@strapi/admin 5.55.0 → 5.56.0

package/dist/server/ee/server/src/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,OAAAA,CAAKC,YAAAA,EAAWC,MAAAA,CAAIC,WAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,gBAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,kBAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,wBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,kBAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport {\n  LEGACY_USER_EVENTS,\n  emitAdminUserDeleted,\n  emitAdminUserUpdateAudits,\n  touchesTrackedFields,\n} from '../../../../server/src/audit-logs/admin-users';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // The audit log records what changed, so it needs the row before the write\n  const previous = touchesTrackedFields(attributes)\n    ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n    : null;\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n  await emitAdminUserDeleted({ strapi }, deletedUser);\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  for (const deletedUser of deletedUsers) {\n    await emitAdminUserDeleted({ strapi }, deletedUser);\n  }\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","previous","touchesTrackedFields","db","query","findOne","where","populate","hashedPassword","hashPassword","password","updatedUser","update","data","eventHub","emit","LEGACY_USER_EVENTS","UPDATE","sanitizeUser","emitAdminUserUpdateAudits","updated","deleteById","userToDelete","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;;AAaA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,OAAAA,CAAKC,YAAAA,EAAWC,MAAAA,CAAIC,WAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM8C,QAAAA,GAAWC,+BAAAA,CAAqBZ,UAAAA,CAAAA,GAClC,MAAM7B,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAIhB,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMkB,iBAAiB,MAAMzC,gBAAAA,CAAW,QAAQ0C,YAAY,CAACnB,WAAWoB,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;YAC9DN,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZiD,IAAAA,EAAM;AACJ,gBAAA,GAAGvB,UAAU;gBACboB,QAAAA,EAAUF;AACZ,aAAA;YACAD,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEA9C,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,oCAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOqB,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;QAC9DN,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZiD,IAAAA,EAAMvB,UAAAA;QACNiB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM5C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIqB,WAAAA,EAAa;AACflD,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,oCAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOqB,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOzD,EAAAA,GAAAA;;IAExB,MAAM0D,YAAAA,GAAe,MAAM7D,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAChEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZ2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACe,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAatB,KAAK,CAACuB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAKpE,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIvE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMwE,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNwB,MAAM,CAAC;QAAEtB,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgB,MAAM,EAAE;AAAE/D,QAAAA,IAAAA,EAAMiD,YAAAA,CAAaS,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,+BAAAA,CAAqB;AAAExE,QAAAA;KAAO,EAAGkE,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMO,cAAc,OAAOhD,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAMuC,sBAAAA,GAAyB,MAAM1E,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QACxE9B,KAAAA,EAAO;YACL1C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAe+B,UAAU,KAAKS,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIhF,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMkF,eAAe,EAAE;IACvB,KAAK,MAAMzE,MAAMsB,GAAAA,CAAK;QACpB,MAAMyC,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAewB,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZ2C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAyE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAM1C,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgB,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAatD,GAAG,CAAC,CAAC4C,cAAgBT,YAAAA,CAAaS,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,+BAAAA,CAAqB;AAAExE,YAAAA;SAAO,EAAGkE,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkBlD,kBAAAA,CAAEmD,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAM/C,uBAAuB,OAAOiD,MAAAA,GAAAA;IAClC,MAAM1E,IAAAA,GAAQ,MAAMoC,OAAAA,CAAQsC,MAAAA,CAAAA;AAC5B,IAAA,MAAMhD,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKkB,wBAAAA,CAAkB3E,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMiD,eAAe,CAACjD,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,kBAAAA,CAAEsD,IAAI,CAAC5E,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACyD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMnC,OAAAA,GAAU,OAAOzC,EAAAA,EAAS2C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAO9C,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;AAAG2C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAMuC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAOrF,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QAAE9B,KAAAA,EAAO;YAAElC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACA6D,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAb,IAAAA,UAAAA;AACAhC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/user.mjs

@@ -3,6 +3,7 @@ import { pipe, castArray, map, toNumber } from 'lodash/fp';
 import { errors, arrays } from '@strapi/utils';
 import { hasSuperAdminRole } from '../../../../server/src/domain/user.mjs';
 import constants from '../../../../server/src/services/constants.mjs';
+import { touchesTrackedFields, LEGACY_USER_EVENTS, emitAdminUserUpdateAudits, emitAdminUserDeleted } from '../../../../server/src/audit-logs/admin-users.mjs';
 import { getService } from '../utils/index.mjs';
 
 const { ValidationError } = errors;
@@ -75,6 +76,15 @@ const removeFromEEDisabledUsersList = async (ids)=>{
             throw new ValidationError('You must have at least one user with super admin role.');
         }
     }
+    // The audit log records what changed, so it needs the row before the write
+    const previous = touchesTrackedFields(attributes) ? await strapi.db.query('admin::user').findOne({
+        where: {
+            id
+        },
+        populate: [
+            'roles'
+        ]
+    }) : null;
     // hash password if a new one is sent
     if (___default.has(attributes, 'password')) {
         const hashedPassword = await getService('auth').hashPassword(attributes.password);
@@ -90,9 +100,16 @@ const removeFromEEDisabledUsersList = async (ids)=>{
                 'roles'
             ]
         });
-        strapi.eventHub.emit('user.update', {
+        strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, {
             user: sanitizeUser(updatedUser)
         });
+        await emitAdminUserUpdateAudits({
+            strapi
+        }, {
+            previous,
+            updated: updatedUser,
+            attributes
+        });
         return updatedUser;
     }
     const updatedUser = await strapi.db.query('admin::user').update({
@@ -106,9 +123,16 @@ const removeFromEEDisabledUsersList = async (ids)=>{
     });
     await updateEEDisabledUsersList(id, attributes);
     if (updatedUser) {
-        strapi.eventHub.emit('user.update', {
+        strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, {
             user: sanitizeUser(updatedUser)
         });
+        await emitAdminUserUpdateAudits({
+            strapi
+        }, {
+            previous,
+            updated: updatedUser,
+            attributes
+        });
     }
     return updatedUser;
 };
@@ -150,9 +174,12 @@ const removeFromEEDisabledUsersList = async (ids)=>{
         await sessionManager('admin').invalidateRefreshToken(String(id));
     }
     await removeFromEEDisabledUsersList(id);
-    strapi.eventHub.emit('user.delete', {
+    strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {
         user: sanitizeUser(deletedUser)
     });
+    await emitAdminUserDeleted({
+        strapi
+    }, deletedUser);
     return deletedUser;
 };
 /** Delete a user
@@ -190,9 +217,14 @@ const removeFromEEDisabledUsersList = async (ids)=>{
         deletedUsers.push(deletedUser);
     }
     await removeFromEEDisabledUsersList(ids);
-    strapi.eventHub.emit('user.delete', {
+    strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {
         users: deletedUsers.map((deletedUser)=>sanitizeUser(deletedUser))
     });
+    for (const deletedUser of deletedUsers){
+        await emitAdminUserDeleted({
+            strapi
+        }, deletedUser);
+    }
     return deletedUsers;
 };
 const sanitizeUserRoles = (role)=>___default.pick(role, [

package/dist/server/ee/server/src/services/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","hashedPassword","hashPassword","password","updatedUser","db","query","update","where","data","populate","eventHub","emit","sanitizeUser","deleteById","userToDelete","findOne","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;AAOA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,IAAAA,CAAKC,SAAAA,EAAWC,GAAAA,CAAIC,QAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIoC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMW,iBAAiB,MAAMlC,UAAAA,CAAW,QAAQmC,YAAY,CAACZ,WAAWa,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;YAC9DC,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ6C,IAAAA,EAAM;AACJ,gBAAA,GAAGnB,UAAU;gBACba,QAAAA,EAAUF;AACZ,aAAA;YACAS,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAjD,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAM3C,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,MAAM,CAAC;QAC9DC,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ6C,IAAAA,EAAMnB,UAAAA;QACNoB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM/C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIc,WAAAA,EAAa;AACf3C,QAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,YAAAA,IAAAA,EAAM4C,YAAAA,CAAaT,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOlD,EAAAA,GAAAA;;IAExB,MAAMmD,YAAAA,GAAe,MAAMtD,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAChER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QACZ8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACK,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAaf,KAAK,CAACiB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAK9D,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAeyB,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIjE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMkE,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNgB,MAAM,CAAC;QAAEd,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;QAAG8C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAE3C,QAAAA,IAAAA,EAAM4C,YAAAA,CAAaQ,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMK,cAAc,OAAOxC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAM+B,sBAAAA,GAAyB,MAAMlE,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QACxEpB,KAAAA,EAAO;YACL5C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAeyB,UAAU,KAAKO,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAM0E,eAAe,EAAE;IACvB,KAAK,MAAMjE,MAAMsB,GAAAA,CAAK;QACpB,MAAMmC,WAAAA,GAAc,MAAM5D,MAAAA,CAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegB,MAAM,CAAC;YAC9Dd,KAAAA,EAAO;AAAE5C,gBAAAA;AAAG,aAAA;YACZ8C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMhD,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe6D,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM7D,cAAAA,CAAe,OAAA,CAAA,CAAS8D,sBAAsB,CAACC,MAAAA,CAAO7D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAiE,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMpC,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOkD,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCmB,QAAAA,KAAAA,EAAOF,YAAAA,CAAa9C,GAAG,CAAC,CAACsC,cAAgBR,YAAAA,CAAaQ,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkB1C,UAAAA,CAAE2C,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAMvC,uBAAuB,OAAOyC,MAAAA,GAAAA;IAClC,MAAMlE,IAAAA,GAAQ,MAAM+C,OAAAA,CAAQmB,MAAAA,CAAAA;AAC5B,IAAA,MAAMxC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAeyB,UAAU,KAAK,CAAA,IAAKgB,iBAAAA,CAAkBnE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4C,eAAe,CAAC5C,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,UAAAA,CAAE8C,IAAI,CAACpE,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACiD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMhB,OAAAA,GAAU,OAAOpD,EAAAA,EAAS8C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAOjD,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeU,OAAO,CAAC;QAAER,KAAAA,EAAO;AAAE5C,YAAAA;AAAG,SAAA;AAAG8C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAM4B,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAO7E,OAAO4C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesB,KAAK,CAAC;QAAEpB,KAAAA,EAAO;YAAEpC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACAqD,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAZ,IAAAA,UAAAA;AACAzB,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.mjs","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport {\n  LEGACY_USER_EVENTS,\n  emitAdminUserDeleted,\n  emitAdminUserUpdateAudits,\n  touchesTrackedFields,\n} from '../../../../server/src/audit-logs/admin-users';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n */\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const user = disabledUsers.find((user: any) => user.id === Number(id));\n  if (!user) {\n    return;\n  }\n\n  if (user.isActive !== input.isActive) {\n    const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n    await strapi.store.set({\n      type: 'ee',\n      key: 'disabled_users',\n      value: newDisabledUsersList,\n    });\n  }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n  let idsToCheck: any;\n  if (typeof ids === 'object') {\n    idsToCheck = castNumberArray(ids);\n  } else {\n    idsToCheck = [Number(ids)];\n  }\n\n  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n  if (!disabledUsers) {\n    return;\n  }\n\n  const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n  await strapi.store.set({\n    type: 'ee',\n    key: 'disabled_users',\n    value: newDisabledUsersList,\n  });\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n */\nconst updateById = async (id: any, attributes: any) => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // The audit log records what changed, so it needs the row before the write\n  const previous = touchesTrackedFields(attributes)\n    ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n    : null;\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  await updateEEDisabledUsersList(id, attributes);\n\n  if (updatedUser) {\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n  }\n\n  return updatedUser;\n};\n\n/** Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n */\nconst deleteById = async (id: unknown) => {\n  // Check at least one super admin remains\n  const userToDelete = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  await removeFromEEDisabledUsersList(id);\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n  await emitAdminUserDeleted({ strapi }, deletedUser);\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n */\nconst deleteByIds = async (ids: any) => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  await removeFromEEDisabledUsersList(ids);\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  for (const deletedUser of deletedUsers) {\n    await emitAdminUserDeleted({ strapi }, deletedUser);\n  }\n\n  return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/**\n * Check if a user is the last super admin\n * @param {int|string} userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: unknown) => {\n  const user = (await findOne(userId)) as any;\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Remove private user fields\n * @param {Object} user - user to sanitize\n */\nconst sanitizeUser = (user: any) => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n  return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n  updateEEDisabledUsersList,\n  removeFromEEDisabledUsersList,\n  getCurrentActiveUserCount,\n  deleteByIds,\n  deleteById,\n  updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","previous","touchesTrackedFields","db","query","findOne","where","populate","hashedPassword","hashPassword","password","updatedUser","update","data","eventHub","emit","LEGACY_USER_EVENTS","UPDATE","sanitizeUser","emitAdminUserUpdateAudits","updated","deleteById","userToDelete","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;AAaA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,IAAAA,CAAKC,SAAAA,EAAWC,GAAAA,CAAIC,QAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM8C,QAAAA,GAAWC,oBAAAA,CAAqBZ,UAAAA,CAAAA,GAClC,MAAM7B,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAIhB,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMkB,iBAAiB,MAAMzC,UAAAA,CAAW,QAAQ0C,YAAY,CAACnB,WAAWoB,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;YAC9DN,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZiD,IAAAA,EAAM;AACJ,gBAAA,GAAGvB,UAAU;gBACboB,QAAAA,EAAUF;AACZ,aAAA;YACAD,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEA9C,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,yBAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOqB,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;QAC9DN,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZiD,IAAAA,EAAMvB,UAAAA;QACNiB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM5C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIqB,WAAAA,EAAa;AACflD,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,yBAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOqB,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOzD,EAAAA,GAAAA;;IAExB,MAAM0D,YAAAA,GAAe,MAAM7D,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAChEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZ2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACe,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAatB,KAAK,CAACuB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAKpE,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIvE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMwE,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNwB,MAAM,CAAC;QAAEtB,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgB,MAAM,EAAE;AAAE/D,QAAAA,IAAAA,EAAMiD,YAAAA,CAAaS,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,oBAAAA,CAAqB;AAAExE,QAAAA;KAAO,EAAGkE,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMO,cAAc,OAAOhD,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAMuC,sBAAAA,GAAyB,MAAM1E,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QACxE9B,KAAAA,EAAO;YACL1C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAe+B,UAAU,KAAKS,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIhF,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMkF,eAAe,EAAE;IACvB,KAAK,MAAMzE,MAAMsB,GAAAA,CAAK;QACpB,MAAMyC,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAewB,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZ2C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAyE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAM1C,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgB,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAatD,GAAG,CAAC,CAAC4C,cAAgBT,YAAAA,CAAaS,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,oBAAAA,CAAqB;AAAExE,YAAAA;SAAO,EAAGkE,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkBlD,UAAAA,CAAEmD,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAM/C,uBAAuB,OAAOiD,MAAAA,GAAAA;IAClC,MAAM1E,IAAAA,GAAQ,MAAMoC,OAAAA,CAAQsC,MAAAA,CAAAA;AAC5B,IAAA,MAAMhD,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKkB,iBAAAA,CAAkB3E,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMiD,eAAe,CAACjD,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,UAAAA,CAAEsD,IAAI,CAAC5E,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACyD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMnC,OAAAA,GAAU,OAAOzC,EAAAA,EAAS2C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAO9C,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;AAAG2C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAMuC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAOrF,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QAAE9B,KAAAA,EAAO;YAAElC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACA6D,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAb,IAAAA,UAAAA;AACAhC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/audit-logs/admin-users.js

@@ -0,0 +1,169 @@
+'use strict';
+
+var fp = require('lodash/fp');
+var utils = require('@strapi/utils');
+
+const AUDITED_EVENTS = {
+    USER_CREATE: 'admin-user.create',
+    USER_UPDATE: 'admin-user.update',
+    USER_DELETE: 'admin-user.delete',
+    PASSWORD_RESET_CREATE: 'admin-user.password-reset.create',
+    PASSWORD_RESET_CONFIRM: 'admin-user.password-reset.confirm',
+    PASSWORD_UPDATE: 'admin-user.password.update',
+    INVITE_ACCEPT: 'admin-user.invite.accept'
+};
+/**
+ * Event hub events kept for custom listeners. The audit log no longer records them:
+ * it records the AUDITED_EVENTS above, built from the row with before/after values.
+ *
+ * @deprecated Removed in the next major. Listen to the audit log events, or to the
+ * database lifecycles, instead.
+ */ const LEGACY_USER_EVENTS = {
+    CREATE: 'user.create',
+    UPDATE: 'user.update',
+    DELETE: 'user.delete'
+};
+/**
+ * The fields an audit reader needs to identify the account and its access. Never
+ * `password`, the tokens, or the timestamps: the row has its own date.
+ */ const ADMIN_USER_TRACKED_FIELDS = [
+    'firstname',
+    'lastname',
+    'email',
+    'username',
+    'preferedLanguage',
+    'isActive'
+];
+/** Sorted, so order alone is not a change. */ const toRoleIds = (roles)=>fp.sortBy((id)=>String(id), (roles ?? []).map((role)=>typeof role === 'object' ? role.id : role));
+const getAdminUserChanges = (previous, next)=>{
+    const changes = {};
+    for (const field of ADMIN_USER_TRACKED_FIELDS){
+        // isActive is a boolean column that older rows may hold as null
+        const before = field === 'isActive' ? previous.isActive === true : previous[field] ?? null;
+        const after = field === 'isActive' ? next.isActive === true : next[field] ?? null;
+        if (before !== after) {
+            changes[field] = {
+                before,
+                after
+            };
+        }
+    }
+    if (previous.roles != null || next.roles != null) {
+        const before = toRoleIds(previous.roles);
+        const after = toRoleIds(next.roles);
+        if (!fp.isEqual(before, after)) {
+            changes.roles = {
+                before,
+                after
+            };
+        }
+    }
+    return changes;
+};
+/**
+ * `email` is required by the admin::user schema; the contract type marks it optional
+ * because it also describes creation payloads.
+ */ const toAdminUserEvent = (user)=>({
+        userId: user.id,
+        email: user.email
+    });
+const emitAdminUserCreated = ({ strapi }, user)=>utils.emitAudit({
+        strapi
+    }, AUDITED_EVENTS.USER_CREATE, {
+        ...toAdminUserEvent(user),
+        firstname: user.firstname ?? null,
+        lastname: user.lastname ?? null,
+        roles: toRoleIds(user.roles),
+        isActive: user.isActive === true
+    });
+const emitAdminUserDeleted = ({ strapi }, user)=>utils.emitAudit({
+        strapi
+    }, AUDITED_EVENTS.USER_DELETE, toAdminUserEvent(user));
+/** Whether an update touches a field the audit log compares, so the previous row is needed. */ const touchesTrackedFields = (attributes)=>[
+        ...ADMIN_USER_TRACKED_FIELDS,
+        'roles'
+    ].some((field)=>field in attributes);
+/**
+ * The account events an update can produce, emitted by updateById after the write:
+ * `admin-user.update` with the fields that changed, `admin-user.password.update` when a
+ * password was set. Both run through the request context, so a public flow (reset,
+ * invitation) with no session emits them too and the subscriber drops them.
+ */ const emitAdminUserUpdateAudits = async ({ strapi }, { previous, updated, attributes })=>{
+    if (!updated) {
+        return;
+    }
+    if (previous) {
+        const changes = getAdminUserChanges(previous, updated);
+        if (Object.keys(changes).length > 0) {
+            await utils.emitAudit({
+                strapi
+            }, AUDITED_EVENTS.USER_UPDATE, {
+                ...toAdminUserEvent(updated),
+                changes
+            });
+        }
+    }
+    if ('password' in attributes) {
+        await utils.emitAudit({
+            strapi
+        }, AUDITED_EVENTS.PASSWORD_UPDATE, toAdminUserEvent(updated));
+    }
+};
+const registerAdminUserAuditEvents = (auditLogsLifecycle)=>{
+    const resource = (event)=>({
+            type: 'admin-user',
+            id: event.userId,
+            email: event.email
+        });
+    const withoutSession = {
+        allowUnknownActor: true
+    };
+    // The first super admin registers from a public form too
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.USER_CREATE, (event)=>({
+            resource: resource(event),
+            details: {
+                email: event.email,
+                firstname: event.firstname,
+                lastname: event.lastname,
+                roles: event.roles,
+                isActive: event.isActive
+            }
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.USER_UPDATE, (event)=>({
+            resource: resource(event),
+            details: {
+                changes: event.changes
+            }
+        }));
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.USER_DELETE, (event)=>({
+            resource: resource(event)
+        }));
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.PASSWORD_RESET_CREATE, (event)=>({
+            resource: resource(event),
+            details: {
+                expiresAt: new Date(event.expiresAt).toISOString()
+            }
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.PASSWORD_RESET_CONFIRM, (event)=>({
+            resource: resource(event)
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.INVITE_ACCEPT, (event)=>({
+            resource: resource(event)
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.PASSWORD_UPDATE, (event)=>({
+            resource: resource(event)
+        }));
+};
+
+exports.ADMIN_USER_TRACKED_FIELDS = ADMIN_USER_TRACKED_FIELDS;
+exports.AUDITED_EVENTS = AUDITED_EVENTS;
+exports.LEGACY_USER_EVENTS = LEGACY_USER_EVENTS;
+exports.emitAdminUserCreated = emitAdminUserCreated;
+exports.emitAdminUserDeleted = emitAdminUserDeleted;
+exports.emitAdminUserUpdateAudits = emitAdminUserUpdateAudits;
+exports.getAdminUserChanges = getAdminUserChanges;
+exports.registerAdminUserAuditEvents = registerAdminUserAuditEvents;
+exports.toAdminUserEvent = toAdminUserEvent;
+exports.toRoleIds = toRoleIds;
+exports.touchesTrackedFields = touchesTrackedFields;
+//# sourceMappingURL=admin-users.js.map

package/dist/server/server/src/audit-logs/admin-users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-users.js","sources":["../../../../../server/src/audit-logs/admin-users.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash/fp';\nimport type { Data, Modules } from '@strapi/types';\nimport { emitAudit } from '@strapi/utils';\n\nexport const AUDITED_EVENTS = {\n  USER_CREATE: 'admin-user.create',\n  USER_UPDATE: 'admin-user.update',\n  USER_DELETE: 'admin-user.delete',\n  PASSWORD_RESET_CREATE: 'admin-user.password-reset.create',\n  PASSWORD_RESET_CONFIRM: 'admin-user.password-reset.confirm',\n  PASSWORD_UPDATE: 'admin-user.password.update',\n  INVITE_ACCEPT: 'admin-user.invite.accept',\n} as const;\n\n/**\n * Event hub events kept for custom listeners. The audit log no longer records them:\n * it records the AUDITED_EVENTS above, built from the row with before/after values.\n *\n * @deprecated Removed in the next major. Listen to the audit log events, or to the\n * database lifecycles, instead.\n */\nexport const LEGACY_USER_EVENTS = {\n  CREATE: 'user.create',\n  UPDATE: 'user.update',\n  DELETE: 'user.delete',\n} as const;\n\nexport interface AdminUserResource extends Modules.AuditLogs.Resource {\n  type: 'admin-user';\n  id: Data.ID;\n  email: string;\n}\n\n/**\n * The affected account, as read from the `admin::user` row after the write. Never the\n * row itself: it carries the password hash and the reset and registration tokens.\n */\nexport interface AdminUserEvent {\n  userId: Data.ID;\n  email: string;\n}\n\n/**\n * The fields an audit reader needs to identify the account and its access. Never\n * `password`, the tokens, or the timestamps: the row has its own date.\n */\nexport const ADMIN_USER_TRACKED_FIELDS = [\n  'firstname',\n  'lastname',\n  'email',\n  'username',\n  'preferedLanguage',\n  'isActive',\n] as const;\n\ntype TrackedField = (typeof ADMIN_USER_TRACKED_FIELDS)[number];\n\n/** A user row, or the attributes of an update: roles come as rows or as ids. */\nexport interface AdminUserSnapshot {\n  firstname?: string | null;\n  lastname?: string | null;\n  email?: string | null;\n  username?: string | null;\n  preferedLanguage?: string | null;\n  isActive?: boolean | null;\n  roles?: Array<Data.ID | { id: Data.ID }> | null;\n}\n\nexport type AdminUserChanges = Partial<\n  Record<TrackedField, Modules.AuditLogs.FieldChange<string | boolean | null>> & {\n    roles: Modules.AuditLogs.FieldChange<Data.ID[]>;\n  }\n>;\n\nexport interface CreateDetails {\n  email: string;\n  firstname: string | null;\n  lastname: string | null;\n  roles: Data.ID[];\n  isActive: boolean;\n}\n\nexport type CreateEvent = AdminUserEvent & Omit<CreateDetails, 'email'>;\nexport type UpdateEvent = AdminUserEvent & { changes: AdminUserChanges };\nexport type PasswordResetCreateEvent = AdminUserEvent & { expiresAt: string | Date };\n\n/** Sorted, so order alone is not a change. */\nexport const toRoleIds = (roles: AdminUserSnapshot['roles']): Data.ID[] =>\n  sortBy(\n    (id: Data.ID) => String(id),\n    (roles ?? []).map((role) => (typeof role === 'object' ? role.id : role))\n  );\n\nexport const getAdminUserChanges = (\n  previous: AdminUserSnapshot,\n  next: AdminUserSnapshot\n): AdminUserChanges => {\n  const changes: AdminUserChanges = {};\n\n  for (const field of ADMIN_USER_TRACKED_FIELDS) {\n    // isActive is a boolean column that older rows may hold as null\n    const before = field === 'isActive' ? previous.isActive === true : (previous[field] ?? null);\n    const after = field === 'isActive' ? next.isActive === true : (next[field] ?? null);\n\n    if (before !== after) {\n      changes[field] = { before, after };\n    }\n  }\n\n  if (previous.roles != null || next.roles != null) {\n    const before = toRoleIds(previous.roles);\n    const after = toRoleIds(next.roles);\n\n    if (!isEqual(before, after)) {\n      changes.roles = { before, after };\n    }\n  }\n\n  return changes;\n};\n\n/**\n * `email` is required by the admin::user schema; the contract type marks it optional\n * because it also describes creation payloads.\n */\nexport const toAdminUserEvent = (user: { id: Data.ID; email?: string | null }): AdminUserEvent => ({\n  userId: user.id,\n  email: user.email as string,\n});\n\ntype AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];\n\ninterface AdminUserRow extends AdminUserSnapshot {\n  id: Data.ID;\n}\n\nexport const emitAdminUserCreated = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n  emitAudit({ strapi }, AUDITED_EVENTS.USER_CREATE, {\n    ...toAdminUserEvent(user),\n    firstname: user.firstname ?? null,\n    lastname: user.lastname ?? null,\n    roles: toRoleIds(user.roles),\n    isActive: user.isActive === true,\n  } satisfies CreateEvent);\n\nexport const emitAdminUserDeleted = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n  emitAudit({ strapi }, AUDITED_EVENTS.USER_DELETE, toAdminUserEvent(user));\n\n/** Whether an update touches a field the audit log compares, so the previous row is needed. */\nexport const touchesTrackedFields = (attributes: Record<string, unknown>) =>\n  [...ADMIN_USER_TRACKED_FIELDS, 'roles'].some((field) => field in attributes);\n\n/**\n * The account events an update can produce, emitted by updateById after the write:\n * `admin-user.update` with the fields that changed, `admin-user.password.update` when a\n * password was set. Both run through the request context, so a public flow (reset,\n * invitation) with no session emits them too and the subscriber drops them.\n */\nexport const emitAdminUserUpdateAudits = async (\n  { strapi }: { strapi: AuditStrapi },\n  {\n    previous,\n    updated,\n    attributes,\n  }: {\n    previous: AdminUserSnapshot | null | undefined;\n    updated: AdminUserRow | null | undefined;\n    attributes: Record<string, unknown>;\n  }\n) => {\n  if (!updated) {\n    return;\n  }\n\n  if (previous) {\n    const changes = getAdminUserChanges(previous, updated);\n\n    if (Object.keys(changes).length > 0) {\n      await emitAudit({ strapi }, AUDITED_EVENTS.USER_UPDATE, {\n        ...toAdminUserEvent(updated),\n        changes,\n      } satisfies UpdateEvent);\n    }\n  }\n\n  if ('password' in attributes) {\n    await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_UPDATE, toAdminUserEvent(updated));\n  }\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>,\n    options?: { allowUnknownActor?: boolean }\n  ): void;\n}\n\nexport const registerAdminUserAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const resource = (event: AdminUserEvent): AdminUserResource => ({\n    type: 'admin-user',\n    id: event.userId,\n    email: event.email,\n  });\n\n  const withoutSession = { allowUnknownActor: true };\n\n  // The first super admin registers from a public form too\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.USER_CREATE,\n    (event: CreateEvent) => ({\n      resource: resource(event),\n      details: {\n        email: event.email,\n        firstname: event.firstname,\n        lastname: event.lastname,\n        roles: event.roles,\n        isActive: event.isActive,\n      },\n    }),\n    withoutSession\n  );\n\n  auditLogsLifecycle.registerEvent<{ changes: AdminUserChanges }>(\n    AUDITED_EVENTS.USER_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: resource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.USER_DELETE,\n    (event: AdminUserEvent) => ({ resource: resource(event) })\n  );\n\n  auditLogsLifecycle.registerEvent<{ expiresAt: string }>(\n    AUDITED_EVENTS.PASSWORD_RESET_CREATE,\n    (event: PasswordResetCreateEvent) => ({\n      resource: resource(event),\n      details: { expiresAt: new Date(event.expiresAt).toISOString() },\n    }),\n    withoutSession\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.PASSWORD_RESET_CONFIRM,\n    (event: AdminUserEvent) => ({ resource: resource(event) }),\n    withoutSession\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.INVITE_ACCEPT,\n    (event: AdminUserEvent) => ({ resource: resource(event) }),\n    withoutSession\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.PASSWORD_UPDATE,\n    (event: AdminUserEvent) => ({ resource: resource(event) })\n  );\n};\n"],"names":["AUDITED_EVENTS","USER_CREATE","USER_UPDATE","USER_DELETE","PASSWORD_RESET_CREATE","PASSWORD_RESET_CONFIRM","PASSWORD_UPDATE","INVITE_ACCEPT","LEGACY_USER_EVENTS","CREATE","UPDATE","DELETE","ADMIN_USER_TRACKED_FIELDS","toRoleIds","roles","sortBy","id","String","map","role","getAdminUserChanges","previous","next","changes","field","before","isActive","after","isEqual","toAdminUserEvent","user","userId","email","emitAdminUserCreated","strapi","emitAudit","firstname","lastname","emitAdminUserDeleted","touchesTrackedFields","attributes","some","emitAdminUserUpdateAudits","updated","Object","keys","length","registerAdminUserAuditEvents","auditLogsLifecycle","resource","event","type","withoutSession","allowUnknownActor","registerEvent","details","expiresAt","Date","toISOString"],"mappings":";;;;;MAIaA,cAAAA,GAAiB;IAC5BC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,qBAAAA,EAAuB,kCAAA;IACvBC,sBAAAA,EAAwB,mCAAA;IACxBC,eAAAA,EAAiB,4BAAA;IACjBC,aAAAA,EAAe;AACjB;AAEA;;;;;;UAOaC,kBAAAA,GAAqB;IAChCC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ;AACV;AAiBA;;;UAIaC,yBAAAA,GAA4B;AACvC,IAAA,WAAA;AACA,IAAA,UAAA;AACA,IAAA,OAAA;AACA,IAAA,UAAA;AACA,IAAA,kBAAA;AACA,IAAA;;AAkCF,+CACO,MAAMC,SAAAA,GAAY,CAACC,KAAAA,GACxBC,SAAAA,CACE,CAACC,EAAAA,GAAgBC,MAAAA,CAAOD,EAAAA,CAAAA,EACxB,CAACF,KAAAA,IAAS,EAAE,EAAEI,GAAG,CAAC,CAACC,IAAAA,GAAU,OAAOA,IAAAA,KAAS,QAAA,GAAWA,IAAAA,CAAKH,EAAE,GAAGG,IAAAA,CAAAA;AAG/D,MAAMC,mBAAAA,GAAsB,CACjCC,QAAAA,EACAC,IAAAA,GAAAA;AAEA,IAAA,MAAMC,UAA4B,EAAC;IAEnC,KAAK,MAAMC,SAASZ,yBAAAA,CAA2B;;QAE7C,MAAMa,MAAAA,GAASD,KAAAA,KAAU,UAAA,GAAaH,QAAAA,CAASK,QAAQ,KAAK,IAAA,GAAQL,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;QACvF,MAAMG,KAAAA,GAAQH,KAAAA,KAAU,UAAA,GAAaF,IAAAA,CAAKI,QAAQ,KAAK,IAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE9E,QAAA,IAAIC,WAAWE,KAAAA,EAAO;YACpBJ,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIN,SAASP,KAAK,IAAI,QAAQQ,IAAAA,CAAKR,KAAK,IAAI,IAAA,EAAM;QAChD,MAAMW,MAAAA,GAASZ,SAAAA,CAAUQ,QAAAA,CAASP,KAAK,CAAA;QACvC,MAAMa,KAAAA,GAAQd,SAAAA,CAAUS,IAAAA,CAAKR,KAAK,CAAA;QAElC,IAAI,CAACc,UAAAA,CAAQH,MAAAA,EAAQE,KAAAA,CAAAA,EAAQ;AAC3BJ,YAAAA,OAAAA,CAAQT,KAAK,GAAG;AAAEW,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AAClC,QAAA;AACF,IAAA;IAEA,OAAOJ,OAAAA;AACT;AAEA;;;AAGC,IACM,MAAMM,gBAAAA,GAAmB,CAACC,QAAkE;AACjGC,QAAAA,MAAAA,EAAQD,KAAKd,EAAE;AACfgB,QAAAA,KAAAA,EAAOF,KAAKE;AACd,KAAA;AAQO,MAAMC,uBAAuB,CAAC,EAAEC,MAAM,EAA2B,EAAEJ,OACxEK,eAAAA,CAAU;AAAED,QAAAA;KAAO,EAAGlC,cAAAA,CAAeC,WAAW,EAAE;AAChD,QAAA,GAAG4B,iBAAiBC,IAAAA,CAAK;QACzBM,SAAAA,EAAWN,IAAAA,CAAKM,SAAS,IAAI,IAAA;QAC7BC,QAAAA,EAAUP,IAAAA,CAAKO,QAAQ,IAAI,IAAA;QAC3BvB,KAAAA,EAAOD,SAAAA,CAAUiB,KAAKhB,KAAK,CAAA;QAC3BY,QAAAA,EAAUI,IAAAA,CAAKJ,QAAQ,KAAK;KAC9B;AAEK,MAAMY,uBAAuB,CAAC,EAAEJ,MAAM,EAA2B,EAAEJ,OACxEK,eAAAA,CAAU;AAAED,QAAAA;AAAO,KAAA,EAAGlC,cAAAA,CAAeG,WAAW,EAAE0B,gBAAAA,CAAiBC,IAAAA,CAAAA;AAErE,gGACO,MAAMS,oBAAAA,GAAuB,CAACC,UAAAA,GACnC;AAAI5B,QAAAA,GAAAA,yBAAAA;AAA2B,QAAA;AAAQ,KAAA,CAAC6B,IAAI,CAAC,CAACjB,KAAAA,GAAUA,SAASgB,UAAAA;AAEnE;;;;;AAKC,IACM,MAAME,yBAAAA,GAA4B,OACvC,EAAER,MAAM,EAA2B,EACnC,EACEb,QAAQ,EACRsB,OAAO,EACPH,UAAU,EAKX,GAAA;AAED,IAAA,IAAI,CAACG,OAAAA,EAAS;AACZ,QAAA;AACF,IAAA;AAEA,IAAA,IAAItB,QAAAA,EAAU;QACZ,MAAME,OAAAA,GAAUH,oBAAoBC,QAAAA,EAAUsB,OAAAA,CAAAA;AAE9C,QAAA,IAAIC,OAAOC,IAAI,CAACtB,OAAAA,CAAAA,CAASuB,MAAM,GAAG,CAAA,EAAG;AACnC,YAAA,MAAMX,eAAAA,CAAU;AAAED,gBAAAA;aAAO,EAAGlC,cAAAA,CAAeE,WAAW,EAAE;AACtD,gBAAA,GAAG2B,iBAAiBc,OAAAA,CAAQ;AAC5BpB,gBAAAA;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,cAAciB,UAAAA,EAAY;AAC5B,QAAA,MAAML,eAAAA,CAAU;AAAED,YAAAA;SAAO,EAAGlC,cAAAA,CAAeM,eAAe,EAAEuB,gBAAAA,CAAiBc,OAAAA,CAAAA,CAAAA;AAC/E,IAAA;AACF;AAcO,MAAMI,+BAA+B,CAACC,kBAAAA,GAAAA;IAC3C,MAAMC,QAAAA,GAAW,CAACC,KAAAA,IAA8C;YAC9DC,IAAAA,EAAM,YAAA;AACNnC,YAAAA,EAAAA,EAAIkC,MAAMnB,MAAM;AAChBC,YAAAA,KAAAA,EAAOkB,MAAMlB;SACf,CAAA;AAEA,IAAA,MAAMoB,cAAAA,GAAiB;QAAEC,iBAAAA,EAAmB;AAAK,KAAA;;AAGjDL,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeC,WAAW,EAC1B,CAACiD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AACPvB,gBAAAA,KAAAA,EAAOkB,MAAMlB,KAAK;AAClBI,gBAAAA,SAAAA,EAAWc,MAAMd,SAAS;AAC1BC,gBAAAA,QAAAA,EAAUa,MAAMb,QAAQ;AACxBvB,gBAAAA,KAAAA,EAAOoC,MAAMpC,KAAK;AAClBY,gBAAAA,QAAAA,EAAUwB,MAAMxB;AAClB;AACF,SAAA,CAAA,EACA0B,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeE,WAAW,EAC1B,CAACgD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEhC,gBAAAA,OAAAA,EAAS2B,MAAM3B;AAAQ;SACpC,CAAA,CAAA;AAGFyB,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeG,WAAW,EAC1B,CAAC+C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAG1DF,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeI,qBAAqB,EACpC,CAAC8C,SAAqC;AACpCD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEC,gBAAAA,SAAAA,EAAW,IAAIC,IAAAA,CAAKP,KAAAA,CAAMM,SAAS,EAAEE,WAAW;AAAG;AAChE,SAAA,CAAA,EACAN,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeK,sBAAsB,EACrC,CAAC6C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeO,aAAa,EAC5B,CAAC2C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeM,eAAe,EAC9B,CAAC4C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAE5D;;;;;;;;;;;;;;"}

package/dist/server/server/src/audit-logs/admin-users.mjs

@@ -0,0 +1,157 @@
+import { isEqual, sortBy } from 'lodash/fp';
+import { emitAudit } from '@strapi/utils';
+
+const AUDITED_EVENTS = {
+    USER_CREATE: 'admin-user.create',
+    USER_UPDATE: 'admin-user.update',
+    USER_DELETE: 'admin-user.delete',
+    PASSWORD_RESET_CREATE: 'admin-user.password-reset.create',
+    PASSWORD_RESET_CONFIRM: 'admin-user.password-reset.confirm',
+    PASSWORD_UPDATE: 'admin-user.password.update',
+    INVITE_ACCEPT: 'admin-user.invite.accept'
+};
+/**
+ * Event hub events kept for custom listeners. The audit log no longer records them:
+ * it records the AUDITED_EVENTS above, built from the row with before/after values.
+ *
+ * @deprecated Removed in the next major. Listen to the audit log events, or to the
+ * database lifecycles, instead.
+ */ const LEGACY_USER_EVENTS = {
+    CREATE: 'user.create',
+    UPDATE: 'user.update',
+    DELETE: 'user.delete'
+};
+/**
+ * The fields an audit reader needs to identify the account and its access. Never
+ * `password`, the tokens, or the timestamps: the row has its own date.
+ */ const ADMIN_USER_TRACKED_FIELDS = [
+    'firstname',
+    'lastname',
+    'email',
+    'username',
+    'preferedLanguage',
+    'isActive'
+];
+/** Sorted, so order alone is not a change. */ const toRoleIds = (roles)=>sortBy((id)=>String(id), (roles ?? []).map((role)=>typeof role === 'object' ? role.id : role));
+const getAdminUserChanges = (previous, next)=>{
+    const changes = {};
+    for (const field of ADMIN_USER_TRACKED_FIELDS){
+        // isActive is a boolean column that older rows may hold as null
+        const before = field === 'isActive' ? previous.isActive === true : previous[field] ?? null;
+        const after = field === 'isActive' ? next.isActive === true : next[field] ?? null;
+        if (before !== after) {
+            changes[field] = {
+                before,
+                after
+            };
+        }
+    }
+    if (previous.roles != null || next.roles != null) {
+        const before = toRoleIds(previous.roles);
+        const after = toRoleIds(next.roles);
+        if (!isEqual(before, after)) {
+            changes.roles = {
+                before,
+                after
+            };
+        }
+    }
+    return changes;
+};
+/**
+ * `email` is required by the admin::user schema; the contract type marks it optional
+ * because it also describes creation payloads.
+ */ const toAdminUserEvent = (user)=>({
+        userId: user.id,
+        email: user.email
+    });
+const emitAdminUserCreated = ({ strapi }, user)=>emitAudit({
+        strapi
+    }, AUDITED_EVENTS.USER_CREATE, {
+        ...toAdminUserEvent(user),
+        firstname: user.firstname ?? null,
+        lastname: user.lastname ?? null,
+        roles: toRoleIds(user.roles),
+        isActive: user.isActive === true
+    });
+const emitAdminUserDeleted = ({ strapi }, user)=>emitAudit({
+        strapi
+    }, AUDITED_EVENTS.USER_DELETE, toAdminUserEvent(user));
+/** Whether an update touches a field the audit log compares, so the previous row is needed. */ const touchesTrackedFields = (attributes)=>[
+        ...ADMIN_USER_TRACKED_FIELDS,
+        'roles'
+    ].some((field)=>field in attributes);
+/**
+ * The account events an update can produce, emitted by updateById after the write:
+ * `admin-user.update` with the fields that changed, `admin-user.password.update` when a
+ * password was set. Both run through the request context, so a public flow (reset,
+ * invitation) with no session emits them too and the subscriber drops them.
+ */ const emitAdminUserUpdateAudits = async ({ strapi }, { previous, updated, attributes })=>{
+    if (!updated) {
+        return;
+    }
+    if (previous) {
+        const changes = getAdminUserChanges(previous, updated);
+        if (Object.keys(changes).length > 0) {
+            await emitAudit({
+                strapi
+            }, AUDITED_EVENTS.USER_UPDATE, {
+                ...toAdminUserEvent(updated),
+                changes
+            });
+        }
+    }
+    if ('password' in attributes) {
+        await emitAudit({
+            strapi
+        }, AUDITED_EVENTS.PASSWORD_UPDATE, toAdminUserEvent(updated));
+    }
+};
+const registerAdminUserAuditEvents = (auditLogsLifecycle)=>{
+    const resource = (event)=>({
+            type: 'admin-user',
+            id: event.userId,
+            email: event.email
+        });
+    const withoutSession = {
+        allowUnknownActor: true
+    };
+    // The first super admin registers from a public form too
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.USER_CREATE, (event)=>({
+            resource: resource(event),
+            details: {
+                email: event.email,
+                firstname: event.firstname,
+                lastname: event.lastname,
+                roles: event.roles,
+                isActive: event.isActive
+            }
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.USER_UPDATE, (event)=>({
+            resource: resource(event),
+            details: {
+                changes: event.changes
+            }
+        }));
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.USER_DELETE, (event)=>({
+            resource: resource(event)
+        }));
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.PASSWORD_RESET_CREATE, (event)=>({
+            resource: resource(event),
+            details: {
+                expiresAt: new Date(event.expiresAt).toISOString()
+            }
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.PASSWORD_RESET_CONFIRM, (event)=>({
+            resource: resource(event)
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.INVITE_ACCEPT, (event)=>({
+            resource: resource(event)
+        }), withoutSession);
+    auditLogsLifecycle.registerEvent(AUDITED_EVENTS.PASSWORD_UPDATE, (event)=>({
+            resource: resource(event)
+        }));
+};
+
+export { ADMIN_USER_TRACKED_FIELDS, AUDITED_EVENTS, LEGACY_USER_EVENTS, emitAdminUserCreated, emitAdminUserDeleted, emitAdminUserUpdateAudits, getAdminUserChanges, registerAdminUserAuditEvents, toAdminUserEvent, toRoleIds, touchesTrackedFields };
+//# sourceMappingURL=admin-users.mjs.map