@strapi/admin 5.56.0 → 5.57.0

package/dist/server/server/src/services/permission/permissions-manager/index.mjs

@@ -1,5 +1,4 @@
-import ___default from 'lodash';
-import { cloneDeep, isPlainObject } from 'lodash/fp';
+import ___default, { cloneDeep, isPlainObject } from 'lodash';
 import { subject } from '@casl/ability';
 import createSanitizeHelpers from './sanitize.mjs';
 import createValidateHelpers from './validate.mjs';

package/dist/server/server/src/services/permission/permissions-manager/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/index.ts"],"sourcesContent":["import _ from 'lodash';\nimport { cloneDeep, isPlainObject } from 'lodash/fp';\nimport { subject as asSubject } from '@casl/ability';\nimport createSanitizeHelpers from './sanitize';\nimport createValidateHelpers from './validate';\n\nimport { buildStrapiQuery, buildCaslQuery } from './query-builders';\n\nexport default ({ ability, action, model }: any) => ({\n  ability,\n  action,\n  model,\n\n  get isAllowed(): unknown {\n    return this.ability.can(action, model);\n  },\n\n  toSubject(target: any, subjectType = model) {\n    return asSubject(subjectType, target);\n  },\n\n  pickPermittedFieldsOf(data: unknown, options = {}) {\n    return this.sanitizeInput(data, options);\n  },\n\n  getQuery(queryAction = action) {\n    if (_.isUndefined(queryAction)) {\n      throw new Error('Action must be defined to build a permission query');\n    }\n\n    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));\n  },\n\n  // eslint-disable-next-line @typescript-eslint/default-param-last\n  addPermissionsQueryTo(query = {} as any, action: unknown) {\n    const newQuery = cloneDeep(query);\n    const permissionQuery = this.getQuery(action) ?? undefined;\n\n    if (isPlainObject(query.filters)) {\n      newQuery.filters = permissionQuery\n        ? { $and: [query.filters, permissionQuery] }\n        : query.filters;\n    } else {\n      newQuery.filters = permissionQuery;\n    }\n\n    return newQuery;\n  },\n\n  ...createSanitizeHelpers({ action, ability, model }),\n  ...createValidateHelpers({ action, ability, model }),\n});\n"],"names":["ability","action","model","isAllowed","can","toSubject","target","subjectType","asSubject","pickPermittedFieldsOf","data","options","sanitizeInput","getQuery","queryAction","_","isUndefined","Error","buildStrapiQuery","buildCaslQuery","addPermissionsQueryTo","query","newQuery","cloneDeep","permissionQuery","undefined","isPlainObject","filters","$and","createSanitizeHelpers","createValidateHelpers"],"mappings":";;;;;;;AAQA,YAAe,CAAA,CAAC,EAAEA,OAAO,EAAEC,MAAM,EAAEC,KAAK,EAAO,IAAM;AACnDF,QAAAA,OAAAA;AACAC,QAAAA,MAAAA;AACAC,QAAAA,KAAAA;AAEA,QAAA,IAAIC,SAAAA,CAAAA,GAAqB;AACvB,YAAA,OAAO,IAAI,CAACH,OAAO,CAACI,GAAG,CAACH,MAAAA,EAAQC,KAAAA,CAAAA;AAClC,QAAA,CAAA;QAEAG,SAAAA,CAAAA,CAAUC,MAAW,EAAEC,WAAAA,GAAcL,KAAK,EAAA;AACxC,YAAA,OAAOM,QAAUD,WAAAA,EAAaD,MAAAA,CAAAA;AAChC,QAAA,CAAA;AAEAG,QAAAA,qBAAAA,CAAAA,CAAsBC,IAAa,EAAEC,OAAAA,GAAU,EAAE,EAAA;AAC/C,YAAA,OAAO,IAAI,CAACC,aAAa,CAACF,IAAAA,EAAMC,OAAAA,CAAAA;AAClC,QAAA,CAAA;AAEAE,QAAAA,QAAAA,CAAAA,CAASC,cAAcb,MAAM,EAAA;YAC3B,IAAIc,UAAAA,CAAEC,WAAW,CAACF,WAAAA,CAAAA,EAAc;AAC9B,gBAAA,MAAM,IAAIG,KAAAA,CAAM,oDAAA,CAAA;AAClB,YAAA;YAEA,OAAOC,gBAAAA,CAAiBC,cAAAA,CAAenB,OAAAA,EAASc,WAAAA,EAAaZ,KAAAA,CAAAA,CAAAA;AAC/D,QAAA,CAAA;;AAGAkB,QAAAA,qBAAAA,CAAAA,CAAsBC,KAAAA,GAAQ,EAAS,EAAEpB,MAAe,EAAA;AACtD,YAAA,MAAMqB,WAAWC,SAAAA,CAAUF,KAAAA,CAAAA;AAC3B,YAAA,MAAMG,eAAAA,GAAkB,IAAI,CAACX,QAAQ,CAACZ,MAAAA,CAAAA,IAAWwB,SAAAA;YAEjD,IAAIC,aAAAA,CAAcL,KAAAA,CAAMM,OAAO,CAAA,EAAG;gBAChCL,QAAAA,CAASK,OAAO,GAAGH,eAAAA,GACf;oBAAEI,IAAAA,EAAM;AAACP,wBAAAA,KAAAA,CAAMM,OAAO;AAAEH,wBAAAA;AAAgB;AAAC,iBAAA,GACzCH,MAAMM,OAAO;YACnB,CAAA,MAAO;AACLL,gBAAAA,QAAAA,CAASK,OAAO,GAAGH,eAAAA;AACrB,YAAA;YAEA,OAAOF,QAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGO,qBAAAA,CAAsB;AAAE5B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM,CAAE;AACpD,QAAA,GAAG4B,qBAAAA,CAAsB;AAAE7B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM;AACpD,KAAA,CAAC;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/index.ts"],"sourcesContent":["import _, { cloneDeep, isPlainObject } from 'lodash';\n\nimport { subject as asSubject } from '@casl/ability';\nimport createSanitizeHelpers from './sanitize';\nimport createValidateHelpers from './validate';\n\nimport { buildStrapiQuery, buildCaslQuery } from './query-builders';\n\nexport default ({ ability, action, model }: any) => ({\n  ability,\n  action,\n  model,\n\n  get isAllowed(): unknown {\n    return this.ability.can(action, model);\n  },\n\n  toSubject(target: any, subjectType = model) {\n    return asSubject(subjectType, target);\n  },\n\n  pickPermittedFieldsOf(data: unknown, options = {}) {\n    return this.sanitizeInput(data, options);\n  },\n\n  getQuery(queryAction = action) {\n    if (_.isUndefined(queryAction)) {\n      throw new Error('Action must be defined to build a permission query');\n    }\n\n    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));\n  },\n\n  // eslint-disable-next-line @typescript-eslint/default-param-last\n  addPermissionsQueryTo(query = {} as any, action: unknown) {\n    const newQuery = cloneDeep(query);\n    const permissionQuery = this.getQuery(action) ?? undefined;\n\n    if (isPlainObject(query.filters)) {\n      newQuery.filters = permissionQuery\n        ? { $and: [query.filters, permissionQuery] }\n        : query.filters;\n    } else {\n      newQuery.filters = permissionQuery;\n    }\n\n    return newQuery;\n  },\n\n  ...createSanitizeHelpers({ action, ability, model }),\n  ...createValidateHelpers({ action, ability, model }),\n});\n"],"names":["ability","action","model","isAllowed","can","toSubject","target","subjectType","asSubject","pickPermittedFieldsOf","data","options","sanitizeInput","getQuery","queryAction","_","isUndefined","Error","buildStrapiQuery","buildCaslQuery","addPermissionsQueryTo","query","newQuery","cloneDeep","permissionQuery","undefined","isPlainObject","filters","$and","createSanitizeHelpers","createValidateHelpers"],"mappings":";;;;;;AAQA,YAAe,CAAA,CAAC,EAAEA,OAAO,EAAEC,MAAM,EAAEC,KAAK,EAAO,IAAM;AACnDF,QAAAA,OAAAA;AACAC,QAAAA,MAAAA;AACAC,QAAAA,KAAAA;AAEA,QAAA,IAAIC,SAAAA,CAAAA,GAAqB;AACvB,YAAA,OAAO,IAAI,CAACH,OAAO,CAACI,GAAG,CAACH,MAAAA,EAAQC,KAAAA,CAAAA;AAClC,QAAA,CAAA;QAEAG,SAAAA,CAAAA,CAAUC,MAAW,EAAEC,WAAAA,GAAcL,KAAK,EAAA;AACxC,YAAA,OAAOM,QAAUD,WAAAA,EAAaD,MAAAA,CAAAA;AAChC,QAAA,CAAA;AAEAG,QAAAA,qBAAAA,CAAAA,CAAsBC,IAAa,EAAEC,OAAAA,GAAU,EAAE,EAAA;AAC/C,YAAA,OAAO,IAAI,CAACC,aAAa,CAACF,IAAAA,EAAMC,OAAAA,CAAAA;AAClC,QAAA,CAAA;AAEAE,QAAAA,QAAAA,CAAAA,CAASC,cAAcb,MAAM,EAAA;YAC3B,IAAIc,UAAAA,CAAEC,WAAW,CAACF,WAAAA,CAAAA,EAAc;AAC9B,gBAAA,MAAM,IAAIG,KAAAA,CAAM,oDAAA,CAAA;AAClB,YAAA;YAEA,OAAOC,gBAAAA,CAAiBC,cAAAA,CAAenB,OAAAA,EAASc,WAAAA,EAAaZ,KAAAA,CAAAA,CAAAA;AAC/D,QAAA,CAAA;;AAGAkB,QAAAA,qBAAAA,CAAAA,CAAsBC,KAAAA,GAAQ,EAAS,EAAEpB,MAAe,EAAA;AACtD,YAAA,MAAMqB,WAAWC,SAAAA,CAAUF,KAAAA,CAAAA;AAC3B,YAAA,MAAMG,eAAAA,GAAkB,IAAI,CAACX,QAAQ,CAACZ,MAAAA,CAAAA,IAAWwB,SAAAA;YAEjD,IAAIC,aAAAA,CAAcL,KAAAA,CAAMM,OAAO,CAAA,EAAG;gBAChCL,QAAAA,CAASK,OAAO,GAAGH,eAAAA,GACf;oBAAEI,IAAAA,EAAM;AAACP,wBAAAA,KAAAA,CAAMM,OAAO;AAAEH,wBAAAA;AAAgB;AAAC,iBAAA,GACzCH,MAAMM,OAAO;YACnB,CAAA,MAAO;AACLL,gBAAAA,QAAAA,CAASK,OAAO,GAAGH,eAAAA;AACrB,YAAA;YAEA,OAAOF,QAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGO,qBAAAA,CAAsB;AAAE5B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM,CAAE;AACpD,QAAA,GAAG4B,qBAAAA,CAAsB;AAAE7B,YAAAA,MAAAA;AAAQD,YAAAA,OAAAA;AAASE,YAAAA;SAAM;AACpD,KAAA,CAAC;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.js

@@ -2,7 +2,7 @@
 
 var ability = require('@casl/ability');
 var extra = require('@casl/ability/extra');
-var fp = require('lodash/fp');
+var _ = require('lodash');
 
 /**
  * Creates a cached permission fields calculator for a given CASL ability.
@@ -20,18 +20,18 @@ var fp = require('lodash/fp');
         const rules = ability$1.rulesFor(actionOverride, subjectType);
         // Check if any rule has conditions that depend on entity data
         // If so, we can't cache - must compute per entity
-        const hasEntityConditions = rules.some((rule)=>rule.conditions && !fp.isEmpty(rule.conditions));
+        const hasEntityConditions = rules.some((rule)=>rule.conditions && !_.isEmpty(rule.conditions));
         // Return cached result if available and safe to use
         const cacheKey = `${actionOverride}::${String(subjectType)}`;
         if (!hasEntityConditions && permissionCache.has(cacheKey)) {
             return permissionCache.get(cacheKey);
         }
         let result;
-        const allFieldsAllowed = rules.some((r)=>fp.isNil(r.fields));
+        const allFieldsAllowed = rules.some((r)=>r.fields == null);
         if (allFieldsAllowed) {
             result = {
                 permittedFields: [],
-                hasAtLeastOneRegistered: rules.some((r)=>!fp.isNil(r.fields)),
+                hasAtLeastOneRegistered: rules.some((r)=>r.fields != null),
                 shouldIncludeAll: true
             };
         } else {
@@ -39,11 +39,11 @@ var fp = require('lodash/fp');
             const permittedFields = extra.permittedFieldsOf(ability$1, actionOverride, subject, {
                 fieldsFrom: (rule)=>rule.fields || []
             });
-            const hasAtLeastOneRegistered = fp.some((fields)=>!fp.isNil(fields), fp.flatMap(fp.prop('fields'), rules));
+            const hasAtLeastOneRegistered = rules.flatMap((rule)=>rule.fields).some((field)=>field != null);
             result = {
                 permittedFields,
                 hasAtLeastOneRegistered,
-                shouldIncludeAll: fp.isEmpty(permittedFields) && !hasAtLeastOneRegistered
+                shouldIncludeAll: _.isEmpty(permittedFields) && !hasAtLeastOneRegistered
             };
         }
         // Cache for reuse if no entity-specific conditions

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-fields.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty, isNil, flatMap, some, prop } from 'lodash/fp';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => isNil(r.fields));\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => !isNil(r.fields)),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = some(\n        (fields) => !isNil(fields),\n        flatMap(prop('fields'), rules)\n      );\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","isNil","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","prop","set","clearCache","clear"],"mappings":";;;;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,SAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,yBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,SAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,UAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMC,QAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;AACzD,QAAA,IAAIH,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPK,gBAAAA,eAAAA,EAAiB,EAAE;gBACnBC,uBAAAA,EAAyBjB,KAAAA,CAAMG,IAAI,CAAC,CAACU,IAAM,CAACC,QAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;gBAC1DG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,uBAAAA,CAAkB3B,SAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EuB,gBAAAA,UAAAA,EAAY,CAAChB,IAAAA,GAASA,IAAAA,CAAKW,MAAM,IAAI;AACvC,aAAA,CAAA;YAEA,MAAME,uBAAAA,GAA0Bd,QAC9B,CAACY,MAAAA,GAAW,CAACD,QAAAA,CAAMC,MAAAA,CAAAA,EACnBM,UAAAA,CAAQC,OAAAA,CAAK,QAAA,CAAA,EAAWtB,KAAAA,CAAAA,CAAAA;YAG1BW,MAAAA,GAAS;AACPK,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBZ,UAAAA,CAAQU,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACf,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB8B,GAAG,CAAChB,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA6B,UAAAA,EAAY,IAAM/B,gBAAgBgC,KAAK;AACzC,KAAA;AACF;;;;"}
+{"version":3,"file":"permission-fields.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty } from 'lodash';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => r.fields == null);\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => r.fields != null),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = rules\n        .flatMap((rule) => rule.fields)\n        .some((field) => field != null);\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","field","set","clearCache","clear"],"mappings":";;;;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,SAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,yBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,SAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,SAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;AACvD,QAAA,IAAIF,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPI,gBAAAA,eAAAA,EAAiB,EAAE;AACnBC,gBAAAA,uBAAAA,EAAyBhB,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;gBACvDG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,uBAAAA,CAAkB1B,SAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EsB,gBAAAA,UAAAA,EAAY,CAACf,IAAAA,GAASA,IAAAA,CAAKU,MAAM,IAAI;AACvC,aAAA,CAAA;AAEA,YAAA,MAAME,uBAAAA,GAA0BhB,KAAAA,CAC7BoB,OAAO,CAAC,CAAChB,IAAAA,GAASA,IAAAA,CAAKU,MAAM,CAAA,CAC7BX,IAAI,CAAC,CAACkB,QAAUA,KAAAA,IAAS,IAAA,CAAA;YAE5BV,MAAAA,GAAS;AACPI,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBX,SAAAA,CAAQS,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACd,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB6B,GAAG,CAACf,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA4B,UAAAA,EAAY,IAAM9B,gBAAgB+B,KAAK;AACzC,KAAA;AACF;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.mjs

@@ -1,6 +1,6 @@
 import { detectSubjectType } from '@casl/ability';
 import { permittedFieldsOf } from '@casl/ability/extra';
-import { isEmpty, isNil, some, flatMap, prop } from 'lodash/fp';
+import { isEmpty } from 'lodash';
 
 /**
  * Creates a cached permission fields calculator for a given CASL ability.
@@ -25,11 +25,11 @@ import { isEmpty, isNil, some, flatMap, prop } from 'lodash/fp';
             return permissionCache.get(cacheKey);
         }
         let result;
-        const allFieldsAllowed = rules.some((r)=>isNil(r.fields));
+        const allFieldsAllowed = rules.some((r)=>r.fields == null);
         if (allFieldsAllowed) {
             result = {
                 permittedFields: [],
-                hasAtLeastOneRegistered: rules.some((r)=>!isNil(r.fields)),
+                hasAtLeastOneRegistered: rules.some((r)=>r.fields != null),
                 shouldIncludeAll: true
             };
         } else {
@@ -37,7 +37,7 @@ import { isEmpty, isNil, some, flatMap, prop } from 'lodash/fp';
             const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {
                 fieldsFrom: (rule)=>rule.fields || []
             });
-            const hasAtLeastOneRegistered = some((fields)=>!isNil(fields), flatMap(prop('fields'), rules));
+            const hasAtLeastOneRegistered = rules.flatMap((rule)=>rule.fields).some((field)=>field != null);
             result = {
                 permittedFields,
                 hasAtLeastOneRegistered,

package/dist/server/server/src/services/permission/permissions-manager/permission-fields.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"permission-fields.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty, isNil, flatMap, some, prop } from 'lodash/fp';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => isNil(r.fields));\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => !isNil(r.fields)),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = some(\n        (fields) => !isNil(fields),\n        flatMap(prop('fields'), rules)\n      );\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","isNil","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","prop","set","clearCache","clear"],"mappings":";;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,OAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,iBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,OAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,OAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMC,KAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;AACzD,QAAA,IAAIH,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPK,gBAAAA,eAAAA,EAAiB,EAAE;gBACnBC,uBAAAA,EAAyBjB,KAAAA,CAAMG,IAAI,CAAC,CAACU,IAAM,CAACC,KAAAA,CAAMD,EAAEE,MAAM,CAAA,CAAA;gBAC1DG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,iBAAAA,CAAkB3B,OAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EuB,gBAAAA,UAAAA,EAAY,CAAChB,IAAAA,GAASA,IAAAA,CAAKW,MAAM,IAAI;AACvC,aAAA,CAAA;YAEA,MAAME,uBAAAA,GAA0Bd,KAC9B,CAACY,MAAAA,GAAW,CAACD,KAAAA,CAAMC,MAAAA,CAAAA,EACnBM,OAAAA,CAAQC,IAAAA,CAAK,QAAA,CAAA,EAAWtB,KAAAA,CAAAA,CAAAA;YAG1BW,MAAAA,GAAS;AACPK,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBZ,OAAAA,CAAQU,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACf,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB8B,GAAG,CAAChB,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA6B,UAAAA,EAAY,IAAM/B,gBAAgBgC,KAAK;AACzC,KAAA;AACF;;;;"}
+{"version":3,"file":"permission-fields.mjs","sources":["../../../../../../../server/src/services/permission/permissions-manager/permission-fields.ts"],"sourcesContent":["import { detectSubjectType } from '@casl/ability';\nimport { permittedFieldsOf } from '@casl/ability/extra';\nimport { isEmpty } from 'lodash';\n\nimport type { Ability } from '@casl/ability';\n\nexport interface PermissionFieldsResult {\n  permittedFields: string[];\n  hasAtLeastOneRegistered: boolean;\n  shouldIncludeAll: boolean;\n}\n\n/**\n * Creates a cached permission fields calculator for a given CASL ability.\n *\n * The cache stores permission field calculations per action+subjectType combination.\n * Results are only cached when rules have no entity-specific conditions, as those\n * must be computed per entity.\n *\n * @param ability - The CASL ability instance to use for permission checks\n * @returns Object with getPermissionFields function and cache\n */\nexport const createPermissionFieldsCache = (ability: Ability) => {\n  const permissionCache = new Map<string, PermissionFieldsResult>();\n\n  const getPermissionFields = (actionOverride: string, subject: any): PermissionFieldsResult => {\n    const subjectType = detectSubjectType(subject);\n    const rules = ability.rulesFor(actionOverride, subjectType);\n\n    // Check if any rule has conditions that depend on entity data\n    // If so, we can't cache - must compute per entity\n    const hasEntityConditions = rules.some(\n      (rule: any) => rule.conditions && !isEmpty(rule.conditions)\n    );\n\n    // Return cached result if available and safe to use\n    const cacheKey = `${actionOverride}::${String(subjectType)}`;\n    if (!hasEntityConditions && permissionCache.has(cacheKey)) {\n      return permissionCache.get(cacheKey)!;\n    }\n\n    let result: PermissionFieldsResult;\n\n    const allFieldsAllowed = rules.some((r) => r.fields == null);\n    if (allFieldsAllowed) {\n      result = {\n        permittedFields: [],\n        hasAtLeastOneRegistered: rules.some((r) => r.fields != null),\n        shouldIncludeAll: true,\n      };\n    } else {\n      // Compute permission fields (expensive CASL operation)\n      const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {\n        fieldsFrom: (rule) => rule.fields || [],\n      });\n\n      const hasAtLeastOneRegistered = rules\n        .flatMap((rule) => rule.fields)\n        .some((field) => field != null);\n\n      result = {\n        permittedFields,\n        hasAtLeastOneRegistered,\n        shouldIncludeAll: isEmpty(permittedFields) && !hasAtLeastOneRegistered,\n      };\n    }\n\n    // Cache for reuse if no entity-specific conditions\n    if (!hasEntityConditions) {\n      permissionCache.set(cacheKey, result);\n    }\n\n    return result;\n  };\n\n  return {\n    getPermissionFields,\n    clearCache: () => permissionCache.clear(),\n  };\n};\n"],"names":["createPermissionFieldsCache","ability","permissionCache","Map","getPermissionFields","actionOverride","subject","subjectType","detectSubjectType","rules","rulesFor","hasEntityConditions","some","rule","conditions","isEmpty","cacheKey","String","has","get","result","allFieldsAllowed","r","fields","permittedFields","hasAtLeastOneRegistered","shouldIncludeAll","permittedFieldsOf","fieldsFrom","flatMap","field","set","clearCache","clear"],"mappings":";;;;AAYA;;;;;;;;;IAUO,MAAMA,2BAAAA,GAA8B,CAACC,OAAAA,GAAAA;AAC1C,IAAA,MAAMC,kBAAkB,IAAIC,GAAAA,EAAAA;IAE5B,MAAMC,mBAAAA,GAAsB,CAACC,cAAAA,EAAwBC,OAAAA,GAAAA;AACnD,QAAA,MAAMC,cAAcC,iBAAAA,CAAkBF,OAAAA,CAAAA;AACtC,QAAA,MAAMG,KAAAA,GAAQR,OAAAA,CAAQS,QAAQ,CAACL,cAAAA,EAAgBE,WAAAA,CAAAA;;;AAI/C,QAAA,MAAMI,mBAAAA,GAAsBF,KAAAA,CAAMG,IAAI,CACpC,CAACC,IAAAA,GAAcA,IAAAA,CAAKC,UAAU,IAAI,CAACC,OAAAA,CAAQF,IAAAA,CAAKC,UAAU,CAAA,CAAA;;AAI5D,QAAA,MAAME,WAAW,CAAA,EAAGX,cAAAA,CAAe,EAAE,EAAEY,OAAOV,WAAAA,CAAAA,CAAAA,CAAc;AAC5D,QAAA,IAAI,CAACI,mBAAAA,IAAuBT,eAAAA,CAAgBgB,GAAG,CAACF,QAAAA,CAAAA,EAAW;YACzD,OAAOd,eAAAA,CAAgBiB,GAAG,CAACH,QAAAA,CAAAA;AAC7B,QAAA;QAEA,IAAII,MAAAA;QAEJ,MAAMC,gBAAAA,GAAmBZ,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;AACvD,QAAA,IAAIF,gBAAAA,EAAkB;YACpBD,MAAAA,GAAS;AACPI,gBAAAA,eAAAA,EAAiB,EAAE;AACnBC,gBAAAA,uBAAAA,EAAyBhB,MAAMG,IAAI,CAAC,CAACU,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,IAAI,IAAA,CAAA;gBACvDG,gBAAAA,EAAkB;AACpB,aAAA;QACF,CAAA,MAAO;;AAEL,YAAA,MAAMF,eAAAA,GAAkBG,iBAAAA,CAAkB1B,OAAAA,EAASI,cAAAA,EAAgBC,OAAAA,EAAS;AAC1EsB,gBAAAA,UAAAA,EAAY,CAACf,IAAAA,GAASA,IAAAA,CAAKU,MAAM,IAAI;AACvC,aAAA,CAAA;AAEA,YAAA,MAAME,uBAAAA,GAA0BhB,KAAAA,CAC7BoB,OAAO,CAAC,CAAChB,IAAAA,GAASA,IAAAA,CAAKU,MAAM,CAAA,CAC7BX,IAAI,CAAC,CAACkB,QAAUA,KAAAA,IAAS,IAAA,CAAA;YAE5BV,MAAAA,GAAS;AACPI,gBAAAA,eAAAA;AACAC,gBAAAA,uBAAAA;gBACAC,gBAAAA,EAAkBX,OAAAA,CAAQS,oBAAoB,CAACC;AACjD,aAAA;AACF,QAAA;;AAGA,QAAA,IAAI,CAACd,mBAAAA,EAAqB;YACxBT,eAAAA,CAAgB6B,GAAG,CAACf,QAAAA,EAAUI,MAAAA,CAAAA;AAChC,QAAA;QAEA,OAAOA,MAAAA;AACT,IAAA,CAAA;IAEA,OAAO;AACLhB,QAAAA,mBAAAA;QACA4B,UAAAA,EAAY,IAAM9B,gBAAgB+B,KAAK;AACzC,KAAA;AACF;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/sanitize.js

@@ -1,7 +1,7 @@
 'use strict';
 
+var _ = require('lodash');
 var ability = require('@casl/ability');
-var fp = require('lodash/fp');
 var utils = require('@strapi/utils');
 var permissionFields = require('./permission-fields.js');
 var user = require('../../../domain/user.js');
@@ -30,12 +30,12 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
         // TODO: sanitize relations to admin users in all sanitizers
         const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
         const createSanitizeFilters = (ctx)=>utils.async.pipe(utils.traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx), utils.traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx), utils.traverse.traverseQueryFilters(omitHiddenFields, ctx), utils.traverse.traverseQueryFilters(removePassword, ctx), utils.traverse.traverseQueryFilters(({ key, value }, { remove })=>{
-                if (fp.isObject(value) && fp.isEmpty(value)) {
+                if (_.isObject(value) && _.isEmpty(value)) {
                     remove(key);
                 }
             }, ctx));
         const createSanitizeSort = (ctx)=>utils.async.pipe(utils.traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx), utils.traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx), utils.traverse.traverseQuerySort(omitHiddenFields, ctx), utils.traverse.traverseQuerySort(removePassword, ctx), utils.traverse.traverseQuerySort(({ key, attribute, value }, { remove })=>{
-                if (!isScalarAttribute(attribute) && fp.isEmpty(value)) {
+                if (!isScalarAttribute(attribute) && _.isEmpty(value)) {
                     remove(key);
                 }
             }, ctx));
@@ -66,7 +66,7 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
         };
         const sanitizePopulate = utils.async.pipe(utils.traverse.traverseQueryPopulate(expandWildcardPopulate, ctx), utils.traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx), utils.traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx), utils.traverse.traverseQueryPopulate(omitHiddenFields, ctx), utils.traverse.traverseQueryPopulate(removePassword, ctx), utils.traverse.traverseQueryPopulate(sanitizeNestedPopulate, ctx));
         return async (query)=>{
-            const sanitizedQuery = fp.cloneDeep(query);
+            const sanitizedQuery = _.cloneDeep(query);
             const [sanitizedFilters, sanitizedSort, sanitizedPopulate, sanitizedFields] = await Promise.all([
                 query.filters ? sanitizeFilters(query.filters) : undefined,
                 query.sort ? sanitizeSort(query.sort) : undefined,
@@ -105,7 +105,7 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
     const wrapSanitize = (createSanitizeFunction)=>{
         const { getPermissionFields } = permissionFields.createPermissionFieldsCache(ability$1);
         const wrappedSanitize = async (data, options = {})=>{
-            if (fp.isArray(data)) {
+            if (Array.isArray(data)) {
                 return Promise.all(data.map((entity)=>wrappedSanitize(entity, options)));
             }
             const { subject, action: actionOverride } = getDefaultOptions(data, options);
@@ -124,26 +124,26 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
         return wrappedSanitize;
     };
     const getDefaultOptions = (data, options)=>{
-        return fp.defaults({
+        return _.defaults({}, options, {
             subject: ability.subject(model, data),
             action
-        }, options);
+        });
     };
     /**
    * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses
-   */ const omitCreatorRoles = fp.omit([
-        `${CREATED_BY_ATTRIBUTE}.roles`,
-        `${UPDATED_BY_ATTRIBUTE}.roles`
-    ]);
+   */ const omitCreatorRoles = (data)=>_.omit(data, [
+            `${CREATED_BY_ATTRIBUTE}.roles`,
+            `${UPDATED_BY_ATTRIBUTE}.roles`
+        ]);
     /**
    * Visitor used to remove hidden fields from the admin API responses
    */ const omitHiddenFields = ({ key, schema }, { remove })=>{
-        const isHidden = fp.getOr(false, [
+        const isHidden = _.get(schema, [
             'config',
             'attributes',
             key,
             'hidden'
-        ], schema);
+        ], false);
         if (isHidden) {
             remove(key);
         }
@@ -151,7 +151,7 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
     /**
    * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information
    */ const pickAllowedAdminUserFields = ({ attribute, key, value }, { set })=>{
-        const pickAllowedFields = fp.pick(user.ADMIN_USER_ALLOWED_FIELDS);
+        const pickAllowedFields = (user$1)=>_.pick(user$1, user.ADMIN_USER_ALLOWED_FIELDS);
         if (!attribute) {
             return;
         }
@@ -173,41 +173,47 @@ var createSanitizeHelpers = (({ action, ability: ability$1, model })=>{
     const getInputFields = (fields = [])=>{
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
         const writableAttributes = getWritableAttributes(schema);
-        const nonVisibleWritableAttributes = fp.intersection(nonVisibleAttributes, writableAttributes);
-        return fp.uniq([
-            ...fields,
-            ...COMPONENT_FIELDS,
-            ...nonVisibleWritableAttributes
-        ]);
+        const nonVisibleWritableAttributes = _.intersection(writableAttributes, nonVisibleAttributes);
+        return [
+            ...new Set([
+                ...fields,
+                ...COMPONENT_FIELDS,
+                ...nonVisibleWritableAttributes
+            ])
+        ];
     };
     const getOutputFields = (fields = [])=>{
         const nonWritableAttributes = getNonWritableAttributes(schema);
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
-        return fp.uniq([
-            ...fields,
-            ...STATIC_FIELDS,
-            ...COMPONENT_FIELDS,
-            ...nonWritableAttributes,
-            ...nonVisibleAttributes,
-            CREATED_AT_ATTRIBUTE,
-            UPDATED_AT_ATTRIBUTE
-        ]);
+        return [
+            ...new Set([
+                ...fields,
+                ...STATIC_FIELDS,
+                ...COMPONENT_FIELDS,
+                ...nonWritableAttributes,
+                ...nonVisibleAttributes,
+                CREATED_AT_ATTRIBUTE,
+                UPDATED_AT_ATTRIBUTE
+            ])
+        ];
     };
     const getQueryFields = (fields = [])=>{
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
         const writableAttributes = getWritableAttributes(schema);
-        const nonVisibleWritableAttributes = fp.intersection(nonVisibleAttributes, writableAttributes);
-        return fp.uniq([
-            ...fields,
-            ...STATIC_FIELDS,
-            ...COMPONENT_FIELDS,
-            ...nonVisibleWritableAttributes,
-            CREATED_AT_ATTRIBUTE,
-            UPDATED_AT_ATTRIBUTE,
-            PUBLISHED_AT_ATTRIBUTE,
-            CREATED_BY_ATTRIBUTE,
-            UPDATED_BY_ATTRIBUTE
-        ]);
+        const nonVisibleWritableAttributes = _.intersection(writableAttributes, nonVisibleAttributes);
+        return [
+            ...new Set([
+                ...fields,
+                ...STATIC_FIELDS,
+                ...COMPONENT_FIELDS,
+                ...nonVisibleWritableAttributes,
+                CREATED_AT_ATTRIBUTE,
+                UPDATED_AT_ATTRIBUTE,
+                PUBLISHED_AT_ATTRIBUTE,
+                CREATED_BY_ATTRIBUTE,
+                UPDATED_BY_ATTRIBUTE
+            ])
+        ];
     };
     return {
         sanitizeOutput: wrapSanitize(createSanitizeOutput),

package/dist/server/server/src/services/permission/permissions-manager/sanitize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/sanitize.ts"],"sourcesContent":["import { subject as asSubject } from '@casl/ability';\nimport {\n  defaults,\n  omit,\n  isArray,\n  isEmpty,\n  uniq,\n  intersection,\n  pick,\n  getOr,\n  isObject,\n  cloneDeep,\n} from 'lodash/fp';\n\nimport type { UID } from '@strapi/types';\n\nimport {\n  contentTypes,\n  traverseEntity,\n  sanitize,\n  async,\n  traverse,\n  createModelCache,\n} from '@strapi/utils';\nimport { createPermissionFieldsCache } from './permission-fields';\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst {\n  visitors: { removePassword, expandWildcardPopulate },\n} = sanitize;\n\nconst {\n  constants,\n  isScalarAttribute,\n  getNonVisibleAttributes,\n  getNonWritableAttributes,\n  getWritableAttributes,\n} = contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  const { removeDisallowedFields } = sanitize.visitors;\n\n  // Create request-scoped model cache to avoid redundant getModel() calls\n  const modelCache = createModelCache(strapi.getModel.bind(strapi));\n\n  const ctx = {\n    schema,\n    getModel: modelCache.getModel,\n  };\n\n  const createSanitizeQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: sanitize relations to admin users in all sanitizers\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const createSanitizeFilters = (ctx: any) =>\n      async.pipe(\n        traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),\n        traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),\n        traverse.traverseQueryFilters(omitHiddenFields, ctx),\n        traverse.traverseQueryFilters(removePassword, ctx),\n        traverse.traverseQueryFilters(({ key, value }, { remove }) => {\n          if (isObject(value) && isEmpty(value)) {\n            remove(key);\n          }\n        }, ctx)\n      );\n\n    const createSanitizeSort = (ctx: any) =>\n      async.pipe(\n        traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),\n        traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),\n        traverse.traverseQuerySort(omitHiddenFields, ctx),\n        traverse.traverseQuerySort(removePassword, ctx),\n        traverse.traverseQuerySort(({ key, attribute, value }, { remove }) => {\n          if (!isScalarAttribute(attribute) && isEmpty(value)) {\n            remove(key);\n          }\n        }, ctx)\n      );\n\n    const createSanitizeFields = (ctx: any) =>\n      async.pipe(\n        traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),\n        traverse.traverseQueryFields(omitHiddenFields, ctx),\n        traverse.traverseQueryFields(removePassword, ctx)\n      );\n\n    const sanitizeFilters = createSanitizeFilters(ctx);\n    const sanitizeSort = createSanitizeSort(ctx);\n    const sanitizeFields = createSanitizeFields(ctx);\n\n    /** Sanitize nested filters, sort, and fields inside populate. */\n    const sanitizeNestedPopulate = async (\n      { key, value, schema, attribute, getModel }: any,\n      { set }: any\n    ) => {\n      if (attribute) {\n        return;\n      }\n\n      const nestedCtx = { schema, getModel };\n\n      if (key === 'sort') {\n        const sanitizedSort = await createSanitizeSort(nestedCtx)(value);\n        set(key, sanitizedSort);\n      }\n\n      if (key === 'filters') {\n        const sanitizedFilters = await createSanitizeFilters(nestedCtx)(value);\n        set(key, sanitizedFilters);\n      }\n\n      if (key === 'fields') {\n        const sanitizedFields = await createSanitizeFields(nestedCtx)(value);\n        set(key, sanitizedFields);\n      }\n    };\n\n    const sanitizePopulate = async.pipe(\n      traverse.traverseQueryPopulate(expandWildcardPopulate, ctx),\n      traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(omitHiddenFields, ctx),\n      traverse.traverseQueryPopulate(removePassword, ctx),\n      traverse.traverseQueryPopulate(sanitizeNestedPopulate, ctx)\n    );\n\n    return async (query: any) => {\n      const sanitizedQuery = cloneDeep(query);\n\n      const [sanitizedFilters, sanitizedSort, sanitizedPopulate, sanitizedFields] =\n        await Promise.all([\n          query.filters ? sanitizeFilters(query.filters) : undefined,\n          query.sort ? sanitizeSort(query.sort) : undefined,\n          query.populate ? sanitizePopulate(query.populate) : undefined,\n          query.fields ? sanitizeFields(query.fields) : undefined,\n        ]);\n\n      if (sanitizedFilters !== undefined) sanitizedQuery.filters = sanitizedFilters;\n      if (sanitizedSort !== undefined) sanitizedQuery.sort = sanitizedSort;\n      if (sanitizedPopulate !== undefined) sanitizedQuery.populate = sanitizedPopulate;\n      if (sanitizedFields !== undefined) sanitizedQuery.fields = sanitizedFields;\n\n      return sanitizedQuery;\n    };\n  };\n\n  const createSanitizeOutput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getOutputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove unallowed fields from admin::user relations\n      traverseEntity(pickAllowedAdminUserFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove all fields of type 'password'\n      sanitize.sanitizers.sanitizePasswords({\n        schema,\n        getModel(uid: string) {\n          return strapi.getModel(uid as UID.Schema);\n        },\n      })\n    );\n  };\n\n  const createSanitizeInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapSanitize = (createSanitizeFunction: any) => {\n    const { getPermissionFields } = createPermissionFieldsCache(ability);\n\n    const wrappedSanitize = async (data: unknown, options = {} as any): Promise<unknown> => {\n      if (isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedSanitize(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(\n        actionOverride,\n        subject\n      );\n\n      const sanitizeOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const sanitizeFunction = createSanitizeFunction(sanitizeOptions);\n\n      return sanitizeFunction(data);\n    };\n\n    return wrappedSanitize;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({ subject: asSubject(model, data), action }, options);\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = omit([`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const omitHiddenFields = ({ key, schema }: any, { remove }: any) => {\n    const isHidden = getOr(false, ['config', 'attributes', key, 'hidden'], schema);\n\n    if (isHidden) {\n      remove(key);\n    }\n  };\n\n  /**\n   * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const pickAllowedAdminUserFields = ({ attribute, key, value }: any, { set }: any) => {\n    const pickAllowedFields = pick(ADMIN_USER_ALLOWED_FIELDS);\n    if (!attribute) {\n      return;\n    }\n\n    if (attribute.type === 'relation' && attribute.target === 'admin::user' && value) {\n      if (Array.isArray(value)) {\n        set(key, value.map(pickAllowedFields));\n      } else {\n        set(key, pickAllowedFields(value));\n      }\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const omitDisallowedAdminUserFields = ({ key, attribute, schema }: any, { remove }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      remove(key);\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes]);\n  };\n\n  const getOutputFields = (fields = []) => {\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      ...nonWritableAttributes,\n      ...nonVisibleAttributes,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n    ]);\n  };\n\n  const getQueryFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);\n\n    return uniq([\n      ...fields,\n      ...STATIC_FIELDS,\n      ...COMPONENT_FIELDS,\n      ...nonVisibleWritableAttributes,\n      CREATED_AT_ATTRIBUTE,\n      UPDATED_AT_ATTRIBUTE,\n      PUBLISHED_AT_ATTRIBUTE,\n      CREATED_BY_ATTRIBUTE,\n      UPDATED_BY_ATTRIBUTE,\n    ]);\n  };\n\n  return {\n    sanitizeOutput: wrapSanitize(createSanitizeOutput),\n    sanitizeInput: wrapSanitize(createSanitizeInput),\n    sanitizeQuery: wrapSanitize(createSanitizeQuery),\n  };\n};\n"],"names":["visitors","removePassword","expandWildcardPopulate","sanitize","constants","isScalarAttribute","getNonVisibleAttributes","getNonWritableAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","action","ability","model","schema","strapi","getModel","removeDisallowedFields","modelCache","createModelCache","bind","ctx","createSanitizeQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","createSanitizeFilters","async","pipe","traverse","traverseQueryFilters","omitDisallowedAdminUserFields","omitHiddenFields","key","value","remove","isObject","isEmpty","createSanitizeSort","traverseQuerySort","attribute","createSanitizeFields","traverseQueryFields","sanitizeFilters","sanitizeSort","sanitizeFields","sanitizeNestedPopulate","set","nestedCtx","sanitizedSort","sanitizedFilters","sanitizedFields","sanitizePopulate","traverseQueryPopulate","query","sanitizedQuery","cloneDeep","sanitizedPopulate","Promise","all","filters","undefined","sort","populate","createSanitizeOutput","getOutputFields","traverseEntity","pickAllowedAdminUserFields","sanitizers","sanitizePasswords","uid","createSanitizeInput","getInputFields","omitCreatorRoles","wrapSanitize","createSanitizeFunction","getPermissionFields","createPermissionFieldsCache","wrappedSanitize","data","isArray","map","entity","subject","actionOverride","getDefaultOptions","hasAtLeastOneRegistered","sanitizeOptions","sanitizeFunction","defaults","asSubject","omit","isHidden","getOr","pickAllowedFields","pick","ADMIN_USER_ALLOWED_FIELDS","type","target","Array","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","uniq","nonWritableAttributes","sanitizeOutput","sanitizeInput","sanitizeQuery"],"mappings":";;;;;;;;AA2BA,MAAM,EACJA,UAAU,EAAEC,cAAc,EAAEC,sBAAsB,EAAE,EACrD,GAAGC,cAAAA;AAEJ,MAAM,EACJC,SAAS,EACTC,iBAAiB,EACjBC,uBAAuB,EACvBC,wBAAwB,EACxBC,qBAAqB,EACtB,GAAGC,kBAAAA;AACJ,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGZ,SAAAA;AAEJ,MAAMa,gBAAAA,GAAmB;AAAC,IAAA;AAAc,CAAA;AACxC,MAAMC,aAAAA,GAAgB;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,4BAAe,CAAA,CAAC,EAAEQ,MAAM,WAAEC,SAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAAA,CAAOC,QAAQ,CAACH,KAAAA,CAAAA;AAE/B,IAAA,MAAM,EAAEI,sBAAsB,EAAE,GAAGtB,eAASH,QAAQ;;AAGpD,IAAA,MAAM0B,aAAaC,sBAAAA,CAAiBJ,MAAAA,CAAOC,QAAQ,CAACI,IAAI,CAACL,MAAAA,CAAAA,CAAAA;AAEzD,IAAA,MAAMM,GAAAA,GAAM;AACVP,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUE,WAAWF;AACvB,KAAA;AAEA,IAAA,MAAMM,mBAAAA,GAAsB,CAACC,OAAAA,GAAU,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAAA,CAAOE,gBAAgB,GAAG,IAAA,GAAOC,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,wBAAwB,CAACR,GAAAA,GAC7BS,WAAAA,CAAMC,IAAI,CACRC,cAAAA,CAASC,oBAAoB,CAAChB,sBAAAA,CAAuBQ,kBAAkBJ,GAAAA,CAAAA,EACvEW,cAAAA,CAASC,oBAAoB,CAACC,6BAAAA,EAA+Bb,MAC7DW,cAAAA,CAASC,oBAAoB,CAACE,gBAAAA,EAAkBd,MAChDW,cAAAA,CAASC,oBAAoB,CAACxC,cAAAA,EAAgB4B,GAAAA,CAAAA,EAC9CW,eAASC,oBAAoB,CAAC,CAAC,EAAEG,GAAG,EAAEC,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;gBACvD,IAAIC,WAAAA,CAASF,KAAAA,CAAAA,IAAUG,UAAAA,CAAQH,KAAAA,CAAAA,EAAQ;oBACrCC,MAAAA,CAAOF,GAAAA,CAAAA;AACT,gBAAA;YACF,CAAA,EAAGf,GAAAA,CAAAA,CAAAA;AAGP,QAAA,MAAMoB,qBAAqB,CAACpB,GAAAA,GAC1BS,YAAMC,IAAI,CACRC,eAASU,iBAAiB,CAACzB,sBAAAA,CAAuBQ,eAAAA,CAAAA,EAAkBJ,MACpEW,cAAAA,CAASU,iBAAiB,CAACR,6BAAAA,EAA+Bb,GAAAA,CAAAA,EAC1DW,eAASU,iBAAiB,CAACP,gBAAAA,EAAkBd,GAAAA,CAAAA,EAC7CW,eAASU,iBAAiB,CAACjD,gBAAgB4B,GAAAA,CAAAA,EAC3CW,cAAAA,CAASU,iBAAiB,CAAC,CAAC,EAAEN,GAAG,EAAEO,SAAS,EAAEN,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;AAC/D,gBAAA,IAAI,CAACzC,iBAAAA,CAAkB8C,SAAAA,CAAAA,IAAcH,UAAAA,CAAQH,KAAAA,CAAAA,EAAQ;oBACnDC,MAAAA,CAAOF,GAAAA,CAAAA;AACT,gBAAA;YACF,CAAA,EAAGf,GAAAA,CAAAA,CAAAA;QAGP,MAAMuB,oBAAAA,GAAuB,CAACvB,GAAAA,GAC5BS,WAAAA,CAAMC,IAAI,CACRC,cAAAA,CAASa,mBAAmB,CAAC5B,sBAAAA,CAAuBQ,kBAAkBJ,GAAAA,CAAAA,EACtEW,cAAAA,CAASa,mBAAmB,CAACV,gBAAAA,EAAkBd,MAC/CW,cAAAA,CAASa,mBAAmB,CAACpD,cAAAA,EAAgB4B,GAAAA,CAAAA,CAAAA;AAGjD,QAAA,MAAMyB,kBAAkBjB,qBAAAA,CAAsBR,GAAAA,CAAAA;AAC9C,QAAA,MAAM0B,eAAeN,kBAAAA,CAAmBpB,GAAAA,CAAAA;AACxC,QAAA,MAAM2B,iBAAiBJ,oBAAAA,CAAqBvB,GAAAA,CAAAA;AAE5C,0EACA,MAAM4B,sBAAAA,GAAyB,OAC7B,EAAEb,GAAG,EAAEC,KAAK,EAAEvB,MAAM,EAAE6B,SAAS,EAAE3B,QAAQ,EAAO,EAChD,EAAEkC,GAAG,EAAO,GAAA;AAEZ,YAAA,IAAIP,SAAAA,EAAW;AACb,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMQ,SAAAA,GAAY;AAAErC,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAS,aAAA;AAErC,YAAA,IAAIoB,QAAQ,MAAA,EAAQ;gBAClB,MAAMgB,aAAAA,GAAgB,MAAMX,kBAAAA,CAAmBU,SAAAA,CAAAA,CAAWd,KAAAA,CAAAA;AAC1Da,gBAAAA,GAAAA,CAAId,GAAAA,EAAKgB,aAAAA,CAAAA;AACX,YAAA;AAEA,YAAA,IAAIhB,QAAQ,SAAA,EAAW;gBACrB,MAAMiB,gBAAAA,GAAmB,MAAMxB,qBAAAA,CAAsBsB,SAAAA,CAAAA,CAAWd,KAAAA,CAAAA;AAChEa,gBAAAA,GAAAA,CAAId,GAAAA,EAAKiB,gBAAAA,CAAAA;AACX,YAAA;AAEA,YAAA,IAAIjB,QAAQ,QAAA,EAAU;gBACpB,MAAMkB,eAAAA,GAAkB,MAAMV,oBAAAA,CAAqBO,SAAAA,CAAAA,CAAWd,KAAAA,CAAAA;AAC9Da,gBAAAA,GAAAA,CAAId,GAAAA,EAAKkB,eAAAA,CAAAA;AACX,YAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMC,gBAAAA,GAAmBzB,WAAAA,CAAMC,IAAI,CACjCC,eAASwB,qBAAqB,CAAC9D,sBAAAA,EAAwB2B,GAAAA,CAAAA,EACvDW,cAAAA,CAASwB,qBAAqB,CAACvC,sBAAAA,CAAuBQ,kBAAkBJ,GAAAA,CAAAA,EACxEW,cAAAA,CAASwB,qBAAqB,CAACtB,6BAAAA,EAA+Bb,GAAAA,CAAAA,EAC9DW,cAAAA,CAASwB,qBAAqB,CAACrB,gBAAAA,EAAkBd,GAAAA,CAAAA,EACjDW,cAAAA,CAASwB,qBAAqB,CAAC/D,cAAAA,EAAgB4B,GAAAA,CAAAA,EAC/CW,cAAAA,CAASwB,qBAAqB,CAACP,sBAAAA,EAAwB5B,GAAAA,CAAAA,CAAAA;AAGzD,QAAA,OAAO,OAAOoC,KAAAA,GAAAA;AACZ,YAAA,MAAMC,iBAAiBC,YAAAA,CAAUF,KAAAA,CAAAA;YAEjC,MAAM,CAACJ,kBAAkBD,aAAAA,EAAeQ,iBAAAA,EAAmBN,gBAAgB,GACzE,MAAMO,OAAAA,CAAQC,GAAG,CAAC;AAChBL,gBAAAA,KAAAA,CAAMM,OAAO,GAAGjB,eAAAA,CAAgBW,KAAAA,CAAMM,OAAO,CAAA,GAAIC,SAAAA;AACjDP,gBAAAA,KAAAA,CAAMQ,IAAI,GAAGlB,YAAAA,CAAaU,KAAAA,CAAMQ,IAAI,CAAA,GAAID,SAAAA;AACxCP,gBAAAA,KAAAA,CAAMS,QAAQ,GAAGX,gBAAAA,CAAiBE,KAAAA,CAAMS,QAAQ,CAAA,GAAIF,SAAAA;AACpDP,gBAAAA,KAAAA,CAAMjC,MAAM,GAAGwB,cAAAA,CAAeS,KAAAA,CAAMjC,MAAM,CAAA,GAAIwC;AAC/C,aAAA,CAAA;AAEH,YAAA,IAAIX,gBAAAA,KAAqBW,SAAAA,EAAWN,cAAAA,CAAeK,OAAO,GAAGV,gBAAAA;AAC7D,YAAA,IAAID,aAAAA,KAAkBY,SAAAA,EAAWN,cAAAA,CAAeO,IAAI,GAAGb,aAAAA;AACvD,YAAA,IAAIQ,iBAAAA,KAAsBI,SAAAA,EAAWN,cAAAA,CAAeQ,QAAQ,GAAGN,iBAAAA;AAC/D,YAAA,IAAIN,eAAAA,KAAoBU,SAAAA,EAAWN,cAAAA,CAAelC,MAAM,GAAG8B,eAAAA;YAE3D,OAAOI,cAAAA;AACT,QAAA,CAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMS,oBAAAA,GAAuB,CAAC5C,OAAAA,GAAU,EAAS,GAAA;QAC/C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAAA,CAAOE,gBAAgB,GAAG,IAAA,GAAO0C,eAAAA,CAAgB5C,OAAOI,SAAS,CAAA;QAEzF,OAAOE,WAAAA,CAAMC,IAAI;QAEfsC,oBAAAA,CAAelC,gBAAAA,EAAkBd;QAEjCgD,oBAAAA,CAAeC,0BAAAA,EAA4BjD;QAE3CgD,oBAAAA,CAAepD,sBAAAA,CAAuBQ,eAAAA,CAAAA,EAAkBJ,GAAAA,CAAAA;QAExD1B,cAAAA,CAAS4E,UAAU,CAACC,iBAAiB,CAAC;AACpC1D,YAAAA,MAAAA;AACAE,YAAAA,QAAAA,CAAAA,CAASyD,GAAW,EAAA;gBAClB,OAAO1D,MAAAA,CAAOC,QAAQ,CAACyD,GAAAA,CAAAA;AACzB,YAAA;AACF,SAAA,CAAA,CAAA;AAEJ,IAAA,CAAA;AAEA,IAAA,MAAMC,mBAAAA,GAAsB,CAACnD,OAAAA,GAAU,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAAA,CAAOE,gBAAgB,GAAG,IAAA,GAAOiD,cAAAA,CAAenD,OAAOI,SAAS,CAAA;QAExF,OAAOE,WAAAA,CAAMC,IAAI;QAEfsC,oBAAAA,CAAelC,gBAAAA,EAAkBd;QAEjCgD,oBAAAA,CAAepD,sBAAAA,CAAuBQ,eAAAA,CAAAA,EAAkBJ,GAAAA,CAAAA;AAExDuD,QAAAA,gBAAAA,CAAAA;AAEJ,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;AACpB,QAAA,MAAM,EAAEC,mBAAmB,EAAE,GAAGC,4CAAAA,CAA4BpE,SAAAA,CAAAA;AAE5D,QAAA,MAAMqE,eAAAA,GAAkB,OAAOC,IAAAA,EAAe3D,OAAAA,GAAU,EAAS,GAAA;AAC/D,YAAA,IAAI4D,WAAQD,IAAAA,CAAAA,EAAO;gBACjB,OAAOrB,OAAAA,CAAQC,GAAG,CAACoB,IAAAA,CAAKE,GAAG,CAAC,CAACC,MAAAA,GAAoBJ,eAAAA,CAAgBI,MAAAA,EAAQ9D,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E,YAAA;YAEA,MAAM,EAAE+D,OAAO,EAAE3E,MAAAA,EAAQ4E,cAAc,EAAE,GAAGC,kBAAkBN,IAAAA,EAAM3D,OAAAA,CAAAA;YAEpE,MAAM,EAAEE,eAAe,EAAEgE,uBAAuB,EAAE/D,gBAAgB,EAAE,GAAGqD,mBAAAA,CACrEQ,cAAAA,EACAD,OAAAA,CAAAA;AAGF,YAAA,MAAMI,eAAAA,GAAkB;AACtB,gBAAA,GAAGnE,OAAO;gBACVC,MAAAA,EAAQ;AACNE,oBAAAA,gBAAAA;oBACAE,SAAAA,EAAWH,eAAAA;AACXgE,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAME,mBAAmBb,sBAAAA,CAAuBY,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAAA,CAAiBT,IAAAA,CAAAA;AAC1B,QAAA,CAAA;QAEA,OAAOD,eAAAA;AACT,IAAA,CAAA;IAEA,MAAMO,iBAAAA,GAAoB,CAACN,IAAAA,EAAW3D,OAAAA,GAAAA;AACpC,QAAA,OAAOqE,WAAAA,CAAS;AAAEN,YAAAA,OAAAA,EAASO,gBAAUhF,KAAAA,EAAOqE,IAAAA,CAAAA;AAAOvE,YAAAA;SAAO,EAAGY,OAAAA,CAAAA;AAC/D,IAAA,CAAA;AAEA;;MAGA,MAAMqD,mBAAmBkB,OAAAA,CAAK;QAAC,CAAA,EAAGvF,oBAAAA,CAAqB,MAAM,CAAC;QAAE,CAAA,EAAGC,oBAAAA,CAAqB,MAAM;AAAE,KAAA,CAAA;AAEhG;;MAGA,MAAM2B,gBAAAA,GAAmB,CAAC,EAAEC,GAAG,EAAEtB,MAAM,EAAO,EAAE,EAAEwB,MAAM,EAAO,GAAA;QAC7D,MAAMyD,QAAAA,GAAWC,SAAM,KAAA,EAAO;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAc5D,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAEtB,MAAAA,CAAAA;AAEvE,QAAA,IAAIiF,QAAAA,EAAU;YACZzD,MAAAA,CAAOF,GAAAA,CAAAA;AACT,QAAA;AACF,IAAA,CAAA;AAEA;;AAEC,MACD,MAAMkC,0BAAAA,GAA6B,CAAC,EAAE3B,SAAS,EAAEP,GAAG,EAAEC,KAAK,EAAO,EAAE,EAAEa,GAAG,EAAO,GAAA;AAC9E,QAAA,MAAM+C,oBAAoBC,OAAAA,CAAKC,8BAAAA,CAAAA;AAC/B,QAAA,IAAI,CAACxD,SAAAA,EAAW;AACd,YAAA;AACF,QAAA;QAEA,IAAIA,SAAAA,CAAUyD,IAAI,KAAK,UAAA,IAAczD,UAAU0D,MAAM,KAAK,iBAAiBhE,KAAAA,EAAO;YAChF,IAAIiE,KAAAA,CAAMnB,OAAO,CAAC9C,KAAAA,CAAAA,EAAQ;gBACxBa,GAAAA,CAAId,GAAAA,EAAKC,KAAAA,CAAM+C,GAAG,CAACa,iBAAAA,CAAAA,CAAAA;YACrB,CAAA,MAAO;AACL/C,gBAAAA,GAAAA,CAAId,KAAK6D,iBAAAA,CAAkB5D,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACF,QAAA;AACF,IAAA,CAAA;AAEA;;AAEC,MACD,MAAMH,6BAAAA,GAAgC,CAAC,EAAEE,GAAG,EAAEO,SAAS,EAAE7B,MAAM,EAAO,EAAE,EAAEwB,MAAM,EAAO,GAAA;QACrF,IAAIxB,MAAAA,CAAO2D,GAAG,KAAK,aAAA,IAAiB9B,aAAa,CAACwD,8BAAAA,CAA0BI,QAAQ,CAACnE,GAAAA,CAAAA,EAAM;YACzFE,MAAAA,CAAOF,GAAAA,CAAAA;AACT,QAAA;AACF,IAAA,CAAA;IAEA,MAAMuC,cAAAA,GAAiB,CAACnD,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMgF,uBAAuB1G,uBAAAA,CAAwBgB,MAAAA,CAAAA;AACrD,QAAA,MAAM2F,qBAAqBzG,qBAAAA,CAAsBc,MAAAA,CAAAA;QAEjD,MAAM4F,4BAAAA,GAA+BC,gBAAaH,oBAAAA,EAAsBC,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,OAAAA,CAAK;AAAIpF,YAAAA,GAAAA,MAAAA;AAAWf,YAAAA,GAAAA,gBAAAA;AAAqBiG,YAAAA,GAAAA;AAA6B,SAAA,CAAA;AAC/E,IAAA,CAAA;IAEA,MAAMtC,eAAAA,GAAkB,CAAC5C,MAAAA,GAAS,EAAE,GAAA;AAClC,QAAA,MAAMqF,wBAAwB9G,wBAAAA,CAAyBe,MAAAA,CAAAA;AACvD,QAAA,MAAM0F,uBAAuB1G,uBAAAA,CAAwBgB,MAAAA,CAAAA;AAErD,QAAA,OAAO8F,OAAAA,CAAK;AACPpF,YAAAA,GAAAA,MAAAA;AACAd,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACAoG,YAAAA,GAAAA,qBAAAA;AACAL,YAAAA,GAAAA,oBAAAA;AACHpG,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,IAAA,CAAA;IAEA,MAAMsB,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMgF,uBAAuB1G,uBAAAA,CAAwBgB,MAAAA,CAAAA;AACrD,QAAA,MAAM2F,qBAAqBzG,qBAAAA,CAAsBc,MAAAA,CAAAA;QAEjD,MAAM4F,4BAAAA,GAA+BC,gBAAaH,oBAAAA,EAAsBC,kBAAAA,CAAAA;AAExE,QAAA,OAAOG,OAAAA,CAAK;AACPpF,YAAAA,GAAAA,MAAAA;AACAd,YAAAA,GAAAA,aAAAA;AACAD,YAAAA,GAAAA,gBAAAA;AACAiG,YAAAA,GAAAA,4BAAAA;AACHtG,YAAAA,oBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAC,YAAAA,oBAAAA;AACAC,YAAAA;AACD,SAAA,CAAA;AACH,IAAA,CAAA;IAEA,OAAO;AACLsG,QAAAA,cAAAA,EAAgBjC,YAAAA,CAAaV,oBAAAA,CAAAA;AAC7B4C,QAAAA,aAAAA,EAAelC,YAAAA,CAAaH,mBAAAA,CAAAA;AAC5BsC,QAAAA,aAAAA,EAAenC,YAAAA,CAAavD,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"sanitize.js","sources":["../../../../../../../server/src/services/permission/permissions-manager/sanitize.ts"],"sourcesContent":["import { omit, pick, defaults, isEmpty, intersection, get, isObject, cloneDeep } from 'lodash';\nimport { subject as asSubject } from '@casl/ability';\n\nimport type { UID } from '@strapi/types';\n\nimport {\n  contentTypes,\n  traverseEntity,\n  sanitize,\n  async,\n  traverse,\n  createModelCache,\n} from '@strapi/utils';\nimport { createPermissionFieldsCache } from './permission-fields';\nimport { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user';\n\nconst {\n  visitors: { removePassword, expandWildcardPopulate },\n} = sanitize;\n\nconst {\n  constants,\n  isScalarAttribute,\n  getNonVisibleAttributes,\n  getNonWritableAttributes,\n  getWritableAttributes,\n} = contentTypes;\nconst {\n  ID_ATTRIBUTE,\n  DOC_ID_ATTRIBUTE,\n  CREATED_AT_ATTRIBUTE,\n  UPDATED_AT_ATTRIBUTE,\n  PUBLISHED_AT_ATTRIBUTE,\n  CREATED_BY_ATTRIBUTE,\n  UPDATED_BY_ATTRIBUTE,\n} = constants;\n\nconst COMPONENT_FIELDS = ['__component'];\nconst STATIC_FIELDS = [ID_ATTRIBUTE, DOC_ID_ATTRIBUTE];\n\nexport default ({ action, ability, model }: any) => {\n  const schema = strapi.getModel(model);\n\n  const { removeDisallowedFields } = sanitize.visitors;\n\n  // Create request-scoped model cache to avoid redundant getModel() calls\n  const modelCache = createModelCache(strapi.getModel.bind(strapi));\n\n  const ctx = {\n    schema,\n    getModel: modelCache.getModel,\n  };\n\n  const createSanitizeQuery = (options = {} as any) => {\n    const { fields } = options;\n\n    // TODO: sanitize relations to admin users in all sanitizers\n    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);\n\n    const createSanitizeFilters = (ctx: any) =>\n      async.pipe(\n        traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),\n        traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),\n        traverse.traverseQueryFilters(omitHiddenFields, ctx),\n        traverse.traverseQueryFilters(removePassword, ctx),\n        traverse.traverseQueryFilters(({ key, value }, { remove }) => {\n          if (isObject(value) && isEmpty(value)) {\n            remove(key);\n          }\n        }, ctx)\n      );\n\n    const createSanitizeSort = (ctx: any) =>\n      async.pipe(\n        traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),\n        traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),\n        traverse.traverseQuerySort(omitHiddenFields, ctx),\n        traverse.traverseQuerySort(removePassword, ctx),\n        traverse.traverseQuerySort(({ key, attribute, value }, { remove }) => {\n          if (!isScalarAttribute(attribute) && isEmpty(value)) {\n            remove(key);\n          }\n        }, ctx)\n      );\n\n    const createSanitizeFields = (ctx: any) =>\n      async.pipe(\n        traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),\n        traverse.traverseQueryFields(omitHiddenFields, ctx),\n        traverse.traverseQueryFields(removePassword, ctx)\n      );\n\n    const sanitizeFilters = createSanitizeFilters(ctx);\n    const sanitizeSort = createSanitizeSort(ctx);\n    const sanitizeFields = createSanitizeFields(ctx);\n\n    /** Sanitize nested filters, sort, and fields inside populate. */\n    const sanitizeNestedPopulate = async (\n      { key, value, schema, attribute, getModel }: any,\n      { set }: any\n    ) => {\n      if (attribute) {\n        return;\n      }\n\n      const nestedCtx = { schema, getModel };\n\n      if (key === 'sort') {\n        const sanitizedSort = await createSanitizeSort(nestedCtx)(value);\n        set(key, sanitizedSort);\n      }\n\n      if (key === 'filters') {\n        const sanitizedFilters = await createSanitizeFilters(nestedCtx)(value);\n        set(key, sanitizedFilters);\n      }\n\n      if (key === 'fields') {\n        const sanitizedFields = await createSanitizeFields(nestedCtx)(value);\n        set(key, sanitizedFields);\n      }\n    };\n\n    const sanitizePopulate = async.pipe(\n      traverse.traverseQueryPopulate(expandWildcardPopulate, ctx),\n      traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), ctx),\n      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, ctx),\n      traverse.traverseQueryPopulate(omitHiddenFields, ctx),\n      traverse.traverseQueryPopulate(removePassword, ctx),\n      traverse.traverseQueryPopulate(sanitizeNestedPopulate, ctx)\n    );\n\n    return async (query: any) => {\n      const sanitizedQuery = cloneDeep(query);\n\n      const [sanitizedFilters, sanitizedSort, sanitizedPopulate, sanitizedFields] =\n        await Promise.all([\n          query.filters ? sanitizeFilters(query.filters) : undefined,\n          query.sort ? sanitizeSort(query.sort) : undefined,\n          query.populate ? sanitizePopulate(query.populate) : undefined,\n          query.fields ? sanitizeFields(query.fields) : undefined,\n        ]);\n\n      if (sanitizedFilters !== undefined) sanitizedQuery.filters = sanitizedFilters;\n      if (sanitizedSort !== undefined) sanitizedQuery.sort = sanitizedSort;\n      if (sanitizedPopulate !== undefined) sanitizedQuery.populate = sanitizedPopulate;\n      if (sanitizedFields !== undefined) sanitizedQuery.fields = sanitizedFields;\n\n      return sanitizedQuery;\n    };\n  };\n\n  const createSanitizeOutput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getOutputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove unallowed fields from admin::user relations\n      traverseEntity(pickAllowedAdminUserFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove all fields of type 'password'\n      sanitize.sanitizers.sanitizePasswords({\n        schema,\n        getModel(uid: string) {\n          return strapi.getModel(uid as UID.Schema);\n        },\n      })\n    );\n  };\n\n  const createSanitizeInput = (options = {} as any) => {\n    const { fields } = options;\n\n    const permittedFields = fields.shouldIncludeAll ? null : getInputFields(fields.permitted);\n\n    return async.pipe(\n      // Remove fields hidden from the admin\n      traverseEntity(omitHiddenFields, ctx),\n      // Remove not allowed fields (RBAC)\n      traverseEntity(removeDisallowedFields(permittedFields), ctx),\n      // Remove roles from createdBy & updatedBy fields\n      omitCreatorRoles\n    );\n  };\n\n  const wrapSanitize = (createSanitizeFunction: any) => {\n    const { getPermissionFields } = createPermissionFieldsCache(ability);\n\n    const wrappedSanitize = async (data: unknown, options = {} as any): Promise<unknown> => {\n      if (Array.isArray(data)) {\n        return Promise.all(data.map((entity: unknown) => wrappedSanitize(entity, options)));\n      }\n\n      const { subject, action: actionOverride } = getDefaultOptions(data, options);\n\n      const { permittedFields, hasAtLeastOneRegistered, shouldIncludeAll } = getPermissionFields(\n        actionOverride,\n        subject\n      );\n\n      const sanitizeOptions = {\n        ...options,\n        fields: {\n          shouldIncludeAll,\n          permitted: permittedFields,\n          hasAtLeastOneRegistered,\n        },\n      };\n\n      const sanitizeFunction = createSanitizeFunction(sanitizeOptions);\n\n      return sanitizeFunction(data);\n    };\n\n    return wrappedSanitize;\n  };\n\n  const getDefaultOptions = (data: any, options: unknown) => {\n    return defaults({}, options, { subject: asSubject(model, data), action });\n  };\n\n  /**\n   * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses\n   */\n  const omitCreatorRoles = <T extends object>(data: T) =>\n    omit(data, [`${CREATED_BY_ATTRIBUTE}.roles`, `${UPDATED_BY_ATTRIBUTE}.roles`]);\n\n  /**\n   * Visitor used to remove hidden fields from the admin API responses\n   */\n  const omitHiddenFields = ({ key, schema }: any, { remove }: any) => {\n    const isHidden = get(schema, ['config', 'attributes', key, 'hidden'], false);\n\n    if (isHidden) {\n      remove(key);\n    }\n  };\n\n  /**\n   * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const pickAllowedAdminUserFields = ({ attribute, key, value }: any, { set }: any) => {\n    const pickAllowedFields = (user: object) => pick(user, ADMIN_USER_ALLOWED_FIELDS);\n    if (!attribute) {\n      return;\n    }\n\n    if (attribute.type === 'relation' && attribute.target === 'admin::user' && value) {\n      if (Array.isArray(value)) {\n        set(key, value.map(pickAllowedFields));\n      } else {\n        set(key, pickAllowedFields(value));\n      }\n    }\n  };\n\n  /**\n   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information\n   */\n  const omitDisallowedAdminUserFields = ({ key, attribute, schema }: any, { remove }: any) => {\n    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {\n      remove(key);\n    }\n  };\n\n  const getInputFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(writableAttributes, nonVisibleAttributes);\n\n    return [...new Set([...fields, ...COMPONENT_FIELDS, ...nonVisibleWritableAttributes])];\n  };\n\n  const getOutputFields = (fields = []) => {\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n\n    return [\n      ...new Set([\n        ...fields,\n        ...STATIC_FIELDS,\n        ...COMPONENT_FIELDS,\n        ...nonWritableAttributes,\n        ...nonVisibleAttributes,\n        CREATED_AT_ATTRIBUTE,\n        UPDATED_AT_ATTRIBUTE,\n      ]),\n    ];\n  };\n\n  const getQueryFields = (fields = []) => {\n    const nonVisibleAttributes = getNonVisibleAttributes(schema);\n    const writableAttributes = getWritableAttributes(schema);\n\n    const nonVisibleWritableAttributes = intersection(writableAttributes, nonVisibleAttributes);\n\n    return [\n      ...new Set([\n        ...fields,\n        ...STATIC_FIELDS,\n        ...COMPONENT_FIELDS,\n        ...nonVisibleWritableAttributes,\n        CREATED_AT_ATTRIBUTE,\n        UPDATED_AT_ATTRIBUTE,\n        PUBLISHED_AT_ATTRIBUTE,\n        CREATED_BY_ATTRIBUTE,\n        UPDATED_BY_ATTRIBUTE,\n      ]),\n    ];\n  };\n\n  return {\n    sanitizeOutput: wrapSanitize(createSanitizeOutput),\n    sanitizeInput: wrapSanitize(createSanitizeInput),\n    sanitizeQuery: wrapSanitize(createSanitizeQuery),\n  };\n};\n"],"names":["visitors","removePassword","expandWildcardPopulate","sanitize","constants","isScalarAttribute","getNonVisibleAttributes","getNonWritableAttributes","getWritableAttributes","contentTypes","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","CREATED_AT_ATTRIBUTE","UPDATED_AT_ATTRIBUTE","PUBLISHED_AT_ATTRIBUTE","CREATED_BY_ATTRIBUTE","UPDATED_BY_ATTRIBUTE","COMPONENT_FIELDS","STATIC_FIELDS","action","ability","model","schema","strapi","getModel","removeDisallowedFields","modelCache","createModelCache","bind","ctx","createSanitizeQuery","options","fields","permittedFields","shouldIncludeAll","getQueryFields","permitted","createSanitizeFilters","async","pipe","traverse","traverseQueryFilters","omitDisallowedAdminUserFields","omitHiddenFields","key","value","remove","isObject","isEmpty","createSanitizeSort","traverseQuerySort","attribute","createSanitizeFields","traverseQueryFields","sanitizeFilters","sanitizeSort","sanitizeFields","sanitizeNestedPopulate","set","nestedCtx","sanitizedSort","sanitizedFilters","sanitizedFields","sanitizePopulate","traverseQueryPopulate","query","sanitizedQuery","cloneDeep","sanitizedPopulate","Promise","all","filters","undefined","sort","populate","createSanitizeOutput","getOutputFields","traverseEntity","pickAllowedAdminUserFields","sanitizers","sanitizePasswords","uid","createSanitizeInput","getInputFields","omitCreatorRoles","wrapSanitize","createSanitizeFunction","getPermissionFields","createPermissionFieldsCache","wrappedSanitize","data","Array","isArray","map","entity","subject","actionOverride","getDefaultOptions","hasAtLeastOneRegistered","sanitizeOptions","sanitizeFunction","defaults","asSubject","omit","isHidden","get","pickAllowedFields","user","pick","ADMIN_USER_ALLOWED_FIELDS","type","target","includes","nonVisibleAttributes","writableAttributes","nonVisibleWritableAttributes","intersection","Set","nonWritableAttributes","sanitizeOutput","sanitizeInput","sanitizeQuery"],"mappings":";;;;;;;;AAgBA,MAAM,EACJA,UAAU,EAAEC,cAAc,EAAEC,sBAAsB,EAAE,EACrD,GAAGC,cAAAA;AAEJ,MAAM,EACJC,SAAS,EACTC,iBAAiB,EACjBC,uBAAuB,EACvBC,wBAAwB,EACxBC,qBAAqB,EACtB,GAAGC,kBAAAA;AACJ,MAAM,EACJC,YAAY,EACZC,gBAAgB,EAChBC,oBAAoB,EACpBC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,oBAAoB,EACrB,GAAGZ,SAAAA;AAEJ,MAAMa,gBAAAA,GAAmB;AAAC,IAAA;AAAc,CAAA;AACxC,MAAMC,aAAAA,GAAgB;AAACR,IAAAA,YAAAA;AAAcC,IAAAA;AAAiB,CAAA;AAEtD,4BAAe,CAAA,CAAC,EAAEQ,MAAM,WAAEC,SAAO,EAAEC,KAAK,EAAO,GAAA;IAC7C,MAAMC,MAAAA,GAASC,MAAAA,CAAOC,QAAQ,CAACH,KAAAA,CAAAA;AAE/B,IAAA,MAAM,EAAEI,sBAAsB,EAAE,GAAGtB,eAASH,QAAQ;;AAGpD,IAAA,MAAM0B,aAAaC,sBAAAA,CAAiBJ,MAAAA,CAAOC,QAAQ,CAACI,IAAI,CAACL,MAAAA,CAAAA,CAAAA;AAEzD,IAAA,MAAMM,GAAAA,GAAM;AACVP,QAAAA,MAAAA;AACAE,QAAAA,QAAAA,EAAUE,WAAWF;AACvB,KAAA;AAEA,IAAA,MAAMM,mBAAAA,GAAsB,CAACC,OAAAA,GAAU,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;;AAGnB,QAAA,MAAME,kBAAkBD,MAAAA,CAAOE,gBAAgB,GAAG,IAAA,GAAOC,cAAAA,CAAeH,OAAOI,SAAS,CAAA;AAExF,QAAA,MAAMC,wBAAwB,CAACR,GAAAA,GAC7BS,WAAAA,CAAMC,IAAI,CACRC,cAAAA,CAASC,oBAAoB,CAAChB,sBAAAA,CAAuBQ,kBAAkBJ,GAAAA,CAAAA,EACvEW,cAAAA,CAASC,oBAAoB,CAACC,6BAAAA,EAA+Bb,MAC7DW,cAAAA,CAASC,oBAAoB,CAACE,gBAAAA,EAAkBd,MAChDW,cAAAA,CAASC,oBAAoB,CAACxC,cAAAA,EAAgB4B,GAAAA,CAAAA,EAC9CW,eAASC,oBAAoB,CAAC,CAAC,EAAEG,GAAG,EAAEC,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;gBACvD,IAAIC,UAAAA,CAASF,KAAAA,CAAAA,IAAUG,SAAAA,CAAQH,KAAAA,CAAAA,EAAQ;oBACrCC,MAAAA,CAAOF,GAAAA,CAAAA;AACT,gBAAA;YACF,CAAA,EAAGf,GAAAA,CAAAA,CAAAA;AAGP,QAAA,MAAMoB,qBAAqB,CAACpB,GAAAA,GAC1BS,YAAMC,IAAI,CACRC,eAASU,iBAAiB,CAACzB,sBAAAA,CAAuBQ,eAAAA,CAAAA,EAAkBJ,MACpEW,cAAAA,CAASU,iBAAiB,CAACR,6BAAAA,EAA+Bb,GAAAA,CAAAA,EAC1DW,eAASU,iBAAiB,CAACP,gBAAAA,EAAkBd,GAAAA,CAAAA,EAC7CW,eAASU,iBAAiB,CAACjD,gBAAgB4B,GAAAA,CAAAA,EAC3CW,cAAAA,CAASU,iBAAiB,CAAC,CAAC,EAAEN,GAAG,EAAEO,SAAS,EAAEN,KAAK,EAAE,EAAE,EAAEC,MAAM,EAAE,GAAA;AAC/D,gBAAA,IAAI,CAACzC,iBAAAA,CAAkB8C,SAAAA,CAAAA,IAAcH,SAAAA,CAAQH,KAAAA,CAAAA,EAAQ;oBACnDC,MAAAA,CAAOF,GAAAA,CAAAA;AACT,gBAAA;YACF,CAAA,EAAGf,GAAAA,CAAAA,CAAAA;QAGP,MAAMuB,oBAAAA,GAAuB,CAACvB,GAAAA,GAC5BS,WAAAA,CAAMC,IAAI,CACRC,cAAAA,CAASa,mBAAmB,CAAC5B,sBAAAA,CAAuBQ,kBAAkBJ,GAAAA,CAAAA,EACtEW,cAAAA,CAASa,mBAAmB,CAACV,gBAAAA,EAAkBd,MAC/CW,cAAAA,CAASa,mBAAmB,CAACpD,cAAAA,EAAgB4B,GAAAA,CAAAA,CAAAA;AAGjD,QAAA,MAAMyB,kBAAkBjB,qBAAAA,CAAsBR,GAAAA,CAAAA;AAC9C,QAAA,MAAM0B,eAAeN,kBAAAA,CAAmBpB,GAAAA,CAAAA;AACxC,QAAA,MAAM2B,iBAAiBJ,oBAAAA,CAAqBvB,GAAAA,CAAAA;AAE5C,0EACA,MAAM4B,sBAAAA,GAAyB,OAC7B,EAAEb,GAAG,EAAEC,KAAK,EAAEvB,MAAM,EAAE6B,SAAS,EAAE3B,QAAQ,EAAO,EAChD,EAAEkC,GAAG,EAAO,GAAA;AAEZ,YAAA,IAAIP,SAAAA,EAAW;AACb,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMQ,SAAAA,GAAY;AAAErC,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAS,aAAA;AAErC,YAAA,IAAIoB,QAAQ,MAAA,EAAQ;gBAClB,MAAMgB,aAAAA,GAAgB,MAAMX,kBAAAA,CAAmBU,SAAAA,CAAAA,CAAWd,KAAAA,CAAAA;AAC1Da,gBAAAA,GAAAA,CAAId,GAAAA,EAAKgB,aAAAA,CAAAA;AACX,YAAA;AAEA,YAAA,IAAIhB,QAAQ,SAAA,EAAW;gBACrB,MAAMiB,gBAAAA,GAAmB,MAAMxB,qBAAAA,CAAsBsB,SAAAA,CAAAA,CAAWd,KAAAA,CAAAA;AAChEa,gBAAAA,GAAAA,CAAId,GAAAA,EAAKiB,gBAAAA,CAAAA;AACX,YAAA;AAEA,YAAA,IAAIjB,QAAQ,QAAA,EAAU;gBACpB,MAAMkB,eAAAA,GAAkB,MAAMV,oBAAAA,CAAqBO,SAAAA,CAAAA,CAAWd,KAAAA,CAAAA;AAC9Da,gBAAAA,GAAAA,CAAId,GAAAA,EAAKkB,eAAAA,CAAAA;AACX,YAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMC,gBAAAA,GAAmBzB,WAAAA,CAAMC,IAAI,CACjCC,eAASwB,qBAAqB,CAAC9D,sBAAAA,EAAwB2B,GAAAA,CAAAA,EACvDW,cAAAA,CAASwB,qBAAqB,CAACvC,sBAAAA,CAAuBQ,kBAAkBJ,GAAAA,CAAAA,EACxEW,cAAAA,CAASwB,qBAAqB,CAACtB,6BAAAA,EAA+Bb,GAAAA,CAAAA,EAC9DW,cAAAA,CAASwB,qBAAqB,CAACrB,gBAAAA,EAAkBd,GAAAA,CAAAA,EACjDW,cAAAA,CAASwB,qBAAqB,CAAC/D,cAAAA,EAAgB4B,GAAAA,CAAAA,EAC/CW,cAAAA,CAASwB,qBAAqB,CAACP,sBAAAA,EAAwB5B,GAAAA,CAAAA,CAAAA;AAGzD,QAAA,OAAO,OAAOoC,KAAAA,GAAAA;AACZ,YAAA,MAAMC,iBAAiBC,WAAAA,CAAUF,KAAAA,CAAAA;YAEjC,MAAM,CAACJ,kBAAkBD,aAAAA,EAAeQ,iBAAAA,EAAmBN,gBAAgB,GACzE,MAAMO,OAAAA,CAAQC,GAAG,CAAC;AAChBL,gBAAAA,KAAAA,CAAMM,OAAO,GAAGjB,eAAAA,CAAgBW,KAAAA,CAAMM,OAAO,CAAA,GAAIC,SAAAA;AACjDP,gBAAAA,KAAAA,CAAMQ,IAAI,GAAGlB,YAAAA,CAAaU,KAAAA,CAAMQ,IAAI,CAAA,GAAID,SAAAA;AACxCP,gBAAAA,KAAAA,CAAMS,QAAQ,GAAGX,gBAAAA,CAAiBE,KAAAA,CAAMS,QAAQ,CAAA,GAAIF,SAAAA;AACpDP,gBAAAA,KAAAA,CAAMjC,MAAM,GAAGwB,cAAAA,CAAeS,KAAAA,CAAMjC,MAAM,CAAA,GAAIwC;AAC/C,aAAA,CAAA;AAEH,YAAA,IAAIX,gBAAAA,KAAqBW,SAAAA,EAAWN,cAAAA,CAAeK,OAAO,GAAGV,gBAAAA;AAC7D,YAAA,IAAID,aAAAA,KAAkBY,SAAAA,EAAWN,cAAAA,CAAeO,IAAI,GAAGb,aAAAA;AACvD,YAAA,IAAIQ,iBAAAA,KAAsBI,SAAAA,EAAWN,cAAAA,CAAeQ,QAAQ,GAAGN,iBAAAA;AAC/D,YAAA,IAAIN,eAAAA,KAAoBU,SAAAA,EAAWN,cAAAA,CAAelC,MAAM,GAAG8B,eAAAA;YAE3D,OAAOI,cAAAA;AACT,QAAA,CAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMS,oBAAAA,GAAuB,CAAC5C,OAAAA,GAAU,EAAS,GAAA;QAC/C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAAA,CAAOE,gBAAgB,GAAG,IAAA,GAAO0C,eAAAA,CAAgB5C,OAAOI,SAAS,CAAA;QAEzF,OAAOE,WAAAA,CAAMC,IAAI;QAEfsC,oBAAAA,CAAelC,gBAAAA,EAAkBd;QAEjCgD,oBAAAA,CAAeC,0BAAAA,EAA4BjD;QAE3CgD,oBAAAA,CAAepD,sBAAAA,CAAuBQ,eAAAA,CAAAA,EAAkBJ,GAAAA,CAAAA;QAExD1B,cAAAA,CAAS4E,UAAU,CAACC,iBAAiB,CAAC;AACpC1D,YAAAA,MAAAA;AACAE,YAAAA,QAAAA,CAAAA,CAASyD,GAAW,EAAA;gBAClB,OAAO1D,MAAAA,CAAOC,QAAQ,CAACyD,GAAAA,CAAAA;AACzB,YAAA;AACF,SAAA,CAAA,CAAA;AAEJ,IAAA,CAAA;AAEA,IAAA,MAAMC,mBAAAA,GAAsB,CAACnD,OAAAA,GAAU,EAAS,GAAA;QAC9C,MAAM,EAAEC,MAAM,EAAE,GAAGD,OAAAA;AAEnB,QAAA,MAAME,kBAAkBD,MAAAA,CAAOE,gBAAgB,GAAG,IAAA,GAAOiD,cAAAA,CAAenD,OAAOI,SAAS,CAAA;QAExF,OAAOE,WAAAA,CAAMC,IAAI;QAEfsC,oBAAAA,CAAelC,gBAAAA,EAAkBd;QAEjCgD,oBAAAA,CAAepD,sBAAAA,CAAuBQ,eAAAA,CAAAA,EAAkBJ,GAAAA,CAAAA;AAExDuD,QAAAA,gBAAAA,CAAAA;AAEJ,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,CAACC,sBAAAA,GAAAA;AACpB,QAAA,MAAM,EAAEC,mBAAmB,EAAE,GAAGC,4CAAAA,CAA4BpE,SAAAA,CAAAA;AAE5D,QAAA,MAAMqE,eAAAA,GAAkB,OAAOC,IAAAA,EAAe3D,OAAAA,GAAU,EAAS,GAAA;YAC/D,IAAI4D,KAAAA,CAAMC,OAAO,CAACF,IAAAA,CAAAA,EAAO;gBACvB,OAAOrB,OAAAA,CAAQC,GAAG,CAACoB,IAAAA,CAAKG,GAAG,CAAC,CAACC,MAAAA,GAAoBL,eAAAA,CAAgBK,MAAAA,EAAQ/D,OAAAA,CAAAA,CAAAA,CAAAA;AAC3E,YAAA;YAEA,MAAM,EAAEgE,OAAO,EAAE5E,MAAAA,EAAQ6E,cAAc,EAAE,GAAGC,kBAAkBP,IAAAA,EAAM3D,OAAAA,CAAAA;YAEpE,MAAM,EAAEE,eAAe,EAAEiE,uBAAuB,EAAEhE,gBAAgB,EAAE,GAAGqD,mBAAAA,CACrES,cAAAA,EACAD,OAAAA,CAAAA;AAGF,YAAA,MAAMI,eAAAA,GAAkB;AACtB,gBAAA,GAAGpE,OAAO;gBACVC,MAAAA,EAAQ;AACNE,oBAAAA,gBAAAA;oBACAE,SAAAA,EAAWH,eAAAA;AACXiE,oBAAAA;AACF;AACF,aAAA;AAEA,YAAA,MAAME,mBAAmBd,sBAAAA,CAAuBa,eAAAA,CAAAA;AAEhD,YAAA,OAAOC,gBAAAA,CAAiBV,IAAAA,CAAAA;AAC1B,QAAA,CAAA;QAEA,OAAOD,eAAAA;AACT,IAAA,CAAA;IAEA,MAAMQ,iBAAAA,GAAoB,CAACP,IAAAA,EAAW3D,OAAAA,GAAAA;QACpC,OAAOsE,UAAAA,CAAS,EAAC,EAAGtE,OAAAA,EAAS;AAAEgE,YAAAA,OAAAA,EAASO,gBAAUjF,KAAAA,EAAOqE,IAAAA,CAAAA;AAAOvE,YAAAA;AAAO,SAAA,CAAA;AACzE,IAAA,CAAA;AAEA;;AAEC,MACD,MAAMiE,gBAAAA,GAAmB,CAAmBM,IAAAA,GAC1Ca,OAAKb,IAAAA,EAAM;YAAC,CAAA,EAAG3E,oBAAAA,CAAqB,MAAM,CAAC;YAAE,CAAA,EAAGC,oBAAAA,CAAqB,MAAM;AAAE,SAAA,CAAA;AAE/E;;MAGA,MAAM2B,gBAAAA,GAAmB,CAAC,EAAEC,GAAG,EAAEtB,MAAM,EAAO,EAAE,EAAEwB,MAAM,EAAO,GAAA;QAC7D,MAAM0D,QAAAA,GAAWC,MAAInF,MAAAA,EAAQ;AAAC,YAAA,QAAA;AAAU,YAAA,YAAA;AAAcsB,YAAAA,GAAAA;AAAK,YAAA;SAAS,EAAE,KAAA,CAAA;AAEtE,QAAA,IAAI4D,QAAAA,EAAU;YACZ1D,MAAAA,CAAOF,GAAAA,CAAAA;AACT,QAAA;AACF,IAAA,CAAA;AAEA;;AAEC,MACD,MAAMkC,0BAAAA,GAA6B,CAAC,EAAE3B,SAAS,EAAEP,GAAG,EAAEC,KAAK,EAAO,EAAE,EAAEa,GAAG,EAAO,GAAA;AAC9E,QAAA,MAAMgD,iBAAAA,GAAoB,CAACC,MAAAA,GAAiBC,MAAAA,CAAKD,MAAAA,EAAME,8BAAAA,CAAAA;AACvD,QAAA,IAAI,CAAC1D,SAAAA,EAAW;AACd,YAAA;AACF,QAAA;QAEA,IAAIA,SAAAA,CAAU2D,IAAI,KAAK,UAAA,IAAc3D,UAAU4D,MAAM,KAAK,iBAAiBlE,KAAAA,EAAO;YAChF,IAAI8C,KAAAA,CAAMC,OAAO,CAAC/C,KAAAA,CAAAA,EAAQ;gBACxBa,GAAAA,CAAId,GAAAA,EAAKC,KAAAA,CAAMgD,GAAG,CAACa,iBAAAA,CAAAA,CAAAA;YACrB,CAAA,MAAO;AACLhD,gBAAAA,GAAAA,CAAId,KAAK8D,iBAAAA,CAAkB7D,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACF,QAAA;AACF,IAAA,CAAA;AAEA;;AAEC,MACD,MAAMH,6BAAAA,GAAgC,CAAC,EAAEE,GAAG,EAAEO,SAAS,EAAE7B,MAAM,EAAO,EAAE,EAAEwB,MAAM,EAAO,GAAA;QACrF,IAAIxB,MAAAA,CAAO2D,GAAG,KAAK,aAAA,IAAiB9B,aAAa,CAAC0D,8BAAAA,CAA0BG,QAAQ,CAACpE,GAAAA,CAAAA,EAAM;YACzFE,MAAAA,CAAOF,GAAAA,CAAAA;AACT,QAAA;AACF,IAAA,CAAA;IAEA,MAAMuC,cAAAA,GAAiB,CAACnD,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMiF,uBAAuB3G,uBAAAA,CAAwBgB,MAAAA,CAAAA;AACrD,QAAA,MAAM4F,qBAAqB1G,qBAAAA,CAAsBc,MAAAA,CAAAA;QAEjD,MAAM6F,4BAAAA,GAA+BC,eAAaF,kBAAAA,EAAoBD,oBAAAA,CAAAA;QAEtE,OAAO;AAAI,YAAA,GAAA,IAAII,GAAAA,CAAI;AAAIrF,gBAAAA,GAAAA,MAAAA;AAAWf,gBAAAA,GAAAA,gBAAAA;AAAqBkG,gBAAAA,GAAAA;AAA6B,aAAA;AAAE,SAAA;AACxF,IAAA,CAAA;IAEA,MAAMvC,eAAAA,GAAkB,CAAC5C,MAAAA,GAAS,EAAE,GAAA;AAClC,QAAA,MAAMsF,wBAAwB/G,wBAAAA,CAAyBe,MAAAA,CAAAA;AACvD,QAAA,MAAM2F,uBAAuB3G,uBAAAA,CAAwBgB,MAAAA,CAAAA;QAErD,OAAO;AACF,YAAA,GAAA,IAAI+F,GAAAA,CAAI;AACNrF,gBAAAA,GAAAA,MAAAA;AACAd,gBAAAA,GAAAA,aAAAA;AACAD,gBAAAA,GAAAA,gBAAAA;AACAqG,gBAAAA,GAAAA,qBAAAA;AACAL,gBAAAA,GAAAA,oBAAAA;AACHrG,gBAAAA,oBAAAA;AACAC,gBAAAA;AACD,aAAA;AACF,SAAA;AACH,IAAA,CAAA;IAEA,MAAMsB,cAAAA,GAAiB,CAACH,MAAAA,GAAS,EAAE,GAAA;AACjC,QAAA,MAAMiF,uBAAuB3G,uBAAAA,CAAwBgB,MAAAA,CAAAA;AACrD,QAAA,MAAM4F,qBAAqB1G,qBAAAA,CAAsBc,MAAAA,CAAAA;QAEjD,MAAM6F,4BAAAA,GAA+BC,eAAaF,kBAAAA,EAAoBD,oBAAAA,CAAAA;QAEtE,OAAO;AACF,YAAA,GAAA,IAAII,GAAAA,CAAI;AACNrF,gBAAAA,GAAAA,MAAAA;AACAd,gBAAAA,GAAAA,aAAAA;AACAD,gBAAAA,GAAAA,gBAAAA;AACAkG,gBAAAA,GAAAA,4BAAAA;AACHvG,gBAAAA,oBAAAA;AACAC,gBAAAA,oBAAAA;AACAC,gBAAAA,sBAAAA;AACAC,gBAAAA,oBAAAA;AACAC,gBAAAA;AACD,aAAA;AACF,SAAA;AACH,IAAA,CAAA;IAEA,OAAO;AACLuG,QAAAA,cAAAA,EAAgBlC,YAAAA,CAAaV,oBAAAA,CAAAA;AAC7B6C,QAAAA,aAAAA,EAAenC,YAAAA,CAAaH,mBAAAA,CAAAA;AAC5BuC,QAAAA,aAAAA,EAAepC,YAAAA,CAAavD,mBAAAA;AAC9B,KAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/services/permission/permissions-manager/sanitize.mjs

@@ -1,5 +1,5 @@
+import { defaults, cloneDeep, intersection, isObject, isEmpty, get, omit, pick } from 'lodash';
 import { subject } from '@casl/ability';
-import { omit, isArray, defaults, cloneDeep, intersection, uniq, isObject, isEmpty, getOr, pick } from 'lodash/fp';
 import { sanitize, contentTypes, createModelCache, async, traverse, traverseEntity } from '@strapi/utils';
 import { createPermissionFieldsCache } from './permission-fields.mjs';
 import { ADMIN_USER_ALLOWED_FIELDS } from '../../../domain/user.mjs';
@@ -103,7 +103,7 @@ var createSanitizeHelpers = (({ action, ability, model })=>{
     const wrapSanitize = (createSanitizeFunction)=>{
         const { getPermissionFields } = createPermissionFieldsCache(ability);
         const wrappedSanitize = async (data, options = {})=>{
-            if (isArray(data)) {
+            if (Array.isArray(data)) {
                 return Promise.all(data.map((entity)=>wrappedSanitize(entity, options)));
             }
             const { subject, action: actionOverride } = getDefaultOptions(data, options);
@@ -122,26 +122,26 @@ var createSanitizeHelpers = (({ action, ability, model })=>{
         return wrappedSanitize;
     };
     const getDefaultOptions = (data, options)=>{
-        return defaults({
+        return defaults({}, options, {
             subject: subject(model, data),
             action
-        }, options);
+        });
     };
     /**
    * Omit creator fields' (createdBy & updatedBy) roles from the admin API responses
-   */ const omitCreatorRoles = omit([
-        `${CREATED_BY_ATTRIBUTE}.roles`,
-        `${UPDATED_BY_ATTRIBUTE}.roles`
-    ]);
+   */ const omitCreatorRoles = (data)=>omit(data, [
+            `${CREATED_BY_ATTRIBUTE}.roles`,
+            `${UPDATED_BY_ATTRIBUTE}.roles`
+        ]);
     /**
    * Visitor used to remove hidden fields from the admin API responses
    */ const omitHiddenFields = ({ key, schema }, { remove })=>{
-        const isHidden = getOr(false, [
+        const isHidden = get(schema, [
             'config',
             'attributes',
             key,
             'hidden'
-        ], schema);
+        ], false);
         if (isHidden) {
             remove(key);
         }
@@ -149,7 +149,7 @@ var createSanitizeHelpers = (({ action, ability, model })=>{
     /**
    * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information
    */ const pickAllowedAdminUserFields = ({ attribute, key, value }, { set })=>{
-        const pickAllowedFields = pick(ADMIN_USER_ALLOWED_FIELDS);
+        const pickAllowedFields = (user)=>pick(user, ADMIN_USER_ALLOWED_FIELDS);
         if (!attribute) {
             return;
         }
@@ -171,41 +171,47 @@ var createSanitizeHelpers = (({ action, ability, model })=>{
     const getInputFields = (fields = [])=>{
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
         const writableAttributes = getWritableAttributes(schema);
-        const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);
-        return uniq([
-            ...fields,
-            ...COMPONENT_FIELDS,
-            ...nonVisibleWritableAttributes
-        ]);
+        const nonVisibleWritableAttributes = intersection(writableAttributes, nonVisibleAttributes);
+        return [
+            ...new Set([
+                ...fields,
+                ...COMPONENT_FIELDS,
+                ...nonVisibleWritableAttributes
+            ])
+        ];
     };
     const getOutputFields = (fields = [])=>{
         const nonWritableAttributes = getNonWritableAttributes(schema);
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
-        return uniq([
-            ...fields,
-            ...STATIC_FIELDS,
-            ...COMPONENT_FIELDS,
-            ...nonWritableAttributes,
-            ...nonVisibleAttributes,
-            CREATED_AT_ATTRIBUTE,
-            UPDATED_AT_ATTRIBUTE
-        ]);
+        return [
+            ...new Set([
+                ...fields,
+                ...STATIC_FIELDS,
+                ...COMPONENT_FIELDS,
+                ...nonWritableAttributes,
+                ...nonVisibleAttributes,
+                CREATED_AT_ATTRIBUTE,
+                UPDATED_AT_ATTRIBUTE
+            ])
+        ];
     };
     const getQueryFields = (fields = [])=>{
         const nonVisibleAttributes = getNonVisibleAttributes(schema);
         const writableAttributes = getWritableAttributes(schema);
-        const nonVisibleWritableAttributes = intersection(nonVisibleAttributes, writableAttributes);
-        return uniq([
-            ...fields,
-            ...STATIC_FIELDS,
-            ...COMPONENT_FIELDS,
-            ...nonVisibleWritableAttributes,
-            CREATED_AT_ATTRIBUTE,
-            UPDATED_AT_ATTRIBUTE,
-            PUBLISHED_AT_ATTRIBUTE,
-            CREATED_BY_ATTRIBUTE,
-            UPDATED_BY_ATTRIBUTE
-        ]);
+        const nonVisibleWritableAttributes = intersection(writableAttributes, nonVisibleAttributes);
+        return [
+            ...new Set([
+                ...fields,
+                ...STATIC_FIELDS,
+                ...COMPONENT_FIELDS,
+                ...nonVisibleWritableAttributes,
+                CREATED_AT_ATTRIBUTE,
+                UPDATED_AT_ATTRIBUTE,
+                PUBLISHED_AT_ATTRIBUTE,
+                CREATED_BY_ATTRIBUTE,
+                UPDATED_BY_ATTRIBUTE
+            ])
+        ];
     };
     return {
         sanitizeOutput: wrapSanitize(createSanitizeOutput),