@strapi/admin 5.50.2 → 5.51.1

package/dist/server/ee/server/src/audit-logs/services/audit-logs.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logs.js","sources":["../../../../../../../ee/server/src/audit-logs/services/audit-logs.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\ninterface Event {\n  action: string;\n  date: Date;\n  userId: string | number;\n  payload: Record<string, unknown>;\n}\n\ninterface Log extends Omit<Event, 'userId'> {\n  user: string | number;\n}\n\nconst getSanitizedUser = (user: any) => {\n  let displayName = user.email;\n\n  if (user.username) {\n    displayName = user.username;\n  } else if (user.firstname && user.lastname) {\n    displayName = `${user.firstname} ${user.lastname}`;\n  }\n\n  return {\n    id: user.id,\n    email: user.email,\n    displayName,\n  };\n};\n\n/**\n * @description\n * Manages audit logs interaction with the database. Accessible via strapi.get('audit-logs')\n */\nconst createAuditLogsService = (strapi: Core.Strapi) => {\n  return {\n    async saveEvent(event: Event) {\n      const { userId, ...rest } = event;\n\n      const auditLog: Log = { ...rest, user: userId };\n\n      // Save to database\n      await strapi.db?.query('admin::audit-log').create({ data: auditLog });\n\n      return this;\n    },\n\n    async findMany(query: unknown) {\n      const { results, pagination } = await strapi.db?.query('admin::audit-log').findPage({\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n        ...strapi.get('query-params').transform('admin::audit-log', query),\n      });\n\n      const sanitizedResults = results.map((result: any) => {\n        const { user, ...rest } = result;\n        return {\n          ...rest,\n          user: user ? getSanitizedUser(user) : null,\n        };\n      });\n\n      return {\n        results: sanitizedResults,\n        pagination,\n      };\n    },\n\n    async findOne(id: unknown) {\n      const result: any = await strapi.db?.query('admin::audit-log').findOne({\n        where: { id },\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n      });\n\n      if (!result) {\n        return null;\n      }\n\n      const { user, ...rest } = result;\n      return {\n        ...rest,\n        user: user ? getSanitizedUser(user) : null,\n      };\n    },\n\n    deleteExpiredEvents(expirationDate: Date) {\n      return strapi.db?.query('admin::audit-log').deleteMany({\n        where: {\n          date: {\n            $lt: expirationDate.toISOString(),\n          },\n        },\n      });\n    },\n  };\n};\n\nexport { createAuditLogsService };\n"],"names":["getSanitizedUser","user","displayName","email","username","firstname","lastname","id","createAuditLogsService","strapi","saveEvent","event","userId","rest","auditLog","db","query","create","data","findMany","results","pagination","findPage","populate","select","get","transform","sanitizedResults","map","result","findOne","where","deleteExpiredEvents","expirationDate","deleteMany","date","$lt","toISOString"],"mappings":";;AAaA,MAAMA,mBAAmB,CAACC,IAAAA,GAAAA;IACxB,IAAIC,WAAAA,GAAcD,KAAKE,KAAK;IAE5B,IAAIF,IAAAA,CAAKG,QAAQ,EAAE;AACjBF,QAAAA,WAAAA,GAAcD,KAAKG,QAAQ;AAC7B,IAAA,CAAA,MAAO,IAAIH,IAAAA,CAAKI,SAAS,IAAIJ,IAAAA,CAAKK,QAAQ,EAAE;QAC1CJ,WAAAA,GAAc,CAAA,EAAGD,KAAKI,SAAS,CAAC,CAAC,EAAEJ,IAAAA,CAAKK,QAAQ,CAAA,CAAE;AACpD,IAAA;IAEA,OAAO;AACLC,QAAAA,EAAAA,EAAIN,KAAKM,EAAE;AACXJ,QAAAA,KAAAA,EAAOF,KAAKE,KAAK;AACjBD,QAAAA;AACF,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMM,yBAAyB,CAACC,MAAAA,GAAAA;IAC9B,OAAO;AACL,QAAA,MAAMC,WAAUC,KAAY,EAAA;AAC1B,YAAA,MAAM,EAAEC,MAAM,EAAE,GAAGC,MAAM,GAAGF,KAAAA;AAE5B,YAAA,MAAMG,QAAAA,GAAgB;AAAE,gBAAA,GAAGD,IAAI;gBAAEZ,IAAAA,EAAMW;AAAO,aAAA;;AAG9C,YAAA,MAAMH,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBC,MAAAA,CAAO;gBAAEC,IAAAA,EAAMJ;AAAS,aAAA,CAAA;AAEnE,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEA,QAAA,MAAMK,UAASH,KAAc,EAAA;AAC3B,YAAA,MAAM,EAAEI,OAAO,EAAEC,UAAU,EAAE,GAAG,MAAMZ,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,kBAAA,CAAA,CAAoBM,QAAAA,CAAS;gBAClFC,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU,iBAAA;AACrC,gBAAA,GAAGf,OAAOgB,GAAG,CAAC,gBAAgBC,SAAS,CAAC,oBAAoBV,KAAAA;AAC9D,aAAA,CAAA;AAEA,YAAA,MAAMW,gBAAAA,GAAmBP,OAAAA,CAAQQ,GAAG,CAAC,CAACC,MAAAA,GAAAA;AACpC,gBAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;gBAC1B,OAAO;AACL,oBAAA,GAAGhB,IAAI;oBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,iBAAA;AACF,YAAA,CAAA,CAAA;YAEA,OAAO;gBACLmB,OAAAA,EAASO,gBAAAA;AACTN,gBAAAA;AACF,aAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMS,SAAQvB,EAAW,EAAA;AACvB,YAAA,MAAMsB,SAAc,MAAMpB,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBc,OAAAA,CAAQ;gBACrEC,KAAAA,EAAO;AAAExB,oBAAAA;AAAG,iBAAA;gBACZgB,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU;AACvC,aAAA,CAAA;AAEA,YAAA,IAAI,CAACK,MAAAA,EAAQ;gBACX,OAAO,IAAA;AACT,YAAA;AAEA,YAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;YAC1B,OAAO;AACL,gBAAA,GAAGhB,IAAI;gBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,aAAA;AACF,QAAA,CAAA;AAEA+B,QAAAA,mBAAAA,CAAAA,CAAoBC,cAAoB,EAAA;AACtC,YAAA,OAAOxB,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBkB,UAAAA,CAAW;gBACrDH,KAAAA,EAAO;oBACLI,IAAAA,EAAM;AACJC,wBAAAA,GAAAA,EAAKH,eAAeI,WAAW;AACjC;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"audit-logs.js","sources":["../../../../../../../ee/server/src/audit-logs/services/audit-logs.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\ninterface Event {\n  action: string;\n  date: Date;\n  userId: string | number;\n  payload: Record<string, unknown>;\n}\n\ninterface Log extends Omit<Event, 'userId'> {\n  user: string | number;\n}\n\nconst getSanitizedUser = (user: any) => {\n  let displayName = user.email;\n\n  if (user.username) {\n    displayName = user.username;\n  } else if (user.firstname && user.lastname) {\n    displayName = `${user.firstname} ${user.lastname}`;\n  }\n\n  return {\n    id: user.id,\n    email: user.email,\n    displayName,\n  };\n};\n\n/**\n * @description\n * Manages audit logs interaction with the database. Accessible via strapi.get('audit-logs')\n */\nconst createAuditLogsService = (strapi: Core.Strapi) => {\n  return {\n    async saveEvent(event: Event) {\n      const { userId, ...rest } = event;\n\n      const auditLog: Log = { ...rest, user: userId };\n\n      // Save to database\n      await strapi.db?.query('admin::audit-log').create({ data: auditLog });\n\n      return this;\n    },\n\n    async findMany(query: unknown) {\n      const { results, pagination } = await strapi.db.query('admin::audit-log').findPage({\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n        ...strapi.get('query-params').transform('admin::audit-log', query),\n      });\n\n      const sanitizedResults = results.map((result: any) => {\n        const { user, ...rest } = result;\n        return {\n          ...rest,\n          user: user ? getSanitizedUser(user) : null,\n        };\n      });\n\n      return {\n        results: sanitizedResults,\n        pagination,\n      };\n    },\n\n    async findManyUsers(query: { page?: number | string; pageSize?: number | string }) {\n      const { page = 1, pageSize = 10 } = query;\n\n      const userAttribute = strapi.db.metadata.get('admin::audit-log').attributes.user;\n\n      if (\n        userAttribute?.type !== 'relation' ||\n        !('joinTable' in userAttribute) ||\n        !userAttribute.joinTable ||\n        !('inverseJoinColumn' in userAttribute.joinTable)\n      ) {\n        throw new Error('The audit log user relation is expected to use a join table');\n      }\n\n      const { joinTable } = userAttribute;\n\n      const authorIds = await strapi.db\n        .connection(joinTable.name)\n        .distinct(joinTable.inverseJoinColumn.name)\n        .pluck(joinTable.inverseJoinColumn.name);\n\n      const { results, pagination } = await strapi.db.query('admin::user').findPage({\n        select: ['id', 'email', 'username', 'firstname', 'lastname'],\n        where: { id: { $in: authorIds } },\n        orderBy: { id: 'asc' },\n        page: Number(page),\n        pageSize: Number(pageSize),\n      });\n\n      return {\n        results: results.map(getSanitizedUser),\n        pagination,\n      };\n    },\n\n    async findOne(id: unknown) {\n      const result: any = await strapi.db?.query('admin::audit-log').findOne({\n        where: { id },\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n      });\n\n      if (!result) {\n        return null;\n      }\n\n      const { user, ...rest } = result;\n      return {\n        ...rest,\n        user: user ? getSanitizedUser(user) : null,\n      };\n    },\n\n    deleteExpiredEvents(expirationDate: Date) {\n      return strapi.db?.query('admin::audit-log').deleteMany({\n        where: {\n          date: {\n            $lt: expirationDate.toISOString(),\n          },\n        },\n      });\n    },\n  };\n};\n\nexport { createAuditLogsService };\n"],"names":["getSanitizedUser","user","displayName","email","username","firstname","lastname","id","createAuditLogsService","strapi","saveEvent","event","userId","rest","auditLog","db","query","create","data","findMany","results","pagination","findPage","populate","select","get","transform","sanitizedResults","map","result","findManyUsers","page","pageSize","userAttribute","metadata","attributes","type","joinTable","Error","authorIds","connection","name","distinct","inverseJoinColumn","pluck","where","$in","orderBy","Number","findOne","deleteExpiredEvents","expirationDate","deleteMany","date","$lt","toISOString"],"mappings":";;AAaA,MAAMA,mBAAmB,CAACC,IAAAA,GAAAA;IACxB,IAAIC,WAAAA,GAAcD,KAAKE,KAAK;IAE5B,IAAIF,IAAAA,CAAKG,QAAQ,EAAE;AACjBF,QAAAA,WAAAA,GAAcD,KAAKG,QAAQ;AAC7B,IAAA,CAAA,MAAO,IAAIH,IAAAA,CAAKI,SAAS,IAAIJ,IAAAA,CAAKK,QAAQ,EAAE;QAC1CJ,WAAAA,GAAc,CAAA,EAAGD,KAAKI,SAAS,CAAC,CAAC,EAAEJ,IAAAA,CAAKK,QAAQ,CAAA,CAAE;AACpD,IAAA;IAEA,OAAO;AACLC,QAAAA,EAAAA,EAAIN,KAAKM,EAAE;AACXJ,QAAAA,KAAAA,EAAOF,KAAKE,KAAK;AACjBD,QAAAA;AACF,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMM,yBAAyB,CAACC,MAAAA,GAAAA;IAC9B,OAAO;AACL,QAAA,MAAMC,WAAUC,KAAY,EAAA;AAC1B,YAAA,MAAM,EAAEC,MAAM,EAAE,GAAGC,MAAM,GAAGF,KAAAA;AAE5B,YAAA,MAAMG,QAAAA,GAAgB;AAAE,gBAAA,GAAGD,IAAI;gBAAEZ,IAAAA,EAAMW;AAAO,aAAA;;AAG9C,YAAA,MAAMH,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBC,MAAAA,CAAO;gBAAEC,IAAAA,EAAMJ;AAAS,aAAA,CAAA;AAEnE,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEA,QAAA,MAAMK,UAASH,KAAc,EAAA;AAC3B,YAAA,MAAM,EAAEI,OAAO,EAAEC,UAAU,EAAE,GAAG,MAAMZ,MAAAA,CAAOM,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBM,QAAQ,CAAC;gBACjFC,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU,iBAAA;AACrC,gBAAA,GAAGf,OAAOgB,GAAG,CAAC,gBAAgBC,SAAS,CAAC,oBAAoBV,KAAAA;AAC9D,aAAA,CAAA;AAEA,YAAA,MAAMW,gBAAAA,GAAmBP,OAAAA,CAAQQ,GAAG,CAAC,CAACC,MAAAA,GAAAA;AACpC,gBAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;gBAC1B,OAAO;AACL,oBAAA,GAAGhB,IAAI;oBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,iBAAA;AACF,YAAA,CAAA,CAAA;YAEA,OAAO;gBACLmB,OAAAA,EAASO,gBAAAA;AACTN,gBAAAA;AACF,aAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMS,eAAcd,KAA6D,EAAA;AAC/E,YAAA,MAAM,EAAEe,IAAAA,GAAO,CAAC,EAAEC,QAAAA,GAAW,EAAE,EAAE,GAAGhB,KAAAA;YAEpC,MAAMiB,aAAAA,GAAgBxB,MAAAA,CAAOM,EAAE,CAACmB,QAAQ,CAACT,GAAG,CAAC,kBAAA,CAAA,CAAoBU,UAAU,CAAClC,IAAI;AAEhF,YAAA,IACEgC,eAAeG,IAAAA,KAAS,UAAA,IACxB,EAAE,WAAA,IAAeH,aAAY,CAAA,IAC7B,CAACA,aAAAA,CAAcI,SAAS,IACxB,EAAE,uBAAuBJ,aAAAA,CAAcI,SAAS,CAAD,EAC/C;AACA,gBAAA,MAAM,IAAIC,KAAAA,CAAM,6DAAA,CAAA;AAClB,YAAA;YAEA,MAAM,EAAED,SAAS,EAAE,GAAGJ,aAAAA;YAEtB,MAAMM,SAAAA,GAAY,MAAM9B,MAAAA,CAAOM,EAAE,CAC9ByB,UAAU,CAACH,SAAAA,CAAUI,IAAI,CAAA,CACzBC,QAAQ,CAACL,SAAAA,CAAUM,iBAAiB,CAACF,IAAI,CAAA,CACzCG,KAAK,CAACP,SAAAA,CAAUM,iBAAiB,CAACF,IAAI,CAAA;AAEzC,YAAA,MAAM,EAAErB,OAAO,EAAEC,UAAU,EAAE,GAAG,MAAMZ,MAAAA,CAAOM,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeM,QAAQ,CAAC;gBAC5EE,MAAAA,EAAQ;AAAC,oBAAA,IAAA;AAAM,oBAAA,OAAA;AAAS,oBAAA,UAAA;AAAY,oBAAA,WAAA;AAAa,oBAAA;AAAW,iBAAA;gBAC5DqB,KAAAA,EAAO;oBAAEtC,EAAAA,EAAI;wBAAEuC,GAAAA,EAAKP;AAAU;AAAE,iBAAA;gBAChCQ,OAAAA,EAAS;oBAAExC,EAAAA,EAAI;AAAM,iBAAA;AACrBwB,gBAAAA,IAAAA,EAAMiB,MAAAA,CAAOjB,IAAAA,CAAAA;AACbC,gBAAAA,QAAAA,EAAUgB,MAAAA,CAAOhB,QAAAA;AACnB,aAAA,CAAA;YAEA,OAAO;gBACLZ,OAAAA,EAASA,OAAAA,CAAQQ,GAAG,CAAC5B,gBAAAA,CAAAA;AACrBqB,gBAAAA;AACF,aAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAM4B,SAAQ1C,EAAW,EAAA;AACvB,YAAA,MAAMsB,SAAc,MAAMpB,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBiC,OAAAA,CAAQ;gBACrEJ,KAAAA,EAAO;AAAEtC,oBAAAA;AAAG,iBAAA;gBACZgB,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU;AACvC,aAAA,CAAA;AAEA,YAAA,IAAI,CAACK,MAAAA,EAAQ;gBACX,OAAO,IAAA;AACT,YAAA;AAEA,YAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;YAC1B,OAAO;AACL,gBAAA,GAAGhB,IAAI;gBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,aAAA;AACF,QAAA,CAAA;AAEAiD,QAAAA,mBAAAA,CAAAA,CAAoBC,cAAoB,EAAA;AACtC,YAAA,OAAO1C,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBoC,UAAAA,CAAW;gBACrDP,KAAAA,EAAO;oBACLQ,IAAAA,EAAM;AACJC,wBAAAA,GAAAA,EAAKH,eAAeI,WAAW;AACjC;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,KAAA;AACF;;;;"}

package/dist/server/ee/server/src/audit-logs/services/audit-logs.mjs

@@ -29,7 +29,7 @@ const getSanitizedUser = (user)=>{
             return this;
         },
         async findMany (query) {
-            const { results, pagination } = await strapi.db?.query('admin::audit-log').findPage({
+            const { results, pagination } = await strapi.db.query('admin::audit-log').findPage({
                 populate: [
                     'user'
                 ],
@@ -52,6 +52,38 @@ const getSanitizedUser = (user)=>{
                 pagination
             };
         },
+        async findManyUsers (query) {
+            const { page = 1, pageSize = 10 } = query;
+            const userAttribute = strapi.db.metadata.get('admin::audit-log').attributes.user;
+            if (userAttribute?.type !== 'relation' || !('joinTable' in userAttribute) || !userAttribute.joinTable || !('inverseJoinColumn' in userAttribute.joinTable)) {
+                throw new Error('The audit log user relation is expected to use a join table');
+            }
+            const { joinTable } = userAttribute;
+            const authorIds = await strapi.db.connection(joinTable.name).distinct(joinTable.inverseJoinColumn.name).pluck(joinTable.inverseJoinColumn.name);
+            const { results, pagination } = await strapi.db.query('admin::user').findPage({
+                select: [
+                    'id',
+                    'email',
+                    'username',
+                    'firstname',
+                    'lastname'
+                ],
+                where: {
+                    id: {
+                        $in: authorIds
+                    }
+                },
+                orderBy: {
+                    id: 'asc'
+                },
+                page: Number(page),
+                pageSize: Number(pageSize)
+            });
+            return {
+                results: results.map(getSanitizedUser),
+                pagination
+            };
+        },
         async findOne (id) {
             const result = await strapi.db?.query('admin::audit-log').findOne({
                 where: {

package/dist/server/ee/server/src/audit-logs/services/audit-logs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logs.mjs","sources":["../../../../../../../ee/server/src/audit-logs/services/audit-logs.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\ninterface Event {\n  action: string;\n  date: Date;\n  userId: string | number;\n  payload: Record<string, unknown>;\n}\n\ninterface Log extends Omit<Event, 'userId'> {\n  user: string | number;\n}\n\nconst getSanitizedUser = (user: any) => {\n  let displayName = user.email;\n\n  if (user.username) {\n    displayName = user.username;\n  } else if (user.firstname && user.lastname) {\n    displayName = `${user.firstname} ${user.lastname}`;\n  }\n\n  return {\n    id: user.id,\n    email: user.email,\n    displayName,\n  };\n};\n\n/**\n * @description\n * Manages audit logs interaction with the database. Accessible via strapi.get('audit-logs')\n */\nconst createAuditLogsService = (strapi: Core.Strapi) => {\n  return {\n    async saveEvent(event: Event) {\n      const { userId, ...rest } = event;\n\n      const auditLog: Log = { ...rest, user: userId };\n\n      // Save to database\n      await strapi.db?.query('admin::audit-log').create({ data: auditLog });\n\n      return this;\n    },\n\n    async findMany(query: unknown) {\n      const { results, pagination } = await strapi.db?.query('admin::audit-log').findPage({\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n        ...strapi.get('query-params').transform('admin::audit-log', query),\n      });\n\n      const sanitizedResults = results.map((result: any) => {\n        const { user, ...rest } = result;\n        return {\n          ...rest,\n          user: user ? getSanitizedUser(user) : null,\n        };\n      });\n\n      return {\n        results: sanitizedResults,\n        pagination,\n      };\n    },\n\n    async findOne(id: unknown) {\n      const result: any = await strapi.db?.query('admin::audit-log').findOne({\n        where: { id },\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n      });\n\n      if (!result) {\n        return null;\n      }\n\n      const { user, ...rest } = result;\n      return {\n        ...rest,\n        user: user ? getSanitizedUser(user) : null,\n      };\n    },\n\n    deleteExpiredEvents(expirationDate: Date) {\n      return strapi.db?.query('admin::audit-log').deleteMany({\n        where: {\n          date: {\n            $lt: expirationDate.toISOString(),\n          },\n        },\n      });\n    },\n  };\n};\n\nexport { createAuditLogsService };\n"],"names":["getSanitizedUser","user","displayName","email","username","firstname","lastname","id","createAuditLogsService","strapi","saveEvent","event","userId","rest","auditLog","db","query","create","data","findMany","results","pagination","findPage","populate","select","get","transform","sanitizedResults","map","result","findOne","where","deleteExpiredEvents","expirationDate","deleteMany","date","$lt","toISOString"],"mappings":"AAaA,MAAMA,mBAAmB,CAACC,IAAAA,GAAAA;IACxB,IAAIC,WAAAA,GAAcD,KAAKE,KAAK;IAE5B,IAAIF,IAAAA,CAAKG,QAAQ,EAAE;AACjBF,QAAAA,WAAAA,GAAcD,KAAKG,QAAQ;AAC7B,IAAA,CAAA,MAAO,IAAIH,IAAAA,CAAKI,SAAS,IAAIJ,IAAAA,CAAKK,QAAQ,EAAE;QAC1CJ,WAAAA,GAAc,CAAA,EAAGD,KAAKI,SAAS,CAAC,CAAC,EAAEJ,IAAAA,CAAKK,QAAQ,CAAA,CAAE;AACpD,IAAA;IAEA,OAAO;AACLC,QAAAA,EAAAA,EAAIN,KAAKM,EAAE;AACXJ,QAAAA,KAAAA,EAAOF,KAAKE,KAAK;AACjBD,QAAAA;AACF,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMM,yBAAyB,CAACC,MAAAA,GAAAA;IAC9B,OAAO;AACL,QAAA,MAAMC,WAAUC,KAAY,EAAA;AAC1B,YAAA,MAAM,EAAEC,MAAM,EAAE,GAAGC,MAAM,GAAGF,KAAAA;AAE5B,YAAA,MAAMG,QAAAA,GAAgB;AAAE,gBAAA,GAAGD,IAAI;gBAAEZ,IAAAA,EAAMW;AAAO,aAAA;;AAG9C,YAAA,MAAMH,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBC,MAAAA,CAAO;gBAAEC,IAAAA,EAAMJ;AAAS,aAAA,CAAA;AAEnE,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEA,QAAA,MAAMK,UAASH,KAAc,EAAA;AAC3B,YAAA,MAAM,EAAEI,OAAO,EAAEC,UAAU,EAAE,GAAG,MAAMZ,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,kBAAA,CAAA,CAAoBM,QAAAA,CAAS;gBAClFC,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU,iBAAA;AACrC,gBAAA,GAAGf,OAAOgB,GAAG,CAAC,gBAAgBC,SAAS,CAAC,oBAAoBV,KAAAA;AAC9D,aAAA,CAAA;AAEA,YAAA,MAAMW,gBAAAA,GAAmBP,OAAAA,CAAQQ,GAAG,CAAC,CAACC,MAAAA,GAAAA;AACpC,gBAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;gBAC1B,OAAO;AACL,oBAAA,GAAGhB,IAAI;oBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,iBAAA;AACF,YAAA,CAAA,CAAA;YAEA,OAAO;gBACLmB,OAAAA,EAASO,gBAAAA;AACTN,gBAAAA;AACF,aAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMS,SAAQvB,EAAW,EAAA;AACvB,YAAA,MAAMsB,SAAc,MAAMpB,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBc,OAAAA,CAAQ;gBACrEC,KAAAA,EAAO;AAAExB,oBAAAA;AAAG,iBAAA;gBACZgB,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU;AACvC,aAAA,CAAA;AAEA,YAAA,IAAI,CAACK,MAAAA,EAAQ;gBACX,OAAO,IAAA;AACT,YAAA;AAEA,YAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;YAC1B,OAAO;AACL,gBAAA,GAAGhB,IAAI;gBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,aAAA;AACF,QAAA,CAAA;AAEA+B,QAAAA,mBAAAA,CAAAA,CAAoBC,cAAoB,EAAA;AACtC,YAAA,OAAOxB,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBkB,UAAAA,CAAW;gBACrDH,KAAAA,EAAO;oBACLI,IAAAA,EAAM;AACJC,wBAAAA,GAAAA,EAAKH,eAAeI,WAAW;AACjC;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"audit-logs.mjs","sources":["../../../../../../../ee/server/src/audit-logs/services/audit-logs.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\ninterface Event {\n  action: string;\n  date: Date;\n  userId: string | number;\n  payload: Record<string, unknown>;\n}\n\ninterface Log extends Omit<Event, 'userId'> {\n  user: string | number;\n}\n\nconst getSanitizedUser = (user: any) => {\n  let displayName = user.email;\n\n  if (user.username) {\n    displayName = user.username;\n  } else if (user.firstname && user.lastname) {\n    displayName = `${user.firstname} ${user.lastname}`;\n  }\n\n  return {\n    id: user.id,\n    email: user.email,\n    displayName,\n  };\n};\n\n/**\n * @description\n * Manages audit logs interaction with the database. Accessible via strapi.get('audit-logs')\n */\nconst createAuditLogsService = (strapi: Core.Strapi) => {\n  return {\n    async saveEvent(event: Event) {\n      const { userId, ...rest } = event;\n\n      const auditLog: Log = { ...rest, user: userId };\n\n      // Save to database\n      await strapi.db?.query('admin::audit-log').create({ data: auditLog });\n\n      return this;\n    },\n\n    async findMany(query: unknown) {\n      const { results, pagination } = await strapi.db.query('admin::audit-log').findPage({\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n        ...strapi.get('query-params').transform('admin::audit-log', query),\n      });\n\n      const sanitizedResults = results.map((result: any) => {\n        const { user, ...rest } = result;\n        return {\n          ...rest,\n          user: user ? getSanitizedUser(user) : null,\n        };\n      });\n\n      return {\n        results: sanitizedResults,\n        pagination,\n      };\n    },\n\n    async findManyUsers(query: { page?: number | string; pageSize?: number | string }) {\n      const { page = 1, pageSize = 10 } = query;\n\n      const userAttribute = strapi.db.metadata.get('admin::audit-log').attributes.user;\n\n      if (\n        userAttribute?.type !== 'relation' ||\n        !('joinTable' in userAttribute) ||\n        !userAttribute.joinTable ||\n        !('inverseJoinColumn' in userAttribute.joinTable)\n      ) {\n        throw new Error('The audit log user relation is expected to use a join table');\n      }\n\n      const { joinTable } = userAttribute;\n\n      const authorIds = await strapi.db\n        .connection(joinTable.name)\n        .distinct(joinTable.inverseJoinColumn.name)\n        .pluck(joinTable.inverseJoinColumn.name);\n\n      const { results, pagination } = await strapi.db.query('admin::user').findPage({\n        select: ['id', 'email', 'username', 'firstname', 'lastname'],\n        where: { id: { $in: authorIds } },\n        orderBy: { id: 'asc' },\n        page: Number(page),\n        pageSize: Number(pageSize),\n      });\n\n      return {\n        results: results.map(getSanitizedUser),\n        pagination,\n      };\n    },\n\n    async findOne(id: unknown) {\n      const result: any = await strapi.db?.query('admin::audit-log').findOne({\n        where: { id },\n        populate: ['user'],\n        select: ['action', 'date', 'payload'],\n      });\n\n      if (!result) {\n        return null;\n      }\n\n      const { user, ...rest } = result;\n      return {\n        ...rest,\n        user: user ? getSanitizedUser(user) : null,\n      };\n    },\n\n    deleteExpiredEvents(expirationDate: Date) {\n      return strapi.db?.query('admin::audit-log').deleteMany({\n        where: {\n          date: {\n            $lt: expirationDate.toISOString(),\n          },\n        },\n      });\n    },\n  };\n};\n\nexport { createAuditLogsService };\n"],"names":["getSanitizedUser","user","displayName","email","username","firstname","lastname","id","createAuditLogsService","strapi","saveEvent","event","userId","rest","auditLog","db","query","create","data","findMany","results","pagination","findPage","populate","select","get","transform","sanitizedResults","map","result","findManyUsers","page","pageSize","userAttribute","metadata","attributes","type","joinTable","Error","authorIds","connection","name","distinct","inverseJoinColumn","pluck","where","$in","orderBy","Number","findOne","deleteExpiredEvents","expirationDate","deleteMany","date","$lt","toISOString"],"mappings":"AAaA,MAAMA,mBAAmB,CAACC,IAAAA,GAAAA;IACxB,IAAIC,WAAAA,GAAcD,KAAKE,KAAK;IAE5B,IAAIF,IAAAA,CAAKG,QAAQ,EAAE;AACjBF,QAAAA,WAAAA,GAAcD,KAAKG,QAAQ;AAC7B,IAAA,CAAA,MAAO,IAAIH,IAAAA,CAAKI,SAAS,IAAIJ,IAAAA,CAAKK,QAAQ,EAAE;QAC1CJ,WAAAA,GAAc,CAAA,EAAGD,KAAKI,SAAS,CAAC,CAAC,EAAEJ,IAAAA,CAAKK,QAAQ,CAAA,CAAE;AACpD,IAAA;IAEA,OAAO;AACLC,QAAAA,EAAAA,EAAIN,KAAKM,EAAE;AACXJ,QAAAA,KAAAA,EAAOF,KAAKE,KAAK;AACjBD,QAAAA;AACF,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMM,yBAAyB,CAACC,MAAAA,GAAAA;IAC9B,OAAO;AACL,QAAA,MAAMC,WAAUC,KAAY,EAAA;AAC1B,YAAA,MAAM,EAAEC,MAAM,EAAE,GAAGC,MAAM,GAAGF,KAAAA;AAE5B,YAAA,MAAMG,QAAAA,GAAgB;AAAE,gBAAA,GAAGD,IAAI;gBAAEZ,IAAAA,EAAMW;AAAO,aAAA;;AAG9C,YAAA,MAAMH,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBC,MAAAA,CAAO;gBAAEC,IAAAA,EAAMJ;AAAS,aAAA,CAAA;AAEnE,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEA,QAAA,MAAMK,UAASH,KAAc,EAAA;AAC3B,YAAA,MAAM,EAAEI,OAAO,EAAEC,UAAU,EAAE,GAAG,MAAMZ,MAAAA,CAAOM,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBM,QAAQ,CAAC;gBACjFC,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU,iBAAA;AACrC,gBAAA,GAAGf,OAAOgB,GAAG,CAAC,gBAAgBC,SAAS,CAAC,oBAAoBV,KAAAA;AAC9D,aAAA,CAAA;AAEA,YAAA,MAAMW,gBAAAA,GAAmBP,OAAAA,CAAQQ,GAAG,CAAC,CAACC,MAAAA,GAAAA;AACpC,gBAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;gBAC1B,OAAO;AACL,oBAAA,GAAGhB,IAAI;oBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,iBAAA;AACF,YAAA,CAAA,CAAA;YAEA,OAAO;gBACLmB,OAAAA,EAASO,gBAAAA;AACTN,gBAAAA;AACF,aAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMS,eAAcd,KAA6D,EAAA;AAC/E,YAAA,MAAM,EAAEe,IAAAA,GAAO,CAAC,EAAEC,QAAAA,GAAW,EAAE,EAAE,GAAGhB,KAAAA;YAEpC,MAAMiB,aAAAA,GAAgBxB,MAAAA,CAAOM,EAAE,CAACmB,QAAQ,CAACT,GAAG,CAAC,kBAAA,CAAA,CAAoBU,UAAU,CAAClC,IAAI;AAEhF,YAAA,IACEgC,eAAeG,IAAAA,KAAS,UAAA,IACxB,EAAE,WAAA,IAAeH,aAAY,CAAA,IAC7B,CAACA,aAAAA,CAAcI,SAAS,IACxB,EAAE,uBAAuBJ,aAAAA,CAAcI,SAAS,CAAD,EAC/C;AACA,gBAAA,MAAM,IAAIC,KAAAA,CAAM,6DAAA,CAAA;AAClB,YAAA;YAEA,MAAM,EAAED,SAAS,EAAE,GAAGJ,aAAAA;YAEtB,MAAMM,SAAAA,GAAY,MAAM9B,MAAAA,CAAOM,EAAE,CAC9ByB,UAAU,CAACH,SAAAA,CAAUI,IAAI,CAAA,CACzBC,QAAQ,CAACL,SAAAA,CAAUM,iBAAiB,CAACF,IAAI,CAAA,CACzCG,KAAK,CAACP,SAAAA,CAAUM,iBAAiB,CAACF,IAAI,CAAA;AAEzC,YAAA,MAAM,EAAErB,OAAO,EAAEC,UAAU,EAAE,GAAG,MAAMZ,MAAAA,CAAOM,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeM,QAAQ,CAAC;gBAC5EE,MAAAA,EAAQ;AAAC,oBAAA,IAAA;AAAM,oBAAA,OAAA;AAAS,oBAAA,UAAA;AAAY,oBAAA,WAAA;AAAa,oBAAA;AAAW,iBAAA;gBAC5DqB,KAAAA,EAAO;oBAAEtC,EAAAA,EAAI;wBAAEuC,GAAAA,EAAKP;AAAU;AAAE,iBAAA;gBAChCQ,OAAAA,EAAS;oBAAExC,EAAAA,EAAI;AAAM,iBAAA;AACrBwB,gBAAAA,IAAAA,EAAMiB,MAAAA,CAAOjB,IAAAA,CAAAA;AACbC,gBAAAA,QAAAA,EAAUgB,MAAAA,CAAOhB,QAAAA;AACnB,aAAA,CAAA;YAEA,OAAO;gBACLZ,OAAAA,EAASA,OAAAA,CAAQQ,GAAG,CAAC5B,gBAAAA,CAAAA;AACrBqB,gBAAAA;AACF,aAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAM4B,SAAQ1C,EAAW,EAAA;AACvB,YAAA,MAAMsB,SAAc,MAAMpB,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBiC,OAAAA,CAAQ;gBACrEJ,KAAAA,EAAO;AAAEtC,oBAAAA;AAAG,iBAAA;gBACZgB,QAAAA,EAAU;AAAC,oBAAA;AAAO,iBAAA;gBAClBC,MAAAA,EAAQ;AAAC,oBAAA,QAAA;AAAU,oBAAA,MAAA;AAAQ,oBAAA;AAAU;AACvC,aAAA,CAAA;AAEA,YAAA,IAAI,CAACK,MAAAA,EAAQ;gBACX,OAAO,IAAA;AACT,YAAA;AAEA,YAAA,MAAM,EAAE5B,IAAI,EAAE,GAAGY,MAAM,GAAGgB,MAAAA;YAC1B,OAAO;AACL,gBAAA,GAAGhB,IAAI;gBACPZ,IAAAA,EAAMA,IAAAA,GAAOD,iBAAiBC,IAAAA,CAAAA,GAAQ;AACxC,aAAA;AACF,QAAA,CAAA;AAEAiD,QAAAA,mBAAAA,CAAAA,CAAoBC,cAAoB,EAAA;AACtC,YAAA,OAAO1C,MAAAA,CAAOM,EAAE,EAAEC,KAAAA,CAAM,oBAAoBoC,UAAAA,CAAW;gBACrDP,KAAAA,EAAO;oBACLQ,IAAAA,EAAM;AACJC,wBAAAA,GAAAA,EAAKH,eAAeI,WAAW;AACjC;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,KAAA;AACF;;;;"}

package/dist/server/ee/server/src/audit-logs/validation/audit-logs.js

@@ -13,9 +13,17 @@ const validateFindManySchema = utils.yup.object().shape({
     pageSize: utils.yup.number().integer().min(1).max(100),
     sort: utils.yup.mixed().oneOf(ALLOWED_SORT_STRINGS)
 }).required();
+const validateFindManyUsersSchema = utils.yup.object().shape({
+    page: utils.yup.number().integer().min(1),
+    pageSize: utils.yup.number().integer().min(1).max(100)
+}).required();
 const validateFindMany = utils.validateYupSchema(validateFindManySchema, {
     strict: false
 });
+const validateFindManyUsers = utils.validateYupSchema(validateFindManyUsersSchema, {
+    strict: false
+});
 
 exports.validateFindMany = validateFindMany;
+exports.validateFindManyUsers = validateFindManyUsers;
 //# sourceMappingURL=audit-logs.js.map

package/dist/server/ee/server/src/audit-logs/validation/audit-logs.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logs.js","sources":["../../../../../../../ee/server/src/audit-logs/validation/audit-logs.ts"],"sourcesContent":["import { yup, validateYupSchema } from '@strapi/utils';\n\nconst ALLOWED_SORT_STRINGS = ['action:ASC', 'action:DESC', 'date:ASC', 'date:DESC'];\n\nconst validateFindManySchema = yup\n  .object()\n  .shape({\n    page: yup.number().integer().min(1),\n    pageSize: yup.number().integer().min(1).max(100),\n    sort: yup.mixed().oneOf(ALLOWED_SORT_STRINGS),\n  })\n  .required();\n\nexport const validateFindMany = validateYupSchema(validateFindManySchema, { strict: false });\n\nexport default {\n  validateFindMany,\n};\n"],"names":["ALLOWED_SORT_STRINGS","validateFindManySchema","yup","object","shape","page","number","integer","min","pageSize","max","sort","mixed","oneOf","required","validateFindMany","validateYupSchema","strict"],"mappings":";;;;AAEA,MAAMA,oBAAAA,GAAuB;AAAC,IAAA,YAAA;AAAc,IAAA,aAAA;AAAe,IAAA,UAAA;AAAY,IAAA;AAAY,CAAA;AAEnF,MAAMC,sBAAAA,GAAyBC,SAAAA,CAC5BC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLC,IAAAA,IAAAA,EAAMH,UAAII,MAAM,EAAA,CAAGC,OAAO,EAAA,CAAGC,GAAG,CAAC,CAAA,CAAA;IACjCC,QAAAA,EAAUP,SAAAA,CAAII,MAAM,EAAA,CAAGC,OAAO,GAAGC,GAAG,CAAC,CAAA,CAAA,CAAGE,GAAG,CAAC,GAAA,CAAA;AAC5CC,IAAAA,IAAAA,EAAMT,SAAAA,CAAIU,KAAK,EAAA,CAAGC,KAAK,CAACb,oBAAAA;AAC1B,CAAA,CAAA,CACCc,QAAQ,EAAA;AAEJ,MAAMC,gBAAAA,GAAmBC,uBAAAA,CAAkBf,sBAAAA,EAAwB;IAAEgB,MAAAA,EAAQ;AAAM,CAAA;;;;"}
+{"version":3,"file":"audit-logs.js","sources":["../../../../../../../ee/server/src/audit-logs/validation/audit-logs.ts"],"sourcesContent":["import { yup, validateYupSchema } from '@strapi/utils';\n\nconst ALLOWED_SORT_STRINGS = ['action:ASC', 'action:DESC', 'date:ASC', 'date:DESC'];\n\nconst validateFindManySchema = yup\n  .object()\n  .shape({\n    page: yup.number().integer().min(1),\n    pageSize: yup.number().integer().min(1).max(100),\n    sort: yup.mixed().oneOf(ALLOWED_SORT_STRINGS),\n  })\n  .required();\n\nconst validateFindManyUsersSchema = yup\n  .object()\n  .shape({\n    page: yup.number().integer().min(1),\n    pageSize: yup.number().integer().min(1).max(100),\n  })\n  .required();\n\nexport const validateFindMany = validateYupSchema(validateFindManySchema, { strict: false });\nexport const validateFindManyUsers = validateYupSchema(validateFindManyUsersSchema, {\n  strict: false,\n});\n\nexport default {\n  validateFindMany,\n  validateFindManyUsers,\n};\n"],"names":["ALLOWED_SORT_STRINGS","validateFindManySchema","yup","object","shape","page","number","integer","min","pageSize","max","sort","mixed","oneOf","required","validateFindManyUsersSchema","validateFindMany","validateYupSchema","strict","validateFindManyUsers"],"mappings":";;;;AAEA,MAAMA,oBAAAA,GAAuB;AAAC,IAAA,YAAA;AAAc,IAAA,aAAA;AAAe,IAAA,UAAA;AAAY,IAAA;AAAY,CAAA;AAEnF,MAAMC,sBAAAA,GAAyBC,SAAAA,CAC5BC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLC,IAAAA,IAAAA,EAAMH,UAAII,MAAM,EAAA,CAAGC,OAAO,EAAA,CAAGC,GAAG,CAAC,CAAA,CAAA;IACjCC,QAAAA,EAAUP,SAAAA,CAAII,MAAM,EAAA,CAAGC,OAAO,GAAGC,GAAG,CAAC,CAAA,CAAA,CAAGE,GAAG,CAAC,GAAA,CAAA;AAC5CC,IAAAA,IAAAA,EAAMT,SAAAA,CAAIU,KAAK,EAAA,CAAGC,KAAK,CAACb,oBAAAA;AAC1B,CAAA,CAAA,CACCc,QAAQ,EAAA;AAEX,MAAMC,2BAAAA,GAA8Bb,SAAAA,CACjCC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLC,IAAAA,IAAAA,EAAMH,UAAII,MAAM,EAAA,CAAGC,OAAO,EAAA,CAAGC,GAAG,CAAC,CAAA,CAAA;IACjCC,QAAAA,EAAUP,SAAAA,CAAII,MAAM,EAAA,CAAGC,OAAO,GAAGC,GAAG,CAAC,CAAA,CAAA,CAAGE,GAAG,CAAC,GAAA;AAC9C,CAAA,CAAA,CACCI,QAAQ,EAAA;AAEJ,MAAME,gBAAAA,GAAmBC,uBAAAA,CAAkBhB,sBAAAA,EAAwB;IAAEiB,MAAAA,EAAQ;AAAM,CAAA;AACnF,MAAMC,qBAAAA,GAAwBF,uBAAAA,CAAkBF,2BAAAA,EAA6B;IAClFG,MAAAA,EAAQ;AACV,CAAA;;;;;"}

package/dist/server/ee/server/src/audit-logs/validation/audit-logs.mjs

@@ -11,9 +11,16 @@ const validateFindManySchema = yup.object().shape({
     pageSize: yup.number().integer().min(1).max(100),
     sort: yup.mixed().oneOf(ALLOWED_SORT_STRINGS)
 }).required();
+const validateFindManyUsersSchema = yup.object().shape({
+    page: yup.number().integer().min(1),
+    pageSize: yup.number().integer().min(1).max(100)
+}).required();
 const validateFindMany = validateYupSchema(validateFindManySchema, {
     strict: false
 });
+const validateFindManyUsers = validateYupSchema(validateFindManyUsersSchema, {
+    strict: false
+});
 
-export { validateFindMany };
+export { validateFindMany, validateFindManyUsers };
 //# sourceMappingURL=audit-logs.mjs.map

package/dist/server/ee/server/src/audit-logs/validation/audit-logs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logs.mjs","sources":["../../../../../../../ee/server/src/audit-logs/validation/audit-logs.ts"],"sourcesContent":["import { yup, validateYupSchema } from '@strapi/utils';\n\nconst ALLOWED_SORT_STRINGS = ['action:ASC', 'action:DESC', 'date:ASC', 'date:DESC'];\n\nconst validateFindManySchema = yup\n  .object()\n  .shape({\n    page: yup.number().integer().min(1),\n    pageSize: yup.number().integer().min(1).max(100),\n    sort: yup.mixed().oneOf(ALLOWED_SORT_STRINGS),\n  })\n  .required();\n\nexport const validateFindMany = validateYupSchema(validateFindManySchema, { strict: false });\n\nexport default {\n  validateFindMany,\n};\n"],"names":["ALLOWED_SORT_STRINGS","validateFindManySchema","yup","object","shape","page","number","integer","min","pageSize","max","sort","mixed","oneOf","required","validateFindMany","validateYupSchema","strict"],"mappings":";;AAEA,MAAMA,oBAAAA,GAAuB;AAAC,IAAA,YAAA;AAAc,IAAA,aAAA;AAAe,IAAA,UAAA;AAAY,IAAA;AAAY,CAAA;AAEnF,MAAMC,sBAAAA,GAAyBC,GAAAA,CAC5BC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLC,IAAAA,IAAAA,EAAMH,IAAII,MAAM,EAAA,CAAGC,OAAO,EAAA,CAAGC,GAAG,CAAC,CAAA,CAAA;IACjCC,QAAAA,EAAUP,GAAAA,CAAII,MAAM,EAAA,CAAGC,OAAO,GAAGC,GAAG,CAAC,CAAA,CAAA,CAAGE,GAAG,CAAC,GAAA,CAAA;AAC5CC,IAAAA,IAAAA,EAAMT,GAAAA,CAAIU,KAAK,EAAA,CAAGC,KAAK,CAACb,oBAAAA;AAC1B,CAAA,CAAA,CACCc,QAAQ,EAAA;AAEJ,MAAMC,gBAAAA,GAAmBC,iBAAAA,CAAkBf,sBAAAA,EAAwB;IAAEgB,MAAAA,EAAQ;AAAM,CAAA;;;;"}
+{"version":3,"file":"audit-logs.mjs","sources":["../../../../../../../ee/server/src/audit-logs/validation/audit-logs.ts"],"sourcesContent":["import { yup, validateYupSchema } from '@strapi/utils';\n\nconst ALLOWED_SORT_STRINGS = ['action:ASC', 'action:DESC', 'date:ASC', 'date:DESC'];\n\nconst validateFindManySchema = yup\n  .object()\n  .shape({\n    page: yup.number().integer().min(1),\n    pageSize: yup.number().integer().min(1).max(100),\n    sort: yup.mixed().oneOf(ALLOWED_SORT_STRINGS),\n  })\n  .required();\n\nconst validateFindManyUsersSchema = yup\n  .object()\n  .shape({\n    page: yup.number().integer().min(1),\n    pageSize: yup.number().integer().min(1).max(100),\n  })\n  .required();\n\nexport const validateFindMany = validateYupSchema(validateFindManySchema, { strict: false });\nexport const validateFindManyUsers = validateYupSchema(validateFindManyUsersSchema, {\n  strict: false,\n});\n\nexport default {\n  validateFindMany,\n  validateFindManyUsers,\n};\n"],"names":["ALLOWED_SORT_STRINGS","validateFindManySchema","yup","object","shape","page","number","integer","min","pageSize","max","sort","mixed","oneOf","required","validateFindManyUsersSchema","validateFindMany","validateYupSchema","strict","validateFindManyUsers"],"mappings":";;AAEA,MAAMA,oBAAAA,GAAuB;AAAC,IAAA,YAAA;AAAc,IAAA,aAAA;AAAe,IAAA,UAAA;AAAY,IAAA;AAAY,CAAA;AAEnF,MAAMC,sBAAAA,GAAyBC,GAAAA,CAC5BC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLC,IAAAA,IAAAA,EAAMH,IAAII,MAAM,EAAA,CAAGC,OAAO,EAAA,CAAGC,GAAG,CAAC,CAAA,CAAA;IACjCC,QAAAA,EAAUP,GAAAA,CAAII,MAAM,EAAA,CAAGC,OAAO,GAAGC,GAAG,CAAC,CAAA,CAAA,CAAGE,GAAG,CAAC,GAAA,CAAA;AAC5CC,IAAAA,IAAAA,EAAMT,GAAAA,CAAIU,KAAK,EAAA,CAAGC,KAAK,CAACb,oBAAAA;AAC1B,CAAA,CAAA,CACCc,QAAQ,EAAA;AAEX,MAAMC,2BAAAA,GAA8Bb,GAAAA,CACjCC,MAAM,EAAA,CACNC,KAAK,CAAC;AACLC,IAAAA,IAAAA,EAAMH,IAAII,MAAM,EAAA,CAAGC,OAAO,EAAA,CAAGC,GAAG,CAAC,CAAA,CAAA;IACjCC,QAAAA,EAAUP,GAAAA,CAAII,MAAM,EAAA,CAAGC,OAAO,GAAGC,GAAG,CAAC,CAAA,CAAA,CAAGE,GAAG,CAAC,GAAA;AAC9C,CAAA,CAAA,CACCI,QAAQ,EAAA;AAEJ,MAAME,gBAAAA,GAAmBC,iBAAAA,CAAkBhB,sBAAAA,EAAwB;IAAEiB,MAAAA,EAAQ;AAAM,CAAA;AACnF,MAAMC,qBAAAA,GAAwBF,iBAAAA,CAAkBF,2BAAAA,EAA6B;IAClFG,MAAAA,EAAQ;AACV,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,gBAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,QAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,SAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin.js","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\n\nimport { getService } from '../utils';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;;;AAKA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,gBAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,QAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,QAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,SAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/admin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\nimport { getService } from '../utils';\nimport path from 'path';\nimport fs from 'fs';\nimport crypto from 'crypto';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;AAQA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,KAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import { isNil } from 'lodash/fp';\nimport { env } from '@strapi/utils';\n\nimport { getService } from '../utils';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType() {\n    const flags = strapi.config.get('admin.flags', {});\n    const isAILicense = strapi.ee.features.isEnabled('cms-ai');\n    const isAIConfigured = strapi.config.get('admin.ai', { enabled: isAILicense });\n\n    try {\n      return {\n        data: {\n          isEE: strapi.EE,\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type,\n          planPriceId: strapi.ee.planPriceId,\n          ai: {\n            enabled: isAILicense && isAIConfigured.enabled,\n          },\n        },\n      };\n    } catch (err) {\n      return { data: { isEE: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (!isNil(permittedSeats) && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: isNil(permittedSeats) ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","isAILicense","ee","features","isEnabled","isAIConfigured","enabled","data","isEE","EE","isTrial","list","type","planPriceId","ai","err","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","isNil","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;;AAKA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;AAChD,QAAA,MAAMC,cAAcH,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,QAAA,CAAA;AACjD,QAAA,MAAMC,iBAAiBP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,UAAA,EAAY;YAAEM,OAAAA,EAASL;AAAY,SAAA,CAAA;QAE5E,IAAI;YACF,OAAO;gBACLM,IAAAA,EAAM;AACJC,oBAAAA,IAAAA,EAAMV,OAAOW,EAAE;oBACfC,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,oBAAAA,QAAAA,EAAUL,MAAAA,CAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,EAAA;AACjCd,oBAAAA,KAAAA;oBACAe,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;oBACpBC,WAAAA,EAAaf,MAAAA,CAAOI,EAAE,CAACW,WAAW;oBAClCC,EAAAA,EAAI;wBACFR,OAAAA,EAASL,WAAAA,IAAeI,eAAeC;AACzC;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAER,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;AAAOL,oBAAAA,QAAAA,EAAU,EAAE;AAAEN,oBAAAA,KAAAA;oBAAOiB,EAAAA,EAAI;wBAAER,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9E,QAAA;AACF,IAAA,CAAA;IAEA,MAAMU,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOI,EAAE,CAACgB,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;AAEA,QAAA,IAAI,CAACM,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;AAEA,QAAA,IAAI,CAACQ,KAAAA,CAAMX,cAAAA,CAAAA,IAAmBI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMb,IAAAA,GAAO;AACXc,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAU,gBAAAA,EAAkBD,KAAAA,CAAMX,cAAAA,CAAAA,GAAkB,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC5EG,YAAAA,kBAAAA;YACAU,qBAAAA,EAAuBC,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDnB,IAAAA,EAAMd,MAAAA,CAAOI,EAAE,CAACU,IAAI;YACpBF,OAAAA,EAASZ,MAAAA,CAAOI,EAAE,CAACQ,OAAO;AAC1BP,YAAAA,QAAAA,EAAUL,OAAOI,EAAE,CAACC,QAAQ,CAACQ,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEJ,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js

@@ -102,7 +102,8 @@ const redirectWithAuth = async (ctx)=>{
         const userId = String(user.id);
         const deviceId = sessionAuth.generateDeviceId();
         const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
-            type: 'refresh'
+            type: 'refresh',
+            metadata: sessionAuth.buildSessionMetadataFromContext(ctx)
         });
         const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);
         ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
@@ -115,12 +116,17 @@ const redirectWithAuth = async (ctx)=>{
         const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
         const isProduction = process.env.NODE_ENV === 'production';
         const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
-        const domain = strapi.config.get('admin.auth.domain');
+        // Resolve through the shared helpers so the server write agrees with the
+        // client set/delete (which read the same config inlined at build time);
+        // any divergence leaves a cookie the admin panel cannot clear on logout.
+        const domain = sessionAuth.getAccessCookieDomain();
+        const path = sessionAuth.getAccessCookiePath();
         ctx.cookies.set(sessionAuth.getAccessCookieName(), accessToken, {
             httpOnly: false,
             secure: isSecure,
             overwrite: true,
-            domain
+            domain,
+            path
         });
         const sanitizedUser = index.getService('user').sanitizeUser(user);
         strapi.eventHub.emit('admin.auth.success', {

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getAccessCookieName,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;AAYA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,iCAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACa,mCAAuBT,WAAAA,EAAa;YAClDU,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQJ,QAAAA;YACRK,SAAAA,EAAW,IAAA;AACXJ,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMK,aAAAA,GAAgBvD,gBAAAA,CAAW,MAAA,CAAA,CAAQwD,YAAY,CAACzD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMwD,aAAAA;AAAerE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAasE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOlE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;;;"}
+{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;AAeA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,2CAAAA,CAAgCrD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMsD,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BhD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBnD,MAAAA,CAAOoD,MAAM,CAAChC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMiC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,iCAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,+BAAAA,EAAAA;AAEbxE,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACgB,mCAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB5D,gBAAAA,CAAW,MAAA,CAAA,CAAQ6D,YAAY,CAAC9D,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAM6D,aAAAA;AAAe1E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa2E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOvE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs

@@ -1,7 +1,7 @@
 import passport from 'koa-passport';
 import { getService } from '../../utils/index.mjs';
 import utils from './utils.mjs';
-import { getSessionManager, generateDeviceId, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getAccessCookieName } from '../../../../../shared/utils/session-auth.mjs';
+import { getSessionManager, generateDeviceId, buildSessionMetadataFromContext, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getAccessCookieDomain, getAccessCookiePath, getAccessCookieName } from '../../../../../shared/utils/session-auth.mjs';
 
 const defaultConnectionError = ()=>new Error('Invalid connection payload');
 const authenticate = async (ctx, next)=>{
@@ -94,7 +94,8 @@ const redirectWithAuth = async (ctx)=>{
         const userId = String(user.id);
         const deviceId = generateDeviceId();
         const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
-            type: 'refresh'
+            type: 'refresh',
+            metadata: buildSessionMetadataFromContext(ctx)
         });
         const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);
         ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
@@ -107,12 +108,17 @@ const redirectWithAuth = async (ctx)=>{
         const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
         const isProduction = process.env.NODE_ENV === 'production';
         const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;
-        const domain = strapi.config.get('admin.auth.domain');
+        // Resolve through the shared helpers so the server write agrees with the
+        // client set/delete (which read the same config inlined at build time);
+        // any divergence leaves a cookie the admin panel cannot clear on logout.
+        const domain = getAccessCookieDomain();
+        const path = getAccessCookiePath();
         ctx.cookies.set(getAccessCookieName(), accessToken, {
             httpOnly: false,
             secure: isSecure,
             overwrite: true,
-            domain
+            domain,
+            path
         });
         const sanitizedUser = getService('user').sanitizeUser(user);
         strapi.eventHub.emit('admin.auth.success', {

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getAccessCookieName,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    const domain: string | undefined = strapi.config.get('admin.auth.domain');\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAYA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM;AACR,SAAA,CAAA;QAEA,MAAMC,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWJ,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACC,qBAAqBR,YAAAA,EAAcI,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMhB,cAAAA,CAAe,OAAA,CAAA,CAASiB,mBAAmB,CAACV,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWS,YAAAA,EAAc;YAC3B9C,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOY,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBjD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAM+B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;AAE5E,QAAA,MAAMK,MAAAA,GAA6BxD,MAAAA,CAAOkD,MAAM,CAAC9B,GAAG,CAAC,mBAAA,CAAA;AACrD/B,QAAAA,GAAAA,CAAIsD,OAAO,CAACC,GAAG,CAACa,uBAAuBT,WAAAA,EAAa;YAClDU,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQJ,QAAAA;YACRK,SAAAA,EAAW,IAAA;AACXJ,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMK,aAAAA,GAAgBvD,UAAAA,CAAW,MAAA,CAAA,CAAQwD,YAAY,CAACzD,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAMwD,aAAAA;AAAerE,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAasE,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOlE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAeA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,+BAAAA,CAAgCrD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMsD,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACC,qBAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BhD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBnD,MAAAA,CAAOoD,MAAM,CAAChC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMiC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,qBAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,mBAAAA,EAAAA;AAEbxE,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACgB,uBAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB5D,UAAAA,CAAW,MAAA,CAAA,CAAQ6D,YAAY,CAAC9D,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAM6D,aAAAA;AAAe1E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa2E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOvE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/auth.js

@@ -4,6 +4,7 @@ var _ = require('lodash');
 var utils = require('@strapi/utils');
 var index = require('../utils/index.js');
 var ssoLock = require('../utils/sso-lock.js');
+var auth$1 = require('../../../../server/src/services/auth.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -26,10 +27,7 @@ const { ApplicationError } = utils.errors;
     if (!user || await ssoLock.isSsoLocked(user)) {
         return;
     }
-    const resetPasswordToken = index.getService('token').createToken();
-    await index.getService('user').updateById(user.id, {
-        resetPasswordToken
-    });
+    const resetPasswordToken = await auth$1.assignResetPasswordToken(user.id);
     // Send an email to the admin.
     const url = `${strapi.config.get('admin.absoluteUrl')}/auth/reset-password?code=${resetPasswordToken}`;
     return strapi.plugin('email').service('email').sendTemplatedEmail({
@@ -64,9 +62,11 @@ const { ApplicationError } = utils.errors;
     if (!matchingUser || await ssoLock.isSsoLocked(matchingUser)) {
         throw new ApplicationError();
     }
+    await auth$1.assertResetPasswordTokenIsValid(matchingUser);
     return index.getService('user').updateById(matchingUser.id, {
         password,
-        resetPasswordToken: null
+        resetPasswordToken: null,
+        resetPasswordTokenExpiresAt: null
     });
 };
 var auth = {

package/dist/server/ee/server/src/services/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = getService('token').createToken();\n  await getService('user').updateById(user.id, { resetPasswordToken });\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","getService","createToken","updateById","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser"],"mappings":";;;;;;;;;;;AAKA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,mBAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;IAEA,MAAMQ,kBAAAA,GAAqBC,gBAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMD,iBAAW,MAAA,CAAA,CAAQE,UAAU,CAACX,IAAAA,CAAKY,EAAE,EAAE;AAAEJ,QAAAA;AAAmB,KAAA,CAAA;;IAGlE,MAAMK,GAAAA,GAAM,CAAA,EAAGZ,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEP,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJe,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAInB,KAAKD,KAAK;AACdqB,QAAAA,IAAAA,EAAMnB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASpB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAd,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAb,IAAAA,EAAMsB,kBAAAA,CAAEC,IAAI,CAACvB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDwB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENxB,MAAAA,CAAOyB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAEpB,kBAAkB,EAAEqB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM7B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACwB,YAAAA,IAAiB,MAAMvB,mBAAAA,CAAYuB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIlC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,OAAOa,iBAAW,MAAA,CAAA,CAAQE,UAAU,CAACmB,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACArB,kBAAAA,EAAoB;AACtB,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACbV,IAAAA,cAAAA;AACA8B,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"auth.js","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\nimport {\n  assignResetPasswordToken,\n  assertResetPasswordTokenIsValid,\n} from '../../../../server/src/services/auth';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","assignResetPasswordToken","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser","assertResetPasswordTokenIsValid","getService","updateById","resetPasswordTokenExpiresAt"],"mappings":";;;;;;;;;;;;AASA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,mBAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;AAEA,IAAA,MAAMQ,kBAAAA,GAAqB,MAAMC,+BAAAA,CAAyBT,IAAAA,CAAKU,EAAE,CAAA;;IAGjE,MAAMC,GAAAA,GAAM,CAAA,EAAGV,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEL,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJa,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIjB,KAAKD,KAAK;AACdmB,QAAAA,IAAAA,EAAMjB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASlB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAZ,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAX,IAAAA,EAAMoB,kBAAAA,CAAEC,IAAI,CAACrB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDsB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENtB,MAAAA,CAAOuB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAElB,kBAAkB,EAAEmB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM3B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACsB,YAAAA,IAAiB,MAAMrB,mBAAAA,CAAYqB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIhC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMiC,sCAAAA,CAAgCD,YAAAA,CAAAA;AAEtC,IAAA,OAAOE,iBAAW,MAAA,CAAA,CAAQC,UAAU,CAACH,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACAnB,kBAAAA,EAAoB,IAAA;QACpBwB,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACblC,IAAAA,cAAAA;AACA4B,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/auth.mjs

@@ -2,6 +2,7 @@ import ___default from 'lodash';
 import { errors } from '@strapi/utils';
 import { getService } from '../utils/index.mjs';
 import { isSsoLocked } from '../utils/sso-lock.mjs';
+import { assertResetPasswordTokenIsValid, assignResetPasswordToken } from '../../../../server/src/services/auth.mjs';
 
 const { ApplicationError } = errors;
 /**
@@ -20,10 +21,7 @@ const { ApplicationError } = errors;
     if (!user || await isSsoLocked(user)) {
         return;
     }
-    const resetPasswordToken = getService('token').createToken();
-    await getService('user').updateById(user.id, {
-        resetPasswordToken
-    });
+    const resetPasswordToken = await assignResetPasswordToken(user.id);
     // Send an email to the admin.
     const url = `${strapi.config.get('admin.absoluteUrl')}/auth/reset-password?code=${resetPasswordToken}`;
     return strapi.plugin('email').service('email').sendTemplatedEmail({
@@ -58,9 +56,11 @@ const { ApplicationError } = errors;
     if (!matchingUser || await isSsoLocked(matchingUser)) {
         throw new ApplicationError();
     }
+    await assertResetPasswordTokenIsValid(matchingUser);
     return getService('user').updateById(matchingUser.id, {
         password,
-        resetPasswordToken: null
+        resetPasswordToken: null,
+        resetPasswordTokenExpiresAt: null
     });
 };
 var auth = {

package/dist/server/ee/server/src/services/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = getService('token').createToken();\n  await getService('user').updateById(user.id, { resetPasswordToken });\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","getService","createToken","updateById","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser"],"mappings":";;;;;AAKA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,WAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;IAEA,MAAMQ,kBAAAA,GAAqBC,UAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMD,WAAW,MAAA,CAAA,CAAQE,UAAU,CAACX,IAAAA,CAAKY,EAAE,EAAE;AAAEJ,QAAAA;AAAmB,KAAA,CAAA;;IAGlE,MAAMK,GAAAA,GAAM,CAAA,EAAGZ,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEP,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJe,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAInB,KAAKD,KAAK;AACdqB,QAAAA,IAAAA,EAAMnB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASpB,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAd,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAb,IAAAA,EAAMsB,UAAAA,CAAEC,IAAI,CAACvB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDwB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENxB,MAAAA,CAAOyB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAEpB,kBAAkB,EAAEqB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM7B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACwB,YAAAA,IAAiB,MAAMvB,WAAAA,CAAYuB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIlC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,OAAOa,WAAW,MAAA,CAAA,CAAQE,UAAU,CAACmB,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACArB,kBAAAA,EAAoB;AACtB,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACbV,IAAAA,cAAAA;AACA8B,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"auth.mjs","sources":["../../../../../../ee/server/src/services/auth.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { isSsoLocked } from '../utils/sso-lock';\nimport {\n  assignResetPasswordToken,\n  assertResetPasswordTokenIsValid,\n} from '../../../../server/src/services/auth';\n\nconst { ApplicationError } = errors;\n/**\n * Send an email to the user if it exists and is not locked to SSO\n * If those conditions are not met, nothing happens\n *\n * @param {Object} param params\n * @param {string} param.email user email for which to reset the password\n */\nconst forgotPassword = async ({ email }: any = {}) => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { email, isActive: true } });\n\n  if (!user || (await isSsoLocked(user))) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param {Object} param params\n * @param {string} param.resetPasswordToken token generated to request a password reset\n * @param {string} param.password new user password\n */\nconst resetPassword = async ({ resetPasswordToken, password }: any = {}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser || (await isSsoLocked(matchingUser))) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return getService('user').updateById(matchingUser.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n};\n\nexport default {\n  forgotPassword,\n  resetPassword,\n};\n"],"names":["ApplicationError","errors","forgotPassword","email","user","strapi","db","query","findOne","where","isActive","isSsoLocked","resetPasswordToken","assignResetPasswordToken","id","url","config","get","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","password","matchingUser","assertResetPasswordTokenIsValid","getService","updateById","resetPasswordTokenExpiresAt"],"mappings":";;;;;;AASA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAC7B;;;;;;IAOA,MAAMC,iBAAiB,OAAO,EAAEC,KAAK,EAAO,GAAG,EAAE,GAAA;IAC/C,MAAMC,IAAAA,GAAO,MAAMC,MAAAA,CAAOC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEN,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE7F,IAAA,IAAI,CAACN,IAAAA,IAAS,MAAMO,WAAAA,CAAYP,IAAAA,CAAAA,EAAQ;AACtC,QAAA;AACF,IAAA;AAEA,IAAA,MAAMQ,kBAAAA,GAAqB,MAAMC,wBAAAA,CAAyBT,IAAAA,CAAKU,EAAE,CAAA;;IAGjE,MAAMC,GAAAA,GAAM,CAAA,EAAGV,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEL,kBAAAA,CAAAA,CAAoB;IAClD,OAAOP,MAAAA,CACJa,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIjB,KAAKD,KAAK;AACdmB,QAAAA,IAAAA,EAAMjB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBM,QAAAA,OAAAA,EAASlB,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAZ,MAAAA,CAAOW,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEF,QAAAA,GAAAA;QACAX,IAAAA,EAAMoB,UAAAA,CAAEC,IAAI,CAACrB,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDsB,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENtB,MAAAA,CAAOuB,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;;IAMA,MAAMG,aAAAA,GAAgB,OAAO,EAAElB,kBAAkB,EAAEmB,QAAQ,EAAO,GAAG,EAAE,GAAA;IACrE,MAAMC,YAAAA,GAAe,MAAM3B,MAAAA,CAAOC,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEG,YAAAA,kBAAAA;YAAoBF,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACsB,YAAAA,IAAiB,MAAMrB,WAAAA,CAAYqB,YAAAA,CAAAA,EAAgB;AACtD,QAAA,MAAM,IAAIhC,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMiC,+BAAAA,CAAgCD,YAAAA,CAAAA;AAEtC,IAAA,OAAOE,WAAW,MAAA,CAAA,CAAQC,UAAU,CAACH,YAAAA,CAAalB,EAAE,EAAE;AACpDiB,QAAAA,QAAAA;QACAnB,kBAAAA,EAAoB,IAAA;QACpBwB,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AACF,CAAA;AAEA,WAAe;AACblC,IAAAA,cAAAA;AACA4B,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/user.js

@@ -223,6 +223,7 @@ const sanitizeUserRoles = (role)=>___default.default.pick(role, [
         ...___default.default.omit(user, [
             'password',
             'resetPasswordToken',
+            'resetPasswordTokenExpiresAt',
             'registrationToken',
             'roles'
         ]),