@strapi/admin 5.50.2 → 5.51.0

package/dist/server/shared/utils/auth-cookie-domain.js

@@ -0,0 +1,41 @@
+'use strict';
+
+/**
+ * Domain attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so
+ * multiple Strapi instances under the same parent domain share, or stay
+ * isolated to, the intended host.
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the domain requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `undefined` (host-only cookie) to match the browser default and
+ * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is
+ * configured. A host-only cookie and a `Domain`-scoped cookie are distinct
+ * entries in the browser cookie store, so set and delete must agree on the
+ * domain or logout leaves a colliding copy behind.
+ */ const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;
+const isValidCookieDomain = (domain)=>{
+    // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no
+    // path, no port, and none of the control/attribute-separator characters.
+    return !/[\x00-\x1F\x7F;,\s/:]/.test(domain);
+};
+const resolveAuthCookieDomain = (configuredDomain, warn = console.warn)=>{
+    const cookieDomain = (configuredDomain || '').trim();
+    if (!cookieDomain) {
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    if (!isValidCookieDomain(cookieDomain)) {
+        warn(`Ignoring invalid admin auth cookie domain "${cookieDomain}" (must be a bare host name); using a host-only cookie instead.`);
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    return cookieDomain;
+};
+
+exports.DEFAULT_AUTH_COOKIE_DOMAIN = DEFAULT_AUTH_COOKIE_DOMAIN;
+exports.resolveAuthCookieDomain = resolveAuthCookieDomain;
+//# sourceMappingURL=auth-cookie-domain.js.map

package/dist/server/shared/utils/auth-cookie-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-domain.js","sources":["../../../../shared/utils/auth-cookie-domain.ts"],"sourcesContent":["/**\n * Domain attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so\n * multiple Strapi instances under the same parent domain share, or stay\n * isolated to, the intended host.\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the domain requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `undefined` (host-only cookie) to match the browser default and\n * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is\n * configured. A host-only cookie and a `Domain`-scoped cookie are distinct\n * entries in the browser cookie store, so set and delete must agree on the\n * domain or logout leaves a colliding copy behind.\n */\nexport const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;\n\nconst isValidCookieDomain = (domain: string): boolean => {\n  // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no\n  // path, no port, and none of the control/attribute-separator characters.\n  return !/[\\x00-\\x1F\\x7F;,\\s/:]/.test(domain);\n};\n\nexport const resolveAuthCookieDomain = (\n  configuredDomain?: string,\n  warn: (message: string) => void = console.warn\n): string | undefined => {\n  const cookieDomain = (configuredDomain || '').trim();\n\n  if (!cookieDomain) {\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  if (!isValidCookieDomain(cookieDomain)) {\n    warn(\n      `Ignoring invalid admin auth cookie domain \"${cookieDomain}\" (must be a bare host name); using a host-only cookie instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  return cookieDomain;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_DOMAIN","undefined","isValidCookieDomain","domain","test","resolveAuthCookieDomain","configuredDomain","warn","console","cookieDomain","trim"],"mappings":";;AAAA;;;;;;;;;;;;;;;;;;IAmBO,MAAMA,0BAAAA,GAA6BC;AAE1C,MAAMC,sBAAsB,CAACC,MAAAA,GAAAA;;;IAG3B,OAAO,CAAC,uBAAA,CAAwBC,IAAI,CAACD,MAAAA,CAAAA;AACvC,CAAA;MAEaE,uBAAAA,GAA0B,CACrCC,gBAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,eAAe,CAACH,gBAAAA,IAAoB,EAAC,EAAGI,IAAI,EAAA;AAElD,IAAA,IAAI,CAACD,YAAAA,EAAc;QACjB,OAAOT,0BAAAA;AACT,IAAA;IAEA,IAAI,CAACE,oBAAoBO,YAAAA,CAAAA,EAAe;AACtCF,QAAAA,IAAAA,CACE,CAAC,2CAA2C,EAAEE,YAAAA,CAAa,+DAA+D,CAAC,CAAA;QAE7H,OAAOT,0BAAAA;AACT,IAAA;IAEA,OAAOS,YAAAA;AACT;;;;;"}

package/dist/server/shared/utils/auth-cookie-domain.mjs

@@ -0,0 +1,38 @@
+/**
+ * Domain attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so
+ * multiple Strapi instances under the same parent domain share, or stay
+ * isolated to, the intended host.
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the domain requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `undefined` (host-only cookie) to match the browser default and
+ * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is
+ * configured. A host-only cookie and a `Domain`-scoped cookie are distinct
+ * entries in the browser cookie store, so set and delete must agree on the
+ * domain or logout leaves a colliding copy behind.
+ */ const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;
+const isValidCookieDomain = (domain)=>{
+    // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no
+    // path, no port, and none of the control/attribute-separator characters.
+    return !/[\x00-\x1F\x7F;,\s/:]/.test(domain);
+};
+const resolveAuthCookieDomain = (configuredDomain, warn = console.warn)=>{
+    const cookieDomain = (configuredDomain || '').trim();
+    if (!cookieDomain) {
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    if (!isValidCookieDomain(cookieDomain)) {
+        warn(`Ignoring invalid admin auth cookie domain "${cookieDomain}" (must be a bare host name); using a host-only cookie instead.`);
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    return cookieDomain;
+};
+
+export { DEFAULT_AUTH_COOKIE_DOMAIN, resolveAuthCookieDomain };
+//# sourceMappingURL=auth-cookie-domain.mjs.map

package/dist/server/shared/utils/auth-cookie-domain.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-domain.mjs","sources":["../../../../shared/utils/auth-cookie-domain.ts"],"sourcesContent":["/**\n * Domain attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so\n * multiple Strapi instances under the same parent domain share, or stay\n * isolated to, the intended host.\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the domain requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `undefined` (host-only cookie) to match the browser default and\n * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is\n * configured. A host-only cookie and a `Domain`-scoped cookie are distinct\n * entries in the browser cookie store, so set and delete must agree on the\n * domain or logout leaves a colliding copy behind.\n */\nexport const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;\n\nconst isValidCookieDomain = (domain: string): boolean => {\n  // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no\n  // path, no port, and none of the control/attribute-separator characters.\n  return !/[\\x00-\\x1F\\x7F;,\\s/:]/.test(domain);\n};\n\nexport const resolveAuthCookieDomain = (\n  configuredDomain?: string,\n  warn: (message: string) => void = console.warn\n): string | undefined => {\n  const cookieDomain = (configuredDomain || '').trim();\n\n  if (!cookieDomain) {\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  if (!isValidCookieDomain(cookieDomain)) {\n    warn(\n      `Ignoring invalid admin auth cookie domain \"${cookieDomain}\" (must be a bare host name); using a host-only cookie instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  return cookieDomain;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_DOMAIN","undefined","isValidCookieDomain","domain","test","resolveAuthCookieDomain","configuredDomain","warn","console","cookieDomain","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;IAmBO,MAAMA,0BAAAA,GAA6BC;AAE1C,MAAMC,sBAAsB,CAACC,MAAAA,GAAAA;;;IAG3B,OAAO,CAAC,uBAAA,CAAwBC,IAAI,CAACD,MAAAA,CAAAA;AACvC,CAAA;MAEaE,uBAAAA,GAA0B,CACrCC,gBAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,eAAe,CAACH,gBAAAA,IAAoB,EAAC,EAAGI,IAAI,EAAA;AAElD,IAAA,IAAI,CAACD,YAAAA,EAAc;QACjB,OAAOT,0BAAAA;AACT,IAAA;IAEA,IAAI,CAACE,oBAAoBO,YAAAA,CAAAA,EAAe;AACtCF,QAAAA,IAAAA,CACE,CAAC,2CAA2C,EAAEE,YAAAA,CAAa,+DAA+D,CAAC,CAAA;QAE7H,OAAOT,0BAAAA;AACT,IAAA;IAEA,OAAOS,YAAAA;AACT;;;;"}

package/dist/server/shared/utils/auth-cookie-name.js

@@ -14,13 +14,13 @@
  */ const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';
 // RFC 6265 cookie-name token characters.
 const VALID_COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-const resolveAuthCookieName = (configuredName)=>{
+const resolveAuthCookieName = (configuredName, warn = console.warn)=>{
     const cookieName = (configuredName || '').trim();
     if (!cookieName) {
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     if (!VALID_COOKIE_NAME.test(cookieName)) {
-        console.warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
+        warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     return cookieName;

package/dist/server/shared/utils/auth-cookie-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie-name.js","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (configuredName?: string): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    console.warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","cookieName","trim","test","console","warn"],"mappings":";;AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;AAEnB,MAAMC,wBAAwB,CAACC,cAAAA,GAAAA;AACpC,IAAA,MAAMC,aAAa,CAACD,cAAAA,IAAkB,EAAC,EAAGE,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOJ,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBK,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCG,OAAAA,CAAQC,IAAI,CACV,CAAC,yCAAyC,EAAEJ,WAAW,8DAA8D,EAAEJ,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOI,UAAAA;AACT;;;;;"}
+{"version":3,"file":"auth-cookie-name.js","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (\n  configuredName?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","warn","console","cookieName","trim","test"],"mappings":";;AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;MAEbC,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAON,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBO,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,8DAA8D,EAAEN,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOM,UAAAA;AACT;;;;;"}

package/dist/server/shared/utils/auth-cookie-name.mjs

@@ -12,13 +12,13 @@
  */ const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';
 // RFC 6265 cookie-name token characters.
 const VALID_COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-const resolveAuthCookieName = (configuredName)=>{
+const resolveAuthCookieName = (configuredName, warn = console.warn)=>{
     const cookieName = (configuredName || '').trim();
     if (!cookieName) {
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     if (!VALID_COOKIE_NAME.test(cookieName)) {
-        console.warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
+        warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
         return DEFAULT_AUTH_COOKIE_NAME;
     }
     return cookieName;

package/dist/server/shared/utils/auth-cookie-name.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie-name.mjs","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (configuredName?: string): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    console.warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","cookieName","trim","test","console","warn"],"mappings":"AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;AAEnB,MAAMC,wBAAwB,CAACC,cAAAA,GAAAA;AACpC,IAAA,MAAMC,aAAa,CAACD,cAAAA,IAAkB,EAAC,EAAGE,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOJ,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBK,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCG,OAAAA,CAAQC,IAAI,CACV,CAAC,yCAAyC,EAAEJ,WAAW,8DAA8D,EAAEJ,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOI,UAAAA;AACT;;;;"}
+{"version":3,"file":"auth-cookie-name.mjs","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (\n  configuredName?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","warn","console","cookieName","trim","test"],"mappings":"AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;MAEbC,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAON,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBO,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,8DAA8D,EAAEN,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOM,UAAAA;AACT;;;;"}

package/dist/server/shared/utils/auth-cookie-path.js

@@ -0,0 +1,39 @@
+'use strict';
+
+/**
+ * Path attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.path` so multiple Strapi instances on the same
+ * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the path requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `/admin` to match the refresh-cookie path used by
+ * `getRefreshCookieOptions`.
+ */ const DEFAULT_AUTH_COOKIE_PATH = '/admin';
+const isValidCookiePath = (path)=>{
+    if (!path.startsWith('/')) {
+        return false;
+    }
+    // RFC 6265 path-av: any CHAR except CTLs or ";".
+    return !/[\x00-\x1F\x7F;]/.test(path);
+};
+const resolveAuthCookiePath = (configuredPath, warn = console.warn)=>{
+    const cookiePath = (configuredPath || '').trim();
+    if (!cookiePath) {
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    if (!isValidCookiePath(cookiePath)) {
+        warn(`Ignoring invalid admin auth cookie path "${cookiePath}" (must be an absolute path without ";"); using "${DEFAULT_AUTH_COOKIE_PATH}" instead.`);
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    return cookiePath;
+};
+
+exports.DEFAULT_AUTH_COOKIE_PATH = DEFAULT_AUTH_COOKIE_PATH;
+exports.resolveAuthCookiePath = resolveAuthCookiePath;
+//# sourceMappingURL=auth-cookie-path.js.map

package/dist/server/shared/utils/auth-cookie-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-path.js","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Path attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.path` so multiple Strapi instances on the same\n * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the path requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `/admin` to match the refresh-cookie path used by\n * `getRefreshCookieOptions`.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":";;AAAA;;;;;;;;;;;;;;IAeO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;IAGA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;;"}

package/dist/server/shared/utils/auth-cookie-path.mjs

@@ -0,0 +1,36 @@
+/**
+ * Path attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.path` so multiple Strapi instances on the same
+ * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the path requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `/admin` to match the refresh-cookie path used by
+ * `getRefreshCookieOptions`.
+ */ const DEFAULT_AUTH_COOKIE_PATH = '/admin';
+const isValidCookiePath = (path)=>{
+    if (!path.startsWith('/')) {
+        return false;
+    }
+    // RFC 6265 path-av: any CHAR except CTLs or ";".
+    return !/[\x00-\x1F\x7F;]/.test(path);
+};
+const resolveAuthCookiePath = (configuredPath, warn = console.warn)=>{
+    const cookiePath = (configuredPath || '').trim();
+    if (!cookiePath) {
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    if (!isValidCookiePath(cookiePath)) {
+        warn(`Ignoring invalid admin auth cookie path "${cookiePath}" (must be an absolute path without ";"); using "${DEFAULT_AUTH_COOKIE_PATH}" instead.`);
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    return cookiePath;
+};
+
+export { DEFAULT_AUTH_COOKIE_PATH, resolveAuthCookiePath };
+//# sourceMappingURL=auth-cookie-path.mjs.map

package/dist/server/shared/utils/auth-cookie-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-path.mjs","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Path attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.path` so multiple Strapi instances on the same\n * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the path requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `/admin` to match the refresh-cookie path used by\n * `getRefreshCookieOptions`.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":"AAAA;;;;;;;;;;;;;;IAeO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;IAGA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;"}

package/dist/server/shared/utils/session-auth.js

@@ -1,16 +1,35 @@
 'use strict';
 
 var crypto = require('crypto');
+var utils = require('@strapi/utils');
 var authCookieName = require('./auth-cookie-name.js');
+var authCookiePath = require('./auth-cookie-path.js');
+var authCookieDomain = require('./auth-cookie-domain.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 
+const ADMIN_ORIGIN = 'admin';
+const SESSION_CONTENT_TYPE = 'admin::session';
 const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';
+// The resolvers are browser-shared (also inlined into the admin bundle) so
+// they default to console.warn; on the server, route their warnings through
+// the Strapi logger instead.
+const warnViaStrapiLog = (message)=>{
+    strapi.log.warn(message);
+};
 const getAccessCookieName = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.name');
-    return authCookieName.resolveAuthCookieName(configured);
+    return authCookieName.resolveAuthCookieName(configured, warnViaStrapiLog);
+};
+const getAccessCookiePath = ()=>{
+    const configured = strapi.config.get('admin.auth.cookie.path');
+    return authCookiePath.resolveAuthCookiePath(configured, warnViaStrapiLog);
+};
+const getAccessCookieDomain = ()=>{
+    const configured = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
+    return authCookieDomain.resolveAuthCookieDomain(configured, warnViaStrapiLog);
 };
 const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;
 const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;
@@ -19,8 +38,8 @@ const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;
 const getRefreshCookieOptions = (secureRequest)=>{
     const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
     const isProduction = process.env.NODE_ENV === 'production';
-    const domain = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
-    const path = strapi.config.get('admin.auth.cookie.path', '/admin');
+    const domain = getAccessCookieDomain();
+    const path = getAccessCookiePath();
     const sameSite = strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';
     let isSecure;
     if (typeof configuredSecure === 'boolean') {
@@ -80,6 +99,34 @@ const extractDeviceParams = (requestBody)=>{
         rememberMe
     };
 };
+const buildSessionMetadataFromContext = (ctx)=>utils.buildSessionMetadata({
+        userAgent: ctx.request.headers['user-agent']
+    });
+/**
+ * Resolves the device id to use when revoking sessions on logout.
+ * SSO assigns deviceId server-side, so the client-provided value may not match
+ * the active session row. Prefer the deviceId stored on the session backing
+ * the current access token when available.
+ *
+ * Callers should pass `ctx.state.session.id` from the admin auth strategy and
+ * the already-parsed body `deviceId` — the logout route requires authentication,
+ * so sessionId is expected to be present.
+ */ const resolveLogoutDeviceId = async (userId, sessionId, clientDeviceId)=>{
+    if (!sessionId) {
+        strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');
+        return clientDeviceId;
+    }
+    const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({
+        where: {
+            sessionId
+        }
+    });
+    if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {
+        strapi.log.debug('resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId');
+        return clientDeviceId;
+    }
+    return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;
+};
 
 exports.DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN;
 exports.DEFAULT_IDLE_SESSION_LIFESPAN = DEFAULT_IDLE_SESSION_LIFESPAN;
@@ -87,9 +134,13 @@ exports.DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;
 exports.DEFAULT_MAX_SESSION_LIFESPAN = DEFAULT_MAX_SESSION_LIFESPAN;
 exports.REFRESH_COOKIE_NAME = REFRESH_COOKIE_NAME;
 exports.buildCookieOptionsWithExpiry = buildCookieOptionsWithExpiry;
+exports.buildSessionMetadataFromContext = buildSessionMetadataFromContext;
 exports.extractDeviceParams = extractDeviceParams;
 exports.generateDeviceId = generateDeviceId;
+exports.getAccessCookieDomain = getAccessCookieDomain;
 exports.getAccessCookieName = getAccessCookieName;
+exports.getAccessCookiePath = getAccessCookiePath;
 exports.getRefreshCookieOptions = getRefreshCookieOptions;
 exports.getSessionManager = getSessionManager;
+exports.resolveLogoutDeviceId = resolveLogoutDeviceId;
 //# sourceMappingURL=session-auth.js.map

package/dist/server/shared/utils/session-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Modules } from '@strapi/types';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  const path: string = strapi.config.get('admin.auth.cookie.path', '/admin');\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n"],"names":["REFRESH_COOKIE_NAME","getAccessCookieName","configured","strapi","config","get","resolveAuthCookieName","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean"],"mappings":";;;;;;;;;AAKO,MAAMA,sBAAsB;MAEtBC,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,oCAAAA,CAAsBJ,UAAAA,CAAAA;AAC/B;AAEO,MAAMK,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBV,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMS,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;IAE9C,MAAMC,MAAAA,GACJf,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BF,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,MAAMc,OAAehB,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,wBAAA,EAA0B,QAAA,CAAA;AAEjE,IAAA,MAAMe,WACJjB,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIgB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClB3B,MAAAA,CAAOC,MAAM,CAACC,GAAG,CACf,8CAAA,EACAG,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjB3B,MAAAA,CAAOC,MAAM,CAACC,GAAG,CACf,6CAAA,EACAE,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAU3C,OAAO4C,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;;;;;;;;;;;;;;"}
+{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookiePath = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.path');\n  return resolveAuthCookiePath(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getAccessCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","getAccessCookiePath","resolveAuthCookiePath","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;;;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,qCAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaU,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMJ,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOG,qCAAsBL,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaY,qBAAAA,GAAwB,IAAA;IACnC,MAAMN,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAOK,yCAAwBP,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMc,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBlB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMa,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOhB,mBAAAA,EAAAA;AAEb,IAAA,MAAMiB,WACJzB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIoB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAO,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAM,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnD,OAAOoD,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,0BAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACdtE,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMzE,MAAAA,CAAO0E,EAAE,CAACC,KAAK,CAAC/E,oBAAAA,CAAAA,CAAsBgF,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAWnF,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;;;;;;;;;;;;;;;"}

package/dist/server/shared/utils/session-auth.mjs

@@ -1,10 +1,29 @@
 import crypto from 'crypto';
+import { buildSessionMetadata } from '@strapi/utils';
 import { resolveAuthCookieName } from './auth-cookie-name.mjs';
+import { resolveAuthCookiePath } from './auth-cookie-path.mjs';
+import { resolveAuthCookieDomain } from './auth-cookie-domain.mjs';
 
+const ADMIN_ORIGIN = 'admin';
+const SESSION_CONTENT_TYPE = 'admin::session';
 const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';
+// The resolvers are browser-shared (also inlined into the admin bundle) so
+// they default to console.warn; on the server, route their warnings through
+// the Strapi logger instead.
+const warnViaStrapiLog = (message)=>{
+    strapi.log.warn(message);
+};
 const getAccessCookieName = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.name');
-    return resolveAuthCookieName(configured);
+    return resolveAuthCookieName(configured, warnViaStrapiLog);
+};
+const getAccessCookiePath = ()=>{
+    const configured = strapi.config.get('admin.auth.cookie.path');
+    return resolveAuthCookiePath(configured, warnViaStrapiLog);
+};
+const getAccessCookieDomain = ()=>{
+    const configured = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
+    return resolveAuthCookieDomain(configured, warnViaStrapiLog);
 };
 const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;
 const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;
@@ -13,8 +32,8 @@ const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;
 const getRefreshCookieOptions = (secureRequest)=>{
     const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
     const isProduction = process.env.NODE_ENV === 'production';
-    const domain = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
-    const path = strapi.config.get('admin.auth.cookie.path', '/admin');
+    const domain = getAccessCookieDomain();
+    const path = getAccessCookiePath();
     const sameSite = strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';
     let isSecure;
     if (typeof configuredSecure === 'boolean') {
@@ -74,6 +93,34 @@ const extractDeviceParams = (requestBody)=>{
         rememberMe
     };
 };
+const buildSessionMetadataFromContext = (ctx)=>buildSessionMetadata({
+        userAgent: ctx.request.headers['user-agent']
+    });
+/**
+ * Resolves the device id to use when revoking sessions on logout.
+ * SSO assigns deviceId server-side, so the client-provided value may not match
+ * the active session row. Prefer the deviceId stored on the session backing
+ * the current access token when available.
+ *
+ * Callers should pass `ctx.state.session.id` from the admin auth strategy and
+ * the already-parsed body `deviceId` — the logout route requires authentication,
+ * so sessionId is expected to be present.
+ */ const resolveLogoutDeviceId = async (userId, sessionId, clientDeviceId)=>{
+    if (!sessionId) {
+        strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');
+        return clientDeviceId;
+    }
+    const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({
+        where: {
+            sessionId
+        }
+    });
+    if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {
+        strapi.log.debug('resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId');
+        return clientDeviceId;
+    }
+    return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;
+};
 
-export { DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, REFRESH_COOKIE_NAME, buildCookieOptionsWithExpiry, extractDeviceParams, generateDeviceId, getAccessCookieName, getRefreshCookieOptions, getSessionManager };
+export { DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, REFRESH_COOKIE_NAME, buildCookieOptionsWithExpiry, buildSessionMetadataFromContext, extractDeviceParams, generateDeviceId, getAccessCookieDomain, getAccessCookieName, getAccessCookiePath, getRefreshCookieOptions, getSessionManager, resolveLogoutDeviceId };
 //# sourceMappingURL=session-auth.mjs.map

package/dist/server/shared/utils/session-auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-auth.mjs","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Modules } from '@strapi/types';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  const path: string = strapi.config.get('admin.auth.cookie.path', '/admin');\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n"],"names":["REFRESH_COOKIE_NAME","getAccessCookieName","configured","strapi","config","get","resolveAuthCookieName","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean"],"mappings":";;;AAKO,MAAMA,sBAAsB;MAEtBC,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,qBAAAA,CAAsBJ,UAAAA,CAAAA;AAC/B;AAEO,MAAMK,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBV,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMS,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;IAE9C,MAAMC,MAAAA,GACJf,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BF,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,MAAMc,OAAehB,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,wBAAA,EAA0B,QAAA,CAAA;AAEjE,IAAA,MAAMe,WACJjB,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIgB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClB3B,MAAAA,CAAOC,MAAM,CAACC,GAAG,CACf,8CAAA,EACAG,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjB3B,MAAAA,CAAOC,MAAM,CAACC,GAAG,CACf,6CAAA,EACAE,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAU3C,OAAO4C,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,MAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;;;;"}
+{"version":3,"file":"session-auth.mjs","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookiePath = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.path');\n  return resolveAuthCookiePath(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getAccessCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","getAccessCookiePath","resolveAuthCookiePath","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,sBAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaU,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMJ,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOG,sBAAsBL,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaY,qBAAAA,GAAwB,IAAA;IACnC,MAAMN,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAOK,wBAAwBP,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMc,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBlB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMa,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOhB,mBAAAA,EAAAA;AAEb,IAAA,MAAMiB,WACJzB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIoB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAO,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAM,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnD,OAAOoD,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,MAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,oBAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACdtE,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMzE,MAAAA,CAAO0E,EAAE,CAACC,KAAK,CAAC/E,oBAAAA,CAAAA,CAAsBgF,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAWnF,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;"}

package/dist/server/src/content-types/User.d.ts

@@ -58,6 +58,12 @@ declare const _default: {
             private: boolean;
             searchable: boolean;
         };
+        resetPasswordTokenExpiresAt: {
+            type: string;
+            configurable: boolean;
+            private: boolean;
+            searchable: boolean;
+        };
         registrationToken: {
             type: string;
             configurable: boolean;

package/dist/server/src/content-types/User.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../../server/src/content-types/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wBAiHE"}
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../../server/src/content-types/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wBAuHE"}

package/dist/server/src/content-types/index.d.ts

@@ -129,6 +129,12 @@ declare const _default: {
                     private: boolean;
                     searchable: boolean;
                 };
+                resetPasswordTokenExpiresAt: {
+                    type: string;
+                    configurable: boolean;
+                    private: boolean;
+                    searchable: boolean;
+                };
                 registrationToken: {
                     type: string;
                     configurable: boolean;

package/dist/server/src/content-types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/content-types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,wBASE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/content-types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,wBASE"}

package/dist/server/src/controllers/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,KAAK,CAAC;AAGzC,OAAO,eAAe,CAAC;;;0BAwHO,OAAO;kBAcf,OAAO;uBAiDF,OAAO;wBAmDN,OAAO;uBAUR,OAAO;qBAsDT,OAAO;gBAyCZ,OAAO;;AA7S3B,wBAsUE"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,KAAK,CAAC;AAGzC,OAAO,eAAe,CAAC;;;0BAqHO,OAAO;kBAcf,OAAO;uBAiDF,OAAO;wBAmDN,OAAO;uBAUR,OAAO;qBAsDT,OAAO;gBAyCZ,OAAO;;AA7S3B,wBA2UE"}

package/dist/server/src/domain/user.d.ts

@@ -10,6 +10,7 @@ export declare function createUser(attributes: Partial<AdminUserCreationPayload>
     email?: string | undefined;
     password?: string | undefined;
     resetPasswordToken?: string | null | undefined;
+    resetPasswordTokenExpiresAt?: (string | Date | null) | undefined;
     registrationToken?: string | null | undefined;
     preferedLanguage?: string | undefined;
     roles: import("@strapi/types/dist/data/constants.js").ID[];

package/dist/server/src/domain/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../server/src/domain/user.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,SAAS,EAET,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAI1C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC;;;;;;;;;;;EAOvE;AAED,eAAO,MAAM,iBAAiB,GAAI,MAAM,SAAS,YAEhD,CAAC;AAEF,eAAO,MAAM,yBAAyB,UAOrC,CAAC;;;8BAXsC,SAAS;;;AAajD,wBAIE"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../server/src/domain/user.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,SAAS,EAET,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAI1C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC;;;;;;;;;;;;EAOvE;AAED,eAAO,MAAM,iBAAiB,GAAI,MAAM,SAAS,YAEhD,CAAC;AAEF,eAAO,MAAM,yBAAyB,UAOrC,CAAC;;;8BAXsC,SAAS;;;AAajD,wBAIE"}

package/dist/server/src/index.d.ts

@@ -500,6 +500,12 @@ declare let admin: {
                         private: boolean;
                         searchable: boolean;
                     };
+                    resetPasswordTokenExpiresAt: {
+                        type: string;
+                        configurable: boolean;
+                        private: boolean;
+                        searchable: boolean;
+                    };
                     registrationToken: {
                         type: string;
                         configurable: boolean;

package/dist/server/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/src/index.ts"],"names":[],"mappings":"AAeA,QAAA,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;sBAPG,GAAG;;;;;sBAAH,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6Bm5C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA3B/4C,0BAAY,EAAC,wBACjC;gCAPe,0BAAW,EAAC,wBACtB;;CAqBJ,CAAC;AAUF,eAAe,KAAK,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/src/index.ts"],"names":[],"mappings":"AAeA,QAAA,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;sBAPG,GAAG;;;;;sBAAH,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6Bu9C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA3Bn9C,0BAAY,EAAC,wBACjC;gCAPe,0BAAW,EAAC,wBACtB;;CAqBJ,CAAC;AAUF,eAAe,KAAK,CAAC"}