW,YAAA,CAAA,CAChCS,cAAc,CAACE,MAAM,EAAA,CACrBE,MAAM,CAAC,CAAC7D,SAAWA,MAAAA,CAAO+D,OAAO,KAAK,UAAA,CAAA,CACtCS,GAAG,CAAC,CAACxE,MAAAA,GAAWA,OAAOuF,QAAQ,CAAA;AAElC,IAAA,MAAMC,UAAAA,GAAa,MAAMxC,gBAAAA,CAAW,MAAA,CAAA,CAAQL,aAAa,EAAA;AACzD,IAAA,MAAM8C,YAAAA,GAAeD,UAAAA,IAAcA,UAAAA,CAAW5D,EAAE,KAAKkB,MAAAA;IACrD,MAAM4C,UAAAA,GAAaC,OAAI,MAAA,EAAQ7C,MAAAA,CAAAA;IAE/B,MAAM8C,mBAAAA,GAAsBR,WAC1B;KACCZ,GAAG,CAACkB,WACL;;KAEClB,GAAG,CAACE,gBAAiBxE,MAAM,CAAA;AAE9B,IAAA,MAAM2F,mBAAAA,GAAsB,MAAM7C,gBAAAA,CAAW,YAAA,CAAA,CAAclB,QAAQ,CAAC;QAClEN,KAAAA,EAAO;YAAEJ,IAAAA,EAAM;gBAAEQ,EAAAA,EAAIkB;AAAO;AAAE,SAAA;QAC9BvB,QAAAA,EAAU;AAAC,YAAA;AAAO;AACpB,KAAA,CAAA;AAEA,IAAA,MAAMuE,gBAAAA,GAAmBC,iBAAAA,CACvBlG,mBAAAA,EACA+F,mBAAAA,EACAC,qBACAhC,MAAM,CAAC,CAACY,UAAAA,GAA2B,CAACa,eAAAA,CAAgBU,QAAQ,CAACvB,WAAWzE,MAAM,CAAA,CAAA;AAEhF,IAAA,MAAMiG,mBAAAA,GAAsBF,iBAAAA,CAC1BlG,mBAAAA,EACAgG,mBAAAA,EACAD,qBACA/B,MAAM,CAAC,CAACY,UAAAA,GAA2B,CAACa,eAAAA,CAAgBU,QAAQ,CAACvB,WAAWzE,MAAM,CAAA,CAAA;IAEhF,MAAMkG,mBAAAA,GAAsBC,eAAAA,CAAa,IAAA,EAAMF,mBAAAA,EAAqBJ,mBAAAA,CAAAA;IAEpE,IAAII,mBAAAA,CAAoBG,MAAM,GAAG,CAAA,EAAG;;AAElC,QAAA,MAAMpD,iBAAW,YAAA,CAAA,CAAcD,WAAW,CAACkD,mBAAAA,CAAoBzB,GAAG,CAAC6B,OAAAA,CAAK,IAAA,CAAA,CAAA,CAAA;AAC1E,IAAA;IAEA,IAAIP,gBAAAA,CAAiBM,MAAM,GAAG,CAAA,EAAG;QAC/B,MAAME,cAAAA,GAAiB,MAAMxB,cAAAA,CAAehC,MAAAA,EAAQgD,gBAAAA,CAAAA;AACpDI,QAAAA,mBAAAA,CAAoB7C,IAAI,CAAA,GAAIiD,cAAAA,CAAAA;AAC9B,IAAA;IAEA,IAAI,CAACb,iBAAiBK,gBAAAA,CAAiBM,MAAM,IAAIH,mBAAAA,CAAoBG,MAAK,CAAA,EAAI;QAC5E,MAAMpD,gBAAAA,CAAW,WAAWuD,4BAA4B,EAAA;AAC1D,IAAA;AAEA,IAAA,IAAIT,iBAAiBM,MAAM,GAAG,KAAKH,mBAAAA,CAAoBG,MAAM,GAAG,CAAA,EAAG;QACjE,MAAMpD,gBAAAA,CAAW,iBAAA,CAAA,CAAmBwD,sBAAsB,CAAC1D,MAAAA,CAAAA;AAC7D,IAAA;IAEA,OAAOoD,mBAAAA;AACT,CAAA;AAEA,MAAMpB,cAAAA,GAAiB,OAAOhC,MAAAA,EAAiBsC,WAAAA,GAAAA;AAC7C,IAAA,MAAM,EAAEqB,iBAAiB,EAAEC,UAAU,EAAE,GAAG1D,gBAAAA,CAAW,YAAA,CAAA;IACrD,MAAM,EAAE2D,kBAAkB,EAAE,GAAGjC,eAAAA;AAE/B,IAAA,MAAMkB,sBAAsBR,WAAAA,CACzBZ,GAAG,CAACmB,MAAAA,CAAI,MAAA,EAAQ7C,QACjB;;AAEC0B,KAAAA,GAAG,CAACmC,kBAAAA,CAAmBF,iBAAAA,CAAAA,CAAAA,CACvBjC,GAAG,CAACE,gBAAiBxE,MAAM,CAAA;AAE9B,IAAA,OAAOwG,UAAAA,CAAWd,mBAAAA,CAAAA;AACpB,CAAA;AAEA,MAAMgB,mBAAAA,GAAsB,CAAC5G,MAAAA,GAAmBA,MAAAA,CAAO+D,OAAO,KAAKvF,oBAAAA;AAEnE;;AAEC,IACD,MAAMqI,0BAAAA,GAA6B,UAAA;AACjC,IAAA,MAAMnE,cAAAA,GAAiB,MAAMM,gBAAAA,CAAW,MAAA,CAAA,CAAQL,aAAa,EAAA;AAC7D,IAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,QAAA;AACF,IAAA;AAEA,IAAA,MAAMoE,oBAAoB9D,gBAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAM+D,qBAAqB/D,gBAAAA,CAAW,cAAA,CAAA;AAEtC,IAAA,MAAMU,UAAAA,GAAaoD,iBAAAA,CAAkBrD,cAAc,CAACE,MAAM,EAAA;AAE1D,IAAA,MAAMC,sBAAsBF,UAAAA,CAAWG,MAAM,CAAC,CAAC7D,SAAW4G,mBAAAA,CAAoB5G,MAAAA,CAAAA,CAAAA;AAC9E,IAAA,MAAMgH,eAAetD,UAAAA,CAAWG,MAAM,CAAC,CAAC7D,MAAAA,GAAW,CAAC4G,mBAAAA,CAAoB5G,MAAAA,CAAAA,CAAAA;;IAGxE,MAAMoF,WAAAA,GAAc2B,kBAAAA,CAAmB1C,8BAA8B,CACnET,mBAAAA,CAAAA;;AAIF,IAAA,MAAMqD,gBAAAA,GAAmBD,YAAAA,CAAaE,MAAM,CAAC,CAACC,GAAAA,EAAKnH,MAAAA,GAAAA;AACjD,QAAA,MAAM,EAAEuF,QAAQ,EAAE6B,QAAQ,EAAE,GAAGpH,MAAAA;AAE/B,QAAA,IAAIqH,WAAQD,QAAAA,CAAAA,EAAW;YACrBD,GAAAA,CAAI9D,IAAI,IACH+D,QAAAA,CAAS5C,GAAG,CAAC,CAAC8C,OAAAA,GAAY5C,eAAAA,CAAiBxE,MAAM,CAAC;oBAAEF,MAAAA,EAAQuF,QAAAA;AAAU+B,oBAAAA;AAAQ,iBAAA,CAAA,CAAA,CAAA;QAErF,CAAA,MAAO;AACLH,YAAAA,GAAAA,CAAI9D,IAAI,CAACqB,eAAAA,CAAiBxE,MAAM,CAAC;gBAAEF,MAAAA,EAAQuF;AAAS,aAAA,CAAA,CAAA;AACtD,QAAA;QAEA,OAAO4B,GAAAA;AACT,IAAA,CAAA,EAAG,EAAE,CAAA;AAEL/B,IAAAA,WAAAA,CAAY/B,IAAI,CAAA,GAAI4D,gBAAAA,CAAAA;AAEpB,IAAA,MAAMM,yBAA0B,MAAMzI,KAAAA,CAAMC,8BAA8B,CAACyI,IAAI,CAC7EpC,WAAAA,CAAAA;IAGF,MAAMD,iBAAAA,CAAkBzC,cAAAA,CAAed,EAAE,EAAE2F,sBAAAA,CAAAA;AAC7C,CAAA;AAEA;;IAGA,MAAME,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,MAAM1F,QAAQxB,kBAAAA,CAAEyB,GAAG,CAACyF,IAAAA,EAAM,SAAS,EAAE,CAAA;AAErC,IAAA,OAAO1F,MAAMwC,GAAG,CAAC6B,OAAAA,CAAK,MAAA,CAAA,CAAA,CAASL,QAAQ,CAACzH,gBAAAA,CAAAA;AAC1C,CAAA;AAEA,MAAMoJ,SAAAA,GAAY;IAChBC,cAAAA,EAAgBrJ;AAClB,CAAA;AAEA,WAAe;AACbO,IAAAA,KAAAA;AACAK,IAAAA,YAAAA;AACAe,IAAAA,MAAAA;AACAmB,IAAAA,OAAAA;AACAI,IAAAA,qBAAAA;AACAI,IAAAA,IAAAA;AACAE,IAAAA,qBAAAA;AACAI,IAAAA,MAAAA;AACA9B,IAAAA,MAAAA;AACAkC,IAAAA,KAAAA;AACAQ,IAAAA,WAAAA;AACApB,IAAAA,aAAAA;AACAgB,IAAAA,aAAAA;AACAW,IAAAA,2BAAAA;AACAC,IAAAA,sBAAAA;AACAwB,IAAAA,4BAAAA;AACAD,IAAAA,cAAAA;AACA2C,IAAAA,iBAAAA;AACAtC,IAAAA,iBAAAA;AACA0B,IAAAA,0BAAAA;AACArE,IAAAA,uBAAAA;AACAmF,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"role.js","sources":["../../../../../server/src/services/role.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */ // TODO: TS - Use database parameters interface when they are ready\n/* eslint-disable @typescript-eslint/default-param-last */\nimport _ from 'lodash';\nimport { set, omit, pick, prop, isArray, differenceWith, differenceBy, isEqual } from 'lodash/fp';\n\nimport { dates, arrays, hooks as hooksUtils, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\n\nimport permissionDomain from '../domain/permission';\nimport type { AdminUser, AdminRole, Permission } from '../../../shared/contracts/shared';\nimport type { Action } from '../domain/action';\n\nimport { validatePermissionsExist } from '../validation/permission';\nimport roleConstants from './constants';\nimport { getService } from '../utils';\n\nconst { SUPER_ADMIN_CODE, CONTENT_TYPE_SECTION } = roleConstants;\n\nconst { createAsyncSeriesWaterfallHook } = hooksUtils;\nconst { ApplicationError } = errors;\n\nconst hooks = {\n  willResetSuperAdminPermissions: createAsyncSeriesWaterfallHook(),\n  willValidateUpdatePermissions: createAsyncSeriesWaterfallHook(),\n};\n\nconst ACTIONS = {\n  publish: 'plugin::content-manager.explorer.publish',\n};\n\n// @ts-expect-error lodash types\nconst sanitizeRole: <T extends object>(obj: T) => Omit<T, 'users' | 'permissions'> = omit([\n  'users',\n  'permissions',\n] as const);\n\nexport type AdminRoleWithUsersCount = AdminRole & { usersCount: number };\n\nconst COMPARABLE_FIELDS = ['conditions', 'properties', 'subject', 'action', 'actionParameters'];\nconst pickComparableFields = pick(COMPARABLE_FIELDS);\n\nconst jsonClean = <T extends object>(data: T): T => JSON.parse(JSON.stringify(data));\n\n/**\n * Compare two permissions\n */\nconst arePermissionsEqual = (p1: Permission, p2: Permission): boolean => {\n  if (p1.action === p2.action) {\n    return isEqual(jsonClean(pickComparableFields(p1)), jsonClean(pickComparableFields(p2)));\n  }\n\n  return false;\n};\n\n/**\n * Create and save a role in database\n * @param attributes A partial role object\n */\nconst create = async (attributes: Partial<AdminRole>): Promise<AdminRole> => {\n  const alreadyExists = await exists({ name: attributes.name });\n\n  if (alreadyExists) {\n    throw new ApplicationError(\n      `The name must be unique and a role with name \\`${attributes.name}\\` already exists.`\n    );\n  }\n  const autoGeneratedCode = `${_.kebabCase(attributes.name)}-${dates.timestampCode()}`;\n\n  const rolesWithCode = {\n    ...attributes,\n    code: attributes.code || autoGeneratedCode,\n  };\n\n  const result = await strapi.db.query('admin::role').create({ data: rolesWithCode });\n  strapi.eventHub.emit('role.create', { role: sanitizeRole(result) });\n\n  return result;\n};\n\n/**\n * Find a role in database\n * @param params query params to find the role\n * @param populate\n */\nconst findOne = (params = {}, populate?: unknown): Promise<AdminRole> => {\n  return strapi.db.query('admin::role').findOne({ where: params, populate });\n};\n\n/**\n * Find a role in database with usersCounts\n * @param params query params to find the role\n * @param populate\n */\nconst findOneWithUsersCount = async (\n  params = {},\n  populate?: unknown\n): Promise<AdminRoleWithUsersCount> => {\n  const role = await strapi.db.query('admin::role').findOne({ where: params, populate });\n\n  if (role) {\n    role.usersCount = await getUsersCount(role.id);\n  }\n\n  return role;\n};\n\n/**\n * Find roles in database\n * @param params query params to find the roles\n * @param populate\n */\nconst find = (params = {}, populate: unknown): Promise<AdminRole[]> => {\n  return strapi.db.query('admin::role').findMany({ where: params, populate });\n};\n\n/**\n * Find all roles in database\n */\nconst findAllWithUsersCount = async (params: any): Promise<AdminRoleWithUsersCount[]> => {\n  const roles: AdminRoleWithUsersCount[] = await strapi.db\n    .query('admin::role')\n    .findMany(strapi.get('query-params').transform('admin::role', params));\n\n  for (const role of roles) {\n    role.usersCount = await getUsersCount(role.id);\n  }\n\n  return roles;\n};\n\n/**\n * Update a role in database\n * @param params query params to find the role to update\n * @param attributes A partial role object\n */\nconst update = async (params: any, attributes: Partial<AdminRole>): Promise<AdminRole> => {\n  const sanitizedAttributes = _.omit(attributes, ['code']);\n\n  if (_.has(params, 'id') && _.has(sanitizedAttributes, 'name')) {\n    const alreadyExists = await exists({\n      name: sanitizedAttributes.name,\n      id: { $ne: params.id },\n    });\n    if (alreadyExists) {\n      throw new ApplicationError(\n        `The name must be unique and a role with name \\`${sanitizedAttributes.name}\\` already exists.`\n      );\n    }\n  }\n\n  const result = await strapi.db\n    .query('admin::role')\n    .update({ where: params, data: sanitizedAttributes });\n\n  strapi.eventHub.emit('role.update', { role: sanitizeRole(result) });\n\n  return result;\n};\n\n/**\n * Check if a role exists in database\n * @param params query params to find the role\n */\nconst exists = async (params = {} as unknown): Promise<boolean> => {\n  const count = await strapi.db.query('admin::role').count({ where: params });\n  return count > 0;\n};\n\n/**\n * Count the number of roles based on search params\n * @param params params used for the query\n */\nconst count = async (params = {} as any): Promise<number> => {\n  return strapi.db.query('admin::role').count(params);\n};\n\n/**\n * Check if the given roles id can be deleted safely, throw otherwise\n * @param ids\n */\nconst checkRolesIdForDeletion = async (ids = [] as Data.ID[]) => {\n  const superAdminRole = await getSuperAdmin();\n\n  if (superAdminRole && arrays.includesString(ids, superAdminRole.id)) {\n    throw new ApplicationError('You cannot delete the super admin role');\n  }\n\n  for (const roleId of ids) {\n    const usersCount = await getUsersCount(roleId);\n    if (usersCount !== 0) {\n      throw new ApplicationError('Some roles are still assigned to some users');\n    }\n  }\n};\n\n/**\n * Delete roles in database if they have no user assigned\n * @param ids query params to find the roles\n */\nconst deleteByIds = async (ids = [] as Data.ID[]): Promise<AdminRole[]> => {\n  await checkRolesIdForDeletion(ids);\n\n  await getService('permission').deleteByRolesIds(ids);\n\n  const deletedRoles: AdminRole[] = [];\n  for (const id of ids) {\n    const deletedRole = await strapi.db.query('admin::role').delete({ where: { id } });\n\n    if (deletedRole) {\n      strapi.eventHub.emit('role.delete', { role: deletedRole });\n      deletedRoles.push(deletedRole);\n    }\n  }\n\n  return deletedRoles;\n};\n\n/** Count the number of users for some roles\n */\nconst getUsersCount = async (roleId: Data.ID): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where: { roles: { id: roleId } } });\n};\n\n/** Returns admin role\n */\nconst getSuperAdmin = (): Promise<AdminRole | undefined> => findOne({ code: SUPER_ADMIN_CODE });\n\n/** Returns admin role with userCount\n * @returns {Promise<role>}\n */\nconst getSuperAdminWithUsersCount = () => findOneWithUsersCount({ code: SUPER_ADMIN_CODE });\n\n/** Create superAdmin, Author and Editor role is no role already exist\n */\nconst createRolesIfNoneExist = async () => {\n  const someRolesExist = await exists();\n  if (someRolesExist) {\n    return;\n  }\n\n  const { actionProvider } = getService('permission');\n\n  const allActions = actionProvider.values();\n  const contentTypesActions = allActions.filter((a) => a.section === 'contentTypes');\n\n  // create 3 roles\n  const superAdminRole = await create({\n    name: 'Super Admin',\n    code: 'strapi-super-admin',\n    description: 'Super Admins can access and manage all features and settings.',\n  });\n\n  await getService('user').assignARoleToAll(superAdminRole.id);\n\n  const editorRole = await create({\n    name: 'Editor',\n    code: 'strapi-editor',\n    description: 'Editors can manage and publish contents including those of other users.',\n  });\n\n  const authorRole = await create({\n    name: 'Author',\n    code: 'strapi-author',\n    description: 'Authors can manage the content they have created.',\n  });\n\n  // create content-type permissions for each role\n  // Exclude non-displayed content types (e.g. plugin::users-permissions.role) from Editor/Author\n  // since those types are in explorer.read subjects only for super admin relation reads.\n  const nonDisplayedUids = Object.values(strapi.contentTypes as Record<string, any>)\n    .filter((ct) => ct?.pluginOptions?.['content-manager']?.visible === false)\n    .map((ct) => ct.uid as string);\n\n  const editorPermissions = getService('content-type').getPermissionsWithNestedFields(\n    contentTypesActions,\n    {\n      restrictedSubjects: ['plugin::users-permissions.user', ...nonDisplayedUids],\n    }\n  );\n\n  const authorPermissions = editorPermissions\n    .filter(({ action }: any) => action !== ACTIONS.publish)\n    .map((permission: any) =>\n      permissionDomain.create({ ...permission, conditions: ['admin::is-creator'] })\n    );\n\n  editorPermissions.push(...getDefaultPluginPermissions());\n  authorPermissions.push(...getDefaultPluginPermissions({ isAuthor: true }));\n\n  // assign permissions to roles\n  await addPermissions(editorRole.id, editorPermissions);\n  await addPermissions(authorRole.id, authorPermissions);\n};\n\nconst getDefaultPluginPermissions = ({ isAuthor = false } = {}) => {\n  const conditions = isAuthor ? ['admin::is-creator'] : [];\n\n  // add plugin permissions for each role\n  return [\n    { action: 'plugin::upload.read', conditions },\n    { action: 'plugin::upload.configure-view' },\n    { action: 'plugin::upload.assets.create' },\n    { action: 'plugin::upload.assets.update', conditions },\n    { action: 'plugin::upload.assets.download' },\n    { action: 'plugin::upload.assets.copy-link' },\n  ].map(permissionDomain.create);\n};\n\n/** Display a warning if the role superAdmin doesn't exist\n *  or if the role is not assigned to at least one user\n */\nconst displayWarningIfNoSuperAdmin = async () => {\n  const superAdminRole = await getSuperAdminWithUsersCount();\n  const someUsersExists = await getService('user').exists();\n\n  if (!superAdminRole) {\n    strapi.log.warn(\"Your application doesn't have a super admin role.\");\n  } else if (someUsersExists && superAdminRole.usersCount === 0) {\n    strapi.log.warn(\"Your application doesn't have a super admin user.\");\n  }\n};\n\n/**\n * Assign permissions to a role\n * @param roleId - role Data.ID\n * @param {Array<Permission{action,subject,fields,conditions}>} permissions - permissions to assign to the role\n */\nconst assignPermissions = async (\n  roleId: Data.ID,\n  permissions: Array<Pick<Permission, 'action' | 'subject' | 'conditions'>> = []\n) => {\n  await validatePermissionsExist(permissions);\n\n  // Internal actions are not handled by the role service, so any permission\n  // with an internal action is filtered out\n  const internalActions = getService('permission')\n    .actionProvider.values()\n    .filter((action) => action.section === 'internal')\n    .map((action) => action.actionId);\n\n  const superAdmin = await getService('role').getSuperAdmin();\n  const isSuperAdmin = superAdmin && superAdmin.id === roleId;\n  const assignRole = set('role', roleId);\n\n  const permissionsWithRole = permissions\n    // Add the role attribute to every permission\n    .map(assignRole)\n    // Transform each permission into a Permission instance\n    // @ts-expect-error - lodash set doesn't resolve the type appropriately\n    .map(permissionDomain.create);\n\n  const existingPermissions = await getService('permission').findMany({\n    where: { role: { id: roleId } },\n    populate: ['role'],\n  });\n\n  const permissionsToAdd = differenceWith(\n    arePermissionsEqual,\n    permissionsWithRole,\n    existingPermissions\n  ).filter((permission: Permission) => !internalActions.includes(permission.action));\n\n  const permissionsToDelete = differenceWith(\n    arePermissionsEqual,\n    existingPermissions,\n    permissionsWithRole\n  ).filter((permission: Permission) => !internalActions.includes(permission.action));\n\n  const permissionsToReturn = differenceBy('id', permissionsToDelete, existingPermissions);\n\n  if (permissionsToDelete.length > 0) {\n    // @ts-expect-error - lodash prop doesn't resolve the type appropriately\n    await getService('permission').deleteByIds(permissionsToDelete.map(prop('id')));\n  }\n\n  if (permissionsToAdd.length > 0) {\n    const newPermissions = await addPermissions(roleId, permissionsToAdd);\n    permissionsToReturn.push(...newPermissions);\n  }\n\n  if (!isSuperAdmin && (permissionsToAdd.length || permissionsToDelete.length)) {\n    await getService('metrics').sendDidUpdateRolePermissions();\n  }\n\n  if (permissionsToAdd.length > 0 || permissionsToDelete.length > 0) {\n    await getService('api-token-admin').syncPermissionsForRole(roleId);\n  }\n\n  return permissionsToReturn;\n};\n\nconst addPermissions = async (roleId: Data.ID, permissions: any) => {\n  const { conditionProvider, createMany } = getService('permission');\n  const { sanitizeConditions } = permissionDomain;\n\n  const permissionsWithRole = permissions\n    .map(set('role', roleId))\n    // @ts-expect-error - refactor domain/permission Condition type, as it's now expecting\n    // a string but it should be a Condition interface\n    .map(sanitizeConditions(conditionProvider))\n    .map(permissionDomain.create);\n\n  return createMany(permissionsWithRole);\n};\n\nconst isContentTypeAction = (action: Action) => action.section === CONTENT_TYPE_SECTION;\n\n/**\n * Reset super admin permissions (giving it all permissions)\n */\nconst resetSuperAdminPermissions = async () => {\n  const superAdminRole = await getService('role').getSuperAdmin();\n  if (!superAdminRole) {\n    return;\n  }\n\n  const permissionService = getService('permission');\n  const contentTypeService = getService('content-type');\n\n  const allActions = permissionService.actionProvider.values() as Action[];\n\n  const contentTypesActions = allActions.filter((action) => isContentTypeAction(action));\n  const otherActions = allActions.filter((action) => !isContentTypeAction(action));\n\n  // First, get the content-types permissions\n  const permissions = contentTypeService.getPermissionsWithNestedFields(\n    contentTypesActions\n  ) as Permission[];\n\n  // Then add every other permission\n  const otherPermissions = otherActions.reduce((acc, action) => {\n    const { actionId, subjects } = action;\n\n    if (isArray(subjects)) {\n      acc.push(\n        ...subjects.map((subject) => permissionDomain.create({ action: actionId, subject }))\n      );\n    } else {\n      acc.push(permissionDomain.create({ action: actionId }));\n    }\n\n    return acc;\n  }, [] as Permission[]);\n\n  permissions.push(...otherPermissions);\n\n  const transformedPermissions = (await hooks.willResetSuperAdminPermissions.call(\n    permissions\n  )) as Permission[];\n\n  await assignPermissions(superAdminRole.id, transformedPermissions);\n};\n\n/**\n * Check if a user object includes the super admin role\n */\nconst hasSuperAdminRole = (user: AdminUser): boolean => {\n  const roles = _.get(user, 'roles', []) as AdminRole[];\n\n  return roles.map(prop('code')).includes(SUPER_ADMIN_CODE);\n};\n\nconst constants = {\n  superAdminCode: SUPER_ADMIN_CODE,\n};\n\nexport default {\n  hooks,\n  sanitizeRole,\n  create,\n  findOne,\n  findOneWithUsersCount,\n  find,\n  findAllWithUsersCount,\n  update,\n  exists,\n  count,\n  deleteByIds,\n  getUsersCount,\n  getSuperAdmin,\n  getSuperAdminWithUsersCount,\n  createRolesIfNoneExist,\n  displayWarningIfNoSuperAdmin,\n  addPermissions,\n  hasSuperAdminRole,\n  assignPermissions,\n  resetSuperAdminPermissions,\n  checkRolesIdForDeletion,\n  constants,\n};\n"],"names":["SUPER_ADMIN_CODE","CONTENT_TYPE_SECTION","roleConstants","createAsyncSeriesWaterfallHook","hooksUtils","ApplicationError","errors","hooks","willResetSuperAdminPermissions","willValidateUpdatePermissions","ACTIONS","publish","sanitizeRole","omit","COMPARABLE_FIELDS","pickComparableFields","pick","jsonClean","data","JSON","parse","stringify","arePermissionsEqual","p1","p2","action","isEqual","create","attributes","alreadyExists","exists","name","autoGeneratedCode","_","kebabCase","dates","timestampCode","rolesWithCode","code","result","strapi","db","query","eventHub","emit","role","findOne","params","populate","where","findOneWithUsersCount","usersCount","getUsersCount","id","find","findMany","findAllWithUsersCount","roles","get","transform","update","sanitizedAttributes","has","$ne","count","checkRolesIdForDeletion","ids","superAdminRole","getSuperAdmin","arrays","includesString","roleId","deleteByIds","getService","deleteByRolesIds","deletedRoles","deletedRole","delete","push","getSuperAdminWithUsersCount","createRolesIfNoneExist","someRolesExist","actionProvider","allActions","values","contentTypesActions","filter","a","section","description","assignARoleToAll","editorRole","authorRole","nonDisplayedUids","Object","contentTypes","ct","pluginOptions","visible","map","uid","editorPermissions","getPermissionsWithNestedFields","restrictedSubjects","authorPermissions","permission","permissionDomain","conditions","getDefaultPluginPermissions","isAuthor","addPermissions","displayWarningIfNoSuperAdmin","someUsersExists","log","warn","assignPermissions","permissions","validatePermissionsExist","internalActions","actionId","superAdmin","isSuperAdmin","assignRole","set","permissionsWithRole","existingPermissions","permissionsToAdd","differenceWith","includes","permissionsToDelete","permissionsToReturn","differenceBy","length","prop","newPermissions","sendDidUpdateRolePermissions","syncPermissionsForRole","conditionProvider","createMany","sanitizeConditions","isContentTypeAction","resetSuperAdminPermissions","permissionService","contentTypeService","otherActions","otherPermissions","reduce","acc","subjects","isArray","subject","transformedPermissions","call","hasSuperAdminRole","user","constants","superAdminCode"],"mappings":";;;;;;;;;;;;;;AAAA;AAgBA,MAAM,EAAEA,gBAAgB,EAAEC,oBAAoB,EAAE,GAAGC,WAAAA;AAEnD,MAAM,EAAEC,8BAA8B,EAAE,GAAGC,WAAAA;AAC3C,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,YAAAA;AAE7B,MAAMC,KAAAA,GAAQ;IACZC,8BAAAA,EAAgCL,8BAAAA,EAAAA;IAChCM,6BAAAA,EAA+BN,8BAAAA;AACjC,CAAA;AAEA,MAAMO,OAAAA,GAAU;IACdC,OAAAA,EAAS;AACX,CAAA;AAEA;AACA,MAAMC,eAA+EC,OAAAA,CAAK;AACxF,IAAA,OAAA;AACA,IAAA;AACD,CAAA,CAAA;AAID,MAAMC,iBAAAA,GAAoB;AAAC,IAAA,YAAA;AAAc,IAAA,YAAA;AAAc,IAAA,SAAA;AAAW,IAAA,QAAA;AAAU,IAAA;AAAmB,CAAA;AAC/F,MAAMC,uBAAuBC,OAAAA,CAAKF,iBAAAA,CAAAA;AAElC,MAAMG,SAAAA,GAAY,CAAmBC,IAAAA,GAAeC,IAAAA,CAAKC,KAAK,CAACD,IAAAA,CAAKE,SAAS,CAACH,IAAAA,CAAAA,CAAAA;AAE9E;;IAGA,MAAMI,mBAAAA,GAAsB,CAACC,EAAAA,EAAgBC,EAAAA,GAAAA;AAC3C,IAAA,IAAID,EAAAA,CAAGE,MAAM,KAAKD,EAAAA,CAAGC,MAAM,EAAE;AAC3B,QAAA,OAAOC,UAAAA,CAAQT,SAAAA,CAAUF,oBAAAA,CAAqBQ,EAAAA,CAAAA,CAAAA,EAAMN,UAAUF,oBAAAA,CAAqBS,EAAAA,CAAAA,CAAAA,CAAAA;AACrF,IAAA;IAEA,OAAO,KAAA;AACT,CAAA;AAEA;;;IAIA,MAAMG,SAAS,OAAOC,UAAAA,GAAAA;IACpB,MAAMC,aAAAA,GAAgB,MAAMC,MAAAA,CAAO;AAAEC,QAAAA,IAAAA,EAAMH,WAAWG;AAAK,KAAA,CAAA;AAE3D,IAAA,IAAIF,aAAAA,EAAe;QACjB,MAAM,IAAIxB,iBACR,CAAC,+CAA+C,EAAEuB,UAAAA,CAAWG,IAAI,CAAC,kBAAkB,CAAC,CAAA;AAEzF,IAAA;AACA,IAAA,MAAMC,iBAAAA,GAAoB,CAAA,EAAGC,kBAAAA,CAAEC,SAAS,CAACN,UAAAA,CAAWG,IAAI,CAAA,CAAE,CAAC,EAAEI,WAAAA,CAAMC,aAAa,EAAA,CAAA,CAAI;AAEpF,IAAA,MAAMC,aAAAA,GAAgB;AACpB,QAAA,GAAGT,UAAU;QACbU,IAAAA,EAAMV,UAAAA,CAAWU,IAAI,IAAIN;AAC3B,KAAA;IAEA,MAAMO,MAAAA,GAAS,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAef,MAAM,CAAC;QAAET,IAAAA,EAAMmB;AAAc,KAAA,CAAA;AACjFG,IAAAA,MAAAA,CAAOG,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEC,QAAAA,IAAAA,EAAMjC,YAAAA,CAAa2B,MAAAA;AAAQ,KAAA,CAAA;IAEjE,OAAOA,MAAAA;AACT,CAAA;AAEA;;;;AAIC,IACD,MAAMO,OAAAA,GAAU,CAACC,MAAAA,GAAS,EAAE,EAAEC,QAAAA,GAAAA;AAC5B,IAAA,OAAOR,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeI,OAAO,CAAC;QAAEG,KAAAA,EAAOF,MAAAA;AAAQC,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;AAIC,IACD,MAAME,qBAAAA,GAAwB,OAC5BH,MAAAA,GAAS,EAAE,EACXC,QAAAA,GAAAA;IAEA,MAAMH,IAAAA,GAAO,MAAML,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeI,OAAO,CAAC;QAAEG,KAAAA,EAAOF,MAAAA;AAAQC,QAAAA;AAAS,KAAA,CAAA;AAEpF,IAAA,IAAIH,IAAAA,EAAM;AACRA,QAAAA,IAAAA,CAAKM,UAAU,GAAG,MAAMC,aAAAA,CAAcP,KAAKQ,EAAE,CAAA;AAC/C,IAAA;IAEA,OAAOR,IAAAA;AACT,CAAA;AAEA;;;;AAIC,IACD,MAAMS,IAAAA,GAAO,CAACP,MAAAA,GAAS,EAAE,EAAEC,QAAAA,GAAAA;AACzB,IAAA,OAAOR,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAea,QAAQ,CAAC;QAAEN,KAAAA,EAAOF,MAAAA;AAAQC,QAAAA;AAAS,KAAA,CAAA;AAC3E,CAAA;AAEA;;IAGA,MAAMQ,wBAAwB,OAAOT,MAAAA,GAAAA;AACnC,IAAA,MAAMU,QAAmC,MAAMjB,MAAAA,CAAOC,EAAE,CACrDC,KAAK,CAAC,aAAA,CAAA,CACNa,QAAQ,CAACf,OAAOkB,GAAG,CAAC,cAAA,CAAA,CAAgBC,SAAS,CAAC,aAAA,EAAeZ,MAAAA,CAAAA,CAAAA;IAEhE,KAAK,MAAMF,QAAQY,KAAAA,CAAO;AACxBZ,QAAAA,IAAAA,CAAKM,UAAU,GAAG,MAAMC,aAAAA,CAAcP,KAAKQ,EAAE,CAAA;AAC/C,IAAA;IAEA,OAAOI,KAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAMG,MAAAA,GAAS,OAAOb,MAAAA,EAAanB,UAAAA,GAAAA;AACjC,IAAA,MAAMiC,mBAAAA,GAAsB5B,kBAAAA,CAAEpB,IAAI,CAACe,UAAAA,EAAY;AAAC,QAAA;AAAO,KAAA,CAAA;IAEvD,IAAIK,kBAAAA,CAAE6B,GAAG,CAACf,MAAAA,EAAQ,SAASd,kBAAAA,CAAE6B,GAAG,CAACD,mBAAAA,EAAqB,MAAA,CAAA,EAAS;QAC7D,MAAMhC,aAAAA,GAAgB,MAAMC,MAAAA,CAAO;AACjCC,YAAAA,IAAAA,EAAM8B,oBAAoB9B,IAAI;YAC9BsB,EAAAA,EAAI;AAAEU,gBAAAA,GAAAA,EAAKhB,OAAOM;AAAG;AACvB,SAAA,CAAA;AACA,QAAA,IAAIxB,aAAAA,EAAe;YACjB,MAAM,IAAIxB,iBACR,CAAC,+CAA+C,EAAEwD,mBAAAA,CAAoB9B,IAAI,CAAC,kBAAkB,CAAC,CAAA;AAElG,QAAA;AACF,IAAA;IAEA,MAAMQ,MAAAA,GAAS,MAAMC,MAAAA,CAAOC,EAAE,CAC3BC,KAAK,CAAC,aAAA,CAAA,CACNkB,MAAM,CAAC;QAAEX,KAAAA,EAAOF,MAAAA;QAAQ7B,IAAAA,EAAM2C;AAAoB,KAAA,CAAA;AAErDrB,IAAAA,MAAAA,CAAOG,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEC,QAAAA,IAAAA,EAAMjC,YAAAA,CAAa2B,MAAAA;AAAQ,KAAA,CAAA;IAEjE,OAAOA,MAAAA;AACT,CAAA;AAEA;;;AAGC,IACD,MAAMT,MAAAA,GAAS,OAAOiB,MAAAA,GAAS,EAAa,GAAA;IAC1C,MAAMiB,KAAAA,GAAQ,MAAMxB,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEf,KAAAA,EAAOF;AAAO,KAAA,CAAA;AACzE,IAAA,OAAOiB,KAAAA,GAAQ,CAAA;AACjB,CAAA;AAEA;;;AAGC,IACD,MAAMA,KAAAA,GAAQ,OAAOjB,MAAAA,GAAS,EAAS,GAAA;AACrC,IAAA,OAAOP,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAACjB,MAAAA,CAAAA;AAC9C,CAAA;AAEA;;;AAGC,IACD,MAAMkB,uBAAAA,GAA0B,OAAOC,GAAAA,GAAM,EAAE,GAAa;AAC1D,IAAA,MAAMC,iBAAiB,MAAMC,aAAAA,EAAAA;AAE7B,IAAA,IAAID,kBAAkBE,YAAAA,CAAOC,cAAc,CAACJ,GAAAA,EAAKC,cAAAA,CAAed,EAAE,CAAA,EAAG;AACnE,QAAA,MAAM,IAAIhD,gBAAAA,CAAiB,wCAAA,CAAA;AAC7B,IAAA;IAEA,KAAK,MAAMkE,UAAUL,GAAAA,CAAK;QACxB,MAAMf,UAAAA,GAAa,MAAMC,aAAAA,CAAcmB,MAAAA,CAAAA;AACvC,QAAA,IAAIpB,eAAe,CAAA,EAAG;AACpB,YAAA,MAAM,IAAI9C,gBAAAA,CAAiB,6CAAA,CAAA;AAC7B,QAAA;AACF,IAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMmE,WAAAA,GAAc,OAAON,GAAAA,GAAM,EAAE,GAAa;AAC9C,IAAA,MAAMD,uBAAAA,CAAwBC,GAAAA,CAAAA;IAE9B,MAAMO,gBAAAA,CAAW,YAAA,CAAA,CAAcC,gBAAgB,CAACR,GAAAA,CAAAA;AAEhD,IAAA,MAAMS,eAA4B,EAAE;IACpC,KAAK,MAAMtB,MAAMa,GAAAA,CAAK;QACpB,MAAMU,WAAAA,GAAc,MAAMpC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemC,MAAM,CAAC;YAAE5B,KAAAA,EAAO;AAAEI,gBAAAA;AAAG;AAAE,SAAA,CAAA;AAEhF,QAAA,IAAIuB,WAAAA,EAAa;AACfpC,YAAAA,MAAAA,CAAOG,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;gBAAEC,IAAAA,EAAM+B;AAAY,aAAA,CAAA;AACxDD,YAAAA,YAAAA,CAAaG,IAAI,CAACF,WAAAA,CAAAA;AACpB,QAAA;AACF,IAAA;IAEA,OAAOD,YAAAA;AACT,CAAA;AAEA;IAEA,MAAMvB,gBAAgB,OAAOmB,MAAAA,GAAAA;AAC3B,IAAA,OAAO/B,OAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEf,KAAAA,EAAO;YAAEQ,KAAAA,EAAO;gBAAEJ,EAAAA,EAAIkB;AAAO;AAAE;AAAE,KAAA,CAAA;AACjF,CAAA;AAEA;IAEA,MAAMH,aAAAA,GAAgB,IAAsCtB,OAAAA,CAAQ;QAAER,IAAAA,EAAMtC;AAAiB,KAAA,CAAA;AAE7F;;IAGA,MAAM+E,2BAAAA,GAA8B,IAAM7B,qBAAAA,CAAsB;QAAEZ,IAAAA,EAAMtC;AAAiB,KAAA,CAAA;AAEzF;AACC,IACD,MAAMgF,sBAAAA,GAAyB,UAAA;AAC7B,IAAA,MAAMC,iBAAiB,MAAMnD,MAAAA,EAAAA;AAC7B,IAAA,IAAImD,cAAAA,EAAgB;AAClB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGT,gBAAAA,CAAW,YAAA,CAAA;IAEtC,MAAMU,UAAAA,GAAaD,eAAeE,MAAM,EAAA;IACxC,MAAMC,mBAAAA,GAAsBF,WAAWG,MAAM,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAEC,OAAO,KAAK,cAAA,CAAA;;IAGnE,MAAMrB,cAAAA,GAAiB,MAAMxC,MAAAA,CAAO;QAClCI,IAAAA,EAAM,aAAA;QACNO,IAAAA,EAAM,oBAAA;QACNmD,WAAAA,EAAa;AACf,KAAA,CAAA;AAEA,IAAA,MAAMhB,gBAAAA,CAAW,MAAA,CAAA,CAAQiB,gBAAgB,CAACvB,eAAed,EAAE,CAAA;IAE3D,MAAMsC,UAAAA,GAAa,MAAMhE,MAAAA,CAAO;QAC9BI,IAAAA,EAAM,QAAA;QACNO,IAAAA,EAAM,eAAA;QACNmD,WAAAA,EAAa;AACf,KAAA,CAAA;IAEA,MAAMG,UAAAA,GAAa,MAAMjE,MAAAA,CAAO;QAC9BI,IAAAA,EAAM,QAAA;QACNO,IAAAA,EAAM,eAAA;QACNmD,WAAAA,EAAa;AACf,KAAA,CAAA;;;;IAKA,MAAMI,gBAAAA,GAAmBC,OAAOV,MAAM,CAAC5C,OAAOuD,YAAY,CAAA,CACvDT,MAAM,CAAC,CAACU,EAAAA,GAAOA,IAAIC,aAAAA,GAAgB,iBAAA,CAAkB,EAAEC,OAAAA,KAAY,KAAA,CAAA,CACnEC,GAAG,CAAC,CAACH,EAAAA,GAAOA,EAAAA,CAAGI,GAAG,CAAA;AAErB,IAAA,MAAMC,iBAAAA,GAAoB5B,gBAAAA,CAAW,cAAA,CAAA,CAAgB6B,8BAA8B,CACjFjB,mBAAAA,EACA;QACEkB,kBAAAA,EAAoB;AAAC,YAAA,gCAAA;AAAqCV,YAAAA,GAAAA;AAAiB;AAC7E,KAAA,CAAA;AAGF,IAAA,MAAMW,oBAAoBH,iBAAAA,CACvBf,MAAM,CAAC,CAAC,EAAE7D,MAAM,EAAO,GAAKA,WAAWf,OAAAA,CAAQC,OAAO,EACtDwF,GAAG,CAAC,CAACM,UAAAA,GACJC,eAAAA,CAAiB/E,MAAM,CAAC;AAAE,YAAA,GAAG8E,UAAU;YAAEE,UAAAA,EAAY;AAAC,gBAAA;AAAoB;AAAC,SAAA,CAAA,CAAA;AAG/EN,IAAAA,iBAAAA,CAAkBvB,IAAI,CAAA,GAAI8B,2BAAAA,EAAAA,CAAAA;IAC1BJ,iBAAAA,CAAkB1B,IAAI,IAAI8B,2BAAAA,CAA4B;QAAEC,QAAAA,EAAU;AAAK,KAAA,CAAA,CAAA;;IAGvE,MAAMC,cAAAA,CAAenB,UAAAA,CAAWtC,EAAE,EAAEgD,iBAAAA,CAAAA;IACpC,MAAMS,cAAAA,CAAelB,UAAAA,CAAWvC,EAAE,EAAEmD,iBAAAA,CAAAA;AACtC,CAAA;AAEA,MAAMI,2BAAAA,GAA8B,CAAC,EAAEC,QAAAA,GAAW,KAAK,EAAE,GAAG,EAAE,GAAA;AAC5D,IAAA,MAAMF,aAAaE,QAAAA,GAAW;AAAC,QAAA;AAAoB,KAAA,GAAG,EAAE;;IAGxD,OAAO;AACL,QAAA;YAAEpF,MAAAA,EAAQ,qBAAA;AAAuBkF,YAAAA;AAAW,SAAA;AAC5C,QAAA;YAAElF,MAAAA,EAAQ;AAAgC,SAAA;AAC1C,QAAA;YAAEA,MAAAA,EAAQ;AAA+B,SAAA;AACzC,QAAA;YAAEA,MAAAA,EAAQ,8BAAA;AAAgCkF,YAAAA;AAAW,SAAA;AACrD,QAAA;YAAElF,MAAAA,EAAQ;AAAiC,SAAA;AAC3C,QAAA;YAAEA,MAAAA,EAAQ;AAAkC;KAC7C,CAAC0E,GAAG,CAACO,eAAAA,CAAiB/E,MAAM,CAAA;AAC/B,CAAA;AAEA;;AAEC,IACD,MAAMoF,4BAAAA,GAA+B,UAAA;AACnC,IAAA,MAAM5C,iBAAiB,MAAMY,2BAAAA,EAAAA;AAC7B,IAAA,MAAMiC,eAAAA,GAAkB,MAAMvC,gBAAAA,CAAW,MAAA,CAAA,CAAQ3C,MAAM,EAAA;AAEvD,IAAA,IAAI,CAACqC,cAAAA,EAAgB;QACnB3B,MAAAA,CAAOyE,GAAG,CAACC,IAAI,CAAC,mDAAA,CAAA;AAClB,IAAA,CAAA,MAAO,IAAIF,eAAAA,IAAmB7C,cAAAA,CAAehB,UAAU,KAAK,CAAA,EAAG;QAC7DX,MAAAA,CAAOyE,GAAG,CAACC,IAAI,CAAC,mDAAA,CAAA;AAClB,IAAA;AACF,CAAA;AAEA;;;;AAIC,IACD,MAAMC,iBAAAA,GAAoB,OACxB5C,MAAAA,EACA6C,cAA4E,EAAE,GAAA;AAE9E,IAAA,MAAMC,mCAAAA,CAAyBD,WAAAA,CAAAA;;;IAI/B,MAAME,eAAAA,GAAkB7C,iBAAW,YAAA,CAAA,CAChCS,cAAc,CAACE,MAAM,EAAA,CACrBE,MAAM,CAAC,CAAC7D,SAAWA,MAAAA,CAAO+D,OAAO,KAAK,UAAA,CAAA,CACtCW,GAAG,CAAC,CAAC1E,MAAAA,GAAWA,OAAO8F,QAAQ,CAAA;AAElC,IAAA,MAAMC,UAAAA,GAAa,MAAM/C,gBAAAA,CAAW,MAAA,CAAA,CAAQL,aAAa,EAAA;AACzD,IAAA,MAAMqD,YAAAA,GAAeD,UAAAA,IAAcA,UAAAA,CAAWnE,EAAE,KAAKkB,MAAAA;IACrD,MAAMmD,UAAAA,GAAaC,OAAI,MAAA,EAAQpD,MAAAA,CAAAA;IAE/B,MAAMqD,mBAAAA,GAAsBR,WAC1B;KACCjB,GAAG,CAACuB,WACL;;KAECvB,GAAG,CAACO,gBAAiB/E,MAAM,CAAA;AAE9B,IAAA,MAAMkG,mBAAAA,GAAsB,MAAMpD,gBAAAA,CAAW,YAAA,CAAA,CAAclB,QAAQ,CAAC;QAClEN,KAAAA,EAAO;YAAEJ,IAAAA,EAAM;gBAAEQ,EAAAA,EAAIkB;AAAO;AAAE,SAAA;QAC9BvB,QAAAA,EAAU;AAAC,YAAA;AAAO;AACpB,KAAA,CAAA;AAEA,IAAA,MAAM8E,gBAAAA,GAAmBC,iBAAAA,CACvBzG,mBAAAA,EACAsG,mBAAAA,EACAC,qBACAvC,MAAM,CAAC,CAACmB,UAAAA,GAA2B,CAACa,eAAAA,CAAgBU,QAAQ,CAACvB,WAAWhF,MAAM,CAAA,CAAA;AAEhF,IAAA,MAAMwG,mBAAAA,GAAsBF,iBAAAA,CAC1BzG,mBAAAA,EACAuG,mBAAAA,EACAD,qBACAtC,MAAM,CAAC,CAACmB,UAAAA,GAA2B,CAACa,eAAAA,CAAgBU,QAAQ,CAACvB,WAAWhF,MAAM,CAAA,CAAA;IAEhF,MAAMyG,mBAAAA,GAAsBC,eAAAA,CAAa,IAAA,EAAMF,mBAAAA,EAAqBJ,mBAAAA,CAAAA;IAEpE,IAAII,mBAAAA,CAAoBG,MAAM,GAAG,CAAA,EAAG;;AAElC,QAAA,MAAM3D,iBAAW,YAAA,CAAA,CAAcD,WAAW,CAACyD,mBAAAA,CAAoB9B,GAAG,CAACkC,OAAAA,CAAK,IAAA,CAAA,CAAA,CAAA;AAC1E,IAAA;IAEA,IAAIP,gBAAAA,CAAiBM,MAAM,GAAG,CAAA,EAAG;QAC/B,MAAME,cAAAA,GAAiB,MAAMxB,cAAAA,CAAevC,MAAAA,EAAQuD,gBAAAA,CAAAA;AACpDI,QAAAA,mBAAAA,CAAoBpD,IAAI,CAAA,GAAIwD,cAAAA,CAAAA;AAC9B,IAAA;IAEA,IAAI,CAACb,iBAAiBK,gBAAAA,CAAiBM,MAAM,IAAIH,mBAAAA,CAAoBG,MAAK,CAAA,EAAI;QAC5E,MAAM3D,gBAAAA,CAAW,WAAW8D,4BAA4B,EAAA;AAC1D,IAAA;AAEA,IAAA,IAAIT,iBAAiBM,MAAM,GAAG,KAAKH,mBAAAA,CAAoBG,MAAM,GAAG,CAAA,EAAG;QACjE,MAAM3D,gBAAAA,CAAW,iBAAA,CAAA,CAAmB+D,sBAAsB,CAACjE,MAAAA,CAAAA;AAC7D,IAAA;IAEA,OAAO2D,mBAAAA;AACT,CAAA;AAEA,MAAMpB,cAAAA,GAAiB,OAAOvC,MAAAA,EAAiB6C,WAAAA,GAAAA;AAC7C,IAAA,MAAM,EAAEqB,iBAAiB,EAAEC,UAAU,EAAE,GAAGjE,gBAAAA,CAAW,YAAA,CAAA;IACrD,MAAM,EAAEkE,kBAAkB,EAAE,GAAGjC,eAAAA;AAE/B,IAAA,MAAMkB,sBAAsBR,WAAAA,CACzBjB,GAAG,CAACwB,MAAAA,CAAI,MAAA,EAAQpD,QACjB;;AAEC4B,KAAAA,GAAG,CAACwC,kBAAAA,CAAmBF,iBAAAA,CAAAA,CAAAA,CACvBtC,GAAG,CAACO,gBAAiB/E,MAAM,CAAA;AAE9B,IAAA,OAAO+G,UAAAA,CAAWd,mBAAAA,CAAAA;AACpB,CAAA;AAEA,MAAMgB,mBAAAA,GAAsB,CAACnH,MAAAA,GAAmBA,MAAAA,CAAO+D,OAAO,KAAKvF,oBAAAA;AAEnE;;AAEC,IACD,MAAM4I,0BAAAA,GAA6B,UAAA;AACjC,IAAA,MAAM1E,cAAAA,GAAiB,MAAMM,gBAAAA,CAAW,MAAA,CAAA,CAAQL,aAAa,EAAA;AAC7D,IAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM2E,oBAAoBrE,gBAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,qBAAqBtE,gBAAAA,CAAW,cAAA,CAAA;AAEtC,IAAA,MAAMU,UAAAA,GAAa2D,iBAAAA,CAAkB5D,cAAc,CAACE,MAAM,EAAA;AAE1D,IAAA,MAAMC,sBAAsBF,UAAAA,CAAWG,MAAM,CAAC,CAAC7D,SAAWmH,mBAAAA,CAAoBnH,MAAAA,CAAAA,CAAAA;AAC9E,IAAA,MAAMuH,eAAe7D,UAAAA,CAAWG,MAAM,CAAC,CAAC7D,MAAAA,GAAW,CAACmH,mBAAAA,CAAoBnH,MAAAA,CAAAA,CAAAA;;IAGxE,MAAM2F,WAAAA,GAAc2B,kBAAAA,CAAmBzC,8BAA8B,CACnEjB,mBAAAA,CAAAA;;AAIF,IAAA,MAAM4D,gBAAAA,GAAmBD,YAAAA,CAAaE,MAAM,CAAC,CAACC,GAAAA,EAAK1H,MAAAA,GAAAA;AACjD,QAAA,MAAM,EAAE8F,QAAQ,EAAE6B,QAAQ,EAAE,GAAG3H,MAAAA;AAE/B,QAAA,IAAI4H,WAAQD,QAAAA,CAAAA,EAAW;YACrBD,GAAAA,CAAIrE,IAAI,IACHsE,QAAAA,CAASjD,GAAG,CAAC,CAACmD,OAAAA,GAAY5C,eAAAA,CAAiB/E,MAAM,CAAC;oBAAEF,MAAAA,EAAQ8F,QAAAA;AAAU+B,oBAAAA;AAAQ,iBAAA,CAAA,CAAA,CAAA;QAErF,CAAA,MAAO;AACLH,YAAAA,GAAAA,CAAIrE,IAAI,CAAC4B,eAAAA,CAAiB/E,MAAM,CAAC;gBAAEF,MAAAA,EAAQ8F;AAAS,aAAA,CAAA,CAAA;AACtD,QAAA;QAEA,OAAO4B,GAAAA;AACT,IAAA,CAAA,EAAG,EAAE,CAAA;AAEL/B,IAAAA,WAAAA,CAAYtC,IAAI,CAAA,GAAImE,gBAAAA,CAAAA;AAEpB,IAAA,MAAMM,yBAA0B,MAAMhJ,KAAAA,CAAMC,8BAA8B,CAACgJ,IAAI,CAC7EpC,WAAAA,CAAAA;IAGF,MAAMD,iBAAAA,CAAkBhD,cAAAA,CAAed,EAAE,EAAEkG,sBAAAA,CAAAA;AAC7C,CAAA;AAEA;;IAGA,MAAME,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,MAAMjG,QAAQxB,kBAAAA,CAAEyB,GAAG,CAACgG,IAAAA,EAAM,SAAS,EAAE,CAAA;AAErC,IAAA,OAAOjG,MAAM0C,GAAG,CAACkC,OAAAA,CAAK,MAAA,CAAA,CAAA,CAASL,QAAQ,CAAChI,gBAAAA,CAAAA;AAC1C,CAAA;AAEA,MAAM2J,SAAAA,GAAY;IAChBC,cAAAA,EAAgB5J;AAClB,CAAA;AAEA,WAAe;AACbO,IAAAA,KAAAA;AACAK,IAAAA,YAAAA;AACAe,IAAAA,MAAAA;AACAmB,IAAAA,OAAAA;AACAI,IAAAA,qBAAAA;AACAI,IAAAA,IAAAA;AACAE,IAAAA,qBAAAA;AACAI,IAAAA,MAAAA;AACA9B,IAAAA,MAAAA;AACAkC,IAAAA,KAAAA;AACAQ,IAAAA,WAAAA;AACApB,IAAAA,aAAAA;AACAgB,IAAAA,aAAAA;AACAW,IAAAA,2BAAAA;AACAC,IAAAA,sBAAAA;AACA+B,IAAAA,4BAAAA;AACAD,IAAAA,cAAAA;AACA2C,IAAAA,iBAAAA;AACAtC,IAAAA,iBAAAA;AACA0B,IAAAA,0BAAAA;AACA5E,IAAAA,uBAAAA;AACA0F,IAAAA;AACF,CAAA;;;;"}