@strapi/admin 5.50.2 → 5.51.1

package/dist/server/ee/server/src/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, ['password', 'resetPasswordToken', 'registrationToken', 'roles']),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,OAAAA,CAAKC,YAAAA,EAAWC,MAAAA,CAAIC,WAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,gBAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,kBAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,wBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,kBAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AAAC,YAAA,UAAA;AAAY,YAAA,oBAAA;AAAsB,YAAA,mBAAA;AAAqB,YAAA;SAAQ,CAAC;AACjF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,OAAAA,CAAKC,YAAAA,EAAWC,MAAAA,CAAIC,WAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,gBAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,kBAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,wBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,kBAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/user.mjs

@@ -217,6 +217,7 @@ const sanitizeUserRoles = (role)=>___default.pick(role, [
         ...___default.omit(user, [
             'password',
             'resetPasswordToken',
+            'resetPasswordTokenExpiresAt',
             'registrationToken',
             'roles'
         ]),

package/dist/server/ee/server/src/services/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, ['password', 'resetPasswordToken', 'registrationToken', 'roles']),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,IAAAA,CAAKC,SAAAA,EAAWC,GAAAA,CAAIC,QAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,UAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,UAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,iBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,UAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AAAC,YAAA,UAAA;AAAY,YAAA,oBAAA;AAAsB,YAAA,mBAAA;AAAqB,YAAA;SAAQ,CAAC;AACjF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.mjs","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,IAAAA,CAAKC,SAAAA,EAAWC,GAAAA,CAAIC,QAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,UAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,UAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,iBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,UAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/content-types/User.js

@@ -60,6 +60,12 @@ var User = {
             private: true,
             searchable: false
         },
+        resetPasswordTokenExpiresAt: {
+            type: 'datetime',
+            configurable: false,
+            private: true,
+            searchable: false
+        },
         registrationToken: {
             type: 'string',
             configurable: false,

package/dist/server/server/src/content-types/User.js.map

@@ -1 +1 @@
-{"version":3,"file":"User.js","sources":["../../../../../server/src/content-types/User.ts"],"sourcesContent":["export default {\n  collectionName: 'admin_users',\n  info: {\n    name: 'User',\n    description: '',\n    singularName: 'user',\n    pluralName: 'users',\n    displayName: 'User',\n  },\n  pluginOptions: {\n    'content-manager': {\n      visible: false,\n    },\n    'content-type-builder': {\n      visible: false,\n    },\n  },\n  attributes: {\n    firstname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    lastname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    username: {\n      type: 'string',\n      unique: false,\n      configurable: false,\n      required: false,\n    },\n    email: {\n      type: 'email',\n      minLength: 6,\n      configurable: false,\n      required: true,\n      unique: true,\n      private: true,\n    },\n    password: {\n      type: 'password',\n      minLength: 6,\n      configurable: false,\n      required: false,\n      private: true,\n      searchable: false,\n    },\n    resetPasswordToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    registrationToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    isActive: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    roles: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'manyToMany',\n      inversedBy: 'users',\n      target: 'admin::role',\n      // FIXME: Allow setting this\n      collectionName: 'strapi_users_roles',\n    },\n    apiTokens: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'oneToMany',\n      mappedBy: 'adminUserOwner',\n      target: 'admin::api-token',\n    },\n    blocked: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    preferedLanguage: {\n      type: 'string',\n      configurable: false,\n      required: false,\n      searchable: false,\n    },\n  },\n  config: {\n    attributes: {\n      resetPasswordToken: {\n        hidden: true,\n      },\n      registrationToken: {\n        hidden: true,\n      },\n    },\n  },\n};\n"],"names":["collectionName","info","name","description","singularName","pluralName","displayName","pluginOptions","visible","attributes","firstname","type","unique","minLength","configurable","required","lastname","username","email","private","password","searchable","resetPasswordToken","registrationToken","isActive","default","roles","relation","inversedBy","target","apiTokens","mappedBy","blocked","preferedLanguage","config","hidden"],"mappings":";;AAAA,WAAe;IACbA,cAAAA,EAAgB,aAAA;IAChBC,IAAAA,EAAM;QACJC,IAAAA,EAAM,MAAA;QACNC,WAAAA,EAAa,EAAA;QACbC,YAAAA,EAAc,MAAA;QACdC,UAAAA,EAAY,OAAA;QACZC,WAAAA,EAAa;AACf,KAAA;IACAC,aAAAA,EAAe;QACb,iBAAA,EAAmB;YACjBC,OAAAA,EAAS;AACX,SAAA;QACA,sBAAA,EAAwB;YACtBA,OAAAA,EAAS;AACX;AACF,KAAA;IACAC,UAAAA,EAAY;QACVC,SAAAA,EAAW;YACTC,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAC,QAAAA,EAAU;YACRL,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAE,QAAAA,EAAU;YACRN,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRE,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAG,KAAAA,EAAO;YACLP,IAAAA,EAAM,OAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,IAAA;YACVH,MAAAA,EAAQ,IAAA;YACRO,OAAAA,EAAS;AACX,SAAA;QACAC,QAAAA,EAAU;YACRT,IAAAA,EAAM,UAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVI,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAC,kBAAAA,EAAoB;YAClBX,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAE,iBAAAA,EAAmB;YACjBZ,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAG,QAAAA,EAAU;YACRb,IAAAA,EAAM,SAAA;YACNc,OAAAA,EAAS,KAAA;YACTX,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAO,KAAAA,EAAO;YACLZ,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNgB,QAAAA,EAAU,YAAA;YACVC,UAAAA,EAAY,OAAA;YACZC,MAAAA,EAAQ,aAAA;;YAER7B,cAAAA,EAAgB;AAClB,SAAA;QACA8B,SAAAA,EAAW;YACThB,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNgB,QAAAA,EAAU,WAAA;YACVI,QAAAA,EAAU,gBAAA;YACVF,MAAAA,EAAQ;AACV,SAAA;QACAG,OAAAA,EAAS;YACPrB,IAAAA,EAAM,SAAA;YACNc,OAAAA,EAAS,KAAA;YACTX,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAc,gBAAAA,EAAkB;YAChBtB,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVM,UAAAA,EAAY;AACd;AACF,KAAA;IACAa,MAAAA,EAAQ;QACNzB,UAAAA,EAAY;YACVa,kBAAAA,EAAoB;gBAClBa,MAAAA,EAAQ;AACV,aAAA;YACAZ,iBAAAA,EAAmB;gBACjBY,MAAAA,EAAQ;AACV;AACF;AACF;AACF,CAAA;;;;"}
+{"version":3,"file":"User.js","sources":["../../../../../server/src/content-types/User.ts"],"sourcesContent":["export default {\n  collectionName: 'admin_users',\n  info: {\n    name: 'User',\n    description: '',\n    singularName: 'user',\n    pluralName: 'users',\n    displayName: 'User',\n  },\n  pluginOptions: {\n    'content-manager': {\n      visible: false,\n    },\n    'content-type-builder': {\n      visible: false,\n    },\n  },\n  attributes: {\n    firstname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    lastname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    username: {\n      type: 'string',\n      unique: false,\n      configurable: false,\n      required: false,\n    },\n    email: {\n      type: 'email',\n      minLength: 6,\n      configurable: false,\n      required: true,\n      unique: true,\n      private: true,\n    },\n    password: {\n      type: 'password',\n      minLength: 6,\n      configurable: false,\n      required: false,\n      private: true,\n      searchable: false,\n    },\n    resetPasswordToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    resetPasswordTokenExpiresAt: {\n      type: 'datetime',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    registrationToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    isActive: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    roles: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'manyToMany',\n      inversedBy: 'users',\n      target: 'admin::role',\n      // FIXME: Allow setting this\n      collectionName: 'strapi_users_roles',\n    },\n    apiTokens: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'oneToMany',\n      mappedBy: 'adminUserOwner',\n      target: 'admin::api-token',\n    },\n    blocked: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    preferedLanguage: {\n      type: 'string',\n      configurable: false,\n      required: false,\n      searchable: false,\n    },\n  },\n  config: {\n    attributes: {\n      resetPasswordToken: {\n        hidden: true,\n      },\n      registrationToken: {\n        hidden: true,\n      },\n    },\n  },\n};\n"],"names":["collectionName","info","name","description","singularName","pluralName","displayName","pluginOptions","visible","attributes","firstname","type","unique","minLength","configurable","required","lastname","username","email","private","password","searchable","resetPasswordToken","resetPasswordTokenExpiresAt","registrationToken","isActive","default","roles","relation","inversedBy","target","apiTokens","mappedBy","blocked","preferedLanguage","config","hidden"],"mappings":";;AAAA,WAAe;IACbA,cAAAA,EAAgB,aAAA;IAChBC,IAAAA,EAAM;QACJC,IAAAA,EAAM,MAAA;QACNC,WAAAA,EAAa,EAAA;QACbC,YAAAA,EAAc,MAAA;QACdC,UAAAA,EAAY,OAAA;QACZC,WAAAA,EAAa;AACf,KAAA;IACAC,aAAAA,EAAe;QACb,iBAAA,EAAmB;YACjBC,OAAAA,EAAS;AACX,SAAA;QACA,sBAAA,EAAwB;YACtBA,OAAAA,EAAS;AACX;AACF,KAAA;IACAC,UAAAA,EAAY;QACVC,SAAAA,EAAW;YACTC,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAC,QAAAA,EAAU;YACRL,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAE,QAAAA,EAAU;YACRN,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRE,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAG,KAAAA,EAAO;YACLP,IAAAA,EAAM,OAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,IAAA;YACVH,MAAAA,EAAQ,IAAA;YACRO,OAAAA,EAAS;AACX,SAAA;QACAC,QAAAA,EAAU;YACRT,IAAAA,EAAM,UAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVI,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAC,kBAAAA,EAAoB;YAClBX,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAE,2BAAAA,EAA6B;YAC3BZ,IAAAA,EAAM,UAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAG,iBAAAA,EAAmB;YACjBb,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAI,QAAAA,EAAU;YACRd,IAAAA,EAAM,SAAA;YACNe,OAAAA,EAAS,KAAA;YACTZ,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAQ,KAAAA,EAAO;YACLb,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNiB,QAAAA,EAAU,YAAA;YACVC,UAAAA,EAAY,OAAA;YACZC,MAAAA,EAAQ,aAAA;;YAER9B,cAAAA,EAAgB;AAClB,SAAA;QACA+B,SAAAA,EAAW;YACTjB,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNiB,QAAAA,EAAU,WAAA;YACVI,QAAAA,EAAU,gBAAA;YACVF,MAAAA,EAAQ;AACV,SAAA;QACAG,OAAAA,EAAS;YACPtB,IAAAA,EAAM,SAAA;YACNe,OAAAA,EAAS,KAAA;YACTZ,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAe,gBAAAA,EAAkB;YAChBvB,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVM,UAAAA,EAAY;AACd;AACF,KAAA;IACAc,MAAAA,EAAQ;QACN1B,UAAAA,EAAY;YACVa,kBAAAA,EAAoB;gBAClBc,MAAAA,EAAQ;AACV,aAAA;YACAZ,iBAAAA,EAAmB;gBACjBY,MAAAA,EAAQ;AACV;AACF;AACF;AACF,CAAA;;;;"}

package/dist/server/server/src/content-types/User.mjs

@@ -58,6 +58,12 @@ var User = {
             private: true,
             searchable: false
         },
+        resetPasswordTokenExpiresAt: {
+            type: 'datetime',
+            configurable: false,
+            private: true,
+            searchable: false
+        },
         registrationToken: {
             type: 'string',
             configurable: false,

package/dist/server/server/src/content-types/User.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"User.mjs","sources":["../../../../../server/src/content-types/User.ts"],"sourcesContent":["export default {\n  collectionName: 'admin_users',\n  info: {\n    name: 'User',\n    description: '',\n    singularName: 'user',\n    pluralName: 'users',\n    displayName: 'User',\n  },\n  pluginOptions: {\n    'content-manager': {\n      visible: false,\n    },\n    'content-type-builder': {\n      visible: false,\n    },\n  },\n  attributes: {\n    firstname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    lastname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    username: {\n      type: 'string',\n      unique: false,\n      configurable: false,\n      required: false,\n    },\n    email: {\n      type: 'email',\n      minLength: 6,\n      configurable: false,\n      required: true,\n      unique: true,\n      private: true,\n    },\n    password: {\n      type: 'password',\n      minLength: 6,\n      configurable: false,\n      required: false,\n      private: true,\n      searchable: false,\n    },\n    resetPasswordToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    registrationToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    isActive: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    roles: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'manyToMany',\n      inversedBy: 'users',\n      target: 'admin::role',\n      // FIXME: Allow setting this\n      collectionName: 'strapi_users_roles',\n    },\n    apiTokens: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'oneToMany',\n      mappedBy: 'adminUserOwner',\n      target: 'admin::api-token',\n    },\n    blocked: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    preferedLanguage: {\n      type: 'string',\n      configurable: false,\n      required: false,\n      searchable: false,\n    },\n  },\n  config: {\n    attributes: {\n      resetPasswordToken: {\n        hidden: true,\n      },\n      registrationToken: {\n        hidden: true,\n      },\n    },\n  },\n};\n"],"names":["collectionName","info","name","description","singularName","pluralName","displayName","pluginOptions","visible","attributes","firstname","type","unique","minLength","configurable","required","lastname","username","email","private","password","searchable","resetPasswordToken","registrationToken","isActive","default","roles","relation","inversedBy","target","apiTokens","mappedBy","blocked","preferedLanguage","config","hidden"],"mappings":"AAAA,WAAe;IACbA,cAAAA,EAAgB,aAAA;IAChBC,IAAAA,EAAM;QACJC,IAAAA,EAAM,MAAA;QACNC,WAAAA,EAAa,EAAA;QACbC,YAAAA,EAAc,MAAA;QACdC,UAAAA,EAAY,OAAA;QACZC,WAAAA,EAAa;AACf,KAAA;IACAC,aAAAA,EAAe;QACb,iBAAA,EAAmB;YACjBC,OAAAA,EAAS;AACX,SAAA;QACA,sBAAA,EAAwB;YACtBA,OAAAA,EAAS;AACX;AACF,KAAA;IACAC,UAAAA,EAAY;QACVC,SAAAA,EAAW;YACTC,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAC,QAAAA,EAAU;YACRL,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAE,QAAAA,EAAU;YACRN,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRE,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAG,KAAAA,EAAO;YACLP,IAAAA,EAAM,OAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,IAAA;YACVH,MAAAA,EAAQ,IAAA;YACRO,OAAAA,EAAS;AACX,SAAA;QACAC,QAAAA,EAAU;YACRT,IAAAA,EAAM,UAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVI,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAC,kBAAAA,EAAoB;YAClBX,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAE,iBAAAA,EAAmB;YACjBZ,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAG,QAAAA,EAAU;YACRb,IAAAA,EAAM,SAAA;YACNc,OAAAA,EAAS,KAAA;YACTX,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAO,KAAAA,EAAO;YACLZ,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNgB,QAAAA,EAAU,YAAA;YACVC,UAAAA,EAAY,OAAA;YACZC,MAAAA,EAAQ,aAAA;;YAER7B,cAAAA,EAAgB;AAClB,SAAA;QACA8B,SAAAA,EAAW;YACThB,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNgB,QAAAA,EAAU,WAAA;YACVI,QAAAA,EAAU,gBAAA;YACVF,MAAAA,EAAQ;AACV,SAAA;QACAG,OAAAA,EAAS;YACPrB,IAAAA,EAAM,SAAA;YACNc,OAAAA,EAAS,KAAA;YACTX,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAc,gBAAAA,EAAkB;YAChBtB,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVM,UAAAA,EAAY;AACd;AACF,KAAA;IACAa,MAAAA,EAAQ;QACNzB,UAAAA,EAAY;YACVa,kBAAAA,EAAoB;gBAClBa,MAAAA,EAAQ;AACV,aAAA;YACAZ,iBAAAA,EAAmB;gBACjBY,MAAAA,EAAQ;AACV;AACF;AACF;AACF,CAAA;;;;"}
+{"version":3,"file":"User.mjs","sources":["../../../../../server/src/content-types/User.ts"],"sourcesContent":["export default {\n  collectionName: 'admin_users',\n  info: {\n    name: 'User',\n    description: '',\n    singularName: 'user',\n    pluralName: 'users',\n    displayName: 'User',\n  },\n  pluginOptions: {\n    'content-manager': {\n      visible: false,\n    },\n    'content-type-builder': {\n      visible: false,\n    },\n  },\n  attributes: {\n    firstname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    lastname: {\n      type: 'string',\n      unique: false,\n      minLength: 1,\n      configurable: false,\n      required: false,\n    },\n    username: {\n      type: 'string',\n      unique: false,\n      configurable: false,\n      required: false,\n    },\n    email: {\n      type: 'email',\n      minLength: 6,\n      configurable: false,\n      required: true,\n      unique: true,\n      private: true,\n    },\n    password: {\n      type: 'password',\n      minLength: 6,\n      configurable: false,\n      required: false,\n      private: true,\n      searchable: false,\n    },\n    resetPasswordToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    resetPasswordTokenExpiresAt: {\n      type: 'datetime',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    registrationToken: {\n      type: 'string',\n      configurable: false,\n      private: true,\n      searchable: false,\n    },\n    isActive: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    roles: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'manyToMany',\n      inversedBy: 'users',\n      target: 'admin::role',\n      // FIXME: Allow setting this\n      collectionName: 'strapi_users_roles',\n    },\n    apiTokens: {\n      configurable: false,\n      private: true,\n      type: 'relation',\n      relation: 'oneToMany',\n      mappedBy: 'adminUserOwner',\n      target: 'admin::api-token',\n    },\n    blocked: {\n      type: 'boolean',\n      default: false,\n      configurable: false,\n      private: true,\n    },\n    preferedLanguage: {\n      type: 'string',\n      configurable: false,\n      required: false,\n      searchable: false,\n    },\n  },\n  config: {\n    attributes: {\n      resetPasswordToken: {\n        hidden: true,\n      },\n      registrationToken: {\n        hidden: true,\n      },\n    },\n  },\n};\n"],"names":["collectionName","info","name","description","singularName","pluralName","displayName","pluginOptions","visible","attributes","firstname","type","unique","minLength","configurable","required","lastname","username","email","private","password","searchable","resetPasswordToken","resetPasswordTokenExpiresAt","registrationToken","isActive","default","roles","relation","inversedBy","target","apiTokens","mappedBy","blocked","preferedLanguage","config","hidden"],"mappings":"AAAA,WAAe;IACbA,cAAAA,EAAgB,aAAA;IAChBC,IAAAA,EAAM;QACJC,IAAAA,EAAM,MAAA;QACNC,WAAAA,EAAa,EAAA;QACbC,YAAAA,EAAc,MAAA;QACdC,UAAAA,EAAY,OAAA;QACZC,WAAAA,EAAa;AACf,KAAA;IACAC,aAAAA,EAAe;QACb,iBAAA,EAAmB;YACjBC,OAAAA,EAAS;AACX,SAAA;QACA,sBAAA,EAAwB;YACtBA,OAAAA,EAAS;AACX;AACF,KAAA;IACAC,UAAAA,EAAY;QACVC,SAAAA,EAAW;YACTC,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAC,QAAAA,EAAU;YACRL,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRC,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAE,QAAAA,EAAU;YACRN,IAAAA,EAAM,QAAA;YACNC,MAAAA,EAAQ,KAAA;YACRE,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU;AACZ,SAAA;QACAG,KAAAA,EAAO;YACLP,IAAAA,EAAM,OAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,IAAA;YACVH,MAAAA,EAAQ,IAAA;YACRO,OAAAA,EAAS;AACX,SAAA;QACAC,QAAAA,EAAU;YACRT,IAAAA,EAAM,UAAA;YACNE,SAAAA,EAAW,CAAA;YACXC,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVI,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAC,kBAAAA,EAAoB;YAClBX,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAE,2BAAAA,EAA6B;YAC3BZ,IAAAA,EAAM,UAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAG,iBAAAA,EAAmB;YACjBb,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTE,UAAAA,EAAY;AACd,SAAA;QACAI,QAAAA,EAAU;YACRd,IAAAA,EAAM,SAAA;YACNe,OAAAA,EAAS,KAAA;YACTZ,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAQ,KAAAA,EAAO;YACLb,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNiB,QAAAA,EAAU,YAAA;YACVC,UAAAA,EAAY,OAAA;YACZC,MAAAA,EAAQ,aAAA;;YAER9B,cAAAA,EAAgB;AAClB,SAAA;QACA+B,SAAAA,EAAW;YACTjB,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS,IAAA;YACTR,IAAAA,EAAM,UAAA;YACNiB,QAAAA,EAAU,WAAA;YACVI,QAAAA,EAAU,gBAAA;YACVF,MAAAA,EAAQ;AACV,SAAA;QACAG,OAAAA,EAAS;YACPtB,IAAAA,EAAM,SAAA;YACNe,OAAAA,EAAS,KAAA;YACTZ,YAAAA,EAAc,KAAA;YACdK,OAAAA,EAAS;AACX,SAAA;QACAe,gBAAAA,EAAkB;YAChBvB,IAAAA,EAAM,QAAA;YACNG,YAAAA,EAAc,KAAA;YACdC,QAAAA,EAAU,KAAA;YACVM,UAAAA,EAAY;AACd;AACF,KAAA;IACAc,MAAAA,EAAQ;QACN1B,UAAAA,EAAY;YACVa,kBAAAA,EAAoB;gBAClBc,MAAAA,EAAQ;AACV,aAAA;YACAZ,iBAAAA,EAAmB;gBACjBY,MAAAA,EAAQ;AACV;AACF;AACF;AACF,CAAA;;;;"}

package/dist/server/server/src/controllers/authentication.js

@@ -16,9 +16,6 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 var passport__default = /*#__PURE__*/_interopDefault(passport);
 var compose__default = /*#__PURE__*/_interopDefault(compose);
 
-const buildSessionMetadataFromContext = (ctx)=>utils.buildSessionMetadata({
-        userAgent: ctx.request.headers['user-agent']
-    });
 const { ApplicationError, ValidationError } = utils.errors;
 var authentication = {
     login: compose__default.default([
@@ -70,7 +67,7 @@ var authentication = {
                 const { deviceId, rememberMe } = sessionAuth.extractDeviceParams(ctx.request.body);
                 const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
                     type: rememberMe ? 'refresh' : 'session',
-                    metadata: buildSessionMetadataFromContext(ctx)
+                    metadata: sessionAuth.buildSessionMetadataFromContext(ctx)
                 });
                 const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt, ctx.request.secure);
                 ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
@@ -116,7 +113,7 @@ var authentication = {
             const { deviceId, rememberMe } = sessionAuth.extractDeviceParams(ctx.request.body);
             const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
                 type: rememberMe ? 'refresh' : 'session',
-                metadata: buildSessionMetadataFromContext(ctx)
+                metadata: sessionAuth.buildSessionMetadataFromContext(ctx)
             });
             const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt, ctx.request.secure);
             ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
@@ -151,7 +148,7 @@ var authentication = {
             const { deviceId, rememberMe } = sessionAuth.extractDeviceParams(ctx.request.body);
             const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
                 type: rememberMe ? 'refresh' : 'session',
-                metadata: buildSessionMetadataFromContext(ctx)
+                metadata: sessionAuth.buildSessionMetadataFromContext(ctx)
             });
             const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry(rememberMe ? 'refresh' : 'session', absoluteExpiresAt, ctx.request.secure);
             ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, refreshToken, cookieOptions);
@@ -194,7 +191,7 @@ var authentication = {
             await sessionManager('admin').invalidateRefreshToken(userId);
             const { token: refreshToken, absoluteExpiresAt } = await sessionManager('admin').generateRefreshToken(userId, deviceId, {
                 type: 'session',
-                metadata: buildSessionMetadataFromContext(ctx)
+                metadata: sessionAuth.buildSessionMetadataFromContext(ctx)
             });
             // No rememberMe flow here; expire with session by default (session cookie)
             const cookieOptions = sessionAuth.buildCookieOptionsWithExpiry('session', absoluteExpiresAt, ctx.request.secure);
@@ -254,8 +251,6 @@ var authentication = {
         strapi.eventHub.emit('admin.logout', {
             user: sanitizedUser
         });
-        const bodyDeviceId = ctx.request.body?.deviceId;
-        const deviceId = typeof bodyDeviceId === 'string' ? bodyDeviceId : undefined;
         // Clear cookie regardless of token validity
         ctx.cookies.set(sessionAuth.REFRESH_COOKIE_NAME, '', {
             ...sessionAuth.getRefreshCookieOptions(ctx.request.secure),
@@ -265,7 +260,14 @@ var authentication = {
             const sessionManager = sessionAuth.getSessionManager();
             if (sessionManager) {
                 const userId = String(ctx.state.user.id);
-                await sessionManager('admin').invalidateRefreshToken(userId, deviceId);
+                const bodyDeviceId = ctx.request.body?.deviceId;
+                const sessionId = ctx.state.session?.id;
+                if (typeof bodyDeviceId === 'string' && bodyDeviceId.length > 0) {
+                    const deviceId = await sessionAuth.resolveLogoutDeviceId(userId, sessionId, bodyDeviceId);
+                    await sessionManager('admin').invalidateRefreshToken(userId, deviceId);
+                } else {
+                    await sessionManager('admin').invalidateRefreshToken(userId);
+                }
             }
         } catch (err) {
             strapi.log.error('Failed to revoke admin sessions during logout', err);

package/dist/server/server/src/controllers/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport { errors, buildSessionMetadata } from '@strapi/utils';\nimport { getService } from '../utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegisterAdmin,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\nconst { ApplicationError, ValidationError } = errors;\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          strapi.eventHub.emit('admin.auth.error', {\n            error: new Error(info.message),\n            provider: 'local',\n          });\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n          metadata: buildSessionMetadataFromContext(ctx),\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt,\n          ctx.request.secure\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as RegisterAdmin.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const user = await getService('user').createFirstAdmin(input);\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies RegisterAdmin.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    getService('auth').forgotPassword(input);\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(\n        rotation.type,\n        rotation.absoluteExpiresAt,\n        ctx.request.secure\n      );\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    const bodyDeviceId = ctx.request.body?.deviceId as string | undefined;\n    const deviceId = typeof bodyDeviceId === 'string' ? bodyDeviceId : undefined;\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(ctx.request.secure),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","ApplicationError","ValidationError","errors","login","compose","next","validateLoginSessionInput","body","passport","authenticate","session","err","user","info","strapi","eventHub","emit","error","provider","details","code","notImplemented","Error","message","query","state","sanitizedUser","getService","sanitizeUser","sessionManager","getSessionManager","internalServerError","userId","String","id","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","cookieOptions","buildCookieOptionsWithExpiry","secure","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","createFirstAdmin","telemetry","send","forgotPassword","validateForgotPasswordInput","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","bodyDeviceId","undefined","getRefreshCookieOptions","expires","Date"],"mappings":";;;;;;;;;;;;;;;;;;AAkCA,MAAMA,+BAAAA,GAAkC,CAACC,GAAAA,GACvCC,0BAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;AACjC,KAAA,CAAA;AAEF,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAE9C,qBAAe;AACbC,IAAAA,KAAAA,EAAOC,wBAAAA,CAAQ;AACb,QAAA,OAAOT,GAAAA,EAAcU,IAAAA,GAAAA;AACnB,YAAA,MAAMC,MAA0BX,GAAAA,CAAIG,OAAO,CAACS,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOF,IAAAA,EAAAA;AACT,QAAA,CAAA;AACA,QAAA,CAACV,GAAAA,EAAcU,IAAAA,GAAAA;YACb,OAAOG,yBAAAA,CAASC,YAAY,CAAC,OAAA,EAAS;gBAAEC,OAAAA,EAAS;aAAM,EAAG,CAACC,KAAKC,IAAAA,EAAMC,IAAAA,GAAAA;AACpE,gBAAA,IAAIF,GAAAA,EAAK;AACPG,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBAAEC,KAAAA,EAAON,GAAAA;wBAAKO,QAAAA,EAAU;AAAQ,qBAAA,CAAA;;AAEzE,oBAAA,IAAIP,GAAAA,CAAIQ,OAAO,EAAEC,IAAAA,KAAS,mBAAA,EAAqB;wBAC7C,MAAMT,GAAAA;AACR,oBAAA;;AAGA,oBAAA,OAAOhB,IAAI0B,cAAc,EAAA;AAC3B,gBAAA;AAEA,gBAAA,IAAI,CAACT,IAAAA,EAAM;AACTE,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBACvCC,KAAAA,EAAO,IAAIK,KAAAA,CAAMT,IAAAA,CAAKU,OAAO,CAAA;wBAC7BL,QAAAA,EAAU;AACZ,qBAAA,CAAA;oBACA,MAAM,IAAIlB,gBAAAA,CAAiBa,IAAAA,CAAKU,OAAO,CAAA;AACzC,gBAAA;gBAEA,MAAMC,KAAAA,GAAQ7B,IAAI8B,KAAK;AACvBD,gBAAAA,KAAAA,CAAMZ,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAMc,aAAAA,GAAgBC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;oBAAEJ,IAAAA,EAAMc,aAAAA;oBAAeR,QAAAA,EAAU;AAAQ,iBAAA,CAAA;gBAEpF,OAAOb,IAAAA,EAAAA;AACT,YAAA,CAAA,CAAA,CAAGV,GAAAA,EAAKU,IAAAA,CAAAA;AACV,QAAA,CAAA;QACA,OAAOV,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAEiB,IAAI,EAAE,GAAGjB,IAAI8B,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMI,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,oBAAA,OAAOlC,IAAIoC,mBAAmB,EAAA;AAChC,gBAAA;gBACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;gBAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoB1C,GAAAA,CAAIG,OAAO,CAACS,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,oBAAAA,QAAAA,EAAUjD,+BAAAA,CAAgCC,GAAAA;AAC5C,iBAAA,CAAA;gBAEA,MAAMiD,aAAAA,GAAgBC,yCACpBT,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACA7C,GAAAA,CAAIG,OAAO,CAACgD,MAAM,CAAA;AAEpBnD,gBAAAA,GAAAA,CAAIoD,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcK,aAAAA,CAAAA;AAEnD,gBAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWW,YAAAA,EAAc;AAC3B,oBAAA,OAAOvD,IAAIoC,mBAAmB,EAAA;AAChC,gBAAA;AAEA,gBAAA,MAAM,EAAEO,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/BvD,gBAAAA,GAAAA,CAAIY,IAAI,GAAG;oBACT8C,IAAAA,EAAM;wBACJf,KAAAA,EAAOc,WAAAA;AACPA,wBAAAA,WAAAA;AACAxC,wBAAAA,IAAAA,EAAMe,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACjC,GAAAA,CAAI8B,KAAK,CAACb,IAAI;AACtD;AACF,iBAAA;AACF,YAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,gBAAAA,MAAAA,CAAOwC,GAAG,CAACrC,KAAK,CAAC,wCAAA,EAA0CA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOtB,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;AACF,QAAA;AACD,KAAA,CAAA;AAED,IAAA,MAAMwB,kBAAiB5D,GAAY,EAAA;AACjC,QAAA,MAAM6D,sCAAAA,CAA8B7D,GAAAA,CAAIG,OAAO,CAAC0B,KAAK,CAAA;AAErD,QAAA,MAAM,EAAEiC,iBAAiB,EAAE,GAAG9D,GAAAA,CAAIG,OAAO,CAAC0B,KAAK;AAE/C,QAAA,MAAM+B,gBAAAA,GAAmB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ+B,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAAA,EAAkB;AACrB,YAAA,MAAM,IAAItD,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,QAAA;AAEAN,QAAAA,GAAAA,CAAIY,IAAI,GAAG;YAAE8C,IAAAA,EAAME;AAAiB,SAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMI,UAAShE,GAAY,EAAA;AACzB,QAAA,MAAMiE,KAAAA,GAAQjE,GAAAA,CAAIG,OAAO,CAACS,IAAI;AAE9B,QAAA,MAAMsD,kCAAAA,CAA0BD,KAAAA,CAAAA;AAEhC,QAAA,MAAMhD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQgC,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAM/B,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOlC,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoB1C,GAAAA,CAAIG,OAAO,CAACS,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUjD,+BAAAA,CAAgCC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAMiD,aAAAA,GAAgBC,yCACpBT,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACA7C,GAAAA,CAAIG,OAAO,CAACgD,MAAM,CAAA;AAEpBnD,YAAAA,GAAAA,CAAIoD,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcK,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWW,YAAAA,EAAc;AAC3B,gBAAA,OAAOvD,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/BvD,YAAAA,GAAAA,CAAIY,IAAI,GAAG;gBACT8C,IAAAA,EAAM;oBACJf,KAAAA,EAAOc,WAAAA;AACPA,oBAAAA,WAAAA;oBACAxC,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOwC,GAAG,CAACrC,KAAK,CAAC,wDAAA,EAA0DA,KAAAA,CAAAA;AAC3E,YAAA,OAAOtB,IAAIoC,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAM+B,eAAcnE,GAAY,EAAA;AAC9B,QAAA,MAAMiE,KAAAA,GAAQjE,GAAAA,CAAIG,OAAO,CAACS,IAAI;AAE9B,QAAA,MAAMwD,uCAAAA,CAA+BH,KAAAA,CAAAA;AAErC,QAAA,MAAMhD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQqC,gBAAgB,CAACJ,KAAAA,CAAAA;QAEvD9C,MAAAA,CAAOmD,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAMrC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOlC,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoB1C,GAAAA,CAAIG,OAAO,CAACS,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUjD,+BAAAA,CAAgCC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAMiD,aAAAA,GAAgBC,yCACpBT,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACA7C,GAAAA,CAAIG,OAAO,CAACgD,MAAM,CAAA;AAEpBnD,YAAAA,GAAAA,CAAIoD,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcK,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWW,YAAAA,EAAc;AAC3B,gBAAA,OAAOvD,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/BvD,YAAAA,GAAAA,CAAIY,IAAI,GAAG;gBACT8C,IAAAA,EAAM;oBACJf,KAAAA,EAAOc,WAAAA;AACPA,oBAAAA,WAAAA;oBACAxC,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOwC,GAAG,CAACrC,KAAK,CAAC,8DAAA,EAAgEA,KAAAA,CAAAA;AACjF,YAAA,OAAOtB,IAAIoC,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMoC,gBAAexE,GAAY,EAAA;AAC/B,QAAA,MAAMiE,KAAAA,GAAQjE,GAAAA,CAAIG,OAAO,CAACS,IAAI;AAE9B,QAAA,MAAM6D,cAAAA,CAA4BR,KAAAA,CAAAA;QAElCjC,gBAAAA,CAAW,MAAA,CAAA,CAAQwC,cAAc,CAACP,KAAAA,CAAAA;AAElCjE,QAAAA,GAAAA,CAAI0E,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAc3E,GAAY,EAAA;AAC9B,QAAA,MAAMiE,KAAAA,GAAQjE,GAAAA,CAAIG,OAAO,CAACS,IAAI;AAE9B,QAAA,MAAMgE,aAAAA,CAA2BX,KAAAA,CAAAA;AAEjC,QAAA,MAAMhD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQ2C,aAAa,CAACV,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAM/B,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOlC,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;AAC7B,YAAA,MAAMC,QAAAA,GAAWqC,4BAAAA,EAAAA;;YAGjB,MAAM3C,cAAAA,CAAe,OAAA,CAAA,CAAS4C,sBAAsB,CAACzC,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEM,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;gBACvCO,IAAAA,EAAM,SAAA;AACNC,gBAAAA,QAAAA,EAAUjD,+BAAAA,CAAgCC,GAAAA;AAC5C,aAAA,CAAA;;AAGA,YAAA,MAAMiD,gBAAgBC,wCAAAA,CACpB,SAAA,EACAL,mBACA7C,GAAAA,CAAIG,OAAO,CAACgD,MAAM,CAAA;AAEpBnD,YAAAA,GAAAA,CAAIoD,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcK,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWW,YAAAA,EAAc;AAC3B,gBAAA,OAAOvD,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAM,EAAEO,KAAK,EAAE,GAAGY,YAAAA;AAElBvD,YAAAA,GAAAA,CAAIY,IAAI,GAAG;gBACT8C,IAAAA,EAAM;AACJf,oBAAAA,KAAAA;oBACA1B,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOD,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOwC,GAAG,CAACrC,KAAK,CAAC,8DAAA,EAAgEN,GAAAA,CAAAA;AACjF,YAAA,OAAOhB,IAAIoC,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqB,aAAYzD,GAAY,EAAA;AAC5B,QAAA,MAAM4C,YAAAA,GAAe5C,GAAAA,CAAIoD,OAAO,CAAC2B,GAAG,CAACzB,+BAAAA,CAAAA;AAErC,QAAA,IAAI,CAACV,YAAAA,EAAc;YACjB,OAAO5C,GAAAA,CAAIgF,YAAY,CAAC,uBAAA,CAAA;AAC1B,QAAA;QAEA,IAAI;AACF,YAAA,MAAM9C,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOlC,IAAIoC,mBAAmB,EAAA;AAChC,YAAA;;;AAIA,YAAA,MAAM6C,QAAAA,GAAW,MAAM/C,cAAAA,CAAe,OAAA,CAAA,CAASgD,kBAAkB,CAACtC,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAWqC,QAAAA,EAAU;gBACvB,OAAOjF,GAAAA,CAAIgF,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;AAEA,YAAA,MAAMG,SAAS,MAAMjD,cAAAA,CAAe,SAASsB,mBAAmB,CAACyB,SAAStC,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAWwC,MAAAA,EAAQ;gBACrB,OAAOnF,GAAAA,CAAIgF,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;YAEA,MAAM,EAAErC,KAAK,EAAE,GAAGwC,MAAAA;;YAElB,MAAMC,IAAAA,GAAOlC,wCAAAA,CACX+B,QAAAA,CAASlC,IAAI,EACbkC,QAAAA,CAASpC,iBAAiB,EAC1B7C,GAAAA,CAAIG,OAAO,CAACgD,MAAM,CAAA;AAGpBnD,YAAAA,GAAAA,CAAIoD,OAAO,CAACC,GAAG,CAACC,+BAAAA,EAAqB2B,QAAAA,CAAStC,KAAK,EAAEyC,IAAAA,CAAAA;AACrDpF,YAAAA,GAAAA,CAAIY,IAAI,GAAG;gBAAE8C,IAAAA,EAAM;AAAEf,oBAAAA;AAAM;AAAE,aAAA;AAC/B,QAAA,CAAA,CAAE,OAAO3B,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOwC,GAAG,CAACrC,KAAK,CAAC,oDAAA,EAAsDN,GAAAA,CAAAA;AACvE,YAAA,OAAOhB,IAAIoC,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMiD,QAAOrF,GAAY,EAAA;QACvB,MAAM+B,aAAAA,GAAgBC,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACjC,GAAAA,CAAI8B,KAAK,CAACb,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,cAAA,EAAgB;YAAEJ,IAAAA,EAAMc;AAAc,SAAA,CAAA;AAE3D,QAAA,MAAMuD,YAAAA,GAAetF,GAAAA,CAAIG,OAAO,CAACS,IAAI,EAAE4B,QAAAA;AACvC,QAAA,MAAMA,QAAAA,GAAW,OAAO8C,YAAAA,KAAiB,QAAA,GAAWA,YAAAA,GAAeC,SAAAA;;AAGnEvF,QAAAA,GAAAA,CAAIoD,OAAO,CAACC,GAAG,CAACC,iCAAqB,EAAA,EAAI;AACvC,YAAA,GAAGkC,mCAAAA,CAAwBxF,GAAAA,CAAIG,OAAO,CAACgD,MAAM,CAAC;AAC9CsC,YAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAMxD,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAID,cAAAA,EAAgB;AAClB,gBAAA,MAAMG,SAASC,MAAAA,CAAOtC,GAAAA,CAAI8B,KAAK,CAACb,IAAI,CAACsB,EAAE,CAAA;AACvC,gBAAA,MAAML,cAAAA,CAAe,OAAA,CAAA,CAAS4C,sBAAsB,CAACzC,MAAAA,EAAQG,QAAAA,CAAAA;AAC/D,YAAA;AACF,QAAA,CAAA,CAAE,OAAOxB,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOwC,GAAG,CAACrC,KAAK,CAAC,+CAAA,EAAiDN,GAAAA,CAAAA;AACpE,QAAA;AAEAhB,QAAAA,GAAAA,CAAIY,IAAI,GAAG;AAAE8C,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"authentication.js","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n  resolveLogoutDeviceId,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegisterAdmin,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError, ValidationError } = errors;\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          strapi.eventHub.emit('admin.auth.error', {\n            error: new Error(info.message),\n            provider: 'local',\n          });\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n          metadata: buildSessionMetadataFromContext(ctx),\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt,\n          ctx.request.secure\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as RegisterAdmin.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const user = await getService('user').createFirstAdmin(input);\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies RegisterAdmin.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    getService('auth').forgotPassword(input);\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(\n        rotation.type,\n        rotation.absoluteExpiresAt,\n        ctx.request.secure\n      );\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(ctx.request.secure),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        const bodyDeviceId = (ctx.request.body as { deviceId?: string } | undefined)?.deviceId;\n        const sessionId = (ctx.state.session as { id?: string } | undefined)?.id;\n\n        if (typeof bodyDeviceId === 'string' && bodyDeviceId.length > 0) {\n          const deviceId = await resolveLogoutDeviceId(userId, sessionId, bodyDeviceId);\n          await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n        } else {\n          await sessionManager('admin').invalidateRefreshToken(userId);\n        }\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["ApplicationError","ValidationError","errors","login","compose","ctx","next","validateLoginSessionInput","request","body","passport","authenticate","session","err","user","info","strapi","eventHub","emit","error","provider","details","code","notImplemented","Error","message","query","state","sanitizedUser","getService","sanitizeUser","sessionManager","getSessionManager","internalServerError","userId","String","id","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","secure","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","createFirstAdmin","telemetry","send","forgotPassword","validateForgotPasswordInput","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","getRefreshCookieOptions","expires","Date","bodyDeviceId","sessionId","length","resolveLogoutDeviceId"],"mappings":";;;;;;;;;;;;;;;;;;AAoCA,MAAM,EAAEA,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAE9C,qBAAe;AACbC,IAAAA,KAAAA,EAAOC,wBAAAA,CAAQ;AACb,QAAA,OAAOC,GAAAA,EAAcC,IAAAA,GAAAA;AACnB,YAAA,MAAMC,MAA0BF,GAAAA,CAAIG,OAAO,CAACC,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOH,IAAAA,EAAAA;AACT,QAAA,CAAA;AACA,QAAA,CAACD,GAAAA,EAAcC,IAAAA,GAAAA;YACb,OAAOI,yBAAAA,CAASC,YAAY,CAAC,OAAA,EAAS;gBAAEC,OAAAA,EAAS;aAAM,EAAG,CAACC,KAAKC,IAAAA,EAAMC,IAAAA,GAAAA;AACpE,gBAAA,IAAIF,GAAAA,EAAK;AACPG,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBAAEC,KAAAA,EAAON,GAAAA;wBAAKO,QAAAA,EAAU;AAAQ,qBAAA,CAAA;;AAEzE,oBAAA,IAAIP,GAAAA,CAAIQ,OAAO,EAAEC,IAAAA,KAAS,mBAAA,EAAqB;wBAC7C,MAAMT,GAAAA;AACR,oBAAA;;AAGA,oBAAA,OAAOR,IAAIkB,cAAc,EAAA;AAC3B,gBAAA;AAEA,gBAAA,IAAI,CAACT,IAAAA,EAAM;AACTE,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBACvCC,KAAAA,EAAO,IAAIK,KAAAA,CAAMT,IAAAA,CAAKU,OAAO,CAAA;wBAC7BL,QAAAA,EAAU;AACZ,qBAAA,CAAA;oBACA,MAAM,IAAIpB,gBAAAA,CAAiBe,IAAAA,CAAKU,OAAO,CAAA;AACzC,gBAAA;gBAEA,MAAMC,KAAAA,GAAQrB,IAAIsB,KAAK;AACvBD,gBAAAA,KAAAA,CAAMZ,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAMc,aAAAA,GAAgBC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;oBAAEJ,IAAAA,EAAMc,aAAAA;oBAAeR,QAAAA,EAAU;AAAQ,iBAAA,CAAA;gBAEpF,OAAOd,IAAAA,EAAAA;AACT,YAAA,CAAA,CAAA,CAAGD,GAAAA,EAAKC,IAAAA,CAAAA;AACV,QAAA,CAAA;QACA,OAAOD,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAES,IAAI,EAAE,GAAGT,IAAIsB,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMI,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,oBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,gBAAA;gBACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;gBAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,oBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,iBAAA,CAAA;gBAEA,MAAM0C,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,gBAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,gBAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,oBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,gBAAA;AAEA,gBAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,gBAAAA,GAAAA,CAAII,IAAI,GAAG;oBACT+C,IAAAA,EAAM;wBACJhB,KAAAA,EAAOe,WAAAA;AACPA,wBAAAA,WAAAA;AACAzC,wBAAAA,IAAAA,EAAMe,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACzB,GAAAA,CAAIsB,KAAK,CAACb,IAAI;AACtD;AACF,iBAAA;AACF,YAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,gBAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,wCAAA,EAA0CA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AACF,QAAA;AACD,KAAA,CAAA;AAED,IAAA,MAAMyB,kBAAiBrD,GAAY,EAAA;AACjC,QAAA,MAAMsD,sCAAAA,CAA8BtD,GAAAA,CAAIG,OAAO,CAACkB,KAAK,CAAA;AAErD,QAAA,MAAM,EAAEkC,iBAAiB,EAAE,GAAGvD,GAAAA,CAAIG,OAAO,CAACkB,KAAK;AAE/C,QAAA,MAAMgC,gBAAAA,GAAmB,MAAM7B,gBAAAA,CAAW,MAAA,CAAA,CAAQgC,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAAA,EAAkB;AACrB,YAAA,MAAM,IAAIzD,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,QAAA;AAEAI,QAAAA,GAAAA,CAAII,IAAI,GAAG;YAAE+C,IAAAA,EAAME;AAAiB,SAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMI,UAASzD,GAAY,EAAA;AACzB,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMuD,kCAAAA,CAA0BD,KAAAA,CAAAA;AAEhC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQiC,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAMhC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAM0C,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzC,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,wDAAA,EAA0DA,KAAAA,CAAAA;AAC3E,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMgC,eAAc5D,GAAY,EAAA;AAC9B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMyD,uCAAAA,CAA+BH,KAAAA,CAAAA;AAErC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQsC,gBAAgB,CAACJ,KAAAA,CAAAA;QAEvD/C,MAAAA,CAAOoD,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAMtC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAM0C,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzC,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,8DAAA,EAAgEA,KAAAA,CAAAA;AACjF,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqC,gBAAejE,GAAY,EAAA;AAC/B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAM8D,cAAAA,CAA4BR,KAAAA,CAAAA;QAElClC,gBAAAA,CAAW,MAAA,CAAA,CAAQyC,cAAc,CAACP,KAAAA,CAAAA;AAElC1D,QAAAA,GAAAA,CAAImE,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAcpE,GAAY,EAAA;AAC9B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMiE,aAAAA,CAA2BX,KAAAA,CAAAA;AAEjC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQ4C,aAAa,CAACV,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAMhC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;AAC7B,YAAA,MAAMC,QAAAA,GAAWsC,4BAAAA,EAAAA;;YAGjB,MAAM5C,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEM,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;gBACvCO,IAAAA,EAAM,SAAA;AACNC,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;;AAGA,YAAA,MAAM0C,gBAAgBC,wCAAAA,CACpB,SAAA,EACAN,mBACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAM,EAAEO,KAAK,EAAE,GAAGa,YAAAA;AAElBhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;AACJhB,oBAAAA,KAAAA;oBACA1B,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOD,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,8DAAA,EAAgEN,GAAAA,CAAAA;AACjF,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMsB,aAAYlD,GAAY,EAAA;AAC5B,QAAA,MAAMoC,YAAAA,GAAepC,GAAAA,CAAI6C,OAAO,CAAC2B,GAAG,CAACzB,+BAAAA,CAAAA;AAErC,QAAA,IAAI,CAACX,YAAAA,EAAc;YACjB,OAAOpC,GAAAA,CAAIyE,YAAY,CAAC,uBAAA,CAAA;AAC1B,QAAA;QAEA,IAAI;AACF,YAAA,MAAM/C,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;;;AAIA,YAAA,MAAM8C,QAAAA,GAAW,MAAMhD,cAAAA,CAAe,OAAA,CAAA,CAASiD,kBAAkB,CAACvC,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAWsC,QAAAA,EAAU;gBACvB,OAAO1E,GAAAA,CAAIyE,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;AAEA,YAAA,MAAMG,SAAS,MAAMlD,cAAAA,CAAe,SAASuB,mBAAmB,CAACyB,SAASvC,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAWyC,MAAAA,EAAQ;gBACrB,OAAO5E,GAAAA,CAAIyE,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;YAEA,MAAM,EAAEtC,KAAK,EAAE,GAAGyC,MAAAA;;YAElB,MAAMC,IAAAA,GAAOlC,wCAAAA,CACX+B,QAAAA,CAASnC,IAAI,EACbmC,QAAAA,CAASrC,iBAAiB,EAC1BrC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAGpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,+BAAAA,EAAqB2B,QAAAA,CAASvC,KAAK,EAAE0C,IAAAA,CAAAA;AACrD7E,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBAAE+C,IAAAA,EAAM;AAAEhB,oBAAAA;AAAM;AAAE,aAAA;AAC/B,QAAA,CAAA,CAAE,OAAO3B,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,oDAAA,EAAsDN,GAAAA,CAAAA;AACvE,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMkD,QAAO9E,GAAY,EAAA;QACvB,MAAMuB,aAAAA,GAAgBC,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACzB,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,cAAA,EAAgB;YAAEJ,IAAAA,EAAMc;AAAc,SAAA,CAAA;;AAG3DvB,QAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqB,EAAA,EAAI;AACvC,YAAA,GAAGgC,mCAAAA,CAAwB/E,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAC;AAC9CoC,YAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAMvD,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAID,cAAAA,EAAgB;AAClB,gBAAA,MAAMG,SAASC,MAAAA,CAAO9B,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAACsB,EAAE,CAAA;AACvC,gBAAA,MAAMmD,YAAAA,GAAgBlF,GAAAA,CAAIG,OAAO,CAACC,IAAI,EAAwC4B,QAAAA;AAC9E,gBAAA,MAAMmD,SAAAA,GAAanF,GAAAA,CAAIsB,KAAK,CAACf,OAAO,EAAkCwB,EAAAA;AAEtE,gBAAA,IAAI,OAAOmD,YAAAA,KAAiB,QAAA,IAAYA,YAAAA,CAAaE,MAAM,GAAG,CAAA,EAAG;AAC/D,oBAAA,MAAMpD,QAAAA,GAAW,MAAMqD,iCAAAA,CAAsBxD,MAAAA,EAAQsD,SAAAA,EAAWD,YAAAA,CAAAA;AAChE,oBAAA,MAAMxD,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,EAAQG,QAAAA,CAAAA;gBAC/D,CAAA,MAAO;oBACL,MAAMN,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,CAAAA;AACvD,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAOrB,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,+CAAA,EAAiDN,GAAAA,CAAAA;AACpE,QAAA;AAEAR,QAAAA,GAAAA,CAAII,IAAI,GAAG;AAAE+C,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB,IAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/controllers/authentication.mjs

@@ -1,17 +1,14 @@
 import passport from 'koa-passport';
 import compose from 'koa-compose';
 import '@strapi/types';
-import { errors, buildSessionMetadata } from '@strapi/utils';
+import { errors } from '@strapi/utils';
 import { getService } from '../utils/index.mjs';
-import { getSessionManager, extractDeviceParams, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getRefreshCookieOptions, generateDeviceId } from '../../../shared/utils/session-auth.mjs';
+import { getSessionManager, extractDeviceParams, buildSessionMetadataFromContext, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getRefreshCookieOptions, resolveLogoutDeviceId, generateDeviceId } from '../../../shared/utils/session-auth.mjs';
 import { validateAdminRegistrationInput, validateRegistrationInput, validateRegistrationInfoQuery } from '../validation/authentication/register.mjs';
 import validateForgotPasswordInput from '../validation/authentication/forgot-password.mjs';
 import validateResetPasswordInput from '../validation/authentication/reset-password.mjs';
 import validateLoginSessionInput from '../validation/authentication/login.mjs';
 
-const buildSessionMetadataFromContext = (ctx)=>buildSessionMetadata({
-        userAgent: ctx.request.headers['user-agent']
-    });
 const { ApplicationError, ValidationError } = errors;
 var authentication = {
     login: compose([
@@ -247,8 +244,6 @@ var authentication = {
         strapi.eventHub.emit('admin.logout', {
             user: sanitizedUser
         });
-        const bodyDeviceId = ctx.request.body?.deviceId;
-        const deviceId = typeof bodyDeviceId === 'string' ? bodyDeviceId : undefined;
         // Clear cookie regardless of token validity
         ctx.cookies.set(REFRESH_COOKIE_NAME, '', {
             ...getRefreshCookieOptions(ctx.request.secure),
@@ -258,7 +253,14 @@ var authentication = {
             const sessionManager = getSessionManager();
             if (sessionManager) {
                 const userId = String(ctx.state.user.id);
-                await sessionManager('admin').invalidateRefreshToken(userId, deviceId);
+                const bodyDeviceId = ctx.request.body?.deviceId;
+                const sessionId = ctx.state.session?.id;
+                if (typeof bodyDeviceId === 'string' && bodyDeviceId.length > 0) {
+                    const deviceId = await resolveLogoutDeviceId(userId, sessionId, bodyDeviceId);
+                    await sessionManager('admin').invalidateRefreshToken(userId, deviceId);
+                } else {
+                    await sessionManager('admin').invalidateRefreshToken(userId);
+                }
             }
         } catch (err) {
             strapi.log.error('Failed to revoke admin sessions during logout', err);