@strapi/admin 5.56.0 → 5.57.0

package/dist/server/server/src/services/api-token.js

@@ -1,7 +1,7 @@
 'use strict';
 
+var _ = require('lodash');
 var crypto = require('crypto');
-var fp = require('lodash/fp');
 var utils = require('@strapi/utils');
 var constants = require('./constants.js');
 var index = require('../utils/index.js');
@@ -95,18 +95,18 @@ const UPDATABLE_FIELDS = [
  * Assert that a token's permissions attribute is valid for its type
  */ const assertCustomTokenPermissionsValidity = (type, permissions)=>{
     // Ensure non-custom tokens doesn't have permissions
-    if (type !== constants.API_TOKEN_TYPE.CUSTOM && !fp.isEmpty(permissions)) {
+    if (type !== constants.API_TOKEN_TYPE.CUSTOM && !_.isEmpty(permissions)) {
         throw new ValidationError('Non-custom tokens should not reference permissions');
     }
     // Custom type tokens should always have permissions attached to them
-    if (type === constants.API_TOKEN_TYPE.CUSTOM && !fp.isArray(permissions)) {
+    if (type === constants.API_TOKEN_TYPE.CUSTOM && !Array.isArray(permissions)) {
         throw new ValidationError('Missing permissions attribute for custom token');
     }
     // Permissions provided for a custom type token should be valid/registered permissions UID
     if (type === constants.API_TOKEN_TYPE.CUSTOM) {
         const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
-        const invalidPermissions = fp.difference(permissions, validPermissions);
-        if (!fp.isEmpty(invalidPermissions)) {
+        const invalidPermissions = _.difference(permissions, validPermissions);
+        if (!_.isEmpty(invalidPermissions)) {
             throw new ValidationError(`Unknown permissions provided: ${invalidPermissions.join(', ')}`);
         }
     }
@@ -114,10 +114,10 @@ const UPDATABLE_FIELDS = [
 /**
  * Check if a token's lifespan is valid
  */ const isValidLifespan = (lifespan)=>{
-    if (fp.isNil(lifespan)) {
+    if (lifespan == null) {
         return true;
     }
-    if (!fp.isNumber(lifespan) || !Object.values(constants.API_TOKEN_LIFESPANS).includes(lifespan)) {
+    if (!_.isNumber(lifespan) || !Object.values(constants.API_TOKEN_LIFESPANS).includes(lifespan)) {
         return false;
     }
     return true;
@@ -232,7 +232,9 @@ const UPDATABLE_FIELDS = [
         const anyUserPermHasAllFields = matchingUserPerms.some((p)=>!p.properties?.fields || p.properties.fields.length === 0);
         const requestedFields = requested.properties?.fields;
         if (!anyUserPermHasAllFields) {
-            const effectiveUserFields = fp.uniq(matchingUserPerms.flatMap((p)=>p.properties?.fields || []));
+            const effectiveUserFields = [
+                ...new Set(matchingUserPerms.flatMap((p)=>p.properties?.fields || []))
+            ];
             // When the owner is field-restricted, omitting fields would widen access to all fields.
             // Force explicit field selection so token scope can't exceed the owner's ceiling.
             if (requestedFields === undefined || requestedFields === null) {
@@ -252,7 +254,9 @@ const UPDATABLE_FIELDS = [
         // If any matching user perm is unconditional → token gets no conditions.
         // Otherwise → union of conditions across matching perms.
         const anyUserPermIsUnconditional = matchingUserPerms.some((p)=>!p.conditions || p.conditions.length === 0);
-        const enforcedConditions = anyUserPermIsUnconditional ? [] : fp.uniq(matchingUserPerms.flatMap((p)=>p.conditions || []));
+        const enforcedConditions = anyUserPermIsUnconditional ? [] : [
+            ...new Set(matchingUserPerms.flatMap((p)=>p.conditions || []))
+        ];
         return {
             ...requested,
             conditions: enforcedConditions
@@ -292,7 +296,7 @@ const UPDATABLE_FIELDS = [
     'action',
     'actionParameters'
 ];
-const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
+const pickComparableFields = (permission)=>_.pick(permission, COMPARABLE_FIELDS);
 /**
  * Helper to clean JSON (remove undefined values)
  */ const jsonClean = (data)=>JSON.parse(JSON.stringify(data));
@@ -300,7 +304,7 @@ const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
  * Compare two permissions for equality
  */ const arePermissionsEqual = (p1, p2)=>{
     if (p1.action === p2.action) {
-        return fp.isEqual(jsonClean(pickComparableFields(p1)), jsonClean(pickComparableFields(p2)));
+        return _.isEqual(jsonClean(pickComparableFields(p1)), jsonClean(pickComparableFields(p2)));
     }
     return false;
 };
@@ -323,10 +327,10 @@ const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
             }
         }
     });
-    const permissionsToAdd = fp.differenceWith(arePermissionsEqual, permissionsWithToken, existingPermissions);
-    const permissionsToDelete = fp.differenceWith(arePermissionsEqual, existingPermissions, permissionsWithToken);
+    const permissionsToAdd = _.differenceWith(permissionsWithToken, existingPermissions, arePermissionsEqual);
+    const permissionsToDelete = _.differenceWith(existingPermissions, permissionsWithToken, arePermissionsEqual);
     if (permissionsToDelete.length > 0) {
-        await index.getService('permission').deleteByIds(permissionsToDelete.map(fp.prop('id')));
+        await index.getService('permission').deleteByIds(permissionsToDelete.map((permission)=>permission?.id));
     }
     if (permissionsToAdd.length > 0) {
         await createApiTokenAdminPermissions(tokenId, permissionsToAdd);
@@ -363,7 +367,9 @@ const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
         const anyUserPermHasAllFields = matchingUserPerms.some((p)=>!p.properties?.fields || p.properties.fields.length === 0);
         const tokenFields = tokenPerm.properties?.fields;
         const fieldCeilingExceeded = !anyUserPermHasAllFields && tokenFields !== undefined && tokenFields !== null && tokenFields.length > 0 && (()=>{
-            const effectiveUserFields = fp.uniq(matchingUserPerms.flatMap((p)=>p.properties?.fields || []));
+            const effectiveUserFields = [
+                ...new Set(matchingUserPerms.flatMap((p)=>p.properties?.fields || []))
+            ];
             return tokenFields.some((f)=>!effectiveUserFields.includes(f));
         })();
         if (fieldCeilingExceeded) {
@@ -372,7 +378,9 @@ const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
         }
         // Condition: force conditions to be the ones of the user permission(s)
         const anyUserPermIsUnconditional = matchingUserPerms.some((p)=>!p.conditions || p.conditions.length === 0);
-        const enforcedConditions = anyUserPermIsUnconditional ? [] : fp.uniq(matchingUserPerms.flatMap((p)=>p.conditions || []));
+        const enforcedConditions = anyUserPermIsUnconditional ? [] : [
+            ...new Set(matchingUserPerms.flatMap((p)=>p.conditions || []))
+        ];
         const currentConditions = tokenPerm.conditions || [];
         const conditionsChanged = enforcedConditions.length !== currentConditions.length || enforcedConditions.some((c)=>!currentConditions.includes(c));
         if (conditionsChanged) {
@@ -454,7 +462,7 @@ const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
 /**
  * Flatten a token's database permissions objects to an array of strings
  */ const flattenTokenPermissions = (permissions)=>{
-    return fp.isArray(permissions) ? fp.map('action', permissions) : [];
+    return Array.isArray(permissions) ? Array.from(permissions, (permission)=>permission?.action) : [];
 };
 /**
  *  Get a token.
@@ -479,14 +487,14 @@ const pickComparableFields = fp.pick(COMPARABLE_FIELDS);
     }
     // Tokens created before kind introduction case: force kind to be content-api
     const computedKind = token.kind ?? 'content-api';
-    const result = fp.omit([
+    const result = _.omit(token, [
         'accessKey',
         'encryptedKey',
         'type',
         'permissions',
         'adminPermissions',
         'adminUserOwner'
-    ], token);
+    ]);
     if (computedKind === 'content-api') {
         Object.assign(result, {
             kind: 'content-api',
@@ -579,8 +587,8 @@ const authenticateAdminToken = async (accessToken)=>{
 };
 const getExpirationFields = (lifespan)=>{
     // it must be nil or a finite number >= 0
-    const isValidNumber = fp.isNumber(lifespan) && Number.isFinite(lifespan) && lifespan > 0;
-    if (!isValidNumber && !fp.isNil(lifespan)) {
+    const isValidNumber = _.isNumber(lifespan) && Number.isFinite(lifespan) && lifespan > 0;
+    if (!isValidNumber && lifespan != null) {
         throw new ValidationError('lifespan must be a positive number or null');
     }
     return {
@@ -604,11 +612,11 @@ const getExpirationFields = (lifespan)=>{
             select: SELECT_FIELDS,
             populate: POPULATE_FIELDS,
             data: {
-                ...fp.omit([
+                ..._.omit(attributes, [
                     'permissions',
                     'adminPermissions',
                     'adminUserOwner'
-                ], attributes),
+                ]),
                 accessKey: hash(accessKey),
                 encryptedKey,
                 adminUserOwner: null,
@@ -622,7 +630,9 @@ const getExpirationFields = (lifespan)=>{
         // If this is a custom type token, create the related content-API permissions
         if (castedContentApiApiTokenBody.type === constants.API_TOKEN_TYPE.CUSTOM) {
             // TODO: createMany doesn't seem to create relation properly, implement a better way rather than a ton of queries
-            await Promise.all(fp.uniq(castedContentApiApiTokenBody.permissions).map((action)=>strapi.db.query('admin::api-token-permission').create({
+            await Promise.all([
+                ...new Set(castedContentApiApiTokenBody.permissions)
+            ].map((action)=>strapi.db.query('admin::api-token-permission').create({
                     data: {
                         action,
                         token: apiToken
@@ -650,10 +660,10 @@ const getExpirationFields = (lifespan)=>{
             }
         });
         // Casted to any to avoid complex type duplication
-        return fp.omit([
+        return _.omit(result, [
             'adminPermissions',
             'adminUserOwner'
-        ], result);
+        ]);
     }
     // kind === 'admin'
     assertAdminKindFields(attributes);
@@ -676,11 +686,11 @@ const getExpirationFields = (lifespan)=>{
         select: SELECT_FIELDS,
         populate: POPULATE_FIELDS,
         data: {
-            ...fp.omit([
+            ..._.omit(attributes, [
                 'permissions',
                 'adminPermissions',
                 'adminUserOwner'
-            ], attributes),
+            ]),
             accessKey: hash(accessKey),
             encryptedKey,
             adminUserOwner: ownerId,
@@ -715,9 +725,9 @@ const getExpirationFields = (lifespan)=>{
     });
     // Casted to any to avoid complex type duplication
     return {
-        ...fp.omit([
+        ..._.omit(result, [
             'permissions'
-        ], result),
+        ]),
         adminUserOwner: toAdminTokenOwner(result.adminUserOwner)
     };
 };
@@ -763,9 +773,9 @@ const regenerate = async (id)=>{
         }
     });
     return {
-        ...fp.omit([
+        ..._.omit(apiToken, [
             'adminUserOwner'
-        ], apiToken),
+        ]),
         kind: apiToken.kind ?? 'content-api',
         accessKey
     };
@@ -835,18 +845,18 @@ For security reasons, prefer storing the secret in an environment variable and r
     if (!tokens) {
         return tokens;
     }
-    return tokens.map((token)=>token.kind === null || token.kind === 'content-api' ? fp.omit([
-            'adminPermissions',
-            'adminUserOwner'
-        ], {
+    return tokens.map((token)=>token.kind === null || token.kind === 'content-api' ? _.omit({
             ...token,
             // Tokens created before kind introduction case: force kind to be content-api
             kind: 'content-api',
             permissions: flattenTokenPermissions(token.permissions)
-        }) : {
-            ...fp.omit([
+        }, [
+            'adminPermissions',
+            'adminUserOwner'
+        ]) : {
+            ..._.omit(token, [
                 'permissions'
-            ], token),
+            ]),
             adminUserOwner: token.adminUserOwner !== null && token.adminUserOwner !== undefined ? toAdminTokenOwner(token.adminUserOwner) : null
         });
 };
@@ -898,14 +908,14 @@ For security reasons, prefer storing the secret in an environment variable and r
         };
     }
     // content-api tokens (including legacy null-kind rows): normalise shape
-    return fp.omit([
-        'adminPermissions',
-        'adminUserOwner'
-    ], {
+    return _.omit({
         ...deletedToken,
         kind: 'content-api',
         permissions: flattenTokenPermissions(deletedToken.permissions)
-    });
+    }, [
+        'adminPermissions',
+        'adminUserOwner'
+    ]);
 };
 /**
  * Update a token and its permissions
@@ -998,7 +1008,7 @@ For security reasons, prefer storing the secret in an environment variable and r
             }
         }
     }
-    const baseData = fp.pick(UPDATABLE_FIELDS, attributes);
+    const baseData = _.pick(attributes, UPDATABLE_FIELDS);
     // Migrate legacy null-kind rows to the explicit value on first write
     if (originalToken.kind === null) {
         baseData.kind = 'content-api';
@@ -1015,10 +1025,12 @@ For security reasons, prefer storing the secret in an environment variable and r
         // custom tokens need to have their permissions updated as well
         if (updatedToken.type === constants.API_TOKEN_TYPE.CUSTOM && incomingPermissions !== undefined) {
             const currentPermissionsResult = await strapi.db.query('admin::api-token').load(updatedToken, 'permissions');
-            const currentPermissions = fp.map('action', currentPermissionsResult || []);
-            const newPermissions = fp.uniq(incomingPermissions || []);
-            const actionsToDelete = fp.difference(currentPermissions, newPermissions);
-            const actionsToAdd = fp.difference(newPermissions, currentPermissions);
+            const currentPermissions = Array.from(currentPermissionsResult || [], (permission)=>permission?.action);
+            const newPermissions = [
+                ...new Set(incomingPermissions || [])
+            ];
+            const actionsToDelete = _.difference(currentPermissions, newPermissions);
+            const actionsToAdd = _.difference(newPermissions, currentPermissions);
             // TODO: improve efficiency here
             await Promise.all(actionsToDelete.map((action)=>strapi.db.query('admin::api-token-permission').delete({
                     where: {