@strapi/admin 5.55.1 → 5.57.0

package/dist/server/server/src/services/passport.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passport.mjs","sources":["../../../../../server/src/services/passport.ts"],"sourcesContent":["import passport from 'koa-passport';\nimport type { Strategy } from 'passport-local';\nimport { isFunction } from 'lodash/fp';\n\nimport createLocalStrategy from './passport/local-strategy';\n\nconst authEventsMapper = {\n  onConnectionSuccess: 'admin.auth.success',\n  onConnectionError: 'admin.auth.error',\n};\n\nconst valueIsFunctionType = ([, value]: [any, any]) => isFunction(value);\nconst keyIsValidEventName = ([key]: any) => {\n  return Object.keys(strapi.service('admin::passport').authEventsMapper).includes(key);\n};\n\nconst getPassportStrategies = () => [createLocalStrategy(strapi)] as Strategy[];\n\nconst registerAuthEvents = () => {\n  // @ts-expect-error - TODO: migrate auth service to TS\n  const { events = {} } = strapi.config.get('admin.auth', {});\n  const { authEventsMapper } = strapi.service('admin::passport');\n\n  const eventList = Object.entries(events).filter(keyIsValidEventName).filter(valueIsFunctionType);\n\n  for (const [eventName, handler] of eventList) {\n    // TODO - TS: ensure the handler is an EventHub.Listener\n    strapi.eventHub.on(authEventsMapper[eventName], handler as any);\n  }\n};\n\nconst init = () => {\n  strapi\n    .service('admin::passport')\n    .getPassportStrategies()\n    .forEach((strategy: Strategy) => passport.use(strategy));\n\n  registerAuthEvents();\n\n  return passport.initialize();\n};\n\nexport default { init, getPassportStrategies, authEventsMapper };\n"],"names":["authEventsMapper","onConnectionSuccess","onConnectionError","valueIsFunctionType","value","isFunction","keyIsValidEventName","key","Object","keys","strapi","service","includes","getPassportStrategies","createLocalStrategy","registerAuthEvents","events","config","get","eventList","entries","filter","eventName","handler","eventHub","on","init","forEach","strategy","passport","use","initialize"],"mappings":";;;;AAMA,MAAMA,gBAAAA,GAAmB;IACvBC,mBAAAA,EAAqB,oBAAA;IACrBC,iBAAAA,EAAmB;AACrB,CAAA;AAEA,MAAMC,mBAAAA,GAAsB,CAAC,GAAGC,KAAAA,CAAkB,GAAKC,UAAAA,CAAWD,KAAAA,CAAAA;AAClE,MAAME,mBAAAA,GAAsB,CAAC,CAACC,GAAAA,CAAS,GAAA;IACrC,OAAOC,MAAAA,CAAOC,IAAI,CAACC,MAAAA,CAAOC,OAAO,CAAC,iBAAA,CAAA,CAAmBX,gBAAgB,CAAA,CAAEY,QAAQ,CAACL,GAAAA,CAAAA;AAClF,CAAA;AAEA,MAAMM,wBAAwB,IAAM;QAACC,mBAAAA,CAAoBJ,MAAAA;AAAQ,KAAA;AAEjE,MAAMK,kBAAAA,GAAqB,IAAA;;AAEzB,IAAA,MAAM,EAAEC,MAAAA,GAAS,EAAE,EAAE,GAAGN,MAAAA,CAAOO,MAAM,CAACC,GAAG,CAAC,YAAA,EAAc,EAAC,CAAA;AACzD,IAAA,MAAM,EAAElB,gBAAgB,EAAE,GAAGU,MAAAA,CAAOC,OAAO,CAAC,iBAAA,CAAA;IAE5C,MAAMQ,SAAAA,GAAYX,OAAOY,OAAO,CAACJ,QAAQK,MAAM,CAACf,mBAAAA,CAAAA,CAAqBe,MAAM,CAAClB,mBAAAA,CAAAA;AAE5E,IAAA,KAAK,MAAM,CAACmB,SAAAA,EAAWC,OAAAA,CAAQ,IAAIJ,SAAAA,CAAW;;AAE5CT,QAAAA,MAAAA,CAAOc,QAAQ,CAACC,EAAE,CAACzB,gBAAgB,CAACsB,UAAU,EAAEC,OAAAA,CAAAA;AAClD,IAAA;AACF,CAAA;AAEA,MAAMG,IAAAA,GAAO,IAAA;IACXhB,MAAAA,CACGC,OAAO,CAAC,iBAAA,CAAA,CACRE,qBAAqB,EAAA,CACrBc,OAAO,CAAC,CAACC,QAAAA,GAAuBC,UAAAA,CAASC,GAAG,CAACF,QAAAA,CAAAA,CAAAA;AAEhDb,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,OAAOc,WAASE,UAAU,EAAA;AAC5B,CAAA;AAEA,eAAe;AAAEL,IAAAA,IAAAA;AAAMb,IAAAA,qBAAAA;AAAuBb,IAAAA;AAAiB,CAAA;;;;"}
+{"version":3,"file":"passport.mjs","sources":["../../../../../server/src/services/passport.ts"],"sourcesContent":["import passport from 'koa-passport';\nimport type { Strategy } from 'passport-local';\n\nimport createLocalStrategy from './passport/local-strategy';\n\nconst authEventsMapper = {\n  onConnectionSuccess: 'admin.auth.success',\n  onConnectionError: 'admin.auth.error',\n};\n\nconst valueIsFunctionType = ([, value]: [any, any]) => typeof value === 'function';\nconst keyIsValidEventName = ([key]: any) => {\n  return Object.keys(strapi.service('admin::passport').authEventsMapper).includes(key);\n};\n\nconst getPassportStrategies = () => [createLocalStrategy(strapi)] as Strategy[];\n\nconst registerAuthEvents = () => {\n  // @ts-expect-error - TODO: migrate auth service to TS\n  const { events = {} } = strapi.config.get('admin.auth', {});\n  const { authEventsMapper } = strapi.service('admin::passport');\n\n  const eventList = Object.entries(events).filter(keyIsValidEventName).filter(valueIsFunctionType);\n\n  for (const [eventName, handler] of eventList) {\n    // TODO - TS: ensure the handler is an EventHub.Listener\n    strapi.eventHub.on(authEventsMapper[eventName], handler as any);\n  }\n};\n\nconst init = () => {\n  strapi\n    .service('admin::passport')\n    .getPassportStrategies()\n    .forEach((strategy: Strategy) => passport.use(strategy));\n\n  registerAuthEvents();\n\n  return passport.initialize();\n};\n\nexport default { init, getPassportStrategies, authEventsMapper };\n"],"names":["authEventsMapper","onConnectionSuccess","onConnectionError","valueIsFunctionType","value","keyIsValidEventName","key","Object","keys","strapi","service","includes","getPassportStrategies","createLocalStrategy","registerAuthEvents","events","config","get","eventList","entries","filter","eventName","handler","eventHub","on","init","forEach","strategy","passport","use","initialize"],"mappings":";;;AAKA,MAAMA,gBAAAA,GAAmB;IACvBC,mBAAAA,EAAqB,oBAAA;IACrBC,iBAAAA,EAAmB;AACrB,CAAA;AAEA,MAAMC,sBAAsB,CAAC,GAAGC,KAAAA,CAAkB,GAAK,OAAOA,KAAAA,KAAU,UAAA;AACxE,MAAMC,mBAAAA,GAAsB,CAAC,CAACC,GAAAA,CAAS,GAAA;IACrC,OAAOC,MAAAA,CAAOC,IAAI,CAACC,MAAAA,CAAOC,OAAO,CAAC,iBAAA,CAAA,CAAmBV,gBAAgB,CAAA,CAAEW,QAAQ,CAACL,GAAAA,CAAAA;AAClF,CAAA;AAEA,MAAMM,wBAAwB,IAAM;QAACC,mBAAAA,CAAoBJ,MAAAA;AAAQ,KAAA;AAEjE,MAAMK,kBAAAA,GAAqB,IAAA;;AAEzB,IAAA,MAAM,EAAEC,MAAAA,GAAS,EAAE,EAAE,GAAGN,MAAAA,CAAOO,MAAM,CAACC,GAAG,CAAC,YAAA,EAAc,EAAC,CAAA;AACzD,IAAA,MAAM,EAAEjB,gBAAgB,EAAE,GAAGS,MAAAA,CAAOC,OAAO,CAAC,iBAAA,CAAA;IAE5C,MAAMQ,SAAAA,GAAYX,OAAOY,OAAO,CAACJ,QAAQK,MAAM,CAACf,mBAAAA,CAAAA,CAAqBe,MAAM,CAACjB,mBAAAA,CAAAA;AAE5E,IAAA,KAAK,MAAM,CAACkB,SAAAA,EAAWC,OAAAA,CAAQ,IAAIJ,SAAAA,CAAW;;AAE5CT,QAAAA,MAAAA,CAAOc,QAAQ,CAACC,EAAE,CAACxB,gBAAgB,CAACqB,UAAU,EAAEC,OAAAA,CAAAA;AAClD,IAAA;AACF,CAAA;AAEA,MAAMG,IAAAA,GAAO,IAAA;IACXhB,MAAAA,CACGC,OAAO,CAAC,iBAAA,CAAA,CACRE,qBAAqB,EAAA,CACrBc,OAAO,CAAC,CAACC,QAAAA,GAAuBC,UAAAA,CAASC,GAAG,CAACF,QAAAA,CAAAA,CAAAA;AAEhDb,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,OAAOc,WAASE,UAAU,EAAA;AAC5B,CAAA;AAEA,eAAe;AAAEL,IAAAA,IAAAA;AAAMb,IAAAA,qBAAAA;AAAuBZ,IAAAA;AAAiB,CAAA;;;;"}

package/dist/server/server/src/services/permission/engine.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var permissions = require('@strapi/permissions');
 var index = require('../../domain/permission/index.js');
 var index$1 = require('../../utils/index.js');
@@ -25,7 +25,7 @@ var createPermissionEngine = ((params)=>{
         const properties = permission.properties || {};
         // Only keep the properties allowed by the action (action.applyToProperties)
         const propertiesName = Object.keys(properties);
-        const invalidProperties = fp.difference(propertiesName, // @ts-expect-error - applyToProperties is defined inside the options of an action
+        const invalidProperties = _.difference(propertiesName, // @ts-expect-error - applyToProperties is defined inside the options of an action
         action.applyToProperties || propertiesName);
         const permissionWithSanitizedProperties = invalidProperties.reduce(// @ts-expect-error - fix reduce, property should be a string but it's actually the permission object
         (property)=>index.default.deleteProperty(property, permission), permission);
@@ -34,7 +34,7 @@ var createPermissionEngine = ((params)=>{
      * Ignore the permission if the fields property is an empty array (access to no field)
      */ .on('after-format::validate.permission', ({ permission })=>{
         const { fields } = permission.properties;
-        if (fp.isArray(fields) && fp.isEmpty(fields)) {
+        if (Array.isArray(fields) && _.isEmpty(fields)) {
             return false;
         }
     });
@@ -57,7 +57,7 @@ var createPermissionEngine = ((params)=>{
         },
         /**
      * Check many permissions based on an ability
-     */ checkMany: fp.curry((ability, permissions)=>{
+     */ checkMany: _.curry((ability, permissions)=>{
             // @ts-expect-error - Permissions does not contain any field property
             return permissions.map(({ action, subject, field })=>ability.can(action, subject, field));
         })

package/dist/server/server/src/services/permission/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sources":["../../../../../../server/src/services/permission/engine.ts"],"sourcesContent":["import { curry, isArray, isEmpty, difference } from 'lodash/fp';\nimport { engine } from '@strapi/permissions';\nimport type { Ability } from '@casl/ability';\nimport permissionDomain from '../../domain/permission';\nimport { getService } from '../../utils';\nimport { Action } from '../../domain/action';\nimport type { AdminUser, Permission } from '../../../../shared/contracts/shared';\n\nexport default (params: { providers: engine.EngineParams['providers'] }) => {\n  const { providers } = params;\n\n  const engineInstance = engine\n    .new({ providers })\n    /**\n     * Validate the permission's action exists in the action registry\n     */\n    .on('before-format::validate.permission', ({ permission }) => {\n      const action = providers.action.get(permission.action);\n\n      // If the action isn't registered into the action provider, then ignore the permission\n      if (!action) {\n        strapi.log.debug(\n          `Unknown action \"${permission.action}\" supplied when registering a new permission in engine`\n        );\n        return false;\n      }\n    })\n\n    /**\n     * Remove invalid properties from the permission based on the action (applyToProperties)\n     */\n    .on('format.permission', (permission: Permission) => {\n      const action = providers.action.get(permission.action) as Action;\n      const properties = permission.properties || {};\n\n      // Only keep the properties allowed by the action (action.applyToProperties)\n      const propertiesName = Object.keys(properties);\n      const invalidProperties = difference(\n        propertiesName,\n        // @ts-expect-error - applyToProperties is defined inside the options of an action\n        action.applyToProperties || propertiesName\n      );\n\n      const permissionWithSanitizedProperties = invalidProperties.reduce(\n        // @ts-expect-error - fix reduce, property should be a string but it's actually the permission object\n        (property) => permissionDomain.deleteProperty(property, permission) as Permission,\n        permission\n      );\n\n      return permissionWithSanitizedProperties;\n    })\n\n    /**\n     * Ignore the permission if the fields property is an empty array (access to no field)\n     */\n    .on('after-format::validate.permission', ({ permission }) => {\n      const { fields } = permission.properties;\n\n      if (isArray(fields) && isEmpty(fields)) {\n        return false;\n      }\n    });\n\n  return {\n    get hooks() {\n      return engineInstance.hooks;\n    },\n\n    /**\n     * Generate an ability based on the given user (using associated roles & permissions)\n     * @param user\n     */\n    async generateUserAbility(user: AdminUser): Promise<Ability> {\n      const permissions = (await getService('permission').findUserPermissions(user)) as any;\n\n      return engineInstance.generateAbility(permissions, user);\n    },\n\n    /**\n     * Generate an ability based on an admin token's stored permissions, scoped to the owner.\n     * Token permissions are already validated and ceiling-clamped at write time.\n     */\n    async generateTokenAbility(tokenPermissions: Permission[], owner: AdminUser): Promise<Ability> {\n      return engineInstance.generateAbility(tokenPermissions as any, owner);\n    },\n\n    /**\n     * Check many permissions based on an ability\n     */\n    checkMany: curry((ability: Ability, permissions: Permission[]) => {\n      // @ts-expect-error - Permissions does not contain any field property\n      return permissions.map(({ action, subject, field }) => ability.can(action, subject, field));\n    }),\n  };\n};\n"],"names":["params","providers","engineInstance","engine","new","on","permission","action","get","strapi","log","debug","properties","propertiesName","Object","keys","invalidProperties","difference","applyToProperties","permissionWithSanitizedProperties","reduce","property","permissionDomain","deleteProperty","fields","isArray","isEmpty","hooks","generateUserAbility","user","permissions","getService","findUserPermissions","generateAbility","generateTokenAbility","tokenPermissions","owner","checkMany","curry","ability","map","subject","field","can"],"mappings":";;;;;;;AAQA,6BAAe,CAAA,CAACA,MAAAA,GAAAA;IACd,MAAM,EAAEC,SAAS,EAAE,GAAGD,MAAAA;IAEtB,MAAME,cAAAA,GAAiBC,kBAAAA,CACpBC,GAAG,CAAC;AAAEH,QAAAA;KAAU,CACjB;;AAEC,SACAI,EAAE,CAAC,oCAAA,EAAsC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACvD,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;;AAGrD,QAAA,IAAI,CAACA,MAAAA,EAAQ;YACXE,MAAAA,CAAOC,GAAG,CAACC,KAAK,CACd,CAAC,gBAAgB,EAAEL,UAAAA,CAAWC,MAAM,CAAC,sDAAsD,CAAC,CAAA;YAE9F,OAAO,KAAA;AACT,QAAA;IACF,CAAA,CAEA;;SAGCF,EAAE,CAAC,mBAAA,EAAqB,CAACC,UAAAA,GAAAA;AACxB,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;AACrD,QAAA,MAAMK,UAAAA,GAAaN,UAAAA,CAAWM,UAAU,IAAI,EAAC;;QAG7C,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAI,CAACH,UAAAA,CAAAA;QACnC,MAAMI,iBAAAA,GAAoBC,aAAAA,CACxBJ,cAAAA;AAEAN,QAAAA,MAAAA,CAAOW,iBAAiB,IAAIL,cAAAA,CAAAA;AAG9B,QAAA,MAAMM,iCAAAA,GAAoCH,iBAAAA,CAAkBI,MAAM;AAEhE,QAAA,CAACC,QAAAA,GAAaC,aAAAA,CAAiBC,cAAc,CAACF,UAAUf,UAAAA,CAAAA,EACxDA,UAAAA,CAAAA;QAGF,OAAOa,iCAAAA;IACT,CAAA,CAEA;;AAEC,SACAd,EAAE,CAAC,mCAAA,EAAqC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACtD,QAAA,MAAM,EAAEkB,MAAM,EAAE,GAAGlB,WAAWM,UAAU;QAExC,IAAIa,UAAAA,CAAQD,MAAAA,CAAAA,IAAWE,UAAAA,CAAQF,MAAAA,CAAAA,EAAS;YACtC,OAAO,KAAA;AACT,QAAA;AACF,IAAA,CAAA,CAAA;IAEF,OAAO;AACL,QAAA,IAAIG,KAAAA,CAAAA,GAAQ;AACV,YAAA,OAAOzB,eAAeyB,KAAK;AAC7B,QAAA,CAAA;AAEA;;;QAIA,MAAMC,qBAAoBC,IAAe,EAAA;AACvC,YAAA,MAAMC,WAAAA,GAAe,MAAMC,kBAAAA,CAAW,YAAA,CAAA,CAAcC,mBAAmB,CAACH,IAAAA,CAAAA;YAExE,OAAO3B,cAAAA,CAAe+B,eAAe,CAACH,WAAAA,EAAaD,IAAAA,CAAAA;AACrD,QAAA,CAAA;AAEA;;;AAGC,QACD,MAAMK,oBAAAA,CAAAA,CAAqBC,gBAA8B,EAAEC,KAAgB,EAAA;YACzE,OAAOlC,cAAAA,CAAe+B,eAAe,CAACE,gBAAAA,EAAyBC,KAAAA,CAAAA;AACjE,QAAA,CAAA;AAEA;;QAGAC,SAAAA,EAAWC,QAAAA,CAAM,CAACC,OAAAA,EAAkBT,WAAAA,GAAAA;;AAElC,YAAA,OAAOA,YAAYU,GAAG,CAAC,CAAC,EAAEjC,MAAM,EAAEkC,OAAO,EAAEC,KAAK,EAAE,GAAKH,OAAAA,CAAQI,GAAG,CAACpC,QAAQkC,OAAAA,EAASC,KAAAA,CAAAA,CAAAA;AACtF,QAAA,CAAA;AACF,KAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"engine.js","sources":["../../../../../../server/src/services/permission/engine.ts"],"sourcesContent":["import { curry, isEmpty, difference } from 'lodash';\n\nimport { engine } from '@strapi/permissions';\nimport type { Ability } from '@casl/ability';\nimport permissionDomain from '../../domain/permission';\nimport { getService } from '../../utils';\nimport { Action } from '../../domain/action';\nimport type { AdminUser, Permission } from '../../../../shared/contracts/shared';\n\nexport default (params: { providers: engine.EngineParams['providers'] }) => {\n  const { providers } = params;\n\n  const engineInstance = engine\n    .new({ providers })\n    /**\n     * Validate the permission's action exists in the action registry\n     */\n    .on('before-format::validate.permission', ({ permission }) => {\n      const action = providers.action.get(permission.action);\n\n      // If the action isn't registered into the action provider, then ignore the permission\n      if (!action) {\n        strapi.log.debug(\n          `Unknown action \"${permission.action}\" supplied when registering a new permission in engine`\n        );\n        return false;\n      }\n    })\n\n    /**\n     * Remove invalid properties from the permission based on the action (applyToProperties)\n     */\n    .on('format.permission', (permission: Permission) => {\n      const action = providers.action.get(permission.action) as Action;\n      const properties = permission.properties || {};\n\n      // Only keep the properties allowed by the action (action.applyToProperties)\n      const propertiesName = Object.keys(properties);\n      const invalidProperties = difference(\n        propertiesName,\n        // @ts-expect-error - applyToProperties is defined inside the options of an action\n        action.applyToProperties || propertiesName\n      );\n\n      const permissionWithSanitizedProperties = invalidProperties.reduce(\n        // @ts-expect-error - fix reduce, property should be a string but it's actually the permission object\n        (property) => permissionDomain.deleteProperty(property, permission) as Permission,\n        permission\n      );\n\n      return permissionWithSanitizedProperties;\n    })\n\n    /**\n     * Ignore the permission if the fields property is an empty array (access to no field)\n     */\n    .on('after-format::validate.permission', ({ permission }) => {\n      const { fields } = permission.properties;\n\n      if (Array.isArray(fields) && isEmpty(fields)) {\n        return false;\n      }\n    });\n\n  return {\n    get hooks() {\n      return engineInstance.hooks;\n    },\n\n    /**\n     * Generate an ability based on the given user (using associated roles & permissions)\n     * @param user\n     */\n    async generateUserAbility(user: AdminUser): Promise<Ability> {\n      const permissions = (await getService('permission').findUserPermissions(user)) as any;\n\n      return engineInstance.generateAbility(permissions, user);\n    },\n\n    /**\n     * Generate an ability based on an admin token's stored permissions, scoped to the owner.\n     * Token permissions are already validated and ceiling-clamped at write time.\n     */\n    async generateTokenAbility(tokenPermissions: Permission[], owner: AdminUser): Promise<Ability> {\n      return engineInstance.generateAbility(tokenPermissions as any, owner);\n    },\n\n    /**\n     * Check many permissions based on an ability\n     */\n    checkMany: curry((ability: Ability, permissions: Permission[]) => {\n      // @ts-expect-error - Permissions does not contain any field property\n      return permissions.map(({ action, subject, field }) => ability.can(action, subject, field));\n    }),\n  };\n};\n"],"names":["params","providers","engineInstance","engine","new","on","permission","action","get","strapi","log","debug","properties","propertiesName","Object","keys","invalidProperties","difference","applyToProperties","permissionWithSanitizedProperties","reduce","property","permissionDomain","deleteProperty","fields","Array","isArray","isEmpty","hooks","generateUserAbility","user","permissions","getService","findUserPermissions","generateAbility","generateTokenAbility","tokenPermissions","owner","checkMany","curry","ability","map","subject","field","can"],"mappings":";;;;;;;AASA,6BAAe,CAAA,CAACA,MAAAA,GAAAA;IACd,MAAM,EAAEC,SAAS,EAAE,GAAGD,MAAAA;IAEtB,MAAME,cAAAA,GAAiBC,kBAAAA,CACpBC,GAAG,CAAC;AAAEH,QAAAA;KAAU,CACjB;;AAEC,SACAI,EAAE,CAAC,oCAAA,EAAsC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACvD,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;;AAGrD,QAAA,IAAI,CAACA,MAAAA,EAAQ;YACXE,MAAAA,CAAOC,GAAG,CAACC,KAAK,CACd,CAAC,gBAAgB,EAAEL,UAAAA,CAAWC,MAAM,CAAC,sDAAsD,CAAC,CAAA;YAE9F,OAAO,KAAA;AACT,QAAA;IACF,CAAA,CAEA;;SAGCF,EAAE,CAAC,mBAAA,EAAqB,CAACC,UAAAA,GAAAA;AACxB,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;AACrD,QAAA,MAAMK,UAAAA,GAAaN,UAAAA,CAAWM,UAAU,IAAI,EAAC;;QAG7C,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAI,CAACH,UAAAA,CAAAA;QACnC,MAAMI,iBAAAA,GAAoBC,YAAAA,CACxBJ,cAAAA;AAEAN,QAAAA,MAAAA,CAAOW,iBAAiB,IAAIL,cAAAA,CAAAA;AAG9B,QAAA,MAAMM,iCAAAA,GAAoCH,iBAAAA,CAAkBI,MAAM;AAEhE,QAAA,CAACC,QAAAA,GAAaC,aAAAA,CAAiBC,cAAc,CAACF,UAAUf,UAAAA,CAAAA,EACxDA,UAAAA,CAAAA;QAGF,OAAOa,iCAAAA;IACT,CAAA,CAEA;;AAEC,SACAd,EAAE,CAAC,mCAAA,EAAqC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACtD,QAAA,MAAM,EAAEkB,MAAM,EAAE,GAAGlB,WAAWM,UAAU;AAExC,QAAA,IAAIa,KAAAA,CAAMC,OAAO,CAACF,MAAAA,CAAAA,IAAWG,UAAQH,MAAAA,CAAAA,EAAS;YAC5C,OAAO,KAAA;AACT,QAAA;AACF,IAAA,CAAA,CAAA;IAEF,OAAO;AACL,QAAA,IAAII,KAAAA,CAAAA,GAAQ;AACV,YAAA,OAAO1B,eAAe0B,KAAK;AAC7B,QAAA,CAAA;AAEA;;;QAIA,MAAMC,qBAAoBC,IAAe,EAAA;AACvC,YAAA,MAAMC,WAAAA,GAAe,MAAMC,kBAAAA,CAAW,YAAA,CAAA,CAAcC,mBAAmB,CAACH,IAAAA,CAAAA;YAExE,OAAO5B,cAAAA,CAAegC,eAAe,CAACH,WAAAA,EAAaD,IAAAA,CAAAA;AACrD,QAAA,CAAA;AAEA;;;AAGC,QACD,MAAMK,oBAAAA,CAAAA,CAAqBC,gBAA8B,EAAEC,KAAgB,EAAA;YACzE,OAAOnC,cAAAA,CAAegC,eAAe,CAACE,gBAAAA,EAAyBC,KAAAA,CAAAA;AACjE,QAAA,CAAA;AAEA;;QAGAC,SAAAA,EAAWC,OAAAA,CAAM,CAACC,OAAAA,EAAkBT,WAAAA,GAAAA;;AAElC,YAAA,OAAOA,YAAYU,GAAG,CAAC,CAAC,EAAElC,MAAM,EAAEmC,OAAO,EAAEC,KAAK,EAAE,GAAKH,OAAAA,CAAQI,GAAG,CAACrC,QAAQmC,OAAAA,EAASC,KAAAA,CAAAA,CAAAA;AACtF,QAAA,CAAA;AACF,KAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/permission/engine.mjs

@@ -1,4 +1,4 @@
-import { difference, isArray, isEmpty, curry } from 'lodash/fp';
+import { difference, isEmpty, curry } from 'lodash';
 import { engine } from '@strapi/permissions';
 import permissionDomain from '../../domain/permission/index.mjs';
 import { getService } from '../../utils/index.mjs';
@@ -32,7 +32,7 @@ var createPermissionEngine = ((params)=>{
      * Ignore the permission if the fields property is an empty array (access to no field)
      */ .on('after-format::validate.permission', ({ permission })=>{
         const { fields } = permission.properties;
-        if (isArray(fields) && isEmpty(fields)) {
+        if (Array.isArray(fields) && isEmpty(fields)) {
             return false;
         }
     });

package/dist/server/server/src/services/permission/engine.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"engine.mjs","sources":["../../../../../../server/src/services/permission/engine.ts"],"sourcesContent":["import { curry, isArray, isEmpty, difference } from 'lodash/fp';\nimport { engine } from '@strapi/permissions';\nimport type { Ability } from '@casl/ability';\nimport permissionDomain from '../../domain/permission';\nimport { getService } from '../../utils';\nimport { Action } from '../../domain/action';\nimport type { AdminUser, Permission } from '../../../../shared/contracts/shared';\n\nexport default (params: { providers: engine.EngineParams['providers'] }) => {\n  const { providers } = params;\n\n  const engineInstance = engine\n    .new({ providers })\n    /**\n     * Validate the permission's action exists in the action registry\n     */\n    .on('before-format::validate.permission', ({ permission }) => {\n      const action = providers.action.get(permission.action);\n\n      // If the action isn't registered into the action provider, then ignore the permission\n      if (!action) {\n        strapi.log.debug(\n          `Unknown action \"${permission.action}\" supplied when registering a new permission in engine`\n        );\n        return false;\n      }\n    })\n\n    /**\n     * Remove invalid properties from the permission based on the action (applyToProperties)\n     */\n    .on('format.permission', (permission: Permission) => {\n      const action = providers.action.get(permission.action) as Action;\n      const properties = permission.properties || {};\n\n      // Only keep the properties allowed by the action (action.applyToProperties)\n      const propertiesName = Object.keys(properties);\n      const invalidProperties = difference(\n        propertiesName,\n        // @ts-expect-error - applyToProperties is defined inside the options of an action\n        action.applyToProperties || propertiesName\n      );\n\n      const permissionWithSanitizedProperties = invalidProperties.reduce(\n        // @ts-expect-error - fix reduce, property should be a string but it's actually the permission object\n        (property) => permissionDomain.deleteProperty(property, permission) as Permission,\n        permission\n      );\n\n      return permissionWithSanitizedProperties;\n    })\n\n    /**\n     * Ignore the permission if the fields property is an empty array (access to no field)\n     */\n    .on('after-format::validate.permission', ({ permission }) => {\n      const { fields } = permission.properties;\n\n      if (isArray(fields) && isEmpty(fields)) {\n        return false;\n      }\n    });\n\n  return {\n    get hooks() {\n      return engineInstance.hooks;\n    },\n\n    /**\n     * Generate an ability based on the given user (using associated roles & permissions)\n     * @param user\n     */\n    async generateUserAbility(user: AdminUser): Promise<Ability> {\n      const permissions = (await getService('permission').findUserPermissions(user)) as any;\n\n      return engineInstance.generateAbility(permissions, user);\n    },\n\n    /**\n     * Generate an ability based on an admin token's stored permissions, scoped to the owner.\n     * Token permissions are already validated and ceiling-clamped at write time.\n     */\n    async generateTokenAbility(tokenPermissions: Permission[], owner: AdminUser): Promise<Ability> {\n      return engineInstance.generateAbility(tokenPermissions as any, owner);\n    },\n\n    /**\n     * Check many permissions based on an ability\n     */\n    checkMany: curry((ability: Ability, permissions: Permission[]) => {\n      // @ts-expect-error - Permissions does not contain any field property\n      return permissions.map(({ action, subject, field }) => ability.can(action, subject, field));\n    }),\n  };\n};\n"],"names":["params","providers","engineInstance","engine","new","on","permission","action","get","strapi","log","debug","properties","propertiesName","Object","keys","invalidProperties","difference","applyToProperties","permissionWithSanitizedProperties","reduce","property","permissionDomain","deleteProperty","fields","isArray","isEmpty","hooks","generateUserAbility","user","permissions","getService","findUserPermissions","generateAbility","generateTokenAbility","tokenPermissions","owner","checkMany","curry","ability","map","subject","field","can"],"mappings":";;;;;AAQA,6BAAe,CAAA,CAACA,MAAAA,GAAAA;IACd,MAAM,EAAEC,SAAS,EAAE,GAAGD,MAAAA;IAEtB,MAAME,cAAAA,GAAiBC,MAAAA,CACpBC,GAAG,CAAC;AAAEH,QAAAA;KAAU,CACjB;;AAEC,SACAI,EAAE,CAAC,oCAAA,EAAsC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACvD,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;;AAGrD,QAAA,IAAI,CAACA,MAAAA,EAAQ;YACXE,MAAAA,CAAOC,GAAG,CAACC,KAAK,CACd,CAAC,gBAAgB,EAAEL,UAAAA,CAAWC,MAAM,CAAC,sDAAsD,CAAC,CAAA;YAE9F,OAAO,KAAA;AACT,QAAA;IACF,CAAA,CAEA;;SAGCF,EAAE,CAAC,mBAAA,EAAqB,CAACC,UAAAA,GAAAA;AACxB,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;AACrD,QAAA,MAAMK,UAAAA,GAAaN,UAAAA,CAAWM,UAAU,IAAI,EAAC;;QAG7C,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAI,CAACH,UAAAA,CAAAA;QACnC,MAAMI,iBAAAA,GAAoBC,UAAAA,CACxBJ,cAAAA;AAEAN,QAAAA,MAAAA,CAAOW,iBAAiB,IAAIL,cAAAA,CAAAA;AAG9B,QAAA,MAAMM,iCAAAA,GAAoCH,iBAAAA,CAAkBI,MAAM;AAEhE,QAAA,CAACC,QAAAA,GAAaC,gBAAAA,CAAiBC,cAAc,CAACF,UAAUf,UAAAA,CAAAA,EACxDA,UAAAA,CAAAA;QAGF,OAAOa,iCAAAA;IACT,CAAA,CAEA;;AAEC,SACAd,EAAE,CAAC,mCAAA,EAAqC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACtD,QAAA,MAAM,EAAEkB,MAAM,EAAE,GAAGlB,WAAWM,UAAU;QAExC,IAAIa,OAAAA,CAAQD,MAAAA,CAAAA,IAAWE,OAAAA,CAAQF,MAAAA,CAAAA,EAAS;YACtC,OAAO,KAAA;AACT,QAAA;AACF,IAAA,CAAA,CAAA;IAEF,OAAO;AACL,QAAA,IAAIG,KAAAA,CAAAA,GAAQ;AACV,YAAA,OAAOzB,eAAeyB,KAAK;AAC7B,QAAA,CAAA;AAEA;;;QAIA,MAAMC,qBAAoBC,IAAe,EAAA;AACvC,YAAA,MAAMC,WAAAA,GAAe,MAAMC,UAAAA,CAAW,YAAA,CAAA,CAAcC,mBAAmB,CAACH,IAAAA,CAAAA;YAExE,OAAO3B,cAAAA,CAAe+B,eAAe,CAACH,WAAAA,EAAaD,IAAAA,CAAAA;AACrD,QAAA,CAAA;AAEA;;;AAGC,QACD,MAAMK,oBAAAA,CAAAA,CAAqBC,gBAA8B,EAAEC,KAAgB,EAAA;YACzE,OAAOlC,cAAAA,CAAe+B,eAAe,CAACE,gBAAAA,EAAyBC,KAAAA,CAAAA;AACjE,QAAA,CAAA;AAEA;;QAGAC,SAAAA,EAAWC,KAAAA,CAAM,CAACC,OAAAA,EAAkBT,WAAAA,GAAAA;;AAElC,YAAA,OAAOA,YAAYU,GAAG,CAAC,CAAC,EAAEjC,MAAM,EAAEkC,OAAO,EAAEC,KAAK,EAAE,GAAKH,OAAAA,CAAQI,GAAG,CAACpC,QAAQkC,OAAAA,EAASC,KAAAA,CAAAA,CAAAA;AACtF,QAAA,CAAA;AACF,KAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"engine.mjs","sources":["../../../../../../server/src/services/permission/engine.ts"],"sourcesContent":["import { curry, isEmpty, difference } from 'lodash';\n\nimport { engine } from '@strapi/permissions';\nimport type { Ability } from '@casl/ability';\nimport permissionDomain from '../../domain/permission';\nimport { getService } from '../../utils';\nimport { Action } from '../../domain/action';\nimport type { AdminUser, Permission } from '../../../../shared/contracts/shared';\n\nexport default (params: { providers: engine.EngineParams['providers'] }) => {\n  const { providers } = params;\n\n  const engineInstance = engine\n    .new({ providers })\n    /**\n     * Validate the permission's action exists in the action registry\n     */\n    .on('before-format::validate.permission', ({ permission }) => {\n      const action = providers.action.get(permission.action);\n\n      // If the action isn't registered into the action provider, then ignore the permission\n      if (!action) {\n        strapi.log.debug(\n          `Unknown action \"${permission.action}\" supplied when registering a new permission in engine`\n        );\n        return false;\n      }\n    })\n\n    /**\n     * Remove invalid properties from the permission based on the action (applyToProperties)\n     */\n    .on('format.permission', (permission: Permission) => {\n      const action = providers.action.get(permission.action) as Action;\n      const properties = permission.properties || {};\n\n      // Only keep the properties allowed by the action (action.applyToProperties)\n      const propertiesName = Object.keys(properties);\n      const invalidProperties = difference(\n        propertiesName,\n        // @ts-expect-error - applyToProperties is defined inside the options of an action\n        action.applyToProperties || propertiesName\n      );\n\n      const permissionWithSanitizedProperties = invalidProperties.reduce(\n        // @ts-expect-error - fix reduce, property should be a string but it's actually the permission object\n        (property) => permissionDomain.deleteProperty(property, permission) as Permission,\n        permission\n      );\n\n      return permissionWithSanitizedProperties;\n    })\n\n    /**\n     * Ignore the permission if the fields property is an empty array (access to no field)\n     */\n    .on('after-format::validate.permission', ({ permission }) => {\n      const { fields } = permission.properties;\n\n      if (Array.isArray(fields) && isEmpty(fields)) {\n        return false;\n      }\n    });\n\n  return {\n    get hooks() {\n      return engineInstance.hooks;\n    },\n\n    /**\n     * Generate an ability based on the given user (using associated roles & permissions)\n     * @param user\n     */\n    async generateUserAbility(user: AdminUser): Promise<Ability> {\n      const permissions = (await getService('permission').findUserPermissions(user)) as any;\n\n      return engineInstance.generateAbility(permissions, user);\n    },\n\n    /**\n     * Generate an ability based on an admin token's stored permissions, scoped to the owner.\n     * Token permissions are already validated and ceiling-clamped at write time.\n     */\n    async generateTokenAbility(tokenPermissions: Permission[], owner: AdminUser): Promise<Ability> {\n      return engineInstance.generateAbility(tokenPermissions as any, owner);\n    },\n\n    /**\n     * Check many permissions based on an ability\n     */\n    checkMany: curry((ability: Ability, permissions: Permission[]) => {\n      // @ts-expect-error - Permissions does not contain any field property\n      return permissions.map(({ action, subject, field }) => ability.can(action, subject, field));\n    }),\n  };\n};\n"],"names":["params","providers","engineInstance","engine","new","on","permission","action","get","strapi","log","debug","properties","propertiesName","Object","keys","invalidProperties","difference","applyToProperties","permissionWithSanitizedProperties","reduce","property","permissionDomain","deleteProperty","fields","Array","isArray","isEmpty","hooks","generateUserAbility","user","permissions","getService","findUserPermissions","generateAbility","generateTokenAbility","tokenPermissions","owner","checkMany","curry","ability","map","subject","field","can"],"mappings":";;;;;AASA,6BAAe,CAAA,CAACA,MAAAA,GAAAA;IACd,MAAM,EAAEC,SAAS,EAAE,GAAGD,MAAAA;IAEtB,MAAME,cAAAA,GAAiBC,MAAAA,CACpBC,GAAG,CAAC;AAAEH,QAAAA;KAAU,CACjB;;AAEC,SACAI,EAAE,CAAC,oCAAA,EAAsC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACvD,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;;AAGrD,QAAA,IAAI,CAACA,MAAAA,EAAQ;YACXE,MAAAA,CAAOC,GAAG,CAACC,KAAK,CACd,CAAC,gBAAgB,EAAEL,UAAAA,CAAWC,MAAM,CAAC,sDAAsD,CAAC,CAAA;YAE9F,OAAO,KAAA;AACT,QAAA;IACF,CAAA,CAEA;;SAGCF,EAAE,CAAC,mBAAA,EAAqB,CAACC,UAAAA,GAAAA;AACxB,QAAA,MAAMC,SAASN,SAAAA,CAAUM,MAAM,CAACC,GAAG,CAACF,WAAWC,MAAM,CAAA;AACrD,QAAA,MAAMK,UAAAA,GAAaN,UAAAA,CAAWM,UAAU,IAAI,EAAC;;QAG7C,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAI,CAACH,UAAAA,CAAAA;QACnC,MAAMI,iBAAAA,GAAoBC,UAAAA,CACxBJ,cAAAA;AAEAN,QAAAA,MAAAA,CAAOW,iBAAiB,IAAIL,cAAAA,CAAAA;AAG9B,QAAA,MAAMM,iCAAAA,GAAoCH,iBAAAA,CAAkBI,MAAM;AAEhE,QAAA,CAACC,QAAAA,GAAaC,gBAAAA,CAAiBC,cAAc,CAACF,UAAUf,UAAAA,CAAAA,EACxDA,UAAAA,CAAAA;QAGF,OAAOa,iCAAAA;IACT,CAAA,CAEA;;AAEC,SACAd,EAAE,CAAC,mCAAA,EAAqC,CAAC,EAAEC,UAAU,EAAE,GAAA;AACtD,QAAA,MAAM,EAAEkB,MAAM,EAAE,GAAGlB,WAAWM,UAAU;AAExC,QAAA,IAAIa,KAAAA,CAAMC,OAAO,CAACF,MAAAA,CAAAA,IAAWG,QAAQH,MAAAA,CAAAA,EAAS;YAC5C,OAAO,KAAA;AACT,QAAA;AACF,IAAA,CAAA,CAAA;IAEF,OAAO;AACL,QAAA,IAAII,KAAAA,CAAAA,GAAQ;AACV,YAAA,OAAO1B,eAAe0B,KAAK;AAC7B,QAAA,CAAA;AAEA;;;QAIA,MAAMC,qBAAoBC,IAAe,EAAA;AACvC,YAAA,MAAMC,WAAAA,GAAe,MAAMC,UAAAA,CAAW,YAAA,CAAA,CAAcC,mBAAmB,CAACH,IAAAA,CAAAA;YAExE,OAAO5B,cAAAA,CAAegC,eAAe,CAACH,WAAAA,EAAaD,IAAAA,CAAAA;AACrD,QAAA,CAAA;AAEA;;;AAGC,QACD,MAAMK,oBAAAA,CAAAA,CAAqBC,gBAA8B,EAAEC,KAAgB,EAAA;YACzE,OAAOnC,cAAAA,CAAegC,eAAe,CAACE,gBAAAA,EAAyBC,KAAAA,CAAAA;AACjE,QAAA,CAAA;AAEA;;QAGAC,SAAAA,EAAWC,KAAAA,CAAM,CAACC,OAAAA,EAAkBT,WAAAA,GAAAA;;AAElC,YAAA,OAAOA,YAAYU,GAAG,CAAC,CAAC,EAAElC,MAAM,EAAEmC,OAAO,EAAEC,KAAK,EAAE,GAAKH,OAAAA,CAAQI,GAAG,CAACrC,QAAQmC,OAAAA,EAASC,KAAAA,CAAAA,CAAAA;AACtF,QAAA,CAAA;AACF,KAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/index.js

@@ -1,7 +1,6 @@
 'use strict';
 
 var _ = require('lodash');
-var fp = require('lodash/fp');
 var ability = require('@casl/ability');
 var sanitize = require('./sanitize.js');
 var validate = require('./validate.js');
@@ -32,9 +31,9 @@ var index = (({ ability: ability$1, action, model })=>({
         },
         // eslint-disable-next-line @typescript-eslint/default-param-last
         addPermissionsQueryTo (query = {}, action) {
-            const newQuery = fp.cloneDeep(query);
+            const newQuery = _.cloneDeep(query);
             const permissionQuery = this.getQuery(action) ?? undefined;
-            if (fp.isPlainObject(query.filters)) {
+            if (_.isPlainObject(query.filters)) {
                 newQuery.filters = permissionQuery ? {
                     $and: [
                         query.filters,

package/dist/server/server/src/services/permission/permissions-manager/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/index.ts"],"sourcesContent":["import _ from 'lodash';\nimport { cloneDeep, isPlainObject } from 'lodash/fp';\nimport { subject as asSubject } from '@casl/ability';\nimport createSanitizeHelpers from './sanitize';\nimport createValidateHelpers from './validate';\n\nimport { buildStrapiQuery, buildCaslQuery } from './query-builders';\n\nexport default ({ ability, action, model }: any) => ({\n  ability,\n  action,\n  model,\n\n  get isAllowed(): unknown {\n    return this.ability.can(action, model);\n  },\n\n  toSubject(target: any, subjectType = model) {\n    return asSubject(subjectType, target);\n  },\n\n  pickPermittedFieldsOf(data: unknown, options = {}) {\n    return this.sanitizeInput(data, options);\n  },\n\n  getQuery(queryAction = action) {\n    if (_.isUndefined(queryAction)) {\n      throw new Error('Action must be defined to build a permission query');\n    }\n\n    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));\n  },\n\n  // eslint-disable-next-line @typescript-eslint/default-param-last\n  addPermissionsQueryTo(query = {} as any, action: unknown) {\n    const newQuery = cloneDeep(query);\n    const permissionQuery = this.getQuery(action) ?? undefined;\n\n    if (isPlainObject(query.filters)) {\n      newQuery.filters = permissionQuery\n        ? { $and: [query.filters, permissionQuery] }\n        : query.filters;\n    } else {\n      newQuery.filters = permissionQuery;\n    }\n\n    return newQuery;\n  },\n\n  ...createSanitizeHelpers({ action, ability, model }),\n  ...createValidateHelpers({ action, ability, model }),\n});\n"],"names":["ability","action","model","isAllowed","can","toSubject","target","subjectType","asSubject","pickPermittedFieldsOf","data","options","sanitizeInput","getQuery","queryAction","_","isUndefined","Error","buildStrapiQuery","buildCaslQuery","addPermissionsQueryTo","query","newQuery","cloneDeep","permissionQuery","undefined","isPlainObject","filters","$and","createSanitizeHelpers","createValidateHelpers"],"mappings":";;;;;;;;;;;;;AAQA,YAAe,CAAA,CAAC,WAAEA,SAAO,EAAEC,MAAM,EAAEC,KAAK,EAAO,IAAM;AACnDF,iBAAAA,SAAAA;AACAC,QAAAA,MAAAA;AACAC,QAAAA,KAAAA;AAEA,QAAA,IAAIC,SAAAA,CAAAA,GAAqB;AACvB,YAAA,OAAO,IAAI,CAACH,OAAO,CAACI,GAAG,CAACH,MAAAA,EAAQC,KAAAA,CAAAA;AAClC,QAAA,CAAA;QAEAG,SAAAA,CAAAA,CAAUC,MAAW,EAAEC,WAAAA,GAAcL,KAAK,EAAA;AACxC,YAAA,OAAOM,gBAAUD,WAAAA,EAAaD,MAAAA,CAAAA;AAChC,QAAA,CAAA;AAEAG,QAAAA,qBAAAA,CAAAA,CAAsBC,IAAa,EAAEC,OAAAA,GAAU,EAAE,EAAA;AAC/C,YAAA,OAAO,IAAI,CAACC,aAAa,CAACF,IAAAA,EAAMC,OAAAA,CAAAA;AAClC,QAAA,CAAA;AAEAE,QAAAA,QAAAA,CAAAA,CAASC,cAAcb,MAAM,EAAA;YAC3B,IAAIc,kBAAAA,CAAEC,WAAW,CAACF,WAAAA,CAAAA,EAAc;AAC9B,gBAAA,MAAM,IAAIG,KAAAA,CAAM,oDAAA,CAAA;AAClB,YAAA;YAEA,OAAOC,8BAAAA,CAAiBC,4BAAAA,CAAenB,SAAAA,EAASc,WAAAA,EAAaZ,KAAAA,CAAAA,CAAAA;AAC/D,QAAA,CAAA;;AAGAkB,QAAAA,qBAAAA,CAAAA,CAAsBC,KAAAA,GAAQ,EAAS,EAAEpB,MAAe,EAAA;AACtD,YAAA,MAAMqB,WAAWC,YAAAA,CAAUF,KAAAA,CAAAA;AAC3B,YAAA,MAAMG,eAAAA,GAAkB,IAAI,CAACX,QAAQ,CAACZ,MAAAA,CAAAA,IAAWwB,SAAAA;YAEjD,IAAIC,gBAAAA,CAAcL,KAAAA,CAAMM,OAAO,CAAA,EAAG;gBAChCL,QAAAA,CAASK,OAAO,GAAGH,eAAAA,GACf;oBAAEI,IAAAA,EAAM;AAACP,wBAAAA,KAAAA,CAAMM,OAAO;AAAEH,wBAAAA;AAAgB;AAAC,iBAAA,GACzCH,MAAMM,OAAO;YACnB,CAAA,MAAO;AACLL,gBAAAA,QAAAA,CAASK,OAAO,GAAGH,eAAAA;AACrB,YAAA;YAEA,OAAOF,QAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGO,QAAAA,CAAsB;AAAE5B,YAAAA,MAAAA;AAAQD,qBAAAA,SAAAA;AAASE,YAAAA;SAAM,CAAE;AACpD,QAAA,GAAG4B,QAAAA,CAAsB;AAAE7B,YAAAA,MAAAA;AAAQD,qBAAAA,SAAAA;AAASE,YAAAA;SAAM;AACpD,KAAA,CAAC;;;;"}
+{"version":3,"file":"index.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/index.ts"],"sourcesContent":["import _, { cloneDeep, isPlainObject } from 'lodash';\n\nimport { subject as asSubject } from '@casl/ability';\nimport createSanitizeHelpers from './sanitize';\nimport createValidateHelpers from './validate';\n\nimport { buildStrapiQuery, buildCaslQuery } from './query-builders';\n\nexport default ({ ability, action, model }: any) => ({\n  ability,\n  action,\n  model,\n\n  get isAllowed(): unknown {\n    return this.ability.can(action, model);\n  },\n\n  toSubject(target: any, subjectType = model) {\n    return asSubject(subjectType, target);\n  },\n\n  pickPermittedFieldsOf(data: unknown, options = {}) {\n    return this.sanitizeInput(data, options);\n  },\n\n  getQuery(queryAction = action) {\n    if (_.isUndefined(queryAction)) {\n      throw new Error('Action must be defined to build a permission query');\n    }\n\n    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));\n  },\n\n  // eslint-disable-next-line @typescript-eslint/default-param-last\n  addPermissionsQueryTo(query = {} as any, action: unknown) {\n    const newQuery = cloneDeep(query);\n    const permissionQuery = this.getQuery(action) ?? undefined;\n\n    if (isPlainObject(query.filters)) {\n      newQuery.filters = permissionQuery\n        ? { $and: [query.filters, permissionQuery] }\n        : query.filters;\n    } else {\n      newQuery.filters = permissionQuery;\n    }\n\n    return newQuery;\n  },\n\n  ...createSanitizeHelpers({ action, ability, model }),\n  ...createValidateHelpers({ action, ability, model }),\n});\n"],"names":["ability","action","model","isAllowed","can","toSubject","target","subjectType","asSubject","pickPermittedFieldsOf","data","options","sanitizeInput","getQuery","queryAction","_","isUndefined","Error","buildStrapiQuery","buildCaslQuery","addPermissionsQueryTo","query","newQuery","cloneDeep","permissionQuery","undefined","isPlainObject","filters","$and","createSanitizeHelpers","createValidateHelpers"],"mappings":";;;;;;;;;;;;AAQA,YAAe,CAAA,CAAC,WAAEA,SAAO,EAAEC,MAAM,EAAEC,KAAK,EAAO,IAAM;AACnDF,iBAAAA,SAAAA;AACAC,QAAAA,MAAAA;AACAC,QAAAA,KAAAA;AAEA,QAAA,IAAIC,SAAAA,CAAAA,GAAqB;AACvB,YAAA,OAAO,IAAI,CAACH,OAAO,CAACI,GAAG,CAACH,MAAAA,EAAQC,KAAAA,CAAAA;AAClC,QAAA,CAAA;QAEAG,SAAAA,CAAAA,CAAUC,MAAW,EAAEC,WAAAA,GAAcL,KAAK,EAAA;AACxC,YAAA,OAAOM,gBAAUD,WAAAA,EAAaD,MAAAA,CAAAA;AAChC,QAAA,CAAA;AAEAG,QAAAA,qBAAAA,CAAAA,CAAsBC,IAAa,EAAEC,OAAAA,GAAU,EAAE,EAAA;AAC/C,YAAA,OAAO,IAAI,CAACC,aAAa,CAACF,IAAAA,EAAMC,OAAAA,CAAAA;AAClC,QAAA,CAAA;AAEAE,QAAAA,QAAAA,CAAAA,CAASC,cAAcb,MAAM,EAAA;YAC3B,IAAIc,kBAAAA,CAAEC,WAAW,CAACF,WAAAA,CAAAA,EAAc;AAC9B,gBAAA,MAAM,IAAIG,KAAAA,CAAM,oDAAA,CAAA;AAClB,YAAA;YAEA,OAAOC,8BAAAA,CAAiBC,4BAAAA,CAAenB,SAAAA,EAASc,WAAAA,EAAaZ,KAAAA,CAAAA,CAAAA;AAC/D,QAAA,CAAA;;AAGAkB,QAAAA,qBAAAA,CAAAA,CAAsBC,KAAAA,GAAQ,EAAS,EAAEpB,MAAe,EAAA;AACtD,YAAA,MAAMqB,WAAWC,WAAAA,CAAUF,KAAAA,CAAAA;AAC3B,YAAA,MAAMG,eAAAA,GAAkB,IAAI,CAACX,QAAQ,CAACZ,MAAAA,CAAAA,IAAWwB,SAAAA;YAEjD,IAAIC,eAAAA,CAAcL,KAAAA,CAAMM,OAAO,CAAA,EAAG;gBAChCL,QAAAA,CAASK,OAAO,GAAGH,eAAAA,GACf;oBAAEI,IAAAA,EAAM;AAACP,wBAAAA,KAAAA,CAAMM,OAAO;AAAEH,wBAAAA;AAAgB;AAAC,iBAAA,GACzCH,MAAMM,OAAO;YACnB,CAAA,MAAO;AACLL,gBAAAA,QAAAA,CAASK,OAAO,GAAGH,eAAAA;AACrB,YAAA;YAEA,OAAOF,QAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGO,QAAAA,CAAsB;AAAE5B,YAAAA,MAAAA;AAAQD,qBAAAA,SAAAA;AAASE,YAAAA;SAAM,CAAE;AACpD,QAAA,GAAG4B,QAAAA,CAAsB;AAAE7B,YAAAA,MAAAA;AAAQD,qBAAAA,SAAAA;AAASE,YAAAA;SAAM;AACpD,KAAA,CAAC;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/index.mjs

@@ -1,5 +1,4 @@
-import ___default from 'lodash';
-import { cloneDeep, isPlainObject } from 'lodash/fp';
+import ___default, { cloneDeep, isPlainObject } from 'lodash';
 import { subject } from '@casl/ability';
 import createSanitizeHelpers from './sanitize.mjs';
 import createValidateHelpers from './validate.mjs';

package/dist/server/server/src/services/permission/permissions-manager/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/index.ts"],"sourcesContent":["import _ from 'lodash';\nimport { cloneDeep, isPlainObject } from 'lodash/fp';\nimport { subject as asSubject } from '@casl/ability';\nimport createSanitizeHelpers from './sanitize';\nimport createValidateHelpers from './validate';\n\nimport { buildStrapiQuery, buildCaslQuery } from './query-builders';\n\nexport default ({ ability, action, model }: any) => ({\n  ability,\n  action,\n  model,\n\n  get isAllowed(): unknown {\n    return this.ability.can(action, model);\n  },\n\n  toSubject(target: any, subjectType = model) {\n    return asSubject(subjectType, target);\n  },\n\n  pickPermittedFieldsOf(data: unknown, options = {}) {\n    return this.sanitizeInput(data, options);\n  },\n\n  getQuery(queryAction = action) {\n    if (_.isUndefined(queryAction)) {\n      throw new Error('Action must be defined to build a permission query');\n    }\n\n    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));\n  },\n\n  // eslint-disable-next-line @typescript-eslint/default-param-last\n  addPermissionsQueryTo(query = {} as any, action: unknown) {\n    const newQuery = cloneDeep(query);\n    const permissionQuery = this.getQuery(action) ?? undefined;\n\n    if (isPlainObject(query.filters)) {\n      newQuery.filters = permissionQuery\n        ? { $and: [query.filters, permissionQuery] }\n        : query.filters;\n    } else {\n      newQuery.filters = permissionQuery;\n    }\n\n    return newQuery;\n  },\n\n  ...createSanitizeHelpers({ action, ability, model }),\n  ...createValidateHelpers({ action, ability, model }),\n});\n"],"names":["ability","action","model","isAllowed","can","toSubject","target","subjectType","asSubject","pickPermittedFieldsOf","data","options","sanitizeInput","getQuery","queryAction","_","isUndefined","Error","buildStrapiQuery","buildCaslQuery","addPermissionsQueryTo","query","newQuery","cloneDeep","permissionQuery","undefined","isPlainObject","filters","$and","createSanitizeHelpers","createValidateHelpers"],"mappings":";;;;;;;AAQA,YAAe,CAAA,CAAC,EAAEA,OAAO,EAAEC,MAAM,EAAEC,KAAK,EAAO,IAAM;AACnDF,QAAAA,OAAAA;AACAC,QAAAA,MAAAA;AACAC,QAAAA,KAAAA;AAEA,QAAA,IAAIC,SAAAA,CAAAA,GAAqB;AACvB,YAAA,OAAO,IAAI,CAACH,OAAO,CAACI,GAAG,CAACH,MAAAA,EAAQC,KAAAA,CAAAA;AAClC,QAAA,CAAA;QAEAG,SAAAA,CAAAA,CAAUC,MAAW,EAAEC,WAAAA,GAAcL,KAAK,EAAA;AACxC,YAAA,OAAOM,QAAUD,WAAAA,EAAaD,MAAAA,CAAAA;AAChC,QAAA,CAAA;AAEAG,QAAAA,qBAAAA,CAAAA,CAAsBC,IAAa,EAAEC,OAAAA,GAAU,EAAE,EAAA;AAC/C,YAAA,OAAO,IAAI,CAACC,aAAa,CAACF,IAAAA,EAAMC,OAAAA,CAAAA;AAClC,QAAA,CAAA;AAEAE,QAAAA,QAAAA,CAAAA,CAASC,cAAcb,MAAM,EAAA;YAC3B,IAAIc,UAAAA,CAAEC,WAAW,CAACF,WAAAA,CAAAA,EAAc;AAC9B,gBAAA,MAAM,IAAIG,KAAAA,CAAM,oDAAA,CAAA;AAClB,YAAA;YAEA,OAAOC,gBAAAA,CAAiBC,cAAAA,CAAenB,OAAAA,EAASc,WAAAA,EAAaZ,KAAAA,CAAAA,CAAAA;AAC/D,QAAA,CAAA;;AAGAkB,QAAAA,qBAAAA,CAAAA,CAAsBC,KAAAA,GAAQ,EAAS,EAAEpB,MAAe,EAAA;AACtD,YAAA,MAAMqB,WAAWC,SAAAA,CAAUF,KAAAA,CAAAA;AAC3B,YAAA,MAAMG,eAAAA,GAAkB,IAAI,CAACX,QAAQ,CAACZ,MAAAA,CAAAA,IAAWwB,SAAAA;YAEjD,IAAIC,aAAAA,CAAcL,KAAAA,CAAMM,OAAO,CAAA,EAAG;gBAChCL,QAAAA,CAASK,OAAO,GAAGH,eAAAA,GACf;oBAAEI,IAAAA,EAAM;AAACP,wBAAAA,KAAAA,CAAMM,OAAO;AAAEH,wBAAAA;AAAgB;AAAC,iBAAA,GACzCH,MAAMM,OAAO;YACnB,CAAA,MAAO;AACLL,gBAAAA,QAAAA,CAASK,OAAO,GAAGH,eAAAA;AACrB,YAAA;YAEA,OAAOF,QAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGO,qBAAAA,CAAsB;AAAE5B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM,CAAE;AACpD,QAAA,GAAG4B,qBAAAA,CAAsB;AAAE7B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM;AACpD,KAAA,CAAC;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/index.ts"],"sourcesContent":["import _, { cloneDeep, isPlainObject } from 'lodash';\n\nimport { subject as asSubject } from '@casl/ability';\nimport createSanitizeHelpers from './sanitize';\nimport createValidateHelpers from './validate';\n\nimport { buildStrapiQuery, buildCaslQuery } from './query-builders';\n\nexport default ({ ability, action, model }: any) => ({\n  ability,\n  action,\n  model,\n\n  get isAllowed(): unknown {\n    return this.ability.can(action, model);\n  },\n\n  toSubject(target: any, subjectType = model) {\n    return asSubject(subjectType, target);\n  },\n\n  pickPermittedFieldsOf(data: unknown, options = {}) {\n    return this.sanitizeInput(data, options);\n  },\n\n  getQuery(queryAction = action) {\n    if (_.isUndefined(queryAction)) {\n      throw new Error('Action must be defined to build a permission query');\n    }\n\n    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));\n  },\n\n  // eslint-disable-next-line @typescript-eslint/default-param-last\n  addPermissionsQueryTo(query = {} as any, action: unknown) {\n    const newQuery = cloneDeep(query);\n    const permissionQuery = this.getQuery(action) ?? undefined;\n\n    if (isPlainObject(query.filters)) {\n      newQuery.filters = permissionQuery\n        ? { $and: [query.filters, permissionQuery] }\n        : query.filters;\n    } else {\n      newQuery.filters = permissionQuery;\n    }\n\n    return newQuery;\n  },\n\n  ...createSanitizeHelpers({ action, ability, model }),\n  ...createValidateHelpers({ action, ability, model }),\n});\n"],"names":["ability","action","model","isAllowed","can","toSubject","target","subjectType","asSubject","pickPermittedFieldsOf","data","options","sanitizeInput","getQuery","queryAction","_","isUndefined","Error","buildStrapiQuery","buildCaslQuery","addPermissionsQueryTo","query","newQuery","cloneDeep","permissionQuery","undefined","isPlainObject","filters","$and","createSanitizeHelpers","createValidateHelpers"],"mappings":";;;;;;AAQA,YAAe,CAAA,CAAC,EAAEA,OAAO,EAAEC,MAAM,EAAEC,KAAK,EAAO,IAAM;AACnDF,QAAAA,OAAAA;AACAC,QAAAA,MAAAA;AACAC,QAAAA,KAAAA;AAEA,QAAA,IAAIC,SAAAA,CAAAA,GAAqB;AACvB,YAAA,OAAO,IAAI,CAACH,OAAO,CAACI,GAAG,CAACH,MAAAA,EAAQC,KAAAA,CAAAA;AAClC,QAAA,CAAA;QAEAG,SAAAA,CAAAA,CAAUC,MAAW,EAAEC,WAAAA,GAAcL,KAAK,EAAA;AACxC,YAAA,OAAOM,QAAUD,WAAAA,EAAaD,MAAAA,CAAAA;AAChC,QAAA,CAAA;AAEAG,QAAAA,qBAAAA,CAAAA,CAAsBC,IAAa,EAAEC,OAAAA,GAAU,EAAE,EAAA;AAC/C,YAAA,OAAO,IAAI,CAACC,aAAa,CAACF,IAAAA,EAAMC,OAAAA,CAAAA;AAClC,QAAA,CAAA;AAEAE,QAAAA,QAAAA,CAAAA,CAASC,cAAcb,MAAM,EAAA;YAC3B,IAAIc,UAAAA,CAAEC,WAAW,CAACF,WAAAA,CAAAA,EAAc;AAC9B,gBAAA,MAAM,IAAIG,KAAAA,CAAM,oDAAA,CAAA;AAClB,YAAA;YAEA,OAAOC,gBAAAA,CAAiBC,cAAAA,CAAenB,OAAAA,EAASc,WAAAA,EAAaZ,KAAAA,CAAAA,CAAAA;AAC/D,QAAA,CAAA;;AAGAkB,QAAAA,qBAAAA,CAAAA,CAAsBC,KAAAA,GAAQ,EAAS,EAAEpB,MAAe,EAAA;AACtD,YAAA,MAAMqB,WAAWC,SAAAA,CAAUF,KAAAA,CAAAA;AAC3B,YAAA,MAAMG,eAAAA,GAAkB,IAAI,CAACX,QAAQ,CAACZ,MAAAA,CAAAA,IAAWwB,SAAAA;YAEjD,IAAIC,aAAAA,CAAcL,KAAAA,CAAMM,OAAO,CAAA,EAAG;gBAChCL,QAAAA,CAASK,OAAO,GAAGH,eAAAA,GACf;oBAAEI,IAAAA,EAAM;AAACP,wBAAAA,KAAAA,CAAMM,OAAO;AAAEH,wBAAAA;AAAgB;AAAC,iBAAA,GACzCH,MAAMM,OAAO;YACnB,CAAA,MAAO;AACLL,gBAAAA,QAAAA,CAASK,OAAO,GAAGH,eAAAA;AACrB,YAAA;YAEA,OAAOF,QAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGO,qBAAAA,CAAsB;AAAE5B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM,CAAE;AACpD,QAAA,GAAG4B,qBAAAA,CAAsB;AAAE7B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM;AACpD,KAAA,CAAC;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.js

@@ -2,7 +2,7 @@
 
 var ability = require('@casl/ability');
 var extra = require('@casl/ability/extra');
-var fp = require('lodash/fp');
+var _ = require('lodash');
 
 /**
  * Creates a cached permission fields calculator for a given CASL ability.
@@ -20,18 +20,18 @@ var fp = require('lodash/fp');
         const rules = ability$1.rulesFor(actionOverride, subjectType);
         // Check if any rule has conditions that depend on entity data
         // If so, we can't cache - must compute per entity
-        const hasEntityConditions = rules.some((rule)=>rule.conditions && !fp.isEmpty(rule.conditions));
+        const hasEntityConditions = rules.some((rule)=>rule.conditions && !_.isEmpty(rule.conditions));
         // Return cached result if available and safe to use
         const cacheKey = `${actionOverride}::${String(subjectType)}`;
         if (!hasEntityConditions && permissionCache.has(cacheKey)) {
             return permissionCache.get(cacheKey);
         }
         let result;
-        const allFieldsAllowed = rules.some((r)=>fp.isNil(r.fields));
+        const allFieldsAllowed = rules.some((r)=>r.fields == null);
         if (allFieldsAllowed) {
             result = {
                 permittedFields: [],
-                hasAtLeastOneRegistered: rules.some((r)=>!fp.isNil(r.fields)),
+                hasAtLeastOneRegistered: rules.some((r)=>r.fields != null),
                 shouldIncludeAll: true
             };
         } else {
@@ -39,11 +39,11 @@ var fp = require('lodash/fp');
             const permittedFields = extra.permittedFieldsOf(ability$1, actionOverride, subject, {
                 fieldsFrom: (rule)=>rule.fields || []
             });
-            const hasAtLeastOneRegistered = fp.some((fields)=>!fp.isNil(fields), fp.flatMap(fp.prop('fields'), rules));
+            const hasAtLeastOneRegistered = rules.flatMap((rule)=>rule.fields).some((field)=>field != null);
             result = {
                 permittedFields,
                 hasAtLeastOneRegistered,
-                shouldIncludeAll: fp.isEmpty(permittedFields) && !hasAtLeastOneRegistered
+                shouldIncludeAll: _.isEmpty(permittedFields) && !hasAtLeastOneRegistered
             };
         }
         // Cache for reuse if no entity-specific conditions

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-fields.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty, isNil, flatMap, some, prop } from 'lodash/fp';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => isNil(r.fields));\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => !isNil(r.fields)),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = some(\n        (fields) => !isNil(fields),\n        flatMap(prop('fields'), rules)\n      );\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","isNil","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","prop","set","clearCache","clear"],"mappings":";;;;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,SAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,yBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,SAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,UAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMC,QAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;AACzD,QAAA,IAAIH,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPK,gBAAAA,eAAAA,EAAiB,EAAE;gBACnBC,uBAAAA,EAAyBjB,KAAAA,CAAMG,IAAI,CAAC,CAACU,IAAM,CAACC,QAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;gBAC1DG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,uBAAAA,CAAkB3B,SAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EuB,gBAAAA,UAAAA,EAAY,CAAChB,IAAAA,GAASA,IAAAA,CAAKW,MAAM,IAAI;AACvC,aAAA,CAAA;YAEA,MAAME,uBAAAA,GAA0Bd,QAC9B,CAACY,MAAAA,GAAW,CAACD,QAAAA,CAAMC,MAAAA,CAAAA,EACnBM,UAAAA,CAAQC,OAAAA,CAAK,QAAA,CAAA,EAAWtB,KAAAA,CAAAA,CAAAA;YAG1BW,MAAAA,GAAS;AACPK,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBZ,UAAAA,CAAQU,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACf,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB8B,GAAG,CAAChB,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA6B,UAAAA,EAAY,IAAM/B,gBAAgBgC,KAAK;AACzC,KAAA;AACF;;;;"}
+{"version":3,"file":"permission-fields.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty } from 'lodash';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => r.fields == null);\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => r.fields != null),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = rules\n        .flatMap((rule) => rule.fields)\n        .some((field) => field != null);\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","field","set","clearCache","clear"],"mappings":";;;;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,SAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,yBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,SAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,SAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;AACvD,QAAA,IAAIF,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPI,gBAAAA,eAAAA,EAAiB,EAAE;AACnBC,gBAAAA,uBAAAA,EAAyBhB,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;gBACvDG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,uBAAAA,CAAkB1B,SAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EsB,gBAAAA,UAAAA,EAAY,CAACf,IAAAA,GAASA,IAAAA,CAAKU,MAAM,IAAI;AACvC,aAAA,CAAA;AAEA,YAAA,MAAME,uBAAAA,GAA0BhB,KAAAA,CAC7BoB,OAAO,CAAC,CAAChB,IAAAA,GAASA,IAAAA,CAAKU,MAAM,CAAA,CAC7BX,IAAI,CAAC,CAACkB,QAAUA,KAAAA,IAAS,IAAA,CAAA;YAE5BV,MAAAA,GAAS;AACPI,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBX,SAAAA,CAAQS,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACd,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB6B,GAAG,CAACf,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA4B,UAAAA,EAAY,IAAM9B,gBAAgB+B,KAAK;AACzC,KAAA;AACF;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.mjs

@@ -1,6 +1,6 @@
 import { detectSubjectType } from '@casl/ability';
 import { permittedFieldsOf } from '@casl/ability/extra';
-import { isEmpty, isNil, some, flatMap, prop } from 'lodash/fp';
+import { isEmpty } from 'lodash';
 
 /**
  * Creates a cached permission fields calculator for a given CASL ability.
@@ -25,11 +25,11 @@ import { isEmpty, isNil, some, flatMap, prop } from 'lodash/fp';
             return permissionCache.get(cacheKey);
         }
         let result;
-        const allFieldsAllowed = rules.some((r)=>isNil(r.fields));
+        const allFieldsAllowed = rules.some((r)=>r.fields == null);
         if (allFieldsAllowed) {
             result = {
                 permittedFields: [],
-                hasAtLeastOneRegistered: rules.some((r)=>!isNil(r.fields)),
+                hasAtLeastOneRegistered: rules.some((r)=>r.fields != null),
                 shouldIncludeAll: true
             };
         } else {
@@ -37,7 +37,7 @@ import { isEmpty, isNil, some, flatMap, prop } from 'lodash/fp';
             const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {
                 fieldsFrom: (rule)=>rule.fields || []
             });
-            const hasAtLeastOneRegistered = some((fields)=>!isNil(fields), flatMap(prop('fields'), rules));
+            const hasAtLeastOneRegistered = rules.flatMap((rule)=>rule.fields).some((field)=>field != null);
             result = {
                 permittedFields,
                 hasAtLeastOneRegistered,

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"permission-fields.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty, isNil, flatMap, some, prop } from 'lodash/fp';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => isNil(r.fields));\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => !isNil(r.fields)),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = some(\n        (fields) => !isNil(fields),\n        flatMap(prop('fields'), rules)\n      );\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","isNil","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","prop","set","clearCache","clear"],"mappings":";;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,OAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,iBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,OAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,OAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMC,KAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;AACzD,QAAA,IAAIH,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPK,gBAAAA,eAAAA,EAAiB,EAAE;gBACnBC,uBAAAA,EAAyBjB,KAAAA,CAAMG,IAAI,CAAC,CAACU,IAAM,CAACC,KAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;gBAC1DG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,iBAAAA,CAAkB3B,OAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EuB,gBAAAA,UAAAA,EAAY,CAAChB,IAAAA,GAASA,IAAAA,CAAKW,MAAM,IAAI;AACvC,aAAA,CAAA;YAEA,MAAME,uBAAAA,GAA0Bd,KAC9B,CAACY,MAAAA,GAAW,CAACD,KAAAA,CAAMC,MAAAA,CAAAA,EACnBM,OAAAA,CAAQC,IAAAA,CAAK,QAAA,CAAA,EAAWtB,KAAAA,CAAAA,CAAAA;YAG1BW,MAAAA,GAAS;AACPK,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBZ,OAAAA,CAAQU,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACf,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB8B,GAAG,CAAChB,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA6B,UAAAA,EAAY,IAAM/B,gBAAgBgC,KAAK;AACzC,KAAA;AACF;;;;"}
+{"version":3,"file":"permission-fields.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty } from 'lodash';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => r.fields == null);\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => r.fields != null),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = rules\n        .flatMap((rule) => rule.fields)\n        .some((field) => field != null);\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","field","set","clearCache","clear"],"mappings":";;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,OAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,iBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,OAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,OAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;AACvD,QAAA,IAAIF,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPI,gBAAAA,eAAAA,EAAiB,EAAE;AACnBC,gBAAAA,uBAAAA,EAAyBhB,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;gBACvDG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,iBAAAA,CAAkB1B,OAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EsB,gBAAAA,UAAAA,EAAY,CAACf,IAAAA,GAASA,IAAAA,CAAKU,MAAM,IAAI;AACvC,aAAA,CAAA;AAEA,YAAA,MAAME,uBAAAA,GAA0BhB,KAAAA,CAC7BoB,OAAO,CAAC,CAAChB,IAAAA,GAASA,IAAAA,CAAKU,MAAM,CAAA,CAC7BX,IAAI,CAAC,CAACkB,QAAUA,KAAAA,IAAS,IAAA,CAAA;YAE5BV,MAAAA,GAAS;AACPI,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBX,OAAAA,CAAQS,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACd,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB6B,GAAG,CAACf,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA4B,UAAAA,EAAY,IAAM9B,gBAAgB+B,KAAK;AACzC,KAAA;AACF;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/sanitize.js

@@ -1,7 +1,7 @@
 'use strict';
 
+var _ = require('lodash');
 var ability = require('@casl/ability');
-var fp = require('lodash/fp');
 var utils = require('@strapi/utils');
 var permissionFields = require('./permission-fields.js');
 var user = require('../../../domain/user.js');
@@ -30,12 +30,12 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
         // TODO: sanitize relations to admin users in all sanitizers
         const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
         const createSanitizeFilters = (ctx)=>utils.async.pipe(utils.traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx), utils.traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx), utils.traverse.traverseQueryFilters(omitHiddenFields, ctx), utils.traverse.traverseQueryFilters(removePassword, ctx), utils.traverse.traverseQueryFilters(({ key, value }, { remove })=>{
-                if (fp.isObject(value) && fp.isEmpty(value)) {
+                if (_.isObject(value) && _.isEmpty(value)) {
                     remove(key);
                 }
             }, ctx));
         const createSanitizeSort = (ctx)=>utils.async.pipe(utils.traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx), utils.traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx), utils.traverse.traverseQuerySort(omitHiddenFields, ctx), utils.traverse.traverseQuerySort(removePassword, ctx), utils.traverse.traverseQuerySort(({ key, attribute, value }, { remove })=>{
-                if (!isScalarAttribute(attribute) && fp.isEmpty(value)) {
+                if (!isScalarAttribute(attribute) && _.isEmpty(value)) {
                     remove(key);
                 }
             }, ctx));
@@ -66,7 +66,7 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
         };
         const sanitizePopulate = utils.async.pipe(utils.traverse.traverseQueryPopulate(expandWildcardPopulate, ctx), utils.traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx), utils.traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx), utils.traverse.traverseQueryPopulate(omitHiddenFields, ctx), utils.traverse.traverseQueryPopulate(removePassword, ctx), utils.traverse.traverseQueryPopulate(sanitizeNestedPopulate, ctx));
         return async (query)=>{
-            const sanitizedQuery = fp.cloneDeep(query);
+            const sanitizedQuery = _.cloneDeep(query);
             const [sanitizedFilters, sanitizedSort, sanitizedPopulate, sanitizedFields] = await Promise.all([
                 query.filters ? sanitizeFilters(query.filters) : undefined,
                 query.sort ? sanitizeSort(query.sort) : undefined,
@@ -105,7 +105,7 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
     const wrapSanitize = (createSanitizeFunction)=>{
         const { getPermissionFields } = permissionFields.createPermissionFieldsCache(ability$1);
         const wrappedSanitize = async (data, options = {})=>{
-            if (fp.isArray(data)) {
+            if (Array.isArray(data)) {
                 return Promise.all(data.map((entity)=>wrappedSanitize(entity, options)));
             }
             const { subject, action: actionOverride } = getDefaultOptions(data, options);
@@ -124,26 +124,26 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
         return wrappedSanitize;
     };
     const getDefaultOptions = (data, options)=>{
-        return fp.defaults({
+        return _.defaults({}, options, {
             subject: ability.subject(model, data),
             action
-        }, options);
+        });
     };
     /**
    * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses
-   */ const omitCreatorRoles = fp.omit([
-        `${CREATED_BY_ATTRIBUTE}.roles`,
-        `${UPDATED_BY_ATTRIBUTE}.roles`
-    ]);
+   */ const omitCreatorRoles = (data)=>_.omit(data, [
+            `${CREATED_BY_ATTRIBUTE}.roles`,
+            `${UPDATED_BY_ATTRIBUTE}.roles`
+        ]);
     /**
    * Visitor used to remove hidden fields from the admin API responses
    */ const omitHiddenFields = ({ key, schema }, { remove })=>{
-        const isHidden = fp.getOr(false, [
+        const isHidden = _.get(schema, [
             'config',
             'attributes',
             key,
             'hidden'
-        ], schema);
+        ], false);
         if (isHidden) {
             remove(key);
         }
@@ -151,7 +151,7 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
     /**
    * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information
    */ const pickAllowedAdminUserFields = ({ attribute, key, value }, { set })=>{
-        const pickAllowedFields = fp.pick(user.ADMIN_USER_ALLOWED_FIELDS);
+        const pickAllowedFields = (user$1)=>_.pick(user$1, user.ADMIN_USER_ALLOWED_FIELDS);
         if (!attribute) {
             return;
         }
@@ -173,41 +173,47 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
     const getInputFields = (fields = [])=>{
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
         const writableAttributes = getWritableAttributes(schema);
-        const nonVisibleWritableAttributes = fp.intersection(nonVisibleAttributes, writableAttributes);
-        return fp.uniq([
-            ...fields,
-            ...COMPONENT_FIELDS,
-            ...nonVisibleWritableAttributes
-        ]);
+        const nonVisibleWritableAttributes = _.intersection(writableAttributes, nonVisibleAttributes);
+        return [
+            ...new Set([
+                ...fields,
+                ...COMPONENT_FIELDS,
+                ...nonVisibleWritableAttributes
+            ])
+        ];
     };
     const getOutputFields = (fields = [])=>{
         const nonWritableAttributes = getNonWritableAttributes(schema);
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
-        return fp.uniq([
-            ...fields,
-            ...STATIC_FIELDS,
-            ...COMPONENT_FIELDS,
-            ...nonWritableAttributes,
-            ...nonVisibleAttributes,
-            CREATED_AT_ATTRIBUTE,
-            UPDATED_AT_ATTRIBUTE
-        ]);
+        return [
+            ...new Set([
+                ...fields,
+                ...STATIC_FIELDS,
+                ...COMPONENT_FIELDS,
+                ...nonWritableAttributes,
+                ...nonVisibleAttributes,
+                CREATED_AT_ATTRIBUTE,
+                UPDATED_AT_ATTRIBUTE
+            ])
+        ];
     };
     const getQueryFields = (fields = [])=>{
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
         const writableAttributes = getWritableAttributes(schema);
-        const nonVisibleWritableAttributes = fp.intersection(nonVisibleAttributes, writableAttributes);
-        return fp.uniq([
-            ...fields,
-            ...STATIC_FIELDS,
-            ...COMPONENT_FIELDS,
-            ...nonVisibleWritableAttributes,
-            CREATED_AT_ATTRIBUTE,
-            UPDATED_AT_ATTRIBUTE,
-            PUBLISHED_AT_ATTRIBUTE,
-            CREATED_BY_ATTRIBUTE,
-            UPDATED_BY_ATTRIBUTE
-        ]);
+        const nonVisibleWritableAttributes = _.intersection(writableAttributes, nonVisibleAttributes);
+        return [
+            ...new Set([
+                ...fields,
+                ...STATIC_FIELDS,
+                ...COMPONENT_FIELDS,
+                ...nonVisibleWritableAttributes,
+                CREATED_AT_ATTRIBUTE,
+                UPDATED_AT_ATTRIBUTE,
+                PUBLISHED_AT_ATTRIBUTE,
+                CREATED_BY_ATTRIBUTE,
+                UPDATED_BY_ATTRIBUTE
+            ])
+        ];
     };
     return {
         sanitizeOutput: wrapSanitize(createSanitizeOutput),