@strapi/admin 5.50.1 → 5.51.0

package/dist/server/server/src/routes/serve-admin-panel.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve-admin-panel.js","sources":["../../../../../server/src/routes/serve-admin-panel.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport { resolve, join, extname, basename } from 'path';\nimport fse from 'fs-extra';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\nconst registerAdminPanelRoute = ({ strapi }: { strapi: Core.Strapi }) => {\n  let buildDir = resolve(strapi.dirs.dist.root, 'build');\n\n  if (!fse.pathExistsSync(buildDir)) {\n    buildDir = resolve(__dirname, '../../build');\n  }\n\n  const serveAdminMiddleware = async (ctx: Context, next: Next) => {\n    await next();\n\n    if (ctx.method !== 'HEAD' && ctx.method !== 'GET') {\n      return;\n    }\n\n    if (ctx.body != null || ctx.status !== 404) {\n      return;\n    }\n\n    ctx.type = 'html';\n    ctx.body = fse.createReadStream(join(buildDir, 'index.html'));\n  };\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: `${strapi.config.admin.path}/:path*`,\n      handler: [\n        serveAdminMiddleware,\n        serveStatic(buildDir, {\n          maxage: 31536000,\n          defer: false,\n          index: 'index.html',\n          setHeaders(res: any, path: any) {\n            const ext = extname(path);\n            // publicly cache static files to avoid unnecessary network & disk access\n            if (ext !== '.html') {\n              res.setHeader('cache-control', 'public, max-age=31536000, immutable');\n            }\n          },\n        }),\n      ],\n      config: { auth: false },\n    },\n  ]);\n};\n\n// serveStatic is not supposed to be used to serve a folder that have sub-folders\nexport const serveStatic = (filesDir: any, koaStaticOptions = {}) => {\n  const serve = koaStatic(filesDir, koaStaticOptions);\n\n  return async (ctx: Context, next: Next) => {\n    if (!extname(ctx.path)) {\n      await next();\n      return;\n    }\n\n    const prev = ctx.path;\n    const newPath = `/${basename(ctx.path)}`;\n\n    ctx.path = newPath;\n    await serve(ctx, async () => {\n      ctx.path = prev;\n      await next();\n      ctx.path = newPath;\n    });\n    ctx.path = prev;\n  };\n};\n\nexport default registerAdminPanelRoute;\n"],"names":["registerAdminPanelRoute","strapi","buildDir","resolve","dirs","dist","root","fse","pathExistsSync","__dirname","serveAdminMiddleware","ctx","next","method","body","status","type","createReadStream","join","server","routes","path","config","admin","handler","serveStatic","maxage","defer","index","setHeaders","res","ext","extname","setHeader","auth","filesDir","koaStaticOptions","serve","koaStatic","prev","newPath","basename"],"mappings":";;;;;;;;;;;;;AAMA,MAAMA,uBAAAA,GAA0B,CAAC,EAAEC,MAAM,EAA2B,GAAA;IAClE,IAAIC,QAAAA,GAAWC,aAAQF,MAAAA,CAAOG,IAAI,CAACC,IAAI,CAACC,IAAI,EAAE,OAAA,CAAA;AAE9C,IAAA,IAAI,CAACC,oBAAAA,CAAIC,cAAc,CAACN,QAAAA,CAAAA,EAAW;AACjCA,QAAAA,QAAAA,GAAWC,aAAQM,SAAAA,EAAW,aAAA,CAAA;AAChC,IAAA;IAEA,MAAMC,oBAAAA,GAAuB,OAAOC,GAAAA,EAAcC,IAAAA,GAAAA;QAChD,MAAMA,IAAAA,EAAAA;AAEN,QAAA,IAAID,IAAIE,MAAM,KAAK,UAAUF,GAAAA,CAAIE,MAAM,KAAK,KAAA,EAAO;AACjD,YAAA;AACF,QAAA;AAEA,QAAA,IAAIF,IAAIG,IAAI,IAAI,QAAQH,GAAAA,CAAII,MAAM,KAAK,GAAA,EAAK;AAC1C,YAAA;AACF,QAAA;AAEAJ,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAA;AACXL,QAAAA,GAAAA,CAAIG,IAAI,GAAGP,oBAAAA,CAAIU,gBAAgB,CAACC,UAAKhB,QAAAA,EAAU,YAAA,CAAA,CAAA;AACjD,IAAA,CAAA;IAEAD,MAAAA,CAAOkB,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEP,MAAAA,EAAQ,KAAA;YACRQ,IAAAA,EAAM,CAAA,EAAGpB,OAAOqB,MAAM,CAACC,KAAK,CAACF,IAAI,CAAC,OAAO,CAAC;YAC1CG,OAAAA,EAAS;AACPd,gBAAAA,oBAAAA;AACAe,gBAAAA,WAAAA,CAAYvB,QAAAA,EAAU;oBACpBwB,MAAAA,EAAQ,QAAA;oBACRC,KAAAA,EAAO,KAAA;oBACPC,KAAAA,EAAO,YAAA;oBACPC,UAAAA,CAAAA,CAAWC,GAAQ,EAAET,MAAS,EAAA;AAC5B,wBAAA,MAAMU,MAAMC,YAAAA,CAAQX,MAAAA,CAAAA;;AAEpB,wBAAA,IAAIU,QAAQ,OAAA,EAAS;4BACnBD,GAAAA,CAAIG,SAAS,CAAC,eAAA,EAAiB,qCAAA,CAAA;AACjC,wBAAA;AACF,oBAAA;AACF,iBAAA;AACD,aAAA;YACDX,MAAAA,EAAQ;gBAAEY,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;AAEA;MACaT,WAAAA,GAAc,CAACU,QAAAA,EAAeC,gBAAAA,GAAmB,EAAE,GAAA;IAC9D,MAAMC,KAAAA,GAAQC,2BAAUH,QAAAA,EAAUC,gBAAAA,CAAAA;AAElC,IAAA,OAAO,OAAOzB,GAAAA,EAAcC,IAAAA,GAAAA;AAC1B,QAAA,IAAI,CAACoB,YAAAA,CAAQrB,GAAAA,CAAIU,IAAI,CAAA,EAAG;YACtB,MAAMT,IAAAA,EAAAA;AACN,YAAA;AACF,QAAA;QAEA,MAAM2B,IAAAA,GAAO5B,IAAIU,IAAI;AACrB,QAAA,MAAMmB,UAAU,CAAC,CAAC,EAAEC,aAAAA,CAAS9B,GAAAA,CAAIU,IAAI,CAAA,CAAA,CAAG;AAExCV,QAAAA,GAAAA,CAAIU,IAAI,GAAGmB,OAAAA;AACX,QAAA,MAAMH,MAAM1B,GAAAA,EAAK,UAAA;AACfA,YAAAA,GAAAA,CAAIU,IAAI,GAAGkB,IAAAA;YACX,MAAM3B,IAAAA,EAAAA;AACND,YAAAA,GAAAA,CAAIU,IAAI,GAAGmB,OAAAA;AACb,QAAA,CAAA,CAAA;AACA7B,QAAAA,GAAAA,CAAIU,IAAI,GAAGkB,IAAAA;AACb,IAAA,CAAA;AACF;;;;;"}
+{"version":3,"file":"serve-admin-panel.js","sources":["../../../../../server/src/routes/serve-admin-panel.ts"],"sourcesContent":["import type { ServerResponse } from 'http';\nimport type { Context, Next } from 'koa';\nimport { resolve, join, extname, basename } from 'path';\nimport fse from 'fs-extra';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\nconst ADMIN_SHELL_CACHE_CONTROL = 'no-cache';\nconst ADMIN_SHELL_SURROGATE_CONTROL = 'no-store';\nconst HASHED_ASSET_CACHE_CONTROL = 'public, max-age=31536000, immutable';\n\nconst applyAdminShellCacheHeaders = (setHeader: (name: string, value: string) => void) => {\n  setHeader('Cache-Control', ADMIN_SHELL_CACHE_CONTROL);\n  setHeader('Surrogate-Control', ADMIN_SHELL_SURROGATE_CONTROL);\n};\n\nconst registerAdminPanelRoute = ({ strapi }: { strapi: Core.Strapi }) => {\n  let buildDir = resolve(strapi.dirs.dist.root, 'build');\n\n  if (!fse.pathExistsSync(buildDir)) {\n    buildDir = resolve(__dirname, '../../build');\n  }\n\n  const serveAdminMiddleware = async (ctx: Context, next: Next) => {\n    await next();\n\n    if (ctx.method !== 'HEAD' && ctx.method !== 'GET') {\n      return;\n    }\n\n    if (ctx.body != null || ctx.status !== 404) {\n      return;\n    }\n\n    applyAdminShellCacheHeaders((name, value) => {\n      ctx.set(name, value);\n    });\n    ctx.type = 'html';\n    ctx.body = fse.createReadStream(join(buildDir, 'index.html'));\n  };\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: `${strapi.config.admin.path}/:path*`,\n      handler: [\n        serveAdminMiddleware,\n        serveStatic(buildDir, {\n          maxage: 0,\n          defer: false,\n          index: 'index.html',\n          setHeaders(res: ServerResponse, path: string) {\n            const ext = extname(path);\n            if (ext === '.html') {\n              applyAdminShellCacheHeaders((name, value) => {\n                res.setHeader(name, value);\n              });\n              return;\n            }\n\n            res.setHeader('Cache-Control', HASHED_ASSET_CACHE_CONTROL);\n          },\n        }),\n      ],\n      config: { auth: false },\n    },\n  ]);\n};\n\n// serveStatic is not supposed to be used to serve a folder that have sub-folders\nexport const serveStatic = (filesDir: any, koaStaticOptions = {}) => {\n  const serve = koaStatic(filesDir, koaStaticOptions);\n\n  return async (ctx: Context, next: Next) => {\n    if (!extname(ctx.path)) {\n      await next();\n      return;\n    }\n\n    const prev = ctx.path;\n    const newPath = `/${basename(ctx.path)}`;\n\n    ctx.path = newPath;\n    await serve(ctx, async () => {\n      ctx.path = prev;\n      await next();\n      ctx.path = newPath;\n    });\n    ctx.path = prev;\n  };\n};\n\nexport default registerAdminPanelRoute;\n"],"names":["ADMIN_SHELL_CACHE_CONTROL","ADMIN_SHELL_SURROGATE_CONTROL","HASHED_ASSET_CACHE_CONTROL","applyAdminShellCacheHeaders","setHeader","registerAdminPanelRoute","strapi","buildDir","resolve","dirs","dist","root","fse","pathExistsSync","__dirname","serveAdminMiddleware","ctx","next","method","body","status","name","value","set","type","createReadStream","join","server","routes","path","config","admin","handler","serveStatic","maxage","defer","index","setHeaders","res","ext","extname","auth","filesDir","koaStaticOptions","serve","koaStatic","prev","newPath","basename"],"mappings":";;;;;;;;;;;;;AAOA,MAAMA,yBAAAA,GAA4B,UAAA;AAClC,MAAMC,6BAAAA,GAAgC,UAAA;AACtC,MAAMC,0BAAAA,GAA6B,qCAAA;AAEnC,MAAMC,8BAA8B,CAACC,SAAAA,GAAAA;AACnCA,IAAAA,SAAAA,CAAU,eAAA,EAAiBJ,yBAAAA,CAAAA;AAC3BI,IAAAA,SAAAA,CAAU,mBAAA,EAAqBH,6BAAAA,CAAAA;AACjC,CAAA;AAEA,MAAMI,uBAAAA,GAA0B,CAAC,EAAEC,MAAM,EAA2B,GAAA;IAClE,IAAIC,QAAAA,GAAWC,aAAQF,MAAAA,CAAOG,IAAI,CAACC,IAAI,CAACC,IAAI,EAAE,OAAA,CAAA;AAE9C,IAAA,IAAI,CAACC,oBAAAA,CAAIC,cAAc,CAACN,QAAAA,CAAAA,EAAW;AACjCA,QAAAA,QAAAA,GAAWC,aAAQM,SAAAA,EAAW,aAAA,CAAA;AAChC,IAAA;IAEA,MAAMC,oBAAAA,GAAuB,OAAOC,GAAAA,EAAcC,IAAAA,GAAAA;QAChD,MAAMA,IAAAA,EAAAA;AAEN,QAAA,IAAID,IAAIE,MAAM,KAAK,UAAUF,GAAAA,CAAIE,MAAM,KAAK,KAAA,EAAO;AACjD,YAAA;AACF,QAAA;AAEA,QAAA,IAAIF,IAAIG,IAAI,IAAI,QAAQH,GAAAA,CAAII,MAAM,KAAK,GAAA,EAAK;AAC1C,YAAA;AACF,QAAA;AAEAjB,QAAAA,2BAAAA,CAA4B,CAACkB,IAAAA,EAAMC,KAAAA,GAAAA;YACjCN,GAAAA,CAAIO,GAAG,CAACF,IAAAA,EAAMC,KAAAA,CAAAA;AAChB,QAAA,CAAA,CAAA;AACAN,QAAAA,GAAAA,CAAIQ,IAAI,GAAG,MAAA;AACXR,QAAAA,GAAAA,CAAIG,IAAI,GAAGP,oBAAAA,CAAIa,gBAAgB,CAACC,UAAKnB,QAAAA,EAAU,YAAA,CAAA,CAAA;AACjD,IAAA,CAAA;IAEAD,MAAAA,CAAOqB,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEV,MAAAA,EAAQ,KAAA;YACRW,IAAAA,EAAM,CAAA,EAAGvB,OAAOwB,MAAM,CAACC,KAAK,CAACF,IAAI,CAAC,OAAO,CAAC;YAC1CG,OAAAA,EAAS;AACPjB,gBAAAA,oBAAAA;AACAkB,gBAAAA,WAAAA,CAAY1B,QAAAA,EAAU;oBACpB2B,MAAAA,EAAQ,CAAA;oBACRC,KAAAA,EAAO,KAAA;oBACPC,KAAAA,EAAO,YAAA;oBACPC,UAAAA,CAAAA,CAAWC,GAAmB,EAAET,MAAY,EAAA;AAC1C,wBAAA,MAAMU,MAAMC,YAAAA,CAAQX,MAAAA,CAAAA;AACpB,wBAAA,IAAIU,QAAQ,OAAA,EAAS;AACnBpC,4BAAAA,2BAAAA,CAA4B,CAACkB,IAAAA,EAAMC,KAAAA,GAAAA;gCACjCgB,GAAAA,CAAIlC,SAAS,CAACiB,IAAAA,EAAMC,KAAAA,CAAAA;AACtB,4BAAA,CAAA,CAAA;AACA,4BAAA;AACF,wBAAA;wBAEAgB,GAAAA,CAAIlC,SAAS,CAAC,eAAA,EAAiBF,0BAAAA,CAAAA;AACjC,oBAAA;AACF,iBAAA;AACD,aAAA;YACD4B,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;AAEA;MACaR,WAAAA,GAAc,CAACS,QAAAA,EAAeC,gBAAAA,GAAmB,EAAE,GAAA;IAC9D,MAAMC,KAAAA,GAAQC,2BAAUH,QAAAA,EAAUC,gBAAAA,CAAAA;AAElC,IAAA,OAAO,OAAO3B,GAAAA,EAAcC,IAAAA,GAAAA;AAC1B,QAAA,IAAI,CAACuB,YAAAA,CAAQxB,GAAAA,CAAIa,IAAI,CAAA,EAAG;YACtB,MAAMZ,IAAAA,EAAAA;AACN,YAAA;AACF,QAAA;QAEA,MAAM6B,IAAAA,GAAO9B,IAAIa,IAAI;AACrB,QAAA,MAAMkB,UAAU,CAAC,CAAC,EAAEC,aAAAA,CAAShC,GAAAA,CAAIa,IAAI,CAAA,CAAA,CAAG;AAExCb,QAAAA,GAAAA,CAAIa,IAAI,GAAGkB,OAAAA;AACX,QAAA,MAAMH,MAAM5B,GAAAA,EAAK,UAAA;AACfA,YAAAA,GAAAA,CAAIa,IAAI,GAAGiB,IAAAA;YACX,MAAM7B,IAAAA,EAAAA;AACND,YAAAA,GAAAA,CAAIa,IAAI,GAAGkB,OAAAA;AACb,QAAA,CAAA,CAAA;AACA/B,QAAAA,GAAAA,CAAIa,IAAI,GAAGiB,IAAAA;AACb,IAAA,CAAA;AACF;;;;;"}

package/dist/server/server/src/routes/serve-admin-panel.mjs

@@ -2,6 +2,13 @@ import { resolve, join, extname, basename } from 'path';
 import fse from 'fs-extra';
 import koaStatic from 'koa-static';
 
+const ADMIN_SHELL_CACHE_CONTROL = 'no-cache';
+const ADMIN_SHELL_SURROGATE_CONTROL = 'no-store';
+const HASHED_ASSET_CACHE_CONTROL = 'public, max-age=31536000, immutable';
+const applyAdminShellCacheHeaders = (setHeader)=>{
+    setHeader('Cache-Control', ADMIN_SHELL_CACHE_CONTROL);
+    setHeader('Surrogate-Control', ADMIN_SHELL_SURROGATE_CONTROL);
+};
 const registerAdminPanelRoute = ({ strapi })=>{
     let buildDir = resolve(strapi.dirs.dist.root, 'build');
     if (!fse.pathExistsSync(buildDir)) {
@@ -15,6 +22,9 @@ const registerAdminPanelRoute = ({ strapi })=>{
         if (ctx.body != null || ctx.status !== 404) {
             return;
         }
+        applyAdminShellCacheHeaders((name, value)=>{
+            ctx.set(name, value);
+        });
         ctx.type = 'html';
         ctx.body = fse.createReadStream(join(buildDir, 'index.html'));
     };
@@ -25,15 +35,18 @@ const registerAdminPanelRoute = ({ strapi })=>{
             handler: [
                 serveAdminMiddleware,
                 serveStatic(buildDir, {
-                    maxage: 31536000,
+                    maxage: 0,
                     defer: false,
                     index: 'index.html',
                     setHeaders (res, path) {
                         const ext = extname(path);
-                        // publicly cache static files to avoid unnecessary network & disk access
-                        if (ext !== '.html') {
-                            res.setHeader('cache-control', 'public, max-age=31536000, immutable');
+                        if (ext === '.html') {
+                            applyAdminShellCacheHeaders((name, value)=>{
+                                res.setHeader(name, value);
+                            });
+                            return;
                         }
+                        res.setHeader('Cache-Control', HASHED_ASSET_CACHE_CONTROL);
                     }
                 })
             ],

package/dist/server/server/src/routes/serve-admin-panel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve-admin-panel.mjs","sources":["../../../../../server/src/routes/serve-admin-panel.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport { resolve, join, extname, basename } from 'path';\nimport fse from 'fs-extra';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\nconst registerAdminPanelRoute = ({ strapi }: { strapi: Core.Strapi }) => {\n  let buildDir = resolve(strapi.dirs.dist.root, 'build');\n\n  if (!fse.pathExistsSync(buildDir)) {\n    buildDir = resolve(__dirname, '../../build');\n  }\n\n  const serveAdminMiddleware = async (ctx: Context, next: Next) => {\n    await next();\n\n    if (ctx.method !== 'HEAD' && ctx.method !== 'GET') {\n      return;\n    }\n\n    if (ctx.body != null || ctx.status !== 404) {\n      return;\n    }\n\n    ctx.type = 'html';\n    ctx.body = fse.createReadStream(join(buildDir, 'index.html'));\n  };\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: `${strapi.config.admin.path}/:path*`,\n      handler: [\n        serveAdminMiddleware,\n        serveStatic(buildDir, {\n          maxage: 31536000,\n          defer: false,\n          index: 'index.html',\n          setHeaders(res: any, path: any) {\n            const ext = extname(path);\n            // publicly cache static files to avoid unnecessary network & disk access\n            if (ext !== '.html') {\n              res.setHeader('cache-control', 'public, max-age=31536000, immutable');\n            }\n          },\n        }),\n      ],\n      config: { auth: false },\n    },\n  ]);\n};\n\n// serveStatic is not supposed to be used to serve a folder that have sub-folders\nexport const serveStatic = (filesDir: any, koaStaticOptions = {}) => {\n  const serve = koaStatic(filesDir, koaStaticOptions);\n\n  return async (ctx: Context, next: Next) => {\n    if (!extname(ctx.path)) {\n      await next();\n      return;\n    }\n\n    const prev = ctx.path;\n    const newPath = `/${basename(ctx.path)}`;\n\n    ctx.path = newPath;\n    await serve(ctx, async () => {\n      ctx.path = prev;\n      await next();\n      ctx.path = newPath;\n    });\n    ctx.path = prev;\n  };\n};\n\nexport default registerAdminPanelRoute;\n"],"names":["registerAdminPanelRoute","strapi","buildDir","resolve","dirs","dist","root","fse","pathExistsSync","__dirname","serveAdminMiddleware","ctx","next","method","body","status","type","createReadStream","join","server","routes","path","config","admin","handler","serveStatic","maxage","defer","index","setHeaders","res","ext","extname","setHeader","auth","filesDir","koaStaticOptions","serve","koaStatic","prev","newPath","basename"],"mappings":";;;;AAMA,MAAMA,uBAAAA,GAA0B,CAAC,EAAEC,MAAM,EAA2B,GAAA;IAClE,IAAIC,QAAAA,GAAWC,QAAQF,MAAAA,CAAOG,IAAI,CAACC,IAAI,CAACC,IAAI,EAAE,OAAA,CAAA;AAE9C,IAAA,IAAI,CAACC,GAAAA,CAAIC,cAAc,CAACN,QAAAA,CAAAA,EAAW;AACjCA,QAAAA,QAAAA,GAAWC,QAAQM,SAAAA,EAAW,aAAA,CAAA;AAChC,IAAA;IAEA,MAAMC,oBAAAA,GAAuB,OAAOC,GAAAA,EAAcC,IAAAA,GAAAA;QAChD,MAAMA,IAAAA,EAAAA;AAEN,QAAA,IAAID,IAAIE,MAAM,KAAK,UAAUF,GAAAA,CAAIE,MAAM,KAAK,KAAA,EAAO;AACjD,YAAA;AACF,QAAA;AAEA,QAAA,IAAIF,IAAIG,IAAI,IAAI,QAAQH,GAAAA,CAAII,MAAM,KAAK,GAAA,EAAK;AAC1C,YAAA;AACF,QAAA;AAEAJ,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAA;AACXL,QAAAA,GAAAA,CAAIG,IAAI,GAAGP,GAAAA,CAAIU,gBAAgB,CAACC,KAAKhB,QAAAA,EAAU,YAAA,CAAA,CAAA;AACjD,IAAA,CAAA;IAEAD,MAAAA,CAAOkB,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEP,MAAAA,EAAQ,KAAA;YACRQ,IAAAA,EAAM,CAAA,EAAGpB,OAAOqB,MAAM,CAACC,KAAK,CAACF,IAAI,CAAC,OAAO,CAAC;YAC1CG,OAAAA,EAAS;AACPd,gBAAAA,oBAAAA;AACAe,gBAAAA,WAAAA,CAAYvB,QAAAA,EAAU;oBACpBwB,MAAAA,EAAQ,QAAA;oBACRC,KAAAA,EAAO,KAAA;oBACPC,KAAAA,EAAO,YAAA;oBACPC,UAAAA,CAAAA,CAAWC,GAAQ,EAAET,IAAS,EAAA;AAC5B,wBAAA,MAAMU,MAAMC,OAAAA,CAAQX,IAAAA,CAAAA;;AAEpB,wBAAA,IAAIU,QAAQ,OAAA,EAAS;4BACnBD,GAAAA,CAAIG,SAAS,CAAC,eAAA,EAAiB,qCAAA,CAAA;AACjC,wBAAA;AACF,oBAAA;AACF,iBAAA;AACD,aAAA;YACDX,MAAAA,EAAQ;gBAAEY,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;AAEA;MACaT,WAAAA,GAAc,CAACU,QAAAA,EAAeC,gBAAAA,GAAmB,EAAE,GAAA;IAC9D,MAAMC,KAAAA,GAAQC,UAAUH,QAAAA,EAAUC,gBAAAA,CAAAA;AAElC,IAAA,OAAO,OAAOzB,GAAAA,EAAcC,IAAAA,GAAAA;AAC1B,QAAA,IAAI,CAACoB,OAAAA,CAAQrB,GAAAA,CAAIU,IAAI,CAAA,EAAG;YACtB,MAAMT,IAAAA,EAAAA;AACN,YAAA;AACF,QAAA;QAEA,MAAM2B,IAAAA,GAAO5B,IAAIU,IAAI;AACrB,QAAA,MAAMmB,UAAU,CAAC,CAAC,EAAEC,QAAAA,CAAS9B,GAAAA,CAAIU,IAAI,CAAA,CAAA,CAAG;AAExCV,QAAAA,GAAAA,CAAIU,IAAI,GAAGmB,OAAAA;AACX,QAAA,MAAMH,MAAM1B,GAAAA,EAAK,UAAA;AACfA,YAAAA,GAAAA,CAAIU,IAAI,GAAGkB,IAAAA;YACX,MAAM3B,IAAAA,EAAAA;AACND,YAAAA,GAAAA,CAAIU,IAAI,GAAGmB,OAAAA;AACb,QAAA,CAAA,CAAA;AACA7B,QAAAA,GAAAA,CAAIU,IAAI,GAAGkB,IAAAA;AACb,IAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"serve-admin-panel.mjs","sources":["../../../../../server/src/routes/serve-admin-panel.ts"],"sourcesContent":["import type { ServerResponse } from 'http';\nimport type { Context, Next } from 'koa';\nimport { resolve, join, extname, basename } from 'path';\nimport fse from 'fs-extra';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\nconst ADMIN_SHELL_CACHE_CONTROL = 'no-cache';\nconst ADMIN_SHELL_SURROGATE_CONTROL = 'no-store';\nconst HASHED_ASSET_CACHE_CONTROL = 'public, max-age=31536000, immutable';\n\nconst applyAdminShellCacheHeaders = (setHeader: (name: string, value: string) => void) => {\n  setHeader('Cache-Control', ADMIN_SHELL_CACHE_CONTROL);\n  setHeader('Surrogate-Control', ADMIN_SHELL_SURROGATE_CONTROL);\n};\n\nconst registerAdminPanelRoute = ({ strapi }: { strapi: Core.Strapi }) => {\n  let buildDir = resolve(strapi.dirs.dist.root, 'build');\n\n  if (!fse.pathExistsSync(buildDir)) {\n    buildDir = resolve(__dirname, '../../build');\n  }\n\n  const serveAdminMiddleware = async (ctx: Context, next: Next) => {\n    await next();\n\n    if (ctx.method !== 'HEAD' && ctx.method !== 'GET') {\n      return;\n    }\n\n    if (ctx.body != null || ctx.status !== 404) {\n      return;\n    }\n\n    applyAdminShellCacheHeaders((name, value) => {\n      ctx.set(name, value);\n    });\n    ctx.type = 'html';\n    ctx.body = fse.createReadStream(join(buildDir, 'index.html'));\n  };\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: `${strapi.config.admin.path}/:path*`,\n      handler: [\n        serveAdminMiddleware,\n        serveStatic(buildDir, {\n          maxage: 0,\n          defer: false,\n          index: 'index.html',\n          setHeaders(res: ServerResponse, path: string) {\n            const ext = extname(path);\n            if (ext === '.html') {\n              applyAdminShellCacheHeaders((name, value) => {\n                res.setHeader(name, value);\n              });\n              return;\n            }\n\n            res.setHeader('Cache-Control', HASHED_ASSET_CACHE_CONTROL);\n          },\n        }),\n      ],\n      config: { auth: false },\n    },\n  ]);\n};\n\n// serveStatic is not supposed to be used to serve a folder that have sub-folders\nexport const serveStatic = (filesDir: any, koaStaticOptions = {}) => {\n  const serve = koaStatic(filesDir, koaStaticOptions);\n\n  return async (ctx: Context, next: Next) => {\n    if (!extname(ctx.path)) {\n      await next();\n      return;\n    }\n\n    const prev = ctx.path;\n    const newPath = `/${basename(ctx.path)}`;\n\n    ctx.path = newPath;\n    await serve(ctx, async () => {\n      ctx.path = prev;\n      await next();\n      ctx.path = newPath;\n    });\n    ctx.path = prev;\n  };\n};\n\nexport default registerAdminPanelRoute;\n"],"names":["ADMIN_SHELL_CACHE_CONTROL","ADMIN_SHELL_SURROGATE_CONTROL","HASHED_ASSET_CACHE_CONTROL","applyAdminShellCacheHeaders","setHeader","registerAdminPanelRoute","strapi","buildDir","resolve","dirs","dist","root","fse","pathExistsSync","__dirname","serveAdminMiddleware","ctx","next","method","body","status","name","value","set","type","createReadStream","join","server","routes","path","config","admin","handler","serveStatic","maxage","defer","index","setHeaders","res","ext","extname","auth","filesDir","koaStaticOptions","serve","koaStatic","prev","newPath","basename"],"mappings":";;;;AAOA,MAAMA,yBAAAA,GAA4B,UAAA;AAClC,MAAMC,6BAAAA,GAAgC,UAAA;AACtC,MAAMC,0BAAAA,GAA6B,qCAAA;AAEnC,MAAMC,8BAA8B,CAACC,SAAAA,GAAAA;AACnCA,IAAAA,SAAAA,CAAU,eAAA,EAAiBJ,yBAAAA,CAAAA;AAC3BI,IAAAA,SAAAA,CAAU,mBAAA,EAAqBH,6BAAAA,CAAAA;AACjC,CAAA;AAEA,MAAMI,uBAAAA,GAA0B,CAAC,EAAEC,MAAM,EAA2B,GAAA;IAClE,IAAIC,QAAAA,GAAWC,QAAQF,MAAAA,CAAOG,IAAI,CAACC,IAAI,CAACC,IAAI,EAAE,OAAA,CAAA;AAE9C,IAAA,IAAI,CAACC,GAAAA,CAAIC,cAAc,CAACN,QAAAA,CAAAA,EAAW;AACjCA,QAAAA,QAAAA,GAAWC,QAAQM,SAAAA,EAAW,aAAA,CAAA;AAChC,IAAA;IAEA,MAAMC,oBAAAA,GAAuB,OAAOC,GAAAA,EAAcC,IAAAA,GAAAA;QAChD,MAAMA,IAAAA,EAAAA;AAEN,QAAA,IAAID,IAAIE,MAAM,KAAK,UAAUF,GAAAA,CAAIE,MAAM,KAAK,KAAA,EAAO;AACjD,YAAA;AACF,QAAA;AAEA,QAAA,IAAIF,IAAIG,IAAI,IAAI,QAAQH,GAAAA,CAAII,MAAM,KAAK,GAAA,EAAK;AAC1C,YAAA;AACF,QAAA;AAEAjB,QAAAA,2BAAAA,CAA4B,CAACkB,IAAAA,EAAMC,KAAAA,GAAAA;YACjCN,GAAAA,CAAIO,GAAG,CAACF,IAAAA,EAAMC,KAAAA,CAAAA;AAChB,QAAA,CAAA,CAAA;AACAN,QAAAA,GAAAA,CAAIQ,IAAI,GAAG,MAAA;AACXR,QAAAA,GAAAA,CAAIG,IAAI,GAAGP,GAAAA,CAAIa,gBAAgB,CAACC,KAAKnB,QAAAA,EAAU,YAAA,CAAA,CAAA;AACjD,IAAA,CAAA;IAEAD,MAAAA,CAAOqB,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEV,MAAAA,EAAQ,KAAA;YACRW,IAAAA,EAAM,CAAA,EAAGvB,OAAOwB,MAAM,CAACC,KAAK,CAACF,IAAI,CAAC,OAAO,CAAC;YAC1CG,OAAAA,EAAS;AACPjB,gBAAAA,oBAAAA;AACAkB,gBAAAA,WAAAA,CAAY1B,QAAAA,EAAU;oBACpB2B,MAAAA,EAAQ,CAAA;oBACRC,KAAAA,EAAO,KAAA;oBACPC,KAAAA,EAAO,YAAA;oBACPC,UAAAA,CAAAA,CAAWC,GAAmB,EAAET,IAAY,EAAA;AAC1C,wBAAA,MAAMU,MAAMC,OAAAA,CAAQX,IAAAA,CAAAA;AACpB,wBAAA,IAAIU,QAAQ,OAAA,EAAS;AACnBpC,4BAAAA,2BAAAA,CAA4B,CAACkB,IAAAA,EAAMC,KAAAA,GAAAA;gCACjCgB,GAAAA,CAAIlC,SAAS,CAACiB,IAAAA,EAAMC,KAAAA,CAAAA;AACtB,4BAAA,CAAA,CAAA;AACA,4BAAA;AACF,wBAAA;wBAEAgB,GAAAA,CAAIlC,SAAS,CAAC,eAAA,EAAiBF,0BAAAA,CAAAA;AACjC,oBAAA;AACF,iBAAA;AACD,aAAA;YACD4B,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;AAEA;MACaR,WAAAA,GAAc,CAACS,QAAAA,EAAeC,gBAAAA,GAAmB,EAAE,GAAA;IAC9D,MAAMC,KAAAA,GAAQC,UAAUH,QAAAA,EAAUC,gBAAAA,CAAAA;AAElC,IAAA,OAAO,OAAO3B,GAAAA,EAAcC,IAAAA,GAAAA;AAC1B,QAAA,IAAI,CAACuB,OAAAA,CAAQxB,GAAAA,CAAIa,IAAI,CAAA,EAAG;YACtB,MAAMZ,IAAAA,EAAAA;AACN,YAAA;AACF,QAAA;QAEA,MAAM6B,IAAAA,GAAO9B,IAAIa,IAAI;AACrB,QAAA,MAAMkB,UAAU,CAAC,CAAC,EAAEC,QAAAA,CAAShC,GAAAA,CAAIa,IAAI,CAAA,CAAA,CAAG;AAExCb,QAAAA,GAAAA,CAAIa,IAAI,GAAGkB,OAAAA;AACX,QAAA,MAAMH,MAAM5B,GAAAA,EAAK,UAAA;AACfA,YAAAA,GAAAA,CAAIa,IAAI,GAAGiB,IAAAA;YACX,MAAM7B,IAAAA,EAAAA;AACND,YAAAA,GAAAA,CAAIa,IAAI,GAAGkB,OAAAA;AACb,QAAA,CAAA,CAAA;AACA/B,QAAAA,GAAAA,CAAIa,IAAI,GAAGiB,IAAAA;AACb,IAAA,CAAA;AACF;;;;"}

package/dist/server/server/src/services/auth.js

@@ -1,9 +1,12 @@
 'use strict';
 
+Object.defineProperty(exports, '__esModule', { value: true });
+
 var bcrypt = require('bcryptjs');
 var _ = require('lodash');
 var utils = require('@strapi/utils');
 var index = require('../utils/index.js');
+var token = require('./token.js');
 require('@strapi/types');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -12,6 +15,46 @@ var bcrypt__default = /*#__PURE__*/_interopDefault(bcrypt);
 var ___default = /*#__PURE__*/_interopDefault(_);
 
 const { ApplicationError } = utils.errors;
+// Default lifetime of an admin reset-password token. Overridable via
+// `admin.forgotPassword.expiresIn` (number of seconds or a shorthand like '15m', '1h').
+const DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN = '1h';
+/**
+ * Resolve the reset-password token lifetime, in milliseconds, from config.
+ * Falls back to {@link DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN} for unset/invalid values.
+ */ const getResetPasswordTokenTTL = ()=>{
+    const configured = strapi.config.get('admin.forgotPassword.expiresIn', DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN);
+    const seconds = token.expiresInToSeconds(configured) ?? token.expiresInToSeconds(DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN);
+    return seconds * 1000;
+};
+/**
+ * Create a reset-password token with an expiry and persist it on the user.
+ * Shared by the CE and EE auth services so the expiry behaviour can't drift.
+ * @returns the generated reset-password token
+ */ const assignResetPasswordToken = async (userId)=>{
+    const resetPasswordToken = index.getService('token').createToken();
+    const resetPasswordTokenExpiresAt = new Date(Date.now() + getResetPasswordTokenTTL());
+    await index.getService('user').updateById(userId, {
+        resetPasswordToken,
+        resetPasswordTokenExpiresAt
+    });
+    return resetPasswordToken;
+};
+/**
+ * Reject a reset-password token that has expired — or that has no expiry at all
+ * (tokens issued before this was introduced) — clearing the stale token so it
+ * cannot be retried. Shared by the CE and EE auth services. (GH#25711)
+ */ const assertResetPasswordTokenIsValid = async (user)=>{
+    const { resetPasswordTokenExpiresAt } = user;
+    const isExpired = !resetPasswordTokenExpiresAt || new Date(resetPasswordTokenExpiresAt).getTime() <= Date.now();
+    if (isExpired) {
+        // Clear the stale token so it can no longer be retried.
+        await index.getService('user').updateById(user.id, {
+            resetPasswordToken: null,
+            resetPasswordTokenExpiresAt: null
+        });
+        throw new ApplicationError('This reset password token has expired');
+    }
+};
 /**
  * hashes a password
  * @param password - password to hash
@@ -79,10 +122,7 @@ const { ApplicationError } = utils.errors;
     if (!user) {
         return;
     }
-    const resetPasswordToken = index.getService('token').createToken();
-    await index.getService('user').updateById(user.id, {
-        resetPasswordToken
-    });
+    const resetPasswordToken = await assignResetPasswordToken(user.id);
     // Send an email to the admin.
     const url = `${strapi.config.get('admin.absoluteUrl')}/auth/reset-password?code=${resetPasswordToken}`;
     return strapi.plugin('email').service('email').sendTemplatedEmail({
@@ -116,9 +156,11 @@ const { ApplicationError } = utils.errors;
     if (!matchingUser) {
         throw new ApplicationError();
     }
+    await assertResetPasswordTokenIsValid(matchingUser);
     return index.getService('user').updateById(matchingUser.id, {
         password,
-        resetPasswordToken: null
+        resetPasswordToken: null,
+        resetPasswordTokenExpiresAt: null
     });
 };
 var auth = {
@@ -129,5 +171,8 @@ var auth = {
     resetPassword
 };
 
-module.exports = auth;
+exports.assertResetPasswordTokenIsValid = assertResetPasswordTokenIsValid;
+exports.assignResetPasswordToken = assignResetPasswordToken;
+exports.default = auth;
+exports.getResetPasswordTokenTTL = getResetPasswordTokenTTL;
 //# sourceMappingURL=auth.js.map

package/dist/server/server/src/services/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sources":["../../../../../server/src/services/auth.ts"],"sourcesContent":["import bcrypt from 'bcryptjs';\nimport _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport type { AdminUser } from '../../../shared/contracts/shared';\nimport '@strapi/types';\n\nconst { ApplicationError } = errors;\n\n/**\n * hashes a password\n * @param password - password to hash\n * @returns hashed password\n */\nconst hashPassword = (password: string) => bcrypt.hash(password, 10);\n\n/**\n * Validate a password\n * @param password\n * @param hash\n * @returns {Promise<boolean>} is the password valid\n */\nconst validatePassword = (password: string, hash: string) => bcrypt.compare(password, hash);\n\n/**\n * Check login credentials\n * @param email the users email address\n * @param password the users password\n */\nconst checkCredentials = async ({ email, password }: { email: string; password: string }) => {\n  const user: AdminUser = await strapi.db.query('admin::user').findOne({ where: { email } });\n\n  if (!user || !user.password) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  const isValid = await validatePassword(password, user.password);\n\n  if (!isValid) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  if (!(user.isActive === true)) {\n    return [null, false, { message: 'User not active' }];\n  }\n\n  return [null, user];\n};\n\n/**\n * Send an email to the user if it exists or do nothing\n * @param email user email for which to reset the password\n */\nconst forgotPassword = async ({ email } = {} as { email: string }) => {\n  const user: AdminUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email, isActive: true } });\n  if (!user) {\n    return;\n  }\n\n  const resetPasswordToken = getService('token').createToken();\n  await getService('user').updateById(user.id, { resetPasswordToken });\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param resetPasswordToken token generated to request a password reset\n * @param password new user password\n */\nconst resetPassword = async (\n  { resetPasswordToken, password } = {} as { resetPasswordToken: string; password: string }\n) => {\n  const matchingUser: AdminUser | undefined = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser) {\n    throw new ApplicationError();\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n  });\n};\n\nexport default { checkCredentials, validatePassword, hashPassword, forgotPassword, resetPassword };\n"],"names":["ApplicationError","errors","hashPassword","password","bcrypt","hash","validatePassword","compare","checkCredentials","email","user","strapi","db","query","findOne","where","message","isValid","isActive","forgotPassword","resetPasswordToken","getService","createToken","updateById","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","matchingUser"],"mappings":";;;;;;;;;;;;;AAOA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAE7B;;;;AAIC,IACD,MAAMC,YAAAA,GAAe,CAACC,WAAqBC,uBAAAA,CAAOC,IAAI,CAACF,QAAAA,EAAU,EAAA,CAAA;AAEjE;;;;;IAMA,MAAMG,mBAAmB,CAACH,QAAAA,EAAkBE,OAAiBD,uBAAAA,CAAOG,OAAO,CAACJ,QAAAA,EAAUE,IAAAA,CAAAA;AAEtF;;;;AAIC,IACD,MAAMG,gBAAAA,GAAmB,OAAO,EAAEC,KAAK,EAAEN,QAAQ,EAAuC,GAAA;IACtF,MAAMO,IAAAA,GAAkB,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA;AAAM;AAAE,KAAA,CAAA;AAExF,IAAA,IAAI,CAACC,IAAAA,IAAQ,CAACA,IAAAA,CAAKP,QAAQ,EAAE;QAC3B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEa,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,MAAMC,OAAAA,GAAU,MAAMX,gBAAAA,CAAiBH,QAAAA,EAAUO,KAAKP,QAAQ,CAAA;AAE9D,IAAA,IAAI,CAACc,OAAAA,EAAS;QACZ,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAED,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,IAAI,EAAEN,IAAAA,CAAKQ,QAAQ,KAAK,IAAG,CAAA,EAAI;QAC7B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEF,OAAAA,EAAS;AAAkB;AAAE,SAAA;AACtD,IAAA;IAEA,OAAO;AAAC,QAAA,IAAA;AAAMN,QAAAA;AAAK,KAAA;AACrB,CAAA;AAEA;;;IAIA,MAAMS,iBAAiB,OAAO,EAAEV,KAAK,EAAE,GAAG,EAAuB,GAAA;IAC/D,MAAMC,IAAAA,GAAkB,MAAMC,MAAAA,CAAOC,EAAE,CACpCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOS,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC9C,IAAA,IAAI,CAACR,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;IAEA,MAAMU,kBAAAA,GAAqBC,gBAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMD,iBAAW,MAAA,CAAA,CAAQE,UAAU,CAACb,IAAAA,CAAKc,EAAE,EAAE;AAAEJ,QAAAA;AAAmB,KAAA,CAAA;;IAGlE,MAAMK,GAAAA,GAAM,CAAA,EAAGd,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEP,kBAAAA,CAAAA,CAAoB;IAElD,OAAOT,MAAAA,CACJiB,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIrB,KAAKD,KAAK;AACduB,QAAAA,IAAAA,EAAMrB,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAAStB,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAhB,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAf,IAAAA,EAAMwB,kBAAAA,CAAEC,IAAI,CAACzB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAED0B,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAEN1B,MAAAA,CAAO2B,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;IAKA,MAAMG,aAAAA,GAAgB,OACpB,EAAEpB,kBAAkB,EAAEjB,QAAQ,EAAE,GAAG,EAAsD,GAAA;IAEzF,MAAMsC,YAAAA,GAAsC,MAAM9B,MAAAA,CAAOC,EAAE,CACxDC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEK,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACuB,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAIzC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,OAAOqB,iBAAW,MAAA,CAAA,CAAQE,UAAU,CAACkB,YAAAA,CAAajB,EAAE,EAAE;AACpDrB,QAAAA,QAAAA;QACAiB,kBAAAA,EAAoB;AACtB,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AAAEZ,IAAAA,gBAAAA;AAAkBF,IAAAA,gBAAAA;AAAkBJ,IAAAA,YAAAA;AAAciB,IAAAA,cAAAA;AAAgBqB,IAAAA;AAAc,CAAA;;;;"}
+{"version":3,"file":"auth.js","sources":["../../../../../server/src/services/auth.ts"],"sourcesContent":["import bcrypt from 'bcryptjs';\nimport _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { expiresInToSeconds } from './token';\nimport type { AdminUser } from '../../../shared/contracts/shared';\nimport '@strapi/types';\n\nconst { ApplicationError } = errors;\n\n// Default lifetime of an admin reset-password token. Overridable via\n// `admin.forgotPassword.expiresIn` (number of seconds or a shorthand like '15m', '1h').\nconst DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN = '1h';\n\n/**\n * Resolve the reset-password token lifetime, in milliseconds, from config.\n * Falls back to {@link DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN} for unset/invalid values.\n */\nconst getResetPasswordTokenTTL = (): number => {\n  const configured = strapi.config.get(\n    'admin.forgotPassword.expiresIn',\n    DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN\n  );\n  const seconds =\n    expiresInToSeconds(configured) ??\n    (expiresInToSeconds(DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN) as number);\n  return seconds * 1000;\n};\n\n/**\n * Create a reset-password token with an expiry and persist it on the user.\n * Shared by the CE and EE auth services so the expiry behaviour can't drift.\n * @returns the generated reset-password token\n */\nconst assignResetPasswordToken = async (userId: AdminUser['id']): Promise<string> => {\n  const resetPasswordToken = getService('token').createToken();\n  const resetPasswordTokenExpiresAt = new Date(Date.now() + getResetPasswordTokenTTL());\n\n  await getService('user').updateById(userId, {\n    resetPasswordToken,\n    resetPasswordTokenExpiresAt,\n  });\n\n  return resetPasswordToken;\n};\n\n/**\n * Reject a reset-password token that has expired — or that has no expiry at all\n * (tokens issued before this was introduced) — clearing the stale token so it\n * cannot be retried. Shared by the CE and EE auth services. (GH#25711)\n */\nconst assertResetPasswordTokenIsValid = async (user: AdminUser): Promise<void> => {\n  const { resetPasswordTokenExpiresAt } = user;\n  const isExpired =\n    !resetPasswordTokenExpiresAt || new Date(resetPasswordTokenExpiresAt).getTime() <= Date.now();\n\n  if (isExpired) {\n    // Clear the stale token so it can no longer be retried.\n    await getService('user').updateById(user.id, {\n      resetPasswordToken: null,\n      resetPasswordTokenExpiresAt: null,\n    });\n    throw new ApplicationError('This reset password token has expired');\n  }\n};\n\n/**\n * hashes a password\n * @param password - password to hash\n * @returns hashed password\n */\nconst hashPassword = (password: string) => bcrypt.hash(password, 10);\n\n/**\n * Validate a password\n * @param password\n * @param hash\n * @returns {Promise<boolean>} is the password valid\n */\nconst validatePassword = (password: string, hash: string) => bcrypt.compare(password, hash);\n\n/**\n * Check login credentials\n * @param email the users email address\n * @param password the users password\n */\nconst checkCredentials = async ({ email, password }: { email: string; password: string }) => {\n  const user: AdminUser = await strapi.db.query('admin::user').findOne({ where: { email } });\n\n  if (!user || !user.password) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  const isValid = await validatePassword(password, user.password);\n\n  if (!isValid) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  if (!(user.isActive === true)) {\n    return [null, false, { message: 'User not active' }];\n  }\n\n  return [null, user];\n};\n\n/**\n * Send an email to the user if it exists or do nothing\n * @param email user email for which to reset the password\n */\nconst forgotPassword = async ({ email } = {} as { email: string }) => {\n  const user: AdminUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email, isActive: true } });\n  if (!user) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param resetPasswordToken token generated to request a password reset\n * @param password new user password\n */\nconst resetPassword = async (\n  { resetPasswordToken, password } = {} as { resetPasswordToken: string; password: string }\n) => {\n  const matchingUser: AdminUser | undefined = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n};\n\nexport default { checkCredentials, validatePassword, hashPassword, forgotPassword, resetPassword };\nexport { getResetPasswordTokenTTL, assignResetPasswordToken, assertResetPasswordTokenIsValid };\n"],"names":["ApplicationError","errors","DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN","getResetPasswordTokenTTL","configured","strapi","config","get","seconds","expiresInToSeconds","assignResetPasswordToken","userId","resetPasswordToken","getService","createToken","resetPasswordTokenExpiresAt","Date","now","updateById","assertResetPasswordTokenIsValid","user","isExpired","getTime","id","hashPassword","password","bcrypt","hash","validatePassword","compare","checkCredentials","email","db","query","findOne","where","message","isValid","isActive","forgotPassword","url","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","matchingUser"],"mappings":";;;;;;;;;;;;;;;;AAQA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAE7B;AACA;AACA,MAAMC,uCAAAA,GAA0C,IAAA;AAEhD;;;AAGC,UACKC,wBAAAA,GAA2B,IAAA;AAC/B,IAAA,MAAMC,aAAaC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAClC,gCAAA,EACAL,uCAAAA,CAAAA;IAEF,MAAMM,OAAAA,GACJC,wBAAAA,CAAmBL,UAAAA,CAAAA,IAClBK,wBAAAA,CAAmBP,uCAAAA,CAAAA;AACtB,IAAA,OAAOM,OAAAA,GAAU,IAAA;AACnB;AAEA;;;;IAKA,MAAME,2BAA2B,OAAOC,MAAAA,GAAAA;IACtC,MAAMC,kBAAAA,GAAqBC,gBAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMC,2BAAAA,GAA8B,IAAIC,IAAAA,CAAKA,IAAAA,CAAKC,GAAG,EAAA,GAAKd,wBAAAA,EAAAA,CAAAA;AAE1D,IAAA,MAAMU,gBAAAA,CAAW,MAAA,CAAA,CAAQK,UAAU,CAACP,MAAAA,EAAQ;AAC1CC,QAAAA,kBAAAA;AACAG,QAAAA;AACF,KAAA,CAAA;IAEA,OAAOH,kBAAAA;AACT;AAEA;;;;IAKA,MAAMO,kCAAkC,OAAOC,IAAAA,GAAAA;IAC7C,MAAM,EAAEL,2BAA2B,EAAE,GAAGK,IAAAA;IACxC,MAAMC,SAAAA,GACJ,CAACN,2BAAAA,IAA+B,IAAIC,KAAKD,2BAAAA,CAAAA,CAA6BO,OAAO,EAAA,IAAMN,IAAAA,CAAKC,GAAG,EAAA;AAE7F,IAAA,IAAII,SAAAA,EAAW;;AAEb,QAAA,MAAMR,iBAAW,MAAA,CAAA,CAAQK,UAAU,CAACE,IAAAA,CAAKG,EAAE,EAAE;YAC3CX,kBAAAA,EAAoB,IAAA;YACpBG,2BAAAA,EAA6B;AAC/B,SAAA,CAAA;AACA,QAAA,MAAM,IAAIf,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,IAAA;AACF;AAEA;;;;AAIC,IACD,MAAMwB,YAAAA,GAAe,CAACC,WAAqBC,uBAAAA,CAAOC,IAAI,CAACF,QAAAA,EAAU,EAAA,CAAA;AAEjE;;;;;IAMA,MAAMG,mBAAmB,CAACH,QAAAA,EAAkBE,OAAiBD,uBAAAA,CAAOG,OAAO,CAACJ,QAAAA,EAAUE,IAAAA,CAAAA;AAEtF;;;;AAIC,IACD,MAAMG,gBAAAA,GAAmB,OAAO,EAAEC,KAAK,EAAEN,QAAQ,EAAuC,GAAA;IACtF,MAAML,IAAAA,GAAkB,MAAMf,MAAAA,CAAO2B,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA;AAAM;AAAE,KAAA,CAAA;AAExF,IAAA,IAAI,CAACX,IAAAA,IAAQ,CAACA,IAAAA,CAAKK,QAAQ,EAAE;QAC3B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEW,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,MAAMC,OAAAA,GAAU,MAAMT,gBAAAA,CAAiBH,QAAAA,EAAUL,KAAKK,QAAQ,CAAA;AAE9D,IAAA,IAAI,CAACY,OAAAA,EAAS;QACZ,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAED,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,IAAI,EAAEhB,IAAAA,CAAKkB,QAAQ,KAAK,IAAG,CAAA,EAAI;QAC7B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEF,OAAAA,EAAS;AAAkB;AAAE,SAAA;AACtD,IAAA;IAEA,OAAO;AAAC,QAAA,IAAA;AAAMhB,QAAAA;AAAK,KAAA;AACrB,CAAA;AAEA;;;IAIA,MAAMmB,iBAAiB,OAAO,EAAER,KAAK,EAAE,GAAG,EAAuB,GAAA;IAC/D,MAAMX,IAAAA,GAAkB,MAAMf,MAAAA,CAAO2B,EAAE,CACpCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC9C,IAAA,IAAI,CAAClB,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,MAAMR,kBAAAA,GAAqB,MAAMF,wBAAAA,CAAyBU,IAAAA,CAAKG,EAAE,CAAA;;IAGjE,MAAMiB,GAAAA,GAAM,CAAA,EAAGnC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEK,kBAAAA,CAAAA,CAAoB;IAElD,OAAOP,MAAAA,CACJoC,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIxB,KAAKW,KAAK;AACdc,QAAAA,IAAAA,EAAMxC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBuC,QAAAA,OAAAA,EAASzC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAF,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEiC,QAAAA,GAAAA;QACApB,IAAAA,EAAM2B,kBAAAA,CAAEC,IAAI,CAAC5B,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAED6B,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAEN7C,MAAAA,CAAO8C,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;IAKA,MAAMG,aAAAA,GAAgB,OACpB,EAAEzC,kBAAkB,EAAEa,QAAQ,EAAE,GAAG,EAAsD,GAAA;IAEzF,MAAM6B,YAAAA,GAAsC,MAAMjD,MAAAA,CAAO2B,EAAE,CACxDC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEvB,YAAAA,kBAAAA;YAAoB0B,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACgB,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAItD,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMmB,+BAAAA,CAAgCmC,YAAAA,CAAAA;AAEtC,IAAA,OAAOzC,iBAAW,MAAA,CAAA,CAAQK,UAAU,CAACoC,YAAAA,CAAa/B,EAAE,EAAE;AACpDE,QAAAA,QAAAA;QACAb,kBAAAA,EAAoB,IAAA;QACpBG,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AAAEe,IAAAA,gBAAAA;AAAkBF,IAAAA,gBAAAA;AAAkBJ,IAAAA,YAAAA;AAAce,IAAAA,cAAAA;AAAgBc,IAAAA;AAAc,CAAA;;;;;;;"}

package/dist/server/server/src/services/auth.mjs

@@ -2,9 +2,50 @@ import bcrypt from 'bcryptjs';
 import ___default from 'lodash';
 import { errors } from '@strapi/utils';
 import { getService } from '../utils/index.mjs';
+import { expiresInToSeconds } from './token.mjs';
 import '@strapi/types';
 
 const { ApplicationError } = errors;
+// Default lifetime of an admin reset-password token. Overridable via
+// `admin.forgotPassword.expiresIn` (number of seconds or a shorthand like '15m', '1h').
+const DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN = '1h';
+/**
+ * Resolve the reset-password token lifetime, in milliseconds, from config.
+ * Falls back to {@link DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN} for unset/invalid values.
+ */ const getResetPasswordTokenTTL = ()=>{
+    const configured = strapi.config.get('admin.forgotPassword.expiresIn', DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN);
+    const seconds = expiresInToSeconds(configured) ?? expiresInToSeconds(DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN);
+    return seconds * 1000;
+};
+/**
+ * Create a reset-password token with an expiry and persist it on the user.
+ * Shared by the CE and EE auth services so the expiry behaviour can't drift.
+ * @returns the generated reset-password token
+ */ const assignResetPasswordToken = async (userId)=>{
+    const resetPasswordToken = getService('token').createToken();
+    const resetPasswordTokenExpiresAt = new Date(Date.now() + getResetPasswordTokenTTL());
+    await getService('user').updateById(userId, {
+        resetPasswordToken,
+        resetPasswordTokenExpiresAt
+    });
+    return resetPasswordToken;
+};
+/**
+ * Reject a reset-password token that has expired — or that has no expiry at all
+ * (tokens issued before this was introduced) — clearing the stale token so it
+ * cannot be retried. Shared by the CE and EE auth services. (GH#25711)
+ */ const assertResetPasswordTokenIsValid = async (user)=>{
+    const { resetPasswordTokenExpiresAt } = user;
+    const isExpired = !resetPasswordTokenExpiresAt || new Date(resetPasswordTokenExpiresAt).getTime() <= Date.now();
+    if (isExpired) {
+        // Clear the stale token so it can no longer be retried.
+        await getService('user').updateById(user.id, {
+            resetPasswordToken: null,
+            resetPasswordTokenExpiresAt: null
+        });
+        throw new ApplicationError('This reset password token has expired');
+    }
+};
 /**
  * hashes a password
  * @param password - password to hash
@@ -72,10 +113,7 @@ const { ApplicationError } = errors;
     if (!user) {
         return;
     }
-    const resetPasswordToken = getService('token').createToken();
-    await getService('user').updateById(user.id, {
-        resetPasswordToken
-    });
+    const resetPasswordToken = await assignResetPasswordToken(user.id);
     // Send an email to the admin.
     const url = `${strapi.config.get('admin.absoluteUrl')}/auth/reset-password?code=${resetPasswordToken}`;
     return strapi.plugin('email').service('email').sendTemplatedEmail({
@@ -109,9 +147,11 @@ const { ApplicationError } = errors;
     if (!matchingUser) {
         throw new ApplicationError();
     }
+    await assertResetPasswordTokenIsValid(matchingUser);
     return getService('user').updateById(matchingUser.id, {
         password,
-        resetPasswordToken: null
+        resetPasswordToken: null,
+        resetPasswordTokenExpiresAt: null
     });
 };
 var auth = {
@@ -122,5 +162,5 @@ var auth = {
     resetPassword
 };
 
-export { auth as default };
+export { assertResetPasswordTokenIsValid, assignResetPasswordToken, auth as default, getResetPasswordTokenTTL };
 //# sourceMappingURL=auth.mjs.map

package/dist/server/server/src/services/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","sources":["../../../../../server/src/services/auth.ts"],"sourcesContent":["import bcrypt from 'bcryptjs';\nimport _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport type { AdminUser } from '../../../shared/contracts/shared';\nimport '@strapi/types';\n\nconst { ApplicationError } = errors;\n\n/**\n * hashes a password\n * @param password - password to hash\n * @returns hashed password\n */\nconst hashPassword = (password: string) => bcrypt.hash(password, 10);\n\n/**\n * Validate a password\n * @param password\n * @param hash\n * @returns {Promise<boolean>} is the password valid\n */\nconst validatePassword = (password: string, hash: string) => bcrypt.compare(password, hash);\n\n/**\n * Check login credentials\n * @param email the users email address\n * @param password the users password\n */\nconst checkCredentials = async ({ email, password }: { email: string; password: string }) => {\n  const user: AdminUser = await strapi.db.query('admin::user').findOne({ where: { email } });\n\n  if (!user || !user.password) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  const isValid = await validatePassword(password, user.password);\n\n  if (!isValid) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  if (!(user.isActive === true)) {\n    return [null, false, { message: 'User not active' }];\n  }\n\n  return [null, user];\n};\n\n/**\n * Send an email to the user if it exists or do nothing\n * @param email user email for which to reset the password\n */\nconst forgotPassword = async ({ email } = {} as { email: string }) => {\n  const user: AdminUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email, isActive: true } });\n  if (!user) {\n    return;\n  }\n\n  const resetPasswordToken = getService('token').createToken();\n  await getService('user').updateById(user.id, { resetPasswordToken });\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param resetPasswordToken token generated to request a password reset\n * @param password new user password\n */\nconst resetPassword = async (\n  { resetPasswordToken, password } = {} as { resetPasswordToken: string; password: string }\n) => {\n  const matchingUser: AdminUser | undefined = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser) {\n    throw new ApplicationError();\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n  });\n};\n\nexport default { checkCredentials, validatePassword, hashPassword, forgotPassword, resetPassword };\n"],"names":["ApplicationError","errors","hashPassword","password","bcrypt","hash","validatePassword","compare","checkCredentials","email","user","strapi","db","query","findOne","where","message","isValid","isActive","forgotPassword","resetPasswordToken","getService","createToken","updateById","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","matchingUser"],"mappings":";;;;;;AAOA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAE7B;;;;AAIC,IACD,MAAMC,YAAAA,GAAe,CAACC,WAAqBC,MAAAA,CAAOC,IAAI,CAACF,QAAAA,EAAU,EAAA,CAAA;AAEjE;;;;;IAMA,MAAMG,mBAAmB,CAACH,QAAAA,EAAkBE,OAAiBD,MAAAA,CAAOG,OAAO,CAACJ,QAAAA,EAAUE,IAAAA,CAAAA;AAEtF;;;;AAIC,IACD,MAAMG,gBAAAA,GAAmB,OAAO,EAAEC,KAAK,EAAEN,QAAQ,EAAuC,GAAA;IACtF,MAAMO,IAAAA,GAAkB,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA;AAAM;AAAE,KAAA,CAAA;AAExF,IAAA,IAAI,CAACC,IAAAA,IAAQ,CAACA,IAAAA,CAAKP,QAAQ,EAAE;QAC3B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEa,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,MAAMC,OAAAA,GAAU,MAAMX,gBAAAA,CAAiBH,QAAAA,EAAUO,KAAKP,QAAQ,CAAA;AAE9D,IAAA,IAAI,CAACc,OAAAA,EAAS;QACZ,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAED,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,IAAI,EAAEN,IAAAA,CAAKQ,QAAQ,KAAK,IAAG,CAAA,EAAI;QAC7B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEF,OAAAA,EAAS;AAAkB;AAAE,SAAA;AACtD,IAAA;IAEA,OAAO;AAAC,QAAA,IAAA;AAAMN,QAAAA;AAAK,KAAA;AACrB,CAAA;AAEA;;;IAIA,MAAMS,iBAAiB,OAAO,EAAEV,KAAK,EAAE,GAAG,EAAuB,GAAA;IAC/D,MAAMC,IAAAA,GAAkB,MAAMC,MAAAA,CAAOC,EAAE,CACpCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOS,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC9C,IAAA,IAAI,CAACR,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;IAEA,MAAMU,kBAAAA,GAAqBC,UAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMD,WAAW,MAAA,CAAA,CAAQE,UAAU,CAACb,IAAAA,CAAKc,EAAE,EAAE;AAAEJ,QAAAA;AAAmB,KAAA,CAAA;;IAGlE,MAAMK,GAAAA,GAAM,CAAA,EAAGd,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEP,kBAAAA,CAAAA,CAAoB;IAElD,OAAOT,MAAAA,CACJiB,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIrB,KAAKD,KAAK;AACduB,QAAAA,IAAAA,EAAMrB,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAAStB,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAhB,MAAAA,CAAOe,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAf,IAAAA,EAAMwB,UAAAA,CAAEC,IAAI,CAACzB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAED0B,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAEN1B,MAAAA,CAAO2B,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;IAKA,MAAMG,aAAAA,GAAgB,OACpB,EAAEpB,kBAAkB,EAAEjB,QAAQ,EAAE,GAAG,EAAsD,GAAA;IAEzF,MAAMsC,YAAAA,GAAsC,MAAM9B,MAAAA,CAAOC,EAAE,CACxDC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEK,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACuB,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAIzC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,OAAOqB,WAAW,MAAA,CAAA,CAAQE,UAAU,CAACkB,YAAAA,CAAajB,EAAE,EAAE;AACpDrB,QAAAA,QAAAA;QACAiB,kBAAAA,EAAoB;AACtB,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AAAEZ,IAAAA,gBAAAA;AAAkBF,IAAAA,gBAAAA;AAAkBJ,IAAAA,YAAAA;AAAciB,IAAAA,cAAAA;AAAgBqB,IAAAA;AAAc,CAAA;;;;"}
+{"version":3,"file":"auth.mjs","sources":["../../../../../server/src/services/auth.ts"],"sourcesContent":["import bcrypt from 'bcryptjs';\nimport _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { expiresInToSeconds } from './token';\nimport type { AdminUser } from '../../../shared/contracts/shared';\nimport '@strapi/types';\n\nconst { ApplicationError } = errors;\n\n// Default lifetime of an admin reset-password token. Overridable via\n// `admin.forgotPassword.expiresIn` (number of seconds or a shorthand like '15m', '1h').\nconst DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN = '1h';\n\n/**\n * Resolve the reset-password token lifetime, in milliseconds, from config.\n * Falls back to {@link DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN} for unset/invalid values.\n */\nconst getResetPasswordTokenTTL = (): number => {\n  const configured = strapi.config.get(\n    'admin.forgotPassword.expiresIn',\n    DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN\n  );\n  const seconds =\n    expiresInToSeconds(configured) ??\n    (expiresInToSeconds(DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN) as number);\n  return seconds * 1000;\n};\n\n/**\n * Create a reset-password token with an expiry and persist it on the user.\n * Shared by the CE and EE auth services so the expiry behaviour can't drift.\n * @returns the generated reset-password token\n */\nconst assignResetPasswordToken = async (userId: AdminUser['id']): Promise<string> => {\n  const resetPasswordToken = getService('token').createToken();\n  const resetPasswordTokenExpiresAt = new Date(Date.now() + getResetPasswordTokenTTL());\n\n  await getService('user').updateById(userId, {\n    resetPasswordToken,\n    resetPasswordTokenExpiresAt,\n  });\n\n  return resetPasswordToken;\n};\n\n/**\n * Reject a reset-password token that has expired — or that has no expiry at all\n * (tokens issued before this was introduced) — clearing the stale token so it\n * cannot be retried. Shared by the CE and EE auth services. (GH#25711)\n */\nconst assertResetPasswordTokenIsValid = async (user: AdminUser): Promise<void> => {\n  const { resetPasswordTokenExpiresAt } = user;\n  const isExpired =\n    !resetPasswordTokenExpiresAt || new Date(resetPasswordTokenExpiresAt).getTime() <= Date.now();\n\n  if (isExpired) {\n    // Clear the stale token so it can no longer be retried.\n    await getService('user').updateById(user.id, {\n      resetPasswordToken: null,\n      resetPasswordTokenExpiresAt: null,\n    });\n    throw new ApplicationError('This reset password token has expired');\n  }\n};\n\n/**\n * hashes a password\n * @param password - password to hash\n * @returns hashed password\n */\nconst hashPassword = (password: string) => bcrypt.hash(password, 10);\n\n/**\n * Validate a password\n * @param password\n * @param hash\n * @returns {Promise<boolean>} is the password valid\n */\nconst validatePassword = (password: string, hash: string) => bcrypt.compare(password, hash);\n\n/**\n * Check login credentials\n * @param email the users email address\n * @param password the users password\n */\nconst checkCredentials = async ({ email, password }: { email: string; password: string }) => {\n  const user: AdminUser = await strapi.db.query('admin::user').findOne({ where: { email } });\n\n  if (!user || !user.password) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  const isValid = await validatePassword(password, user.password);\n\n  if (!isValid) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  if (!(user.isActive === true)) {\n    return [null, false, { message: 'User not active' }];\n  }\n\n  return [null, user];\n};\n\n/**\n * Send an email to the user if it exists or do nothing\n * @param email user email for which to reset the password\n */\nconst forgotPassword = async ({ email } = {} as { email: string }) => {\n  const user: AdminUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email, isActive: true } });\n  if (!user) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param resetPasswordToken token generated to request a password reset\n * @param password new user password\n */\nconst resetPassword = async (\n  { resetPasswordToken, password } = {} as { resetPasswordToken: string; password: string }\n) => {\n  const matchingUser: AdminUser | undefined = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n};\n\nexport default { checkCredentials, validatePassword, hashPassword, forgotPassword, resetPassword };\nexport { getResetPasswordTokenTTL, assignResetPasswordToken, assertResetPasswordTokenIsValid };\n"],"names":["ApplicationError","errors","DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN","getResetPasswordTokenTTL","configured","strapi","config","get","seconds","expiresInToSeconds","assignResetPasswordToken","userId","resetPasswordToken","getService","createToken","resetPasswordTokenExpiresAt","Date","now","updateById","assertResetPasswordTokenIsValid","user","isExpired","getTime","id","hashPassword","password","bcrypt","hash","validatePassword","compare","checkCredentials","email","db","query","findOne","where","message","isValid","isActive","forgotPassword","url","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","matchingUser"],"mappings":";;;;;;;AAQA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAE7B;AACA;AACA,MAAMC,uCAAAA,GAA0C,IAAA;AAEhD;;;AAGC,UACKC,wBAAAA,GAA2B,IAAA;AAC/B,IAAA,MAAMC,aAAaC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAClC,gCAAA,EACAL,uCAAAA,CAAAA;IAEF,MAAMM,OAAAA,GACJC,kBAAAA,CAAmBL,UAAAA,CAAAA,IAClBK,kBAAAA,CAAmBP,uCAAAA,CAAAA;AACtB,IAAA,OAAOM,OAAAA,GAAU,IAAA;AACnB;AAEA;;;;IAKA,MAAME,2BAA2B,OAAOC,MAAAA,GAAAA;IACtC,MAAMC,kBAAAA,GAAqBC,UAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMC,2BAAAA,GAA8B,IAAIC,IAAAA,CAAKA,IAAAA,CAAKC,GAAG,EAAA,GAAKd,wBAAAA,EAAAA,CAAAA;AAE1D,IAAA,MAAMU,UAAAA,CAAW,MAAA,CAAA,CAAQK,UAAU,CAACP,MAAAA,EAAQ;AAC1CC,QAAAA,kBAAAA;AACAG,QAAAA;AACF,KAAA,CAAA;IAEA,OAAOH,kBAAAA;AACT;AAEA;;;;IAKA,MAAMO,kCAAkC,OAAOC,IAAAA,GAAAA;IAC7C,MAAM,EAAEL,2BAA2B,EAAE,GAAGK,IAAAA;IACxC,MAAMC,SAAAA,GACJ,CAACN,2BAAAA,IAA+B,IAAIC,KAAKD,2BAAAA,CAAAA,CAA6BO,OAAO,EAAA,IAAMN,IAAAA,CAAKC,GAAG,EAAA;AAE7F,IAAA,IAAII,SAAAA,EAAW;;AAEb,QAAA,MAAMR,WAAW,MAAA,CAAA,CAAQK,UAAU,CAACE,IAAAA,CAAKG,EAAE,EAAE;YAC3CX,kBAAAA,EAAoB,IAAA;YACpBG,2BAAAA,EAA6B;AAC/B,SAAA,CAAA;AACA,QAAA,MAAM,IAAIf,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,IAAA;AACF;AAEA;;;;AAIC,IACD,MAAMwB,YAAAA,GAAe,CAACC,WAAqBC,MAAAA,CAAOC,IAAI,CAACF,QAAAA,EAAU,EAAA,CAAA;AAEjE;;;;;IAMA,MAAMG,mBAAmB,CAACH,QAAAA,EAAkBE,OAAiBD,MAAAA,CAAOG,OAAO,CAACJ,QAAAA,EAAUE,IAAAA,CAAAA;AAEtF;;;;AAIC,IACD,MAAMG,gBAAAA,GAAmB,OAAO,EAAEC,KAAK,EAAEN,QAAQ,EAAuC,GAAA;IACtF,MAAML,IAAAA,GAAkB,MAAMf,MAAAA,CAAO2B,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA;AAAM;AAAE,KAAA,CAAA;AAExF,IAAA,IAAI,CAACX,IAAAA,IAAQ,CAACA,IAAAA,CAAKK,QAAQ,EAAE;QAC3B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEW,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,MAAMC,OAAAA,GAAU,MAAMT,gBAAAA,CAAiBH,QAAAA,EAAUL,KAAKK,QAAQ,CAAA;AAE9D,IAAA,IAAI,CAACY,OAAAA,EAAS;QACZ,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAED,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,IAAI,EAAEhB,IAAAA,CAAKkB,QAAQ,KAAK,IAAG,CAAA,EAAI;QAC7B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEF,OAAAA,EAAS;AAAkB;AAAE,SAAA;AACtD,IAAA;IAEA,OAAO;AAAC,QAAA,IAAA;AAAMhB,QAAAA;AAAK,KAAA;AACrB,CAAA;AAEA;;;IAIA,MAAMmB,iBAAiB,OAAO,EAAER,KAAK,EAAE,GAAG,EAAuB,GAAA;IAC/D,MAAMX,IAAAA,GAAkB,MAAMf,MAAAA,CAAO2B,EAAE,CACpCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC9C,IAAA,IAAI,CAAClB,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,MAAMR,kBAAAA,GAAqB,MAAMF,wBAAAA,CAAyBU,IAAAA,CAAKG,EAAE,CAAA;;IAGjE,MAAMiB,GAAAA,GAAM,CAAA,EAAGnC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEK,kBAAAA,CAAAA,CAAoB;IAElD,OAAOP,MAAAA,CACJoC,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIxB,KAAKW,KAAK;AACdc,QAAAA,IAAAA,EAAMxC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBuC,QAAAA,OAAAA,EAASzC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAF,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEiC,QAAAA,GAAAA;QACApB,IAAAA,EAAM2B,UAAAA,CAAEC,IAAI,CAAC5B,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAED6B,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAEN7C,MAAAA,CAAO8C,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;IAKA,MAAMG,aAAAA,GAAgB,OACpB,EAAEzC,kBAAkB,EAAEa,QAAQ,EAAE,GAAG,EAAsD,GAAA;IAEzF,MAAM6B,YAAAA,GAAsC,MAAMjD,MAAAA,CAAO2B,EAAE,CACxDC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEvB,YAAAA,kBAAAA;YAAoB0B,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACgB,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAItD,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMmB,+BAAAA,CAAgCmC,YAAAA,CAAAA;AAEtC,IAAA,OAAOzC,WAAW,MAAA,CAAA,CAAQK,UAAU,CAACoC,YAAAA,CAAa/B,EAAE,EAAE;AACpDE,QAAAA,QAAAA;QACAb,kBAAAA,EAAoB,IAAA;QACpBG,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AAAEe,IAAAA,gBAAAA;AAAkBF,IAAAA,gBAAAA;AAAkBJ,IAAAA,YAAAA;AAAce,IAAAA,cAAAA;AAAgBc,IAAAA;AAAc,CAAA;;;;"}

package/dist/server/server/src/services/index.js

@@ -26,7 +26,7 @@ const contentApiTokenService = apiToken.createTokenService('content-api');
 const adminTokenService = apiToken.createTokenService('admin');
 // TODO: TS - Export services one by one as this export is cjs
 var services = {
-    auth,
+    auth: auth.default,
     user,
     role,
     passport,

package/dist/server/server/src/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../../../server/src/services/index.ts"],"sourcesContent":["// NOTE: Make sure to use default export for services overwritten in EE\nimport auth from './auth';\nimport user from './user';\nimport role from './role';\nimport passport from './passport';\nimport metrics from './metrics';\nimport encryption from './encryption';\nimport * as token from './token';\nimport * as permission from './permission';\nimport * as contentType from './content-type';\nimport * as constants from './constants';\nimport * as condition from './condition';\nimport * as action from './action';\nimport { createTokenService } from './api-token';\nimport * as transfer from './transfer';\nimport * as projectSettings from './project-settings';\nimport { homepageService } from './homepage';\n\nconst contentApiTokenService = createTokenService('content-api');\nconst adminTokenService = createTokenService('admin');\n\n// TODO: TS - Export services one by one as this export is cjs\nexport default {\n  auth,\n  user,\n  role,\n  passport,\n  token,\n  permission,\n  metrics,\n  'content-type': contentType,\n  constants,\n  condition,\n  action,\n  /** @deprecated Use 'api-token-content-api' instead */\n  'api-token': contentApiTokenService,\n  'api-token-content-api': contentApiTokenService,\n  'api-token-admin': adminTokenService,\n  transfer,\n  'project-settings': projectSettings,\n  encryption,\n  homepage: homepageService,\n};\n"],"names":["contentApiTokenService","createTokenService","adminTokenService","auth","user","role","passport","token","permission","metrics","contentType","constants","condition","action","transfer","projectSettings","encryption","homepage","homepageService"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA;AAkBA,MAAMA,yBAAyBC,2BAAAA,CAAmB,aAAA,CAAA;AAClD,MAAMC,oBAAoBD,2BAAAA,CAAmB,OAAA,CAAA;AAE7C;AACA,eAAe;AACbE,IAAAA,IAAAA;AACAC,IAAAA,IAAAA;AACAC,IAAAA,IAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,KAAAA;AACAC,IAAAA,UAAAA;AACAC,IAAAA,OAAAA;IACA,cAAA,EAAgBC,WAAAA;AAChBC,eAAAA,oBAAAA;AACAC,IAAAA,SAAAA;AACAC,IAAAA,MAAAA;AACA,2DACA,WAAA,EAAab,sBAAAA;IACb,uBAAA,EAAyBA,sBAAAA;IACzB,iBAAA,EAAmBE,iBAAAA;AACnBY,cAAAA,KAAAA;IACA,kBAAA,EAAoBC,eAAAA;AACpBC,IAAAA,UAAAA;IACAC,QAAAA,EAAUC;AACZ,CAAA;;;;"}
+{"version":3,"file":"index.js","sources":["../../../../../server/src/services/index.ts"],"sourcesContent":["// NOTE: Make sure to use default export for services overwritten in EE\nimport auth from './auth';\nimport user from './user';\nimport role from './role';\nimport passport from './passport';\nimport metrics from './metrics';\nimport encryption from './encryption';\nimport * as token from './token';\nimport * as permission from './permission';\nimport * as contentType from './content-type';\nimport * as constants from './constants';\nimport * as condition from './condition';\nimport * as action from './action';\nimport { createTokenService } from './api-token';\nimport * as transfer from './transfer';\nimport * as projectSettings from './project-settings';\nimport { homepageService } from './homepage';\n\nconst contentApiTokenService = createTokenService('content-api');\nconst adminTokenService = createTokenService('admin');\n\n// TODO: TS - Export services one by one as this export is cjs\nexport default {\n  auth,\n  user,\n  role,\n  passport,\n  token,\n  permission,\n  metrics,\n  'content-type': contentType,\n  constants,\n  condition,\n  action,\n  /** @deprecated Use 'api-token-content-api' instead */\n  'api-token': contentApiTokenService,\n  'api-token-content-api': contentApiTokenService,\n  'api-token-admin': adminTokenService,\n  transfer,\n  'project-settings': projectSettings,\n  encryption,\n  homepage: homepageService,\n};\n"],"names":["contentApiTokenService","createTokenService","adminTokenService","auth","user","role","passport","token","permission","metrics","contentType","constants","condition","action","transfer","projectSettings","encryption","homepage","homepageService"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA;AAkBA,MAAMA,yBAAyBC,2BAAAA,CAAmB,aAAA,CAAA;AAClD,MAAMC,oBAAoBD,2BAAAA,CAAmB,OAAA,CAAA;AAE7C;AACA,eAAe;AACbE,UAAAA,YAAAA;AACAC,IAAAA,IAAAA;AACAC,IAAAA,IAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,KAAAA;AACAC,IAAAA,UAAAA;AACAC,IAAAA,OAAAA;IACA,cAAA,EAAgBC,WAAAA;AAChBC,eAAAA,oBAAAA;AACAC,IAAAA,SAAAA;AACAC,IAAAA,MAAAA;AACA,2DACA,WAAA,EAAab,sBAAAA;IACb,uBAAA,EAAyBA,sBAAAA;IACzB,iBAAA,EAAmBE,iBAAAA;AACnBY,cAAAA,KAAAA;IACA,kBAAA,EAAoBC,eAAAA;AACpBC,IAAAA,UAAAA;IACAC,QAAAA,EAAUC;AACZ,CAAA;;;;"}

package/dist/server/server/src/services/user.js

@@ -32,6 +32,7 @@ const getSessionManager = ()=>{
         ...___default.default.omit(user, [
             'password',
             'resetPasswordToken',
+            'resetPasswordTokenExpiresAt',
             'registrationToken',
             'roles'
         ]),

package/dist/server/server/src/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _ from 'lodash';\nimport { defaults } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, ['password', 'resetPasswordToken', 'registrationToken', 'roles']),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit('user.create', { user: sanitizeUser(user) });\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch (error) {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({ populate: ['roles'] }, params));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","hashedPassword","updatedUser","update","resetPasswordByEmail","email","findOne","Error","passwordValidator","validate","error","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","firstname","lastname","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,kBAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,kBAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AAAC,YAAA,UAAA;AAAY,YAAA,oBAAA;AAAsB,YAAA,mBAAA;AAAqB,YAAA;SAAQ,CAAC;AACjFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,gBAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,iBAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,CAACpB,IAAAA,GAAAA;AACvBQ,IAAAA,gBAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AACjE,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;IAE/Ce,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMU,mBAAmB,OACvBnB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACU,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAM9B,MAAAA,CAAOkB,EAAE,CACnCa,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAM7C;AAAiB,SAAA,CAAA,CAC/B8C,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAIvC,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMgD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAIhD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnB+B,QAAAA,EAAU,IAAA;YACVpC,KAAAA,EAAO;AAACyB,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEAnB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM0B,UAAAA,GAAa,OACjBD,EAAAA,EACAlC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMoC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACzC,UAAAA,CAAWH,KAAK,EAAGyB,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWiC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIpD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAII,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAM0C,iBAAiB,MAAMvC,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAMqC,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC9DnB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZrB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAUoC;AACZ,aAAA;YACA5B,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;QAC9DnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZrB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI6B,WAAAA,EAAa;AACfnD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAME,oBAAAA,GAAuB,OAAOC,KAAAA,EAAexC,QAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEqB,YAAAA;AAAM,SAAA;QAAGhC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIqD,KAAAA,CAAM,CAAC,0BAA0B,EAAEF,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAMG,yBAAAA,CAAkBC,QAAQ,CAAC5C,QAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAO6C,KAAAA,EAAO;AACd,QAAA,MAAM,IAAInE,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMmD,UAAAA,CAAWxC,IAAAA,CAAKuC,EAAE,EAAE;AAAE5B,QAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAM+B,uBAAuB,OAAOe,MAAAA,GAAAA;IAClC,MAAMzD,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQK,MAAAA,CAAAA;IAC5B,IAAI,CAACzD,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM2B,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKC,wBAAAA,CAAkB3D,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4D,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMT,OAAAA,CAAQK,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,wBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMjE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QACjE5C,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL4B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEiC,GAAAA,EAAK9E;AAAiB;AAChC;AACF;AACF,SAAA;QACA+E,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACPtC,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOiC,UAAAA,CAAWvB,EAAE,KAAKsB,WAAAA,CAAYtB,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOhC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAAEtC,KAAAA,EAAOzB;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAMgE,uBAAuB,OAC3B9D,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAOsE,SAAAA;AACT,IAAA;IAEA,OAAO7E,kBAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAMuE,QAAAA,GAAW,OAAO,EACtBhE,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMkE,YAAAA,GAAe,MAAM3E,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACiE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAInF,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,OAAOmB,iBAAW,MAAA,CAAA,CAAQgC,UAAU,CAACgC,YAAAA,CAAajC,EAAE,EAAE;AACpD5B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3B8D,QAAAA,SAAAA,EAAWnE,SAASmE,SAAS;AAC7BC,QAAAA,QAAAA,EAAUpE,SAASoE,QAAQ;QAC3BnE,iBAAAA,EAAmB,IAAA;QACnB+B,QAAAA,EAAU;AACZ,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMc,OAAAA,GAAU,OAAOb,EAAAA,EAAapB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGpB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMwD,cAAAA,GAAiB,OAAOxB,KAAAA,EAAehC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CtB,KAAAA,EAAO;YAAEqB,KAAAA,EAAO;gBAAEyB,IAAAA,EAAMzB;AAAM;AAAE,SAAA;AAChChC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAM0D,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM9D,KAAAA,GAAQnB,OACXkF,GAAG,CAAC,gBACJC,SAAS,CAAC,eAAeC,WAAAA,CAAS;QAAE9D,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,EAAG2D,MAAAA,CAAAA,CAAAA;AAE9D,IAAA,OAAOjF,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe6D,QAAQ,CAAC7D,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAMkE,aAAa,OAAO3C,EAAAA,GAAAA;;IAExB,MAAM4C,YAAAA,GAAiC,MAAMtF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACgE,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAajF,KAAK,CAACkF,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAEtD,IAAI,KAAK7C,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAMyC,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIrE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMiG,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNuE,MAAM,CAAC;QAAEzD,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA1C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAauF,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMK,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMjE,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;IAC3E,MAAMkD,sBAAAA,GAAyB,MAAMhG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QACxEtC,KAAAA,EAAO;YACLS,EAAAA,EAAIqD,GAAAA;YACJ1F,KAAAA,EAAO;AAAEqC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAe+B,UAAU,KAAKmC,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxG,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMyG,eAAe,EAAE;IACvB,KAAK,MAAMvD,MAAMqD,GAAAA,CAAK;QACpB,MAAMN,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuE,MAAM,CAAC;YAC9DzD,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZpB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAuD,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEAzF,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCyE,QAAAA,KAAAA,EAAOF,YAAAA,CAAa3F,GAAG,CAAC,CAACmF,cAAgBvF,YAAAA,CAAauF,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOpG,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAC1CtC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBACLqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAM9B,KAAAA,GAAQ,OAAOtC,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOjC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;AAAEtC,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMqE,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAC1DlC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBAAEqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM7F,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC3CnB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAIvC,KAAKuC;AAAG,aAAA;YACrBrB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACkG,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAMnC,QAAQ,MAAM6B,qBAAAA,EAAAA;AAEpB,IAAA,IAAI7B,QAAQ,CAAA,EAAG;QACbvE,MAAAA,CAAO2G,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAErC,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAMsC,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAAElC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAOmE,MAAM7F,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAK2G,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACb1F,IAAAA,MAAAA;AACAO,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACAgC,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACAxE,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAuB,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAS,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACA7B,IAAAA,KAAAA;AACA+B,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACArD,IAAAA,oBAAAA;AACAwD,IAAAA,iBAAAA;AACA9C,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.js","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _ from 'lodash';\nimport { defaults } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit('user.create', { user: sanitizeUser(user) });\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch (error) {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({ populate: ['roles'] }, params));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","hashedPassword","updatedUser","update","resetPasswordByEmail","email","findOne","Error","passwordValidator","validate","error","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","firstname","lastname","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,kBAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,kBAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,gBAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,iBAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,CAACpB,IAAAA,GAAAA;AACvBQ,IAAAA,gBAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AACjE,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;IAE/Ce,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMU,mBAAmB,OACvBnB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACU,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAM9B,MAAAA,CAAOkB,EAAE,CACnCa,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAM7C;AAAiB,SAAA,CAAA,CAC/B8C,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAIvC,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMgD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAIhD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnB+B,QAAAA,EAAU,IAAA;YACVpC,KAAAA,EAAO;AAACyB,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEAnB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM0B,UAAAA,GAAa,OACjBD,EAAAA,EACAlC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMoC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACzC,UAAAA,CAAWH,KAAK,EAAGyB,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWiC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIpD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAII,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAM0C,iBAAiB,MAAMvC,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAMqC,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC9DnB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZrB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAUoC;AACZ,aAAA;YACA5B,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;QAC9DnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZrB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI6B,WAAAA,EAAa;AACfnD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAME,oBAAAA,GAAuB,OAAOC,KAAAA,EAAexC,QAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEqB,YAAAA;AAAM,SAAA;QAAGhC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIqD,KAAAA,CAAM,CAAC,0BAA0B,EAAEF,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAMG,yBAAAA,CAAkBC,QAAQ,CAAC5C,QAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAO6C,KAAAA,EAAO;AACd,QAAA,MAAM,IAAInE,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMmD,UAAAA,CAAWxC,IAAAA,CAAKuC,EAAE,EAAE;AAAE5B,QAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAM+B,uBAAuB,OAAOe,MAAAA,GAAAA;IAClC,MAAMzD,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQK,MAAAA,CAAAA;IAC5B,IAAI,CAACzD,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM2B,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKC,wBAAAA,CAAkB3D,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4D,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMT,OAAAA,CAAQK,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,wBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMjE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QACjE5C,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL4B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEiC,GAAAA,EAAK9E;AAAiB;AAChC;AACF;AACF,SAAA;QACA+E,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACPtC,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOiC,UAAAA,CAAWvB,EAAE,KAAKsB,WAAAA,CAAYtB,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOhC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAAEtC,KAAAA,EAAOzB;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAMgE,uBAAuB,OAC3B9D,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAOsE,SAAAA;AACT,IAAA;IAEA,OAAO7E,kBAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAMuE,QAAAA,GAAW,OAAO,EACtBhE,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMkE,YAAAA,GAAe,MAAM3E,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACiE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAInF,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,OAAOmB,iBAAW,MAAA,CAAA,CAAQgC,UAAU,CAACgC,YAAAA,CAAajC,EAAE,EAAE;AACpD5B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3B8D,QAAAA,SAAAA,EAAWnE,SAASmE,SAAS;AAC7BC,QAAAA,QAAAA,EAAUpE,SAASoE,QAAQ;QAC3BnE,iBAAAA,EAAmB,IAAA;QACnB+B,QAAAA,EAAU;AACZ,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMc,OAAAA,GAAU,OAAOb,EAAAA,EAAapB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGpB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMwD,cAAAA,GAAiB,OAAOxB,KAAAA,EAAehC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CtB,KAAAA,EAAO;YAAEqB,KAAAA,EAAO;gBAAEyB,IAAAA,EAAMzB;AAAM;AAAE,SAAA;AAChChC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAM0D,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM9D,KAAAA,GAAQnB,OACXkF,GAAG,CAAC,gBACJC,SAAS,CAAC,eAAeC,WAAAA,CAAS;QAAE9D,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,EAAG2D,MAAAA,CAAAA,CAAAA;AAE9D,IAAA,OAAOjF,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe6D,QAAQ,CAAC7D,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAMkE,aAAa,OAAO3C,EAAAA,GAAAA;;IAExB,MAAM4C,YAAAA,GAAiC,MAAMtF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACgE,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAajF,KAAK,CAACkF,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAEtD,IAAI,KAAK7C,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAMyC,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIrE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMiG,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNuE,MAAM,CAAC;QAAEzD,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA1C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAauF,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMK,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMjE,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;IAC3E,MAAMkD,sBAAAA,GAAyB,MAAMhG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QACxEtC,KAAAA,EAAO;YACLS,EAAAA,EAAIqD,GAAAA;YACJ1F,KAAAA,EAAO;AAAEqC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAe+B,UAAU,KAAKmC,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxG,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMyG,eAAe,EAAE;IACvB,KAAK,MAAMvD,MAAMqD,GAAAA,CAAK;QACpB,MAAMN,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuE,MAAM,CAAC;YAC9DzD,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZpB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAuD,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEAzF,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCyE,QAAAA,KAAAA,EAAOF,YAAAA,CAAa3F,GAAG,CAAC,CAACmF,cAAgBvF,YAAAA,CAAauF,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOpG,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAC1CtC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBACLqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAM9B,KAAAA,GAAQ,OAAOtC,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOjC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;AAAEtC,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMqE,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAC1DlC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBAAEqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM7F,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC3CnB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAIvC,KAAKuC;AAAG,aAAA;YACrBrB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACkG,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAMnC,QAAQ,MAAM6B,qBAAAA,EAAAA;AAEpB,IAAA,IAAI7B,QAAQ,CAAA,EAAG;QACbvE,MAAAA,CAAO2G,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAErC,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAMsC,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAAElC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAOmE,MAAM7F,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAK2G,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACb1F,IAAAA,MAAAA;AACAO,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACAgC,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACAxE,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAuB,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAS,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACA7B,IAAAA,KAAAA;AACA+B,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACArD,IAAAA,oBAAAA;AACAwD,IAAAA,iBAAAA;AACA9C,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/user.mjs

@@ -26,6 +26,7 @@ const getSessionManager = ()=>{
         ...___default.omit(user, [
             'password',
             'resetPasswordToken',
+            'resetPasswordTokenExpiresAt',
             'registrationToken',
             'roles'
         ]),