@strapi/admin 5.56.0 → 5.57.0

package/dist/server/server/src/services/api-token.mjs

@@ -1,5 +1,5 @@
+import { differenceWith, omit, pick, difference, isEqual, isEmpty, isNumber } from 'lodash';
 import crypto from 'crypto';
-import { pick, uniq, differenceWith, prop, omit, map, difference, isEqual, isArray, isEmpty, isNumber, isNil } from 'lodash/fp';
 import { errors, emitAudit } from '@strapi/utils';
 import constants from './constants.mjs';
 import { getService } from '../utils/index.mjs';
@@ -93,7 +93,7 @@ const UPDATABLE_FIELDS = [
         throw new ValidationError('Non-custom tokens should not reference permissions');
     }
     // Custom type tokens should always have permissions attached to them
-    if (type === constants.API_TOKEN_TYPE.CUSTOM && !isArray(permissions)) {
+    if (type === constants.API_TOKEN_TYPE.CUSTOM && !Array.isArray(permissions)) {
         throw new ValidationError('Missing permissions attribute for custom token');
     }
     // Permissions provided for a custom type token should be valid/registered permissions UID
@@ -108,7 +108,7 @@ const UPDATABLE_FIELDS = [
 /**
  * Check if a token's lifespan is valid
  */ const isValidLifespan = (lifespan)=>{
-    if (isNil(lifespan)) {
+    if (lifespan == null) {
         return true;
     }
     if (!isNumber(lifespan) || !Object.values(constants.API_TOKEN_LIFESPANS).includes(lifespan)) {
@@ -226,7 +226,9 @@ const UPDATABLE_FIELDS = [
         const anyUserPermHasAllFields = matchingUserPerms.some((p)=>!p.properties?.fields || p.properties.fields.length === 0);
         const requestedFields = requested.properties?.fields;
         if (!anyUserPermHasAllFields) {
-            const effectiveUserFields = uniq(matchingUserPerms.flatMap((p)=>p.properties?.fields || []));
+            const effectiveUserFields = [
+                ...new Set(matchingUserPerms.flatMap((p)=>p.properties?.fields || []))
+            ];
             // When the owner is field-restricted, omitting fields would widen access to all fields.
             // Force explicit field selection so token scope can't exceed the owner's ceiling.
             if (requestedFields === undefined || requestedFields === null) {
@@ -246,7 +248,9 @@ const UPDATABLE_FIELDS = [
         // If any matching user perm is unconditional → token gets no conditions.
         // Otherwise → union of conditions across matching perms.
         const anyUserPermIsUnconditional = matchingUserPerms.some((p)=>!p.conditions || p.conditions.length === 0);
-        const enforcedConditions = anyUserPermIsUnconditional ? [] : uniq(matchingUserPerms.flatMap((p)=>p.conditions || []));
+        const enforcedConditions = anyUserPermIsUnconditional ? [] : [
+            ...new Set(matchingUserPerms.flatMap((p)=>p.conditions || []))
+        ];
         return {
             ...requested,
             conditions: enforcedConditions
@@ -286,7 +290,7 @@ const UPDATABLE_FIELDS = [
     'action',
     'actionParameters'
 ];
-const pickComparableFields = pick(COMPARABLE_FIELDS);
+const pickComparableFields = (permission)=>pick(permission, COMPARABLE_FIELDS);
 /**
  * Helper to clean JSON (remove undefined values)
  */ const jsonClean = (data)=>JSON.parse(JSON.stringify(data));
@@ -317,10 +321,10 @@ const pickComparableFields = pick(COMPARABLE_FIELDS);
             }
         }
     });
-    const permissionsToAdd = differenceWith(arePermissionsEqual, permissionsWithToken, existingPermissions);
-    const permissionsToDelete = differenceWith(arePermissionsEqual, existingPermissions, permissionsWithToken);
+    const permissionsToAdd = differenceWith(permissionsWithToken, existingPermissions, arePermissionsEqual);
+    const permissionsToDelete = differenceWith(existingPermissions, permissionsWithToken, arePermissionsEqual);
     if (permissionsToDelete.length > 0) {
-        await getService('permission').deleteByIds(permissionsToDelete.map(prop('id')));
+        await getService('permission').deleteByIds(permissionsToDelete.map((permission)=>permission?.id));
     }
     if (permissionsToAdd.length > 0) {
         await createApiTokenAdminPermissions(tokenId, permissionsToAdd);
@@ -357,7 +361,9 @@ const pickComparableFields = pick(COMPARABLE_FIELDS);
         const anyUserPermHasAllFields = matchingUserPerms.some((p)=>!p.properties?.fields || p.properties.fields.length === 0);
         const tokenFields = tokenPerm.properties?.fields;
         const fieldCeilingExceeded = !anyUserPermHasAllFields && tokenFields !== undefined && tokenFields !== null && tokenFields.length > 0 && (()=>{
-            const effectiveUserFields = uniq(matchingUserPerms.flatMap((p)=>p.properties?.fields || []));
+            const effectiveUserFields = [
+                ...new Set(matchingUserPerms.flatMap((p)=>p.properties?.fields || []))
+            ];
             return tokenFields.some((f)=>!effectiveUserFields.includes(f));
         })();
         if (fieldCeilingExceeded) {
@@ -366,7 +372,9 @@ const pickComparableFields = pick(COMPARABLE_FIELDS);
         }
         // Condition: force conditions to be the ones of the user permission(s)
         const anyUserPermIsUnconditional = matchingUserPerms.some((p)=>!p.conditions || p.conditions.length === 0);
-        const enforcedConditions = anyUserPermIsUnconditional ? [] : uniq(matchingUserPerms.flatMap((p)=>p.conditions || []));
+        const enforcedConditions = anyUserPermIsUnconditional ? [] : [
+            ...new Set(matchingUserPerms.flatMap((p)=>p.conditions || []))
+        ];
         const currentConditions = tokenPerm.conditions || [];
         const conditionsChanged = enforcedConditions.length !== currentConditions.length || enforcedConditions.some((c)=>!currentConditions.includes(c));
         if (conditionsChanged) {
@@ -448,7 +456,7 @@ const pickComparableFields = pick(COMPARABLE_FIELDS);
 /**
  * Flatten a token's database permissions objects to an array of strings
  */ const flattenTokenPermissions = (permissions)=>{
-    return isArray(permissions) ? map('action', permissions) : [];
+    return Array.isArray(permissions) ? Array.from(permissions, (permission)=>permission?.action) : [];
 };
 /**
  *  Get a token.
@@ -473,14 +481,14 @@ const pickComparableFields = pick(COMPARABLE_FIELDS);
     }
     // Tokens created before kind introduction case: force kind to be content-api
     const computedKind = token.kind ?? 'content-api';
-    const result = omit([
+    const result = omit(token, [
         'accessKey',
         'encryptedKey',
         'type',
         'permissions',
         'adminPermissions',
         'adminUserOwner'
-    ], token);
+    ]);
     if (computedKind === 'content-api') {
         Object.assign(result, {
             kind: 'content-api',
@@ -574,7 +582,7 @@ const authenticateAdminToken = async (accessToken)=>{
 const getExpirationFields = (lifespan)=>{
     // it must be nil or a finite number >= 0
     const isValidNumber = isNumber(lifespan) && Number.isFinite(lifespan) && lifespan > 0;
-    if (!isValidNumber && !isNil(lifespan)) {
+    if (!isValidNumber && lifespan != null) {
         throw new ValidationError('lifespan must be a positive number or null');
     }
     return {
@@ -598,11 +606,11 @@ const getExpirationFields = (lifespan)=>{
             select: SELECT_FIELDS,
             populate: POPULATE_FIELDS,
             data: {
-                ...omit([
+                ...omit(attributes, [
                     'permissions',
                     'adminPermissions',
                     'adminUserOwner'
-                ], attributes),
+                ]),
                 accessKey: hash(accessKey),
                 encryptedKey,
                 adminUserOwner: null,
@@ -616,7 +624,9 @@ const getExpirationFields = (lifespan)=>{
         // If this is a custom type token, create the related content-API permissions
         if (castedContentApiApiTokenBody.type === constants.API_TOKEN_TYPE.CUSTOM) {
             // TODO: createMany doesn't seem to create relation properly, implement a better way rather than a ton of queries
-            await Promise.all(uniq(castedContentApiApiTokenBody.permissions).map((action)=>strapi.db.query('admin::api-token-permission').create({
+            await Promise.all([
+                ...new Set(castedContentApiApiTokenBody.permissions)
+            ].map((action)=>strapi.db.query('admin::api-token-permission').create({
                     data: {
                         action,
                         token: apiToken
@@ -644,10 +654,10 @@ const getExpirationFields = (lifespan)=>{
             }
         });
         // Casted to any to avoid complex type duplication
-        return omit([
+        return omit(result, [
             'adminPermissions',
             'adminUserOwner'
-        ], result);
+        ]);
     }
     // kind === 'admin'
     assertAdminKindFields(attributes);
@@ -670,11 +680,11 @@ const getExpirationFields = (lifespan)=>{
         select: SELECT_FIELDS,
         populate: POPULATE_FIELDS,
         data: {
-            ...omit([
+            ...omit(attributes, [
                 'permissions',
                 'adminPermissions',
                 'adminUserOwner'
-            ], attributes),
+            ]),
             accessKey: hash(accessKey),
             encryptedKey,
             adminUserOwner: ownerId,
@@ -709,9 +719,9 @@ const getExpirationFields = (lifespan)=>{
     });
     // Casted to any to avoid complex type duplication
     return {
-        ...omit([
+        ...omit(result, [
             'permissions'
-        ], result),
+        ]),
         adminUserOwner: toAdminTokenOwner(result.adminUserOwner)
     };
 };
@@ -757,9 +767,9 @@ const regenerate = async (id)=>{
         }
     });
     return {
-        ...omit([
+        ...omit(apiToken, [
             'adminUserOwner'
-        ], apiToken),
+        ]),
         kind: apiToken.kind ?? 'content-api',
         accessKey
     };
@@ -829,18 +839,18 @@ For security reasons, prefer storing the secret in an environment variable and r
     if (!tokens) {
         return tokens;
     }
-    return tokens.map((token)=>token.kind === null || token.kind === 'content-api' ? omit([
-            'adminPermissions',
-            'adminUserOwner'
-        ], {
+    return tokens.map((token)=>token.kind === null || token.kind === 'content-api' ? omit({
             ...token,
             // Tokens created before kind introduction case: force kind to be content-api
             kind: 'content-api',
             permissions: flattenTokenPermissions(token.permissions)
-        }) : {
-            ...omit([
+        }, [
+            'adminPermissions',
+            'adminUserOwner'
+        ]) : {
+            ...omit(token, [
                 'permissions'
-            ], token),
+            ]),
             adminUserOwner: token.adminUserOwner !== null && token.adminUserOwner !== undefined ? toAdminTokenOwner(token.adminUserOwner) : null
         });
 };
@@ -892,14 +902,14 @@ For security reasons, prefer storing the secret in an environment variable and r
         };
     }
     // content-api tokens (including legacy null-kind rows): normalise shape
-    return omit([
-        'adminPermissions',
-        'adminUserOwner'
-    ], {
+    return omit({
         ...deletedToken,
         kind: 'content-api',
         permissions: flattenTokenPermissions(deletedToken.permissions)
-    });
+    }, [
+        'adminPermissions',
+        'adminUserOwner'
+    ]);
 };
 /**
  * Update a token and its permissions
@@ -992,7 +1002,7 @@ For security reasons, prefer storing the secret in an environment variable and r
             }
         }
     }
-    const baseData = pick(UPDATABLE_FIELDS, attributes);
+    const baseData = pick(attributes, UPDATABLE_FIELDS);
     // Migrate legacy null-kind rows to the explicit value on first write
     if (originalToken.kind === null) {
         baseData.kind = 'content-api';
@@ -1009,8 +1019,10 @@ For security reasons, prefer storing the secret in an environment variable and r
         // custom tokens need to have their permissions updated as well
         if (updatedToken.type === constants.API_TOKEN_TYPE.CUSTOM && incomingPermissions !== undefined) {
             const currentPermissionsResult = await strapi.db.query('admin::api-token').load(updatedToken, 'permissions');
-            const currentPermissions = map('action', currentPermissionsResult || []);
-            const newPermissions = uniq(incomingPermissions || []);
+            const currentPermissions = Array.from(currentPermissionsResult || [], (permission)=>permission?.action);
+            const newPermissions = [
+                ...new Set(incomingPermissions || [])
+            ];
             const actionsToDelete = difference(currentPermissions, newPermissions);
             const actionsToAdd = difference(newPermissions, currentPermissions);
             // TODO: improve efficiency here