@strapi/admin 5.56.0 → 5.58.0

package/dist/server/server/src/audit-logs/auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.mjs","sources":["../../../../../server/src/audit-logs/auth.ts"],"sourcesContent":["import type { Data, Modules } from '@strapi/types';\nimport { emitAudit } from '@strapi/utils';\n\nimport { toRoleIds, type AdminUserResource, type AdminUserSnapshot } from './admin-users';\n\n/**\n * Event hub events bound to the `admin.auth.events` config callbacks\n * (`onConnectionError`, `onSSOAutoRegistration`). Their names and payloads are public.\n */\nexport const AUTH_EVENTS = {\n  LOGIN_FAILURE: 'admin.auth.error',\n  AUTO_REGISTRATION: 'admin.auth.autoRegistration',\n} as const;\n\n/** One fixed value per emit site. */\nexport type LoginFailureReason =\n  | 'login_not_allowed'\n  | 'unexpected_error'\n  | 'invalid_credentials'\n  | 'account_inactive'\n  | 'sso_connection_error'\n  | 'sso_registration_disabled'\n  | 'sso_role_misconfigured';\n\n/**\n * Payload of `admin.auth.error`, also passed to the `onConnectionError` callback.\n * The audit log stores `provider`, `reason` and the account, never `error`.\n */\nexport interface LoginFailureEvent {\n  error: Error;\n  provider: string;\n  reason: LoginFailureReason;\n  /** The account the login was for, when known. */\n  user?: { id: Data.ID; email: string };\n}\n\n/** Payload of `admin.auth.autoRegistration`: the created `admin::user` row, roles populated. */\nexport interface AutoRegistrationEvent {\n  user: { id: Data.ID; email?: string | null; roles?: AdminUserSnapshot['roles'] };\n  provider: string;\n}\n\nexport interface LoginFailureDetails {\n  provider: string;\n  reason: LoginFailureReason;\n}\n\nexport interface AutoRegistrationDetails {\n  provider: string;\n  roles: Data.ID[];\n}\n\ntype AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];\n\n/**\n * Emits without waiting: listeners bound to the event, such as the `onConnectionError`\n * config callback, run before the audit subscriber and must not hold the login.\n */\nexport const emitLoginFailure = (\n  { strapi }: { strapi: AuditStrapi },\n  event: LoginFailureEvent\n): void => {\n  emitAudit({ strapi }, AUTH_EVENTS.LOGIN_FAILURE, {\n    error: event.error,\n    provider: event.provider,\n    reason: event.reason,\n    ...(event.user ? { user: { id: event.user.id, email: event.user.email } } : {}),\n  } satisfies LoginFailureEvent).catch((error) => {\n    strapi.log.error(`Failed to emit ${AUTH_EVENTS.LOGIN_FAILURE}`, { error });\n  });\n};\n\n/**\n * Whether the audit log records a failed login. Not recorded: failures anyone can produce\n * from outside before any verification, a local login for an email with no account and an\n * SSO connection with no valid profile.\n */\nexport const isRecordedLoginFailure = (event: LoginFailureEvent) =>\n  event.reason !== 'sso_connection_error' && !(event.provider === 'local' && !event.user);\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>,\n    options?: {\n      allowUnknownActor?: boolean;\n      alwaysUnknownActor?: boolean;\n      shouldRecord?: (...args: any[]) => boolean;\n    }\n  ): void;\n}\n\nconst toResource = (user: { id: Data.ID; email?: string | null }): AdminUserResource => ({\n  type: 'admin-user',\n  id: user.id,\n  email: user.email as string,\n});\n\nexport const registerAuthAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  auditLogsLifecycle.registerEvent<LoginFailureDetails>(\n    AUTH_EVENTS.LOGIN_FAILURE,\n    (event: LoginFailureEvent) => ({\n      ...(event.user ? { resource: toResource(event.user) } : {}),\n      outcome: 'failure',\n      details: { provider: event.provider, reason: event.reason },\n    }),\n    { alwaysUnknownActor: true, shouldRecord: isRecordedLoginFailure }\n  );\n\n  auditLogsLifecycle.registerEvent<AutoRegistrationDetails>(\n    AUTH_EVENTS.AUTO_REGISTRATION,\n    (event: AutoRegistrationEvent) => ({\n      resource: toResource(event.user),\n      details: { provider: event.provider, roles: toRoleIds(event.user.roles) },\n    })\n  );\n};\n"],"names":["AUTH_EVENTS","LOGIN_FAILURE","AUTO_REGISTRATION","emitLoginFailure","strapi","event","emitAudit","error","provider","reason","user","id","email","catch","log","isRecordedLoginFailure","toResource","type","registerAuthAuditEvents","auditLogsLifecycle","registerEvent","resource","outcome","details","alwaysUnknownActor","shouldRecord","roles","toRoleIds"],"mappings":";;;AAKA;;;UAIaA,WAAAA,GAAc;IACzBC,aAAAA,EAAe,kBAAA;IACfC,iBAAAA,EAAmB;AACrB;AA0CA;;;AAGC,IACM,MAAMC,gBAAAA,GAAmB,CAC9B,EAAEC,MAAM,EAA2B,EACnCC,KAAAA,GAAAA;IAEAC,SAAAA,CAAU;AAAEF,QAAAA;KAAO,EAAGJ,WAAAA,CAAYC,aAAa,EAAE;AAC/CM,QAAAA,KAAAA,EAAOF,MAAME,KAAK;AAClBC,QAAAA,QAAAA,EAAUH,MAAMG,QAAQ;AACxBC,QAAAA,MAAAA,EAAQJ,MAAMI,MAAM;QACpB,GAAIJ,KAAAA,CAAMK,IAAI,GAAG;YAAEA,IAAAA,EAAM;gBAAEC,EAAAA,EAAIN,KAAAA,CAAMK,IAAI,CAACC,EAAE;gBAAEC,KAAAA,EAAOP,KAAAA,CAAMK,IAAI,CAACE;AAAM;AAAE,SAAA,GAAI;KAC9E,CAAA,CAA+BC,KAAK,CAAC,CAACN,KAAAA,GAAAA;QACpCH,MAAAA,CAAOU,GAAG,CAACP,KAAK,CAAC,CAAC,eAAe,EAAEP,WAAAA,CAAYC,aAAa,CAAA,CAAE,EAAE;AAAEM,YAAAA;AAAM,SAAA,CAAA;AAC1E,IAAA,CAAA,CAAA;AACF;AAEA;;;;AAIC,IACM,MAAMQ,sBAAAA,GAAyB,CAACV,KAAAA,GACrCA,KAAAA,CAAMI,MAAM,KAAK,sBAAA,IAA0B,EAAEJ,KAAAA,CAAMG,QAAQ,KAAK,OAAA,IAAW,CAACH,KAAAA,CAAMK,IAAI;AAkBxF,MAAMM,UAAAA,GAAa,CAACN,IAAAA,IAAqE;QACvFO,IAAAA,EAAM,YAAA;AACNN,QAAAA,EAAAA,EAAID,KAAKC,EAAE;AACXC,QAAAA,KAAAA,EAAOF,KAAKE;KACd,CAAA;AAEO,MAAMM,0BAA0B,CAACC,kBAAAA,GAAAA;AACtCA,IAAAA,kBAAAA,CAAmBC,aAAa,CAC9BpB,WAAAA,CAAYC,aAAa,EACzB,CAACI,SAA8B;YAC7B,GAAIA,KAAAA,CAAMK,IAAI,GAAG;gBAAEW,QAAAA,EAAUL,UAAAA,CAAWX,MAAMK,IAAI;AAAE,aAAA,GAAI,EAAE;YAC1DY,OAAAA,EAAS,SAAA;YACTC,OAAAA,EAAS;AAAEf,gBAAAA,QAAAA,EAAUH,MAAMG,QAAQ;AAAEC,gBAAAA,MAAAA,EAAQJ,MAAMI;AAAO;AAC5D,SAAA,CAAA,EACA;QAAEe,kBAAAA,EAAoB,IAAA;QAAMC,YAAAA,EAAcV;AAAuB,KAAA,CAAA;AAGnEI,IAAAA,kBAAAA,CAAmBC,aAAa,CAC9BpB,WAAAA,CAAYE,iBAAiB,EAC7B,CAACG,SAAkC;YACjCgB,QAAAA,EAAUL,UAAAA,CAAWX,MAAMK,IAAI,CAAA;YAC/Ba,OAAAA,EAAS;AAAEf,gBAAAA,QAAAA,EAAUH,MAAMG,QAAQ;AAAEkB,gBAAAA,KAAAA,EAAOC,SAAAA,CAAUtB,KAAAA,CAAMK,IAAI,CAACgB,KAAK;AAAE;SAC1E,CAAA,CAAA;AAEJ;;;;"}

package/dist/server/server/src/audit-logs/tokens.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 
 const AUDITED_EVENTS = {
     TOKEN_CREATE: 'token.create',
@@ -22,7 +22,7 @@ const TOKEN_EDITABLE_FIELDS = [
 /**
  * Sorted, and passed through JSON so undefined fields drop: neither order nor an absent
  * field counts as a change.
- */ const sortRefs = (refs)=>fp.sortBy((ref)=>JSON.stringify(ref), JSON.parse(JSON.stringify(refs)));
+ */ const sortRefs = (refs)=>_.sortBy(JSON.parse(JSON.stringify(refs)), (ref)=>JSON.stringify(ref));
 const getTokenChanges = (previous, next)=>{
     const changes = {};
     for (const field of TOKEN_EDITABLE_FIELDS){
@@ -38,7 +38,7 @@ const getTokenChanges = (previous, next)=>{
     if (previous.permissions !== undefined || next.permissions !== undefined) {
         const before = sortRefs(previous.permissions ?? []);
         const after = sortRefs(next.permissions ?? []);
-        if (!fp.isEqual(before, after)) {
+        if (!_.isEqual(before, after)) {
             changes.permissions = {
                 before,
                 after

package/dist/server/server/src/audit-logs/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sources":["../../../../../server/src/audit-logs/tokens.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash/fp';\nimport type { Data, Modules } from '@strapi/types';\n\nimport type { Permission } from '../../../shared/contracts/shared';\n\nexport const AUDITED_EVENTS = {\n  TOKEN_CREATE: 'token.create',\n  TOKEN_UPDATE: 'token.update',\n  TOKEN_DELETE: 'token.delete',\n  TOKEN_REGENERATE: 'token.regenerate',\n} as const;\n\nexport type TokenKind = 'content-api' | 'admin' | 'transfer';\n\n/**\n * A token permission as recorded in the audit log: action, subject and properties.\n * The row id says nothing to an auditor, and conditions are not part of the token:\n * they are copied from the owner's role and cannot be set per token.\n */\nexport interface AdminPermissionRef {\n  action: string;\n  subject: string | null;\n  properties: Permission['properties'];\n}\n\nexport type PermissionRef = string | AdminPermissionRef;\n\nexport const toAdminPermissionRefs = (\n  permissions: Array<Pick<Permission, 'action' | 'subject' | 'properties'>> | null | undefined\n): AdminPermissionRef[] =>\n  (permissions ?? []).map((permission) => ({\n    action: permission.action,\n    subject: permission.subject ?? null,\n    properties: permission.properties ?? {},\n  }));\n\nexport const toActionRefs = (\n  permissions: Array<string | { action: string }> | null | undefined\n): string[] =>\n  (permissions ?? []).map((permission) =>\n    typeof permission === 'string' ? permission : permission.action\n  );\n\n/**\n * The owner is recorded as an id: the user object carries the email, which has no place\n * in the log.\n */\nexport interface TokenEvent {\n  tokenId: Data.ID;\n  name: string;\n  kind: TokenKind;\n  adminUserOwner?: Data.ID;\n}\n\nexport interface TokenResource extends Modules.AuditLogs.Resource {\n  type: TokenKind;\n}\n\nexport interface CreateDetails {\n  description: string | null;\n  /** Milliseconds. The column is a biginteger and comes back as a string. */\n  lifespan: number | null;\n  expiresAt: string | null;\n  /** content-api only: read-only | full-access | custom */\n  type?: string;\n  /** content-api (custom), transfer and admin tokens */\n  permissions?: PermissionRef[];\n  adminUserOwner?: Data.ID;\n}\n\nexport type CreateEvent = TokenEvent & {\n  description?: string | null;\n  lifespan?: string | number | null;\n  expiresAt?: string | number | Date | null;\n  type?: string;\n  permissions?: PermissionRef[];\n};\n\nexport const TOKEN_EDITABLE_FIELDS = ['name', 'description', 'type'] as const;\n\nexport type TokenChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string | null>;\n  description: Modules.AuditLogs.FieldChange<string | null>;\n  type: Modules.AuditLogs.FieldChange<string | null>;\n  permissions: Modules.AuditLogs.FieldChange<PermissionRef[]>;\n}>;\n\nexport interface UpdateDetails {\n  changes: TokenChanges;\n  adminUserOwner?: Data.ID;\n}\n\nexport type UpdateEvent = TokenEvent & { changes: TokenChanges };\n\nexport interface TokenSnapshot {\n  name?: string | null;\n  description?: string | null;\n  type?: string | null;\n  permissions?: PermissionRef[];\n}\n\n/**\n * Sorted, and passed through JSON so undefined fields drop: neither order nor an absent\n * field counts as a change.\n */\nconst sortRefs = (refs: PermissionRef[]): PermissionRef[] =>\n  sortBy((ref: PermissionRef) => JSON.stringify(ref), JSON.parse(JSON.stringify(refs)));\n\nexport const getTokenChanges = (previous: TokenSnapshot, next: TokenSnapshot): TokenChanges => {\n  const changes: TokenChanges = {};\n\n  for (const field of TOKEN_EDITABLE_FIELDS) {\n    const before = previous[field] ?? null;\n    const after = next[field] ?? null;\n\n    if (before !== after) {\n      changes[field] = { before, after };\n    }\n  }\n\n  if (previous.permissions !== undefined || next.permissions !== undefined) {\n    const before = sortRefs(previous.permissions ?? []);\n    const after = sortRefs(next.permissions ?? []);\n\n    if (!isEqual(before, after)) {\n      changes.permissions = { before, after };\n    }\n  }\n\n  return changes;\n};\n\nconst toIso = (value: string | number | Date | null | undefined): string | null =>\n  value == null ? null : new Date(value).toISOString();\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerTokenAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const tokenResource = (event: TokenEvent): TokenResource => ({\n    type: event.kind,\n    id: event.tokenId,\n    name: event.name,\n  });\n\n  const owner = (event: TokenEvent) =>\n    event.adminUserOwner != null ? { adminUserOwner: event.adminUserOwner } : {};\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.TOKEN_CREATE,\n    (event: CreateEvent) => ({\n      resource: tokenResource(event),\n      details: {\n        description: event.description ?? null,\n        lifespan: event.lifespan == null ? null : Number(event.lifespan),\n        expiresAt: toIso(event.expiresAt),\n        ...(event.type !== undefined && { type: event.type }),\n        ...(event.permissions !== undefined && { permissions: sortRefs(event.permissions) }),\n        ...owner(event),\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.TOKEN_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: tokenResource(event),\n      details: { changes: event.changes, ...owner(event) },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_DELETE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_REGENERATE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","TOKEN_CREATE","TOKEN_UPDATE","TOKEN_DELETE","TOKEN_REGENERATE","toAdminPermissionRefs","permissions","map","permission","action","subject","properties","toActionRefs","TOKEN_EDITABLE_FIELDS","sortRefs","refs","sortBy","ref","JSON","stringify","parse","getTokenChanges","previous","next","changes","field","before","after","undefined","isEqual","toIso","value","Date","toISOString","registerTokenAuditEvents","auditLogsLifecycle","tokenResource","event","type","kind","id","tokenId","name","owner","adminUserOwner","registerEvent","resource","details","description","lifespan","Number","expiresAt"],"mappings":";;;;MAKaA,cAAAA,GAAiB;IAC5BC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,gBAAAA,EAAkB;AACpB;AAiBO,MAAMC,qBAAAA,GAAwB,CACnCC,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAC,EAAGC,GAAG,CAAC,CAACC,cAAgB;AACvCC,YAAAA,MAAAA,EAAQD,WAAWC,MAAM;YACzBC,OAAAA,EAASF,UAAAA,CAAWE,OAAO,IAAI,IAAA;YAC/BC,UAAAA,EAAYH,UAAAA,CAAWG,UAAU,IAAI;AACvC,SAAA,CAAA;AAEK,MAAMC,eAAe,CAC1BN,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAE,EAAEC,GAAG,CAAC,CAACC,aACvB,OAAOA,UAAAA,KAAe,WAAWA,UAAAA,GAAaA,UAAAA,CAAWC,MAAM;MAsCtDI,qBAAAA,GAAwB;AAAC,IAAA,MAAA;AAAQ,IAAA,aAAA;AAAe,IAAA;;AAuB7D;;;AAGC,IACD,MAAMC,QAAAA,GAAW,CAACC,IAAAA,GAChBC,SAAAA,CAAO,CAACC,GAAAA,GAAuBC,IAAAA,CAAKC,SAAS,CAACF,MAAMC,IAAAA,CAAKE,KAAK,CAACF,IAAAA,CAAKC,SAAS,CAACJ,IAAAA,CAAAA,CAAAA,CAAAA;AAEzE,MAAMM,eAAAA,GAAkB,CAACC,QAAAA,EAAyBC,IAAAA,GAAAA;AACvD,IAAA,MAAMC,UAAwB,EAAC;IAE/B,KAAK,MAAMC,SAASZ,qBAAAA,CAAuB;AACzC,QAAA,MAAMa,MAAAA,GAASJ,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;AAClC,QAAA,MAAME,KAAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE7B,QAAA,IAAIC,WAAWC,KAAAA,EAAO;YACpBH,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIL,SAAShB,WAAW,KAAKsB,aAAaL,IAAAA,CAAKjB,WAAW,KAAKsB,SAAAA,EAAW;AACxE,QAAA,MAAMF,MAAAA,GAASZ,QAAAA,CAASQ,QAAAA,CAAShB,WAAW,IAAI,EAAE,CAAA;AAClD,QAAA,MAAMqB,KAAAA,GAAQb,QAAAA,CAASS,IAAAA,CAAKjB,WAAW,IAAI,EAAE,CAAA;QAE7C,IAAI,CAACuB,UAAAA,CAAQH,MAAAA,EAAQC,KAAAA,CAAAA,EAAQ;AAC3BH,YAAAA,OAAAA,CAAQlB,WAAW,GAAG;AAAEoB,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACxC,QAAA;AACF,IAAA;IAEA,OAAOH,OAAAA;AACT;AAEA,MAAMM,KAAAA,GAAQ,CAACC,KAAAA,GACbA,KAAAA,IAAS,OAAO,IAAA,GAAO,IAAIC,IAAAA,CAAKD,KAAAA,CAAAA,CAAOE,WAAW,EAAA;AAa7C,MAAMC,2BAA2B,CAACC,kBAAAA,GAAAA;IACvC,MAAMC,aAAAA,GAAgB,CAACC,KAAAA,IAAsC;AAC3DC,YAAAA,IAAAA,EAAMD,MAAME,IAAI;AAChBC,YAAAA,EAAAA,EAAIH,MAAMI,OAAO;AACjBC,YAAAA,IAAAA,EAAML,MAAMK;SACd,CAAA;AAEA,IAAA,MAAMC,QAAQ,CAACN,KAAAA,GACbA,KAAAA,CAAMO,cAAc,IAAI,IAAA,GAAO;AAAEA,YAAAA,cAAAA,EAAgBP,MAAMO;AAAe,SAAA,GAAI,EAAC;AAE7ET,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeC,YAAY,EAC3B,CAACoC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;gBACPC,WAAAA,EAAaX,KAAAA,CAAMW,WAAW,IAAI,IAAA;AAClCC,gBAAAA,QAAAA,EAAUZ,MAAMY,QAAQ,IAAI,OAAO,IAAA,GAAOC,MAAAA,CAAOb,MAAMY,QAAQ,CAAA;gBAC/DE,SAAAA,EAAWrB,KAAAA,CAAMO,MAAMc,SAAS,CAAA;gBAChC,GAAId,KAAAA,CAAMC,IAAI,KAAKV,SAAAA,IAAa;AAAEU,oBAAAA,IAAAA,EAAMD,MAAMC;iBAAM;gBACpD,GAAID,KAAAA,CAAM/B,WAAW,KAAKsB,SAAAA,IAAa;oBAAEtB,WAAAA,EAAaQ,QAAAA,CAASuB,MAAM/B,WAAW;iBAAG;AACnF,gBAAA,GAAGqC,MAAMN,KAAAA;AACX;SACF,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeE,YAAY,EAC3B,CAACmC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;AAAEvB,gBAAAA,OAAAA,EAASa,MAAMb,OAAO;AAAE,gBAAA,GAAGmB,MAAMN,KAAAA;AAAO;SACrD,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeG,YAAY,EAC3B,CAACkC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAGFT,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeI,gBAAgB,EAC/B,CAACiC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAEJ;;;;;;;;;"}
+{"version":3,"file":"tokens.js","sources":["../../../../../server/src/audit-logs/tokens.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash';\n\nimport type { Data, Modules } from '@strapi/types';\n\nimport type { Permission } from '../../../shared/contracts/shared';\n\nexport const AUDITED_EVENTS = {\n  TOKEN_CREATE: 'token.create',\n  TOKEN_UPDATE: 'token.update',\n  TOKEN_DELETE: 'token.delete',\n  TOKEN_REGENERATE: 'token.regenerate',\n} as const;\n\nexport type TokenKind = 'content-api' | 'admin' | 'transfer';\n\n/**\n * A token permission as recorded in the audit log: action, subject and properties.\n * The row id says nothing to an auditor, and conditions are not part of the token:\n * they are copied from the owner's role and cannot be set per token.\n */\nexport interface AdminPermissionRef {\n  action: string;\n  subject: string | null;\n  properties: Permission['properties'];\n}\n\nexport type PermissionRef = string | AdminPermissionRef;\n\nexport const toAdminPermissionRefs = (\n  permissions: Array<Pick<Permission, 'action' | 'subject' | 'properties'>> | null | undefined\n): AdminPermissionRef[] =>\n  (permissions ?? []).map((permission) => ({\n    action: permission.action,\n    subject: permission.subject ?? null,\n    properties: permission.properties ?? {},\n  }));\n\nexport const toActionRefs = (\n  permissions: Array<string | { action: string }> | null | undefined\n): string[] =>\n  (permissions ?? []).map((permission) =>\n    typeof permission === 'string' ? permission : permission.action\n  );\n\n/**\n * The owner is recorded as an id: the user object carries the email, which has no place\n * in the log.\n */\nexport interface TokenEvent {\n  tokenId: Data.ID;\n  name: string;\n  kind: TokenKind;\n  adminUserOwner?: Data.ID;\n}\n\nexport interface TokenResource extends Modules.AuditLogs.Resource {\n  type: TokenKind;\n}\n\nexport interface CreateDetails {\n  description: string | null;\n  /** Milliseconds. The column is a biginteger and comes back as a string. */\n  lifespan: number | null;\n  expiresAt: string | null;\n  /** content-api only: read-only | full-access | custom */\n  type?: string;\n  /** content-api (custom), transfer and admin tokens */\n  permissions?: PermissionRef[];\n  adminUserOwner?: Data.ID;\n}\n\nexport type CreateEvent = TokenEvent & {\n  description?: string | null;\n  lifespan?: string | number | null;\n  expiresAt?: string | number | Date | null;\n  type?: string;\n  permissions?: PermissionRef[];\n};\n\nexport const TOKEN_EDITABLE_FIELDS = ['name', 'description', 'type'] as const;\n\nexport type TokenChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string | null>;\n  description: Modules.AuditLogs.FieldChange<string | null>;\n  type: Modules.AuditLogs.FieldChange<string | null>;\n  permissions: Modules.AuditLogs.FieldChange<PermissionRef[]>;\n}>;\n\nexport interface UpdateDetails {\n  changes: TokenChanges;\n  adminUserOwner?: Data.ID;\n}\n\nexport type UpdateEvent = TokenEvent & { changes: TokenChanges };\n\nexport interface TokenSnapshot {\n  name?: string | null;\n  description?: string | null;\n  type?: string | null;\n  permissions?: PermissionRef[];\n}\n\n/**\n * Sorted, and passed through JSON so undefined fields drop: neither order nor an absent\n * field counts as a change.\n */\nconst sortRefs = (refs: PermissionRef[]): PermissionRef[] =>\n  sortBy(JSON.parse(JSON.stringify(refs)), (ref: PermissionRef) => JSON.stringify(ref));\n\nexport const getTokenChanges = (previous: TokenSnapshot, next: TokenSnapshot): TokenChanges => {\n  const changes: TokenChanges = {};\n\n  for (const field of TOKEN_EDITABLE_FIELDS) {\n    const before = previous[field] ?? null;\n    const after = next[field] ?? null;\n\n    if (before !== after) {\n      changes[field] = { before, after };\n    }\n  }\n\n  if (previous.permissions !== undefined || next.permissions !== undefined) {\n    const before = sortRefs(previous.permissions ?? []);\n    const after = sortRefs(next.permissions ?? []);\n\n    if (!isEqual(before, after)) {\n      changes.permissions = { before, after };\n    }\n  }\n\n  return changes;\n};\n\nconst toIso = (value: string | number | Date | null | undefined): string | null =>\n  value == null ? null : new Date(value).toISOString();\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerTokenAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const tokenResource = (event: TokenEvent): TokenResource => ({\n    type: event.kind,\n    id: event.tokenId,\n    name: event.name,\n  });\n\n  const owner = (event: TokenEvent) =>\n    event.adminUserOwner != null ? { adminUserOwner: event.adminUserOwner } : {};\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.TOKEN_CREATE,\n    (event: CreateEvent) => ({\n      resource: tokenResource(event),\n      details: {\n        description: event.description ?? null,\n        lifespan: event.lifespan == null ? null : Number(event.lifespan),\n        expiresAt: toIso(event.expiresAt),\n        ...(event.type !== undefined && { type: event.type }),\n        ...(event.permissions !== undefined && { permissions: sortRefs(event.permissions) }),\n        ...owner(event),\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.TOKEN_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: tokenResource(event),\n      details: { changes: event.changes, ...owner(event) },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_DELETE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_REGENERATE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","TOKEN_CREATE","TOKEN_UPDATE","TOKEN_DELETE","TOKEN_REGENERATE","toAdminPermissionRefs","permissions","map","permission","action","subject","properties","toActionRefs","TOKEN_EDITABLE_FIELDS","sortRefs","refs","sortBy","JSON","parse","stringify","ref","getTokenChanges","previous","next","changes","field","before","after","undefined","isEqual","toIso","value","Date","toISOString","registerTokenAuditEvents","auditLogsLifecycle","tokenResource","event","type","kind","id","tokenId","name","owner","adminUserOwner","registerEvent","resource","details","description","lifespan","Number","expiresAt"],"mappings":";;;;MAMaA,cAAAA,GAAiB;IAC5BC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,gBAAAA,EAAkB;AACpB;AAiBO,MAAMC,qBAAAA,GAAwB,CACnCC,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAC,EAAGC,GAAG,CAAC,CAACC,cAAgB;AACvCC,YAAAA,MAAAA,EAAQD,WAAWC,MAAM;YACzBC,OAAAA,EAASF,UAAAA,CAAWE,OAAO,IAAI,IAAA;YAC/BC,UAAAA,EAAYH,UAAAA,CAAWG,UAAU,IAAI;AACvC,SAAA,CAAA;AAEK,MAAMC,eAAe,CAC1BN,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAE,EAAEC,GAAG,CAAC,CAACC,aACvB,OAAOA,UAAAA,KAAe,WAAWA,UAAAA,GAAaA,UAAAA,CAAWC,MAAM;MAsCtDI,qBAAAA,GAAwB;AAAC,IAAA,MAAA;AAAQ,IAAA,aAAA;AAAe,IAAA;;AAuB7D;;;AAGC,IACD,MAAMC,QAAAA,GAAW,CAACC,IAAAA,GAChBC,QAAAA,CAAOC,KAAKC,KAAK,CAACD,IAAAA,CAAKE,SAAS,CAACJ,IAAAA,CAAAA,CAAAA,EAAQ,CAACK,GAAAA,GAAuBH,IAAAA,CAAKE,SAAS,CAACC,GAAAA,CAAAA,CAAAA;AAE3E,MAAMC,eAAAA,GAAkB,CAACC,QAAAA,EAAyBC,IAAAA,GAAAA;AACvD,IAAA,MAAMC,UAAwB,EAAC;IAE/B,KAAK,MAAMC,SAASZ,qBAAAA,CAAuB;AACzC,QAAA,MAAMa,MAAAA,GAASJ,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;AAClC,QAAA,MAAME,KAAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE7B,QAAA,IAAIC,WAAWC,KAAAA,EAAO;YACpBH,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIL,SAAShB,WAAW,KAAKsB,aAAaL,IAAAA,CAAKjB,WAAW,KAAKsB,SAAAA,EAAW;AACxE,QAAA,MAAMF,MAAAA,GAASZ,QAAAA,CAASQ,QAAAA,CAAShB,WAAW,IAAI,EAAE,CAAA;AAClD,QAAA,MAAMqB,KAAAA,GAAQb,QAAAA,CAASS,IAAAA,CAAKjB,WAAW,IAAI,EAAE,CAAA;QAE7C,IAAI,CAACuB,SAAAA,CAAQH,MAAAA,EAAQC,KAAAA,CAAAA,EAAQ;AAC3BH,YAAAA,OAAAA,CAAQlB,WAAW,GAAG;AAAEoB,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACxC,QAAA;AACF,IAAA;IAEA,OAAOH,OAAAA;AACT;AAEA,MAAMM,KAAAA,GAAQ,CAACC,KAAAA,GACbA,KAAAA,IAAS,OAAO,IAAA,GAAO,IAAIC,IAAAA,CAAKD,KAAAA,CAAAA,CAAOE,WAAW,EAAA;AAa7C,MAAMC,2BAA2B,CAACC,kBAAAA,GAAAA;IACvC,MAAMC,aAAAA,GAAgB,CAACC,KAAAA,IAAsC;AAC3DC,YAAAA,IAAAA,EAAMD,MAAME,IAAI;AAChBC,YAAAA,EAAAA,EAAIH,MAAMI,OAAO;AACjBC,YAAAA,IAAAA,EAAML,MAAMK;SACd,CAAA;AAEA,IAAA,MAAMC,QAAQ,CAACN,KAAAA,GACbA,KAAAA,CAAMO,cAAc,IAAI,IAAA,GAAO;AAAEA,YAAAA,cAAAA,EAAgBP,MAAMO;AAAe,SAAA,GAAI,EAAC;AAE7ET,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeC,YAAY,EAC3B,CAACoC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;gBACPC,WAAAA,EAAaX,KAAAA,CAAMW,WAAW,IAAI,IAAA;AAClCC,gBAAAA,QAAAA,EAAUZ,MAAMY,QAAQ,IAAI,OAAO,IAAA,GAAOC,MAAAA,CAAOb,MAAMY,QAAQ,CAAA;gBAC/DE,SAAAA,EAAWrB,KAAAA,CAAMO,MAAMc,SAAS,CAAA;gBAChC,GAAId,KAAAA,CAAMC,IAAI,KAAKV,SAAAA,IAAa;AAAEU,oBAAAA,IAAAA,EAAMD,MAAMC;iBAAM;gBACpD,GAAID,KAAAA,CAAM/B,WAAW,KAAKsB,SAAAA,IAAa;oBAAEtB,WAAAA,EAAaQ,QAAAA,CAASuB,MAAM/B,WAAW;iBAAG;AACnF,gBAAA,GAAGqC,MAAMN,KAAAA;AACX;SACF,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeE,YAAY,EAC3B,CAACmC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;AAAEvB,gBAAAA,OAAAA,EAASa,MAAMb,OAAO;AAAE,gBAAA,GAAGmB,MAAMN,KAAAA;AAAO;SACrD,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeG,YAAY,EAC3B,CAACkC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAGFT,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeI,gBAAgB,EAC/B,CAACiC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAEJ;;;;;;;;;"}

package/dist/server/server/src/audit-logs/tokens.mjs

@@ -1,4 +1,4 @@
-import { isEqual, sortBy } from 'lodash/fp';
+import { isEqual, sortBy } from 'lodash';
 
 const AUDITED_EVENTS = {
     TOKEN_CREATE: 'token.create',
@@ -20,7 +20,7 @@ const TOKEN_EDITABLE_FIELDS = [
 /**
  * Sorted, and passed through JSON so undefined fields drop: neither order nor an absent
  * field counts as a change.
- */ const sortRefs = (refs)=>sortBy((ref)=>JSON.stringify(ref), JSON.parse(JSON.stringify(refs)));
+ */ const sortRefs = (refs)=>sortBy(JSON.parse(JSON.stringify(refs)), (ref)=>JSON.stringify(ref));
 const getTokenChanges = (previous, next)=>{
     const changes = {};
     for (const field of TOKEN_EDITABLE_FIELDS){

package/dist/server/server/src/audit-logs/tokens.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.mjs","sources":["../../../../../server/src/audit-logs/tokens.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash/fp';\nimport type { Data, Modules } from '@strapi/types';\n\nimport type { Permission } from '../../../shared/contracts/shared';\n\nexport const AUDITED_EVENTS = {\n  TOKEN_CREATE: 'token.create',\n  TOKEN_UPDATE: 'token.update',\n  TOKEN_DELETE: 'token.delete',\n  TOKEN_REGENERATE: 'token.regenerate',\n} as const;\n\nexport type TokenKind = 'content-api' | 'admin' | 'transfer';\n\n/**\n * A token permission as recorded in the audit log: action, subject and properties.\n * The row id says nothing to an auditor, and conditions are not part of the token:\n * they are copied from the owner's role and cannot be set per token.\n */\nexport interface AdminPermissionRef {\n  action: string;\n  subject: string | null;\n  properties: Permission['properties'];\n}\n\nexport type PermissionRef = string | AdminPermissionRef;\n\nexport const toAdminPermissionRefs = (\n  permissions: Array<Pick<Permission, 'action' | 'subject' | 'properties'>> | null | undefined\n): AdminPermissionRef[] =>\n  (permissions ?? []).map((permission) => ({\n    action: permission.action,\n    subject: permission.subject ?? null,\n    properties: permission.properties ?? {},\n  }));\n\nexport const toActionRefs = (\n  permissions: Array<string | { action: string }> | null | undefined\n): string[] =>\n  (permissions ?? []).map((permission) =>\n    typeof permission === 'string' ? permission : permission.action\n  );\n\n/**\n * The owner is recorded as an id: the user object carries the email, which has no place\n * in the log.\n */\nexport interface TokenEvent {\n  tokenId: Data.ID;\n  name: string;\n  kind: TokenKind;\n  adminUserOwner?: Data.ID;\n}\n\nexport interface TokenResource extends Modules.AuditLogs.Resource {\n  type: TokenKind;\n}\n\nexport interface CreateDetails {\n  description: string | null;\n  /** Milliseconds. The column is a biginteger and comes back as a string. */\n  lifespan: number | null;\n  expiresAt: string | null;\n  /** content-api only: read-only | full-access | custom */\n  type?: string;\n  /** content-api (custom), transfer and admin tokens */\n  permissions?: PermissionRef[];\n  adminUserOwner?: Data.ID;\n}\n\nexport type CreateEvent = TokenEvent & {\n  description?: string | null;\n  lifespan?: string | number | null;\n  expiresAt?: string | number | Date | null;\n  type?: string;\n  permissions?: PermissionRef[];\n};\n\nexport const TOKEN_EDITABLE_FIELDS = ['name', 'description', 'type'] as const;\n\nexport type TokenChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string | null>;\n  description: Modules.AuditLogs.FieldChange<string | null>;\n  type: Modules.AuditLogs.FieldChange<string | null>;\n  permissions: Modules.AuditLogs.FieldChange<PermissionRef[]>;\n}>;\n\nexport interface UpdateDetails {\n  changes: TokenChanges;\n  adminUserOwner?: Data.ID;\n}\n\nexport type UpdateEvent = TokenEvent & { changes: TokenChanges };\n\nexport interface TokenSnapshot {\n  name?: string | null;\n  description?: string | null;\n  type?: string | null;\n  permissions?: PermissionRef[];\n}\n\n/**\n * Sorted, and passed through JSON so undefined fields drop: neither order nor an absent\n * field counts as a change.\n */\nconst sortRefs = (refs: PermissionRef[]): PermissionRef[] =>\n  sortBy((ref: PermissionRef) => JSON.stringify(ref), JSON.parse(JSON.stringify(refs)));\n\nexport const getTokenChanges = (previous: TokenSnapshot, next: TokenSnapshot): TokenChanges => {\n  const changes: TokenChanges = {};\n\n  for (const field of TOKEN_EDITABLE_FIELDS) {\n    const before = previous[field] ?? null;\n    const after = next[field] ?? null;\n\n    if (before !== after) {\n      changes[field] = { before, after };\n    }\n  }\n\n  if (previous.permissions !== undefined || next.permissions !== undefined) {\n    const before = sortRefs(previous.permissions ?? []);\n    const after = sortRefs(next.permissions ?? []);\n\n    if (!isEqual(before, after)) {\n      changes.permissions = { before, after };\n    }\n  }\n\n  return changes;\n};\n\nconst toIso = (value: string | number | Date | null | undefined): string | null =>\n  value == null ? null : new Date(value).toISOString();\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerTokenAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const tokenResource = (event: TokenEvent): TokenResource => ({\n    type: event.kind,\n    id: event.tokenId,\n    name: event.name,\n  });\n\n  const owner = (event: TokenEvent) =>\n    event.adminUserOwner != null ? { adminUserOwner: event.adminUserOwner } : {};\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.TOKEN_CREATE,\n    (event: CreateEvent) => ({\n      resource: tokenResource(event),\n      details: {\n        description: event.description ?? null,\n        lifespan: event.lifespan == null ? null : Number(event.lifespan),\n        expiresAt: toIso(event.expiresAt),\n        ...(event.type !== undefined && { type: event.type }),\n        ...(event.permissions !== undefined && { permissions: sortRefs(event.permissions) }),\n        ...owner(event),\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.TOKEN_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: tokenResource(event),\n      details: { changes: event.changes, ...owner(event) },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_DELETE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_REGENERATE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","TOKEN_CREATE","TOKEN_UPDATE","TOKEN_DELETE","TOKEN_REGENERATE","toAdminPermissionRefs","permissions","map","permission","action","subject","properties","toActionRefs","TOKEN_EDITABLE_FIELDS","sortRefs","refs","sortBy","ref","JSON","stringify","parse","getTokenChanges","previous","next","changes","field","before","after","undefined","isEqual","toIso","value","Date","toISOString","registerTokenAuditEvents","auditLogsLifecycle","tokenResource","event","type","kind","id","tokenId","name","owner","adminUserOwner","registerEvent","resource","details","description","lifespan","Number","expiresAt"],"mappings":";;MAKaA,cAAAA,GAAiB;IAC5BC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,gBAAAA,EAAkB;AACpB;AAiBO,MAAMC,qBAAAA,GAAwB,CACnCC,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAC,EAAGC,GAAG,CAAC,CAACC,cAAgB;AACvCC,YAAAA,MAAAA,EAAQD,WAAWC,MAAM;YACzBC,OAAAA,EAASF,UAAAA,CAAWE,OAAO,IAAI,IAAA;YAC/BC,UAAAA,EAAYH,UAAAA,CAAWG,UAAU,IAAI;AACvC,SAAA,CAAA;AAEK,MAAMC,eAAe,CAC1BN,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAE,EAAEC,GAAG,CAAC,CAACC,aACvB,OAAOA,UAAAA,KAAe,WAAWA,UAAAA,GAAaA,UAAAA,CAAWC,MAAM;MAsCtDI,qBAAAA,GAAwB;AAAC,IAAA,MAAA;AAAQ,IAAA,aAAA;AAAe,IAAA;;AAuB7D;;;AAGC,IACD,MAAMC,QAAAA,GAAW,CAACC,IAAAA,GAChBC,MAAAA,CAAO,CAACC,GAAAA,GAAuBC,IAAAA,CAAKC,SAAS,CAACF,MAAMC,IAAAA,CAAKE,KAAK,CAACF,IAAAA,CAAKC,SAAS,CAACJ,IAAAA,CAAAA,CAAAA,CAAAA;AAEzE,MAAMM,eAAAA,GAAkB,CAACC,QAAAA,EAAyBC,IAAAA,GAAAA;AACvD,IAAA,MAAMC,UAAwB,EAAC;IAE/B,KAAK,MAAMC,SAASZ,qBAAAA,CAAuB;AACzC,QAAA,MAAMa,MAAAA,GAASJ,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;AAClC,QAAA,MAAME,KAAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE7B,QAAA,IAAIC,WAAWC,KAAAA,EAAO;YACpBH,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIL,SAAShB,WAAW,KAAKsB,aAAaL,IAAAA,CAAKjB,WAAW,KAAKsB,SAAAA,EAAW;AACxE,QAAA,MAAMF,MAAAA,GAASZ,QAAAA,CAASQ,QAAAA,CAAShB,WAAW,IAAI,EAAE,CAAA;AAClD,QAAA,MAAMqB,KAAAA,GAAQb,QAAAA,CAASS,IAAAA,CAAKjB,WAAW,IAAI,EAAE,CAAA;QAE7C,IAAI,CAACuB,OAAAA,CAAQH,MAAAA,EAAQC,KAAAA,CAAAA,EAAQ;AAC3BH,YAAAA,OAAAA,CAAQlB,WAAW,GAAG;AAAEoB,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACxC,QAAA;AACF,IAAA;IAEA,OAAOH,OAAAA;AACT;AAEA,MAAMM,KAAAA,GAAQ,CAACC,KAAAA,GACbA,KAAAA,IAAS,OAAO,IAAA,GAAO,IAAIC,IAAAA,CAAKD,KAAAA,CAAAA,CAAOE,WAAW,EAAA;AAa7C,MAAMC,2BAA2B,CAACC,kBAAAA,GAAAA;IACvC,MAAMC,aAAAA,GAAgB,CAACC,KAAAA,IAAsC;AAC3DC,YAAAA,IAAAA,EAAMD,MAAME,IAAI;AAChBC,YAAAA,EAAAA,EAAIH,MAAMI,OAAO;AACjBC,YAAAA,IAAAA,EAAML,MAAMK;SACd,CAAA;AAEA,IAAA,MAAMC,QAAQ,CAACN,KAAAA,GACbA,KAAAA,CAAMO,cAAc,IAAI,IAAA,GAAO;AAAEA,YAAAA,cAAAA,EAAgBP,MAAMO;AAAe,SAAA,GAAI,EAAC;AAE7ET,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeC,YAAY,EAC3B,CAACoC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;gBACPC,WAAAA,EAAaX,KAAAA,CAAMW,WAAW,IAAI,IAAA;AAClCC,gBAAAA,QAAAA,EAAUZ,MAAMY,QAAQ,IAAI,OAAO,IAAA,GAAOC,MAAAA,CAAOb,MAAMY,QAAQ,CAAA;gBAC/DE,SAAAA,EAAWrB,KAAAA,CAAMO,MAAMc,SAAS,CAAA;gBAChC,GAAId,KAAAA,CAAMC,IAAI,KAAKV,SAAAA,IAAa;AAAEU,oBAAAA,IAAAA,EAAMD,MAAMC;iBAAM;gBACpD,GAAID,KAAAA,CAAM/B,WAAW,KAAKsB,SAAAA,IAAa;oBAAEtB,WAAAA,EAAaQ,QAAAA,CAASuB,MAAM/B,WAAW;iBAAG;AACnF,gBAAA,GAAGqC,MAAMN,KAAAA;AACX;SACF,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeE,YAAY,EAC3B,CAACmC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;AAAEvB,gBAAAA,OAAAA,EAASa,MAAMb,OAAO;AAAE,gBAAA,GAAGmB,MAAMN,KAAAA;AAAO;SACrD,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeG,YAAY,EAC3B,CAACkC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAGFT,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeI,gBAAgB,EAC/B,CAACiC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAEJ;;;;"}
+{"version":3,"file":"tokens.mjs","sources":["../../../../../server/src/audit-logs/tokens.ts"],"sourcesContent":["import { isEqual, sortBy } from 'lodash';\n\nimport type { Data, Modules } from '@strapi/types';\n\nimport type { Permission } from '../../../shared/contracts/shared';\n\nexport const AUDITED_EVENTS = {\n  TOKEN_CREATE: 'token.create',\n  TOKEN_UPDATE: 'token.update',\n  TOKEN_DELETE: 'token.delete',\n  TOKEN_REGENERATE: 'token.regenerate',\n} as const;\n\nexport type TokenKind = 'content-api' | 'admin' | 'transfer';\n\n/**\n * A token permission as recorded in the audit log: action, subject and properties.\n * The row id says nothing to an auditor, and conditions are not part of the token:\n * they are copied from the owner's role and cannot be set per token.\n */\nexport interface AdminPermissionRef {\n  action: string;\n  subject: string | null;\n  properties: Permission['properties'];\n}\n\nexport type PermissionRef = string | AdminPermissionRef;\n\nexport const toAdminPermissionRefs = (\n  permissions: Array<Pick<Permission, 'action' | 'subject' | 'properties'>> | null | undefined\n): AdminPermissionRef[] =>\n  (permissions ?? []).map((permission) => ({\n    action: permission.action,\n    subject: permission.subject ?? null,\n    properties: permission.properties ?? {},\n  }));\n\nexport const toActionRefs = (\n  permissions: Array<string | { action: string }> | null | undefined\n): string[] =>\n  (permissions ?? []).map((permission) =>\n    typeof permission === 'string' ? permission : permission.action\n  );\n\n/**\n * The owner is recorded as an id: the user object carries the email, which has no place\n * in the log.\n */\nexport interface TokenEvent {\n  tokenId: Data.ID;\n  name: string;\n  kind: TokenKind;\n  adminUserOwner?: Data.ID;\n}\n\nexport interface TokenResource extends Modules.AuditLogs.Resource {\n  type: TokenKind;\n}\n\nexport interface CreateDetails {\n  description: string | null;\n  /** Milliseconds. The column is a biginteger and comes back as a string. */\n  lifespan: number | null;\n  expiresAt: string | null;\n  /** content-api only: read-only | full-access | custom */\n  type?: string;\n  /** content-api (custom), transfer and admin tokens */\n  permissions?: PermissionRef[];\n  adminUserOwner?: Data.ID;\n}\n\nexport type CreateEvent = TokenEvent & {\n  description?: string | null;\n  lifespan?: string | number | null;\n  expiresAt?: string | number | Date | null;\n  type?: string;\n  permissions?: PermissionRef[];\n};\n\nexport const TOKEN_EDITABLE_FIELDS = ['name', 'description', 'type'] as const;\n\nexport type TokenChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string | null>;\n  description: Modules.AuditLogs.FieldChange<string | null>;\n  type: Modules.AuditLogs.FieldChange<string | null>;\n  permissions: Modules.AuditLogs.FieldChange<PermissionRef[]>;\n}>;\n\nexport interface UpdateDetails {\n  changes: TokenChanges;\n  adminUserOwner?: Data.ID;\n}\n\nexport type UpdateEvent = TokenEvent & { changes: TokenChanges };\n\nexport interface TokenSnapshot {\n  name?: string | null;\n  description?: string | null;\n  type?: string | null;\n  permissions?: PermissionRef[];\n}\n\n/**\n * Sorted, and passed through JSON so undefined fields drop: neither order nor an absent\n * field counts as a change.\n */\nconst sortRefs = (refs: PermissionRef[]): PermissionRef[] =>\n  sortBy(JSON.parse(JSON.stringify(refs)), (ref: PermissionRef) => JSON.stringify(ref));\n\nexport const getTokenChanges = (previous: TokenSnapshot, next: TokenSnapshot): TokenChanges => {\n  const changes: TokenChanges = {};\n\n  for (const field of TOKEN_EDITABLE_FIELDS) {\n    const before = previous[field] ?? null;\n    const after = next[field] ?? null;\n\n    if (before !== after) {\n      changes[field] = { before, after };\n    }\n  }\n\n  if (previous.permissions !== undefined || next.permissions !== undefined) {\n    const before = sortRefs(previous.permissions ?? []);\n    const after = sortRefs(next.permissions ?? []);\n\n    if (!isEqual(before, after)) {\n      changes.permissions = { before, after };\n    }\n  }\n\n  return changes;\n};\n\nconst toIso = (value: string | number | Date | null | undefined): string | null =>\n  value == null ? null : new Date(value).toISOString();\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerTokenAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const tokenResource = (event: TokenEvent): TokenResource => ({\n    type: event.kind,\n    id: event.tokenId,\n    name: event.name,\n  });\n\n  const owner = (event: TokenEvent) =>\n    event.adminUserOwner != null ? { adminUserOwner: event.adminUserOwner } : {};\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.TOKEN_CREATE,\n    (event: CreateEvent) => ({\n      resource: tokenResource(event),\n      details: {\n        description: event.description ?? null,\n        lifespan: event.lifespan == null ? null : Number(event.lifespan),\n        expiresAt: toIso(event.expiresAt),\n        ...(event.type !== undefined && { type: event.type }),\n        ...(event.permissions !== undefined && { permissions: sortRefs(event.permissions) }),\n        ...owner(event),\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.TOKEN_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: tokenResource(event),\n      details: { changes: event.changes, ...owner(event) },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_DELETE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<{ adminUserOwner: Data.ID } | undefined>(\n    AUDITED_EVENTS.TOKEN_REGENERATE,\n    (event: TokenEvent) => ({\n      resource: tokenResource(event),\n      ...(event.adminUserOwner != null && { details: { adminUserOwner: event.adminUserOwner } }),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","TOKEN_CREATE","TOKEN_UPDATE","TOKEN_DELETE","TOKEN_REGENERATE","toAdminPermissionRefs","permissions","map","permission","action","subject","properties","toActionRefs","TOKEN_EDITABLE_FIELDS","sortRefs","refs","sortBy","JSON","parse","stringify","ref","getTokenChanges","previous","next","changes","field","before","after","undefined","isEqual","toIso","value","Date","toISOString","registerTokenAuditEvents","auditLogsLifecycle","tokenResource","event","type","kind","id","tokenId","name","owner","adminUserOwner","registerEvent","resource","details","description","lifespan","Number","expiresAt"],"mappings":";;MAMaA,cAAAA,GAAiB;IAC5BC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,YAAAA,EAAc,cAAA;IACdC,gBAAAA,EAAkB;AACpB;AAiBO,MAAMC,qBAAAA,GAAwB,CACnCC,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAC,EAAGC,GAAG,CAAC,CAACC,cAAgB;AACvCC,YAAAA,MAAAA,EAAQD,WAAWC,MAAM;YACzBC,OAAAA,EAASF,UAAAA,CAAWE,OAAO,IAAI,IAAA;YAC/BC,UAAAA,EAAYH,UAAAA,CAAWG,UAAU,IAAI;AACvC,SAAA,CAAA;AAEK,MAAMC,eAAe,CAC1BN,WAAAA,GAEA,CAACA,WAAAA,IAAe,EAAE,EAAEC,GAAG,CAAC,CAACC,aACvB,OAAOA,UAAAA,KAAe,WAAWA,UAAAA,GAAaA,UAAAA,CAAWC,MAAM;MAsCtDI,qBAAAA,GAAwB;AAAC,IAAA,MAAA;AAAQ,IAAA,aAAA;AAAe,IAAA;;AAuB7D;;;AAGC,IACD,MAAMC,QAAAA,GAAW,CAACC,IAAAA,GAChBC,MAAAA,CAAOC,KAAKC,KAAK,CAACD,IAAAA,CAAKE,SAAS,CAACJ,IAAAA,CAAAA,CAAAA,EAAQ,CAACK,GAAAA,GAAuBH,IAAAA,CAAKE,SAAS,CAACC,GAAAA,CAAAA,CAAAA;AAE3E,MAAMC,eAAAA,GAAkB,CAACC,QAAAA,EAAyBC,IAAAA,GAAAA;AACvD,IAAA,MAAMC,UAAwB,EAAC;IAE/B,KAAK,MAAMC,SAASZ,qBAAAA,CAAuB;AACzC,QAAA,MAAMa,MAAAA,GAASJ,QAAQ,CAACG,KAAAA,CAAM,IAAI,IAAA;AAClC,QAAA,MAAME,KAAAA,GAAQJ,IAAI,CAACE,KAAAA,CAAM,IAAI,IAAA;AAE7B,QAAA,IAAIC,WAAWC,KAAAA,EAAO;YACpBH,OAAO,CAACC,MAAM,GAAG;AAAEC,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACnC,QAAA;AACF,IAAA;AAEA,IAAA,IAAIL,SAAShB,WAAW,KAAKsB,aAAaL,IAAAA,CAAKjB,WAAW,KAAKsB,SAAAA,EAAW;AACxE,QAAA,MAAMF,MAAAA,GAASZ,QAAAA,CAASQ,QAAAA,CAAShB,WAAW,IAAI,EAAE,CAAA;AAClD,QAAA,MAAMqB,KAAAA,GAAQb,QAAAA,CAASS,IAAAA,CAAKjB,WAAW,IAAI,EAAE,CAAA;QAE7C,IAAI,CAACuB,OAAAA,CAAQH,MAAAA,EAAQC,KAAAA,CAAAA,EAAQ;AAC3BH,YAAAA,OAAAA,CAAQlB,WAAW,GAAG;AAAEoB,gBAAAA,MAAAA;AAAQC,gBAAAA;AAAM,aAAA;AACxC,QAAA;AACF,IAAA;IAEA,OAAOH,OAAAA;AACT;AAEA,MAAMM,KAAAA,GAAQ,CAACC,KAAAA,GACbA,KAAAA,IAAS,OAAO,IAAA,GAAO,IAAIC,IAAAA,CAAKD,KAAAA,CAAAA,CAAOE,WAAW,EAAA;AAa7C,MAAMC,2BAA2B,CAACC,kBAAAA,GAAAA;IACvC,MAAMC,aAAAA,GAAgB,CAACC,KAAAA,IAAsC;AAC3DC,YAAAA,IAAAA,EAAMD,MAAME,IAAI;AAChBC,YAAAA,EAAAA,EAAIH,MAAMI,OAAO;AACjBC,YAAAA,IAAAA,EAAML,MAAMK;SACd,CAAA;AAEA,IAAA,MAAMC,QAAQ,CAACN,KAAAA,GACbA,KAAAA,CAAMO,cAAc,IAAI,IAAA,GAAO;AAAEA,YAAAA,cAAAA,EAAgBP,MAAMO;AAAe,SAAA,GAAI,EAAC;AAE7ET,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeC,YAAY,EAC3B,CAACoC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;gBACPC,WAAAA,EAAaX,KAAAA,CAAMW,WAAW,IAAI,IAAA;AAClCC,gBAAAA,QAAAA,EAAUZ,MAAMY,QAAQ,IAAI,OAAO,IAAA,GAAOC,MAAAA,CAAOb,MAAMY,QAAQ,CAAA;gBAC/DE,SAAAA,EAAWrB,KAAAA,CAAMO,MAAMc,SAAS,CAAA;gBAChC,GAAId,KAAAA,CAAMC,IAAI,KAAKV,SAAAA,IAAa;AAAEU,oBAAAA,IAAAA,EAAMD,MAAMC;iBAAM;gBACpD,GAAID,KAAAA,CAAM/B,WAAW,KAAKsB,SAAAA,IAAa;oBAAEtB,WAAAA,EAAaQ,QAAAA,CAASuB,MAAM/B,WAAW;iBAAG;AACnF,gBAAA,GAAGqC,MAAMN,KAAAA;AACX;SACF,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeE,YAAY,EAC3B,CAACmC,SAAwB;AACvBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxBU,OAAAA,EAAS;AAAEvB,gBAAAA,OAAAA,EAASa,MAAMb,OAAO;AAAE,gBAAA,GAAGmB,MAAMN,KAAAA;AAAO;SACrD,CAAA,CAAA;AAGFF,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeG,YAAY,EAC3B,CAACkC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAGFT,IAAAA,kBAAAA,CAAmBU,aAAa,CAC9B7C,cAAAA,CAAeI,gBAAgB,EAC/B,CAACiC,SAAuB;AACtBS,YAAAA,QAAAA,EAAUV,aAAAA,CAAcC,KAAAA,CAAAA;YACxB,GAAIA,KAAAA,CAAMO,cAAc,IAAI,IAAA,IAAQ;gBAAEG,OAAAA,EAAS;AAAEH,oBAAAA,cAAAA,EAAgBP,MAAMO;AAAe;;SACxF,CAAA,CAAA;AAEJ;;;;"}

package/dist/server/server/src/audit-logs/webhooks.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 
 const AUDITED_EVENTS = {
     WEBHOOK_CREATE: 'webhook.create',
@@ -58,7 +58,7 @@ const getWebhookChanges = (previous, next)=>{
     const changes = {};
     for (const field of AUDITED_FIELDS){
         // The url is compared as stored, so a change to its stripped part is recorded too.
-        const changed = field === 'url' ? previous.url !== next.url : !fp.isEqual(before[field], after[field]);
+        const changed = field === 'url' ? previous.url !== next.url : !_.isEqual(before[field], after[field]);
         if (changed) {
             changes[field] = {
                 before: before[field],

package/dist/server/server/src/audit-logs/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash/fp';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;;;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,WAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;;;;;"}
+{"version":3,"file":"webhooks.js","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;;;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,UAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;;;;;"}

package/dist/server/server/src/audit-logs/webhooks.mjs

@@ -1,4 +1,4 @@
-import { isEqual } from 'lodash/fp';
+import { isEqual } from 'lodash';
 
 const AUDITED_EVENTS = {
     WEBHOOK_CREATE: 'webhook.create',

package/dist/server/server/src/audit-logs/webhooks.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.mjs","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash/fp';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,QAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;"}
+{"version":3,"file":"webhooks.mjs","sources":["../../../../../server/src/audit-logs/webhooks.ts"],"sourcesContent":["import { isEqual } from 'lodash';\nimport type { Modules } from '@strapi/types';\n\nexport const AUDITED_EVENTS = {\n  WEBHOOK_CREATE: 'webhook.create',\n  WEBHOOK_UPDATE: 'webhook.update',\n  WEBHOOK_DELETE: 'webhook.delete',\n} as const;\n\ntype Webhook = Modules.WebhookStore.Webhook;\n\nexport interface WebhookEvent {\n  webhookId: string;\n  name: string;\n}\n\n/**\n * The webhook as it may enter a payload: header names only, sorted. Header values\n * carry `Authorization` tokens and are never recorded, not even on the event hub.\n */\nexport interface AuditedWebhook extends WebhookEvent {\n  url: string;\n  events: string[];\n  headers: string[];\n  isEnabled: boolean;\n}\n\nconst AUDITED_FIELDS = ['name', 'url', 'events', 'isEnabled'] as const;\n\n/**\n * Header values are secrets, so the diff lists names only. `changed`: headers whose\n * value changed.\n */\nexport interface HeaderChanges {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nexport type WebhookChanges = Partial<{\n  name: Modules.AuditLogs.FieldChange<string>;\n  url: Modules.AuditLogs.FieldChange<string>;\n  events: Modules.AuditLogs.FieldChange<string[]>;\n  headers: HeaderChanges;\n  isEnabled: Modules.AuditLogs.FieldChange<boolean>;\n}>;\n\nexport type CreateDetails = Omit<AuditedWebhook, keyof WebhookEvent>;\n\nexport interface UpdateDetails {\n  changes: WebhookChanges;\n}\n\nexport type UpdateEvent = WebhookEvent & UpdateDetails;\n\nconst sortStrings = (values: string[]): string[] => [...values].sort((a, b) => a.localeCompare(b));\n\n/**\n * Scheme and host only. The rest of a webhook URL is often the credential: userinfo,\n * `?token=`, or a path segment (Slack, Netlify, Discord hooks).\n */\nexport const toAuditedUrl = (url: string): string => {\n  try {\n    const { protocol, host } = new URL(url);\n    return `${protocol}//${host}`;\n  } catch {\n    return url.replace(/\\/\\/[^/@]*@/, '//').match(/^[^:]+:\\/\\/[^/?#]*/)?.[0] ?? '';\n  }\n};\n\nexport const toAuditedWebhook = (webhook: Webhook): AuditedWebhook => ({\n  webhookId: webhook.id,\n  name: webhook.name,\n  url: toAuditedUrl(webhook.url),\n  events: sortStrings(webhook.events ?? []),\n  headers: sortStrings(Object.keys(webhook.headers ?? {})),\n  isEnabled: webhook.isEnabled,\n});\n\nconst getHeaderChanges = (\n  previous: Webhook['headers'],\n  next: Webhook['headers']\n): HeaderChanges | undefined => {\n  const before = previous ?? {};\n  const after = next ?? {};\n  const names = sortStrings([...new Set([...Object.keys(before), ...Object.keys(after)])]);\n\n  const has = (headers: Webhook['headers'], name: string) => Object.hasOwn(headers, name);\n\n  const changes: HeaderChanges = {\n    added: names.filter((name) => !has(before, name)),\n    removed: names.filter((name) => !has(after, name)),\n    changed: names.filter(\n      (name) => has(before, name) && has(after, name) && before[name] !== after[name]\n    ),\n  };\n\n  return Object.values(changes).some((list) => list.length > 0) ? changes : undefined;\n};\n\nexport const getWebhookChanges = (previous: Webhook, next: Webhook): WebhookChanges => {\n  const before = toAuditedWebhook(previous);\n  const after = toAuditedWebhook(next);\n  const changes: WebhookChanges = {};\n\n  for (const field of AUDITED_FIELDS) {\n    // The url is compared as stored, so a change to its stripped part is recorded too.\n    const changed =\n      field === 'url' ? previous.url !== next.url : !isEqual(before[field], after[field]);\n\n    if (changed) {\n      (changes as Record<string, unknown>)[field] = { before: before[field], after: after[field] };\n    }\n  }\n\n  const headers = getHeaderChanges(previous.headers, next.headers);\n\n  if (headers) {\n    changes.headers = headers;\n  }\n\n  return changes;\n};\n\n/**\n * The part of the audit-logs lifecycle service used here.\n * The full service type lives in the Admin EE package.\n */\ninterface AuditLogsLifecycle {\n  registerEvent<TDetails>(\n    name: string,\n    transform: Modules.AuditLogs.EventTransformer<TDetails>\n  ): void;\n}\n\nexport const registerWebhookAuditEvents = (auditLogsLifecycle: AuditLogsLifecycle) => {\n  const webhookResource = (event: WebhookEvent): Modules.AuditLogs.Resource => ({\n    type: 'webhook',\n    id: event.webhookId,\n    name: event.name,\n  });\n\n  auditLogsLifecycle.registerEvent<CreateDetails>(\n    AUDITED_EVENTS.WEBHOOK_CREATE,\n    (event: AuditedWebhook) => ({\n      resource: webhookResource(event),\n      details: {\n        url: event.url,\n        events: event.events,\n        headers: event.headers,\n        isEnabled: event.isEnabled,\n      },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<UpdateDetails>(\n    AUDITED_EVENTS.WEBHOOK_UPDATE,\n    (event: UpdateEvent) => ({\n      resource: webhookResource(event),\n      details: { changes: event.changes },\n    })\n  );\n\n  auditLogsLifecycle.registerEvent<undefined>(\n    AUDITED_EVENTS.WEBHOOK_DELETE,\n    (event: WebhookEvent) => ({\n      resource: webhookResource(event),\n    })\n  );\n};\n"],"names":["AUDITED_EVENTS","WEBHOOK_CREATE","WEBHOOK_UPDATE","WEBHOOK_DELETE","AUDITED_FIELDS","sortStrings","values","sort","a","b","localeCompare","toAuditedUrl","url","protocol","host","URL","replace","match","toAuditedWebhook","webhook","webhookId","id","name","events","headers","Object","keys","isEnabled","getHeaderChanges","previous","next","before","after","names","Set","has","hasOwn","changes","added","filter","removed","changed","some","list","length","undefined","getWebhookChanges","field","isEqual","registerWebhookAuditEvents","auditLogsLifecycle","webhookResource","event","type","registerEvent","resource","details"],"mappings":";;MAGaA,cAAAA,GAAiB;IAC5BC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB,gBAAA;IAChBC,cAAAA,EAAgB;AAClB;AAoBA,MAAMC,cAAAA,GAAiB;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAY,CAAA;AA4B7D,MAAMC,WAAAA,GAAc,CAACC,MAAAA,GAA+B;AAAIA,QAAAA,GAAAA;AAAO,KAAA,CAACC,IAAI,CAAC,CAACC,GAAGC,CAAAA,GAAMD,CAAAA,CAAEE,aAAa,CAACD,CAAAA,CAAAA,CAAAA;AAE/F;;;IAIO,MAAME,YAAAA,GAAe,CAACC,GAAAA,GAAAA;IAC3B,IAAI;AACF,QAAA,MAAM,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAG,IAAIC,GAAAA,CAAIH,GAAAA,CAAAA;AACnC,QAAA,OAAO,CAAA,EAAGC,QAAAA,CAAS,EAAE,EAAEC,IAAAA,CAAAA,CAAM;AAC/B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOF,GAAAA,CAAII,OAAO,CAAC,aAAA,EAAe,IAAA,CAAA,CAAMC,KAAK,CAAC,oBAAA,CAAA,GAAwB,CAAA,CAAE,IAAI,EAAA;AAC9E,IAAA;AACF;AAEO,MAAMC,gBAAAA,GAAmB,CAACC,OAAAA,IAAsC;AACrEC,QAAAA,SAAAA,EAAWD,QAAQE,EAAE;AACrBC,QAAAA,IAAAA,EAAMH,QAAQG,IAAI;QAClBV,GAAAA,EAAKD,YAAAA,CAAaQ,QAAQP,GAAG,CAAA;AAC7BW,QAAAA,MAAAA,EAAQlB,WAAAA,CAAYc,OAAAA,CAAQI,MAAM,IAAI,EAAE,CAAA;AACxCC,QAAAA,OAAAA,EAASnB,YAAYoB,MAAAA,CAAOC,IAAI,CAACP,OAAAA,CAAQK,OAAO,IAAI,EAAC,CAAA,CAAA;AACrDG,QAAAA,SAAAA,EAAWR,QAAQQ;AACrB,KAAA;AAEA,MAAMC,gBAAAA,GAAmB,CACvBC,QAAAA,EACAC,IAAAA,GAAAA;IAEA,MAAMC,MAAAA,GAASF,YAAY,EAAC;IAC5B,MAAMG,KAAAA,GAAQF,QAAQ,EAAC;AACvB,IAAA,MAAMG,QAAQ5B,WAAAA,CAAY;AAAI,QAAA,GAAA,IAAI6B,GAAAA,CAAI;AAAIT,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACK,MAAAA,CAAAA;AAAYN,YAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACM,KAAAA;AAAO,SAAA;AAAE,KAAA,CAAA;AAEvF,IAAA,MAAMG,MAAM,CAACX,OAAAA,EAA6BF,OAAiBG,MAAAA,CAAOW,MAAM,CAACZ,OAAAA,EAASF,IAAAA,CAAAA;AAElF,IAAA,MAAMe,OAAAA,GAAyB;AAC7BC,QAAAA,KAAAA,EAAOL,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,CAAAA;AAC3CkB,QAAAA,OAAAA,EAASP,MAAMM,MAAM,CAAC,CAACjB,IAAAA,GAAS,CAACa,IAAIH,KAAAA,EAAOV,IAAAA,CAAAA,CAAAA;AAC5CmB,QAAAA,OAAAA,EAASR,MAAMM,MAAM,CACnB,CAACjB,IAAAA,GAASa,IAAIJ,MAAAA,EAAQT,IAAAA,CAAAA,IAASa,GAAAA,CAAIH,KAAAA,EAAOV,SAASS,MAAM,CAACT,KAAK,KAAKU,KAAK,CAACV,IAAAA,CAAK;AAEnF,KAAA;AAEA,IAAA,OAAOG,MAAAA,CAAOnB,MAAM,CAAC+B,OAAAA,CAAAA,CAASK,IAAI,CAAC,CAACC,IAAAA,GAASA,IAAAA,CAAKC,MAAM,GAAG,CAAA,CAAA,GAAKP,OAAAA,GAAUQ,SAAAA;AAC5E,CAAA;AAEO,MAAMC,iBAAAA,GAAoB,CAACjB,QAAAA,EAAmBC,IAAAA,GAAAA;AACnD,IAAA,MAAMC,SAASb,gBAAAA,CAAiBW,QAAAA,CAAAA;AAChC,IAAA,MAAMG,QAAQd,gBAAAA,CAAiBY,IAAAA,CAAAA;AAC/B,IAAA,MAAMO,UAA0B,EAAC;IAEjC,KAAK,MAAMU,SAAS3C,cAAAA,CAAgB;;AAElC,QAAA,MAAMqC,UACJM,KAAAA,KAAU,KAAA,GAAQlB,QAAAA,CAASjB,GAAG,KAAKkB,IAAAA,CAAKlB,GAAG,GAAG,CAACoC,QAAQjB,MAAM,CAACgB,MAAM,EAAEf,KAAK,CAACe,KAAAA,CAAM,CAAA;AAEpF,QAAA,IAAIN,OAAAA,EAAS;YACVJ,OAAmC,CAACU,MAAM,GAAG;gBAAEhB,MAAAA,EAAQA,MAAM,CAACgB,KAAAA,CAAM;gBAAEf,KAAAA,EAAOA,KAAK,CAACe,KAAAA;AAAO,aAAA;AAC7F,QAAA;AACF,IAAA;AAEA,IAAA,MAAMvB,UAAUI,gBAAAA,CAAiBC,QAAAA,CAASL,OAAO,EAAEM,KAAKN,OAAO,CAAA;AAE/D,IAAA,IAAIA,OAAAA,EAAS;AACXa,QAAAA,OAAAA,CAAQb,OAAO,GAAGA,OAAAA;AACpB,IAAA;IAEA,OAAOa,OAAAA;AACT;AAaO,MAAMY,6BAA6B,CAACC,kBAAAA,GAAAA;IACzC,MAAMC,eAAAA,GAAkB,CAACC,KAAAA,IAAqD;YAC5EC,IAAAA,EAAM,SAAA;AACNhC,YAAAA,EAAAA,EAAI+B,MAAMhC,SAAS;AACnBE,YAAAA,IAAAA,EAAM8B,MAAM9B;SACd,CAAA;AAEA4B,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeC,cAAc,EAC7B,CAACmD,SAA2B;AAC1BG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AACP5C,gBAAAA,GAAAA,EAAKwC,MAAMxC,GAAG;AACdW,gBAAAA,MAAAA,EAAQ6B,MAAM7B,MAAM;AACpBC,gBAAAA,OAAAA,EAAS4B,MAAM5B,OAAO;AACtBG,gBAAAA,SAAAA,EAAWyB,MAAMzB;AACnB;SACF,CAAA,CAAA;AAGFuB,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeE,cAAc,EAC7B,CAACkD,SAAwB;AACvBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA,CAAAA;YAC1BI,OAAAA,EAAS;AAAEnB,gBAAAA,OAAAA,EAASe,MAAMf;AAAQ;SACpC,CAAA,CAAA;AAGFa,IAAAA,kBAAAA,CAAmBI,aAAa,CAC9BtD,cAAAA,CAAeG,cAAc,EAC7B,CAACiD,SAAyB;AACxBG,YAAAA,QAAAA,EAAUJ,eAAAA,CAAgBC,KAAAA;SAC5B,CAAA,CAAA;AAEJ;;;;"}

package/dist/server/server/src/bootstrap.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var utils = require('@strapi/utils');
 var index = require('./utils/index.js');
 var token = require('./services/token.js');
@@ -77,7 +77,7 @@ const syncAuthSettings = async ()=>{
     const adminAuthSettings = await adminStore.get({
         key: 'auth'
     });
-    const newAuthSettings = fp.merge(defaultAdminAuthSettings, adminAuthSettings);
+    const newAuthSettings = _.merge({}, defaultAdminAuthSettings, adminAuthSettings);
     const roleExists = await index.getService('role').exists({
         id: newAuthSettings.providers.defaultRole
     });
@@ -92,8 +92,10 @@ const syncAuthSettings = async ()=>{
 };
 const syncAPITokensPermissions = async ()=>{
     const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
-    const permissionsInDB = await utils.async.pipe(strapi.db.query('admin::api-token-permission').findMany, fp.map('action'))();
-    const unknownPermissions = fp.uniq(fp.difference(permissionsInDB, validPermissions));
+    const permissionsInDB = await utils.async.pipe(strapi.db.query('admin::api-token-permission').findMany, (permissions)=>_.map(permissions, 'action'))();
+    const unknownPermissions = [
+        ...new Set(_.difference(permissionsInDB, validPermissions))
+    ];
     if (unknownPermissions.length > 0) {
         await strapi.db.query('admin::api-token-permission').deleteMany({
             where: {

package/dist/server/server/src/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","uniq","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;;;AAmBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,iBAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,qBAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,iBAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,wBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,gBAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,gBAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,iBAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,gBAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,SAAMvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,gBAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAAA,GAAkB,MAAMC,WAAAA,CAAMC,IAAI,CACtCnD,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,6BAAA,CAAA,CAA+BC,QAAQ,EACvDI,MAAAA,CAAI,QAAA,CAAA,CAAA,EAAA;IAGN,MAAM0B,kBAAAA,GAAqBC,OAAAA,CAAKC,aAAAA,CAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,qBAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,8CAAAA;IAC5C,MAAMC,wBAAAA,GACJH,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,wCAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,2CAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,+CAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,yCAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,gBAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,gBAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,gBAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,gBAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,gBAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}
+{"version":3,"file":"bootstrap.js","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { map, merge, difference } from 'lodash';\n\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge({}, defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    (permissions) => map(permissions, 'action')\n  )();\n\n  const unknownPermissions = [...new Set(difference(permissionsInDB, validPermissions))];\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","Set","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;;;AAoBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,iBAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,qBAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,iBAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,wBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,gBAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,gBAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,iBAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,gBAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC7D,IAAA,MAAMC,eAAAA,GAAkBC,OAAAA,CAAM,EAAC,EAAGvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAE5D,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,gBAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,kBAAkB,MAAMC,WAAAA,CAAMC,IAAI,CACtCnD,OAAOC,EAAE,CAACoB,KAAK,CAAC,+BAA+BC,QAAQ,EACvD,CAACwB,WAAAA,GAAgBpB,MAAIoB,WAAAA,EAAa,QAAA,CAAA,CAAA,EAAA;AAGpC,IAAA,MAAMM,kBAAAA,GAAqB;WAAI,IAAIC,GAAAA,CAAIC,aAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA;AAAmB,KAAA;IAEtF,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,qBAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,8CAAAA;IAC5C,MAAMC,wBAAAA,GACJH,wBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,wCAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,2CAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,+CAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,yCAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,gBAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,gBAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,gBAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,gBAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,gBAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,gBAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,gBAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}

package/dist/server/server/src/bootstrap.mjs

@@ -1,4 +1,4 @@
-import { merge, map, uniq, difference } from 'lodash/fp';
+import { merge, map, difference } from 'lodash';
 import { async } from '@strapi/utils';
 import { getService } from './utils/index.mjs';
 import { getTokenOptions, expiresInToSeconds, hasUserConfiguredAuthOptionsExpiresIn } from './services/token.mjs';
@@ -75,7 +75,7 @@ const syncAuthSettings = async ()=>{
     const adminAuthSettings = await adminStore.get({
         key: 'auth'
     });
-    const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);
+    const newAuthSettings = merge({}, defaultAdminAuthSettings, adminAuthSettings);
     const roleExists = await getService('role').exists({
         id: newAuthSettings.providers.defaultRole
     });
@@ -90,8 +90,10 @@ const syncAuthSettings = async ()=>{
 };
 const syncAPITokensPermissions = async ()=>{
     const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
-    const permissionsInDB = await async.pipe(strapi.db.query('admin::api-token-permission').findMany, map('action'))();
-    const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));
+    const permissionsInDB = await async.pipe(strapi.db.query('admin::api-token-permission').findMany, (permissions)=>map(permissions, 'action'))();
+    const unknownPermissions = [
+        ...new Set(difference(permissionsInDB, validPermissions))
+    ];
     if (unknownPermissions.length > 0) {
         await strapi.db.query('admin::api-token-permission').deleteMany({
             where: {

package/dist/server/server/src/bootstrap.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.mjs","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { merge, map, difference, uniq } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge(defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    map('action')\n  )();\n\n  const unknownPermissions = uniq(difference(permissionsInDB, validPermissions));\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","uniq","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;AAmBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,WAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,aAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,WAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,gBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,UAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,UAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,WAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,UAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;IAC7D,MAAMC,eAAAA,GAAkBC,MAAMvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAExD,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,UAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,eAAAA,GAAkB,MAAMC,KAAAA,CAAMC,IAAI,CACtCnD,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,6BAAA,CAAA,CAA+BC,QAAQ,EACvDI,GAAAA,CAAI,QAAA,CAAA,CAAA,EAAA;IAGN,MAAM0B,kBAAAA,GAAqBC,IAAAA,CAAKC,UAAAA,CAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA,CAAAA;IAE5D,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,eAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,kCAAAA;IAC5C,MAAMC,wBAAAA,GACJH,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,4BAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,qCAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,mCAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,6BAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,UAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,UAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,UAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,UAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,UAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}
+{"version":3,"file":"bootstrap.mjs","sources":["../../../../server/src/bootstrap.ts"],"sourcesContent":["import { map, merge, difference } from 'lodash';\n\nimport type { Core } from '@strapi/types';\nimport { async } from '@strapi/utils';\nimport { getService } from './utils';\nimport {\n  getTokenOptions,\n  expiresInToSeconds,\n  hasUserConfiguredAuthOptionsExpiresIn,\n} from './services/token';\nimport adminActions from './config/admin-actions';\nimport adminConditions from './config/admin-conditions';\nimport constants from './services/constants';\nimport {\n  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN,\n  DEFAULT_MAX_SESSION_LIFESPAN,\n  DEFAULT_IDLE_SESSION_LIFESPAN,\n} from '../../shared/utils/session-auth';\n\nconst defaultAdminAuthSettings = {\n  providers: {\n    autoRegister: false,\n    defaultRole: null,\n    ssoLockedRoles: null,\n  },\n};\n\nconst registerPermissionActions = async () => {\n  await getService('permission').actionProvider.registerMany(adminActions.actions);\n};\n\nconst registerAdminConditions = async () => {\n  await getService('permission').conditionProvider.registerMany(adminConditions.conditions);\n};\n\nconst registerModelHooks = () => {\n  const { sendDidChangeInterfaceLanguage } = getService('metrics');\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::user'],\n    afterCreate: sendDidChangeInterfaceLanguage,\n    afterDelete: sendDidChangeInterfaceLanguage,\n    async beforeDelete(event) {\n      // Delete all admin API tokens owned by this user before the user row is removed\n      await getService('api-token-admin').deleteTokensForUser(event.params.where.id);\n    },\n    async afterUpdate(event) {\n      if (event.params.data?.preferedLanguage) {\n        sendDidChangeInterfaceLanguage();\n      }\n      if (event.params.data?.roles !== undefined) {\n        // We re-sync token permissions for all owner users with their role when the user is updated\n        await getService('api-token-admin').syncPermissionsForUser(event.result.id);\n      }\n    },\n  });\n\n  strapi.db.lifecycles.subscribe({\n    models: ['admin::role'],\n    // We re-sync token permissions for all owner users with this role when the role is deleted\n    async beforeDelete(event) {\n      const users = await strapi.db.query('admin::user').findMany({\n        where: { roles: { id: event.params.where.id } },\n        select: ['id'],\n      });\n      event.state.affectedUserIds = users.map((u: { id: unknown }) => u.id);\n    },\n    async afterDelete(event) {\n      for (const userId of (event.state.affectedUserIds as unknown[]) ?? []) {\n        await getService('api-token-admin').syncPermissionsForUser(userId as string | number);\n      }\n    },\n  });\n};\n\nconst syncAuthSettings = async () => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n  const adminAuthSettings = await adminStore.get({ key: 'auth' });\n  const newAuthSettings = merge({}, defaultAdminAuthSettings, adminAuthSettings);\n\n  const roleExists = await getService('role').exists({\n    id: newAuthSettings.providers.defaultRole,\n  });\n\n  // Reset the default SSO role if it has been deleted manually\n  if (!roleExists) {\n    newAuthSettings.providers.defaultRole = null;\n  }\n\n  await adminStore.set({ key: 'auth', value: newAuthSettings });\n};\n\nconst syncAPITokensPermissions = async () => {\n  const validPermissions = strapi.contentAPI.permissions.providers.action.keys();\n  const permissionsInDB = await async.pipe(\n    strapi.db.query('admin::api-token-permission').findMany,\n    (permissions) => map(permissions, 'action')\n  )();\n\n  const unknownPermissions = [...new Set(difference(permissionsInDB, validPermissions))];\n\n  if (unknownPermissions.length > 0) {\n    await strapi.db\n      .query('admin::api-token-permission')\n      .deleteMany({ where: { action: { $in: unknownPermissions } } });\n  }\n};\n\n/**\n * Ensures the creation of default API tokens during the app creation.\n *\n * Checks the database for existing users and API tokens:\n * - If there are no users and no API tokens, it creates two default API tokens:\n *   1. A \"Read Only\" API token with permissions for accessing resources.\n *   2. A \"Full Access\" API token with permissions for accessing and modifying resources.\n *\n * @sideEffects Creates new API tokens in the database if conditions are met.\n */\n\nconst createDefaultAPITokensIfNeeded = async () => {\n  const userService = getService('user');\n  const apiTokenService = getService('api-token-content-api');\n\n  const usersCount = await userService.count();\n  const apiTokenCount = await apiTokenService.countAll();\n\n  if (usersCount === 0 && apiTokenCount === 0) {\n    for (const token of constants.DEFAULT_API_TOKENS) {\n      await apiTokenService.create(token);\n    }\n  }\n};\n\nexport default async ({ strapi }: { strapi: Core.Strapi }) => {\n  // Get the merged token options (includes defaults merged with user config)\n  const { options } = getTokenOptions();\n  const legacyMaxRefreshFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;\n  const legacyMaxSessionFallback =\n    expiresInToSeconds(options?.expiresIn) ?? DEFAULT_MAX_SESSION_LIFESPAN;\n\n  // Warn only when the user set legacy admin.auth.options.expiresIn. Merged JWT options always\n  // include the default expiresIn ('30d'), so reading merged options alone is a false positive.\n  const hasLegacyExpires = hasUserConfiguredAuthOptionsExpiresIn(\n    strapi.config.get('admin.auth.options')\n  );\n  const hasNewMaxRefresh = strapi.config.get('admin.auth.sessions.maxRefreshTokenLifespan') != null;\n  const hasNewMaxSession = strapi.config.get('admin.auth.sessions.maxSessionLifespan') != null;\n\n  if (hasLegacyExpires && (!hasNewMaxRefresh || !hasNewMaxSession)) {\n    strapi.log.warn(\n      'admin.auth.options.expiresIn is deprecated and will be removed in Strapi 6. Please configure admin.auth.sessions.maxRefreshTokenLifespan and admin.auth.sessions.maxSessionLifespan.'\n    );\n  }\n\n  strapi.sessionManager.defineOrigin('admin', {\n    jwtSecret: strapi.config.get('admin.auth.secret'),\n    accessTokenLifespan: strapi.config.get('admin.auth.sessions.accessTokenLifespan', 30 * 60),\n    maxRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.maxRefreshTokenLifespan',\n      legacyMaxRefreshFallback\n    ),\n    idleRefreshTokenLifespan: strapi.config.get(\n      'admin.auth.sessions.idleRefreshTokenLifespan',\n      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n    ),\n    maxSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.maxSessionLifespan',\n      legacyMaxSessionFallback\n    ),\n    idleSessionLifespan: strapi.config.get(\n      'admin.auth.sessions.idleSessionLifespan',\n      DEFAULT_IDLE_SESSION_LIFESPAN\n    ),\n    algorithm: options?.algorithm,\n    // Pass through all JWT options (includes privateKey, publicKey, and any other options)\n    jwtOptions: options,\n  });\n\n  const isProduction = process.env.NODE_ENV === 'production';\n  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');\n  if (isProduction && adminCookieSecure === false) {\n    strapi.log.warn(\n      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'\n    );\n  }\n\n  await registerAdminConditions();\n  await registerPermissionActions();\n  registerModelHooks();\n\n  const permissionService = getService('permission');\n  const userService = getService('user');\n  const roleService = getService('role');\n  const apiTokenService = getService('api-token-content-api');\n  const transferService = getService('transfer');\n  const tokenService = getService('token');\n\n  await roleService.createRolesIfNoneExist();\n  await roleService.resetSuperAdminPermissions();\n  await roleService.displayWarningIfNoSuperAdmin();\n\n  await permissionService.cleanPermissionsInDatabase();\n\n  await userService.displayWarningIfUsersDontHaveRole();\n\n  await syncAuthSettings();\n  await syncAPITokensPermissions();\n\n  await getService('metrics').sendUpdateProjectInformation(strapi);\n  getService('metrics').startCron(strapi);\n\n  apiTokenService.checkSaltIsDefined();\n  transferService.token.checkSaltIsDefined();\n  tokenService.checkSecretIsDefined();\n\n  await createDefaultAPITokensIfNeeded();\n};\n"],"names":["defaultAdminAuthSettings","providers","autoRegister","defaultRole","ssoLockedRoles","registerPermissionActions","getService","actionProvider","registerMany","adminActions","actions","registerAdminConditions","conditionProvider","adminConditions","conditions","registerModelHooks","sendDidChangeInterfaceLanguage","strapi","db","lifecycles","subscribe","models","afterCreate","afterDelete","beforeDelete","event","deleteTokensForUser","params","where","id","afterUpdate","data","preferedLanguage","roles","undefined","syncPermissionsForUser","result","users","query","findMany","select","state","affectedUserIds","map","u","userId","syncAuthSettings","adminStore","store","type","name","adminAuthSettings","get","key","newAuthSettings","merge","roleExists","exists","set","value","syncAPITokensPermissions","validPermissions","contentAPI","permissions","action","keys","permissionsInDB","async","pipe","unknownPermissions","Set","difference","length","deleteMany","$in","createDefaultAPITokensIfNeeded","userService","apiTokenService","usersCount","count","apiTokenCount","countAll","token","constants","DEFAULT_API_TOKENS","create","options","getTokenOptions","legacyMaxRefreshFallback","expiresInToSeconds","expiresIn","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","legacyMaxSessionFallback","DEFAULT_MAX_SESSION_LIFESPAN","hasLegacyExpires","hasUserConfiguredAuthOptionsExpiresIn","config","hasNewMaxRefresh","hasNewMaxSession","log","warn","sessionManager","defineOrigin","jwtSecret","accessTokenLifespan","maxRefreshTokenLifespan","idleRefreshTokenLifespan","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","maxSessionLifespan","idleSessionLifespan","DEFAULT_IDLE_SESSION_LIFESPAN","algorithm","jwtOptions","isProduction","process","env","NODE_ENV","adminCookieSecure","permissionService","roleService","transferService","tokenService","createRolesIfNoneExist","resetSuperAdminPermissions","displayWarningIfNoSuperAdmin","cleanPermissionsInDatabase","displayWarningIfUsersDontHaveRole","sendUpdateProjectInformation","startCron","checkSaltIsDefined","checkSecretIsDefined"],"mappings":";;;;;;;;;AAoBA,MAAMA,wBAAAA,GAA2B;IAC/BC,SAAAA,EAAW;QACTC,YAAAA,EAAc,KAAA;QACdC,WAAAA,EAAa,IAAA;QACbC,cAAAA,EAAgB;AAClB;AACF,CAAA;AAEA,MAAMC,yBAAAA,GAA4B,UAAA;AAChC,IAAA,MAAMC,WAAW,YAAA,CAAA,CAAcC,cAAc,CAACC,YAAY,CAACC,aAAaC,OAAO,CAAA;AACjF,CAAA;AAEA,MAAMC,uBAAAA,GAA0B,UAAA;AAC9B,IAAA,MAAML,WAAW,YAAA,CAAA,CAAcM,iBAAiB,CAACJ,YAAY,CAACK,gBAAgBC,UAAU,CAAA;AAC1F,CAAA;AAEA,MAAMC,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAM,EAAEC,8BAA8B,EAAE,GAAGV,UAAAA,CAAW,SAAA,CAAA;AAEtDW,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;QACvBC,WAAAA,EAAaN,8BAAAA;QACbO,WAAAA,EAAaP,8BAAAA;AACb,QAAA,MAAMQ,cAAaC,KAAK,EAAA;;YAEtB,MAAMnB,UAAAA,CAAW,mBAAmBoB,mBAAmB,CAACD,MAAME,MAAM,CAACC,KAAK,CAACC,EAAE,CAAA;AAC/E,QAAA,CAAA;AACA,QAAA,MAAMC,aAAYL,KAAK,EAAA;AACrB,YAAA,IAAIA,KAAAA,CAAME,MAAM,CAACI,IAAI,EAAEC,gBAAAA,EAAkB;AACvChB,gBAAAA,8BAAAA,EAAAA;AACF,YAAA;AACA,YAAA,IAAIS,MAAME,MAAM,CAACI,IAAI,EAAEE,UAAUC,SAAAA,EAAW;;AAE1C,gBAAA,MAAM5B,WAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACV,KAAAA,CAAMW,MAAM,CAACP,EAAE,CAAA;AAC5E,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AAEAZ,IAAAA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAAC;QAC7BC,MAAAA,EAAQ;AAAC,YAAA;AAAc,SAAA;;AAEvB,QAAA,MAAMG,cAAaC,KAAK,EAAA;YACtB,MAAMY,KAAAA,GAAQ,MAAMpB,MAAAA,CAAOC,EAAE,CAACoB,KAAK,CAAC,aAAA,CAAA,CAAeC,QAAQ,CAAC;gBAC1DX,KAAAA,EAAO;oBAAEK,KAAAA,EAAO;AAAEJ,wBAAAA,EAAAA,EAAIJ,KAAAA,CAAME,MAAM,CAACC,KAAK,CAACC;AAAG;AAAE,iBAAA;gBAC9CW,MAAAA,EAAQ;AAAC,oBAAA;AAAK;AAChB,aAAA,CAAA;YACAf,KAAAA,CAAMgB,KAAK,CAACC,eAAe,GAAGL,KAAAA,CAAMM,GAAG,CAAC,CAACC,CAAAA,GAAuBA,CAAAA,CAAEf,EAAE,CAAA;AACtE,QAAA,CAAA;AACA,QAAA,MAAMN,aAAYE,KAAK,EAAA;YACrB,KAAK,MAAMoB,UAAU,KAACpB,CAAMgB,KAAK,CAACC,eAAe,IAAkB,EAAE,CAAE;gBACrE,MAAMpC,UAAAA,CAAW,iBAAA,CAAA,CAAmB6B,sBAAsB,CAACU,MAAAA,CAAAA;AAC7D,YAAA;AACF,QAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA,MAAMC,gBAAAA,GAAmB,UAAA;AACvB,IAAA,MAAMC,UAAAA,GAAa,MAAM9B,MAAAA,CAAO+B,KAAK,CAAC;QAAEC,IAAAA,EAAM,MAAA;QAAQC,IAAAA,EAAM;AAAQ,KAAA,CAAA;AACpE,IAAA,MAAMC,iBAAAA,GAAoB,MAAMJ,UAAAA,CAAWK,GAAG,CAAC;QAAEC,GAAAA,EAAK;AAAO,KAAA,CAAA;AAC7D,IAAA,MAAMC,eAAAA,GAAkBC,KAAAA,CAAM,EAAC,EAAGvD,wBAAAA,EAA0BmD,iBAAAA,CAAAA;AAE5D,IAAA,MAAMK,UAAAA,GAAa,MAAMlD,UAAAA,CAAW,MAAA,CAAA,CAAQmD,MAAM,CAAC;QACjD5B,EAAAA,EAAIyB,eAAAA,CAAgBrD,SAAS,CAACE;AAChC,KAAA,CAAA;;AAGA,IAAA,IAAI,CAACqD,UAAAA,EAAY;QACfF,eAAAA,CAAgBrD,SAAS,CAACE,WAAW,GAAG,IAAA;AAC1C,IAAA;IAEA,MAAM4C,UAAAA,CAAWW,GAAG,CAAC;QAAEL,GAAAA,EAAK,MAAA;QAAQM,KAAAA,EAAOL;AAAgB,KAAA,CAAA;AAC7D,CAAA;AAEA,MAAMM,wBAAAA,GAA2B,UAAA;IAC/B,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAO6C,UAAU,CAACC,WAAW,CAAC9D,SAAS,CAAC+D,MAAM,CAACC,IAAI,EAAA;AAC5E,IAAA,MAAMC,kBAAkB,MAAMC,KAAAA,CAAMC,IAAI,CACtCnD,OAAOC,EAAE,CAACoB,KAAK,CAAC,+BAA+BC,QAAQ,EACvD,CAACwB,WAAAA,GAAgBpB,IAAIoB,WAAAA,EAAa,QAAA,CAAA,CAAA,EAAA;AAGpC,IAAA,MAAMM,kBAAAA,GAAqB;WAAI,IAAIC,GAAAA,CAAIC,WAAWL,eAAAA,EAAiBL,gBAAAA,CAAAA;AAAmB,KAAA;IAEtF,IAAIQ,kBAAAA,CAAmBG,MAAM,GAAG,CAAA,EAAG;AACjC,QAAA,MAAMvD,OAAOC,EAAE,CACZoB,KAAK,CAAC,6BAAA,CAAA,CACNmC,UAAU,CAAC;YAAE7C,KAAAA,EAAO;gBAAEoC,MAAAA,EAAQ;oBAAEU,GAAAA,EAAKL;AAAmB;AAAE;AAAE,SAAA,CAAA;AACjE,IAAA;AACF,CAAA;AAEA;;;;;;;;;AASC,IAED,MAAMM,8BAAAA,GAAiC,UAAA;AACrC,IAAA,MAAMC,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;IAEnC,MAAMwE,UAAAA,GAAa,MAAMF,WAAAA,CAAYG,KAAK,EAAA;IAC1C,MAAMC,aAAAA,GAAgB,MAAMH,eAAAA,CAAgBI,QAAQ,EAAA;IAEpD,IAAIH,UAAAA,KAAe,CAAA,IAAKE,aAAAA,KAAkB,CAAA,EAAG;AAC3C,QAAA,KAAK,MAAME,KAAAA,IAASC,SAAAA,CAAUC,kBAAkB,CAAE;YAChD,MAAMP,eAAAA,CAAgBQ,MAAM,CAACH,KAAAA,CAAAA;AAC/B,QAAA;AACF,IAAA;AACF,CAAA;AAEA,gBAAe,CAAA,OAAO,EAAEjE,MAAAA,EAAAA,OAAM,EAA2B,GAAA;;IAEvD,MAAM,EAAEqE,OAAO,EAAE,GAAGC,eAAAA,EAAAA;IACpB,MAAMC,wBAAAA,GACJC,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcC,kCAAAA;IAC5C,MAAMC,wBAAAA,GACJH,kBAAAA,CAAmBH,OAAAA,EAASI,SAAAA,CAAAA,IAAcG,4BAAAA;;;AAI5C,IAAA,MAAMC,mBAAmBC,qCAAAA,CACvB9E,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,oBAAA,CAAA,CAAA;AAEpB,IAAA,MAAM6C,mBAAmBhF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,6CAAA,CAAA,IAAkD,IAAA;AAC7F,IAAA,MAAM8C,mBAAmBjF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,wCAAA,CAAA,IAA6C,IAAA;AAExF,IAAA,IAAI0C,qBAAqB,CAACG,gBAAAA,IAAoB,CAACC,gBAAe,CAAA,EAAI;QAChEjF,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,sLAAA,CAAA;AAEJ,IAAA;AAEAnF,IAAAA,OAAAA,CAAOoF,cAAc,CAACC,YAAY,CAAC,OAAA,EAAS;AAC1CC,QAAAA,SAAAA,EAAWtF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,mBAAA,CAAA;AAC7BoD,QAAAA,mBAAAA,EAAqBvF,QAAO+E,MAAM,CAAC5C,GAAG,CAAC,2CAA2C,EAAA,GAAK,EAAA,CAAA;AACvFqD,QAAAA,uBAAAA,EAAyBxF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACxC,6CAAA,EACAoC,wBAAAA,CAAAA;AAEFkB,QAAAA,wBAAAA,EAA0BzF,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACzC,8CAAA,EACAuD,mCAAAA,CAAAA;AAEFC,QAAAA,kBAAAA,EAAoB3F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACnC,wCAAA,EACAwC,wBAAAA,CAAAA;AAEFiB,QAAAA,mBAAAA,EAAqB5F,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CACpC,yCAAA,EACA0D,6BAAAA,CAAAA;AAEFC,QAAAA,SAAAA,EAAWzB,OAAAA,EAASyB,SAAAA;;QAEpBC,UAAAA,EAAY1B;AACd,KAAA,CAAA;AAEA,IAAA,MAAM2B,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,IAAA,MAAMC,iBAAAA,GAAoBpG,OAAAA,CAAO+E,MAAM,CAAC5C,GAAG,CAAC,0BAAA,CAAA;IAC5C,IAAI6D,YAAAA,IAAgBI,sBAAsB,KAAA,EAAO;QAC/CpG,OAAAA,CAAOkF,GAAG,CAACC,IAAI,CACb,wKAAA,CAAA;AAEJ,IAAA;IAEA,MAAMzF,uBAAAA,EAAAA;IACN,MAAMN,yBAAAA,EAAAA;AACNU,IAAAA,kBAAAA,EAAAA;AAEA,IAAA,MAAMuG,oBAAoBhH,UAAAA,CAAW,YAAA,CAAA;AACrC,IAAA,MAAMsE,cAActE,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMiH,cAAcjH,UAAAA,CAAW,MAAA,CAAA;AAC/B,IAAA,MAAMuE,kBAAkBvE,UAAAA,CAAW,uBAAA,CAAA;AACnC,IAAA,MAAMkH,kBAAkBlH,UAAAA,CAAW,UAAA,CAAA;AACnC,IAAA,MAAMmH,eAAenH,UAAAA,CAAW,OAAA,CAAA;AAEhC,IAAA,MAAMiH,YAAYG,sBAAsB,EAAA;AACxC,IAAA,MAAMH,YAAYI,0BAA0B,EAAA;AAC5C,IAAA,MAAMJ,YAAYK,4BAA4B,EAAA;AAE9C,IAAA,MAAMN,kBAAkBO,0BAA0B,EAAA;AAElD,IAAA,MAAMjD,YAAYkD,iCAAiC,EAAA;IAEnD,MAAMhF,gBAAAA,EAAAA;IACN,MAAMc,wBAAAA,EAAAA;IAEN,MAAMtD,UAAAA,CAAW,SAAA,CAAA,CAAWyH,4BAA4B,CAAC9G,OAAAA,CAAAA;IACzDX,UAAAA,CAAW,SAAA,CAAA,CAAW0H,SAAS,CAAC/G,OAAAA,CAAAA;AAEhC4D,IAAAA,eAAAA,CAAgBoD,kBAAkB,EAAA;IAClCT,eAAAA,CAAgBtC,KAAK,CAAC+C,kBAAkB,EAAA;AACxCR,IAAAA,YAAAA,CAAaS,oBAAoB,EAAA;IAEjC,MAAMvD,8BAAAA,EAAAA;AACR,CAAA;;;;"}

package/dist/server/server/src/config/admin-actions.js

@@ -229,6 +229,13 @@ const actions = [
         section: 'settings',
         category: 'project'
     },
+    {
+        uid: 'debug-dump.read',
+        displayName: 'Generate a support debug dump',
+        pluginName: 'admin',
+        section: 'settings',
+        category: 'debug and support'
+    },
     {
         uid: 'transfer.tokens.access',
         displayName: 'Access the transfer tokens settings page',