npm - @strapi/admin - Versions diffs - 5.56.0 → 5.58.0 - Mend

@strapi/admin 5.56.0 → 5.58.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (465) hide show

package/dist/server/ee/server/src/services/user.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport {\n LEGACY_USER_EVENTS,\n emitAdminUserDeleted,\n emitAdminUserUpdateAudits,\n touchesTrackedFields,\n} from '../../../../server/src/audit-logs/admin-users';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n const manager = strapi.sessionManager;\n return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n /\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const user = disabledUsers.find((user: any) => user.id === Number(id));\n if (!user) {\n return;\n }\n\n if (user.isActive !== input.isActive) {\n const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n let idsToCheck: any;\n if (typeof ids === 'object') {\n idsToCheck = castNumberArray(ids);\n } else {\n idsToCheck = [Number(ids)];\n }\n\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n};\n\n/\n Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n /\nconst updateById = async (id: any, attributes: any) => {\n // Check at least one super admin remains\n if (_.has(attributes, 'roles')) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n if (lastAdminUser && willRemoveSuperAdminRole) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // cannot disable last super admin\n if (attributes.isActive === false) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n if (lastAdminUser) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // The audit log records what changed, so it needs the row before the write\n const previous = touchesTrackedFields(attributes)\n ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n : null;\n\n // hash password if a new one is sent\n if (_.has(attributes, 'password')) {\n const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: {\n ...attributes,\n password: hashedPassword,\n },\n populate: ['roles'],\n });\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n return updatedUser;\n }\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: attributes,\n populate: ['roles'],\n });\n\n await updateEEDisabledUsersList(id, attributes);\n\n if (updatedUser) {\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n }\n\n return updatedUser;\n};\n\n/* Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n /\nconst deleteById = async (id: unknown) => {\n // Check at least one super admin remains\n const userToDelete = await strapi.db.query('admin::user').findOne({\n where: { id },\n populate: ['roles'],\n });\n\n if (!userToDelete) {\n return null;\n }\n\n if (userToDelete) {\n if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n if (superAdminRole.usersCount === 1) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n }\n\n const deletedUser = await strapi.db\n .query('admin::user')\n .delete({ where: { id }, populate: ['roles'] });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n await removeFromEEDisabledUsersList(id);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n await emitAdminUserDeleted({ strapi }, deletedUser);\n\n return deletedUser;\n};\n\n/* Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n /\nconst deleteByIds = async (ids: any) => {\n // Check at least one super admin remains\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n where: {\n id: ids,\n roles: { id: superAdminRole.id },\n },\n });\n\n if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n\n const deletedUsers = [];\n for (const id of ids) {\n const deletedUser = await strapi.db.query('admin::user').delete({\n where: { id },\n populate: ['roles'],\n });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n deletedUsers.push(deletedUser);\n }\n\n await removeFromEEDisabledUsersList(ids);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n });\n\n for (const deletedUser of deletedUsers) {\n await emitAdminUserDeleted({ strapi }, deletedUser);\n }\n\n return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/\n Check if a user is the last super admin\n * @param {int\|string} userId user's id to look for\n /\nconst isLastSuperAdminUser = async (userId: unknown) => {\n const user = (await findOne(userId)) as any;\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/\n Remove private user fields\n * @param {Object} user - user to sanitize\n /\nconst sanitizeUser = (user: any) => {\n return {\n ..._.omit(user, [\n 'password',\n 'resetPasswordToken',\n 'resetPasswordTokenExpiresAt',\n 'registrationToken',\n 'roles',\n ]),\n roles: user.roles && user.roles.map(sanitizeUserRoles),\n };\n};\n\n/\n Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n updateEEDisabledUsersList,\n removeFromEEDisabledUsersList,\n getCurrentActiveUserCount,\n deleteByIds,\n deleteById,\n updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","previous","touchesTrackedFields","db","query","findOne","where","populate","hashedPassword","hashPassword","password","updatedUser","update","data","eventHub","emit","LEGACY_USER_EVENTS","UPDATE","sanitizeUser","emitAdminUserUpdateAudits","updated","deleteById","userToDelete","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;;AAaA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,OAAAA,CAAKC,YAAAA,EAAWC,MAAAA,CAAIC,WAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM8C,QAAAA,GAAWC,+BAAAA,CAAqBZ,UAAAA,CAAAA,GAClC,MAAM7B,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAIhB,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMkB,iBAAiB,MAAMzC,gBAAAA,CAAW,QAAQ0C,YAAY,CAACnB,WAAWoB,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;YAC9DN,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZiD,IAAAA,EAAM;AACJ,gBAAA,GAAGvB,UAAU;gBACboB,QAAAA,EAAUF;AACZ,aAAA;YACAD,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEA9C,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,oCAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOqB,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;QAC9DN,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZiD,IAAAA,EAAMvB,UAAAA;QACNiB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM5C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIqB,WAAAA,EAAa;AACflD,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,oCAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOqB,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOzD,EAAAA,GAAAA;;IAExB,MAAM0D,YAAAA,GAAe,MAAM7D,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAChEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZ2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACe,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAatB,KAAK,CAACuB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAKpE,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIvE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMwE,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNwB,MAAM,CAAC;QAAEtB,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgB,MAAM,EAAE;AAAE/D,QAAAA,IAAAA,EAAMiD,YAAAA,CAAaS,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,+BAAAA,CAAqB;AAAExE,QAAAA;KAAO,EAAGkE,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMO,cAAc,OAAOhD,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAMuC,sBAAAA,GAAyB,MAAM1E,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QACxE9B,KAAAA,EAAO;YACL1C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAe+B,UAAU,KAAKS,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIhF,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMkF,eAAe,EAAE;IACvB,KAAK,MAAMzE,MAAMsB,GAAAA,CAAK;QACpB,MAAMyC,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAewB,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZ2C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAyE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAM1C,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgB,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAatD,GAAG,CAAC,CAAC4C,cAAgBT,YAAAA,CAAaS,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,+BAAAA,CAAqB;AAAExE,YAAAA;SAAO,EAAGkE,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkBlD,kBAAAA,CAAEmD,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAM/C,uBAAuB,OAAOiD,MAAAA,GAAAA;IAClC,MAAM1E,IAAAA,GAAQ,MAAMoC,OAAAA,CAAQsC,MAAAA,CAAAA;AAC5B,IAAA,MAAMhD,cAAAA,GAAiB,MAAM5B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKkB,wBAAAA,CAAkB3E,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMiD,eAAe,CAACjD,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,kBAAAA,CAAEsD,IAAI,CAAC5E,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACyD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMnC,OAAAA,GAAU,OAAOzC,EAAAA,EAAS2C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAO9C,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;AAAG2C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAMuC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAOrF,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QAAE9B,KAAAA,EAAO;YAAElC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACA6D,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAb,IAAAA,UAAAA;AACAhC,IAAAA;AACF,CAAA;;;;"}
1	+ {"version":3,"file":"user.js","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _, { castArray, toNumber } from 'lodash';\n\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport {\n LEGACY_USER_EVENTS,\n emitAdminUserDeleted,\n emitAdminUserUpdateAudits,\n touchesTrackedFields,\n} from '../../../../server/src/audit-logs/admin-users';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n const manager = strapi.sessionManager;\n return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n /\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const user = disabledUsers.find((user: any) => user.id === Number(id));\n if (!user) {\n return;\n }\n\n if (user.isActive !== input.isActive) {\n const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n }\n};\n\nconst castNumberArray = (ids: unknown) => castArray(ids).map((id) => toNumber(id));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n let idsToCheck: any;\n if (typeof ids === 'object') {\n idsToCheck = castNumberArray(ids);\n } else {\n idsToCheck = [Number(ids)];\n }\n\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n};\n\n/\n Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n /\nconst updateById = async (id: any, attributes: any) => {\n // Check at least one super admin remains\n if (_.has(attributes, 'roles')) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n if (lastAdminUser && willRemoveSuperAdminRole) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // cannot disable last super admin\n if (attributes.isActive === false) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n if (lastAdminUser) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // The audit log records what changed, so it needs the row before the write\n const previous = touchesTrackedFields(attributes)\n ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n : null;\n\n // hash password if a new one is sent\n if (_.has(attributes, 'password')) {\n const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: {\n ...attributes,\n password: hashedPassword,\n },\n populate: ['roles'],\n });\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n return updatedUser;\n }\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: attributes,\n populate: ['roles'],\n });\n\n await updateEEDisabledUsersList(id, attributes);\n\n if (updatedUser) {\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n }\n\n return updatedUser;\n};\n\n/* Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n /\nconst deleteById = async (id: unknown) => {\n // Check at least one super admin remains\n const userToDelete = await strapi.db.query('admin::user').findOne({\n where: { id },\n populate: ['roles'],\n });\n\n if (!userToDelete) {\n return null;\n }\n\n if (userToDelete) {\n if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n if (superAdminRole.usersCount === 1) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n }\n\n const deletedUser = await strapi.db\n .query('admin::user')\n .delete({ where: { id }, populate: ['roles'] });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n await removeFromEEDisabledUsersList(id);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n await emitAdminUserDeleted({ strapi }, deletedUser);\n\n return deletedUser;\n};\n\n/* Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n /\nconst deleteByIds = async (ids: any) => {\n // Check at least one super admin remains\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n where: {\n id: ids,\n roles: { id: superAdminRole.id },\n },\n });\n\n if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n\n const deletedUsers = [];\n for (const id of ids) {\n const deletedUser = await strapi.db.query('admin::user').delete({\n where: { id },\n populate: ['roles'],\n });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n deletedUsers.push(deletedUser);\n }\n\n await removeFromEEDisabledUsersList(ids);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n });\n\n for (const deletedUser of deletedUsers) {\n await emitAdminUserDeleted({ strapi }, deletedUser);\n }\n\n return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/\n Check if a user is the last super admin\n * @param {int\|string} userId user's id to look for\n /\nconst isLastSuperAdminUser = async (userId: unknown) => {\n const user = (await findOne(userId)) as any;\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/\n Remove private user fields\n * @param {Object} user - user to sanitize\n /\nconst sanitizeUser = (user: any) => {\n return {\n ..._.omit(user, [\n 'password',\n 'resetPasswordToken',\n 'resetPasswordTokenExpiresAt',\n 'registrationToken',\n 'roles',\n ]),\n roles: user.roles && user.roles.map(sanitizeUserRoles),\n };\n};\n\n/\n Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n updateEEDisabledUsersList,\n removeFromEEDisabledUsersList,\n getCurrentActiveUserCount,\n deleteByIds,\n deleteById,\n updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","ids","castArray","map","toNumber","removeFromEEDisabledUsersList","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","previous","touchesTrackedFields","db","query","findOne","where","populate","hashedPassword","hashPassword","password","updatedUser","update","data","eventHub","emit","LEGACY_USER_EVENTS","UPDATE","sanitizeUser","emitAdminUserUpdateAudits","updated","deleteById","userToDelete","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;;;;;;AAaA,MAAM,EAAEA,eAAe,EAAE,GAAGC,YAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkB,CAACC,GAAAA,GAAiBC,WAAAA,CAAUD,KAAKE,GAAG,CAAC,CAACnB,EAAAA,GAAOoB,UAAAA,CAASpB,EAAAA,CAAAA,CAAAA;AAE9E,MAAMqB,gCAAgC,OAAOJ,GAAAA,GAAAA;IAC3C,IAAIK,UAAAA;IACJ,IAAI,OAAOL,QAAQ,QAAA,EAAU;AAC3BK,QAAAA,UAAAA,GAAaN,eAAAA,CAAgBC,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLK,UAAAA,GAAa;YAACf,MAAAA,CAAOU,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMf,aAAAA,GAAgB,MAAMC,gBAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACiB,UAAAA,CAAWC,QAAQ,CAAClB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMe,UAAAA,GAAa,OAAOxB,EAAAA,EAASyB,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB7B,EAAAA,CAAAA;AACjD,QAAA,MAAM8B,cAAAA,GAAiB,MAAM3B,gBAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,YAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe9B,EAAE,CAAA;AAE3F,QAAA,IAAI4B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIzC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIkC,UAAAA,CAAWjB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMoB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB7B,EAAAA,CAAAA;AACjD,QAAA,IAAI4B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIrC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM6C,QAAAA,GAAWC,+BAAAA,CAAqBZ,UAAAA,CAAAA,GAClC,MAAM5B,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QAAG0C,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAIhB,kBAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMkB,iBAAiB,MAAMxC,gBAAAA,CAAW,QAAQyC,YAAY,CAACnB,WAAWoB,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAMjD,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;YAC9DN,KAAAA,EAAO;AAAEzC,gBAAAA;AAAG,aAAA;YACZgD,IAAAA,EAAM;AACJ,gBAAA,GAAGvB,UAAU;gBACboB,QAAAA,EAAUF;AACZ,aAAA;YACAD,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEA7C,QAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBC,MAAM,EAAE;AAAE/C,YAAAA,IAAAA,EAAMgD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,oCAAAA,CAA0B;AAAEzD,YAAAA;SAAO,EAAG;AAAEuC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOqB,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMjD,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;QAC9DN,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QACZgD,IAAAA,EAAMvB,UAAAA;QACNiB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM3C,0BAA0BC,EAAAA,EAAIyB,UAAAA,CAAAA;AAEpC,IAAA,IAAIqB,WAAAA,EAAa;AACfjD,QAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBC,MAAM,EAAE;AAAE/C,YAAAA,IAAAA,EAAMgD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,oCAAAA,CAA0B;AAAEzD,YAAAA;SAAO,EAAG;AAAEuC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOqB,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOxD,EAAAA,GAAAA;;IAExB,MAAMyD,YAAAA,GAAe,MAAM5D,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAChEC,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QACZ0C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACe,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAatB,KAAK,CAACuB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAKnE,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMqC,cAAAA,GAAiB,MAAM3B,gBAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAItE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMuE,WAAAA,GAAc,MAAMjE,MAAAA,CAAOyC,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNwB,MAAM,CAAC;QAAEtB,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QAAG0C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAM5C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAekE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMlE,cAAAA,CAAe,OAAA,CAAA,CAASmE,sBAAsB,CAACC,MAAAA,CAAOlE,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgB,MAAM,EAAE;AAAE9D,QAAAA,IAAAA,EAAMgD,YAAAA,CAAaS,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,+BAAAA,CAAqB;AAAEvE,QAAAA;KAAO,EAAGiE,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMO,cAAc,OAAOpD,GAAAA,GAAAA;;AAEzB,IAAA,MAAMa,cAAAA,GAAiB,MAAM3B,gBAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;IAC3E,MAAMuC,sBAAAA,GAAyB,MAAMzE,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QACxE9B,KAAAA,EAAO;YACLzC,EAAAA,EAAIiB,GAAAA;YACJkB,KAAAA,EAAO;AAAEnC,gBAAAA,EAAAA,EAAI8B,eAAe9B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI8B,cAAAA,CAAe+B,UAAU,KAAKS,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAI/E,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMiF,eAAe,EAAE;IACvB,KAAK,MAAMxE,MAAMiB,GAAAA,CAAK;QACpB,MAAM6C,WAAAA,GAAc,MAAMjE,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAewB,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAEzC,gBAAAA;AAAG,aAAA;YACZ0C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAM5C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAekE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMlE,cAAAA,CAAe,OAAA,CAAA,CAASmE,sBAAsB,CAACC,MAAAA,CAAOlE,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAwE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMzC,6BAAAA,CAA8BJ,GAAAA,CAAAA;AAEpCpB,IAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,6BAAAA,CAAmBgB,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAarD,GAAG,CAAC,CAAC2C,cAAgBT,YAAAA,CAAaS,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,+BAAAA,CAAqB;AAAEvE,YAAAA;SAAO,EAAGiE,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkBlD,kBAAAA,CAAEmD,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAM/C,uBAAuB,OAAOiD,MAAAA,GAAAA;IAClC,MAAMzE,IAAAA,GAAQ,MAAMmC,OAAAA,CAAQsC,MAAAA,CAAAA;AAC5B,IAAA,MAAMhD,cAAAA,GAAiB,MAAM3B,gBAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKkB,wBAAAA,CAAkB1E,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMgD,eAAe,CAAChD,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGqB,kBAAAA,CAAEsD,IAAI,CAAC3E,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF8B,QAAAA,KAAAA,EAAO9B,KAAK8B,KAAK,IAAI9B,KAAK8B,KAAK,CAAChB,GAAG,CAACwD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMnC,OAAAA,GAAU,OAAOxC,EAAAA,EAAS0C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAO7C,OAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;AAAG0C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAMuC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAOpF,OAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QAAE9B,KAAAA,EAAO;YAAEjC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACA4D,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAb,IAAAA,UAAAA;AACAhC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/services/user.mjs CHANGED Viewed

@@ -1,5 +1,4 @@
-import ___default from 'lodash';
-import { pipe, castArray, map, toNumber } from 'lodash/fp';
+import ___default, { castArray, toNumber } from 'lodash';
 import { errors, arrays } from '@strapi/utils';
 import { hasSuperAdminRole } from '../../../../server/src/domain/user.mjs';
 import constants from '../../../../server/src/services/constants.mjs';
@@ -33,7 +32,7 @@ const getSessionManager = ()=>{
         });
     }
 };
-const castNumberArray = pipe(castArray, map(toNumber));
+const castNumberArray = (ids)=>castArray(ids).map((id)=>toNumber(id));
 const removeFromEEDisabledUsersList = async (ids)=>{
     let idsToCheck;
     if (typeof ids === 'object') {

package/dist/server/ee/server/src/services/user.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user.mjs","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _ from 'lodash';\nimport { pipe, map, castArray, toNumber } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport {\n LEGACY_USER_EVENTS,\n emitAdminUserDeleted,\n emitAdminUserUpdateAudits,\n touchesTrackedFields,\n} from '../../../../server/src/audit-logs/admin-users';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n const manager = strapi.sessionManager;\n return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n /\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const user = disabledUsers.find((user: any) => user.id === Number(id));\n if (!user) {\n return;\n }\n\n if (user.isActive !== input.isActive) {\n const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n }\n};\n\nconst castNumberArray = pipe(castArray, map(toNumber));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n let idsToCheck: any;\n if (typeof ids === 'object') {\n idsToCheck = castNumberArray(ids);\n } else {\n idsToCheck = [Number(ids)];\n }\n\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n};\n\n/\n Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n /\nconst updateById = async (id: any, attributes: any) => {\n // Check at least one super admin remains\n if (_.has(attributes, 'roles')) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n if (lastAdminUser && willRemoveSuperAdminRole) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // cannot disable last super admin\n if (attributes.isActive === false) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n if (lastAdminUser) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // The audit log records what changed, so it needs the row before the write\n const previous = touchesTrackedFields(attributes)\n ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n : null;\n\n // hash password if a new one is sent\n if (_.has(attributes, 'password')) {\n const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: {\n ...attributes,\n password: hashedPassword,\n },\n populate: ['roles'],\n });\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n return updatedUser;\n }\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: attributes,\n populate: ['roles'],\n });\n\n await updateEEDisabledUsersList(id, attributes);\n\n if (updatedUser) {\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n }\n\n return updatedUser;\n};\n\n/* Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n /\nconst deleteById = async (id: unknown) => {\n // Check at least one super admin remains\n const userToDelete = await strapi.db.query('admin::user').findOne({\n where: { id },\n populate: ['roles'],\n });\n\n if (!userToDelete) {\n return null;\n }\n\n if (userToDelete) {\n if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n if (superAdminRole.usersCount === 1) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n }\n\n const deletedUser = await strapi.db\n .query('admin::user')\n .delete({ where: { id }, populate: ['roles'] });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n await removeFromEEDisabledUsersList(id);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n await emitAdminUserDeleted({ strapi }, deletedUser);\n\n return deletedUser;\n};\n\n/* Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n /\nconst deleteByIds = async (ids: any) => {\n // Check at least one super admin remains\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n where: {\n id: ids,\n roles: { id: superAdminRole.id },\n },\n });\n\n if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n\n const deletedUsers = [];\n for (const id of ids) {\n const deletedUser = await strapi.db.query('admin::user').delete({\n where: { id },\n populate: ['roles'],\n });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n deletedUsers.push(deletedUser);\n }\n\n await removeFromEEDisabledUsersList(ids);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n });\n\n for (const deletedUser of deletedUsers) {\n await emitAdminUserDeleted({ strapi }, deletedUser);\n }\n\n return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/\n Check if a user is the last super admin\n * @param {int\|string} userId user's id to look for\n /\nconst isLastSuperAdminUser = async (userId: unknown) => {\n const user = (await findOne(userId)) as any;\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/\n Remove private user fields\n * @param {Object} user - user to sanitize\n /\nconst sanitizeUser = (user: any) => {\n return {\n ..._.omit(user, [\n 'password',\n 'resetPasswordToken',\n 'resetPasswordTokenExpiresAt',\n 'registrationToken',\n 'roles',\n ]),\n roles: user.roles && user.roles.map(sanitizeUserRoles),\n };\n};\n\n/\n Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n updateEEDisabledUsersList,\n removeFromEEDisabledUsersList,\n getCurrentActiveUserCount,\n deleteByIds,\n deleteById,\n updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","pipe","castArray","map","toNumber","removeFromEEDisabledUsersList","ids","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","previous","touchesTrackedFields","db","query","findOne","where","populate","hashedPassword","hashPassword","password","updatedUser","update","data","eventHub","emit","LEGACY_USER_EVENTS","UPDATE","sanitizeUser","emitAdminUserUpdateAudits","updated","deleteById","userToDelete","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;;AAaA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkBC,IAAAA,CAAKC,SAAAA,EAAWC,GAAAA,CAAIC,QAAAA,CAAAA,CAAAA;AAE5C,MAAMC,gCAAgC,OAAOC,GAAAA,GAAAA;IAC3C,IAAIC,UAAAA;IACJ,IAAI,OAAOD,QAAQ,QAAA,EAAU;AAC3BC,QAAAA,UAAAA,GAAaP,eAAAA,CAAgBM,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLC,UAAAA,GAAa;YAAChB,MAAAA,CAAOe,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMpB,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACkB,UAAAA,CAAWC,QAAQ,CAACnB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMgB,UAAAA,GAAa,OAAOzB,EAAAA,EAAS0B,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,MAAM+B,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe/B,EAAE,CAAA;AAE3F,QAAA,IAAI6B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAI1C,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAImC,UAAAA,CAAWlB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMqB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB9B,EAAAA,CAAAA;AACjD,QAAA,IAAI6B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAItC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM8C,QAAAA,GAAWC,oBAAAA,CAAqBZ,UAAAA,CAAAA,GAClC,MAAM7B,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAIhB,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMkB,iBAAiB,MAAMzC,UAAAA,CAAW,QAAQ0C,YAAY,CAACnB,WAAWoB,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;YAC9DN,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZiD,IAAAA,EAAM;AACJ,gBAAA,GAAGvB,UAAU;gBACboB,QAAAA,EAAUF;AACZ,aAAA;YACAD,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEA9C,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,yBAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOqB,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMlD,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;QAC9DN,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZiD,IAAAA,EAAMvB,UAAAA;QACNiB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM5C,0BAA0BC,EAAAA,EAAI0B,UAAAA,CAAAA;AAEpC,IAAA,IAAIqB,WAAAA,EAAa;AACflD,QAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBC,MAAM,EAAE;AAAEhD,YAAAA,IAAAA,EAAMiD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,yBAAAA,CAA0B;AAAE1D,YAAAA;SAAO,EAAG;AAAEwC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOqB,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOzD,EAAAA,GAAAA;;IAExB,MAAM0D,YAAAA,GAAe,MAAM7D,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAChEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QACZ2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACe,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAatB,KAAK,CAACuB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAKpE,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMsC,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIvE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMwE,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNwB,MAAM,CAAC;QAAEtB,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;QAAG2C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgB,MAAM,EAAE;AAAE/D,QAAAA,IAAAA,EAAMiD,YAAAA,CAAaS,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,oBAAAA,CAAqB;AAAExE,QAAAA;KAAO,EAAGkE,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMO,cAAc,OAAOhD,GAAAA,GAAAA;;AAEzB,IAAA,MAAMS,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;IAC3E,MAAMuC,sBAAAA,GAAyB,MAAM1E,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QACxE9B,KAAAA,EAAO;YACL1C,EAAAA,EAAIsB,GAAAA;YACJc,KAAAA,EAAO;AAAEpC,gBAAAA,EAAAA,EAAI+B,eAAe/B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI+B,cAAAA,CAAe+B,UAAU,KAAKS,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIhF,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMkF,eAAe,EAAE;IACvB,KAAK,MAAMzE,MAAMsB,GAAAA,CAAK;QACpB,MAAMyC,WAAAA,GAAc,MAAMlE,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAewB,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAE1C,gBAAAA;AAAG,aAAA;YACZ2C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAM7C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAemE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMnE,cAAAA,CAAe,OAAA,CAAA,CAASoE,sBAAsB,CAACC,MAAAA,CAAOnE,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAyE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAM1C,6BAAAA,CAA8BC,GAAAA,CAAAA;AAEpCzB,IAAAA,MAAAA,CAAOqD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgB,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAatD,GAAG,CAAC,CAAC4C,cAAgBT,YAAAA,CAAaS,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,oBAAAA,CAAqB;AAAExE,YAAAA;SAAO,EAAGkE,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkBlD,UAAAA,CAAEmD,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAM/C,uBAAuB,OAAOiD,MAAAA,GAAAA;IAClC,MAAM1E,IAAAA,GAAQ,MAAMoC,OAAAA,CAAQsC,MAAAA,CAAAA;AAC5B,IAAA,MAAMhD,cAAAA,GAAiB,MAAM5B,UAAAA,CAAW,MAAA,CAAA,CAAQ6B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKkB,iBAAAA,CAAkB3E,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMiD,eAAe,CAACjD,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGsB,UAAAA,CAAEsD,IAAI,CAAC5E,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF+B,QAAAA,KAAAA,EAAO/B,KAAK+B,KAAK,IAAI/B,KAAK+B,KAAK,CAACjB,GAAG,CAACyD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMnC,OAAAA,GAAU,OAAOzC,EAAAA,EAAS2C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAO9C,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE1C,YAAAA;AAAG,SAAA;AAAG2C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAMuC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAOrF,OAAO0C,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QAAE9B,KAAAA,EAAO;YAAElC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACA6D,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAb,IAAAA,UAAAA;AACAhC,IAAAA;AACF,CAAA;;;;"}
1	+ {"version":3,"file":"user.mjs","sources":["../../../../../../ee/server/src/services/user.ts"],"sourcesContent":["import _, { castArray, toNumber } from 'lodash';\n\nimport { arrays, errors } from '@strapi/utils';\nimport { hasSuperAdminRole } from '../../../../server/src/domain/user';\nimport constants from '../../../../server/src/services/constants';\nimport {\n LEGACY_USER_EVENTS,\n emitAdminUserDeleted,\n emitAdminUserUpdateAudits,\n touchesTrackedFields,\n} from '../../../../server/src/audit-logs/admin-users';\nimport { getService } from '../utils';\n\nconst { ValidationError } = errors;\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst getSessionManager = () => {\n const manager = strapi.sessionManager;\n return manager ?? null;\n};\n\n/** Checks if ee disabled users list needs to be updated\n * @param {string} id\n * @param {object} input\n /\nconst updateEEDisabledUsersList = async (id: string, input: any) => {\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const user = disabledUsers.find((user: any) => user.id === Number(id));\n if (!user) {\n return;\n }\n\n if (user.isActive !== input.isActive) {\n const newDisabledUsersList = disabledUsers.filter((user: any) => user.id !== Number(id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n }\n};\n\nconst castNumberArray = (ids: unknown) => castArray(ids).map((id) => toNumber(id));\n\nconst removeFromEEDisabledUsersList = async (ids: unknown) => {\n let idsToCheck: any;\n if (typeof ids === 'object') {\n idsToCheck = castNumberArray(ids);\n } else {\n idsToCheck = [Number(ids)];\n }\n\n const disabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n if (!disabledUsers) {\n return;\n }\n\n const newDisabledUsersList = disabledUsers.filter((user: any) => !idsToCheck.includes(user.id));\n await strapi.store.set({\n type: 'ee',\n key: 'disabled_users',\n value: newDisabledUsersList,\n });\n};\n\n/\n Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n * @returns {Promise<user>}\n /\nconst updateById = async (id: any, attributes: any) => {\n // Check at least one super admin remains\n if (_.has(attributes, 'roles')) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles, superAdminRole.id);\n\n if (lastAdminUser && willRemoveSuperAdminRole) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // cannot disable last super admin\n if (attributes.isActive === false) {\n const lastAdminUser = await isLastSuperAdminUser(id);\n if (lastAdminUser) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n\n // The audit log records what changed, so it needs the row before the write\n const previous = touchesTrackedFields(attributes)\n ? await strapi.db.query('admin::user').findOne({ where: { id }, populate: ['roles'] })\n : null;\n\n // hash password if a new one is sent\n if (_.has(attributes, 'password')) {\n const hashedPassword = await getService('auth').hashPassword(attributes.password);\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: {\n ...attributes,\n password: hashedPassword,\n },\n populate: ['roles'],\n });\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n\n return updatedUser;\n }\n\n const updatedUser = await strapi.db.query('admin::user').update({\n where: { id },\n data: attributes,\n populate: ['roles'],\n });\n\n await updateEEDisabledUsersList(id, attributes);\n\n if (updatedUser) {\n strapi.eventHub.emit(LEGACY_USER_EVENTS.UPDATE, { user: sanitizeUser(updatedUser) });\n await emitAdminUserUpdateAudits({ strapi }, { previous, updated: updatedUser, attributes });\n }\n\n return updatedUser;\n};\n\n/* Delete a user\n * @param id id of the user to delete\n * @returns {Promise<user>}\n /\nconst deleteById = async (id: unknown) => {\n // Check at least one super admin remains\n const userToDelete = await strapi.db.query('admin::user').findOne({\n where: { id },\n populate: ['roles'],\n });\n\n if (!userToDelete) {\n return null;\n }\n\n if (userToDelete) {\n if (userToDelete.roles.some((r: any) => r.code === SUPER_ADMIN_CODE)) {\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n if (superAdminRole.usersCount === 1) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n }\n }\n\n const deletedUser = await strapi.db\n .query('admin::user')\n .delete({ where: { id }, populate: ['roles'] });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n await removeFromEEDisabledUsersList(id);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, { user: sanitizeUser(deletedUser) });\n await emitAdminUserDeleted({ strapi }, deletedUser);\n\n return deletedUser;\n};\n\n/* Delete a user\n * @param ids ids of the users to delete\n * @returns {Promise<user>}\n /\nconst deleteByIds = async (ids: any) => {\n // Check at least one super admin remains\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n where: {\n id: ids,\n roles: { id: superAdminRole.id },\n },\n });\n\n if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n throw new ValidationError('You must have at least one user with super admin role.');\n }\n\n const deletedUsers = [];\n for (const id of ids) {\n const deletedUser = await strapi.db.query('admin::user').delete({\n where: { id },\n populate: ['roles'],\n });\n\n // Invalidate all sessions for the deleted user\n const sessionManager = getSessionManager();\n if (sessionManager && sessionManager.hasOrigin('admin')) {\n await sessionManager('admin').invalidateRefreshToken(String(id));\n }\n\n deletedUsers.push(deletedUser);\n }\n\n await removeFromEEDisabledUsersList(ids);\n\n strapi.eventHub.emit(LEGACY_USER_EVENTS.DELETE, {\n users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n });\n\n for (const deletedUser of deletedUsers) {\n await emitAdminUserDeleted({ strapi }, deletedUser);\n }\n\n return deletedUsers;\n};\n\nconst sanitizeUserRoles = (role: unknown) => _.pick(role, ['id', 'name', 'description', 'code']);\n\n/\n Check if a user is the last super admin\n * @param {int\|string} userId user's id to look for\n /\nconst isLastSuperAdminUser = async (userId: unknown) => {\n const user = (await findOne(userId)) as any;\n const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/\n Remove private user fields\n * @param {Object} user - user to sanitize\n /\nconst sanitizeUser = (user: any) => {\n return {\n ..._.omit(user, [\n 'password',\n 'resetPasswordToken',\n 'resetPasswordTokenExpiresAt',\n 'registrationToken',\n 'roles',\n ]),\n roles: user.roles && user.roles.map(sanitizeUserRoles),\n };\n};\n\n/\n Find one user\n */\nconst findOne = async (id: any, populate = ['roles']) => {\n return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\nconst getCurrentActiveUserCount = async () => {\n return strapi.db.query('admin::user').count({ where: { isActive: true } });\n};\n\nexport default {\n updateEEDisabledUsersList,\n removeFromEEDisabledUsersList,\n getCurrentActiveUserCount,\n deleteByIds,\n deleteById,\n updateById,\n};\n"],"names":["ValidationError","errors","SUPER_ADMIN_CODE","constants","getSessionManager","manager","strapi","sessionManager","updateEEDisabledUsersList","id","input","disabledUsers","getService","getDisabledUserList","user","find","Number","isActive","newDisabledUsersList","filter","store","set","type","key","value","castNumberArray","ids","castArray","map","toNumber","removeFromEEDisabledUsersList","idsToCheck","includes","updateById","attributes","_","has","lastAdminUser","isLastSuperAdminUser","superAdminRole","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","roles","previous","touchesTrackedFields","db","query","findOne","where","populate","hashedPassword","hashPassword","password","updatedUser","update","data","eventHub","emit","LEGACY_USER_EVENTS","UPDATE","sanitizeUser","emitAdminUserUpdateAudits","updated","deleteById","userToDelete","some","r","code","usersCount","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","DELETE","emitAdminUserDeleted","deleteByIds","nbOfSuperAdminToDelete","count","deletedUsers","push","users","sanitizeUserRoles","role","pick","userId","hasSuperAdminRole","omit","getCurrentActiveUserCount"],"mappings":";;;;;;;AAaA,MAAM,EAAEA,eAAe,EAAE,GAAGC,MAAAA;AAC5B,MAAM,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAMC,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,yBAAAA,GAA4B,OAAOC,EAAAA,EAAYC,KAAAA,GAAAA;AACnD,IAAA,MAAMC,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMG,IAAAA,GAAOH,cAAcI,IAAI,CAAC,CAACD,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AAClE,IAAA,IAAI,CAACK,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,IAAIA,IAAAA,CAAKG,QAAQ,KAAKP,KAAAA,CAAMO,QAAQ,EAAE;QACpC,MAAMC,oBAAAA,GAAuBP,cAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAcA,IAAAA,CAAKL,EAAE,KAAKO,MAAAA,CAAOP,EAAAA,CAAAA,CAAAA;AACpF,QAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;YACrBC,IAAAA,EAAM,IAAA;YACNC,GAAAA,EAAK,gBAAA;YACLC,KAAAA,EAAON;AACT,SAAA,CAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMO,eAAAA,GAAkB,CAACC,GAAAA,GAAiBC,SAAAA,CAAUD,KAAKE,GAAG,CAAC,CAACnB,EAAAA,GAAOoB,QAAAA,CAASpB,EAAAA,CAAAA,CAAAA;AAE9E,MAAMqB,gCAAgC,OAAOJ,GAAAA,GAAAA;IAC3C,IAAIK,UAAAA;IACJ,IAAI,OAAOL,QAAQ,QAAA,EAAU;AAC3BK,QAAAA,UAAAA,GAAaN,eAAAA,CAAgBC,GAAAA,CAAAA;IAC/B,CAAA,MAAO;QACLK,UAAAA,GAAa;YAACf,MAAAA,CAAOU,GAAAA;AAAK,SAAA;AAC5B,IAAA;AAEA,IAAA,MAAMf,aAAAA,GAAgB,MAAMC,UAAAA,CAAW,kBAAA,CAAA,CAAoBC,mBAAmB,EAAA;AAE9E,IAAA,IAAI,CAACF,aAAAA,EAAe;AAClB,QAAA;AACF,IAAA;IAEA,MAAMO,oBAAAA,GAAuBP,aAAAA,CAAcQ,MAAM,CAAC,CAACL,IAAAA,GAAc,CAACiB,UAAAA,CAAWC,QAAQ,CAAClB,IAAAA,CAAKL,EAAE,CAAA,CAAA;AAC7F,IAAA,MAAMH,MAAAA,CAAOc,KAAK,CAACC,GAAG,CAAC;QACrBC,IAAAA,EAAM,IAAA;QACNC,GAAAA,EAAK,gBAAA;QACLC,KAAAA,EAAON;AACT,KAAA,CAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAMe,UAAAA,GAAa,OAAOxB,EAAAA,EAASyB,UAAAA,GAAAA;;AAEjC,IAAA,IAAIC,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB7B,EAAAA,CAAAA;AACjD,QAAA,MAAM8B,cAAAA,GAAiB,MAAM3B,UAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACT,UAAAA,CAAWU,KAAK,EAAEL,cAAAA,CAAe9B,EAAE,CAAA;AAE3F,QAAA,IAAI4B,iBAAiBI,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIzC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIkC,UAAAA,CAAWjB,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMoB,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqB7B,EAAAA,CAAAA;AACjD,QAAA,IAAI4B,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIrC,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,MAAM6C,QAAAA,GAAWC,oBAAAA,CAAqBZ,UAAAA,CAAAA,GAClC,MAAM5B,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QAAG0C,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,CAAA,GAClF,IAAA;;AAGJ,IAAA,IAAIhB,UAAAA,CAAEC,GAAG,CAACF,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAMkB,iBAAiB,MAAMxC,UAAAA,CAAW,QAAQyC,YAAY,CAACnB,WAAWoB,QAAQ,CAAA;QAEhF,MAAMC,WAAAA,GAAc,MAAMjD,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;YAC9DN,KAAAA,EAAO;AAAEzC,gBAAAA;AAAG,aAAA;YACZgD,IAAAA,EAAM;AACJ,gBAAA,GAAGvB,UAAU;gBACboB,QAAAA,EAAUF;AACZ,aAAA;YACAD,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEA7C,QAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBC,MAAM,EAAE;AAAE/C,YAAAA,IAAAA,EAAMgD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,yBAAAA,CAA0B;AAAEzD,YAAAA;SAAO,EAAG;AAAEuC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;QAEzF,OAAOqB,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMjD,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeQ,MAAM,CAAC;QAC9DN,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QACZgD,IAAAA,EAAMvB,UAAAA;QACNiB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,MAAM3C,0BAA0BC,EAAAA,EAAIyB,UAAAA,CAAAA;AAEpC,IAAA,IAAIqB,WAAAA,EAAa;AACfjD,QAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBC,MAAM,EAAE;AAAE/C,YAAAA,IAAAA,EAAMgD,YAAAA,CAAaP,WAAAA;AAAa,SAAA,CAAA;AAClF,QAAA,MAAMQ,yBAAAA,CAA0B;AAAEzD,YAAAA;SAAO,EAAG;AAAEuC,YAAAA,QAAAA;YAAUmB,OAAAA,EAAST,WAAAA;AAAarB,YAAAA;AAAW,SAAA,CAAA;AAC3F,IAAA;IAEA,OAAOqB,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMU,aAAa,OAAOxD,EAAAA,GAAAA;;IAExB,MAAMyD,YAAAA,GAAe,MAAM5D,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAChEC,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QACZ0C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACe,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAatB,KAAK,CAACuB,IAAI,CAAC,CAACC,CAAAA,GAAWA,CAAAA,CAAEC,IAAI,KAAKnE,gBAAAA,CAAAA,EAAmB;AACpE,YAAA,MAAMqC,cAAAA,GAAiB,MAAM3B,UAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;YAC3E,IAAID,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAItE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMuE,WAAAA,GAAc,MAAMjE,MAAAA,CAAOyC,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNwB,MAAM,CAAC;QAAEtB,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;QAAG0C,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAM5C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAekE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAMlE,cAAAA,CAAe,OAAA,CAAA,CAASmE,sBAAsB,CAACC,MAAAA,CAAOlE,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA,IAAA,MAAMqB,6BAAAA,CAA8BrB,EAAAA,CAAAA;AAEpCH,IAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgB,MAAM,EAAE;AAAE9D,QAAAA,IAAAA,EAAMgD,YAAAA,CAAaS,WAAAA;AAAa,KAAA,CAAA;AAClF,IAAA,MAAMM,oBAAAA,CAAqB;AAAEvE,QAAAA;KAAO,EAAGiE,WAAAA,CAAAA;IAEvC,OAAOA,WAAAA;AACT,CAAA;AAEA;;;IAIA,MAAMO,cAAc,OAAOpD,GAAAA,GAAAA;;AAEzB,IAAA,MAAMa,cAAAA,GAAiB,MAAM3B,UAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;IAC3E,MAAMuC,sBAAAA,GAAyB,MAAMzE,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QACxE9B,KAAAA,EAAO;YACLzC,EAAAA,EAAIiB,GAAAA;YACJkB,KAAAA,EAAO;AAAEnC,gBAAAA,EAAAA,EAAI8B,eAAe9B;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAI8B,cAAAA,CAAe+B,UAAU,KAAKS,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAI/E,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMiF,eAAe,EAAE;IACvB,KAAK,MAAMxE,MAAMiB,GAAAA,CAAK;QACpB,MAAM6C,WAAAA,GAAc,MAAMjE,MAAAA,CAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAewB,MAAM,CAAC;YAC9DtB,KAAAA,EAAO;AAAEzC,gBAAAA;AAAG,aAAA;YACZ0C,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAM5C,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAekE,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAMlE,cAAAA,CAAe,OAAA,CAAA,CAASmE,sBAAsB,CAACC,MAAAA,CAAOlE,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAwE,QAAAA,YAAAA,CAAaC,IAAI,CAACX,WAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,MAAMzC,6BAAAA,CAA8BJ,GAAAA,CAAAA;AAEpCpB,IAAAA,MAAAA,CAAOoD,QAAQ,CAACC,IAAI,CAACC,kBAAAA,CAAmBgB,MAAM,EAAE;AAC9CO,QAAAA,KAAAA,EAAOF,YAAAA,CAAarD,GAAG,CAAC,CAAC2C,cAAgBT,YAAAA,CAAaS,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,KAAK,MAAMA,eAAeU,YAAAA,CAAc;AACtC,QAAA,MAAMJ,oBAAAA,CAAqB;AAAEvE,YAAAA;SAAO,EAAGiE,WAAAA,CAAAA;AACzC,IAAA;IAEA,OAAOU,YAAAA;AACT,CAAA;AAEA,MAAMG,oBAAoB,CAACC,IAAAA,GAAkBlD,UAAAA,CAAEmD,IAAI,CAACD,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAE/F;;;IAIA,MAAM/C,uBAAuB,OAAOiD,MAAAA,GAAAA;IAClC,MAAMzE,IAAAA,GAAQ,MAAMmC,OAAAA,CAAQsC,MAAAA,CAAAA;AAC5B,IAAA,MAAMhD,cAAAA,GAAiB,MAAM3B,UAAAA,CAAW,MAAA,CAAA,CAAQ4B,2BAA2B,EAAA;AAE3E,IAAA,OAAOD,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKkB,iBAAAA,CAAkB1E,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAMgD,eAAe,CAAChD,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGqB,UAAAA,CAAEsD,IAAI,CAAC3E,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACF8B,QAAAA,KAAAA,EAAO9B,KAAK8B,KAAK,IAAI9B,KAAK8B,KAAK,CAAChB,GAAG,CAACwD,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMnC,OAAAA,GAAU,OAAOxC,EAAAA,EAAS0C,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AAClD,IAAA,OAAO7C,OAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEzC,YAAAA;AAAG,SAAA;AAAG0C,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA,MAAMuC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,OAAOpF,OAAOyC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAegC,KAAK,CAAC;QAAE9B,KAAAA,EAAO;YAAEjC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC1E,CAAA;AAEA,WAAe;AACbT,IAAAA,yBAAAA;AACAsB,IAAAA,6BAAAA;AACA4D,IAAAA,yBAAAA;AACAZ,IAAAA,WAAAA;AACAb,IAAAA,UAAAA;AACAhC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/utils/sso-lock.js CHANGED Viewed

@@ -1,6 +1,6 @@
 'use strict';
-var fp = require('lodash/fp');
+var _ = require('lodash');
 const isSsoLocked = async (user)=>{
     if (!strapi.ee.features.isEnabled('sso')) {
@@ -18,7 +18,7 @@ const isSsoLocked = async (user)=>{
         key: 'auth'
     });
     const lockedRoles = providers.ssoLockedRoles ?? [];
-    if (fp.isEmpty(lockedRoles)) {
+    if (_.isEmpty(lockedRoles)) {
         return false;
     }
     const roles = // If the roles are pre-loaded for the given user, then use them

package/dist/server/ee/server/src/utils/sso-lock.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-lock.js","sources":["../../../../../../ee/server/src/utils/sso-lock.ts"],"sourcesContent":["import { isEmpty } from 'lodash~~/fp~~';\n\nexport const isSsoLocked = async (user: any) => {\n if (!strapi.ee.features.isEnabled('sso')) {\n return false;\n }\n\n if (!user) {\n throw new Error('Missing user object');\n }\n\n // check if any roles are locked\n const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n const lockedRoles = providers.ssoLockedRoles ?? [];\n if (isEmpty(lockedRoles)) {\n return false;\n }\n\n const roles =\n // If the roles are pre-loaded for the given user, then use them\n user.roles ??\n // Otherwise, try to load the role based on the given user ID\n (await strapi.db.query('admin::user').load(user, 'roles', { roles: { fields: ['id'] } })) ??\n // If the query fails somehow, default to an empty array\n [];\n\n // Check if any of the user's roles are in lockedRoles\n const isLocked = lockedRoles.some((lockedId: string) =>\n // lockedRoles will be a string to avoid issues with frontend and bigints\n roles.some((role: any) => lockedId === role.id.toString())\n );\n\n return isLocked;\n};\n\nexport default {\n isSsoLocked,\n};\n"],"names":["isSsoLocked","user","strapi","ee","features","isEnabled","Error","adminStore","store","type","name","providers","get","key","lockedRoles","ssoLockedRoles","isEmpty","roles","db","query","load","fields","isLocked","some","lockedId","role","id","toString"],"mappings":";;;;AAEO,MAAMA,cAAc,OAAOC,IAAAA,GAAAA;IAChC,IAAI,CAACC,OAAOC,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,KAAA,CAAA,EAAQ;QACxC,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIK,KAAAA,CAAM,qBAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,UAAAA,GAAa,MAAML,MAAAA,CAAOM,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC1D,IAAA,MAAMC,WAAAA,GAAcH,SAAAA,CAAUI,cAAc,IAAI,EAAE;AAClD,IAAA,IAAIC,~~WAAQF~~,WAAAA,CAAAA,EAAc;QACxB,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,MAAMG;IAEJhB,IAAAA,CAAKgB,KAAK;IAET,MAAMf,MAAAA,CAAOgB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,IAAI,CAACnB,IAAAA,EAAM,OAAA,EAAS;QAAEgB,KAAAA,EAAO;YAAEI,MAAAA,EAAQ;AAAC,gBAAA;AAAK;AAAC;AAAE,KAAA,CAAA;IAEtF,EAAE;;AAGJ,IAAA,MAAMC,WAAWR,WAAAA,CAAYS,IAAI,CAAC,CAACC;QAEjCP,KAAAA,CAAMM,IAAI,CAAC,CAACE,IAAAA,GAAcD,aAAaC,IAAAA,CAAKC,EAAE,CAACC,QAAQ,EAAA,CAAA,CAAA;IAGzD,OAAOL,QAAAA;AACT;;;;"}
1	+ {"version":3,"file":"sso-lock.js","sources":["../../../../../../ee/server/src/utils/sso-lock.ts"],"sourcesContent":["import { isEmpty } from 'lodash';\n\nexport const isSsoLocked = async (user: any) => {\n if (!strapi.ee.features.isEnabled('sso')) {\n return false;\n }\n\n if (!user) {\n throw new Error('Missing user object');\n }\n\n // check if any roles are locked\n const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n const lockedRoles = providers.ssoLockedRoles ?? [];\n if (isEmpty(lockedRoles)) {\n return false;\n }\n\n const roles =\n // If the roles are pre-loaded for the given user, then use them\n user.roles ??\n // Otherwise, try to load the role based on the given user ID\n (await strapi.db.query('admin::user').load(user, 'roles', { roles: { fields: ['id'] } })) ??\n // If the query fails somehow, default to an empty array\n [];\n\n // Check if any of the user's roles are in lockedRoles\n const isLocked = lockedRoles.some((lockedId: string) =>\n // lockedRoles will be a string to avoid issues with frontend and bigints\n roles.some((role: any) => lockedId === role.id.toString())\n );\n\n return isLocked;\n};\n\nexport default {\n isSsoLocked,\n};\n"],"names":["isSsoLocked","user","strapi","ee","features","isEnabled","Error","adminStore","store","type","name","providers","get","key","lockedRoles","ssoLockedRoles","isEmpty","roles","db","query","load","fields","isLocked","some","lockedId","role","id","toString"],"mappings":";;;;AAEO,MAAMA,cAAc,OAAOC,IAAAA,GAAAA;IAChC,IAAI,CAACC,OAAOC,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,KAAA,CAAA,EAAQ;QACxC,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIK,KAAAA,CAAM,qBAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,UAAAA,GAAa,MAAML,MAAAA,CAAOM,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC1D,IAAA,MAAMC,WAAAA,GAAcH,SAAAA,CAAUI,cAAc,IAAI,EAAE;AAClD,IAAA,IAAIC,UAAQF,WAAAA,CAAAA,EAAc;QACxB,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,MAAMG;IAEJhB,IAAAA,CAAKgB,KAAK;IAET,MAAMf,MAAAA,CAAOgB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,IAAI,CAACnB,IAAAA,EAAM,OAAA,EAAS;QAAEgB,KAAAA,EAAO;YAAEI,MAAAA,EAAQ;AAAC,gBAAA;AAAK;AAAC;AAAE,KAAA,CAAA;IAEtF,EAAE;;AAGJ,IAAA,MAAMC,WAAWR,WAAAA,CAAYS,IAAI,CAAC,CAACC;QAEjCP,KAAAA,CAAMM,IAAI,CAAC,CAACE,IAAAA,GAAcD,aAAaC,IAAAA,CAAKC,EAAE,CAACC,QAAQ,EAAA,CAAA,CAAA;IAGzD,OAAOL,QAAAA;AACT;;;;"}

package/dist/server/ee/server/src/utils/sso-lock.mjs CHANGED Viewed

@@ -1,4 +1,4 @@
-import { isEmpty } from 'lodash/fp';
+import { isEmpty } from 'lodash';
 const isSsoLocked = async (user)=>{
     if (!strapi.ee.features.isEnabled('sso')) {

package/dist/server/ee/server/src/utils/sso-lock.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-lock.mjs","sources":["../../../../../../ee/server/src/utils/sso-lock.ts"],"sourcesContent":["import { isEmpty } from 'lodash~~/fp~~';\n\nexport const isSsoLocked = async (user: any) => {\n if (!strapi.ee.features.isEnabled('sso')) {\n return false;\n }\n\n if (!user) {\n throw new Error('Missing user object');\n }\n\n // check if any roles are locked\n const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n const lockedRoles = providers.ssoLockedRoles ?? [];\n if (isEmpty(lockedRoles)) {\n return false;\n }\n\n const roles =\n // If the roles are pre-loaded for the given user, then use them\n user.roles ??\n // Otherwise, try to load the role based on the given user ID\n (await strapi.db.query('admin::user').load(user, 'roles', { roles: { fields: ['id'] } })) ??\n // If the query fails somehow, default to an empty array\n [];\n\n // Check if any of the user's roles are in lockedRoles\n const isLocked = lockedRoles.some((lockedId: string) =>\n // lockedRoles will be a string to avoid issues with frontend and bigints\n roles.some((role: any) => lockedId === role.id.toString())\n );\n\n return isLocked;\n};\n\nexport default {\n isSsoLocked,\n};\n"],"names":["isSsoLocked","user","strapi","ee","features","isEnabled","Error","adminStore","store","type","name","providers","get","key","lockedRoles","ssoLockedRoles","isEmpty","roles","db","query","load","fields","isLocked","some","lockedId","role","id","toString"],"mappings":";;AAEO,MAAMA,cAAc,OAAOC,IAAAA,GAAAA;IAChC,IAAI,CAACC,OAAOC,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,KAAA,CAAA,EAAQ;QACxC,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIK,KAAAA,CAAM,qBAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,UAAAA,GAAa,MAAML,MAAAA,CAAOM,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC1D,IAAA,MAAMC,WAAAA,GAAcH,SAAAA,CAAUI,cAAc,IAAI,EAAE;AAClD,IAAA,IAAIC,QAAQF,WAAAA,CAAAA,EAAc;QACxB,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,MAAMG;IAEJhB,IAAAA,CAAKgB,KAAK;IAET,MAAMf,MAAAA,CAAOgB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,IAAI,CAACnB,IAAAA,EAAM,OAAA,EAAS;QAAEgB,KAAAA,EAAO;YAAEI,MAAAA,EAAQ;AAAC,gBAAA;AAAK;AAAC;AAAE,KAAA,CAAA;IAEtF,EAAE;;AAGJ,IAAA,MAAMC,WAAWR,WAAAA,CAAYS,IAAI,CAAC,CAACC;QAEjCP,KAAAA,CAAMM,IAAI,CAAC,CAACE,IAAAA,GAAcD,aAAaC,IAAAA,CAAKC,EAAE,CAACC,QAAQ,EAAA,CAAA,CAAA;IAGzD,OAAOL,QAAAA;AACT;;;;"}
1	+ {"version":3,"file":"sso-lock.mjs","sources":["../../../../../../ee/server/src/utils/sso-lock.ts"],"sourcesContent":["import { isEmpty } from 'lodash';\n\nexport const isSsoLocked = async (user: any) => {\n if (!strapi.ee.features.isEnabled('sso')) {\n return false;\n }\n\n if (!user) {\n throw new Error('Missing user object');\n }\n\n // check if any roles are locked\n const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n const lockedRoles = providers.ssoLockedRoles ?? [];\n if (isEmpty(lockedRoles)) {\n return false;\n }\n\n const roles =\n // If the roles are pre-loaded for the given user, then use them\n user.roles ??\n // Otherwise, try to load the role based on the given user ID\n (await strapi.db.query('admin::user').load(user, 'roles', { roles: { fields: ['id'] } })) ??\n // If the query fails somehow, default to an empty array\n [];\n\n // Check if any of the user's roles are in lockedRoles\n const isLocked = lockedRoles.some((lockedId: string) =>\n // lockedRoles will be a string to avoid issues with frontend and bigints\n roles.some((role: any) => lockedId === role.id.toString())\n );\n\n return isLocked;\n};\n\nexport default {\n isSsoLocked,\n};\n"],"names":["isSsoLocked","user","strapi","ee","features","isEnabled","Error","adminStore","store","type","name","providers","get","key","lockedRoles","ssoLockedRoles","isEmpty","roles","db","query","load","fields","isLocked","some","lockedId","role","id","toString"],"mappings":";;AAEO,MAAMA,cAAc,OAAOC,IAAAA,GAAAA;IAChC,IAAI,CAACC,OAAOC,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,KAAA,CAAA,EAAQ;QACxC,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIK,KAAAA,CAAM,qBAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,UAAAA,GAAa,MAAML,MAAAA,CAAOM,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC1D,IAAA,MAAMC,WAAAA,GAAcH,SAAAA,CAAUI,cAAc,IAAI,EAAE;AAClD,IAAA,IAAIC,QAAQF,WAAAA,CAAAA,EAAc;QACxB,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,MAAMG;IAEJhB,IAAAA,CAAKgB,KAAK;IAET,MAAMf,MAAAA,CAAOgB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,IAAI,CAACnB,IAAAA,EAAM,OAAA,EAAS;QAAEgB,KAAAA,EAAO;YAAEI,MAAAA,EAAQ;AAAC,gBAAA;AAAK;AAAC;AAAE,KAAA,CAAA;IAEtF,EAAE;;AAGJ,IAAA,MAAMC,WAAWR,WAAAA,CAAYS,IAAI,CAAC,CAACC;QAEjCP,KAAAA,CAAMM,IAAI,CAAC,CAACE,IAAAA,GAAcD,aAAaC,IAAAA,CAAKC,EAAE,CAACC,QAAQ,EAAA,CAAA,CAAA;IAGzD,OAAOL,QAAAA;AACT;;;;"}

package/dist/server/server/src/audit-logs/admin-users.js CHANGED Viewed

@@ -1,6 +1,6 @@
 'use strict';
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var utils = require('@strapi/utils');
 const AUDITED_EVENTS = {
@@ -34,7 +34,7 @@ const AUDITED_EVENTS = {
     'preferedLanguage',
     'isActive'
 ];
-/** Sorted, so order alone is not a change. */ const toRoleIds = (roles)=>fp.sortBy((id)=>String(id), (roles ?? []).map((role)=>typeof role === 'object' ? role.id : role));
+/** Sorted, so order alone is not a change. */ const toRoleIds = (roles)=>_.sortBy((roles ?? []).map((role)=>typeof role === 'object' ? role.id : role), (id)=>String(id));
 const getAdminUserChanges = (previous, next)=>{
     const changes = {};
     for (const field of ADMIN_USER_TRACKED_FIELDS){
@@ -51,7 +51,7 @@ const getAdminUserChanges = (previous, next)=>{
     if (previous.roles != null || next.roles != null) {
         const before = toRoleIds(previous.roles);
         const after = toRoleIds(next.roles);
-        if (!fp.isEqual(before, after)) {
+        if (!_.isEqual(before, after)) {
             changes.roles = {
                 before,
                 after

package/dist/server/server/src/audit-logs/admin-users.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"admin-users.js","sources":["../../../../../server/src/audit-logs/admin-users.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash/fp';\nimport type { Data, Modules } from '@strapi/types';\nimport { emitAudit } from '@strapi/utils';\n\nexport const AUDITED_EVENTS = {\n USER_CREATE: 'admin-user.create',\n USER_UPDATE: 'admin-user.update',\n USER_DELETE: 'admin-user.delete',\n PASSWORD_RESET_CREATE: 'admin-user.password-reset.create',\n PASSWORD_RESET_CONFIRM: 'admin-user.password-reset.confirm',\n PASSWORD_UPDATE: 'admin-user.password.update',\n INVITE_ACCEPT: 'admin-user.invite.accept',\n} as const;\n\n/*\n Event hub events kept for custom listeners. The audit log no longer records them:\n * it records the AUDITED_EVENTS above, built from the row with before/after values.\n \n @deprecated Removed in the next major. Listen to the audit log events, or to the\n * database lifecycles, instead.\n /\nexport const LEGACY_USER_EVENTS = {\n CREATE: 'user.create',\n UPDATE: 'user.update',\n DELETE: 'user.delete',\n} as const;\n\nexport interface AdminUserResource extends Modules.AuditLogs.Resource {\n type: 'admin-user';\n id: Data.ID;\n email: string;\n}\n\n/\n The affected account, as read from the `admin::user` row after the write. Never the\n * row itself: it carries the password hash and the reset and registration tokens.\n /\nexport interface AdminUserEvent {\n userId: Data.ID;\n email: string;\n}\n\n/\n The fields an audit reader needs to identify the account and its access. Never\n * `password`, the tokens, or the timestamps: the row has its own date.\n /\nexport const ADMIN_USER_TRACKED_FIELDS = [\n 'firstname',\n 'lastname',\n 'email',\n 'username',\n 'preferedLanguage',\n 'isActive',\n] as const;\n\ntype TrackedField = (typeof ADMIN_USER_TRACKED_FIELDS)[number];\n\n/* A user row, or the attributes of an update: roles come as rows or as ids. /\nexport interface AdminUserSnapshot {\n firstname?: string \| null;\n lastname?: string \| null;\n email?: string \| null;\n username?: string \| null;\n preferedLanguage?: string \| null;\n isActive?: boolean \| null;\n roles?: Array<Data.ID \| { id: Data.ID }> \| null;\n}\n\nexport type AdminUserChanges = Partial<\n Record<TrackedField, Modules.AuditLogs.FieldChange<string \| boolean \| null>> & {\n roles: Modules.AuditLogs.FieldChange<Data.ID[]>;\n }\n>;\n\nexport interface CreateDetails {\n email: string;\n firstname: string \| null;\n lastname: string \| null;\n roles: Data.ID[];\n isActive: boolean;\n}\n\nexport type CreateEvent = AdminUserEvent & Omit<CreateDetails, 'email'>;\nexport type UpdateEvent = AdminUserEvent & { changes: AdminUserChanges };\nexport type PasswordResetCreateEvent = AdminUserEvent & { expiresAt: string \| Date };\n\n/* Sorted, so order alone is not a change. /\nexport const toRoleIds = (roles: AdminUserSnapshot['roles']): Data.ID[] =>\n sortBy(\n (id: Data.ID) => String(id),\n (roles ?? []).map((role) => (typeof role === 'object' ? role.id : role))\n );\n\nexport const getAdminUserChanges = (\n previous: AdminUserSnapshot,\n next: AdminUserSnapshot\n): AdminUserChanges => {\n const changes: AdminUserChanges = {};\n\n for (const field of ADMIN_USER_TRACKED_FIELDS) {\n // isActive is a boolean column that older rows may hold as null\n const before = field === 'isActive' ? previous.isActive === true : (previous[field] ?? null);\n const after = field === 'isActive' ? next.isActive === true : (next[field] ?? null);\n\n if (before !== after) {\n changes[field] = { before, after };\n }\n }\n\n if (previous.roles != null \|\| next.roles != null) {\n const before = toRoleIds(previous.roles);\n const after = toRoleIds(next.roles);\n\n if (!isEqual(before, after)) {\n changes.roles = { before, after };\n }\n }\n\n return changes;\n};\n\n/\n `email` is required by the admin::user schema; the contract type marks it optional\n * because it also describes creation payloads.\n /\nexport const toAdminUserEvent = (user: { id: Data.ID; email?: string \| null }): AdminUserEvent => ({\n userId: user.id,\n email: user.email as string,\n});\n\ntype AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];\n\ninterface AdminUserRow extends AdminUserSnapshot {\n id: Data.ID;\n}\n\nexport const emitAdminUserCreated = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_CREATE, {\n ...toAdminUserEvent(user),\n firstname: user.firstname ?? null,\n lastname: user.lastname ?? null,\n roles: toRoleIds(user.roles),\n isActive: user.isActive === true,\n } satisfies CreateEvent);\n\nexport const emitAdminUserDeleted = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_DELETE, toAdminUserEvent(user));\n\n/* Whether an update touches a field the audit log compares, so the previous row is needed. /\nexport const touchesTrackedFields = (attributes: Record<string, unknown>) =>\n [...ADMIN_USER_TRACKED_FIELDS, 'roles'].some((field) => field in attributes);\n\n/\n The account events an update can produce, emitted by updateById after the write:\n * `admin-user.update` with the fields that changed, `admin-user.password.update` when a\n * password was set. Both run through the request context, so a public flow (reset,\n * invitation) with no session emits them too and the subscriber drops them.\n /\nexport const emitAdminUserUpdateAudits = async (\n { strapi }: { strapi: AuditStrapi },\n {\n previous,\n updated,\n attributes,\n }: {\n previous: AdminUserSnapshot \| null \| undefined;\n updated: AdminUserRow \| null \| undefined;\n attributes: Record<string, unknown>;\n }\n) => {\n if (!updated) {\n return;\n }\n\n if (previous) {\n const changes = getAdminUserChanges(previous, updated);\n\n if (Object.keys(changes).length > 0) {\n await emitAudit({ strapi }, AUDITED_EVENTS.USER_UPDATE, {\n ...toAdminUserEvent(updated),\n changes,\n } satisfies UpdateEvent);\n }\n }\n\n if ('password' in attributes) {\n await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_UPDATE, toAdminUserEvent(updated));\n }\n};\n\n/\n The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n registerEvent<TDetails>(\n name: string,\n transform: Modules.AuditLogs.EventTransformer<TDetails>,\n options?: { allowUnknownActor?: boolean }\n ): void;\n}\n\nexport const registerAdminUserAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n const resource = (event: AdminUserEvent): AdminUserResource => ({\n type: 'admin-user',\n id: event.userId,\n email: event.email,\n });\n\n const withoutSession = { allowUnknownActor: true };\n\n // The first super admin registers from a public form too\n auditLogsLifecycle.registerEvent<CreateDetails>(\n AUDITED_EVENTS.USER_CREATE,\n (event: CreateEvent) => ({\n resource: resource(event),\n details: {\n email: event.email,\n firstname: event.firstname,\n lastname: event.lastname,\n roles: event.roles,\n isActive: event.isActive,\n },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<{ changes: AdminUserChanges }>(\n AUDITED_EVENTS.USER_UPDATE,\n (event: UpdateEvent) => ({\n resource: resource(event),\n details: { changes: event.changes },\n })\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.USER_DELETE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n\n auditLogsLifecycle.registerEvent<{ expiresAt: string }>(\n AUDITED_EVENTS.PASSWORD_RESET_CREATE,\n (event: PasswordResetCreateEvent) => ({\n resource: resource(event),\n details: { expiresAt: new Date(event.expiresAt).toISOString() },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_RESET_CONFIRM,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.INVITE_ACCEPT,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_UPDATE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n};\n"],"names":["AUDITED_EVENTS","USER_CREATE","USER_UPDATE","USER_DELETE","PASSWORD_RESET_CREATE","PASSWORD_RESET_CONFIRM","PASSWORD_UPDATE","INVITE_ACCEPT","LEGACY_USER_EVENTS","CREATE","UPDATE","DELETE","ADMIN_USER_TRACKED_FIELDS","toRoleIds","roles","sortBy","id","String","map","role","getAdminUserChanges","previous","next","changes","field","before","isActive","after","isEqual","toAdminUserEvent","user","userId","email","emitAdminUserCreated","strapi","emitAudit","firstname","lastname","emitAdminUserDeleted","touchesTrackedFields","attributes","some","emitAdminUserUpdateAudits","updated","Object","keys","length","registerAdminUserAuditEvents","auditLogsLifecycle","resource","event","type","withoutSession","allowUnknownActor","registerEvent","details","expiresAt","Date","toISOString"],"mappings":";;;;;MAIaA,cAAAA,GAAiB;IAC5BC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,qBAAAA,EAAuB,kCAAA;IACvBC,sBAAAA,EAAwB,mCAAA;IACxBC,eAAAA,EAAiB,4BAAA;IACjBC,aAAAA,EAAe;AACjB;AAEA;;;;;;UAOaC,kBAAAA,GAAqB;IAChCC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ;AACV;AAiBA;;;UAIaC,yBAAAA,GAA4B;AACvC,IAAA,WAAA;AACA,IAAA,UAAA;AACA,IAAA,OAAA;AACA,IAAA,UAAA;AACA,IAAA,kBAAA;AACA,IAAA;;AAkCF,+CACO,MAAMC,SAAAA,GAAY,CAACC,KAAAA,GACxBC,SAAAA,CACE,CAACC,EAAAA,GAAgBC,MAAAA,CAAOD,EAAAA,CAAAA,EACxB,CAACF,KAAAA,IAAS,EAAE,EAAEI,GAAG,CAAC,CAACC,IAAAA,GAAU,OAAOA,IAAAA,KAAS,QAAA,GAAWA,IAAAA,CAAKH,EAAE,GAAGG,IAAAA,CAAAA;AAG/D,MAAMC,mBAAAA,GAAsB,CACjCC,QAAAA,EACAC,IAAAA,GAAAA;AAEA,IAAA,MAAMC,UAA4B,EAAC;IAEnC,KAAK,MAAMC,SAASZ,yBAAAA,CAA2B;;QAE7C,MAAMa,MAAAA,GAASD,KAAAA,KAAU,UAAA,GAAaH,QAAAA,CAASK,QAAQ,KAAK,IAAA,GAAQL,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;QACvF,MAAMG,KAAAA,GAAQH,KAAAA,KAAU,UAAA,GAAaF,IAAAA,CAAKI,QAAQ,KAAK,IAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE9E,QAAA,IAAIC,WAAWE,KAAAA,EAAO;YACpBJ,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIN,SAASP,KAAK,IAAI,QAAQQ,IAAAA,CAAKR,KAAK,IAAI,IAAA,EAAM;QAChD,MAAMW,MAAAA,GAASZ,SAAAA,CAAUQ,QAAAA,CAASP,KAAK,CAAA;QACvC,MAAMa,KAAAA,GAAQd,SAAAA,CAAUS,IAAAA,CAAKR,KAAK,CAAA;QAElC,IAAI,CAACc,UAAAA,CAAQH,MAAAA,EAAQE,KAAAA,CAAAA,EAAQ;AAC3BJ,YAAAA,OAAAA,CAAQT,KAAK,GAAG;AAAEW,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AAClC,QAAA;AACF,IAAA;IAEA,OAAOJ,OAAAA;AACT;AAEA;;;AAGC,IACM,MAAMM,gBAAAA,GAAmB,CAACC,QAAkE;AACjGC,QAAAA,MAAAA,EAAQD,KAAKd,EAAE;AACfgB,QAAAA,KAAAA,EAAOF,KAAKE;AACd,KAAA;AAQO,MAAMC,uBAAuB,CAAC,EAAEC,MAAM,EAA2B,EAAEJ,OACxEK,eAAAA,CAAU;AAAED,QAAAA;KAAO,EAAGlC,cAAAA,CAAeC,WAAW,EAAE;AAChD,QAAA,GAAG4B,iBAAiBC,IAAAA,CAAK;QACzBM,SAAAA,EAAWN,IAAAA,CAAKM,SAAS,IAAI,IAAA;QAC7BC,QAAAA,EAAUP,IAAAA,CAAKO,QAAQ,IAAI,IAAA;QAC3BvB,KAAAA,EAAOD,SAAAA,CAAUiB,KAAKhB,KAAK,CAAA;QAC3BY,QAAAA,EAAUI,IAAAA,CAAKJ,QAAQ,KAAK;KAC9B;AAEK,MAAMY,uBAAuB,CAAC,EAAEJ,MAAM,EAA2B,EAAEJ,OACxEK,eAAAA,CAAU;AAAED,QAAAA;AAAO,KAAA,EAAGlC,cAAAA,CAAeG,WAAW,EAAE0B,gBAAAA,CAAiBC,IAAAA,CAAAA;AAErE,gGACO,MAAMS,oBAAAA,GAAuB,CAACC,UAAAA,GACnC;AAAI5B,QAAAA,GAAAA,yBAAAA;AAA2B,QAAA;AAAQ,KAAA,CAAC6B,IAAI,CAAC,CAACjB,KAAAA,GAAUA,SAASgB,UAAAA;AAEnE;;;;;AAKC,IACM,MAAME,yBAAAA,GAA4B,OACvC,EAAER,MAAM,EAA2B,EACnC,EACEb,QAAQ,EACRsB,OAAO,EACPH,UAAU,EAKX,GAAA;AAED,IAAA,IAAI,CAACG,OAAAA,EAAS;AACZ,QAAA;AACF,IAAA;AAEA,IAAA,IAAItB,QAAAA,EAAU;QACZ,MAAME,OAAAA,GAAUH,oBAAoBC,QAAAA,EAAUsB,OAAAA,CAAAA;AAE9C,QAAA,IAAIC,OAAOC,IAAI,CAACtB,OAAAA,CAAAA,CAASuB,MAAM,GAAG,CAAA,EAAG;AACnC,YAAA,MAAMX,eAAAA,CAAU;AAAED,gBAAAA;aAAO,EAAGlC,cAAAA,CAAeE,WAAW,EAAE;AACtD,gBAAA,GAAG2B,iBAAiBc,OAAAA,CAAQ;AAC5BpB,gBAAAA;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,cAAciB,UAAAA,EAAY;AAC5B,QAAA,MAAML,eAAAA,CAAU;AAAED,YAAAA;SAAO,EAAGlC,cAAAA,CAAeM,eAAe,EAAEuB,gBAAAA,CAAiBc,OAAAA,CAAAA,CAAAA;AAC/E,IAAA;AACF;AAcO,MAAMI,+BAA+B,CAACC,kBAAAA,GAAAA;IAC3C,MAAMC,QAAAA,GAAW,CAACC,KAAAA,IAA8C;YAC9DC,IAAAA,EAAM,YAAA;AACNnC,YAAAA,EAAAA,EAAIkC,MAAMnB,MAAM;AAChBC,YAAAA,KAAAA,EAAOkB,MAAMlB;SACf,CAAA;AAEA,IAAA,MAAMoB,cAAAA,GAAiB;QAAEC,iBAAAA,EAAmB;AAAK,KAAA;;AAGjDL,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeC,WAAW,EAC1B,CAACiD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AACPvB,gBAAAA,KAAAA,EAAOkB,MAAMlB,KAAK;AAClBI,gBAAAA,SAAAA,EAAWc,MAAMd,SAAS;AAC1BC,gBAAAA,QAAAA,EAAUa,MAAMb,QAAQ;AACxBvB,gBAAAA,KAAAA,EAAOoC,MAAMpC,KAAK;AAClBY,gBAAAA,QAAAA,EAAUwB,MAAMxB;AAClB;AACF,SAAA,CAAA,EACA0B,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeE,WAAW,EAC1B,CAACgD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEhC,gBAAAA,OAAAA,EAAS2B,MAAM3B;AAAQ;SACpC,CAAA,CAAA;AAGFyB,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeG,WAAW,EAC1B,CAAC+C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAG1DF,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeI,qBAAqB,EACpC,CAAC8C,SAAqC;AACpCD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEC,gBAAAA,SAAAA,EAAW,IAAIC,IAAAA,CAAKP,KAAAA,CAAMM,SAAS,EAAEE,WAAW;AAAG;AAChE,SAAA,CAAA,EACAN,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeK,sBAAsB,EACrC,CAAC6C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeO,aAAa,EAC5B,CAAC2C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeM,eAAe,EAC9B,CAAC4C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAE5D;;;;;;;;;;;;;;"}
1	+ {"version":3,"file":"admin-users.js","sources":["../../../../../server/src/audit-logs/admin-users.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash';\nimport type { Data, Modules } from '@strapi/types';\nimport { emitAudit } from '@strapi/utils';\n\nexport const AUDITED_EVENTS = {\n USER_CREATE: 'admin-user.create',\n USER_UPDATE: 'admin-user.update',\n USER_DELETE: 'admin-user.delete',\n PASSWORD_RESET_CREATE: 'admin-user.password-reset.create',\n PASSWORD_RESET_CONFIRM: 'admin-user.password-reset.confirm',\n PASSWORD_UPDATE: 'admin-user.password.update',\n INVITE_ACCEPT: 'admin-user.invite.accept',\n} as const;\n\n/*\n Event hub events kept for custom listeners. The audit log no longer records them:\n * it records the AUDITED_EVENTS above, built from the row with before/after values.\n \n @deprecated Removed in the next major. Listen to the audit log events, or to the\n * database lifecycles, instead.\n /\nexport const LEGACY_USER_EVENTS = {\n CREATE: 'user.create',\n UPDATE: 'user.update',\n DELETE: 'user.delete',\n} as const;\n\nexport interface AdminUserResource extends Modules.AuditLogs.Resource {\n type: 'admin-user';\n id: Data.ID;\n email: string;\n}\n\n/\n The affected account, as read from the `admin::user` row after the write. Never the\n * row itself: it carries the password hash and the reset and registration tokens.\n /\nexport interface AdminUserEvent {\n userId: Data.ID;\n email: string;\n}\n\n/\n The fields an audit reader needs to identify the account and its access. Never\n * `password`, the tokens, or the timestamps: the row has its own date.\n /\nexport const ADMIN_USER_TRACKED_FIELDS = [\n 'firstname',\n 'lastname',\n 'email',\n 'username',\n 'preferedLanguage',\n 'isActive',\n] as const;\n\ntype TrackedField = (typeof ADMIN_USER_TRACKED_FIELDS)[number];\n\n/* A user row, or the attributes of an update: roles come as rows or as ids. /\nexport interface AdminUserSnapshot {\n firstname?: string \| null;\n lastname?: string \| null;\n email?: string \| null;\n username?: string \| null;\n preferedLanguage?: string \| null;\n isActive?: boolean \| null;\n roles?: Array<Data.ID \| { id: Data.ID }> \| null;\n}\n\nexport type AdminUserChanges = Partial<\n Record<TrackedField, Modules.AuditLogs.FieldChange<string \| boolean \| null>> & {\n roles: Modules.AuditLogs.FieldChange<Data.ID[]>;\n }\n>;\n\nexport interface CreateDetails {\n email: string;\n firstname: string \| null;\n lastname: string \| null;\n roles: Data.ID[];\n isActive: boolean;\n}\n\nexport type CreateEvent = AdminUserEvent & Omit<CreateDetails, 'email'>;\nexport type UpdateEvent = AdminUserEvent & { changes: AdminUserChanges };\nexport type PasswordResetCreateEvent = AdminUserEvent & { expiresAt: string \| Date };\n\n/* Sorted, so order alone is not a change. /\nexport const toRoleIds = (roles: AdminUserSnapshot['roles']): Data.ID[] =>\n sortBy(\n (roles ?? []).map((role) => (typeof role === 'object' ? role.id : role)),\n (id: Data.ID) => String(id)\n );\n\nexport const getAdminUserChanges = (\n previous: AdminUserSnapshot,\n next: AdminUserSnapshot\n): AdminUserChanges => {\n const changes: AdminUserChanges = {};\n\n for (const field of ADMIN_USER_TRACKED_FIELDS) {\n // isActive is a boolean column that older rows may hold as null\n const before = field === 'isActive' ? previous.isActive === true : (previous[field] ?? null);\n const after = field === 'isActive' ? next.isActive === true : (next[field] ?? null);\n\n if (before !== after) {\n changes[field] = { before, after };\n }\n }\n\n if (previous.roles != null \|\| next.roles != null) {\n const before = toRoleIds(previous.roles);\n const after = toRoleIds(next.roles);\n\n if (!isEqual(before, after)) {\n changes.roles = { before, after };\n }\n }\n\n return changes;\n};\n\n/\n `email` is required by the admin::user schema; the contract type marks it optional\n * because it also describes creation payloads.\n /\nexport const toAdminUserEvent = (user: { id: Data.ID; email?: string \| null }): AdminUserEvent => ({\n userId: user.id,\n email: user.email as string,\n});\n\ntype AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];\n\ninterface AdminUserRow extends AdminUserSnapshot {\n id: Data.ID;\n}\n\nexport const emitAdminUserCreated = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_CREATE, {\n ...toAdminUserEvent(user),\n firstname: user.firstname ?? null,\n lastname: user.lastname ?? null,\n roles: toRoleIds(user.roles),\n isActive: user.isActive === true,\n } satisfies CreateEvent);\n\nexport const emitAdminUserDeleted = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_DELETE, toAdminUserEvent(user));\n\n/* Whether an update touches a field the audit log compares, so the previous row is needed. /\nexport const touchesTrackedFields = (attributes: Record<string, unknown>) =>\n [...ADMIN_USER_TRACKED_FIELDS, 'roles'].some((field) => field in attributes);\n\n/\n The account events an update can produce, emitted by updateById after the write:\n * `admin-user.update` with the fields that changed, `admin-user.password.update` when a\n * password was set. Both run through the request context, so a public flow (reset,\n * invitation) with no session emits them too and the subscriber drops them.\n /\nexport const emitAdminUserUpdateAudits = async (\n { strapi }: { strapi: AuditStrapi },\n {\n previous,\n updated,\n attributes,\n }: {\n previous: AdminUserSnapshot \| null \| undefined;\n updated: AdminUserRow \| null \| undefined;\n attributes: Record<string, unknown>;\n }\n) => {\n if (!updated) {\n return;\n }\n\n if (previous) {\n const changes = getAdminUserChanges(previous, updated);\n\n if (Object.keys(changes).length > 0) {\n await emitAudit({ strapi }, AUDITED_EVENTS.USER_UPDATE, {\n ...toAdminUserEvent(updated),\n changes,\n } satisfies UpdateEvent);\n }\n }\n\n if ('password' in attributes) {\n await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_UPDATE, toAdminUserEvent(updated));\n }\n};\n\n/\n The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n registerEvent<TDetails>(\n name: string,\n transform: Modules.AuditLogs.EventTransformer<TDetails>,\n options?: { allowUnknownActor?: boolean }\n ): void;\n}\n\nexport const registerAdminUserAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n const resource = (event: AdminUserEvent): AdminUserResource => ({\n type: 'admin-user',\n id: event.userId,\n email: event.email,\n });\n\n const withoutSession = { allowUnknownActor: true };\n\n // The first super admin registers from a public form too\n auditLogsLifecycle.registerEvent<CreateDetails>(\n AUDITED_EVENTS.USER_CREATE,\n (event: CreateEvent) => ({\n resource: resource(event),\n details: {\n email: event.email,\n firstname: event.firstname,\n lastname: event.lastname,\n roles: event.roles,\n isActive: event.isActive,\n },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<{ changes: AdminUserChanges }>(\n AUDITED_EVENTS.USER_UPDATE,\n (event: UpdateEvent) => ({\n resource: resource(event),\n details: { changes: event.changes },\n })\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.USER_DELETE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n\n auditLogsLifecycle.registerEvent<{ expiresAt: string }>(\n AUDITED_EVENTS.PASSWORD_RESET_CREATE,\n (event: PasswordResetCreateEvent) => ({\n resource: resource(event),\n details: { expiresAt: new Date(event.expiresAt).toISOString() },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_RESET_CONFIRM,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.INVITE_ACCEPT,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_UPDATE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n};\n"],"names":["AUDITED_EVENTS","USER_CREATE","USER_UPDATE","USER_DELETE","PASSWORD_RESET_CREATE","PASSWORD_RESET_CONFIRM","PASSWORD_UPDATE","INVITE_ACCEPT","LEGACY_USER_EVENTS","CREATE","UPDATE","DELETE","ADMIN_USER_TRACKED_FIELDS","toRoleIds","roles","sortBy","map","role","id","String","getAdminUserChanges","previous","next","changes","field","before","isActive","after","isEqual","toAdminUserEvent","user","userId","email","emitAdminUserCreated","strapi","emitAudit","firstname","lastname","emitAdminUserDeleted","touchesTrackedFields","attributes","some","emitAdminUserUpdateAudits","updated","Object","keys","length","registerAdminUserAuditEvents","auditLogsLifecycle","resource","event","type","withoutSession","allowUnknownActor","registerEvent","details","expiresAt","Date","toISOString"],"mappings":";;;;;MAIaA,cAAAA,GAAiB;IAC5BC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,qBAAAA,EAAuB,kCAAA;IACvBC,sBAAAA,EAAwB,mCAAA;IACxBC,eAAAA,EAAiB,4BAAA;IACjBC,aAAAA,EAAe;AACjB;AAEA;;;;;;UAOaC,kBAAAA,GAAqB;IAChCC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ;AACV;AAiBA;;;UAIaC,yBAAAA,GAA4B;AACvC,IAAA,WAAA;AACA,IAAA,UAAA;AACA,IAAA,OAAA;AACA,IAAA,UAAA;AACA,IAAA,kBAAA;AACA,IAAA;;AAkCF,+CACO,MAAMC,SAAAA,GAAY,CAACC,KAAAA,GACxBC,QAAAA,CACE,CAACD,KAAAA,IAAS,EAAE,EAAEE,GAAG,CAAC,CAACC,IAAAA,GAAU,OAAOA,IAAAA,KAAS,QAAA,GAAWA,IAAAA,CAAKC,EAAE,GAAGD,IAAAA,CAAAA,EAClE,CAACC,EAAAA,GAAgBC,MAAAA,CAAOD,EAAAA,CAAAA;AAGrB,MAAME,mBAAAA,GAAsB,CACjCC,QAAAA,EACAC,IAAAA,GAAAA;AAEA,IAAA,MAAMC,UAA4B,EAAC;IAEnC,KAAK,MAAMC,SAASZ,yBAAAA,CAA2B;;QAE7C,MAAMa,MAAAA,GAASD,KAAAA,KAAU,UAAA,GAAaH,QAAAA,CAASK,QAAQ,KAAK,IAAA,GAAQL,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;QACvF,MAAMG,KAAAA,GAAQH,KAAAA,KAAU,UAAA,GAAaF,IAAAA,CAAKI,QAAQ,KAAK,IAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE9E,QAAA,IAAIC,WAAWE,KAAAA,EAAO;YACpBJ,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIN,SAASP,KAAK,IAAI,QAAQQ,IAAAA,CAAKR,KAAK,IAAI,IAAA,EAAM;QAChD,MAAMW,MAAAA,GAASZ,SAAAA,CAAUQ,QAAAA,CAASP,KAAK,CAAA;QACvC,MAAMa,KAAAA,GAAQd,SAAAA,CAAUS,IAAAA,CAAKR,KAAK,CAAA;QAElC,IAAI,CAACc,SAAAA,CAAQH,MAAAA,EAAQE,KAAAA,CAAAA,EAAQ;AAC3BJ,YAAAA,OAAAA,CAAQT,KAAK,GAAG;AAAEW,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AAClC,QAAA;AACF,IAAA;IAEA,OAAOJ,OAAAA;AACT;AAEA;;;AAGC,IACM,MAAMM,gBAAAA,GAAmB,CAACC,QAAkE;AACjGC,QAAAA,MAAAA,EAAQD,KAAKZ,EAAE;AACfc,QAAAA,KAAAA,EAAOF,KAAKE;AACd,KAAA;AAQO,MAAMC,uBAAuB,CAAC,EAAEC,MAAM,EAA2B,EAAEJ,OACxEK,eAAAA,CAAU;AAAED,QAAAA;KAAO,EAAGlC,cAAAA,CAAeC,WAAW,EAAE;AAChD,QAAA,GAAG4B,iBAAiBC,IAAAA,CAAK;QACzBM,SAAAA,EAAWN,IAAAA,CAAKM,SAAS,IAAI,IAAA;QAC7BC,QAAAA,EAAUP,IAAAA,CAAKO,QAAQ,IAAI,IAAA;QAC3BvB,KAAAA,EAAOD,SAAAA,CAAUiB,KAAKhB,KAAK,CAAA;QAC3BY,QAAAA,EAAUI,IAAAA,CAAKJ,QAAQ,KAAK;KAC9B;AAEK,MAAMY,uBAAuB,CAAC,EAAEJ,MAAM,EAA2B,EAAEJ,OACxEK,eAAAA,CAAU;AAAED,QAAAA;AAAO,KAAA,EAAGlC,cAAAA,CAAeG,WAAW,EAAE0B,gBAAAA,CAAiBC,IAAAA,CAAAA;AAErE,gGACO,MAAMS,oBAAAA,GAAuB,CAACC,UAAAA,GACnC;AAAI5B,QAAAA,GAAAA,yBAAAA;AAA2B,QAAA;AAAQ,KAAA,CAAC6B,IAAI,CAAC,CAACjB,KAAAA,GAAUA,SAASgB,UAAAA;AAEnE;;;;;AAKC,IACM,MAAME,yBAAAA,GAA4B,OACvC,EAAER,MAAM,EAA2B,EACnC,EACEb,QAAQ,EACRsB,OAAO,EACPH,UAAU,EAKX,GAAA;AAED,IAAA,IAAI,CAACG,OAAAA,EAAS;AACZ,QAAA;AACF,IAAA;AAEA,IAAA,IAAItB,QAAAA,EAAU;QACZ,MAAME,OAAAA,GAAUH,oBAAoBC,QAAAA,EAAUsB,OAAAA,CAAAA;AAE9C,QAAA,IAAIC,OAAOC,IAAI,CAACtB,OAAAA,CAAAA,CAASuB,MAAM,GAAG,CAAA,EAAG;AACnC,YAAA,MAAMX,eAAAA,CAAU;AAAED,gBAAAA;aAAO,EAAGlC,cAAAA,CAAeE,WAAW,EAAE;AACtD,gBAAA,GAAG2B,iBAAiBc,OAAAA,CAAQ;AAC5BpB,gBAAAA;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,cAAciB,UAAAA,EAAY;AAC5B,QAAA,MAAML,eAAAA,CAAU;AAAED,YAAAA;SAAO,EAAGlC,cAAAA,CAAeM,eAAe,EAAEuB,gBAAAA,CAAiBc,OAAAA,CAAAA,CAAAA;AAC/E,IAAA;AACF;AAcO,MAAMI,+BAA+B,CAACC,kBAAAA,GAAAA;IAC3C,MAAMC,QAAAA,GAAW,CAACC,KAAAA,IAA8C;YAC9DC,IAAAA,EAAM,YAAA;AACNjC,YAAAA,EAAAA,EAAIgC,MAAMnB,MAAM;AAChBC,YAAAA,KAAAA,EAAOkB,MAAMlB;SACf,CAAA;AAEA,IAAA,MAAMoB,cAAAA,GAAiB;QAAEC,iBAAAA,EAAmB;AAAK,KAAA;;AAGjDL,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeC,WAAW,EAC1B,CAACiD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AACPvB,gBAAAA,KAAAA,EAAOkB,MAAMlB,KAAK;AAClBI,gBAAAA,SAAAA,EAAWc,MAAMd,SAAS;AAC1BC,gBAAAA,QAAAA,EAAUa,MAAMb,QAAQ;AACxBvB,gBAAAA,KAAAA,EAAOoC,MAAMpC,KAAK;AAClBY,gBAAAA,QAAAA,EAAUwB,MAAMxB;AAClB;AACF,SAAA,CAAA,EACA0B,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeE,WAAW,EAC1B,CAACgD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEhC,gBAAAA,OAAAA,EAAS2B,MAAM3B;AAAQ;SACpC,CAAA,CAAA;AAGFyB,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeG,WAAW,EAC1B,CAAC+C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAG1DF,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeI,qBAAqB,EACpC,CAAC8C,SAAqC;AACpCD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEC,gBAAAA,SAAAA,EAAW,IAAIC,IAAAA,CAAKP,KAAAA,CAAMM,SAAS,EAAEE,WAAW;AAAG;AAChE,SAAA,CAAA,EACAN,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeK,sBAAsB,EACrC,CAAC6C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeO,aAAa,EAC5B,CAAC2C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeM,eAAe,EAC9B,CAAC4C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAE5D;;;;;;;;;;;;;;"}

package/dist/server/server/src/audit-logs/admin-users.mjs CHANGED Viewed

@@ -1,4 +1,4 @@
-import { isEqual, sortBy } from 'lodash/fp';
+import { isEqual, sortBy } from 'lodash';
 import { emitAudit } from '@strapi/utils';
 const AUDITED_EVENTS = {
@@ -32,7 +32,7 @@ const AUDITED_EVENTS = {
     'preferedLanguage',
     'isActive'
 ];
-/** Sorted, so order alone is not a change. */ const toRoleIds = (roles)=>sortBy((id)=>String(id), (roles ?? []).map((role)=>typeof role === 'object' ? role.id : role));
+/** Sorted, so order alone is not a change. */ const toRoleIds = (roles)=>sortBy((roles ?? []).map((role)=>typeof role === 'object' ? role.id : role), (id)=>String(id));
 const getAdminUserChanges = (previous, next)=>{
     const changes = {};
     for (const field of ADMIN_USER_TRACKED_FIELDS){

package/dist/server/server/src/audit-logs/admin-users.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"admin-users.mjs","sources":["../../../../../server/src/audit-logs/admin-users.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash/fp';\nimport type { Data, Modules } from '@strapi/types';\nimport { emitAudit } from '@strapi/utils';\n\nexport const AUDITED_EVENTS = {\n USER_CREATE: 'admin-user.create',\n USER_UPDATE: 'admin-user.update',\n USER_DELETE: 'admin-user.delete',\n PASSWORD_RESET_CREATE: 'admin-user.password-reset.create',\n PASSWORD_RESET_CONFIRM: 'admin-user.password-reset.confirm',\n PASSWORD_UPDATE: 'admin-user.password.update',\n INVITE_ACCEPT: 'admin-user.invite.accept',\n} as const;\n\n/*\n Event hub events kept for custom listeners. The audit log no longer records them:\n * it records the AUDITED_EVENTS above, built from the row with before/after values.\n \n @deprecated Removed in the next major. Listen to the audit log events, or to the\n * database lifecycles, instead.\n /\nexport const LEGACY_USER_EVENTS = {\n CREATE: 'user.create',\n UPDATE: 'user.update',\n DELETE: 'user.delete',\n} as const;\n\nexport interface AdminUserResource extends Modules.AuditLogs.Resource {\n type: 'admin-user';\n id: Data.ID;\n email: string;\n}\n\n/\n The affected account, as read from the `admin::user` row after the write. Never the\n * row itself: it carries the password hash and the reset and registration tokens.\n /\nexport interface AdminUserEvent {\n userId: Data.ID;\n email: string;\n}\n\n/\n The fields an audit reader needs to identify the account and its access. Never\n * `password`, the tokens, or the timestamps: the row has its own date.\n /\nexport const ADMIN_USER_TRACKED_FIELDS = [\n 'firstname',\n 'lastname',\n 'email',\n 'username',\n 'preferedLanguage',\n 'isActive',\n] as const;\n\ntype TrackedField = (typeof ADMIN_USER_TRACKED_FIELDS)[number];\n\n/* A user row, or the attributes of an update: roles come as rows or as ids. /\nexport interface AdminUserSnapshot {\n firstname?: string \| null;\n lastname?: string \| null;\n email?: string \| null;\n username?: string \| null;\n preferedLanguage?: string \| null;\n isActive?: boolean \| null;\n roles?: Array<Data.ID \| { id: Data.ID }> \| null;\n}\n\nexport type AdminUserChanges = Partial<\n Record<TrackedField, Modules.AuditLogs.FieldChange<string \| boolean \| null>> & {\n roles: Modules.AuditLogs.FieldChange<Data.ID[]>;\n }\n>;\n\nexport interface CreateDetails {\n email: string;\n firstname: string \| null;\n lastname: string \| null;\n roles: Data.ID[];\n isActive: boolean;\n}\n\nexport type CreateEvent = AdminUserEvent & Omit<CreateDetails, 'email'>;\nexport type UpdateEvent = AdminUserEvent & { changes: AdminUserChanges };\nexport type PasswordResetCreateEvent = AdminUserEvent & { expiresAt: string \| Date };\n\n/* Sorted, so order alone is not a change. /\nexport const toRoleIds = (roles: AdminUserSnapshot['roles']): Data.ID[] =>\n sortBy(\n (id: Data.ID) => String(id),\n (roles ?? []).map((role) => (typeof role === 'object' ? role.id : role))\n );\n\nexport const getAdminUserChanges = (\n previous: AdminUserSnapshot,\n next: AdminUserSnapshot\n): AdminUserChanges => {\n const changes: AdminUserChanges = {};\n\n for (const field of ADMIN_USER_TRACKED_FIELDS) {\n // isActive is a boolean column that older rows may hold as null\n const before = field === 'isActive' ? previous.isActive === true : (previous[field] ?? null);\n const after = field === 'isActive' ? next.isActive === true : (next[field] ?? null);\n\n if (before !== after) {\n changes[field] = { before, after };\n }\n }\n\n if (previous.roles != null \|\| next.roles != null) {\n const before = toRoleIds(previous.roles);\n const after = toRoleIds(next.roles);\n\n if (!isEqual(before, after)) {\n changes.roles = { before, after };\n }\n }\n\n return changes;\n};\n\n/\n `email` is required by the admin::user schema; the contract type marks it optional\n * because it also describes creation payloads.\n /\nexport const toAdminUserEvent = (user: { id: Data.ID; email?: string \| null }): AdminUserEvent => ({\n userId: user.id,\n email: user.email as string,\n});\n\ntype AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];\n\ninterface AdminUserRow extends AdminUserSnapshot {\n id: Data.ID;\n}\n\nexport const emitAdminUserCreated = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_CREATE, {\n ...toAdminUserEvent(user),\n firstname: user.firstname ?? null,\n lastname: user.lastname ?? null,\n roles: toRoleIds(user.roles),\n isActive: user.isActive === true,\n } satisfies CreateEvent);\n\nexport const emitAdminUserDeleted = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_DELETE, toAdminUserEvent(user));\n\n/* Whether an update touches a field the audit log compares, so the previous row is needed. /\nexport const touchesTrackedFields = (attributes: Record<string, unknown>) =>\n [...ADMIN_USER_TRACKED_FIELDS, 'roles'].some((field) => field in attributes);\n\n/\n The account events an update can produce, emitted by updateById after the write:\n * `admin-user.update` with the fields that changed, `admin-user.password.update` when a\n * password was set. Both run through the request context, so a public flow (reset,\n * invitation) with no session emits them too and the subscriber drops them.\n /\nexport const emitAdminUserUpdateAudits = async (\n { strapi }: { strapi: AuditStrapi },\n {\n previous,\n updated,\n attributes,\n }: {\n previous: AdminUserSnapshot \| null \| undefined;\n updated: AdminUserRow \| null \| undefined;\n attributes: Record<string, unknown>;\n }\n) => {\n if (!updated) {\n return;\n }\n\n if (previous) {\n const changes = getAdminUserChanges(previous, updated);\n\n if (Object.keys(changes).length > 0) {\n await emitAudit({ strapi }, AUDITED_EVENTS.USER_UPDATE, {\n ...toAdminUserEvent(updated),\n changes,\n } satisfies UpdateEvent);\n }\n }\n\n if ('password' in attributes) {\n await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_UPDATE, toAdminUserEvent(updated));\n }\n};\n\n/\n The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n registerEvent<TDetails>(\n name: string,\n transform: Modules.AuditLogs.EventTransformer<TDetails>,\n options?: { allowUnknownActor?: boolean }\n ): void;\n}\n\nexport const registerAdminUserAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n const resource = (event: AdminUserEvent): AdminUserResource => ({\n type: 'admin-user',\n id: event.userId,\n email: event.email,\n });\n\n const withoutSession = { allowUnknownActor: true };\n\n // The first super admin registers from a public form too\n auditLogsLifecycle.registerEvent<CreateDetails>(\n AUDITED_EVENTS.USER_CREATE,\n (event: CreateEvent) => ({\n resource: resource(event),\n details: {\n email: event.email,\n firstname: event.firstname,\n lastname: event.lastname,\n roles: event.roles,\n isActive: event.isActive,\n },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<{ changes: AdminUserChanges }>(\n AUDITED_EVENTS.USER_UPDATE,\n (event: UpdateEvent) => ({\n resource: resource(event),\n details: { changes: event.changes },\n })\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.USER_DELETE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n\n auditLogsLifecycle.registerEvent<{ expiresAt: string }>(\n AUDITED_EVENTS.PASSWORD_RESET_CREATE,\n (event: PasswordResetCreateEvent) => ({\n resource: resource(event),\n details: { expiresAt: new Date(event.expiresAt).toISOString() },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_RESET_CONFIRM,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.INVITE_ACCEPT,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_UPDATE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n};\n"],"names":["AUDITED_EVENTS","USER_CREATE","USER_UPDATE","USER_DELETE","PASSWORD_RESET_CREATE","PASSWORD_RESET_CONFIRM","PASSWORD_UPDATE","INVITE_ACCEPT","LEGACY_USER_EVENTS","CREATE","UPDATE","DELETE","ADMIN_USER_TRACKED_FIELDS","toRoleIds","roles","sortBy","id","String","map","role","getAdminUserChanges","previous","next","changes","field","before","isActive","after","isEqual","toAdminUserEvent","user","userId","email","emitAdminUserCreated","strapi","emitAudit","firstname","lastname","emitAdminUserDeleted","touchesTrackedFields","attributes","some","emitAdminUserUpdateAudits","updated","Object","keys","length","registerAdminUserAuditEvents","auditLogsLifecycle","resource","event","type","withoutSession","allowUnknownActor","registerEvent","details","expiresAt","Date","toISOString"],"mappings":";;;MAIaA,cAAAA,GAAiB;IAC5BC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,qBAAAA,EAAuB,kCAAA;IACvBC,sBAAAA,EAAwB,mCAAA;IACxBC,eAAAA,EAAiB,4BAAA;IACjBC,aAAAA,EAAe;AACjB;AAEA;;;;;;UAOaC,kBAAAA,GAAqB;IAChCC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ;AACV;AAiBA;;;UAIaC,yBAAAA,GAA4B;AACvC,IAAA,WAAA;AACA,IAAA,UAAA;AACA,IAAA,OAAA;AACA,IAAA,UAAA;AACA,IAAA,kBAAA;AACA,IAAA;;AAkCF,+CACO,MAAMC,SAAAA,GAAY,CAACC,KAAAA,GACxBC,MAAAA,CACE,CAACC,EAAAA,GAAgBC,MAAAA,CAAOD,EAAAA,CAAAA,EACxB,CAACF,KAAAA,IAAS,EAAE,EAAEI,GAAG,CAAC,CAACC,IAAAA,GAAU,OAAOA,IAAAA,KAAS,QAAA,GAAWA,IAAAA,CAAKH,EAAE,GAAGG,IAAAA,CAAAA;AAG/D,MAAMC,mBAAAA,GAAsB,CACjCC,QAAAA,EACAC,IAAAA,GAAAA;AAEA,IAAA,MAAMC,UAA4B,EAAC;IAEnC,KAAK,MAAMC,SAASZ,yBAAAA,CAA2B;;QAE7C,MAAMa,MAAAA,GAASD,KAAAA,KAAU,UAAA,GAAaH,QAAAA,CAASK,QAAQ,KAAK,IAAA,GAAQL,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;QACvF,MAAMG,KAAAA,GAAQH,KAAAA,KAAU,UAAA,GAAaF,IAAAA,CAAKI,QAAQ,KAAK,IAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE9E,QAAA,IAAIC,WAAWE,KAAAA,EAAO;YACpBJ,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIN,SAASP,KAAK,IAAI,QAAQQ,IAAAA,CAAKR,KAAK,IAAI,IAAA,EAAM;QAChD,MAAMW,MAAAA,GAASZ,SAAAA,CAAUQ,QAAAA,CAASP,KAAK,CAAA;QACvC,MAAMa,KAAAA,GAAQd,SAAAA,CAAUS,IAAAA,CAAKR,KAAK,CAAA;QAElC,IAAI,CAACc,OAAAA,CAAQH,MAAAA,EAAQE,KAAAA,CAAAA,EAAQ;AAC3BJ,YAAAA,OAAAA,CAAQT,KAAK,GAAG;AAAEW,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AAClC,QAAA;AACF,IAAA;IAEA,OAAOJ,OAAAA;AACT;AAEA;;;AAGC,IACM,MAAMM,gBAAAA,GAAmB,CAACC,QAAkE;AACjGC,QAAAA,MAAAA,EAAQD,KAAKd,EAAE;AACfgB,QAAAA,KAAAA,EAAOF,KAAKE;AACd,KAAA;AAQO,MAAMC,uBAAuB,CAAC,EAAEC,MAAM,EAA2B,EAAEJ,OACxEK,SAAAA,CAAU;AAAED,QAAAA;KAAO,EAAGlC,cAAAA,CAAeC,WAAW,EAAE;AAChD,QAAA,GAAG4B,iBAAiBC,IAAAA,CAAK;QACzBM,SAAAA,EAAWN,IAAAA,CAAKM,SAAS,IAAI,IAAA;QAC7BC,QAAAA,EAAUP,IAAAA,CAAKO,QAAQ,IAAI,IAAA;QAC3BvB,KAAAA,EAAOD,SAAAA,CAAUiB,KAAKhB,KAAK,CAAA;QAC3BY,QAAAA,EAAUI,IAAAA,CAAKJ,QAAQ,KAAK;KAC9B;AAEK,MAAMY,uBAAuB,CAAC,EAAEJ,MAAM,EAA2B,EAAEJ,OACxEK,SAAAA,CAAU;AAAED,QAAAA;AAAO,KAAA,EAAGlC,cAAAA,CAAeG,WAAW,EAAE0B,gBAAAA,CAAiBC,IAAAA,CAAAA;AAErE,gGACO,MAAMS,oBAAAA,GAAuB,CAACC,UAAAA,GACnC;AAAI5B,QAAAA,GAAAA,yBAAAA;AAA2B,QAAA;AAAQ,KAAA,CAAC6B,IAAI,CAAC,CAACjB,KAAAA,GAAUA,SAASgB,UAAAA;AAEnE;;;;;AAKC,IACM,MAAME,yBAAAA,GAA4B,OACvC,EAAER,MAAM,EAA2B,EACnC,EACEb,QAAQ,EACRsB,OAAO,EACPH,UAAU,EAKX,GAAA;AAED,IAAA,IAAI,CAACG,OAAAA,EAAS;AACZ,QAAA;AACF,IAAA;AAEA,IAAA,IAAItB,QAAAA,EAAU;QACZ,MAAME,OAAAA,GAAUH,oBAAoBC,QAAAA,EAAUsB,OAAAA,CAAAA;AAE9C,QAAA,IAAIC,OAAOC,IAAI,CAACtB,OAAAA,CAAAA,CAASuB,MAAM,GAAG,CAAA,EAAG;AACnC,YAAA,MAAMX,SAAAA,CAAU;AAAED,gBAAAA;aAAO,EAAGlC,cAAAA,CAAeE,WAAW,EAAE;AACtD,gBAAA,GAAG2B,iBAAiBc,OAAAA,CAAQ;AAC5BpB,gBAAAA;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,cAAciB,UAAAA,EAAY;AAC5B,QAAA,MAAML,SAAAA,CAAU;AAAED,YAAAA;SAAO,EAAGlC,cAAAA,CAAeM,eAAe,EAAEuB,gBAAAA,CAAiBc,OAAAA,CAAAA,CAAAA;AAC/E,IAAA;AACF;AAcO,MAAMI,+BAA+B,CAACC,kBAAAA,GAAAA;IAC3C,MAAMC,QAAAA,GAAW,CAACC,KAAAA,IAA8C;YAC9DC,IAAAA,EAAM,YAAA;AACNnC,YAAAA,EAAAA,EAAIkC,MAAMnB,MAAM;AAChBC,YAAAA,KAAAA,EAAOkB,MAAMlB;SACf,CAAA;AAEA,IAAA,MAAMoB,cAAAA,GAAiB;QAAEC,iBAAAA,EAAmB;AAAK,KAAA;;AAGjDL,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeC,WAAW,EAC1B,CAACiD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AACPvB,gBAAAA,KAAAA,EAAOkB,MAAMlB,KAAK;AAClBI,gBAAAA,SAAAA,EAAWc,MAAMd,SAAS;AAC1BC,gBAAAA,QAAAA,EAAUa,MAAMb,QAAQ;AACxBvB,gBAAAA,KAAAA,EAAOoC,MAAMpC,KAAK;AAClBY,gBAAAA,QAAAA,EAAUwB,MAAMxB;AAClB;AACF,SAAA,CAAA,EACA0B,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeE,WAAW,EAC1B,CAACgD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEhC,gBAAAA,OAAAA,EAAS2B,MAAM3B;AAAQ;SACpC,CAAA,CAAA;AAGFyB,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeG,WAAW,EAC1B,CAAC+C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAG1DF,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeI,qBAAqB,EACpC,CAAC8C,SAAqC;AACpCD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEC,gBAAAA,SAAAA,EAAW,IAAIC,IAAAA,CAAKP,KAAAA,CAAMM,SAAS,EAAEE,WAAW;AAAG;AAChE,SAAA,CAAA,EACAN,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeK,sBAAsB,EACrC,CAAC6C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeO,aAAa,EAC5B,CAAC2C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeM,eAAe,EAC9B,CAAC4C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAE5D;;;;"}
1	+ {"version":3,"file":"admin-users.mjs","sources":["../../../../../server/src/audit-logs/admin-users.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash';\nimport type { Data, Modules } from '@strapi/types';\nimport { emitAudit } from '@strapi/utils';\n\nexport const AUDITED_EVENTS = {\n USER_CREATE: 'admin-user.create',\n USER_UPDATE: 'admin-user.update',\n USER_DELETE: 'admin-user.delete',\n PASSWORD_RESET_CREATE: 'admin-user.password-reset.create',\n PASSWORD_RESET_CONFIRM: 'admin-user.password-reset.confirm',\n PASSWORD_UPDATE: 'admin-user.password.update',\n INVITE_ACCEPT: 'admin-user.invite.accept',\n} as const;\n\n/*\n Event hub events kept for custom listeners. The audit log no longer records them:\n * it records the AUDITED_EVENTS above, built from the row with before/after values.\n \n @deprecated Removed in the next major. Listen to the audit log events, or to the\n * database lifecycles, instead.\n /\nexport const LEGACY_USER_EVENTS = {\n CREATE: 'user.create',\n UPDATE: 'user.update',\n DELETE: 'user.delete',\n} as const;\n\nexport interface AdminUserResource extends Modules.AuditLogs.Resource {\n type: 'admin-user';\n id: Data.ID;\n email: string;\n}\n\n/\n The affected account, as read from the `admin::user` row after the write. Never the\n * row itself: it carries the password hash and the reset and registration tokens.\n /\nexport interface AdminUserEvent {\n userId: Data.ID;\n email: string;\n}\n\n/\n The fields an audit reader needs to identify the account and its access. Never\n * `password`, the tokens, or the timestamps: the row has its own date.\n /\nexport const ADMIN_USER_TRACKED_FIELDS = [\n 'firstname',\n 'lastname',\n 'email',\n 'username',\n 'preferedLanguage',\n 'isActive',\n] as const;\n\ntype TrackedField = (typeof ADMIN_USER_TRACKED_FIELDS)[number];\n\n/* A user row, or the attributes of an update: roles come as rows or as ids. /\nexport interface AdminUserSnapshot {\n firstname?: string \| null;\n lastname?: string \| null;\n email?: string \| null;\n username?: string \| null;\n preferedLanguage?: string \| null;\n isActive?: boolean \| null;\n roles?: Array<Data.ID \| { id: Data.ID }> \| null;\n}\n\nexport type AdminUserChanges = Partial<\n Record<TrackedField, Modules.AuditLogs.FieldChange<string \| boolean \| null>> & {\n roles: Modules.AuditLogs.FieldChange<Data.ID[]>;\n }\n>;\n\nexport interface CreateDetails {\n email: string;\n firstname: string \| null;\n lastname: string \| null;\n roles: Data.ID[];\n isActive: boolean;\n}\n\nexport type CreateEvent = AdminUserEvent & Omit<CreateDetails, 'email'>;\nexport type UpdateEvent = AdminUserEvent & { changes: AdminUserChanges };\nexport type PasswordResetCreateEvent = AdminUserEvent & { expiresAt: string \| Date };\n\n/* Sorted, so order alone is not a change. /\nexport const toRoleIds = (roles: AdminUserSnapshot['roles']): Data.ID[] =>\n sortBy(\n (roles ?? []).map((role) => (typeof role === 'object' ? role.id : role)),\n (id: Data.ID) => String(id)\n );\n\nexport const getAdminUserChanges = (\n previous: AdminUserSnapshot,\n next: AdminUserSnapshot\n): AdminUserChanges => {\n const changes: AdminUserChanges = {};\n\n for (const field of ADMIN_USER_TRACKED_FIELDS) {\n // isActive is a boolean column that older rows may hold as null\n const before = field === 'isActive' ? previous.isActive === true : (previous[field] ?? null);\n const after = field === 'isActive' ? next.isActive === true : (next[field] ?? null);\n\n if (before !== after) {\n changes[field] = { before, after };\n }\n }\n\n if (previous.roles != null \|\| next.roles != null) {\n const before = toRoleIds(previous.roles);\n const after = toRoleIds(next.roles);\n\n if (!isEqual(before, after)) {\n changes.roles = { before, after };\n }\n }\n\n return changes;\n};\n\n/\n `email` is required by the admin::user schema; the contract type marks it optional\n * because it also describes creation payloads.\n /\nexport const toAdminUserEvent = (user: { id: Data.ID; email?: string \| null }): AdminUserEvent => ({\n userId: user.id,\n email: user.email as string,\n});\n\ntype AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];\n\ninterface AdminUserRow extends AdminUserSnapshot {\n id: Data.ID;\n}\n\nexport const emitAdminUserCreated = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_CREATE, {\n ...toAdminUserEvent(user),\n firstname: user.firstname ?? null,\n lastname: user.lastname ?? null,\n roles: toRoleIds(user.roles),\n isActive: user.isActive === true,\n } satisfies CreateEvent);\n\nexport const emitAdminUserDeleted = ({ strapi }: { strapi: AuditStrapi }, user: AdminUserRow) =>\n emitAudit({ strapi }, AUDITED_EVENTS.USER_DELETE, toAdminUserEvent(user));\n\n/* Whether an update touches a field the audit log compares, so the previous row is needed. /\nexport const touchesTrackedFields = (attributes: Record<string, unknown>) =>\n [...ADMIN_USER_TRACKED_FIELDS, 'roles'].some((field) => field in attributes);\n\n/\n The account events an update can produce, emitted by updateById after the write:\n * `admin-user.update` with the fields that changed, `admin-user.password.update` when a\n * password was set. Both run through the request context, so a public flow (reset,\n * invitation) with no session emits them too and the subscriber drops them.\n /\nexport const emitAdminUserUpdateAudits = async (\n { strapi }: { strapi: AuditStrapi },\n {\n previous,\n updated,\n attributes,\n }: {\n previous: AdminUserSnapshot \| null \| undefined;\n updated: AdminUserRow \| null \| undefined;\n attributes: Record<string, unknown>;\n }\n) => {\n if (!updated) {\n return;\n }\n\n if (previous) {\n const changes = getAdminUserChanges(previous, updated);\n\n if (Object.keys(changes).length > 0) {\n await emitAudit({ strapi }, AUDITED_EVENTS.USER_UPDATE, {\n ...toAdminUserEvent(updated),\n changes,\n } satisfies UpdateEvent);\n }\n }\n\n if ('password' in attributes) {\n await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_UPDATE, toAdminUserEvent(updated));\n }\n};\n\n/\n The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n registerEvent<TDetails>(\n name: string,\n transform: Modules.AuditLogs.EventTransformer<TDetails>,\n options?: { allowUnknownActor?: boolean }\n ): void;\n}\n\nexport const registerAdminUserAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n const resource = (event: AdminUserEvent): AdminUserResource => ({\n type: 'admin-user',\n id: event.userId,\n email: event.email,\n });\n\n const withoutSession = { allowUnknownActor: true };\n\n // The first super admin registers from a public form too\n auditLogsLifecycle.registerEvent<CreateDetails>(\n AUDITED_EVENTS.USER_CREATE,\n (event: CreateEvent) => ({\n resource: resource(event),\n details: {\n email: event.email,\n firstname: event.firstname,\n lastname: event.lastname,\n roles: event.roles,\n isActive: event.isActive,\n },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<{ changes: AdminUserChanges }>(\n AUDITED_EVENTS.USER_UPDATE,\n (event: UpdateEvent) => ({\n resource: resource(event),\n details: { changes: event.changes },\n })\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.USER_DELETE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n\n auditLogsLifecycle.registerEvent<{ expiresAt: string }>(\n AUDITED_EVENTS.PASSWORD_RESET_CREATE,\n (event: PasswordResetCreateEvent) => ({\n resource: resource(event),\n details: { expiresAt: new Date(event.expiresAt).toISOString() },\n }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_RESET_CONFIRM,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.INVITE_ACCEPT,\n (event: AdminUserEvent) => ({ resource: resource(event) }),\n withoutSession\n );\n\n auditLogsLifecycle.registerEvent<undefined>(\n AUDITED_EVENTS.PASSWORD_UPDATE,\n (event: AdminUserEvent) => ({ resource: resource(event) })\n );\n};\n"],"names":["AUDITED_EVENTS","USER_CREATE","USER_UPDATE","USER_DELETE","PASSWORD_RESET_CREATE","PASSWORD_RESET_CONFIRM","PASSWORD_UPDATE","INVITE_ACCEPT","LEGACY_USER_EVENTS","CREATE","UPDATE","DELETE","ADMIN_USER_TRACKED_FIELDS","toRoleIds","roles","sortBy","map","role","id","String","getAdminUserChanges","previous","next","changes","field","before","isActive","after","isEqual","toAdminUserEvent","user","userId","email","emitAdminUserCreated","strapi","emitAudit","firstname","lastname","emitAdminUserDeleted","touchesTrackedFields","attributes","some","emitAdminUserUpdateAudits","updated","Object","keys","length","registerAdminUserAuditEvents","auditLogsLifecycle","resource","event","type","withoutSession","allowUnknownActor","registerEvent","details","expiresAt","Date","toISOString"],"mappings":";;;MAIaA,cAAAA,GAAiB;IAC5BC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,WAAAA,EAAa,mBAAA;IACbC,qBAAAA,EAAuB,kCAAA;IACvBC,sBAAAA,EAAwB,mCAAA;IACxBC,eAAAA,EAAiB,4BAAA;IACjBC,aAAAA,EAAe;AACjB;AAEA;;;;;;UAOaC,kBAAAA,GAAqB;IAChCC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ,aAAA;IACRC,MAAAA,EAAQ;AACV;AAiBA;;;UAIaC,yBAAAA,GAA4B;AACvC,IAAA,WAAA;AACA,IAAA,UAAA;AACA,IAAA,OAAA;AACA,IAAA,UAAA;AACA,IAAA,kBAAA;AACA,IAAA;;AAkCF,+CACO,MAAMC,SAAAA,GAAY,CAACC,KAAAA,GACxBC,MAAAA,CACE,CAACD,KAAAA,IAAS,EAAE,EAAEE,GAAG,CAAC,CAACC,IAAAA,GAAU,OAAOA,IAAAA,KAAS,QAAA,GAAWA,IAAAA,CAAKC,EAAE,GAAGD,IAAAA,CAAAA,EAClE,CAACC,EAAAA,GAAgBC,MAAAA,CAAOD,EAAAA,CAAAA;AAGrB,MAAME,mBAAAA,GAAsB,CACjCC,QAAAA,EACAC,IAAAA,GAAAA;AAEA,IAAA,MAAMC,UAA4B,EAAC;IAEnC,KAAK,MAAMC,SAASZ,yBAAAA,CAA2B;;QAE7C,MAAMa,MAAAA,GAASD,KAAAA,KAAU,UAAA,GAAaH,QAAAA,CAASK,QAAQ,KAAK,IAAA,GAAQL,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;QACvF,MAAMG,KAAAA,GAAQH,KAAAA,KAAU,UAAA,GAAaF,IAAAA,CAAKI,QAAQ,KAAK,IAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE9E,QAAA,IAAIC,WAAWE,KAAAA,EAAO;YACpBJ,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIN,SAASP,KAAK,IAAI,QAAQQ,IAAAA,CAAKR,KAAK,IAAI,IAAA,EAAM;QAChD,MAAMW,MAAAA,GAASZ,SAAAA,CAAUQ,QAAAA,CAASP,KAAK,CAAA;QACvC,MAAMa,KAAAA,GAAQd,SAAAA,CAAUS,IAAAA,CAAKR,KAAK,CAAA;QAElC,IAAI,CAACc,OAAAA,CAAQH,MAAAA,EAAQE,KAAAA,CAAAA,EAAQ;AAC3BJ,YAAAA,OAAAA,CAAQT,KAAK,GAAG;AAAEW,gBAAAA,MAAAA;AAAQE,gBAAAA;AAAM,aAAA;AAClC,QAAA;AACF,IAAA;IAEA,OAAOJ,OAAAA;AACT;AAEA;;;AAGC,IACM,MAAMM,gBAAAA,GAAmB,CAACC,QAAkE;AACjGC,QAAAA,MAAAA,EAAQD,KAAKZ,EAAE;AACfc,QAAAA,KAAAA,EAAOF,KAAKE;AACd,KAAA;AAQO,MAAMC,uBAAuB,CAAC,EAAEC,MAAM,EAA2B,EAAEJ,OACxEK,SAAAA,CAAU;AAAED,QAAAA;KAAO,EAAGlC,cAAAA,CAAeC,WAAW,EAAE;AAChD,QAAA,GAAG4B,iBAAiBC,IAAAA,CAAK;QACzBM,SAAAA,EAAWN,IAAAA,CAAKM,SAAS,IAAI,IAAA;QAC7BC,QAAAA,EAAUP,IAAAA,CAAKO,QAAQ,IAAI,IAAA;QAC3BvB,KAAAA,EAAOD,SAAAA,CAAUiB,KAAKhB,KAAK,CAAA;QAC3BY,QAAAA,EAAUI,IAAAA,CAAKJ,QAAQ,KAAK;KAC9B;AAEK,MAAMY,uBAAuB,CAAC,EAAEJ,MAAM,EAA2B,EAAEJ,OACxEK,SAAAA,CAAU;AAAED,QAAAA;AAAO,KAAA,EAAGlC,cAAAA,CAAeG,WAAW,EAAE0B,gBAAAA,CAAiBC,IAAAA,CAAAA;AAErE,gGACO,MAAMS,oBAAAA,GAAuB,CAACC,UAAAA,GACnC;AAAI5B,QAAAA,GAAAA,yBAAAA;AAA2B,QAAA;AAAQ,KAAA,CAAC6B,IAAI,CAAC,CAACjB,KAAAA,GAAUA,SAASgB,UAAAA;AAEnE;;;;;AAKC,IACM,MAAME,yBAAAA,GAA4B,OACvC,EAAER,MAAM,EAA2B,EACnC,EACEb,QAAQ,EACRsB,OAAO,EACPH,UAAU,EAKX,GAAA;AAED,IAAA,IAAI,CAACG,OAAAA,EAAS;AACZ,QAAA;AACF,IAAA;AAEA,IAAA,IAAItB,QAAAA,EAAU;QACZ,MAAME,OAAAA,GAAUH,oBAAoBC,QAAAA,EAAUsB,OAAAA,CAAAA;AAE9C,QAAA,IAAIC,OAAOC,IAAI,CAACtB,OAAAA,CAAAA,CAASuB,MAAM,GAAG,CAAA,EAAG;AACnC,YAAA,MAAMX,SAAAA,CAAU;AAAED,gBAAAA;aAAO,EAAGlC,cAAAA,CAAeE,WAAW,EAAE;AACtD,gBAAA,GAAG2B,iBAAiBc,OAAAA,CAAQ;AAC5BpB,gBAAAA;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,cAAciB,UAAAA,EAAY;AAC5B,QAAA,MAAML,SAAAA,CAAU;AAAED,YAAAA;SAAO,EAAGlC,cAAAA,CAAeM,eAAe,EAAEuB,gBAAAA,CAAiBc,OAAAA,CAAAA,CAAAA;AAC/E,IAAA;AACF;AAcO,MAAMI,+BAA+B,CAACC,kBAAAA,GAAAA;IAC3C,MAAMC,QAAAA,GAAW,CAACC,KAAAA,IAA8C;YAC9DC,IAAAA,EAAM,YAAA;AACNjC,YAAAA,EAAAA,EAAIgC,MAAMnB,MAAM;AAChBC,YAAAA,KAAAA,EAAOkB,MAAMlB;SACf,CAAA;AAEA,IAAA,MAAMoB,cAAAA,GAAiB;QAAEC,iBAAAA,EAAmB;AAAK,KAAA;;AAGjDL,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeC,WAAW,EAC1B,CAACiD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AACPvB,gBAAAA,KAAAA,EAAOkB,MAAMlB,KAAK;AAClBI,gBAAAA,SAAAA,EAAWc,MAAMd,SAAS;AAC1BC,gBAAAA,QAAAA,EAAUa,MAAMb,QAAQ;AACxBvB,gBAAAA,KAAAA,EAAOoC,MAAMpC,KAAK;AAClBY,gBAAAA,QAAAA,EAAUwB,MAAMxB;AAClB;AACF,SAAA,CAAA,EACA0B,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeE,WAAW,EAC1B,CAACgD,SAAwB;AACvBD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEhC,gBAAAA,OAAAA,EAAS2B,MAAM3B;AAAQ;SACpC,CAAA,CAAA;AAGFyB,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeG,WAAW,EAC1B,CAAC+C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAG1DF,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeI,qBAAqB,EACpC,CAAC8C,SAAqC;AACpCD,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA,CAAAA;YACnBK,OAAAA,EAAS;AAAEC,gBAAAA,SAAAA,EAAW,IAAIC,IAAAA,CAAKP,KAAAA,CAAMM,SAAS,EAAEE,WAAW;AAAG;AAChE,SAAA,CAAA,EACAN,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeK,sBAAsB,EACrC,CAAC6C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeO,aAAa,EAC5B,CAAC2C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;AAAO,SAAA,CAAA,EACxDE,cAAAA,CAAAA;AAGFJ,IAAAA,kBAAAA,CAAmBM,aAAa,CAC9BtD,cAAAA,CAAeM,eAAe,EAC9B,CAAC4C,SAA2B;AAAED,YAAAA,QAAAA,EAAUA,QAAAA,CAASC,KAAAA;SAAO,CAAA,CAAA;AAE5D;;;;"}

package/dist/server/server/src/audit-logs/auth.js ADDED Viewed

@@ -0,0 +1,72 @@
+'use strict';
+var utils = require('@strapi/utils');
+var adminUsers = require('./admin-users.js');
+/**
+ * Event hub events bound to the `admin.auth.events` config callbacks
+ * (`onConnectionError`, `onSSOAutoRegistration`). Their names and payloads are public.
+ */ const AUTH_EVENTS = {
+    LOGIN_FAILURE: 'admin.auth.error',
+    AUTO_REGISTRATION: 'admin.auth.autoRegistration'
+};
+/**
+ * Emits without waiting: listeners bound to the event, such as the `onConnectionError`
+ * config callback, run before the audit subscriber and must not hold the login.
+ */ const emitLoginFailure = ({ strapi }, event)=>{
+    utils.emitAudit({
+        strapi
+    }, AUTH_EVENTS.LOGIN_FAILURE, {
+        error: event.error,
+        provider: event.provider,
+        reason: event.reason,
+        ...event.user ? {
+            user: {
+                id: event.user.id,
+                email: event.user.email
+            }
+        } : {}
+    }).catch((error)=>{
+        strapi.log.error(`Failed to emit ${AUTH_EVENTS.LOGIN_FAILURE}`, {
+            error
+        });
+    });
+};
+/**
+ * Whether the audit log records a failed login. Not recorded: failures anyone can produce
+ * from outside before any verification, a local login for an email with no account and an
+ * SSO connection with no valid profile.
+ */ const isRecordedLoginFailure = (event)=>event.reason !== 'sso_connection_error' && !(event.provider === 'local' && !event.user);
+const toResource = (user)=>({
+        type: 'admin-user',
+        id: user.id,
+        email: user.email
+    });
+const registerAuthAuditEvents = (auditLogsLifecycle)=>{
+    auditLogsLifecycle.registerEvent(AUTH_EVENTS.LOGIN_FAILURE, (event)=>({
+            ...event.user ? {
+                resource: toResource(event.user)
+            } : {},
+            outcome: 'failure',
+            details: {
+                provider: event.provider,
+                reason: event.reason
+            }
+        }), {
+        alwaysUnknownActor: true,
+        shouldRecord: isRecordedLoginFailure
+    });
+    auditLogsLifecycle.registerEvent(AUTH_EVENTS.AUTO_REGISTRATION, (event)=>({
+            resource: toResource(event.user),
+            details: {
+                provider: event.provider,
+                roles: adminUsers.toRoleIds(event.user.roles)
+            }
+        }));
+};
+exports.AUTH_EVENTS = AUTH_EVENTS;
+exports.emitLoginFailure = emitLoginFailure;
+exports.isRecordedLoginFailure = isRecordedLoginFailure;
+exports.registerAuthAuditEvents = registerAuthAuditEvents;
+//# sourceMappingURL=auth.js.map

package/dist/server/server/src/audit-logs/auth.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"auth.js","sources":["../../../../../server/src/audit-logs/auth.ts"],"sourcesContent":["import type { Data, Modules } from '@strapi/types';\nimport { emitAudit } from '@strapi/utils';\n\nimport { toRoleIds, type AdminUserResource, type AdminUserSnapshot } from './admin-users';\n\n/**\n * Event hub events bound to the `admin.auth.events` config callbacks\n * (`onConnectionError`, `onSSOAutoRegistration`). Their names and payloads are public.\n */\nexport const AUTH_EVENTS = {\n LOGIN_FAILURE: 'admin.auth.error',\n AUTO_REGISTRATION: 'admin.auth.autoRegistration',\n} as const;\n\n/** One fixed value per emit site. */\nexport type LoginFailureReason =\n | 'login_not_allowed'\n | 'unexpected_error'\n | 'invalid_credentials'\n | 'account_inactive'\n | 'sso_connection_error'\n | 'sso_registration_disabled'\n | 'sso_role_misconfigured';\n\n/**\n * Payload of `admin.auth.error`, also passed to the `onConnectionError` callback.\n * The audit log stores `provider`, `reason` and the account, never `error`.\n */\nexport interface LoginFailureEvent {\n error: Error;\n provider: string;\n reason: LoginFailureReason;\n /** The account the login was for, when known. */\n user?: { id: Data.ID; email: string };\n}\n\n/** Payload of `admin.auth.autoRegistration`: the created `admin::user` row, roles populated. */\nexport interface AutoRegistrationEvent {\n user: { id: Data.ID; email?: string | null; roles?: AdminUserSnapshot['roles'] };\n provider: string;\n}\n\nexport interface LoginFailureDetails {\n provider: string;\n reason: LoginFailureReason;\n}\n\nexport interface AutoRegistrationDetails {\n provider: string;\n roles: Data.ID[];\n}\n\ntype AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];\n\n/**\n * Emits without waiting: listeners bound to the event, such as the `onConnectionError`\n * config callback, run before the audit subscriber and must not hold the login.\n */\nexport const emitLoginFailure = (\n { strapi }: { strapi: AuditStrapi },\n event: LoginFailureEvent\n): void => {\n emitAudit({ strapi }, AUTH_EVENTS.LOGIN_FAILURE, {\n error: event.error,\n provider: event.provider,\n reason: event.reason,\n ...(event.user ? { user: { id: event.user.id, email: event.user.email } } : {}),\n } satisfies LoginFailureEvent).catch((error) => {\n strapi.log.error(`Failed to emit ${AUTH_EVENTS.LOGIN_FAILURE}`, { error });\n });\n};\n\n/**\n * Whether the audit log records a failed login. Not recorded: failures anyone can produce\n * from outside before any verification, a local login for an email with no account and an\n * SSO connection with no valid profile.\n */\nexport const isRecordedLoginFailure = (event: LoginFailureEvent) =>\n event.reason !== 'sso_connection_error' && !(event.provider === 'local' && !event.user);\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n registerEvent<TDetails>(\n name: string,\n transform: Modules.AuditLogs.EventTransformer<TDetails>,\n options?: {\n allowUnknownActor?: boolean;\n alwaysUnknownActor?: boolean;\n shouldRecord?: (...args: any[]) => boolean;\n }\n ): void;\n}\n\nconst toResource = (user: { id: Data.ID; email?: string | null }): AdminUserResource => ({\n type: 'admin-user',\n id: user.id,\n email: user.email as string,\n});\n\nexport const registerAuthAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n auditLogsLifecycle.registerEvent<LoginFailureDetails>(\n AUTH_EVENTS.LOGIN_FAILURE,\n (event: LoginFailureEvent) => ({\n ...(event.user ? { resource: toResource(event.user) } : {}),\n outcome: 'failure',\n details: { provider: event.provider, reason: event.reason },\n }),\n { alwaysUnknownActor: true, shouldRecord: isRecordedLoginFailure }\n );\n\n auditLogsLifecycle.registerEvent<AutoRegistrationDetails>(\n AUTH_EVENTS.AUTO_REGISTRATION,\n (event: AutoRegistrationEvent) => ({\n resource: toResource(event.user),\n details: { provider: event.provider, roles: toRoleIds(event.user.roles) },\n })\n );\n};\n"],"names":["AUTH_EVENTS","LOGIN_FAILURE","AUTO_REGISTRATION","emitLoginFailure","strapi","event","emitAudit","error","provider","reason","user","id","email","catch","log","isRecordedLoginFailure","toResource","type","registerAuthAuditEvents","auditLogsLifecycle","registerEvent","resource","outcome","details","alwaysUnknownActor","shouldRecord","roles","toRoleIds"],"mappings":";;;;;AAKA;;;UAIaA,WAAAA,GAAc;IACzBC,aAAAA,EAAe,kBAAA;IACfC,iBAAAA,EAAmB;AACrB;AA0CA;;;AAGC,IACM,MAAMC,gBAAAA,GAAmB,CAC9B,EAAEC,MAAM,EAA2B,EACnCC,KAAAA,GAAAA;IAEAC,eAAAA,CAAU;AAAEF,QAAAA;KAAO,EAAGJ,WAAAA,CAAYC,aAAa,EAAE;AAC/CM,QAAAA,KAAAA,EAAOF,MAAME,KAAK;AAClBC,QAAAA,QAAAA,EAAUH,MAAMG,QAAQ;AACxBC,QAAAA,MAAAA,EAAQJ,MAAMI,MAAM;QACpB,GAAIJ,KAAAA,CAAMK,IAAI,GAAG;YAAEA,IAAAA,EAAM;gBAAEC,EAAAA,EAAIN,KAAAA,CAAMK,IAAI,CAACC,EAAE;gBAAEC,KAAAA,EAAOP,KAAAA,CAAMK,IAAI,CAACE;AAAM;AAAE,SAAA,GAAI;KAC9E,CAAA,CAA+BC,KAAK,CAAC,CAACN,KAAAA,GAAAA;QACpCH,MAAAA,CAAOU,GAAG,CAACP,KAAK,CAAC,CAAC,eAAe,EAAEP,WAAAA,CAAYC,aAAa,CAAA,CAAE,EAAE;AAAEM,YAAAA;AAAM,SAAA,CAAA;AAC1E,IAAA,CAAA,CAAA;AACF;AAEA;;;;AAIC,IACM,MAAMQ,sBAAAA,GAAyB,CAACV,KAAAA,GACrCA,KAAAA,CAAMI,MAAM,KAAK,sBAAA,IAA0B,EAAEJ,KAAAA,CAAMG,QAAQ,KAAK,OAAA,IAAW,CAACH,KAAAA,CAAMK,IAAI;AAkBxF,MAAMM,UAAAA,GAAa,CAACN,IAAAA,IAAqE;QACvFO,IAAAA,EAAM,YAAA;AACNN,QAAAA,EAAAA,EAAID,KAAKC,EAAE;AACXC,QAAAA,KAAAA,EAAOF,KAAKE;KACd,CAAA;AAEO,MAAMM,0BAA0B,CAACC,kBAAAA,GAAAA;AACtCA,IAAAA,kBAAAA,CAAmBC,aAAa,CAC9BpB,WAAAA,CAAYC,aAAa,EACzB,CAACI,SAA8B;YAC7B,GAAIA,KAAAA,CAAMK,IAAI,GAAG;gBAAEW,QAAAA,EAAUL,UAAAA,CAAWX,MAAMK,IAAI;AAAE,aAAA,GAAI,EAAE;YAC1DY,OAAAA,EAAS,SAAA;YACTC,OAAAA,EAAS;AAAEf,gBAAAA,QAAAA,EAAUH,MAAMG,QAAQ;AAAEC,gBAAAA,MAAAA,EAAQJ,MAAMI;AAAO;AAC5D,SAAA,CAAA,EACA;QAAEe,kBAAAA,EAAoB,IAAA;QAAMC,YAAAA,EAAcV;AAAuB,KAAA,CAAA;AAGnEI,IAAAA,kBAAAA,CAAmBC,aAAa,CAC9BpB,WAAAA,CAAYE,iBAAiB,EAC7B,CAACG,SAAkC;YACjCgB,QAAAA,EAAUL,UAAAA,CAAWX,MAAMK,IAAI,CAAA;YAC/Ba,OAAAA,EAAS;AAAEf,gBAAAA,QAAAA,EAAUH,MAAMG,QAAQ;AAAEkB,gBAAAA,KAAAA,EAAOC,oBAAAA,CAAUtB,KAAAA,CAAMK,IAAI,CAACgB,KAAK;AAAE;SAC1E,CAAA,CAAA;AAEJ;;;;;;;"}

package/dist/server/server/src/audit-logs/auth.mjs ADDED Viewed

@@ -0,0 +1,67 @@
+import { emitAudit } from '@strapi/utils';
+import { toRoleIds } from './admin-users.mjs';
+/**
+ * Event hub events bound to the `admin.auth.events` config callbacks
+ * (`onConnectionError`, `onSSOAutoRegistration`). Their names and payloads are public.
+ */ const AUTH_EVENTS = {
+    LOGIN_FAILURE: 'admin.auth.error',
+    AUTO_REGISTRATION: 'admin.auth.autoRegistration'
+};
+/**
+ * Emits without waiting: listeners bound to the event, such as the `onConnectionError`
+ * config callback, run before the audit subscriber and must not hold the login.
+ */ const emitLoginFailure = ({ strapi }, event)=>{
+    emitAudit({
+        strapi
+    }, AUTH_EVENTS.LOGIN_FAILURE, {
+        error: event.error,
+        provider: event.provider,
+        reason: event.reason,
+        ...event.user ? {
+            user: {
+                id: event.user.id,
+                email: event.user.email
+            }
+        } : {}
+    }).catch((error)=>{
+        strapi.log.error(`Failed to emit ${AUTH_EVENTS.LOGIN_FAILURE}`, {
+            error
+        });
+    });
+};
+/**
+ * Whether the audit log records a failed login. Not recorded: failures anyone can produce
+ * from outside before any verification, a local login for an email with no account and an
+ * SSO connection with no valid profile.
+ */ const isRecordedLoginFailure = (event)=>event.reason !== 'sso_connection_error' && !(event.provider === 'local' && !event.user);
+const toResource = (user)=>({
+        type: 'admin-user',
+        id: user.id,
+        email: user.email
+    });
+const registerAuthAuditEvents = (auditLogsLifecycle)=>{
+    auditLogsLifecycle.registerEvent(AUTH_EVENTS.LOGIN_FAILURE, (event)=>({
+            ...event.user ? {
+                resource: toResource(event.user)
+            } : {},
+            outcome: 'failure',
+            details: {
+                provider: event.provider,
+                reason: event.reason
+            }
+        }), {
+        alwaysUnknownActor: true,
+        shouldRecord: isRecordedLoginFailure
+    });
+    auditLogsLifecycle.registerEvent(AUTH_EVENTS.AUTO_REGISTRATION, (event)=>({
+            resource: toResource(event.user),
+            details: {
+                provider: event.provider,
+                roles: toRoleIds(event.user.roles)
+            }
+        }));
+};
+export { AUTH_EVENTS, emitLoginFailure, isRecordedLoginFailure, registerAuthAuditEvents };
+//# sourceMappingURL=auth.mjs.map