@strapi/admin 5.53.0 → 5.55.0

package/dist/server/server/src/services/api-token.mjs

@@ -1,11 +1,12 @@
 import crypto from 'crypto';
 import { pick, uniq, differenceWith, prop, omit, map, difference, isEqual, isArray, isEmpty, isNumber, isNil } from 'lodash/fp';
-import { errors } from '@strapi/utils';
+import { errors, emitAudit } from '@strapi/utils';
 import constants from './constants.mjs';
 import { getService } from '../utils/index.mjs';
 import permissionDomain from '../domain/permission/index.mjs';
 import { validatePermissionsExist } from '../validation/permission.mjs';
 import { checkExpiry, updateLastUsedAt } from '../strategies/api-token-utils.mjs';
+import { AUDITED_EVENTS, toAdminPermissionRefs, toActionRefs, getTokenChanges } from '../audit-logs/tokens.mjs';
 
 const { SUPER_ADMIN_CODE } = constants;
 const { ValidationError, NotFoundError, UnauthorizedError } = errors;
@@ -628,6 +629,20 @@ const getExpirationFields = (lifespan)=>{
                 });
             }
         }
+        await emitAudit({
+            strapi
+        }, AUDITED_EVENTS.TOKEN_CREATE, {
+            tokenId: apiToken.id,
+            name: apiToken.name,
+            kind: 'content-api',
+            description: apiToken.description ?? null,
+            lifespan: apiToken.lifespan,
+            expiresAt: apiToken.expiresAt,
+            type: apiToken.type,
+            ...apiToken.type === constants.API_TOKEN_TYPE.CUSTOM && {
+                permissions: result.permissions ?? []
+            }
+        });
         // Casted to any to avoid complex type duplication
         return omit([
             'adminPermissions',
@@ -680,6 +695,18 @@ const getExpirationFields = (lifespan)=>{
             });
         }
     }
+    await emitAudit({
+        strapi
+    }, AUDITED_EVENTS.TOKEN_CREATE, {
+        tokenId: apiToken.id,
+        name: apiToken.name,
+        kind: 'admin',
+        adminUserOwner: ownerId,
+        description: apiToken.description ?? null,
+        lifespan: apiToken.lifespan,
+        expiresAt: apiToken.expiresAt,
+        permissions: toAdminPermissionRefs(result.adminPermissions)
+    });
     // Casted to any to avoid complex type duplication
     return {
         ...omit([
@@ -695,9 +722,18 @@ const regenerate = async (id)=>{
     const apiToken = await strapi.db.query('admin::api-token').update({
         select: [
             'id',
+            'name',
             'accessKey',
             'kind'
         ],
+        // The owner id only, for the audit row; it is stripped from the response below
+        populate: {
+            adminUserOwner: {
+                select: [
+                    'id'
+                ]
+            }
+        },
         where: {
             id
         },
@@ -709,8 +745,21 @@ const regenerate = async (id)=>{
     if (!apiToken) {
         throw new NotFoundError('The provided token id does not exist');
     }
+    const ownerId = apiToken.kind === 'admin' ? resolveAdminTokenOwnerId(apiToken) : null;
+    await emitAudit({
+        strapi
+    }, AUDITED_EVENTS.TOKEN_REGENERATE, {
+        tokenId: apiToken.id,
+        name: apiToken.name,
+        kind: apiToken.kind ?? 'content-api',
+        ...ownerId != null && {
+            adminUserOwner: ownerId
+        }
+    });
     return {
-        ...apiToken,
+        ...omit([
+            'adminUserOwner'
+        ], apiToken),
         kind: apiToken.kind ?? 'content-api',
         accessKey
     };
@@ -825,6 +874,17 @@ For security reasons, prefer storing the secret in an environment variable and r
     if (deletedToken === null || deletedToken === undefined) {
         return deletedToken;
     }
+    const ownerId = deletedToken.kind === 'admin' ? resolveAdminTokenOwnerId(deletedToken) : null;
+    await emitAudit({
+        strapi
+    }, AUDITED_EVENTS.TOKEN_DELETE, {
+        tokenId: deletedToken.id,
+        name: deletedToken.name,
+        kind: deletedToken.kind ?? 'content-api',
+        ...ownerId != null && {
+            adminUserOwner: ownerId
+        }
+    });
     if (deletedToken.kind === 'admin') {
         return {
             ...deletedToken,
@@ -847,7 +907,9 @@ For security reasons, prefer storing the secret in an environment variable and r
     const originalToken = await strapi.db.query('admin::api-token').findOne({
         select: SELECT_FIELDS,
         populate: [
-            'adminUserOwner'
+            'adminUserOwner',
+            'permissions',
+            'adminPermissions'
         ],
         where: {
             id
@@ -856,6 +918,34 @@ For security reasons, prefer storing the secret in an environment variable and r
     if (!originalToken) {
         throw new NotFoundError('Token not found');
     }
+    // Populated with its permissions: the audit row for this update lists what changed,
+    // so the state before the write is needed. `type` is a content-api concept: admin
+    // tokens only carry the column default.
+    const previousSnapshot = {
+        name: originalToken.name,
+        description: originalToken.description,
+        ...originalToken.kind !== 'admin' && {
+            type: originalToken.type
+        },
+        permissions: originalToken.kind === 'admin' ? toAdminPermissionRefs(originalToken.adminPermissions) : toActionRefs(originalToken.permissions)
+    };
+    const emitUpdate = async (kind, next, adminUserOwner)=>{
+        const changes = getTokenChanges(previousSnapshot, next);
+        if (Object.keys(changes).length === 0) {
+            return;
+        }
+        await emitAudit({
+            strapi
+        }, AUDITED_EVENTS.TOKEN_UPDATE, {
+            tokenId: originalToken.id,
+            name: next.name,
+            kind,
+            changes,
+            ...adminUserOwner != null && {
+                adminUserOwner
+            }
+        });
+    };
     const raw = attributes;
     // kind is immutable after creation.
     // Null-kind rows are legacy content-api tokens — treat null and 'content-api' as the same
@@ -874,7 +964,7 @@ For security reasons, prefer storing the secret in an environment variable and r
         const changingTypeToCustom = incomingType === constants.API_TOKEN_TYPE.CUSTOM && originalToken.type !== constants.API_TOKEN_TYPE.CUSTOM;
         // Only re-validate if permissions or type are being changed
         if (incomingPermissions !== undefined || changingTypeToCustom) {
-            assertCustomTokenPermissionsValidity(resolvedType, incomingPermissions ?? originalToken.permissions);
+            assertCustomTokenPermissionsValidity(resolvedType, incomingPermissions);
         }
     } else if (originalToken.kind === 'admin') {
         assertAdminKindFields(attributes);
@@ -945,9 +1035,16 @@ For security reasons, prefer storing the secret in an environment variable and r
             });
         }
         const permissionsFromDb = await strapi.db.query('admin::api-token').load(updatedToken, 'permissions');
+        const permissions = permissionsFromDb ? toActionRefs(permissionsFromDb) : undefined;
+        await emitUpdate('content-api', {
+            name: updatedToken.name,
+            description: updatedToken.description ?? null,
+            type: updatedToken.type,
+            permissions: permissions ?? []
+        });
         return {
             ...updatedToken,
-            permissions: permissionsFromDb ? permissionsFromDb.map((p)=>p.action) : undefined
+            permissions
         };
     }
     // kind === 'admin'
@@ -959,6 +1056,11 @@ For security reasons, prefer storing the secret in an environment variable and r
     }
     const adminPermissionsFromDb = await strapi.db.query('admin::api-token').load(updatedToken, 'adminPermissions');
     const adminUserOwnerFromDb = await strapi.db.query('admin::api-token').load(updatedToken, 'adminUserOwner');
+    await emitUpdate('admin', {
+        name: updatedToken.name,
+        description: updatedToken.description ?? null,
+        permissions: toAdminPermissionRefs(adminPermissionsFromDb || [])
+    }, resolveAdminTokenOwnerId(originalToken));
     return {
         ...updatedToken,
         adminPermissions: adminPermissionsFromDb || [],