@strapi/admin 5.50.1 → 5.51.0

package/dist/ee/server/src/services/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/auth.ts"],"names":[],"mappings":";iCAayC,GAAG;uDAyCmB,GAAG;;AAelE,wBAGE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/auth.ts"],"names":[],"mappings":";iCAiByC,GAAG;uDAwCmB,GAAG;;AAkBlE,wBAGE"}

package/dist/ee/server/src/services/index.d.ts

@@ -26,9 +26,9 @@ declare const _default: {
         updateById: (id: any, attributes: any) => Promise<any>;
     };
     metrics: {
-        startCron: (strapi: import("@strapi/types/dist/core").Strapi) => void;
+        startCron: (strapi: import("@strapi/types/dist/core/strapi.js").Strapi) => void;
         getSSOProvidersList: () => Promise<any>;
-        sendUpdateProjectInformation: (strapi: import("@strapi/types/dist/core").Strapi) => Promise<void>;
+        sendUpdateProjectInformation: (strapi: import("@strapi/types/dist/core/strapi.js").Strapi) => Promise<void>;
     };
     'seat-enforcement': {
         seatEnforcementWorkflow: () => Promise<void>;

package/dist/ee/server/src/services/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/user.ts"],"names":[],"mappings":";oCAmB6C,MAAM,SAAS,GAAG;yCAwBb,OAAO;;uBA8HzB,GAAG;qBAzCL,OAAO;qBAzDP,GAAG,cAAc,GAAG;;AA4KlD,wBAOE"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../ee/server/src/services/user.ts"],"names":[],"mappings":";oCAmB6C,MAAM,SAAS,GAAG;yCAwBb,OAAO;;uBA8HzB,GAAG;qBAzCL,OAAO;qBAzDP,GAAG,cAAc,GAAG;;AAkLlD,wBAOE"}

package/dist/server/ee/server/src/controllers/admin.js

@@ -20,6 +20,7 @@ var admin = {
                     features: strapi.ee.features.list(),
                     flags,
                     type: strapi.ee.type,
+                    planPriceId: strapi.ee.planPriceId,
                     ai: {
                         enabled: isAILicense && isAIConfigured.enabled
                     }

package/dist/server/ee/server/src/controllers/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,EAAAA,EAAI;wBACFP,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOQ,GAAAA,EAAK;YACZ,OAAO;gBAAEP,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOgB,EAAAA,EAAI;wBAAEP,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMS,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBlB,MAAAA,CAAOI,EAAE,CAACe,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,gBAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMZ,IAAAA,GAAO;AACXa,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,QAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,SAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDlB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin.js","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\n\nimport { getService } from '../utils';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;;;AAKA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,gBAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,QAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,SAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/admin.mjs

@@ -18,6 +18,7 @@ var admin = {
                     features: strapi.ee.features.list(),
                     flags,
                     type: strapi.ee.type,
+                    planPriceId: strapi.ee.planPriceId,
                     ai: {
                         enabled: isAILicense && isAIConfigured.enabled
                     }

package/dist/server/ee/server/src/controllers/admin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,EAAAA,EAAI;wBACFP,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOQ,GAAAA,EAAK;YACZ,OAAO;gBAAEP,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOgB,EAAAA,EAAI;wBAAEP,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMS,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBlB,MAAAA,CAAOI,EAAE,CAACe,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMZ,IAAAA,GAAO;AACXa,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,KAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDlB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\n\nimport { getService } from '../utils';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;AAKA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,KAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js

@@ -102,7 +102,8 @@ const redirectWithAuth = async (ctx)=>{
         const userId = String(user.id);
         const deviceId = sessionAuth.generateDeviceId();
         const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
-            type: 'refresh'
+            type: 'refresh',
+            metadata: sessionAuth.buildSessionMetadataFromContext(ctx)
         });
         const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);
         ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
@@ -115,12 +116,17 @@ const redirectWithAuth = async (ctx)=>{
         const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
         const isProduction = process.env.NODE_ENV === 'production';
         const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
-        const domain = strapi.config.get('admin.auth.domain');
-        ctx.cookies.set('jwtToken', accessToken, {
+        // Resolve through the shared helpers so the server write agrees with the
+        // client set/delete (which read the same config inlined at build time);
+        // any divergence leaves a cookie the admin panel cannot clear on logout.
+        const domain = sessionAuth.getAccessCookieDomain();
+        const path = sessionAuth.getAccessCookiePath();
+        ctx.cookies.set(sessionAuth.getAccessCookieName(), accessToken, {
             httpOnly: false,
             secure: isSecure,
             overwrite: true,
-            domain
+            domain,
+            path
         });
         const sanitizedUser = index.getService('user').sanitizeUser(user);
         strapi.eventHub.emit('admin.auth.success', {

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAAA,EAAa;YACvCS,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQH,QAAAA;YACRI,SAAAA,EAAW,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAAA,GAAgBtD,gBAAAA,CAAW,MAAA,CAAA,CAAQuD,YAAY,CAACxD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMuD,aAAAA;AAAepE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaqE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOjE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;;;"}
+{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;AAeA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,2CAAAA,CAAgCrD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMsD,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BhD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBnD,MAAAA,CAAOoD,MAAM,CAAChC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMiC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,iCAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,+BAAAA,EAAAA;AAEbxE,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACgB,mCAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB5D,gBAAAA,CAAW,MAAA,CAAA,CAAQ6D,YAAY,CAAC9D,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAM6D,aAAAA;AAAe1E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa2E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOvE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs

@@ -1,7 +1,7 @@
 import passport from 'koa-passport';
 import { getService } from '../../utils/index.mjs';
 import utils from './utils.mjs';
-import { getSessionManager, generateDeviceId, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME } from '../../../../../shared/utils/session-auth.mjs';
+import { getSessionManager, generateDeviceId, buildSessionMetadataFromContext, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getAccessCookieDomain, getAccessCookiePath, getAccessCookieName } from '../../../../../shared/utils/session-auth.mjs';
 
 const defaultConnectionError = ()=>new Error('Invalid connection payload');
 const authenticate = async (ctx, next)=>{
@@ -94,7 +94,8 @@ const redirectWithAuth = async (ctx)=>{
         const userId = String(user.id);
         const deviceId = generateDeviceId();
         const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
-            type: 'refresh'
+            type: 'refresh',
+            metadata: buildSessionMetadataFromContext(ctx)
         });
         const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);
         ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
@@ -107,12 +108,17 @@ const redirectWithAuth = async (ctx)=>{
         const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
         const isProduction = process.env.NODE_ENV === 'production';
         const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
-        const domain = strapi.config.get('admin.auth.domain');
-        ctx.cookies.set('jwtToken', accessToken, {
+        // Resolve through the shared helpers so the server write agrees with the
+        // client set/delete (which read the same config inlined at build time);
+        // any divergence leaves a cookie the admin panel cannot clear on logout.
+        const domain = getAccessCookieDomain();
+        const path = getAccessCookiePath();
+        ctx.cookies.set(getAccessCookieName(), accessToken, {
             httpOnly: false,
             secure: isSecure,
             overwrite: true,
-            domain
+            domain,
+            path
         });
         const sanitizedUser = getService('user').sanitizeUser(user);
         strapi.eventHub.emit('admin.auth.success', {

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set('jwtToken', accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAWA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,qBAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAAC,YAAYI,WAAAA,EAAa;YACvCS,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQH,QAAAA;YACRI,SAAAA,EAAW,IAAA;AACXH,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMI,aAAAA,GAAgBtD,UAAAA,CAAW,MAAA,CAAA,CAAQuD,YAAY,CAACxD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMuD,aAAAA;AAAepE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaqE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOjE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAeA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,+BAAAA,CAAgCrD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMsD,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACC,qBAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BhD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBnD,MAAAA,CAAOoD,MAAM,CAAChC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMiC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,qBAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,mBAAAA,EAAAA;AAEbxE,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACgB,uBAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB5D,UAAAA,CAAW,MAAA,CAAA,CAAQ6D,YAAY,CAAC9D,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAM6D,aAAAA;AAAe1E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa2E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOvE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/auth.js

@@ -4,6 +4,7 @@ var _ = require('lodash');
 var utils = require('@strapi/utils');
 var index = require('../utils/index.js');
 var ssoLock = require('../utils/sso-lock.js');
+var auth$1 = require('../../../../server/src/services/auth.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -26,10 +27,7 @@ const { ApplicationError } = utils.errors;
     if (!user || await ssoLock.isSsoLocked(user)) {
         return;
     }
-    const resetPasswordToken = index.getService('token').createToken();
-    await index.getService('user').updateById(user.id, {
-        resetPasswordToken
-    });
+    const resetPasswordToken = await auth$1.assignResetPasswordToken(user.id);
     // Send an email to the admin.
     const url = `${strapi.config.get('admin.absoluteUrl')}/auth/reset-password?code=${resetPasswordToken}`;
     return strapi.plugin('email').service('email').sendTemplatedEmail({
@@ -64,9 +62,11 @@ const { ApplicationError } = utils.errors;
     if (!matchingUser || await ssoLock.isSsoLocked(matchingUser)) {
         throw new ApplicationError();
     }
+    await auth$1.assertResetPasswordTokenIsValid(matchingUser);
     return index.getService('user').updateById(matchingUser.id, {
         password,
-        resetPasswordToken: null
+        resetPasswordToken: null,
+        resetPasswordTokenExpiresAt: null
     });
 };
 var auth = {

package/dist/server/ee/server/src/services/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = getService('token').createToken();\n  await getService('user').updateById(user.id, { resetPasswordToken });\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","getService","createToken","updateById","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser"],"mappings":";;;;;;;;;;;AAKA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,mBAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;IAEA,MAAMQ,kBAAAA,GAAqBC,gBAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMD,iBAAW,MAAA,CAAA,CAAQE,UAAU,CAACX,IAAAA,CAAKY,EAAE,EAAE;AAAEJ,QAAAA;AAAmB,KAAA,CAAA;;IAGlE,MAAMK,GAAAA,GAAM,CAAA,EAAGZ,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEP,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJe,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAInB,KAAKD,KAAK;AACdqB,QAAAA,IAAAA,EAAMnB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASpB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAd,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAb,IAAAA,EAAMsB,kBAAAA,CAAEC,IAAI,CAACvB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDwB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENxB,MAAAA,CAAOyB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAEpB,kBAAkB,EAAEqB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM7B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACwB,YAAAA,IAAiB,MAAMvB,mBAAAA,CAAYuB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIlC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,OAAOa,iBAAW,MAAA,CAAA,CAAQE,UAAU,CAACmB,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACArB,kBAAAA,EAAoB;AACtB,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACbV,IAAAA,cAAAA;AACA8B,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"auth.js","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\nimport {\n  assignResetPasswordToken,\n  assertResetPasswordTokenIsValid,\n} from '../../../../server/src/services/auth';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","assignResetPasswordToken","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser","assertResetPasswordTokenIsValid","getService","updateById","resetPasswordTokenExpiresAt"],"mappings":";;;;;;;;;;;;AASA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,mBAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;AAEA,IAAA,MAAMQ,kBAAAA,GAAqB,MAAMC,+BAAAA,CAAyBT,IAAAA,CAAKU,EAAE,CAAA;;IAGjE,MAAMC,GAAAA,GAAM,CAAA,EAAGV,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEL,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJa,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIjB,KAAKD,KAAK;AACdmB,QAAAA,IAAAA,EAAMjB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASlB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAZ,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAX,IAAAA,EAAMoB,kBAAAA,CAAEC,IAAI,CAACrB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDsB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENtB,MAAAA,CAAOuB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAElB,kBAAkB,EAAEmB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM3B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACsB,YAAAA,IAAiB,MAAMrB,mBAAAA,CAAYqB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIhC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMiC,sCAAAA,CAAgCD,YAAAA,CAAAA;AAEtC,IAAA,OAAOE,iBAAW,MAAA,CAAA,CAAQC,UAAU,CAACH,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACAnB,kBAAAA,EAAoB,IAAA;QACpBwB,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACblC,IAAAA,cAAAA;AACA4B,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/auth.mjs

@@ -2,6 +2,7 @@ import ___default from 'lodash';
 import { errors } from '@strapi/utils';
 import { getService } from '../utils/index.mjs';
 import { isSsoLocked } from '../utils/sso-lock.mjs';
+import { assertResetPasswordTokenIsValid, assignResetPasswordToken } from '../../../../server/src/services/auth.mjs';
 
 const { ApplicationError } = errors;
 /**
@@ -20,10 +21,7 @@ const { ApplicationError } = errors;
     if (!user || await isSsoLocked(user)) {
         return;
     }
-    const resetPasswordToken = getService('token').createToken();
-    await getService('user').updateById(user.id, {
-        resetPasswordToken
-    });
+    const resetPasswordToken = await assignResetPasswordToken(user.id);
     // Send an email to the admin.
     const url = `${strapi.config.get('admin.absoluteUrl')}/auth/reset-password?code=${resetPasswordToken}`;
     return strapi.plugin('email').service('email').sendTemplatedEmail({
@@ -58,9 +56,11 @@ const { ApplicationError } = errors;
     if (!matchingUser || await isSsoLocked(matchingUser)) {
         throw new ApplicationError();
     }
+    await assertResetPasswordTokenIsValid(matchingUser);
     return getService('user').updateById(matchingUser.id, {
         password,
-        resetPasswordToken: null
+        resetPasswordToken: null,
+        resetPasswordTokenExpiresAt: null
     });
 };
 var auth = {

package/dist/server/ee/server/src/services/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = getService('token').createToken();\n  await getService('user').updateById(user.id, { resetPasswordToken });\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","getService","createToken","updateById","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser"],"mappings":";;;;;AAKA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,WAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;IAEA,MAAMQ,kBAAAA,GAAqBC,UAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMD,WAAW,MAAA,CAAA,CAAQE,UAAU,CAACX,IAAAA,CAAKY,EAAE,EAAE;AAAEJ,QAAAA;AAAmB,KAAA,CAAA;;IAGlE,MAAMK,GAAAA,GAAM,CAAA,EAAGZ,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEP,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJe,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAInB,KAAKD,KAAK;AACdqB,QAAAA,IAAAA,EAAMnB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASpB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAd,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAb,IAAAA,EAAMsB,UAAAA,CAAEC,IAAI,CAACvB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDwB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENxB,MAAAA,CAAOyB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAEpB,kBAAkB,EAAEqB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM7B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACwB,YAAAA,IAAiB,MAAMvB,WAAAA,CAAYuB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIlC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,OAAOa,WAAW,MAAA,CAAA,CAAQE,UAAU,CAACmB,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACArB,kBAAAA,EAAoB;AACtB,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACbV,IAAAA,cAAAA;AACA8B,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"auth.mjs","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\nimport {\n  assignResetPasswordToken,\n  assertResetPasswordTokenIsValid,\n} from '../../../../server/src/services/auth';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","assignResetPasswordToken","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser","assertResetPasswordTokenIsValid","getService","updateById","resetPasswordTokenExpiresAt"],"mappings":";;;;;;AASA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,WAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;AAEA,IAAA,MAAMQ,kBAAAA,GAAqB,MAAMC,wBAAAA,CAAyBT,IAAAA,CAAKU,EAAE,CAAA;;IAGjE,MAAMC,GAAAA,GAAM,CAAA,EAAGV,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEL,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJa,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIjB,KAAKD,KAAK;AACdmB,QAAAA,IAAAA,EAAMjB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASlB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAZ,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAX,IAAAA,EAAMoB,UAAAA,CAAEC,IAAI,CAACrB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDsB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENtB,MAAAA,CAAOuB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAElB,kBAAkB,EAAEmB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM3B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACsB,YAAAA,IAAiB,MAAMrB,WAAAA,CAAYqB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIhC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMiC,+BAAAA,CAAgCD,YAAAA,CAAAA;AAEtC,IAAA,OAAOE,WAAW,MAAA,CAAA,CAAQC,UAAU,CAACH,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACAnB,kBAAAA,EAAoB,IAAA;QACpBwB,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACblC,IAAAA,cAAAA;AACA4B,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/user.js

@@ -223,6 +223,7 @@ const sanitizeUserRoles = (role)=>___default.default.pick(role, [
         ...___default.default.omit(user, [
             'password',
             'resetPasswordToken',
+            'resetPasswordTokenExpiresAt',
             'registrationToken',
             'roles'
         ]),

package/dist/server/ee/server/src/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, ['password', 'resetPasswordToken', 'registrationToken', 'roles']),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,OAAAA,CAAKC,YAAAA,EAAWC,MAAAA,CAAIC,WAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,gBAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,kBAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,wBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,kBAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AAAC,YAAA,UAAA;AAAY,YAAA,oBAAA;AAAsB,YAAA,mBAAA;AAAqB,YAAA;SAAQ,CAAC;AACjF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,OAAAA,CAAKC,YAAAA,EAAWC,MAAAA,CAAIC,WAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,gBAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,kBAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,wBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,kBAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/user.mjs

@@ -217,6 +217,7 @@ const sanitizeUserRoles = (role)=>___default.pick(role, [
         ...___default.omit(user, [
             'password',
             'resetPasswordToken',
+            'resetPasswordTokenExpiresAt',
             'registrationToken',
             'roles'
         ]),