@strapi/admin 5.56.0 → 5.57.0

package/dist/server/server/src/audit-logs/webhooks.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 
 const AUDITED_EVENTS = {
     WEBHOOK_CREATE: 'webhook.create',
@@ -58,7 +58,7 @@ const getWebhookChanges = (previous, next)=>{
     const changes = {};
     for (const field of AUDITED_FIELDS){
         // The url is compared as stored, so a change to its stripped part is recorded too.
-        const changed = field === 'url' ? previous.url !== next.url : !fp.isEqual(before[field], after[field]);
+        const changed = field === 'url' ? previous.url !== next.url : !_.isEqual(before[field], after[field]);
         if (changed) {
             changes[field] = {
                 before: before[field],

package/dist/server/server/src/audit-logs/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash/fp';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;;;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,WAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;;;;;"}
+{"version":3,"file":"webhooks.js","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;;;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,UAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;;;;;"}

package/dist/server/server/src/audit-logs/webhooks.mjs

@@ -1,4 +1,4 @@
-import { isEqual } from 'lodash/fp';
+import { isEqual } from 'lodash';
 
 const AUDITED_EVENTS = {
     WEBHOOK_CREATE: 'webhook.create',

package/dist/server/server/src/audit-logs/webhooks.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.mjs","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash/fp';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,QAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;"}
+{"version":3,"file":"webhooks.mjs","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,QAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;"}

package/dist/server/server/src/bootstrap.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var utils = require('@strapi/utils');
 var index = require('./utils/index.js');
 var token = require('./services/token.js');
@@ -77,7 +77,7 @@ const syncAuthSettings = async ()=>{
     const adminAuthSettings = await adminStore.get({
         key: 'auth'
     });
-    const newAuthSettings = fp.merge(defaultAdminAuthSettings, adminAuthSettings);
+    const newAuthSettings = _.merge({}, defaultAdminAuthSettings, adminAuthSettings);
     const roleExists = await index.getService('role').exists({
         id: newAuthSettings.providers.defaultRole
     });
@@ -92,8 +92,10 @@ const syncAuthSettings = async ()=>{
 };
 const syncAPITokensPermissions = async ()=>{
     const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
-    const permissionsInDB = await utils.async.pipe(strapi.db.query('admin::api-token-permission').findMany, fp.map('action'))();
-    const unknownPermissions = fp.uniq(fp.difference(permissionsInDB, validPermissions));
+    const permissionsInDB = await utils.async.pipe(strapi.db.query('admin::api-token-permission').findMany, (permissions)=>_.map(permissions, 'action'))();
+    const unknownPermissions = [
+        ...new Set(_.difference(permissionsInDB, validPermissions))
+    ];
     if (unknownPermissions.length > 0) {
         await strapi.db.query('admin::api-token-permission').deleteMany({
             where: {

package/dist/server/server/src/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","uniq","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;;;AAmBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,iBAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,qBAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,iBAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,wBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,gBAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,gBAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,iBAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,gBAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,SAAMvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,gBAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAAA,GAAkB,MAAMC,WAAAA,CAAMC,IAAI,CACtCnD,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,6BAAA,CAAA,CAA+BC,QAAQ,EACvDI,MAAAA,CAAI,QAAA,CAAA,CAAA,EAAA;IAGN,MAAM0B,kBAAAA,GAAqBC,OAAAA,CAAKC,aAAAA,CAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,qBAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,8CAAAA;IAC5C,MAAMC,wBAAAA,GACJH,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,wCAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,2CAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,+CAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,yCAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,gBAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,gBAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,gBAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,gBAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,gBAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}
+{"version":3,"file":"bootstrap.js","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { map, merge, difference } from 'lodash';\n\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge({}, defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    (permissions) => map(permissions, 'action')\n  )();\n\n  const unknownPermissions = [...new Set(difference(permissionsInDB, validPermissions))];\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","Set","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;;;AAoBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,iBAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,qBAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,iBAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,wBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,gBAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,gBAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,iBAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,gBAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC7D,IAAA,MAAMC,eAAAA,GAAkBC,OAAAA,CAAM,EAAC,EAAGvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAE5D,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,gBAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,kBAAkB,MAAMC,WAAAA,CAAMC,IAAI,CACtCnD,OAAOC,EAAE,CAACoB,KAAK,CAAC,+BAA+BC,QAAQ,EACvD,CAACwB,WAAAA,GAAgBpB,MAAIoB,WAAAA,EAAa,QAAA,CAAA,CAAA,EAAA;AAGpC,IAAA,MAAMM,kBAAAA,GAAqB;WAAI,IAAIC,GAAAA,CAAIC,aAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA;AAAmB,KAAA;IAEtF,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,qBAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,8CAAAA;IAC5C,MAAMC,wBAAAA,GACJH,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,wCAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,2CAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,+CAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,yCAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,gBAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,gBAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,gBAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,gBAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,gBAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}

package/dist/server/server/src/bootstrap.mjs

@@ -1,4 +1,4 @@
-import { merge, map, uniq, difference } from 'lodash/fp';
+import { merge, map, difference } from 'lodash';
 import { async } from '@strapi/utils';
 import { getService } from './utils/index.mjs';
 import { getTokenOptions, expiresInToSeconds, hasUserConfiguredAuthOptionsExpiresIn } from './services/token.mjs';
@@ -75,7 +75,7 @@ const syncAuthSettings = async ()=>{
     const adminAuthSettings = await adminStore.get({
         key: 'auth'
     });
-    const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);
+    const newAuthSettings = merge({}, defaultAdminAuthSettings, adminAuthSettings);
     const roleExists = await getService('role').exists({
         id: newAuthSettings.providers.defaultRole
     });
@@ -90,8 +90,10 @@ const syncAuthSettings = async ()=>{
 };
 const syncAPITokensPermissions = async ()=>{
     const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
-    const permissionsInDB = await async.pipe(strapi.db.query('admin::api-token-permission').findMany, map('action'))();
-    const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));
+    const permissionsInDB = await async.pipe(strapi.db.query('admin::api-token-permission').findMany, (permissions)=>map(permissions, 'action'))();
+    const unknownPermissions = [
+        ...new Set(difference(permissionsInDB, validPermissions))
+    ];
     if (unknownPermissions.length > 0) {
         await strapi.db.query('admin::api-token-permission').deleteMany({
             where: {

package/dist/server/server/src/bootstrap.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.mjs","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","uniq","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;AAmBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,WAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,aAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,WAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,gBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,UAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,UAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,WAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,UAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,MAAMvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,UAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAAA,GAAkB,MAAMC,KAAAA,CAAMC,IAAI,CACtCnD,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,6BAAA,CAAA,CAA+BC,QAAQ,EACvDI,GAAAA,CAAI,QAAA,CAAA,CAAA,EAAA;IAGN,MAAM0B,kBAAAA,GAAqBC,IAAAA,CAAKC,UAAAA,CAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,eAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,kCAAAA;IAC5C,MAAMC,wBAAAA,GACJH,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,4BAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,qCAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,mCAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,6BAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,UAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,UAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,UAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,UAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,UAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}
+{"version":3,"file":"bootstrap.mjs","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { map, merge, difference } from 'lodash';\n\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge({}, defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    (permissions) => map(permissions, 'action')\n  )();\n\n  const unknownPermissions = [...new Set(difference(permissionsInDB, validPermissions))];\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","Set","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;AAoBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,WAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,aAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,WAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,gBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,UAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,UAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,WAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,UAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC7D,IAAA,MAAMC,eAAAA,GAAkBC,KAAAA,CAAM,EAAC,EAAGvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAE5D,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,UAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,kBAAkB,MAAMC,KAAAA,CAAMC,IAAI,CACtCnD,OAAOC,EAAE,CAACoB,KAAK,CAAC,+BAA+BC,QAAQ,EACvD,CAACwB,WAAAA,GAAgBpB,IAAIoB,WAAAA,EAAa,QAAA,CAAA,CAAA,EAAA;AAGpC,IAAA,MAAMM,kBAAAA,GAAqB;WAAI,IAAIC,GAAAA,CAAIC,WAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA;AAAmB,KAAA;IAEtF,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,eAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,kCAAAA;IAC5C,MAAMC,wBAAAA,GACJH,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,4BAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,qCAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,mCAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,6BAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,UAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,UAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,UAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,UAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,UAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}

package/dist/server/server/src/controllers/admin-token.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var utils = require('@strapi/utils');
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var index = require('../utils/index.js');
 var constants = require('../services/constants.js');
 var adminTokens = require('../validation/admin-tokens.js');
@@ -35,8 +35,8 @@ var adminToken = {
         }
         const attributes = {
             kind: 'admin',
-            name: fp.trim(body.name),
-            description: fp.trim(body.description),
+            name: _.trim(body.name),
+            description: _.trim(body.description),
             adminPermissions: body.adminPermissions,
             lifespan: body.lifespan,
             adminUserOwner: ctx.state.user.id
@@ -136,18 +136,18 @@ var adminToken = {
         const { id } = ctx.params;
         const apiTokenService = index.getService('api-token-admin');
         const mutableBody = body;
-        if (fp.has('name', mutableBody)) {
-            mutableBody.name = fp.trim(body.name ?? '');
+        if (_.has(mutableBody, 'name')) {
+            mutableBody.name = _.trim(body.name ?? '');
         }
-        if (fp.has('description', mutableBody) || mutableBody.description === null) {
-            mutableBody.description = fp.trim(body.description ?? '');
+        if (_.has(mutableBody, 'description') || mutableBody.description === null) {
+            mutableBody.description = _.trim(body.description ?? '');
         }
         await adminTokens.validateAdminTokenUpdateInput(body);
         const existingToken = await apiTokenService.getById(id);
         if (!existingToken) {
             return ctx.notFound('API Token not found');
         }
-        if (fp.has('name', body)) {
+        if (_.has(body, 'name')) {
             const nameAlreadyTaken = await apiTokenService.getByName(body.name);
             if (nameAlreadyTaken !== null && !utils.strings.isEqual(nameAlreadyTaken.id, id)) {
                 throw new ApplicationError('Name already taken');

package/dist/server/server/src/controllers/admin-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-token.js","sources":["../../../../../server/src/controllers/admin-token.ts"],"sourcesContent":["import type { Context } from 'koa';\n\nimport { strings, errors } from '@strapi/utils';\nimport { trim, has } from 'lodash/fp';\nimport { getService } from '../utils';\nimport constants from '../services/constants';\nimport {\n  validateAdminTokenCreationInput,\n  validateAdminTokenUpdateInput,\n} from '../validation/admin-tokens';\nimport {\n  Create,\n  List,\n  Revoke,\n  Get,\n  Update,\n  GetOwnerPermissions,\n  AdminApiToken,\n} from '../../../shared/contracts/admin-token';\nimport type { ContentApiApiToken } from '../../../shared/contracts/api-token';\nimport type { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError } = errors;\n\n// ---------------------------------------------------------------------------\n// Access-control helpers\n// ---------------------------------------------------------------------------\n\nconst isSuperAdmin = (user: AdminUser): boolean =>\n  user.roles.some((r) => r.code === constants.SUPER_ADMIN_CODE) === true;\n\nconst getOwnerId = (token: AdminApiToken): string => {\n  const owner = token.adminUserOwner;\n  return String(typeof owner === 'object' ? owner.id : owner);\n};\n\n/** Returns true when user is the recorded owner of an admin token. */\nconst isTokenOwner = (user: AdminUser, token: AdminApiToken): boolean =>\n  getOwnerId(token) === String(user.id);\n\n/** Owner OR super-admin can manage an admin token (read metadata, update…). */\nconst canAccessAdminToken = (user: AdminUser, token: AdminApiToken): boolean =>\n  isTokenOwner(user, token) || isSuperAdmin(user);\n\n// ---------------------------------------------------------------------------\n// Controller\n// ---------------------------------------------------------------------------\n\nexport default {\n  // -------------------------------------------------------------------------\n  // Create\n  // -------------------------------------------------------------------------\n  async create(ctx: Context) {\n    const { body } = ctx.request as Create.Request;\n    const apiTokenService = getService('api-token-admin');\n\n    if ((body as ContentApiApiToken).type !== undefined) {\n      return ctx.badRequest('Type is not allowed for admin tokens');\n    }\n    if ((body as ContentApiApiToken).permissions !== undefined) {\n      return ctx.badRequest('Permissions are not allowed for admin tokens');\n    }\n\n    const attributes = {\n      kind: 'admin' as const,\n      name: trim(body.name),\n      description: trim(body.description),\n      adminPermissions: body.adminPermissions,\n      lifespan: body.lifespan,\n      adminUserOwner: ctx.state.user.id,\n    };\n\n    await validateAdminTokenCreationInput(attributes);\n\n    const alreadyExists = await apiTokenService.exists({ name: attributes.name });\n    if (alreadyExists) {\n      throw new ApplicationError('Name already taken');\n    }\n\n    const apiToken = await apiTokenService.create(attributes, ctx.state.user);\n    ctx.created({ data: apiToken });\n  },\n\n  // -------------------------------------------------------------------------\n  // Regenerate — owner-only, super-admin does NOT bypass\n  // -------------------------------------------------------------------------\n  async regenerate(ctx: Context) {\n    const { id } = ctx.params;\n    const apiTokenService = getService('api-token-admin');\n\n    const token = await apiTokenService.getById(id);\n    if (!token) {\n      ctx.notFound('API Token not found');\n      return;\n    }\n\n    if (!isTokenOwner(ctx.state.user, token)) {\n      return ctx.forbidden();\n    }\n\n    const accessToken = await apiTokenService.regenerate(id);\n    ctx.created({ data: accessToken });\n  },\n\n  // -------------------------------------------------------------------------\n  // List — always filtered to kind: 'admin'\n  // -------------------------------------------------------------------------\n  async list(ctx: Context) {\n    const apiTokenService = getService('api-token-admin');\n    const apiTokens = await apiTokenService.list(ctx.state.user);\n\n    ctx.send({ data: apiTokens } satisfies List.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Revoke\n  // -------------------------------------------------------------------------\n  async revoke(ctx: Context) {\n    const { id } = ctx.params as Revoke.Params;\n    const apiTokenService = getService('api-token-admin');\n\n    const existingToken = await apiTokenService.getById(id);\n    if (existingToken === null) {\n      return ctx.notFound('API Token not found');\n    }\n\n    if (canAccessAdminToken(ctx.state.user, existingToken) === false) {\n      return ctx.forbidden();\n    }\n\n    const apiToken = await apiTokenService.revoke(id);\n    ctx.deleted({ data: apiToken } satisfies Revoke.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Get — key exposed only to owner\n  // -------------------------------------------------------------------------\n  async get(ctx: Context) {\n    const { id } = ctx.params;\n    const apiTokenService = getService('api-token-admin');\n\n    const token = await apiTokenService.getById(id);\n    if (!token) {\n      ctx.notFound('API Token not found');\n      return;\n    }\n\n    if (canAccessAdminToken(ctx.state.user, token) === false) {\n      ctx.notFound('API Token not found');\n      return;\n    }\n\n    if (isTokenOwner(ctx.state.user, token)) {\n      const withKey = await apiTokenService.getById(id, { includeDecryptedKey: true });\n      ctx.send({ data: withKey ?? token } satisfies Get.Response);\n      return;\n    }\n\n    ctx.send({ data: token } satisfies Get.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Update — owner or super-admin only\n  // -------------------------------------------------------------------------\n  async update(ctx: Context) {\n    const { body } = ctx.request as Update.Request;\n    const { id } = ctx.params as Update.Params;\n    const apiTokenService = getService('api-token-admin');\n\n    const mutableBody = body as Record<string, unknown>;\n    if (has('name', mutableBody)) {\n      mutableBody.name = trim(body.name ?? '');\n    }\n    if (has('description', mutableBody) || mutableBody.description === null) {\n      mutableBody.description = trim(body.description ?? '');\n    }\n\n    await validateAdminTokenUpdateInput(body);\n\n    const existingToken = await apiTokenService.getById(id);\n    if (!existingToken) {\n      return ctx.notFound('API Token not found');\n    }\n\n    if (has('name', body)) {\n      const nameAlreadyTaken = await apiTokenService.getByName(body.name!);\n      if (nameAlreadyTaken !== null && !strings.isEqual(nameAlreadyTaken.id, id)) {\n        throw new ApplicationError('Name already taken');\n      }\n    }\n\n    if (!canAccessAdminToken(ctx.state.user, existingToken)) {\n      return ctx.forbidden();\n    }\n\n    const apiToken = await apiTokenService.update(id, body);\n    ctx.send({ data: apiToken } satisfies Update.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Owner permissions — effective permissions of the token owner\n  // -------------------------------------------------------------------------\n  async getOwnerPermissions(ctx: Context) {\n    const { id } = ctx.params as GetOwnerPermissions.Request['params'];\n    const apiTokenService = getService('api-token-admin');\n    const permissionService = getService('permission');\n    const userService = getService('user');\n\n    const token = await apiTokenService.getById(id);\n    if (!token) {\n      return ctx.notFound('apiToken.notFound');\n    }\n\n    if (!canAccessAdminToken(ctx.state.user, token)) {\n      return ctx.forbidden();\n    }\n\n    const ownerId = getOwnerId(token);\n    const ownerUser = await userService.findOne(ownerId);\n    if (!ownerUser) {\n      return ctx.notFound('owner.notFound');\n    }\n\n    const ownerPermissions = await permissionService.findUserPermissions(ownerUser);\n    const sanitizedPermissions = ownerPermissions.map(permissionService.sanitizePermission);\n\n    // @ts-expect-error - transform response type to sanitized permission\n    ctx.body = { data: sanitizedPermissions } satisfies GetOwnerPermissions.Response;\n  },\n};\n"],"names":["ApplicationError","errors","isSuperAdmin","user","roles","some","r","code","constants","SUPER_ADMIN_CODE","getOwnerId","token","owner","adminUserOwner","String","id","isTokenOwner","canAccessAdminToken","create","ctx","body","request","apiTokenService","getService","type","undefined","badRequest","permissions","attributes","kind","name","trim","description","adminPermissions","lifespan","state","validateAdminTokenCreationInput","alreadyExists","exists","apiToken","created","data","regenerate","params","getById","notFound","forbidden","accessToken","list","apiTokens","send","revoke","existingToken","deleted","get","withKey","includeDecryptedKey","update","mutableBody","has","validateAdminTokenUpdateInput","nameAlreadyTaken","getByName","strings","isEqual","getOwnerPermissions","permissionService","userService","ownerId","ownerUser","findOne","ownerPermissions","findUserPermissions","sanitizedPermissions","map","sanitizePermission"],"mappings":";;;;;;;;AAsBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAE7B;AACA;AACA;AAEA,MAAMC,YAAAA,GAAe,CAACC,IAAAA,GACpBA,IAAAA,CAAKC,KAAK,CAACC,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEC,IAAI,KAAKC,SAAAA,CAAUC,gBAAgB,CAAA,KAAM,IAAA;AAEpE,MAAMC,aAAa,CAACC,KAAAA,GAAAA;IAClB,MAAMC,KAAAA,GAAQD,MAAME,cAAc;AAClC,IAAA,OAAOC,OAAO,OAAOF,KAAAA,KAAU,QAAA,GAAWA,KAAAA,CAAMG,EAAE,GAAGH,KAAAA,CAAAA;AACvD,CAAA;AAEA,uEACA,MAAMI,YAAAA,GAAe,CAACb,IAAAA,EAAiBQ,QACrCD,UAAAA,CAAWC,KAAAA,CAAAA,KAAWG,MAAAA,CAAOX,IAAAA,CAAKY,EAAE,CAAA;AAEtC,gFACA,MAAME,mBAAAA,GAAsB,CAACd,MAAiBQ,KAAAA,GAC5CK,YAAAA,CAAab,IAAAA,EAAMQ,KAAAA,CAAAA,IAAUT,YAAAA,CAAaC,IAAAA,CAAAA;AAE5C;AACA;AACA;AAEA,iBAAe;;;;AAIb,IAAA,MAAMe,QAAOC,GAAY,EAAA;AACvB,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,OAAO;AAC5B,QAAA,MAAMC,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,IAAI,IAACH,CAA4BI,IAAI,KAAKC,SAAAA,EAAW;YACnD,OAAON,GAAAA,CAAIO,UAAU,CAAC,sCAAA,CAAA;AACxB,QAAA;AACA,QAAA,IAAI,IAACN,CAA4BO,WAAW,KAAKF,SAAAA,EAAW;YAC1D,OAAON,GAAAA,CAAIO,UAAU,CAAC,8CAAA,CAAA;AACxB,QAAA;AAEA,QAAA,MAAME,UAAAA,GAAa;YACjBC,IAAAA,EAAM,OAAA;YACNC,IAAAA,EAAMC,OAAAA,CAAKX,KAAKU,IAAI,CAAA;YACpBE,WAAAA,EAAaD,OAAAA,CAAKX,KAAKY,WAAW,CAAA;AAClCC,YAAAA,gBAAAA,EAAkBb,KAAKa,gBAAgB;AACvCC,YAAAA,QAAAA,EAAUd,KAAKc,QAAQ;AACvBrB,YAAAA,cAAAA,EAAgBM,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,CAACY;AACjC,SAAA;AAEA,QAAA,MAAMqB,2CAAAA,CAAgCR,UAAAA,CAAAA;AAEtC,QAAA,MAAMS,aAAAA,GAAgB,MAAMf,eAAAA,CAAgBgB,MAAM,CAAC;AAAER,YAAAA,IAAAA,EAAMF,WAAWE;AAAK,SAAA,CAAA;AAC3E,QAAA,IAAIO,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,oBAAA,CAAA;AAC7B,QAAA;QAEA,MAAMuC,QAAAA,GAAW,MAAMjB,eAAAA,CAAgBJ,MAAM,CAACU,UAAAA,EAAYT,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,CAAA;AACxEgB,QAAAA,GAAAA,CAAIqB,OAAO,CAAC;YAAEC,IAAAA,EAAMF;AAAS,SAAA,CAAA;AAC/B,IAAA,CAAA;;;;AAKA,IAAA,MAAMG,YAAWvB,GAAY,EAAA;AAC3B,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAMZ,KAAAA,GAAQ,MAAMW,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACJ,KAAAA,EAAO;AACVQ,YAAAA,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACb,YAAA;AACF,QAAA;AAEA,QAAA,IAAI,CAAC7B,YAAAA,CAAaG,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,KAAAA,CAAAA,EAAQ;AACxC,YAAA,OAAOQ,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMC,WAAAA,GAAc,MAAMzB,eAAAA,CAAgBoB,UAAU,CAAC3B,EAAAA,CAAAA;AACrDI,QAAAA,GAAAA,CAAIqB,OAAO,CAAC;YAAEC,IAAAA,EAAMM;AAAY,SAAA,CAAA;AAClC,IAAA,CAAA;;;;AAKA,IAAA,MAAMC,MAAK7B,GAAY,EAAA;AACrB,QAAA,MAAMG,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;QACnC,MAAM0B,SAAAA,GAAY,MAAM3B,eAAAA,CAAgB0B,IAAI,CAAC7B,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,CAAA;AAE3DgB,QAAAA,GAAAA,CAAI+B,IAAI,CAAC;YAAET,IAAAA,EAAMQ;AAAU,SAAA,CAAA;AAC7B,IAAA,CAAA;;;;AAKA,IAAA,MAAME,QAAOhC,GAAY,EAAA;AACvB,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAM6B,aAAAA,GAAgB,MAAM9B,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AACpD,QAAA,IAAIqC,kBAAkB,IAAA,EAAM;YAC1B,OAAOjC,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACtB,QAAA;AAEA,QAAA,IAAI5B,oBAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEiD,mBAAmB,KAAA,EAAO;AAChE,YAAA,OAAOjC,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMP,QAAAA,GAAW,MAAMjB,eAAAA,CAAgB6B,MAAM,CAACpC,EAAAA,CAAAA;AAC9CI,QAAAA,GAAAA,CAAIkC,OAAO,CAAC;YAAEZ,IAAAA,EAAMF;AAAS,SAAA,CAAA;AAC/B,IAAA,CAAA;;;;AAKA,IAAA,MAAMe,KAAInC,GAAY,EAAA;AACpB,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAMZ,KAAAA,GAAQ,MAAMW,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACJ,KAAAA,EAAO;AACVQ,YAAAA,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACb,YAAA;AACF,QAAA;AAEA,QAAA,IAAI5B,oBAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,WAAW,KAAA,EAAO;AACxDQ,YAAAA,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACb,YAAA;AACF,QAAA;AAEA,QAAA,IAAI7B,aAAaG,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,KAAAA,CAAAA,EAAQ;AACvC,YAAA,MAAM4C,OAAAA,GAAU,MAAMjC,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,EAAI;gBAAEyC,mBAAAA,EAAqB;AAAK,aAAA,CAAA;AAC9ErC,YAAAA,GAAAA,CAAI+B,IAAI,CAAC;AAAET,gBAAAA,IAAAA,EAAMc,OAAAA,IAAW5C;AAAM,aAAA,CAAA;AAClC,YAAA;AACF,QAAA;AAEAQ,QAAAA,GAAAA,CAAI+B,IAAI,CAAC;YAAET,IAAAA,EAAM9B;AAAM,SAAA,CAAA;AACzB,IAAA,CAAA;;;;AAKA,IAAA,MAAM8C,QAAOtC,GAAY,EAAA;AACvB,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,OAAO;AAC5B,QAAA,MAAM,EAAEN,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAMmC,WAAAA,GAActC,IAAAA;QACpB,IAAIuC,MAAAA,CAAI,QAAQD,WAAAA,CAAAA,EAAc;AAC5BA,YAAAA,WAAAA,CAAY5B,IAAI,GAAGC,OAAAA,CAAKX,IAAAA,CAAKU,IAAI,IAAI,EAAA,CAAA;AACvC,QAAA;AACA,QAAA,IAAI6B,OAAI,aAAA,EAAeD,WAAAA,CAAAA,IAAgBA,WAAAA,CAAY1B,WAAW,KAAK,IAAA,EAAM;AACvE0B,YAAAA,WAAAA,CAAY1B,WAAW,GAAGD,OAAAA,CAAKX,IAAAA,CAAKY,WAAW,IAAI,EAAA,CAAA;AACrD,QAAA;AAEA,QAAA,MAAM4B,yCAAAA,CAA8BxC,IAAAA,CAAAA;AAEpC,QAAA,MAAMgC,aAAAA,GAAgB,MAAM9B,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AACpD,QAAA,IAAI,CAACqC,aAAAA,EAAe;YAClB,OAAOjC,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACtB,QAAA;QAEA,IAAIc,MAAAA,CAAI,QAAQvC,IAAAA,CAAAA,EAAO;AACrB,YAAA,MAAMyC,mBAAmB,MAAMvC,eAAAA,CAAgBwC,SAAS,CAAC1C,KAAKU,IAAI,CAAA;YAClE,IAAI+B,gBAAAA,KAAqB,QAAQ,CAACE,aAAAA,CAAQC,OAAO,CAACH,gBAAAA,CAAiB9C,EAAE,EAAEA,EAAAA,CAAAA,EAAK;AAC1E,gBAAA,MAAM,IAAIf,gBAAAA,CAAiB,oBAAA,CAAA;AAC7B,YAAA;AACF,QAAA;AAEA,QAAA,IAAI,CAACiB,mBAAAA,CAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEiD,aAAAA,CAAAA,EAAgB;AACvD,YAAA,OAAOjC,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMP,QAAAA,GAAW,MAAMjB,eAAAA,CAAgBmC,MAAM,CAAC1C,EAAAA,EAAIK,IAAAA,CAAAA;AAClDD,QAAAA,GAAAA,CAAI+B,IAAI,CAAC;YAAET,IAAAA,EAAMF;AAAS,SAAA,CAAA;AAC5B,IAAA,CAAA;;;;AAKA,IAAA,MAAM0B,qBAAoB9C,GAAY,EAAA;AACpC,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AACnC,QAAA,MAAM2C,oBAAoB3C,gBAAAA,CAAW,YAAA,CAAA;AACrC,QAAA,MAAM4C,cAAc5C,gBAAAA,CAAW,MAAA,CAAA;AAE/B,QAAA,MAAMZ,KAAAA,GAAQ,MAAMW,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACJ,KAAAA,EAAO;YACV,OAAOQ,GAAAA,CAAI0B,QAAQ,CAAC,mBAAA,CAAA;AACtB,QAAA;AAEA,QAAA,IAAI,CAAC5B,mBAAAA,CAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,KAAAA,CAAAA,EAAQ;AAC/C,YAAA,OAAOQ,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMsB,UAAU1D,UAAAA,CAAWC,KAAAA,CAAAA;AAC3B,QAAA,MAAM0D,SAAAA,GAAY,MAAMF,WAAAA,CAAYG,OAAO,CAACF,OAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACC,SAAAA,EAAW;YACd,OAAOlD,GAAAA,CAAI0B,QAAQ,CAAC,gBAAA,CAAA;AACtB,QAAA;AAEA,QAAA,MAAM0B,gBAAAA,GAAmB,MAAML,iBAAAA,CAAkBM,mBAAmB,CAACH,SAAAA,CAAAA;AACrE,QAAA,MAAMI,oBAAAA,GAAuBF,gBAAAA,CAAiBG,GAAG,CAACR,kBAAkBS,kBAAkB,CAAA;;AAGtFxD,QAAAA,GAAAA,CAAIC,IAAI,GAAG;YAAEqB,IAAAA,EAAMgC;AAAqB,SAAA;AAC1C,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin-token.js","sources":["../../../../../server/src/controllers/admin-token.ts"],"sourcesContent":["import type { Context } from 'koa';\n\nimport { strings, errors } from '@strapi/utils';\nimport { trim, has } from 'lodash';\n\nimport { getService } from '../utils';\nimport constants from '../services/constants';\nimport {\n  validateAdminTokenCreationInput,\n  validateAdminTokenUpdateInput,\n} from '../validation/admin-tokens';\nimport {\n  Create,\n  List,\n  Revoke,\n  Get,\n  Update,\n  GetOwnerPermissions,\n  AdminApiToken,\n} from '../../../shared/contracts/admin-token';\nimport type { ContentApiApiToken } from '../../../shared/contracts/api-token';\nimport type { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError } = errors;\n\n// ---------------------------------------------------------------------------\n// Access-control helpers\n// ---------------------------------------------------------------------------\n\nconst isSuperAdmin = (user: AdminUser): boolean =>\n  user.roles.some((r) => r.code === constants.SUPER_ADMIN_CODE) === true;\n\nconst getOwnerId = (token: AdminApiToken): string => {\n  const owner = token.adminUserOwner;\n  return String(typeof owner === 'object' ? owner.id : owner);\n};\n\n/** Returns true when user is the recorded owner of an admin token. */\nconst isTokenOwner = (user: AdminUser, token: AdminApiToken): boolean =>\n  getOwnerId(token) === String(user.id);\n\n/** Owner OR super-admin can manage an admin token (read metadata, update…). */\nconst canAccessAdminToken = (user: AdminUser, token: AdminApiToken): boolean =>\n  isTokenOwner(user, token) || isSuperAdmin(user);\n\n// ---------------------------------------------------------------------------\n// Controller\n// ---------------------------------------------------------------------------\n\nexport default {\n  // -------------------------------------------------------------------------\n  // Create\n  // -------------------------------------------------------------------------\n  async create(ctx: Context) {\n    const { body } = ctx.request as Create.Request;\n    const apiTokenService = getService('api-token-admin');\n\n    if ((body as ContentApiApiToken).type !== undefined) {\n      return ctx.badRequest('Type is not allowed for admin tokens');\n    }\n    if ((body as ContentApiApiToken).permissions !== undefined) {\n      return ctx.badRequest('Permissions are not allowed for admin tokens');\n    }\n\n    const attributes = {\n      kind: 'admin' as const,\n      name: trim(body.name),\n      description: trim(body.description),\n      adminPermissions: body.adminPermissions,\n      lifespan: body.lifespan,\n      adminUserOwner: ctx.state.user.id,\n    };\n\n    await validateAdminTokenCreationInput(attributes);\n\n    const alreadyExists = await apiTokenService.exists({ name: attributes.name });\n    if (alreadyExists) {\n      throw new ApplicationError('Name already taken');\n    }\n\n    const apiToken = await apiTokenService.create(attributes, ctx.state.user);\n    ctx.created({ data: apiToken });\n  },\n\n  // -------------------------------------------------------------------------\n  // Regenerate — owner-only, super-admin does NOT bypass\n  // -------------------------------------------------------------------------\n  async regenerate(ctx: Context) {\n    const { id } = ctx.params;\n    const apiTokenService = getService('api-token-admin');\n\n    const token = await apiTokenService.getById(id);\n    if (!token) {\n      ctx.notFound('API Token not found');\n      return;\n    }\n\n    if (!isTokenOwner(ctx.state.user, token)) {\n      return ctx.forbidden();\n    }\n\n    const accessToken = await apiTokenService.regenerate(id);\n    ctx.created({ data: accessToken });\n  },\n\n  // -------------------------------------------------------------------------\n  // List — always filtered to kind: 'admin'\n  // -------------------------------------------------------------------------\n  async list(ctx: Context) {\n    const apiTokenService = getService('api-token-admin');\n    const apiTokens = await apiTokenService.list(ctx.state.user);\n\n    ctx.send({ data: apiTokens } satisfies List.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Revoke\n  // -------------------------------------------------------------------------\n  async revoke(ctx: Context) {\n    const { id } = ctx.params as Revoke.Params;\n    const apiTokenService = getService('api-token-admin');\n\n    const existingToken = await apiTokenService.getById(id);\n    if (existingToken === null) {\n      return ctx.notFound('API Token not found');\n    }\n\n    if (canAccessAdminToken(ctx.state.user, existingToken) === false) {\n      return ctx.forbidden();\n    }\n\n    const apiToken = await apiTokenService.revoke(id);\n    ctx.deleted({ data: apiToken } satisfies Revoke.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Get — key exposed only to owner\n  // -------------------------------------------------------------------------\n  async get(ctx: Context) {\n    const { id } = ctx.params;\n    const apiTokenService = getService('api-token-admin');\n\n    const token = await apiTokenService.getById(id);\n    if (!token) {\n      ctx.notFound('API Token not found');\n      return;\n    }\n\n    if (canAccessAdminToken(ctx.state.user, token) === false) {\n      ctx.notFound('API Token not found');\n      return;\n    }\n\n    if (isTokenOwner(ctx.state.user, token)) {\n      const withKey = await apiTokenService.getById(id, { includeDecryptedKey: true });\n      ctx.send({ data: withKey ?? token } satisfies Get.Response);\n      return;\n    }\n\n    ctx.send({ data: token } satisfies Get.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Update — owner or super-admin only\n  // -------------------------------------------------------------------------\n  async update(ctx: Context) {\n    const { body } = ctx.request as Update.Request;\n    const { id } = ctx.params as Update.Params;\n    const apiTokenService = getService('api-token-admin');\n\n    const mutableBody = body as Record<string, unknown>;\n    if (has(mutableBody, 'name')) {\n      mutableBody.name = trim(body.name ?? '');\n    }\n    if (has(mutableBody, 'description') || mutableBody.description === null) {\n      mutableBody.description = trim(body.description ?? '');\n    }\n\n    await validateAdminTokenUpdateInput(body);\n\n    const existingToken = await apiTokenService.getById(id);\n    if (!existingToken) {\n      return ctx.notFound('API Token not found');\n    }\n\n    if (has(body, 'name')) {\n      const nameAlreadyTaken = await apiTokenService.getByName(body.name!);\n      if (nameAlreadyTaken !== null && !strings.isEqual(nameAlreadyTaken.id, id)) {\n        throw new ApplicationError('Name already taken');\n      }\n    }\n\n    if (!canAccessAdminToken(ctx.state.user, existingToken)) {\n      return ctx.forbidden();\n    }\n\n    const apiToken = await apiTokenService.update(id, body);\n    ctx.send({ data: apiToken } satisfies Update.Response);\n  },\n\n  // -------------------------------------------------------------------------\n  // Owner permissions — effective permissions of the token owner\n  // -------------------------------------------------------------------------\n  async getOwnerPermissions(ctx: Context) {\n    const { id } = ctx.params as GetOwnerPermissions.Request['params'];\n    const apiTokenService = getService('api-token-admin');\n    const permissionService = getService('permission');\n    const userService = getService('user');\n\n    const token = await apiTokenService.getById(id);\n    if (!token) {\n      return ctx.notFound('apiToken.notFound');\n    }\n\n    if (!canAccessAdminToken(ctx.state.user, token)) {\n      return ctx.forbidden();\n    }\n\n    const ownerId = getOwnerId(token);\n    const ownerUser = await userService.findOne(ownerId);\n    if (!ownerUser) {\n      return ctx.notFound('owner.notFound');\n    }\n\n    const ownerPermissions = await permissionService.findUserPermissions(ownerUser);\n    const sanitizedPermissions = ownerPermissions.map(permissionService.sanitizePermission);\n\n    // @ts-expect-error - transform response type to sanitized permission\n    ctx.body = { data: sanitizedPermissions } satisfies GetOwnerPermissions.Response;\n  },\n};\n"],"names":["ApplicationError","errors","isSuperAdmin","user","roles","some","r","code","constants","SUPER_ADMIN_CODE","getOwnerId","token","owner","adminUserOwner","String","id","isTokenOwner","canAccessAdminToken","create","ctx","body","request","apiTokenService","getService","type","undefined","badRequest","permissions","attributes","kind","name","trim","description","adminPermissions","lifespan","state","validateAdminTokenCreationInput","alreadyExists","exists","apiToken","created","data","regenerate","params","getById","notFound","forbidden","accessToken","list","apiTokens","send","revoke","existingToken","deleted","get","withKey","includeDecryptedKey","update","mutableBody","has","validateAdminTokenUpdateInput","nameAlreadyTaken","getByName","strings","isEqual","getOwnerPermissions","permissionService","userService","ownerId","ownerUser","findOne","ownerPermissions","findUserPermissions","sanitizedPermissions","map","sanitizePermission"],"mappings":";;;;;;;;AAuBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,YAAAA;AAE7B;AACA;AACA;AAEA,MAAMC,YAAAA,GAAe,CAACC,IAAAA,GACpBA,IAAAA,CAAKC,KAAK,CAACC,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEC,IAAI,KAAKC,SAAAA,CAAUC,gBAAgB,CAAA,KAAM,IAAA;AAEpE,MAAMC,aAAa,CAACC,KAAAA,GAAAA;IAClB,MAAMC,KAAAA,GAAQD,MAAME,cAAc;AAClC,IAAA,OAAOC,OAAO,OAAOF,KAAAA,KAAU,QAAA,GAAWA,KAAAA,CAAMG,EAAE,GAAGH,KAAAA,CAAAA;AACvD,CAAA;AAEA,uEACA,MAAMI,YAAAA,GAAe,CAACb,IAAAA,EAAiBQ,QACrCD,UAAAA,CAAWC,KAAAA,CAAAA,KAAWG,MAAAA,CAAOX,IAAAA,CAAKY,EAAE,CAAA;AAEtC,gFACA,MAAME,mBAAAA,GAAsB,CAACd,MAAiBQ,KAAAA,GAC5CK,YAAAA,CAAab,IAAAA,EAAMQ,KAAAA,CAAAA,IAAUT,YAAAA,CAAaC,IAAAA,CAAAA;AAE5C;AACA;AACA;AAEA,iBAAe;;;;AAIb,IAAA,MAAMe,QAAOC,GAAY,EAAA;AACvB,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,OAAO;AAC5B,QAAA,MAAMC,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,IAAI,IAACH,CAA4BI,IAAI,KAAKC,SAAAA,EAAW;YACnD,OAAON,GAAAA,CAAIO,UAAU,CAAC,sCAAA,CAAA;AACxB,QAAA;AACA,QAAA,IAAI,IAACN,CAA4BO,WAAW,KAAKF,SAAAA,EAAW;YAC1D,OAAON,GAAAA,CAAIO,UAAU,CAAC,8CAAA,CAAA;AACxB,QAAA;AAEA,QAAA,MAAME,UAAAA,GAAa;YACjBC,IAAAA,EAAM,OAAA;YACNC,IAAAA,EAAMC,MAAAA,CAAKX,KAAKU,IAAI,CAAA;YACpBE,WAAAA,EAAaD,MAAAA,CAAKX,KAAKY,WAAW,CAAA;AAClCC,YAAAA,gBAAAA,EAAkBb,KAAKa,gBAAgB;AACvCC,YAAAA,QAAAA,EAAUd,KAAKc,QAAQ;AACvBrB,YAAAA,cAAAA,EAAgBM,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,CAACY;AACjC,SAAA;AAEA,QAAA,MAAMqB,2CAAAA,CAAgCR,UAAAA,CAAAA;AAEtC,QAAA,MAAMS,aAAAA,GAAgB,MAAMf,eAAAA,CAAgBgB,MAAM,CAAC;AAAER,YAAAA,IAAAA,EAAMF,WAAWE;AAAK,SAAA,CAAA;AAC3E,QAAA,IAAIO,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,oBAAA,CAAA;AAC7B,QAAA;QAEA,MAAMuC,QAAAA,GAAW,MAAMjB,eAAAA,CAAgBJ,MAAM,CAACU,UAAAA,EAAYT,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,CAAA;AACxEgB,QAAAA,GAAAA,CAAIqB,OAAO,CAAC;YAAEC,IAAAA,EAAMF;AAAS,SAAA,CAAA;AAC/B,IAAA,CAAA;;;;AAKA,IAAA,MAAMG,YAAWvB,GAAY,EAAA;AAC3B,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAMZ,KAAAA,GAAQ,MAAMW,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACJ,KAAAA,EAAO;AACVQ,YAAAA,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACb,YAAA;AACF,QAAA;AAEA,QAAA,IAAI,CAAC7B,YAAAA,CAAaG,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,KAAAA,CAAAA,EAAQ;AACxC,YAAA,OAAOQ,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMC,WAAAA,GAAc,MAAMzB,eAAAA,CAAgBoB,UAAU,CAAC3B,EAAAA,CAAAA;AACrDI,QAAAA,GAAAA,CAAIqB,OAAO,CAAC;YAAEC,IAAAA,EAAMM;AAAY,SAAA,CAAA;AAClC,IAAA,CAAA;;;;AAKA,IAAA,MAAMC,MAAK7B,GAAY,EAAA;AACrB,QAAA,MAAMG,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;QACnC,MAAM0B,SAAAA,GAAY,MAAM3B,eAAAA,CAAgB0B,IAAI,CAAC7B,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,CAAA;AAE3DgB,QAAAA,GAAAA,CAAI+B,IAAI,CAAC;YAAET,IAAAA,EAAMQ;AAAU,SAAA,CAAA;AAC7B,IAAA,CAAA;;;;AAKA,IAAA,MAAME,QAAOhC,GAAY,EAAA;AACvB,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAM6B,aAAAA,GAAgB,MAAM9B,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AACpD,QAAA,IAAIqC,kBAAkB,IAAA,EAAM;YAC1B,OAAOjC,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACtB,QAAA;AAEA,QAAA,IAAI5B,oBAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEiD,mBAAmB,KAAA,EAAO;AAChE,YAAA,OAAOjC,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMP,QAAAA,GAAW,MAAMjB,eAAAA,CAAgB6B,MAAM,CAACpC,EAAAA,CAAAA;AAC9CI,QAAAA,GAAAA,CAAIkC,OAAO,CAAC;YAAEZ,IAAAA,EAAMF;AAAS,SAAA,CAAA;AAC/B,IAAA,CAAA;;;;AAKA,IAAA,MAAMe,KAAInC,GAAY,EAAA;AACpB,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAMZ,KAAAA,GAAQ,MAAMW,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACJ,KAAAA,EAAO;AACVQ,YAAAA,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACb,YAAA;AACF,QAAA;AAEA,QAAA,IAAI5B,oBAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,WAAW,KAAA,EAAO;AACxDQ,YAAAA,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACb,YAAA;AACF,QAAA;AAEA,QAAA,IAAI7B,aAAaG,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,KAAAA,CAAAA,EAAQ;AACvC,YAAA,MAAM4C,OAAAA,GAAU,MAAMjC,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,EAAI;gBAAEyC,mBAAAA,EAAqB;AAAK,aAAA,CAAA;AAC9ErC,YAAAA,GAAAA,CAAI+B,IAAI,CAAC;AAAET,gBAAAA,IAAAA,EAAMc,OAAAA,IAAW5C;AAAM,aAAA,CAAA;AAClC,YAAA;AACF,QAAA;AAEAQ,QAAAA,GAAAA,CAAI+B,IAAI,CAAC;YAAET,IAAAA,EAAM9B;AAAM,SAAA,CAAA;AACzB,IAAA,CAAA;;;;AAKA,IAAA,MAAM8C,QAAOtC,GAAY,EAAA;AACvB,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,OAAO;AAC5B,QAAA,MAAM,EAAEN,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AAEnC,QAAA,MAAMmC,WAAAA,GAActC,IAAAA;QACpB,IAAIuC,KAAAA,CAAID,aAAa,MAAA,CAAA,EAAS;AAC5BA,YAAAA,WAAAA,CAAY5B,IAAI,GAAGC,MAAAA,CAAKX,IAAAA,CAAKU,IAAI,IAAI,EAAA,CAAA;AACvC,QAAA;AACA,QAAA,IAAI6B,MAAID,WAAAA,EAAa,aAAA,CAAA,IAAkBA,WAAAA,CAAY1B,WAAW,KAAK,IAAA,EAAM;AACvE0B,YAAAA,WAAAA,CAAY1B,WAAW,GAAGD,MAAAA,CAAKX,IAAAA,CAAKY,WAAW,IAAI,EAAA,CAAA;AACrD,QAAA;AAEA,QAAA,MAAM4B,yCAAAA,CAA8BxC,IAAAA,CAAAA;AAEpC,QAAA,MAAMgC,aAAAA,GAAgB,MAAM9B,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AACpD,QAAA,IAAI,CAACqC,aAAAA,EAAe;YAClB,OAAOjC,GAAAA,CAAI0B,QAAQ,CAAC,qBAAA,CAAA;AACtB,QAAA;QAEA,IAAIc,KAAAA,CAAIvC,MAAM,MAAA,CAAA,EAAS;AACrB,YAAA,MAAMyC,mBAAmB,MAAMvC,eAAAA,CAAgBwC,SAAS,CAAC1C,KAAKU,IAAI,CAAA;YAClE,IAAI+B,gBAAAA,KAAqB,QAAQ,CAACE,aAAAA,CAAQC,OAAO,CAACH,gBAAAA,CAAiB9C,EAAE,EAAEA,EAAAA,CAAAA,EAAK;AAC1E,gBAAA,MAAM,IAAIf,gBAAAA,CAAiB,oBAAA,CAAA;AAC7B,YAAA;AACF,QAAA;AAEA,QAAA,IAAI,CAACiB,mBAAAA,CAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEiD,aAAAA,CAAAA,EAAgB;AACvD,YAAA,OAAOjC,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMP,QAAAA,GAAW,MAAMjB,eAAAA,CAAgBmC,MAAM,CAAC1C,EAAAA,EAAIK,IAAAA,CAAAA;AAClDD,QAAAA,GAAAA,CAAI+B,IAAI,CAAC;YAAET,IAAAA,EAAMF;AAAS,SAAA,CAAA;AAC5B,IAAA,CAAA;;;;AAKA,IAAA,MAAM0B,qBAAoB9C,GAAY,EAAA;AACpC,QAAA,MAAM,EAAEJ,EAAE,EAAE,GAAGI,IAAIwB,MAAM;AACzB,QAAA,MAAMrB,kBAAkBC,gBAAAA,CAAW,iBAAA,CAAA;AACnC,QAAA,MAAM2C,oBAAoB3C,gBAAAA,CAAW,YAAA,CAAA;AACrC,QAAA,MAAM4C,cAAc5C,gBAAAA,CAAW,MAAA,CAAA;AAE/B,QAAA,MAAMZ,KAAAA,GAAQ,MAAMW,eAAAA,CAAgBsB,OAAO,CAAC7B,EAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACJ,KAAAA,EAAO;YACV,OAAOQ,GAAAA,CAAI0B,QAAQ,CAAC,mBAAA,CAAA;AACtB,QAAA;AAEA,QAAA,IAAI,CAAC5B,mBAAAA,CAAoBE,GAAAA,CAAIgB,KAAK,CAAChC,IAAI,EAAEQ,KAAAA,CAAAA,EAAQ;AAC/C,YAAA,OAAOQ,IAAI2B,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAMsB,UAAU1D,UAAAA,CAAWC,KAAAA,CAAAA;AAC3B,QAAA,MAAM0D,SAAAA,GAAY,MAAMF,WAAAA,CAAYG,OAAO,CAACF,OAAAA,CAAAA;AAC5C,QAAA,IAAI,CAACC,SAAAA,EAAW;YACd,OAAOlD,GAAAA,CAAI0B,QAAQ,CAAC,gBAAA,CAAA;AACtB,QAAA;AAEA,QAAA,MAAM0B,gBAAAA,GAAmB,MAAML,iBAAAA,CAAkBM,mBAAmB,CAACH,SAAAA,CAAAA;AACrE,QAAA,MAAMI,oBAAAA,GAAuBF,gBAAAA,CAAiBG,GAAG,CAACR,kBAAkBS,kBAAkB,CAAA;;AAGtFxD,QAAAA,GAAAA,CAAIC,IAAI,GAAG;YAAEqB,IAAAA,EAAMgC;AAAqB,SAAA;AAC1C,IAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/controllers/admin-token.mjs

@@ -1,5 +1,5 @@
 import { errors, strings } from '@strapi/utils';
-import { has, trim } from 'lodash/fp';
+import { has, trim } from 'lodash';
 import { getService } from '../utils/index.mjs';
 import constants from '../services/constants.mjs';
 import { validateAdminTokenUpdateInput, validateAdminTokenCreationInput } from '../validation/admin-tokens.mjs';
@@ -134,10 +134,10 @@ var adminToken = {
         const { id } = ctx.params;
         const apiTokenService = getService('api-token-admin');
         const mutableBody = body;
-        if (has('name', mutableBody)) {
+        if (has(mutableBody, 'name')) {
             mutableBody.name = trim(body.name ?? '');
         }
-        if (has('description', mutableBody) || mutableBody.description === null) {
+        if (has(mutableBody, 'description') || mutableBody.description === null) {
             mutableBody.description = trim(body.description ?? '');
         }
         await validateAdminTokenUpdateInput(body);
@@ -145,7 +145,7 @@ var adminToken = {
         if (!existingToken) {
             return ctx.notFound('API Token not found');
         }
-        if (has('name', body)) {
+        if (has(body, 'name')) {
             const nameAlreadyTaken = await apiTokenService.getByName(body.name);
             if (nameAlreadyTaken !== null && !strings.isEqual(nameAlreadyTaken.id, id)) {
                 throw new ApplicationError('Name already taken');