@strapi/admin 5.54.0 → 5.55.1

package/dist/server/server/src/services/api-token.js

@@ -8,6 +8,7 @@ var index = require('../utils/index.js');
 var index$1 = require('../domain/permission/index.js');
 var permission = require('../validation/permission.js');
 var apiTokenUtils = require('../strategies/api-token-utils.js');
+var tokens = require('../audit-logs/tokens.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -634,6 +635,20 @@ const getExpirationFields = (lifespan)=>{
                 });
             }
         }
+        await utils.emitAudit({
+            strapi
+        }, tokens.AUDITED_EVENTS.TOKEN_CREATE, {
+            tokenId: apiToken.id,
+            name: apiToken.name,
+            kind: 'content-api',
+            description: apiToken.description ?? null,
+            lifespan: apiToken.lifespan,
+            expiresAt: apiToken.expiresAt,
+            type: apiToken.type,
+            ...apiToken.type === constants.API_TOKEN_TYPE.CUSTOM && {
+                permissions: result.permissions ?? []
+            }
+        });
         // Casted to any to avoid complex type duplication
         return fp.omit([
             'adminPermissions',
@@ -686,6 +701,18 @@ const getExpirationFields = (lifespan)=>{
             });
         }
     }
+    await utils.emitAudit({
+        strapi
+    }, tokens.AUDITED_EVENTS.TOKEN_CREATE, {
+        tokenId: apiToken.id,
+        name: apiToken.name,
+        kind: 'admin',
+        adminUserOwner: ownerId,
+        description: apiToken.description ?? null,
+        lifespan: apiToken.lifespan,
+        expiresAt: apiToken.expiresAt,
+        permissions: tokens.toAdminPermissionRefs(result.adminPermissions)
+    });
     // Casted to any to avoid complex type duplication
     return {
         ...fp.omit([
@@ -701,9 +728,18 @@ const regenerate = async (id)=>{
     const apiToken = await strapi.db.query('admin::api-token').update({
         select: [
             'id',
+            'name',
             'accessKey',
             'kind'
         ],
+        // The owner id only, for the audit row; it is stripped from the response below
+        populate: {
+            adminUserOwner: {
+                select: [
+                    'id'
+                ]
+            }
+        },
         where: {
             id
         },
@@ -715,8 +751,21 @@ const regenerate = async (id)=>{
     if (!apiToken) {
         throw new NotFoundError('The provided token id does not exist');
     }
+    const ownerId = apiToken.kind === 'admin' ? resolveAdminTokenOwnerId(apiToken) : null;
+    await utils.emitAudit({
+        strapi
+    }, tokens.AUDITED_EVENTS.TOKEN_REGENERATE, {
+        tokenId: apiToken.id,
+        name: apiToken.name,
+        kind: apiToken.kind ?? 'content-api',
+        ...ownerId != null && {
+            adminUserOwner: ownerId
+        }
+    });
     return {
-        ...apiToken,
+        ...fp.omit([
+            'adminUserOwner'
+        ], apiToken),
         kind: apiToken.kind ?? 'content-api',
         accessKey
     };
@@ -831,6 +880,17 @@ For security reasons, prefer storing the secret in an environment variable and r
     if (deletedToken === null || deletedToken === undefined) {
         return deletedToken;
     }
+    const ownerId = deletedToken.kind === 'admin' ? resolveAdminTokenOwnerId(deletedToken) : null;
+    await utils.emitAudit({
+        strapi
+    }, tokens.AUDITED_EVENTS.TOKEN_DELETE, {
+        tokenId: deletedToken.id,
+        name: deletedToken.name,
+        kind: deletedToken.kind ?? 'content-api',
+        ...ownerId != null && {
+            adminUserOwner: ownerId
+        }
+    });
     if (deletedToken.kind === 'admin') {
         return {
             ...deletedToken,
@@ -853,7 +913,9 @@ For security reasons, prefer storing the secret in an environment variable and r
     const originalToken = await strapi.db.query('admin::api-token').findOne({
         select: SELECT_FIELDS,
         populate: [
-            'adminUserOwner'
+            'adminUserOwner',
+            'permissions',
+            'adminPermissions'
         ],
         where: {
             id
@@ -862,6 +924,34 @@ For security reasons, prefer storing the secret in an environment variable and r
     if (!originalToken) {
         throw new NotFoundError('Token not found');
     }
+    // Populated with its permissions: the audit row for this update lists what changed,
+    // so the state before the write is needed. `type` is a content-api concept: admin
+    // tokens only carry the column default.
+    const previousSnapshot = {
+        name: originalToken.name,
+        description: originalToken.description,
+        ...originalToken.kind !== 'admin' && {
+            type: originalToken.type
+        },
+        permissions: originalToken.kind === 'admin' ? tokens.toAdminPermissionRefs(originalToken.adminPermissions) : tokens.toActionRefs(originalToken.permissions)
+    };
+    const emitUpdate = async (kind, next, adminUserOwner)=>{
+        const changes = tokens.getTokenChanges(previousSnapshot, next);
+        if (Object.keys(changes).length === 0) {
+            return;
+        }
+        await utils.emitAudit({
+            strapi
+        }, tokens.AUDITED_EVENTS.TOKEN_UPDATE, {
+            tokenId: originalToken.id,
+            name: next.name,
+            kind,
+            changes,
+            ...adminUserOwner != null && {
+                adminUserOwner
+            }
+        });
+    };
     const raw = attributes;
     // kind is immutable after creation.
     // Null-kind rows are legacy content-api tokens — treat null and 'content-api' as the same
@@ -880,7 +970,7 @@ For security reasons, prefer storing the secret in an environment variable and r
         const changingTypeToCustom = incomingType === constants.API_TOKEN_TYPE.CUSTOM && originalToken.type !== constants.API_TOKEN_TYPE.CUSTOM;
         // Only re-validate if permissions or type are being changed
         if (incomingPermissions !== undefined || changingTypeToCustom) {
-            assertCustomTokenPermissionsValidity(resolvedType, incomingPermissions ?? originalToken.permissions);
+            assertCustomTokenPermissionsValidity(resolvedType, incomingPermissions);
         }
     } else if (originalToken.kind === 'admin') {
         assertAdminKindFields(attributes);
@@ -951,9 +1041,16 @@ For security reasons, prefer storing the secret in an environment variable and r
             });
         }
         const permissionsFromDb = await strapi.db.query('admin::api-token').load(updatedToken, 'permissions');
+        const permissions = permissionsFromDb ? tokens.toActionRefs(permissionsFromDb) : undefined;
+        await emitUpdate('content-api', {
+            name: updatedToken.name,
+            description: updatedToken.description ?? null,
+            type: updatedToken.type,
+            permissions: permissions ?? []
+        });
         return {
             ...updatedToken,
-            permissions: permissionsFromDb ? permissionsFromDb.map((p)=>p.action) : undefined
+            permissions
         };
     }
     // kind === 'admin'
@@ -965,6 +1062,11 @@ For security reasons, prefer storing the secret in an environment variable and r
     }
     const adminPermissionsFromDb = await strapi.db.query('admin::api-token').load(updatedToken, 'adminPermissions');
     const adminUserOwnerFromDb = await strapi.db.query('admin::api-token').load(updatedToken, 'adminUserOwner');
+    await emitUpdate('admin', {
+        name: updatedToken.name,
+        description: updatedToken.description ?? null,
+        permissions: tokens.toAdminPermissionRefs(adminPermissionsFromDb || [])
+    }, resolveAdminTokenOwnerId(originalToken));
     return {
         ...updatedToken,
         adminPermissions: adminPermissionsFromDb || [],