@strapi/admin 5.55.1 → 5.57.0

package/dist/server/server/src/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _ from 'lodash';\nimport { defaults } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit('user.create', { user: sanitizeUser(user) });\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({ populate: ['roles'] }, params));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","hashedPassword","updatedUser","update","resetPasswordByEmail","email","findOne","Error","passwordValidator","validate","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","firstname","lastname","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,kBAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,kBAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,gBAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,iBAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,CAACpB,IAAAA,GAAAA;AACvBQ,IAAAA,gBAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AACjE,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;IAE/Ce,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMU,mBAAmB,OACvBnB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACU,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAM9B,MAAAA,CAAOkB,EAAE,CACnCa,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAM7C;AAAiB,SAAA,CAAA,CAC/B8C,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAIvC,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMgD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAIhD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnB+B,QAAAA,EAAU,IAAA;YACVpC,KAAAA,EAAO;AAACyB,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEAnB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM0B,UAAAA,GAAa,OACjBD,EAAAA,EACAlC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMoC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACzC,UAAAA,CAAWH,KAAK,EAAGyB,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWiC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIpD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAII,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAM0C,iBAAiB,MAAMvC,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAMqC,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC9DnB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZrB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAUoC;AACZ,aAAA;YACA5B,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;QAC9DnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZrB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI6B,WAAAA,EAAa;AACfnD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAME,oBAAAA,GAAuB,OAAOC,KAAAA,EAAexC,QAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEqB,YAAAA;AAAM,SAAA;QAAGhC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIqD,KAAAA,CAAM,CAAC,0BAA0B,EAAEF,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAMG,yBAAAA,CAAkBC,QAAQ,CAAC5C,QAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAM;AACN,QAAA,MAAM,IAAItB,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMmD,UAAAA,CAAWxC,IAAAA,CAAKuC,EAAE,EAAE;AAAE5B,QAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAM+B,uBAAuB,OAAOc,MAAAA,GAAAA;IAClC,MAAMxD,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQI,MAAAA,CAAAA;IAC5B,IAAI,CAACxD,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM2B,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAe8B,UAAU,KAAK,CAAA,IAAKC,wBAAAA,CAAkB1D,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM2D,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMR,OAAAA,CAAQI,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,wBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMhE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe8C,QAAQ,CAAC;QACjE3C,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL4B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEgC,GAAAA,EAAK7E;AAAiB;AAChC;AACF;AACF,SAAA;QACA8E,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACPrC,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOgC,UAAAA,CAAWtB,EAAE,KAAKqB,WAAAA,CAAYrB,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOhC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;QAAErC,KAAAA,EAAOzB;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAM+D,uBAAuB,OAC3B7D,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAOqE,SAAAA;AACT,IAAA;IAEA,OAAO5E,kBAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAMsE,QAAAA,GAAW,OAAO,EACtB/D,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMiE,YAAAA,GAAe,MAAM1E,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACgE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAIlF,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,OAAOmB,iBAAW,MAAA,CAAA,CAAQgC,UAAU,CAAC+B,YAAAA,CAAahC,EAAE,EAAE;AACpD5B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3B6D,QAAAA,SAAAA,EAAWlE,SAASkE,SAAS;AAC7BC,QAAAA,QAAAA,EAAUnE,SAASmE,QAAQ;QAC3BlE,iBAAAA,EAAmB,IAAA;QACnB+B,QAAAA,EAAU;AACZ,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMc,OAAAA,GAAU,OAAOb,EAAAA,EAAapB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGpB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMuD,cAAAA,GAAiB,OAAOvB,KAAAA,EAAehC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CtB,KAAAA,EAAO;YAAEqB,KAAAA,EAAO;gBAAEwB,IAAAA,EAAMxB;AAAM;AAAE,SAAA;AAChChC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMyD,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM7D,KAAAA,GAAQnB,OACXiF,GAAG,CAAC,gBACJC,SAAS,CAAC,eAAeC,WAAAA,CAAS;QAAE7D,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,EAAG0D,MAAAA,CAAAA,CAAAA;AAE9D,IAAA,OAAOhF,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe4D,QAAQ,CAAC5D,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAMiE,aAAa,OAAO1C,EAAAA,GAAAA;;IAExB,MAAM2C,YAAAA,GAAiC,MAAMrF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAAC+D,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAahF,KAAK,CAACiF,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAErD,IAAI,KAAK7C,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAMyC,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAe8B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIpE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMgG,WAAAA,GAAc,MAAMxF,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNsE,MAAM,CAAC;QAAExD,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAeyF,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMzF,cAAAA,CAAe,OAAA,CAAA,CAAS0F,sBAAsB,CAACC,MAAAA,CAAOlD,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA1C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAasF,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMK,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMhE,cAAAA,GAAiB,MAAMnB,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;IAC3E,MAAMiD,sBAAAA,GAAyB,MAAM/F,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;QACxErC,KAAAA,EAAO;YACLS,EAAAA,EAAIoD,GAAAA;YACJzF,KAAAA,EAAO;AAAEqC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAe8B,UAAU,KAAKmC,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIvG,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMwG,eAAe,EAAE;IACvB,KAAK,MAAMtD,MAAMoD,GAAAA,CAAK;QACpB,MAAMN,WAAAA,GAAc,MAAMxF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesE,MAAM,CAAC;YAC9DxD,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZpB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAeyF,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMzF,cAAAA,CAAe,OAAA,CAAA,CAAS0F,sBAAsB,CAACC,MAAAA,CAAOlD,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAsD,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEAxF,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCwE,QAAAA,KAAAA,EAAOF,YAAAA,CAAa1F,GAAG,CAAC,CAACkF,cAAgBtF,YAAAA,CAAasF,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOnG,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;QAC1CrC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBACLqC,EAAAA,EAAI;oBAAE0D,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAM9B,KAAAA,GAAQ,OAAOrC,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOjC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;AAAErC,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMoE,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMlG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe8C,QAAQ,CAAC;QAC1DjC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBAAEqC,EAAAA,EAAI;oBAAE0D,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM5F,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC3CnB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAIvC,KAAKuC;AAAG,aAAA;YACrBrB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACiG,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAMnC,QAAQ,MAAM6B,qBAAAA,EAAAA;AAEpB,IAAA,IAAI7B,QAAQ,CAAA,EAAG;QACbtE,MAAAA,CAAO0G,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAErC,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAMsC,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMlG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe8C,QAAQ,CAAC;QAAEjC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAOkE,MAAM5F,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAK0G,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACbzF,IAAAA,MAAAA;AACAO,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACA+B,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACAvE,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAsB,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAS,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACA7B,IAAAA,KAAAA;AACA+B,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACApD,IAAAA,oBAAAA;AACAuD,IAAAA,iBAAAA;AACA9C,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.js","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _, { defaults } from 'lodash';\n\nimport { arrays, errors, emitAudit } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport {\n  AUDITED_EVENTS,\n  LEGACY_USER_EVENTS,\n  emitAdminUserCreated,\n  emitAdminUserDeleted,\n  emitAdminUserUpdateAudits,\n  toAdminUserEvent,\n  touchesTrackedFields,\n} from '../audit-logs/admin-users';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = async (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.CREATE, { user: sanitizeUser(user) });\n  await emitAdminUserCreated({ strapi }, user);\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  await emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  await emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // The audit log records what changed, so it needs the row before the write\n  const previous = touchesTrackedFields(attributes)\n    ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n    : null;\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  const registeredUser = await getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n\n  await emitAudit({ strapi }, AUDITED_EVENTS.INVITE_ACCEPT, toAdminUserEvent(registeredUser));\n\n  return registeredUser;\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({}, params, { populate: ['roles'] }));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n  await emitAdminUserDeleted({ strapi }, deletedUser);\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  for (const deletedUser of deletedUsers) {\n    await emitAdminUserDeleted({ strapi }, deletedUser);\n  }\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","LEGACY_USER_EVENTS","CREATE","emitAdminUserCreated","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","previous","touchesTrackedFields","findOne","hashedPassword","updatedUser","update","UPDATE","emitAdminUserUpdateAudits","updated","resetPasswordByEmail","email","Error","passwordValidator","validate","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","registeredUser","firstname","lastname","emitAudit","AUDITED_EVENTS","INVITE_ACCEPT","toAdminUserEvent","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;;;;;;;AA4BA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,kBAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,kBAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,gBAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,iBAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,OAAOpB,IAAAA,GAAAA;AAC7BQ,IAAAA,gBAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBC,MAAM,EAAE;AAAEzB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AAC3E,IAAA,MAAM0B,+BAAAA,CAAqB;AAAE7B,QAAAA;KAAO,EAAGG,IAAAA,CAAAA;AACzC,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;AAE/C,IAAA,MAAMe,eAAAA,CAAgBN,WAAAA,CAAAA;IAEtB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMa,mBAAmB,OACvBtB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACa,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAMjC,MAAAA,CAAOkB,EAAE,CACnCgB,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAMhD;AAAiB,SAAA,CAAA,CAC/BiD,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAI1C,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMmD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAInD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnBkC,QAAAA,EAAU,IAAA;YACVvC,KAAAA,EAAO;AAAC4B,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;AAEA,IAAA,MAAMtB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEtB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM6B,UAAAA,GAAa,OACjBD,EAAAA,EACArC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMuC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMtB,gBAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAAC5C,UAAAA,CAAWH,KAAK,EAAG4B,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1D,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWoC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM6D,QAAAA,GAAWC,+BAAAA,CAAqB9C,UAAAA,CAAAA,GAClC,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGvB,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAI1B,kBAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMgD,iBAAiB,MAAM7C,gBAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAM2C,WAAAA,GAAc,MAAMzD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuC,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZxB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAU0C;AACZ,aAAA;YACAlC,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgC,MAAM,EAAE;AAAExD,YAAAA,IAAAA,EAAMD,YAAAA,CAAauD,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMG,oCAAAA,CAA0B;AAAE5D,YAAAA;SAAO,EAAG;AAAEqD,YAAAA,QAAAA;YAAUQ,OAAAA,EAASJ,WAAAA;AAAajD,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOiD,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMzD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuC,MAAM,CAAC;QAC9DtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZxB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAImC,WAAAA,EAAa;AACfzD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgC,MAAM,EAAE;AAAExD,YAAAA,IAAAA,EAAMD,YAAAA,CAAauD,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMG,oCAAAA,CAA0B;AAAE5D,YAAAA;SAAO,EAAG;AAAEqD,YAAAA,QAAAA;YAAUQ,OAAAA,EAASJ,WAAAA;AAAajD,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOiD,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAMK,oBAAAA,GAAuB,OAAOC,KAAAA,EAAejD,QAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAE2B,YAAAA;AAAM,SAAA;QAAGzC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAI6D,KAAAA,CAAM,CAAC,0BAA0B,EAAED,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAME,yBAAAA,CAAkBC,QAAQ,CAACpD,QAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAM;AACN,QAAA,MAAM,IAAItB,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMsD,UAAAA,CAAW3C,IAAAA,CAAK0C,EAAE,EAAE;AAAE/B,QAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAMkC,uBAAuB,OAAOmB,MAAAA,GAAAA;IAClC,MAAMhE,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQY,MAAAA,CAAAA;IAC5B,IAAI,CAAChE,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM8B,cAAAA,GAAiB,MAAMtB,gBAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAemC,UAAU,KAAK,CAAA,IAAKC,wBAAAA,CAAkBlE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMmE,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMhB,OAAAA,CAAQY,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,wBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMxE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesD,QAAQ,CAAC;QACjEnD,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL+B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEqC,GAAAA,EAAKrF;AAAiB;AAChC;AACF;AACF,SAAA;QACAsF,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACP1C,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOqC,UAAAA,CAAW3B,EAAE,KAAK0B,WAAAA,CAAY1B,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOnC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;QAAE1C,KAAAA,EAAO5B;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAMuE,uBAAuB,OAC3BrE,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAE1B,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAO6E,SAAAA;AACT,IAAA;IAEA,OAAOpF,kBAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAM8E,QAAAA,GAAW,OAAO,EACtBvE,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMyE,YAAAA,GAAe,MAAMlF,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAE1B,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACwE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAI1F,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;IAEA,MAAM2F,cAAAA,GAAiB,MAAMxE,gBAAAA,CAAW,MAAA,CAAA,CAAQmC,UAAU,CAACoC,YAAAA,CAAarC,EAAE,EAAE;AAC1E/B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3BsE,QAAAA,SAAAA,EAAW3E,SAAS2E,SAAS;AAC7BC,QAAAA,QAAAA,EAAU5E,SAAS4E,QAAQ;QAC3B3E,iBAAAA,EAAmB,IAAA;QACnBkC,QAAAA,EAAU;AACZ,KAAA,CAAA;AAEA,IAAA,MAAM0C,eAAAA,CAAU;AAAEtF,QAAAA;KAAO,EAAGuF,yBAAAA,CAAeC,aAAa,EAAEC,2BAAAA,CAAiBN,cAAAA,CAAAA,CAAAA;IAE3E,OAAOA,cAAAA;AACT,CAAA;AAEA;;AAEC,IACD,MAAM5B,OAAAA,GAAU,OAAOV,EAAAA,EAAavB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGvB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMoE,cAAAA,GAAiB,OAAO3B,KAAAA,EAAezC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CnB,KAAAA,EAAO;YAAE2B,KAAAA,EAAO;gBAAE4B,IAAAA,EAAM5B;AAAM;AAAE,SAAA;AAChCzC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMsE,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM1E,KAAAA,GAAQnB,MAAAA,CACX8F,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAAC,aAAA,EAAeC,UAAAA,CAAS,EAAC,EAAGH,MAAAA,EAAQ;QAAEvE,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA,CAAA;AAEvE,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeyE,QAAQ,CAACzE,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAM8E,aAAa,OAAOpD,EAAAA,GAAAA;;IAExB,MAAMqD,YAAAA,GAAiC,MAAMlG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZvB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAAC4E,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAa7F,KAAK,CAAC8F,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAE/D,IAAI,KAAKhD,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAM4C,cAAAA,GAAiB,MAAMtB,gBAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAemC,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAI5E,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAM6G,WAAAA,GAAc,MAAMrG,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNmF,MAAM,CAAC;QAAElE,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGvB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAesG,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMtG,cAAAA,CAAe,OAAA,CAAA,CAASuG,sBAAsB,CAACC,MAAAA,CAAO5D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA7C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmB+E,MAAM,EAAE;AAAEvG,QAAAA,IAAAA,EAAMD,YAAAA,CAAamG,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,+BAAAA,CAAqB;AAAE3G,QAAAA;KAAO,EAAGqG,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMO,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAM5E,cAAAA,GAAiB,MAAMtB,gBAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;IAC3E,MAAM6D,sBAAAA,GAAyB,MAAM9G,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;QACxE1C,KAAAA,EAAO;YACLS,EAAAA,EAAIgE,GAAAA;YACJxG,KAAAA,EAAO;AAAEwC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAemC,UAAU,KAAK0C,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAItH,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMuH,eAAe,EAAE;IACvB,KAAK,MAAMlE,MAAMgE,GAAAA,CAAK;QACpB,MAAMR,WAAAA,GAAc,MAAMrG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemF,MAAM,CAAC;YAC9DlE,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZvB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAesG,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMtG,cAAAA,CAAe,OAAA,CAAA,CAASuG,sBAAsB,CAACC,MAAAA,CAAO5D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAkE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEArG,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmB+E,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAazG,GAAG,CAAC,CAAC+F,cAAgBnG,YAAAA,CAAamG,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,+BAAAA,CAAqB;AAAE3G,YAAAA;SAAO,EAAGqG,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOlH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;QAC1C1C,KAAAA,EAAO;YACL/B,KAAAA,EAAO;gBACLwC,EAAAA,EAAI;oBAAEsE,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMrC,KAAAA,GAAQ,OAAO1C,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOpC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;AAAE1C,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMgF,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMjH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesD,QAAQ,CAAC;QAC1DtC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL/B,KAAAA,EAAO;gBAAEwC,EAAAA,EAAI;oBAAEsE,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM3G,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuC,MAAM,CAAC;YAC3CtB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAI1C,KAAK0C;AAAG,aAAA;YACrBxB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACgH,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAM1C,QAAQ,MAAMoC,qBAAAA,EAAAA;AAEpB,IAAA,IAAIpC,QAAQ,CAAA,EAAG;QACb9E,MAAAA,CAAOyH,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAE5C,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAM6C,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMjH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesD,QAAQ,CAAC;QAAEtC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAO8E,MAAM3G,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAKyH,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACbxG,IAAAA,MAAAA;AACAU,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACAoC,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACA/E,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAmC,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAW,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACApC,IAAAA,KAAAA;AACAsC,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACA1D,IAAAA,oBAAAA;AACA6D,IAAAA,iBAAAA;AACArD,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/user.mjs

@@ -1,7 +1,7 @@
-import ___default from 'lodash';
-import { defaults } from 'lodash/fp';
-import { errors, arrays } from '@strapi/utils';
+import ___default, { defaults } from 'lodash';
+import { errors, emitAudit, arrays } from '@strapi/utils';
 import { hasSuperAdminRole, createUser } from '../domain/user.mjs';
+import { LEGACY_USER_EVENTS, emitAdminUserDeleted, AUDITED_EVENTS, toAdminUserEvent, touchesTrackedFields, emitAdminUserUpdateAudits, emitAdminUserCreated } from '../audit-logs/admin-users.mjs';
 import { password } from '../validation/common-validators.mjs';
 import { getService } from '../utils/index.mjs';
 import constants from './constants.mjs';
@@ -54,16 +54,19 @@ attributes)=>{
     });
     return createdUser;
 };
-const emitUserCreated = (user)=>{
+const emitUserCreated = async (user)=>{
     getService('metrics').sendDidInviteUser();
-    strapi.eventHub.emit('user.create', {
+    strapi.eventHub.emit(LEGACY_USER_EVENTS.CREATE, {
         user: sanitizeUser(user)
     });
+    await emitAdminUserCreated({
+        strapi
+    }, user);
 };
 const create = async (// isActive is added in the controller, it's not sent by the API.
 attributes)=>{
     const createdUser = await createUserInDatabase(attributes);
-    emitUserCreated(createdUser);
+    await emitUserCreated(createdUser);
     return createdUser;
 };
 const createFirstAdmin = async (attributes)=>{
@@ -91,7 +94,7 @@ const createFirstAdmin = async (attributes)=>{
             ]
         });
     });
-    emitUserCreated(createdUser);
+    await emitUserCreated(createdUser);
     return createdUser;
 };
 /**
@@ -115,6 +118,15 @@ const createFirstAdmin = async (attributes)=>{
             throw new ValidationError('You must have at least one user with super admin role.');
         }
     }
+    // The audit log records what changed, so it needs the row before the write
+    const previous = touchesTrackedFields(attributes) ? await strapi.db.query('admin::user').findOne({
+        where: {
+            id
+        },
+        populate: [
+            'roles'
+        ]
+    }) : null;
     // hash password if a new one is sent
     if (___default.has(attributes, 'password')) {
         const hashedPassword = await getService('auth').hashPassword(attributes.password);
@@ -130,9 +142,16 @@ const createFirstAdmin = async (attributes)=>{
                 'roles'
             ]
         });
-        strapi.eventHub.emit('user.update', {
+        strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, {
             user: sanitizeUser(updatedUser)
         });
+        await emitAdminUserUpdateAudits({
+            strapi
+        }, {
+            previous,
+            updated: updatedUser,
+            attributes
+        });
         return updatedUser;
     }
     const updatedUser = await strapi.db.query('admin::user').update({
@@ -145,9 +164,16 @@ const createFirstAdmin = async (attributes)=>{
         ]
     });
     if (updatedUser) {
-        strapi.eventHub.emit('user.update', {
+        strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, {
             user: sanitizeUser(updatedUser)
         });
+        await emitAdminUserUpdateAudits({
+            strapi
+        }, {
+            previous,
+            updated: updatedUser,
+            attributes
+        });
     }
     return updatedUser;
 };
@@ -252,13 +278,17 @@ const createFirstAdmin = async (attributes)=>{
     if (!matchingUser) {
         throw new ValidationError('Invalid registration info');
     }
-    return getService('user').updateById(matchingUser.id, {
+    const registeredUser = await getService('user').updateById(matchingUser.id, {
         password: userInfo.password,
         firstname: userInfo.firstname,
         lastname: userInfo.lastname,
         registrationToken: null,
         isActive: true
     });
+    await emitAudit({
+        strapi
+    }, AUDITED_EVENTS.INVITE_ACCEPT, toAdminUserEvent(registeredUser));
+    return registeredUser;
 };
 /**
  * Find one user
@@ -290,11 +320,11 @@ const createFirstAdmin = async (attributes)=>{
 /** Find many users (paginated)
  * @param params
  */ const findPage = async (params = {})=>{
-    const query = strapi.get('query-params').transform('admin::user', defaults({
+    const query = strapi.get('query-params').transform('admin::user', defaults({}, params, {
         populate: [
             'roles'
         ]
-    }, params));
+    }));
     return strapi.db.query('admin::user').findPage(query);
 };
 /** Delete a user
@@ -333,9 +363,12 @@ const createFirstAdmin = async (attributes)=>{
     if (sessionManager && sessionManager.hasOrigin('admin')) {
         await sessionManager('admin').invalidateRefreshToken(String(id));
     }
-    strapi.eventHub.emit('user.delete', {
+    strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {
         user: sanitizeUser(deletedUser)
     });
+    await emitAdminUserDeleted({
+        strapi
+    }, deletedUser);
     return deletedUser;
 };
 /** Delete a user
@@ -371,9 +404,14 @@ const createFirstAdmin = async (attributes)=>{
         }
         deletedUsers.push(deletedUser);
     }
-    strapi.eventHub.emit('user.delete', {
+    strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {
         users: deletedUsers.map((deletedUser)=>sanitizeUser(deletedUser))
     });
+    for (const deletedUser of deletedUsers){
+        await emitAdminUserDeleted({
+            strapi
+        }, deletedUser);
+    }
     return deletedUsers;
 };
 /** Count the users that don't have any associated roles

package/dist/server/server/src/services/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _ from 'lodash';\nimport { defaults } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit('user.create', { user: sanitizeUser(user) });\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({ populate: ['roles'] }, params));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","hashedPassword","updatedUser","update","resetPasswordByEmail","email","findOne","Error","passwordValidator","validate","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","firstname","lastname","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;AAmBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,MAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,UAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,UAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,UAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,UAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,CAACpB,IAAAA,GAAAA;AACvBQ,IAAAA,UAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AACjE,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;IAE/Ce,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMU,mBAAmB,OACvBnB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACU,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAM9B,MAAAA,CAAOkB,EAAE,CACnCa,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAM7C;AAAiB,SAAA,CAAA,CAC/B8C,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAIvC,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMgD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAIhD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnB+B,QAAAA,EAAU,IAAA;YACVpC,KAAAA,EAAO;AAACyB,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEAnB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM0B,UAAAA,GAAa,OACjBD,EAAAA,EACAlC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMoC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACzC,UAAAA,CAAWH,KAAK,EAAGyB,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWiC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIpD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAII,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAM0C,iBAAiB,MAAMvC,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAMqC,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC9DnB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZrB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAUoC;AACZ,aAAA;YACA5B,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;QAC9DnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZrB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI6B,WAAAA,EAAa;AACfnD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAME,oBAAAA,GAAuB,OAAOC,KAAAA,EAAexC,UAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEqB,YAAAA;AAAM,SAAA;QAAGhC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIqD,KAAAA,CAAM,CAAC,0BAA0B,EAAEF,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAMG,QAAAA,CAAkBC,QAAQ,CAAC5C,UAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAM;AACN,QAAA,MAAM,IAAItB,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMmD,UAAAA,CAAWxC,IAAAA,CAAKuC,EAAE,EAAE;AAAE5B,kBAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAM+B,uBAAuB,OAAOc,MAAAA,GAAAA;IAClC,MAAMxD,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQI,MAAAA,CAAAA;IAC5B,IAAI,CAACxD,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM2B,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAe8B,UAAU,KAAK,CAAA,IAAKC,iBAAAA,CAAkB1D,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM2D,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMR,OAAAA,CAAQI,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,iBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMhE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe8C,QAAQ,CAAC;QACjE3C,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL4B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEgC,GAAAA,EAAK7E;AAAiB;AAChC;AACF;AACF,SAAA;QACA8E,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACPrC,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOgC,UAAAA,CAAWtB,EAAE,KAAKqB,WAAAA,CAAYrB,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOhC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;QAAErC,KAAAA,EAAOzB;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAM+D,uBAAuB,OAC3B7D,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAOqE,SAAAA;AACT,IAAA;IAEA,OAAO5E,UAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAMsE,QAAAA,GAAW,OAAO,EACtB/D,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMiE,YAAAA,GAAe,MAAM1E,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACgE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAIlF,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,OAAOmB,WAAW,MAAA,CAAA,CAAQgC,UAAU,CAAC+B,YAAAA,CAAahC,EAAE,EAAE;AACpD5B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3B6D,QAAAA,SAAAA,EAAWlE,SAASkE,SAAS;AAC7BC,QAAAA,QAAAA,EAAUnE,SAASmE,QAAQ;QAC3BlE,iBAAAA,EAAmB,IAAA;QACnB+B,QAAAA,EAAU;AACZ,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMc,OAAAA,GAAU,OAAOb,EAAAA,EAAapB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGpB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMuD,cAAAA,GAAiB,OAAOvB,KAAAA,EAAehC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CtB,KAAAA,EAAO;YAAEqB,KAAAA,EAAO;gBAAEwB,IAAAA,EAAMxB;AAAM;AAAE,SAAA;AAChChC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMyD,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM7D,KAAAA,GAAQnB,OACXiF,GAAG,CAAC,gBACJC,SAAS,CAAC,eAAeC,QAAAA,CAAS;QAAE7D,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,EAAG0D,MAAAA,CAAAA,CAAAA;AAE9D,IAAA,OAAOhF,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe4D,QAAQ,CAAC5D,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAMiE,aAAa,OAAO1C,EAAAA,GAAAA;;IAExB,MAAM2C,YAAAA,GAAiC,MAAMrF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAAC+D,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAahF,KAAK,CAACiF,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAErD,IAAI,KAAK7C,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAMyC,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAe8B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIpE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMgG,WAAAA,GAAc,MAAMxF,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNsE,MAAM,CAAC;QAAExD,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAeyF,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMzF,cAAAA,CAAe,OAAA,CAAA,CAAS0F,sBAAsB,CAACC,MAAAA,CAAOlD,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA1C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAasF,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMK,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMhE,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;IAC3E,MAAMiD,sBAAAA,GAAyB,MAAM/F,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;QACxErC,KAAAA,EAAO;YACLS,EAAAA,EAAIoD,GAAAA;YACJzF,KAAAA,EAAO;AAAEqC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAe8B,UAAU,KAAKmC,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIvG,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMwG,eAAe,EAAE;IACvB,KAAK,MAAMtD,MAAMoD,GAAAA,CAAK;QACpB,MAAMN,WAAAA,GAAc,MAAMxF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesE,MAAM,CAAC;YAC9DxD,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZpB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAeyF,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMzF,cAAAA,CAAe,OAAA,CAAA,CAAS0F,sBAAsB,CAACC,MAAAA,CAAOlD,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAsD,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEAxF,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCwE,QAAAA,KAAAA,EAAOF,YAAAA,CAAa1F,GAAG,CAAC,CAACkF,cAAgBtF,YAAAA,CAAasF,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOnG,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;QAC1CrC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBACLqC,EAAAA,EAAI;oBAAE0D,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAM9B,KAAAA,GAAQ,OAAOrC,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOjC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemD,KAAK,CAAC;AAAErC,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMoE,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMlG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe8C,QAAQ,CAAC;QAC1DjC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBAAEqC,EAAAA,EAAI;oBAAE0D,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM5F,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC3CnB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAIvC,KAAKuC;AAAG,aAAA;YACrBrB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACiG,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAMnC,QAAQ,MAAM6B,qBAAAA,EAAAA;AAEpB,IAAA,IAAI7B,QAAQ,CAAA,EAAG;QACbtE,MAAAA,CAAO0G,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAErC,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAMsC,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMlG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe8C,QAAQ,CAAC;QAAEjC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAOkE,MAAM5F,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAK0G,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACbzF,IAAAA,MAAAA;AACAO,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACA+B,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACAvE,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAsB,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAS,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACA7B,IAAAA,KAAAA;AACA+B,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACApD,IAAAA,oBAAAA;AACAuD,IAAAA,iBAAAA;AACA9C,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.mjs","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _, { defaults } from 'lodash';\n\nimport { arrays, errors, emitAudit } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport {\n  AUDITED_EVENTS,\n  LEGACY_USER_EVENTS,\n  emitAdminUserCreated,\n  emitAdminUserDeleted,\n  emitAdminUserUpdateAudits,\n  toAdminUserEvent,\n  touchesTrackedFields,\n} from '../audit-logs/admin-users';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = async (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.CREATE, { user: sanitizeUser(user) });\n  await emitAdminUserCreated({ strapi }, user);\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  await emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  await emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // The audit log records what changed, so it needs the row before the write\n  const previous = touchesTrackedFields(attributes)\n    ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n    : null;\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n    await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  const registeredUser = await getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n\n  await emitAudit({ strapi }, AUDITED_EVENTS.INVITE_ACCEPT, toAdminUserEvent(registeredUser));\n\n  return registeredUser;\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({}, params, { populate: ['roles'] }));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n  await emitAdminUserDeleted({ strapi }, deletedUser);\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  for (const deletedUser of deletedUsers) {\n    await emitAdminUserDeleted({ strapi }, deletedUser);\n  }\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","LEGACY_USER_EVENTS","CREATE","emitAdminUserCreated","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","previous","touchesTrackedFields","findOne","hashedPassword","updatedUser","update","UPDATE","emitAdminUserUpdateAudits","updated","resetPasswordByEmail","email","Error","passwordValidator","validate","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","registeredUser","firstname","lastname","emitAudit","AUDITED_EVENTS","INVITE_ACCEPT","toAdminUserEvent","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;AA4BA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,MAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,UAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,UAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,UAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,UAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,OAAOpB,IAAAA,GAAAA;AAC7BQ,IAAAA,UAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBC,MAAM,EAAE;AAAEzB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AAC3E,IAAA,MAAM0B,oBAAAA,CAAqB;AAAE7B,QAAAA;KAAO,EAAGG,IAAAA,CAAAA;AACzC,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;AAE/C,IAAA,MAAMe,eAAAA,CAAgBN,WAAAA,CAAAA;IAEtB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMa,mBAAmB,OACvBtB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACa,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAMjC,MAAAA,CAAOkB,EAAE,CACnCgB,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAMhD;AAAiB,SAAA,CAAA,CAC/BiD,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAI1C,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMmD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAInD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnBkC,QAAAA,EAAU,IAAA;YACVvC,KAAAA,EAAO;AAAC4B,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;AAEA,IAAA,MAAMtB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEtB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM6B,UAAAA,GAAa,OACjBD,EAAAA,EACArC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMuC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMtB,UAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAAC5C,UAAAA,CAAWH,KAAK,EAAG4B,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1D,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWoC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM6D,QAAAA,GAAWC,oBAAAA,CAAqB9C,UAAAA,CAAAA,GAClC,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGvB,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAI1B,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMgD,iBAAiB,MAAM7C,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAM2C,WAAAA,GAAc,MAAMzD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuC,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZxB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAU0C;AACZ,aAAA;YACAlC,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgC,MAAM,EAAE;AAAExD,YAAAA,IAAAA,EAAMD,YAAAA,CAAauD,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMG,yBAAAA,CAA0B;AAAE5D,YAAAA;SAAO,EAAG;AAAEqD,YAAAA,QAAAA;YAAUQ,OAAAA,EAASJ,WAAAA;AAAajD,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOiD,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMzD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuC,MAAM,CAAC;QAC9DtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZxB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAImC,WAAAA,EAAa;AACfzD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgC,MAAM,EAAE;AAAExD,YAAAA,IAAAA,EAAMD,YAAAA,CAAauD,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMG,yBAAAA,CAA0B;AAAE5D,YAAAA;SAAO,EAAG;AAAEqD,YAAAA,QAAAA;YAAUQ,OAAAA,EAASJ,WAAAA;AAAajD,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOiD,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAMK,oBAAAA,GAAuB,OAAOC,KAAAA,EAAejD,UAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAE2B,YAAAA;AAAM,SAAA;QAAGzC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAI6D,KAAAA,CAAM,CAAC,0BAA0B,EAAED,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAME,QAAAA,CAAkBC,QAAQ,CAACpD,UAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAM;AACN,QAAA,MAAM,IAAItB,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMsD,UAAAA,CAAW3C,IAAAA,CAAK0C,EAAE,EAAE;AAAE/B,kBAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAMkC,uBAAuB,OAAOmB,MAAAA,GAAAA;IAClC,MAAMhE,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQY,MAAAA,CAAAA;IAC5B,IAAI,CAAChE,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM8B,cAAAA,GAAiB,MAAMtB,UAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAemC,UAAU,KAAK,CAAA,IAAKC,iBAAAA,CAAkBlE,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMmE,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMhB,OAAAA,CAAQY,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,iBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMxE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesD,QAAQ,CAAC;QACjEnD,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL+B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEqC,GAAAA,EAAKrF;AAAiB;AAChC;AACF;AACF,SAAA;QACAsF,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACP1C,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOqC,UAAAA,CAAW3B,EAAE,KAAK0B,WAAAA,CAAY1B,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOnC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;QAAE1C,KAAAA,EAAO5B;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAMuE,uBAAuB,OAC3BrE,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAE1B,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAO6E,SAAAA;AACT,IAAA;IAEA,OAAOpF,UAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAM8E,QAAAA,GAAW,OAAO,EACtBvE,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMyE,YAAAA,GAAe,MAAMlF,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAE1B,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACwE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAI1F,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;IAEA,MAAM2F,cAAAA,GAAiB,MAAMxE,UAAAA,CAAW,MAAA,CAAA,CAAQmC,UAAU,CAACoC,YAAAA,CAAarC,EAAE,EAAE;AAC1E/B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3BsE,QAAAA,SAAAA,EAAW3E,SAAS2E,SAAS;AAC7BC,QAAAA,QAAAA,EAAU5E,SAAS4E,QAAQ;QAC3B3E,iBAAAA,EAAmB,IAAA;QACnBkC,QAAAA,EAAU;AACZ,KAAA,CAAA;AAEA,IAAA,MAAM0C,SAAAA,CAAU;AAAEtF,QAAAA;KAAO,EAAGuF,cAAAA,CAAeC,aAAa,EAAEC,gBAAAA,CAAiBN,cAAAA,CAAAA,CAAAA;IAE3E,OAAOA,cAAAA;AACT,CAAA;AAEA;;AAEC,IACD,MAAM5B,OAAAA,GAAU,OAAOV,EAAAA,EAAavB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGvB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMoE,cAAAA,GAAiB,OAAO3B,KAAAA,EAAezC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CnB,KAAAA,EAAO;YAAE2B,KAAAA,EAAO;gBAAE4B,IAAAA,EAAM5B;AAAM;AAAE,SAAA;AAChCzC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMsE,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM1E,KAAAA,GAAQnB,MAAAA,CACX8F,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAAC,aAAA,EAAeC,QAAAA,CAAS,EAAC,EAAGH,MAAAA,EAAQ;QAAEvE,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA,CAAA;AAEvE,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeyE,QAAQ,CAACzE,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAM8E,aAAa,OAAOpD,EAAAA,GAAAA;;IAExB,MAAMqD,YAAAA,GAAiC,MAAMlG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZvB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAAC4E,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAa7F,KAAK,CAAC8F,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAE/D,IAAI,KAAKhD,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAM4C,cAAAA,GAAiB,MAAMtB,UAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAemC,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAI5E,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAM6G,WAAAA,GAAc,MAAMrG,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNmF,MAAM,CAAC;QAAElE,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGvB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAesG,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMtG,cAAAA,CAAe,OAAA,CAAA,CAASuG,sBAAsB,CAACC,MAAAA,CAAO5D,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA7C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmB+E,MAAM,EAAE;AAAEvG,QAAAA,IAAAA,EAAMD,YAAAA,CAAamG,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,oBAAAA,CAAqB;AAAE3G,QAAAA;KAAO,EAAGqG,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMO,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAM5E,cAAAA,GAAiB,MAAMtB,UAAAA,CAAW,MAAA,CAAA,CAAQsC,2BAA2B,EAAA;IAC3E,MAAM6D,sBAAAA,GAAyB,MAAM9G,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;QACxE1C,KAAAA,EAAO;YACLS,EAAAA,EAAIgE,GAAAA;YACJxG,KAAAA,EAAO;AAAEwC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAemC,UAAU,KAAK0C,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAItH,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMuH,eAAe,EAAE;IACvB,KAAK,MAAMlE,MAAMgE,GAAAA,CAAK;QACpB,MAAMR,WAAAA,GAAc,MAAMrG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAemF,MAAM,CAAC;YAC9DlE,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZvB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAesG,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMtG,cAAAA,CAAe,OAAA,CAAA,CAASuG,sBAAsB,CAACC,MAAAA,CAAO5D,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAkE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEArG,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmB+E,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAazG,GAAG,CAAC,CAAC+F,cAAgBnG,YAAAA,CAAamG,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,oBAAAA,CAAqB;AAAE3G,YAAAA;SAAO,EAAGqG,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOlH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;QAC1C1C,KAAAA,EAAO;YACL/B,KAAAA,EAAO;gBACLwC,EAAAA,EAAI;oBAAEsE,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMrC,KAAAA,GAAQ,OAAO1C,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOpC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe2D,KAAK,CAAC;AAAE1C,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMgF,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMjH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesD,QAAQ,CAAC;QAC1DtC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL/B,KAAAA,EAAO;gBAAEwC,EAAAA,EAAI;oBAAEsE,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM3G,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuC,MAAM,CAAC;YAC3CtB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAI1C,KAAK0C;AAAG,aAAA;YACrBxB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACgH,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAM1C,QAAQ,MAAMoC,qBAAAA,EAAAA;AAEpB,IAAA,IAAIpC,QAAQ,CAAA,EAAG;QACb9E,MAAAA,CAAOyH,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAE5C,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAM6C,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMjH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAesD,QAAQ,CAAC;QAAEtC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAO8E,MAAM3G,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAKyH,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACbxG,IAAAA,MAAAA;AACAU,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACAoC,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACA/E,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAmC,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAW,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACApC,IAAAA,KAAAA;AACAsC,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACA1D,IAAAA,oBAAAA;AACA6D,IAAAA,iBAAAA;AACArD,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/strategies/api-token-utils.js

@@ -1,6 +1,5 @@
 'use strict';
 
-var fp = require('lodash/fp');
 var dateFns = require('date-fns');
 var utils = require('@strapi/utils');
 
@@ -16,7 +15,7 @@ const extractToken = (ctx)=>{
     return null;
 };
 const checkExpiry = (apiToken)=>{
-    if (!fp.isNil(apiToken.expiresAt)) {
+    if (apiToken.expiresAt != null) {
         const expirationDate = new Date(apiToken.expiresAt);
         if (expirationDate < new Date()) {
             return new UnauthorizedError('Token expired');
@@ -26,7 +25,7 @@ const checkExpiry = (apiToken)=>{
 };
 const updateLastUsedAt = async (apiToken)=>{
     const currentDate = new Date();
-    if (!fp.isNil(apiToken.lastUsedAt)) {
+    if (apiToken.lastUsedAt != null) {
         const hoursSinceLastUsed = dateFns.differenceInHours(currentDate, dateFns.parseISO(apiToken.lastUsedAt));
         if (hoursSinceLastUsed >= 1) {
             await strapi.db.query('admin::api-token').update({

package/dist/server/server/src/strategies/api-token-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-utils.js","sources":["../../../../../server/src/strategies/api-token-utils.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\n\nconst { UnauthorizedError } = errors;\n\nexport const extractToken = (ctx: Context): string | null => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\nexport const checkExpiry = (apiToken: {\n  expiresAt?: string | number | null;\n}): InstanceType<typeof UnauthorizedError> | null => {\n  if (!isNil(apiToken.expiresAt)) {\n    const expirationDate = new Date(apiToken.expiresAt);\n    if (expirationDate < new Date()) {\n      return new UnauthorizedError('Token expired');\n    }\n  }\n\n  return null;\n};\n\nexport const updateLastUsedAt = async (apiToken: {\n  id: number | string;\n  lastUsedAt?: string | null;\n}): Promise<void> => {\n  const currentDate = new Date();\n\n  if (!isNil(apiToken.lastUsedAt)) {\n    const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));\n    if (hoursSinceLastUsed >= 1) {\n      await strapi.db.query('admin::api-token').update({\n        where: { id: apiToken.id },\n        data: { lastUsedAt: currentDate },\n      });\n    }\n  } else {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: apiToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n};\n"],"names":["UnauthorizedError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","checkExpiry","apiToken","isNil","expiresAt","expirationDate","Date","updateLastUsedAt","currentDate","lastUsedAt","hoursSinceLastUsed","differenceInHours","parseISO","strapi","db","query","update","where","id","data"],"mappings":";;;;;;AAKA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,YAAAA;AAEvB,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AAC3B,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMI,cAAc,CAACC,QAAAA,GAAAA;AAG1B,IAAA,IAAI,CAACC,QAAAA,CAAMD,QAAAA,CAASE,SAAS,CAAA,EAAG;AAC9B,QAAA,MAAMC,cAAAA,GAAiB,IAAIC,IAAAA,CAAKJ,QAAAA,CAASE,SAAS,CAAA;QAClD,IAAIC,cAAAA,GAAiB,IAAIC,IAAAA,EAAAA,EAAQ;AAC/B,YAAA,OAAO,IAAIhB,iBAAAA,CAAkB,eAAA,CAAA;AAC/B,QAAA;AACF,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMiB,mBAAmB,OAAOL,QAAAA,GAAAA;AAIrC,IAAA,MAAMM,cAAc,IAAIF,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACH,QAAAA,CAAMD,QAAAA,CAASO,UAAU,CAAA,EAAG;AAC/B,QAAA,MAAMC,kBAAAA,GAAqBC,yBAAAA,CAAkBH,WAAAA,EAAaI,gBAAAA,CAASV,SAASO,UAAU,CAAA,CAAA;AACtF,QAAA,IAAIC,sBAAsB,CAAA,EAAG;AAC3B,YAAA,MAAMG,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;gBAC/CC,KAAAA,EAAO;AAAEC,oBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,iBAAA;gBACzBC,IAAAA,EAAM;oBAAEV,UAAAA,EAAYD;AAAY;AAClC,aAAA,CAAA;AACF,QAAA;IACF,CAAA,MAAO;AACL,QAAA,MAAMK,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,aAAA;YACzBC,IAAAA,EAAM;gBAAEV,UAAAA,EAAYD;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;AACF;;;;;;"}
+{"version":3,"file":"api-token-utils.js","sources":["../../../../../server/src/strategies/api-token-utils.ts"],"sourcesContent":["import type { Context } from 'koa';\n\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\n\nconst { UnauthorizedError } = errors;\n\nexport const extractToken = (ctx: Context): string | null => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\nexport const checkExpiry = (apiToken: {\n  expiresAt?: string | number | null;\n}): InstanceType<typeof UnauthorizedError> | null => {\n  if (apiToken.expiresAt != null) {\n    const expirationDate = new Date(apiToken.expiresAt);\n    if (expirationDate < new Date()) {\n      return new UnauthorizedError('Token expired');\n    }\n  }\n\n  return null;\n};\n\nexport const updateLastUsedAt = async (apiToken: {\n  id: number | string;\n  lastUsedAt?: string | null;\n}): Promise<void> => {\n  const currentDate = new Date();\n\n  if (apiToken.lastUsedAt != null) {\n    const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));\n    if (hoursSinceLastUsed >= 1) {\n      await strapi.db.query('admin::api-token').update({\n        where: { id: apiToken.id },\n        data: { lastUsedAt: currentDate },\n      });\n    }\n  } else {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: apiToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n};\n"],"names":["UnauthorizedError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","checkExpiry","apiToken","expiresAt","expirationDate","Date","updateLastUsedAt","currentDate","lastUsedAt","hoursSinceLastUsed","differenceInHours","parseISO","strapi","db","query","update","where","id","data"],"mappings":";;;;;AAKA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,YAAAA;AAEvB,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AAC3B,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMI,cAAc,CAACC,QAAAA,GAAAA;IAG1B,IAAIA,QAAAA,CAASC,SAAS,IAAI,IAAA,EAAM;AAC9B,QAAA,MAAMC,cAAAA,GAAiB,IAAIC,IAAAA,CAAKH,QAAAA,CAASC,SAAS,CAAA;QAClD,IAAIC,cAAAA,GAAiB,IAAIC,IAAAA,EAAAA,EAAQ;AAC/B,YAAA,OAAO,IAAIf,iBAAAA,CAAkB,eAAA,CAAA;AAC/B,QAAA;AACF,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMgB,mBAAmB,OAAOJ,QAAAA,GAAAA;AAIrC,IAAA,MAAMK,cAAc,IAAIF,IAAAA,EAAAA;IAExB,IAAIH,QAAAA,CAASM,UAAU,IAAI,IAAA,EAAM;AAC/B,QAAA,MAAMC,kBAAAA,GAAqBC,yBAAAA,CAAkBH,WAAAA,EAAaI,gBAAAA,CAAST,SAASM,UAAU,CAAA,CAAA;AACtF,QAAA,IAAIC,sBAAsB,CAAA,EAAG;AAC3B,YAAA,MAAMG,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;gBAC/CC,KAAAA,EAAO;AAAEC,oBAAAA,EAAAA,EAAIf,SAASe;AAAG,iBAAA;gBACzBC,IAAAA,EAAM;oBAAEV,UAAAA,EAAYD;AAAY;AAClC,aAAA,CAAA;AACF,QAAA;IACF,CAAA,MAAO;AACL,QAAA,MAAMK,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIf,SAASe;AAAG,aAAA;YACzBC,IAAAA,EAAM;gBAAEV,UAAAA,EAAYD;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;AACF;;;;;;"}

package/dist/server/server/src/strategies/api-token-utils.mjs

@@ -1,4 +1,3 @@
-import { isNil } from 'lodash/fp';
 import { differenceInHours, parseISO } from 'date-fns';
 import { errors } from '@strapi/utils';
 
@@ -14,7 +13,7 @@ const extractToken = (ctx)=>{
     return null;
 };
 const checkExpiry = (apiToken)=>{
-    if (!isNil(apiToken.expiresAt)) {
+    if (apiToken.expiresAt != null) {
         const expirationDate = new Date(apiToken.expiresAt);
         if (expirationDate < new Date()) {
             return new UnauthorizedError('Token expired');
@@ -24,7 +23,7 @@ const checkExpiry = (apiToken)=>{
 };
 const updateLastUsedAt = async (apiToken)=>{
     const currentDate = new Date();
-    if (!isNil(apiToken.lastUsedAt)) {
+    if (apiToken.lastUsedAt != null) {
         const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));
         if (hoursSinceLastUsed >= 1) {
             await strapi.db.query('admin::api-token').update({

package/dist/server/server/src/strategies/api-token-utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-utils.mjs","sources":["../../../../../server/src/strategies/api-token-utils.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { isNil } from 'lodash/fp';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\n\nconst { UnauthorizedError } = errors;\n\nexport const extractToken = (ctx: Context): string | null => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\nexport const checkExpiry = (apiToken: {\n  expiresAt?: string | number | null;\n}): InstanceType<typeof UnauthorizedError> | null => {\n  if (!isNil(apiToken.expiresAt)) {\n    const expirationDate = new Date(apiToken.expiresAt);\n    if (expirationDate < new Date()) {\n      return new UnauthorizedError('Token expired');\n    }\n  }\n\n  return null;\n};\n\nexport const updateLastUsedAt = async (apiToken: {\n  id: number | string;\n  lastUsedAt?: string | null;\n}): Promise<void> => {\n  const currentDate = new Date();\n\n  if (!isNil(apiToken.lastUsedAt)) {\n    const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));\n    if (hoursSinceLastUsed >= 1) {\n      await strapi.db.query('admin::api-token').update({\n        where: { id: apiToken.id },\n        data: { lastUsedAt: currentDate },\n      });\n    }\n  } else {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: apiToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n};\n"],"names":["UnauthorizedError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","checkExpiry","apiToken","isNil","expiresAt","expirationDate","Date","updateLastUsedAt","currentDate","lastUsedAt","hoursSinceLastUsed","differenceInHours","parseISO","strapi","db","query","update","where","id","data"],"mappings":";;;;AAKA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,MAAAA;AAEvB,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AAC3B,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMI,cAAc,CAACC,QAAAA,GAAAA;AAG1B,IAAA,IAAI,CAACC,KAAAA,CAAMD,QAAAA,CAASE,SAAS,CAAA,EAAG;AAC9B,QAAA,MAAMC,cAAAA,GAAiB,IAAIC,IAAAA,CAAKJ,QAAAA,CAASE,SAAS,CAAA;QAClD,IAAIC,cAAAA,GAAiB,IAAIC,IAAAA,EAAAA,EAAQ;AAC/B,YAAA,OAAO,IAAIhB,iBAAAA,CAAkB,eAAA,CAAA;AAC/B,QAAA;AACF,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMiB,mBAAmB,OAAOL,QAAAA,GAAAA;AAIrC,IAAA,MAAMM,cAAc,IAAIF,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACH,KAAAA,CAAMD,QAAAA,CAASO,UAAU,CAAA,EAAG;AAC/B,QAAA,MAAMC,kBAAAA,GAAqBC,iBAAAA,CAAkBH,WAAAA,EAAaI,QAAAA,CAASV,SAASO,UAAU,CAAA,CAAA;AACtF,QAAA,IAAIC,sBAAsB,CAAA,EAAG;AAC3B,YAAA,MAAMG,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;gBAC/CC,KAAAA,EAAO;AAAEC,oBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,iBAAA;gBACzBC,IAAAA,EAAM;oBAAEV,UAAAA,EAAYD;AAAY;AAClC,aAAA,CAAA;AACF,QAAA;IACF,CAAA,MAAO;AACL,QAAA,MAAMK,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIhB,SAASgB;AAAG,aAAA;YACzBC,IAAAA,EAAM;gBAAEV,UAAAA,EAAYD;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;AACF;;;;"}
+{"version":3,"file":"api-token-utils.mjs","sources":["../../../../../server/src/strategies/api-token-utils.ts"],"sourcesContent":["import type { Context } from 'koa';\n\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\n\nconst { UnauthorizedError } = errors;\n\nexport const extractToken = (ctx: Context): string | null => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\nexport const checkExpiry = (apiToken: {\n  expiresAt?: string | number | null;\n}): InstanceType<typeof UnauthorizedError> | null => {\n  if (apiToken.expiresAt != null) {\n    const expirationDate = new Date(apiToken.expiresAt);\n    if (expirationDate < new Date()) {\n      return new UnauthorizedError('Token expired');\n    }\n  }\n\n  return null;\n};\n\nexport const updateLastUsedAt = async (apiToken: {\n  id: number | string;\n  lastUsedAt?: string | null;\n}): Promise<void> => {\n  const currentDate = new Date();\n\n  if (apiToken.lastUsedAt != null) {\n    const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));\n    if (hoursSinceLastUsed >= 1) {\n      await strapi.db.query('admin::api-token').update({\n        where: { id: apiToken.id },\n        data: { lastUsedAt: currentDate },\n      });\n    }\n  } else {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: apiToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n};\n"],"names":["UnauthorizedError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","checkExpiry","apiToken","expiresAt","expirationDate","Date","updateLastUsedAt","currentDate","lastUsedAt","hoursSinceLastUsed","differenceInHours","parseISO","strapi","db","query","update","where","id","data"],"mappings":";;;AAKA,MAAM,EAAEA,iBAAiB,EAAE,GAAGC,MAAAA;AAEvB,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AAC3B,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMI,cAAc,CAACC,QAAAA,GAAAA;IAG1B,IAAIA,QAAAA,CAASC,SAAS,IAAI,IAAA,EAAM;AAC9B,QAAA,MAAMC,cAAAA,GAAiB,IAAIC,IAAAA,CAAKH,QAAAA,CAASC,SAAS,CAAA;QAClD,IAAIC,cAAAA,GAAiB,IAAIC,IAAAA,EAAAA,EAAQ;AAC/B,YAAA,OAAO,IAAIf,iBAAAA,CAAkB,eAAA,CAAA;AAC/B,QAAA;AACF,IAAA;IAEA,OAAO,IAAA;AACT;AAEO,MAAMgB,mBAAmB,OAAOJ,QAAAA,GAAAA;AAIrC,IAAA,MAAMK,cAAc,IAAIF,IAAAA,EAAAA;IAExB,IAAIH,QAAAA,CAASM,UAAU,IAAI,IAAA,EAAM;AAC/B,QAAA,MAAMC,kBAAAA,GAAqBC,iBAAAA,CAAkBH,WAAAA,EAAaI,QAAAA,CAAST,SAASM,UAAU,CAAA,CAAA;AACtF,QAAA,IAAIC,sBAAsB,CAAA,EAAG;AAC3B,YAAA,MAAMG,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;gBAC/CC,KAAAA,EAAO;AAAEC,oBAAAA,EAAAA,EAAIf,SAASe;AAAG,iBAAA;gBACzBC,IAAAA,EAAM;oBAAEV,UAAAA,EAAYD;AAAY;AAClC,aAAA,CAAA;AACF,QAAA;IACF,CAAA,MAAO;AACL,QAAA,MAAMK,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIf,SAASe;AAAG,aAAA;YACzBC,IAAAA,EAAM;gBAAEV,UAAAA,EAAYD;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;AACF;;;;"}

package/dist/server/server/src/strategies/content-api-token.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var utils = require('@strapi/utils');
 var constants = require('../services/constants.js');
 var index = require('../utils/index.js');
@@ -76,7 +76,7 @@ const isReadScope = (scope)=>scope.endsWith('find') || scope.endsWith('findOne')
     }
     // Read only
     if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {
-        const scopes = fp.castArray(config.scope);
+        const scopes = _.castArray(config.scope);
         if (config.scope && scopes.every(isReadScope)) {
             return;
         }
@@ -84,7 +84,7 @@ const isReadScope = (scope)=>scope.endsWith('find') || scope.endsWith('findOne')
         if (ability === null || ability === undefined) {
             throw new ForbiddenError();
         }
-        const scopes = fp.castArray(config.scope);
+        const scopes = _.castArray(config.scope);
         const isAllowed = scopes.every((scope)=>ability.can(scope));
         if (isAllowed === true) {
             return;

package/dist/server/server/src/strategies/content-api-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-api-token.js","sources":["../../../../../server/src/strategies/content-api-token.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { castArray } from 'lodash/fp';\nimport { errors } from '@strapi/utils';\nimport constants from '../services/constants';\nimport { getService } from '../utils';\nimport { extractToken, checkExpiry, updateLastUsedAt } from './api-token-utils';\nimport '@strapi/types';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst isReadScope = (scope: string) => scope.endsWith('find') || scope.endsWith('findOne');\n\n/**\n * Authenticate a content-api token. Rejects tokens with kind !== 'content-api'.\n */\nexport const authenticate = async (ctx: Context) => {\n  const apiTokenService = getService('api-token-content-api');\n  const token = extractToken(ctx);\n\n  if (token === null) {\n    return { authenticated: false };\n  }\n\n  const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));\n\n  if (apiToken === null || apiToken === undefined) {\n    return { authenticated: false };\n  }\n\n  // Defensive kind check — only handle content-api tokens.\n  // null kind is allowed: tokens created before the kind field was introduced are implicitly content-api.\n  if (apiToken.kind !== 'content-api' && apiToken.kind !== null) {\n    return { authenticated: false };\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    return { authenticated: false, error: expiryError };\n  }\n\n  await updateLastUsedAt(apiToken);\n\n  if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(\n      apiToken.permissions.map((action: string) => ({ action }))\n    );\n\n    return { authenticated: true, ability, credentials: apiToken };\n  }\n\n  return { authenticated: true, credentials: apiToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope.\n *\n * @type {import('.').VerifyFunction}\n */\nexport const verify = (auth: any, config: any) => {\n  const { credentials: apiToken, ability } = auth;\n\n  if (apiToken === null || apiToken === undefined) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    throw expiryError;\n  }\n\n  // Full access\n  if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {\n    return;\n  }\n\n  // Read only\n  if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {\n    const scopes = castArray(config.scope);\n\n    if (config.scope && scopes.every(isReadScope)) {\n      return;\n    }\n  }\n\n  // Custom\n  else if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    if (ability === null || ability === undefined) {\n      throw new ForbiddenError();\n    }\n\n    const scopes = castArray(config.scope);\n    const isAllowed = scopes.every((scope: string) => ability.can(scope));\n\n    if (isAllowed === true) {\n      return;\n    }\n  }\n\n  throw new ForbiddenError();\n};\n\nexport default {\n  name: 'content-api-token',\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","isReadScope","scope","endsWith","authenticate","ctx","apiTokenService","getService","token","extractToken","authenticated","apiToken","getByAccessKey","hash","undefined","kind","expiryError","checkExpiry","error","updateLastUsedAt","type","constants","API_TOKEN_TYPE","CUSTOM","ability","strapi","contentAPI","permissions","engine","generateAbility","map","action","credentials","verify","auth","config","FULL_ACCESS","READ_ONLY","scopes","castArray","every","isAllowed","can","name"],"mappings":";;;;;;;;;;;AAQA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,YAAAA;AAE9C,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GAAkBA,KAAAA,CAAMC,QAAQ,CAAC,MAAA,CAAA,IAAWD,KAAAA,CAAMC,QAAQ,CAAC,SAAA,CAAA;AAEhF;;IAGO,MAAMC,YAAAA,GAAe,OAAOC,GAAAA,GAAAA;AACjC,IAAA,MAAMC,kBAAkBC,gBAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMC,QAAQC,0BAAAA,CAAaJ,GAAAA,CAAAA;AAE3B,IAAA,IAAIG,UAAU,IAAA,EAAM;QAClB,OAAO;YAAEE,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,WAAW,MAAML,eAAAA,CAAgBM,cAAc,CAACN,eAAAA,CAAgBO,IAAI,CAACL,KAAAA,CAAAA,CAAAA;IAE3E,IAAIG,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;QAC/C,OAAO;YAAEJ,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;;AAIA,IAAA,IAAIC,SAASI,IAAI,KAAK,iBAAiBJ,QAAAA,CAASI,IAAI,KAAK,IAAA,EAAM;QAC7D,OAAO;YAAEL,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMM,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,OAAO;YAAEN,aAAAA,EAAe,KAAA;YAAOQ,KAAAA,EAAOF;AAAY,SAAA;AACpD,IAAA;AAEA,IAAA,MAAMG,8BAAAA,CAAiBR,QAAAA,CAAAA;AAEvB,IAAA,IAAIA,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;AACrD,QAAA,MAAMC,UAAU,MAAMC,MAAAA,CAAOC,UAAU,CAACC,WAAW,CAACC,MAAM,CAACC,eAAe,CACxElB,SAASgB,WAAW,CAACG,GAAG,CAAC,CAACC,UAAoB;AAAEA,gBAAAA;aAAO,CAAA,CAAA,CAAA;QAGzD,OAAO;YAAErB,aAAAA,EAAe,IAAA;AAAMc,YAAAA,OAAAA;YAASQ,WAAAA,EAAarB;AAAS,SAAA;AAC/D,IAAA;IAEA,OAAO;QAAED,aAAAA,EAAe,IAAA;QAAMsB,WAAAA,EAAarB;AAAS,KAAA;AACtD;AAEA;;;;AAIC,IACM,MAAMsB,MAAAA,GAAS,CAACC,IAAAA,EAAWC,MAAAA,GAAAA;AAChC,IAAA,MAAM,EAAEH,WAAAA,EAAarB,QAAQ,EAAEa,OAAO,EAAE,GAAGU,IAAAA;IAE3C,IAAIvB,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;AAC/C,QAAA,MAAM,IAAIhB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMkB,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,MAAMA,WAAAA;AACR,IAAA;;AAGA,IAAA,IAAIL,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACc,WAAW,EAAE;AAC1D,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIzB,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACe,SAAS,EAAE;QACxD,MAAMC,MAAAA,GAASC,YAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;AAErC,QAAA,IAAIiC,OAAOjC,KAAK,IAAIoC,MAAAA,CAAOE,KAAK,CAACvC,WAAAA,CAAAA,EAAc;AAC7C,YAAA;AACF,QAAA;IACF,CAAA,MAGK,IAAIU,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;QAC1D,IAAIC,OAAAA,KAAY,IAAA,IAAQA,OAAAA,KAAYV,SAAAA,EAAW;AAC7C,YAAA,MAAM,IAAIf,cAAAA,EAAAA;AACZ,QAAA;QAEA,MAAMuC,MAAAA,GAASC,YAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;QACrC,MAAMuC,SAAAA,GAAYH,OAAOE,KAAK,CAAC,CAACtC,KAAAA,GAAkBsB,OAAAA,CAAQkB,GAAG,CAACxC,KAAAA,CAAAA,CAAAA;AAE9D,QAAA,IAAIuC,cAAc,IAAA,EAAM;AACtB,YAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAI1C,cAAAA,EAAAA;AACZ;AAEA,kCAAe;IACb4C,IAAAA,EAAM,mBAAA;AACNvC,IAAAA,YAAAA;AACA6B,IAAAA;AACF,CAAA;;;;;;"}
+{"version":3,"file":"content-api-token.js","sources":["../../../../../server/src/strategies/content-api-token.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { castArray } from 'lodash';\n\nimport { errors } from '@strapi/utils';\nimport constants from '../services/constants';\nimport { getService } from '../utils';\nimport { extractToken, checkExpiry, updateLastUsedAt } from './api-token-utils';\nimport '@strapi/types';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst isReadScope = (scope: string) => scope.endsWith('find') || scope.endsWith('findOne');\n\n/**\n * Authenticate a content-api token. Rejects tokens with kind !== 'content-api'.\n */\nexport const authenticate = async (ctx: Context) => {\n  const apiTokenService = getService('api-token-content-api');\n  const token = extractToken(ctx);\n\n  if (token === null) {\n    return { authenticated: false };\n  }\n\n  const apiToken = await apiTokenService.getByAccessKey(apiTokenService.hash(token));\n\n  if (apiToken === null || apiToken === undefined) {\n    return { authenticated: false };\n  }\n\n  // Defensive kind check — only handle content-api tokens.\n  // null kind is allowed: tokens created before the kind field was introduced are implicitly content-api.\n  if (apiToken.kind !== 'content-api' && apiToken.kind !== null) {\n    return { authenticated: false };\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    return { authenticated: false, error: expiryError };\n  }\n\n  await updateLastUsedAt(apiToken);\n\n  if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(\n      apiToken.permissions.map((action: string) => ({ action }))\n    );\n\n    return { authenticated: true, ability, credentials: apiToken };\n  }\n\n  return { authenticated: true, credentials: apiToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope.\n *\n * @type {import('.').VerifyFunction}\n */\nexport const verify = (auth: any, config: any) => {\n  const { credentials: apiToken, ability } = auth;\n\n  if (apiToken === null || apiToken === undefined) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const expiryError = checkExpiry(apiToken);\n  if (expiryError !== null) {\n    throw expiryError;\n  }\n\n  // Full access\n  if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {\n    return;\n  }\n\n  // Read only\n  if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {\n    const scopes = castArray(config.scope);\n\n    if (config.scope && scopes.every(isReadScope)) {\n      return;\n    }\n  }\n\n  // Custom\n  else if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {\n    if (ability === null || ability === undefined) {\n      throw new ForbiddenError();\n    }\n\n    const scopes = castArray(config.scope);\n    const isAllowed = scopes.every((scope: string) => ability.can(scope));\n\n    if (isAllowed === true) {\n      return;\n    }\n  }\n\n  throw new ForbiddenError();\n};\n\nexport default {\n  name: 'content-api-token',\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","isReadScope","scope","endsWith","authenticate","ctx","apiTokenService","getService","token","extractToken","authenticated","apiToken","getByAccessKey","hash","undefined","kind","expiryError","checkExpiry","error","updateLastUsedAt","type","constants","API_TOKEN_TYPE","CUSTOM","ability","strapi","contentAPI","permissions","engine","generateAbility","map","action","credentials","verify","auth","config","FULL_ACCESS","READ_ONLY","scopes","castArray","every","isAllowed","can","name"],"mappings":";;;;;;;;;;;AASA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,YAAAA;AAE9C,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GAAkBA,KAAAA,CAAMC,QAAQ,CAAC,MAAA,CAAA,IAAWD,KAAAA,CAAMC,QAAQ,CAAC,SAAA,CAAA;AAEhF;;IAGO,MAAMC,YAAAA,GAAe,OAAOC,GAAAA,GAAAA;AACjC,IAAA,MAAMC,kBAAkBC,gBAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMC,QAAQC,0BAAAA,CAAaJ,GAAAA,CAAAA;AAE3B,IAAA,IAAIG,UAAU,IAAA,EAAM;QAClB,OAAO;YAAEE,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,WAAW,MAAML,eAAAA,CAAgBM,cAAc,CAACN,eAAAA,CAAgBO,IAAI,CAACL,KAAAA,CAAAA,CAAAA;IAE3E,IAAIG,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;QAC/C,OAAO;YAAEJ,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;;AAIA,IAAA,IAAIC,SAASI,IAAI,KAAK,iBAAiBJ,QAAAA,CAASI,IAAI,KAAK,IAAA,EAAM;QAC7D,OAAO;YAAEL,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMM,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,OAAO;YAAEN,aAAAA,EAAe,KAAA;YAAOQ,KAAAA,EAAOF;AAAY,SAAA;AACpD,IAAA;AAEA,IAAA,MAAMG,8BAAAA,CAAiBR,QAAAA,CAAAA;AAEvB,IAAA,IAAIA,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;AACrD,QAAA,MAAMC,UAAU,MAAMC,MAAAA,CAAOC,UAAU,CAACC,WAAW,CAACC,MAAM,CAACC,eAAe,CACxElB,SAASgB,WAAW,CAACG,GAAG,CAAC,CAACC,UAAoB;AAAEA,gBAAAA;aAAO,CAAA,CAAA,CAAA;QAGzD,OAAO;YAAErB,aAAAA,EAAe,IAAA;AAAMc,YAAAA,OAAAA;YAASQ,WAAAA,EAAarB;AAAS,SAAA;AAC/D,IAAA;IAEA,OAAO;QAAED,aAAAA,EAAe,IAAA;QAAMsB,WAAAA,EAAarB;AAAS,KAAA;AACtD;AAEA;;;;AAIC,IACM,MAAMsB,MAAAA,GAAS,CAACC,IAAAA,EAAWC,MAAAA,GAAAA;AAChC,IAAA,MAAM,EAAEH,WAAAA,EAAarB,QAAQ,EAAEa,OAAO,EAAE,GAAGU,IAAAA;IAE3C,IAAIvB,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAaG,SAAAA,EAAW;AAC/C,QAAA,MAAM,IAAIhB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMkB,cAAcC,yBAAAA,CAAYN,QAAAA,CAAAA;AAChC,IAAA,IAAIK,gBAAgB,IAAA,EAAM;QACxB,MAAMA,WAAAA;AACR,IAAA;;AAGA,IAAA,IAAIL,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACc,WAAW,EAAE;AAC1D,QAAA;AACF,IAAA;;AAGA,IAAA,IAAIzB,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACe,SAAS,EAAE;QACxD,MAAMC,MAAAA,GAASC,WAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;AAErC,QAAA,IAAIiC,OAAOjC,KAAK,IAAIoC,MAAAA,CAAOE,KAAK,CAACvC,WAAAA,CAAAA,EAAc;AAC7C,YAAA;AACF,QAAA;IACF,CAAA,MAGK,IAAIU,SAASS,IAAI,KAAKC,UAAUC,cAAc,CAACC,MAAM,EAAE;QAC1D,IAAIC,OAAAA,KAAY,IAAA,IAAQA,OAAAA,KAAYV,SAAAA,EAAW;AAC7C,YAAA,MAAM,IAAIf,cAAAA,EAAAA;AACZ,QAAA;QAEA,MAAMuC,MAAAA,GAASC,WAAAA,CAAUJ,MAAAA,CAAOjC,KAAK,CAAA;QACrC,MAAMuC,SAAAA,GAAYH,OAAOE,KAAK,CAAC,CAACtC,KAAAA,GAAkBsB,OAAAA,CAAQkB,GAAG,CAACxC,KAAAA,CAAAA,CAAAA;AAE9D,QAAA,IAAIuC,cAAc,IAAA,EAAM;AACtB,YAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAI1C,cAAAA,EAAAA;AACZ;AAEA,kCAAe;IACb4C,IAAAA,EAAM,mBAAA;AACNvC,IAAAA,YAAAA;AACA6B,IAAAA;AACF,CAAA;;;;;;"}

package/dist/server/server/src/strategies/content-api-token.mjs

@@ -1,4 +1,4 @@
-import { castArray } from 'lodash/fp';
+import { castArray } from 'lodash';
 import { errors } from '@strapi/utils';
 import constants from '../services/constants.mjs';
 import { getService } from '../utils/index.mjs';