@strapi/admin 5.56.0 → 5.58.0

package/dist/server/server/src/services/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","sources":["../../../../../server/src/services/auth.ts"],"sourcesContent":["import bcrypt from 'bcryptjs';\nimport _ from 'lodash';\nimport { errors, emitAudit } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { expiresInToSeconds } from './token';\nimport { AUDITED_EVENTS, toAdminUserEvent } from '../audit-logs/admin-users';\nimport type { AdminUser } from '../../../shared/contracts/shared';\nimport '@strapi/types';\n\nconst { ApplicationError } = errors;\n\n// Default lifetime of an admin reset-password token. Overridable via\n// `admin.forgotPassword.expiresIn` (number of seconds or a shorthand like '15m', '1h').\nconst DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN = '1h';\n\n/**\n * Resolve the reset-password token lifetime, in milliseconds, from config.\n * Falls back to {@link DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN} for unset/invalid values.\n */\nconst getResetPasswordTokenTTL = (): number => {\n  const configured = strapi.config.get(\n    'admin.forgotPassword.expiresIn',\n    DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN\n  );\n  const seconds =\n    expiresInToSeconds(configured) ??\n    (expiresInToSeconds(DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN) as number);\n  return seconds * 1000;\n};\n\n/**\n * Create a reset-password token with an expiry and persist it on the user.\n * Shared by the CE and EE auth services so the expiry behaviour can't drift.\n * @returns the generated reset-password token\n */\nconst assignResetPasswordToken = async (userId: AdminUser['id']): Promise<string> => {\n  const resetPasswordToken = getService('token').createToken();\n  const resetPasswordTokenExpiresAt = new Date(Date.now() + getResetPasswordTokenTTL());\n\n  const user = await getService('user').updateById(userId, {\n    resetPasswordToken,\n    resetPasswordTokenExpiresAt,\n  });\n\n  // null when the account was deleted between the caller's lookup and this write\n  if (user) {\n    await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_RESET_CREATE, {\n      ...toAdminUserEvent(user),\n      expiresAt: user.resetPasswordTokenExpiresAt,\n    });\n  }\n\n  return resetPasswordToken;\n};\n\n/**\n * Set the new password and consume the reset token. Shared by the CE and EE auth\n * services, after each has validated the token.\n */\nconst completePasswordReset = async (user: AdminUser, password: string): Promise<AdminUser> => {\n  const updatedUser = await getService('user').updateById(user.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n\n  await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_RESET_CONFIRM, toAdminUserEvent(updatedUser));\n\n  return updatedUser;\n};\n\n/**\n * Reject a reset-password token that has expired — or that has no expiry at all\n * (tokens issued before this was introduced) — clearing the stale token so it\n * cannot be retried. Shared by the CE and EE auth services. (GH#25711)\n */\nconst assertResetPasswordTokenIsValid = async (user: AdminUser): Promise<void> => {\n  const { resetPasswordTokenExpiresAt } = user;\n  const isExpired =\n    !resetPasswordTokenExpiresAt || new Date(resetPasswordTokenExpiresAt).getTime() <= Date.now();\n\n  if (isExpired) {\n    // Clear the stale token so it can no longer be retried.\n    await getService('user').updateById(user.id, {\n      resetPasswordToken: null,\n      resetPasswordTokenExpiresAt: null,\n    });\n    throw new ApplicationError('This reset password token has expired');\n  }\n};\n\n/**\n * hashes a password\n * @param password - password to hash\n * @returns hashed password\n */\nconst hashPassword = (password: string) => bcrypt.hash(password, 10);\n\n/**\n * Validate a password\n * @param password\n * @param hash\n * @returns {Promise<boolean>} is the password valid\n */\nconst validatePassword = (password: string, hash: string) => bcrypt.compare(password, hash);\n\n/**\n * Check login credentials\n * @param email the users email address\n * @param password the users password\n */\nconst checkCredentials = async ({ email, password }: { email: string; password: string }) => {\n  const user: AdminUser = await strapi.db.query('admin::user').findOne({ where: { email } });\n\n  if (!user || !user.password) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  const isValid = await validatePassword(password, user.password);\n\n  if (!isValid) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  if (!(user.isActive === true)) {\n    return [null, false, { message: 'User not active' }];\n  }\n\n  return [null, user];\n};\n\n/**\n * Send an email to the user if it exists or do nothing\n * @param email user email for which to reset the password\n */\nconst forgotPassword = async ({ email } = {} as { email: string }) => {\n  const user: AdminUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email, isActive: true } });\n  if (!user) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param resetPasswordToken token generated to request a password reset\n * @param password new user password\n */\nconst resetPassword = async (\n  { resetPasswordToken, password } = {} as { resetPasswordToken: string; password: string }\n) => {\n  const matchingUser: AdminUser | undefined = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return completePasswordReset(matchingUser, password);\n};\n\nexport default { checkCredentials, validatePassword, hashPassword, forgotPassword, resetPassword };\nexport {\n  getResetPasswordTokenTTL,\n  assignResetPasswordToken,\n  assertResetPasswordTokenIsValid,\n  completePasswordReset,\n};\n"],"names":["ApplicationError","errors","DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN","getResetPasswordTokenTTL","configured","strapi","config","get","seconds","expiresInToSeconds","assignResetPasswordToken","userId","resetPasswordToken","getService","createToken","resetPasswordTokenExpiresAt","Date","now","user","updateById","emitAudit","AUDITED_EVENTS","PASSWORD_RESET_CREATE","toAdminUserEvent","expiresAt","completePasswordReset","password","updatedUser","id","PASSWORD_RESET_CONFIRM","assertResetPasswordTokenIsValid","isExpired","getTime","hashPassword","bcrypt","hash","validatePassword","compare","checkCredentials","email","db","query","findOne","where","message","isValid","isActive","forgotPassword","url","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","matchingUser"],"mappings":";;;;;;;;AASA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAE7B;AACA;AACA,MAAMC,uCAAAA,GAA0C,IAAA;AAEhD;;;AAGC,UACKC,wBAAAA,GAA2B,IAAA;AAC/B,IAAA,MAAMC,aAAaC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAClC,gCAAA,EACAL,uCAAAA,CAAAA;IAEF,MAAMM,OAAAA,GACJC,kBAAAA,CAAmBL,UAAAA,CAAAA,IAClBK,kBAAAA,CAAmBP,uCAAAA,CAAAA;AACtB,IAAA,OAAOM,OAAAA,GAAU,IAAA;AACnB;AAEA;;;;IAKA,MAAME,2BAA2B,OAAOC,MAAAA,GAAAA;IACtC,MAAMC,kBAAAA,GAAqBC,UAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMC,2BAAAA,GAA8B,IAAIC,IAAAA,CAAKA,IAAAA,CAAKC,GAAG,EAAA,GAAKd,wBAAAA,EAAAA,CAAAA;AAE1D,IAAA,MAAMe,OAAO,MAAML,UAAAA,CAAW,MAAA,CAAA,CAAQM,UAAU,CAACR,MAAAA,EAAQ;AACvDC,QAAAA,kBAAAA;AACAG,QAAAA;AACF,KAAA,CAAA;;AAGA,IAAA,IAAIG,IAAAA,EAAM;AACR,QAAA,MAAME,SAAAA,CAAU;AAAEf,YAAAA;SAAO,EAAGgB,cAAAA,CAAeC,qBAAqB,EAAE;AAChE,YAAA,GAAGC,iBAAiBL,IAAAA,CAAK;AACzBM,YAAAA,SAAAA,EAAWN,KAAKH;AAClB,SAAA,CAAA;AACF,IAAA;IAEA,OAAOH,kBAAAA;AACT;AAEA;;;IAIA,MAAMa,qBAAAA,GAAwB,OAAOP,IAAAA,EAAiBQ,QAAAA,GAAAA;IACpD,MAAMC,WAAAA,GAAc,MAAMd,UAAAA,CAAW,MAAA,CAAA,CAAQM,UAAU,CAACD,IAAAA,CAAKU,EAAE,EAAE;AAC/DF,QAAAA,QAAAA;QACAd,kBAAAA,EAAoB,IAAA;QACpBG,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AAEA,IAAA,MAAMK,SAAAA,CAAU;AAAEf,QAAAA;KAAO,EAAGgB,cAAAA,CAAeQ,sBAAsB,EAAEN,gBAAAA,CAAiBI,WAAAA,CAAAA,CAAAA;IAEpF,OAAOA,WAAAA;AACT;AAEA;;;;IAKA,MAAMG,kCAAkC,OAAOZ,IAAAA,GAAAA;IAC7C,MAAM,EAAEH,2BAA2B,EAAE,GAAGG,IAAAA;IACxC,MAAMa,SAAAA,GACJ,CAAChB,2BAAAA,IAA+B,IAAIC,KAAKD,2BAAAA,CAAAA,CAA6BiB,OAAO,EAAA,IAAMhB,IAAAA,CAAKC,GAAG,EAAA;AAE7F,IAAA,IAAIc,SAAAA,EAAW;;AAEb,QAAA,MAAMlB,WAAW,MAAA,CAAA,CAAQM,UAAU,CAACD,IAAAA,CAAKU,EAAE,EAAE;YAC3ChB,kBAAAA,EAAoB,IAAA;YACpBG,2BAAAA,EAA6B;AAC/B,SAAA,CAAA;AACA,QAAA,MAAM,IAAIf,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,IAAA;AACF;AAEA;;;;AAIC,IACD,MAAMiC,YAAAA,GAAe,CAACP,WAAqBQ,MAAAA,CAAOC,IAAI,CAACT,QAAAA,EAAU,EAAA,CAAA;AAEjE;;;;;IAMA,MAAMU,mBAAmB,CAACV,QAAAA,EAAkBS,OAAiBD,MAAAA,CAAOG,OAAO,CAACX,QAAAA,EAAUS,IAAAA,CAAAA;AAEtF;;;;AAIC,IACD,MAAMG,gBAAAA,GAAmB,OAAO,EAAEC,KAAK,EAAEb,QAAQ,EAAuC,GAAA;IACtF,MAAMR,IAAAA,GAAkB,MAAMb,MAAAA,CAAOmC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA;AAAM;AAAE,KAAA,CAAA;AAExF,IAAA,IAAI,CAACrB,IAAAA,IAAQ,CAACA,IAAAA,CAAKQ,QAAQ,EAAE;QAC3B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEkB,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,MAAMC,OAAAA,GAAU,MAAMT,gBAAAA,CAAiBV,QAAAA,EAAUR,KAAKQ,QAAQ,CAAA;AAE9D,IAAA,IAAI,CAACmB,OAAAA,EAAS;QACZ,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAED,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,IAAI,EAAE1B,IAAAA,CAAK4B,QAAQ,KAAK,IAAG,CAAA,EAAI;QAC7B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEF,OAAAA,EAAS;AAAkB;AAAE,SAAA;AACtD,IAAA;IAEA,OAAO;AAAC,QAAA,IAAA;AAAM1B,QAAAA;AAAK,KAAA;AACrB,CAAA;AAEA;;;IAIA,MAAM6B,iBAAiB,OAAO,EAAER,KAAK,EAAE,GAAG,EAAuB,GAAA;IAC/D,MAAMrB,IAAAA,GAAkB,MAAMb,MAAAA,CAAOmC,EAAE,CACpCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC9C,IAAA,IAAI,CAAC5B,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,MAAMN,kBAAAA,GAAqB,MAAMF,wBAAAA,CAAyBQ,IAAAA,CAAKU,EAAE,CAAA;;IAGjE,MAAMoB,GAAAA,GAAM,CAAA,EAAG3C,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEK,kBAAAA,CAAAA,CAAoB;IAElD,OAAOP,MAAAA,CACJ4C,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAIlC,KAAKqB,KAAK;AACdc,QAAAA,IAAAA,EAAMhD,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxB+C,QAAAA,OAAAA,EAASjD,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAF,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACEyC,QAAAA,GAAAA;QACA9B,IAAAA,EAAMqC,UAAAA,CAAEC,IAAI,CAACtC,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDuC,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENrD,MAAAA,CAAOsD,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;IAKA,MAAMG,aAAAA,GAAgB,OACpB,EAAEjD,kBAAkB,EAAEc,QAAQ,EAAE,GAAG,EAAsD,GAAA;IAEzF,MAAMoC,YAAAA,GAAsC,MAAMzD,MAAAA,CAAOmC,EAAE,CACxDC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAE/B,YAAAA,kBAAAA;YAAoBkC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACgB,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAI9D,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAM8B,+BAAAA,CAAgCgC,YAAAA,CAAAA;AAEtC,IAAA,OAAOrC,sBAAsBqC,YAAAA,EAAcpC,QAAAA,CAAAA;AAC7C,CAAA;AAEA,WAAe;AAAEY,IAAAA,gBAAAA;AAAkBF,IAAAA,gBAAAA;AAAkBH,IAAAA,YAAAA;AAAcc,IAAAA,cAAAA;AAAgBc,IAAAA;AAAc,CAAA;;;;"}
+{"version":3,"file":"auth.mjs","sources":["../../../../../server/src/services/auth.ts"],"sourcesContent":["import bcrypt from 'bcryptjs';\nimport _ from 'lodash';\nimport { errors, emitAudit } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { expiresInToSeconds } from './token';\nimport { AUDITED_EVENTS, toAdminUserEvent } from '../audit-logs/admin-users';\nimport type { AdminUser } from '../../../shared/contracts/shared';\nimport '@strapi/types';\n\nconst { ApplicationError } = errors;\n\n// Default lifetime of an admin reset-password token. Overridable via\n// `admin.forgotPassword.expiresIn` (number of seconds or a shorthand like '15m', '1h').\nconst DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN = '1h';\n\n/**\n * Resolve the reset-password token lifetime, in milliseconds, from config.\n * Falls back to {@link DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN} for unset/invalid values.\n */\nconst getResetPasswordTokenTTL = (): number => {\n  const configured = strapi.config.get(\n    'admin.forgotPassword.expiresIn',\n    DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN\n  );\n  const seconds =\n    expiresInToSeconds(configured) ??\n    (expiresInToSeconds(DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN) as number);\n  return seconds * 1000;\n};\n\n/**\n * Create a reset-password token with an expiry and persist it on the user.\n * Shared by the CE and EE auth services so the expiry behaviour can't drift.\n * @returns the generated reset-password token\n */\nconst assignResetPasswordToken = async (userId: AdminUser['id']): Promise<string> => {\n  const resetPasswordToken = getService('token').createToken();\n  const resetPasswordTokenExpiresAt = new Date(Date.now() + getResetPasswordTokenTTL());\n\n  const user = await getService('user').updateById(userId, {\n    resetPasswordToken,\n    resetPasswordTokenExpiresAt,\n  });\n\n  // null when the account was deleted between the caller's lookup and this write\n  if (user) {\n    await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_RESET_CREATE, {\n      ...toAdminUserEvent(user),\n      expiresAt: user.resetPasswordTokenExpiresAt,\n    });\n  }\n\n  return resetPasswordToken;\n};\n\n/**\n * Set the new password and consume the reset token. Shared by the CE and EE auth\n * services, after each has validated the token.\n */\nconst completePasswordReset = async (user: AdminUser, password: string): Promise<AdminUser> => {\n  const updatedUser = await getService('user').updateById(user.id, {\n    password,\n    resetPasswordToken: null,\n    resetPasswordTokenExpiresAt: null,\n  });\n\n  await emitAudit({ strapi }, AUDITED_EVENTS.PASSWORD_RESET_CONFIRM, toAdminUserEvent(updatedUser));\n\n  return updatedUser;\n};\n\n/**\n * Reject a reset-password token that has expired — or that has no expiry at all\n * (tokens issued before this was introduced) — clearing the stale token so it\n * cannot be retried. Shared by the CE and EE auth services. (GH#25711)\n */\nconst assertResetPasswordTokenIsValid = async (user: AdminUser): Promise<void> => {\n  const { resetPasswordTokenExpiresAt } = user;\n  const isExpired =\n    !resetPasswordTokenExpiresAt || new Date(resetPasswordTokenExpiresAt).getTime() <= Date.now();\n\n  if (isExpired) {\n    // Clear the stale token so it can no longer be retried.\n    await getService('user').updateById(user.id, {\n      resetPasswordToken: null,\n      resetPasswordTokenExpiresAt: null,\n    });\n    throw new ApplicationError('This reset password token has expired');\n  }\n};\n\n/**\n * hashes a password\n * @param password - password to hash\n * @returns hashed password\n */\nconst hashPassword = (password: string) => bcrypt.hash(password, 10);\n\n/**\n * Validate a password\n * @param password\n * @param hash\n * @returns {Promise<boolean>} is the password valid\n */\nconst validatePassword = (password: string, hash: string) => bcrypt.compare(password, hash);\n\n/**\n * Check login credentials\n * @param email the users email address\n * @param password the users password\n */\nexport const USER_NOT_ACTIVE_MESSAGE = 'User not active';\n\nconst checkCredentials = async ({ email, password }: { email: string; password: string }) => {\n  const user: AdminUser = await strapi.db.query('admin::user').findOne({ where: { email } });\n\n  if (!user || !user.password) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  const isValid = await validatePassword(password, user.password);\n\n  if (!isValid) {\n    return [null, false, { message: 'Invalid credentials' }];\n  }\n\n  if (!(user.isActive === true)) {\n    return [null, false, { message: USER_NOT_ACTIVE_MESSAGE }];\n  }\n\n  return [null, user];\n};\n\n/**\n * Send an email to the user if it exists or do nothing\n * @param email user email for which to reset the password\n */\nconst forgotPassword = async ({ email } = {} as { email: string }) => {\n  const user: AdminUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email, isActive: true } });\n  if (!user) {\n    return;\n  }\n\n  const resetPasswordToken = await assignResetPasswordToken(user.id);\n\n  // Send an email to the admin.\n  const url = `${strapi.config.get(\n    'admin.absoluteUrl'\n  )}/auth/reset-password?code=${resetPasswordToken}`;\n\n  return strapi\n    .plugin('email')\n    .service('email')\n    .sendTemplatedEmail(\n      {\n        to: user.email,\n        from: strapi.config.get('admin.forgotPassword.from'),\n        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),\n      },\n      strapi.config.get('admin.forgotPassword.emailTemplate'),\n      {\n        url,\n        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),\n      }\n    )\n    .catch((err: unknown) => {\n      // log error server side but do not disclose it to the user to avoid leaking informations\n      strapi.log.error(err);\n    });\n};\n\n/**\n * Reset a user password\n * @param resetPasswordToken token generated to request a password reset\n * @param password new user password\n */\nconst resetPassword = async (\n  { resetPasswordToken, password } = {} as { resetPasswordToken: string; password: string }\n) => {\n  const matchingUser: AdminUser | undefined = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { resetPasswordToken, isActive: true } });\n\n  if (!matchingUser) {\n    throw new ApplicationError();\n  }\n\n  await assertResetPasswordTokenIsValid(matchingUser);\n\n  return completePasswordReset(matchingUser, password);\n};\n\nexport default { checkCredentials, validatePassword, hashPassword, forgotPassword, resetPassword };\nexport {\n  getResetPasswordTokenTTL,\n  assignResetPasswordToken,\n  assertResetPasswordTokenIsValid,\n  completePasswordReset,\n};\n"],"names":["ApplicationError","errors","DEFAULT_RESET_PASSWORD_TOKEN_EXPIRES_IN","getResetPasswordTokenTTL","configured","strapi","config","get","seconds","expiresInToSeconds","assignResetPasswordToken","userId","resetPasswordToken","getService","createToken","resetPasswordTokenExpiresAt","Date","now","user","updateById","emitAudit","AUDITED_EVENTS","PASSWORD_RESET_CREATE","toAdminUserEvent","expiresAt","completePasswordReset","password","updatedUser","id","PASSWORD_RESET_CONFIRM","assertResetPasswordTokenIsValid","isExpired","getTime","hashPassword","bcrypt","hash","validatePassword","compare","USER_NOT_ACTIVE_MESSAGE","checkCredentials","email","db","query","findOne","where","message","isValid","isActive","forgotPassword","url","plugin","service","sendTemplatedEmail","to","from","replyTo","_","pick","catch","err","log","error","resetPassword","matchingUser"],"mappings":";;;;;;;;AASA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,MAAAA;AAE7B;AACA;AACA,MAAMC,uCAAAA,GAA0C,IAAA;AAEhD;;;AAGC,UACKC,wBAAAA,GAA2B,IAAA;AAC/B,IAAA,MAAMC,aAAaC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAClC,gCAAA,EACAL,uCAAAA,CAAAA;IAEF,MAAMM,OAAAA,GACJC,kBAAAA,CAAmBL,UAAAA,CAAAA,IAClBK,kBAAAA,CAAmBP,uCAAAA,CAAAA;AACtB,IAAA,OAAOM,OAAAA,GAAU,IAAA;AACnB;AAEA;;;;IAKA,MAAME,2BAA2B,OAAOC,MAAAA,GAAAA;IACtC,MAAMC,kBAAAA,GAAqBC,UAAAA,CAAW,OAAA,CAAA,CAASC,WAAW,EAAA;AAC1D,IAAA,MAAMC,2BAAAA,GAA8B,IAAIC,IAAAA,CAAKA,IAAAA,CAAKC,GAAG,EAAA,GAAKd,wBAAAA,EAAAA,CAAAA;AAE1D,IAAA,MAAMe,OAAO,MAAML,UAAAA,CAAW,MAAA,CAAA,CAAQM,UAAU,CAACR,MAAAA,EAAQ;AACvDC,QAAAA,kBAAAA;AACAG,QAAAA;AACF,KAAA,CAAA;;AAGA,IAAA,IAAIG,IAAAA,EAAM;AACR,QAAA,MAAME,SAAAA,CAAU;AAAEf,YAAAA;SAAO,EAAGgB,cAAAA,CAAeC,qBAAqB,EAAE;AAChE,YAAA,GAAGC,iBAAiBL,IAAAA,CAAK;AACzBM,YAAAA,SAAAA,EAAWN,KAAKH;AAClB,SAAA,CAAA;AACF,IAAA;IAEA,OAAOH,kBAAAA;AACT;AAEA;;;IAIA,MAAMa,qBAAAA,GAAwB,OAAOP,IAAAA,EAAiBQ,QAAAA,GAAAA;IACpD,MAAMC,WAAAA,GAAc,MAAMd,UAAAA,CAAW,MAAA,CAAA,CAAQM,UAAU,CAACD,IAAAA,CAAKU,EAAE,EAAE;AAC/DF,QAAAA,QAAAA;QACAd,kBAAAA,EAAoB,IAAA;QACpBG,2BAAAA,EAA6B;AAC/B,KAAA,CAAA;AAEA,IAAA,MAAMK,SAAAA,CAAU;AAAEf,QAAAA;KAAO,EAAGgB,cAAAA,CAAeQ,sBAAsB,EAAEN,gBAAAA,CAAiBI,WAAAA,CAAAA,CAAAA;IAEpF,OAAOA,WAAAA;AACT;AAEA;;;;IAKA,MAAMG,kCAAkC,OAAOZ,IAAAA,GAAAA;IAC7C,MAAM,EAAEH,2BAA2B,EAAE,GAAGG,IAAAA;IACxC,MAAMa,SAAAA,GACJ,CAAChB,2BAAAA,IAA+B,IAAIC,KAAKD,2BAAAA,CAAAA,CAA6BiB,OAAO,EAAA,IAAMhB,IAAAA,CAAKC,GAAG,EAAA;AAE7F,IAAA,IAAIc,SAAAA,EAAW;;AAEb,QAAA,MAAMlB,WAAW,MAAA,CAAA,CAAQM,UAAU,CAACD,IAAAA,CAAKU,EAAE,EAAE;YAC3ChB,kBAAAA,EAAoB,IAAA;YACpBG,2BAAAA,EAA6B;AAC/B,SAAA,CAAA;AACA,QAAA,MAAM,IAAIf,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,IAAA;AACF;AAEA;;;;AAIC,IACD,MAAMiC,YAAAA,GAAe,CAACP,WAAqBQ,MAAAA,CAAOC,IAAI,CAACT,QAAAA,EAAU,EAAA,CAAA;AAEjE;;;;;IAMA,MAAMU,mBAAmB,CAACV,QAAAA,EAAkBS,OAAiBD,MAAAA,CAAOG,OAAO,CAACX,QAAAA,EAAUS,IAAAA,CAAAA;AAEtF;;;;IAKO,MAAMG,uBAAAA,GAA0B;AAEvC,MAAMC,mBAAmB,OAAO,EAAEC,KAAK,EAAEd,QAAQ,EAAuC,GAAA;IACtF,MAAMR,IAAAA,GAAkB,MAAMb,MAAAA,CAAOoC,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA;AAAM;AAAE,KAAA,CAAA;AAExF,IAAA,IAAI,CAACtB,IAAAA,IAAQ,CAACA,IAAAA,CAAKQ,QAAQ,EAAE;QAC3B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEmB,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,MAAMC,OAAAA,GAAU,MAAMV,gBAAAA,CAAiBV,QAAAA,EAAUR,KAAKQ,QAAQ,CAAA;AAE9D,IAAA,IAAI,CAACoB,OAAAA,EAAS;QACZ,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAED,OAAAA,EAAS;AAAsB;AAAE,SAAA;AAC1D,IAAA;AAEA,IAAA,IAAI,EAAE3B,IAAAA,CAAK6B,QAAQ,KAAK,IAAG,CAAA,EAAI;QAC7B,OAAO;AAAC,YAAA,IAAA;AAAM,YAAA,KAAA;AAAO,YAAA;gBAAEF,OAAAA,EAASP;AAAwB;AAAE,SAAA;AAC5D,IAAA;IAEA,OAAO;AAAC,QAAA,IAAA;AAAMpB,QAAAA;AAAK,KAAA;AACrB,CAAA;AAEA;;;IAIA,MAAM8B,iBAAiB,OAAO,EAAER,KAAK,EAAE,GAAG,EAAuB,GAAA;IAC/D,MAAMtB,IAAAA,GAAkB,MAAMb,MAAAA,CAAOoC,EAAE,CACpCC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEJ,YAAAA,KAAAA;YAAOO,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAC9C,IAAA,IAAI,CAAC7B,IAAAA,EAAM;AACT,QAAA;AACF,IAAA;AAEA,IAAA,MAAMN,kBAAAA,GAAqB,MAAMF,wBAAAA,CAAyBQ,IAAAA,CAAKU,EAAE,CAAA;;IAGjE,MAAMqB,GAAAA,GAAM,CAAA,EAAG5C,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAC9B,mBAAA,CAAA,CACA,0BAA0B,EAAEK,kBAAAA,CAAAA,CAAoB;IAElD,OAAOP,MAAAA,CACJ6C,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,kBAAkB,CACjB;AACEC,QAAAA,EAAAA,EAAInC,KAAKsB,KAAK;AACdc,QAAAA,IAAAA,EAAMjD,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACxBgD,QAAAA,OAAAA,EAASlD,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,8BAAA;AAC7B,KAAA,EACAF,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA,EAClB;AACE0C,QAAAA,GAAAA;QACA/B,IAAAA,EAAMsC,UAAAA,CAAEC,IAAI,CAACvC,IAAAA,EAAM;AAAC,YAAA,OAAA;AAAS,YAAA,WAAA;AAAa,YAAA,UAAA;AAAY,YAAA;AAAW,SAAA;KACnE,CAAA,CAEDwC,KAAK,CAAC,CAACC,GAAAA,GAAAA;;QAENtD,MAAAA,CAAOuD,GAAG,CAACC,KAAK,CAACF,GAAAA,CAAAA;AACnB,IAAA,CAAA,CAAA;AACJ,CAAA;AAEA;;;;IAKA,MAAMG,aAAAA,GAAgB,OACpB,EAAElD,kBAAkB,EAAEc,QAAQ,EAAE,GAAG,EAAsD,GAAA;IAEzF,MAAMqC,YAAAA,GAAsC,MAAM1D,MAAAA,CAAOoC,EAAE,CACxDC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;QAAEC,KAAAA,EAAO;AAAEhC,YAAAA,kBAAAA;YAAoBmC,QAAAA,EAAU;AAAK;AAAE,KAAA,CAAA;AAE3D,IAAA,IAAI,CAACgB,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAI/D,gBAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAM8B,+BAAAA,CAAgCiC,YAAAA,CAAAA;AAEtC,IAAA,OAAOtC,sBAAsBsC,YAAAA,EAAcrC,QAAAA,CAAAA;AAC7C,CAAA;AAEA,WAAe;AAAEa,IAAAA,gBAAAA;AAAkBH,IAAAA,gBAAAA;AAAkBH,IAAAA,YAAAA;AAAce,IAAAA,cAAAA;AAAgBc,IAAAA;AAAc,CAAA;;;;"}

package/dist/server/server/src/services/condition.js

@@ -1,11 +1,11 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var index = require('../utils/index.js');
 
 const isValidCondition = (condition)=>{
     const { conditionProvider } = index.getService('permission');
-    return fp.isString(condition) && conditionProvider.has(condition);
+    return _.isString(condition) && conditionProvider.has(condition);
 };
 
 exports.isValidCondition = isValidCondition;

package/dist/server/server/src/services/condition.js.map

@@ -1 +1 @@
-{"version":3,"file":"condition.js","sources":["../../../../../server/src/services/condition.ts"],"sourcesContent":["import { isString } from 'lodash/fp';\nimport { getService } from '../utils';\n\nconst isValidCondition = (condition: unknown) => {\n  const { conditionProvider } = getService('permission');\n\n  return isString(condition) && conditionProvider.has(condition);\n};\n\nexport { isValidCondition };\n"],"names":["isValidCondition","condition","conditionProvider","getService","isString","has"],"mappings":";;;;;AAGA,MAAMA,mBAAmB,CAACC,SAAAA,GAAAA;AACxB,IAAA,MAAM,EAAEC,iBAAiB,EAAE,GAAGC,gBAAAA,CAAW,YAAA,CAAA;AAEzC,IAAA,OAAOC,WAAAA,CAASH,SAAAA,CAAAA,IAAcC,iBAAAA,CAAkBG,GAAG,CAACJ,SAAAA,CAAAA;AACtD;;;;"}
+{"version":3,"file":"condition.js","sources":["../../../../../server/src/services/condition.ts"],"sourcesContent":["import { isString } from 'lodash';\n\nimport { getService } from '../utils';\n\nconst isValidCondition = (condition: unknown) => {\n  const { conditionProvider } = getService('permission');\n\n  return isString(condition) && conditionProvider.has(condition);\n};\n\nexport { isValidCondition };\n"],"names":["isValidCondition","condition","conditionProvider","getService","isString","has"],"mappings":";;;;;AAIA,MAAMA,mBAAmB,CAACC,SAAAA,GAAAA;AACxB,IAAA,MAAM,EAAEC,iBAAiB,EAAE,GAAGC,gBAAAA,CAAW,YAAA,CAAA;AAEzC,IAAA,OAAOC,UAAAA,CAASH,SAAAA,CAAAA,IAAcC,iBAAAA,CAAkBG,GAAG,CAACJ,SAAAA,CAAAA;AACtD;;;;"}

package/dist/server/server/src/services/condition.mjs

@@ -1,4 +1,4 @@
-import { isString } from 'lodash/fp';
+import { isString } from 'lodash';
 import { getService } from '../utils/index.mjs';
 
 const isValidCondition = (condition)=>{

package/dist/server/server/src/services/condition.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"condition.mjs","sources":["../../../../../server/src/services/condition.ts"],"sourcesContent":["import { isString } from 'lodash/fp';\nimport { getService } from '../utils';\n\nconst isValidCondition = (condition: unknown) => {\n  const { conditionProvider } = getService('permission');\n\n  return isString(condition) && conditionProvider.has(condition);\n};\n\nexport { isValidCondition };\n"],"names":["isValidCondition","condition","conditionProvider","getService","isString","has"],"mappings":";;;AAGA,MAAMA,mBAAmB,CAACC,SAAAA,GAAAA;AACxB,IAAA,MAAM,EAAEC,iBAAiB,EAAE,GAAGC,UAAAA,CAAW,YAAA,CAAA;AAEzC,IAAA,OAAOC,QAAAA,CAASH,SAAAA,CAAAA,IAAcC,iBAAAA,CAAkBG,GAAG,CAACJ,SAAAA,CAAAA;AACtD;;;;"}
+{"version":3,"file":"condition.mjs","sources":["../../../../../server/src/services/condition.ts"],"sourcesContent":["import { isString } from 'lodash';\n\nimport { getService } from '../utils';\n\nconst isValidCondition = (condition: unknown) => {\n  const { conditionProvider } = getService('permission');\n\n  return isString(condition) && conditionProvider.has(condition);\n};\n\nexport { isValidCondition };\n"],"names":["isValidCondition","condition","conditionProvider","getService","isString","has"],"mappings":";;;AAIA,MAAMA,mBAAmB,CAACC,SAAAA,GAAAA;AACxB,IAAA,MAAM,EAAEC,iBAAiB,EAAE,GAAGC,UAAAA,CAAW,YAAA,CAAA;AAEzC,IAAA,OAAOC,QAAAA,CAASH,SAAAA,CAAAA,IAAcC,iBAAAA,CAAkBG,GAAG,CAACJ,SAAAA,CAAAA;AACtD;;;;"}

package/dist/server/server/src/services/content-type.js

@@ -1,7 +1,6 @@
 'use strict';
 
 var _ = require('lodash');
-var fp = require('lodash/fp');
 var utils = require('@strapi/utils');
 var index = require('../utils/index.js');
 var index$1 = require('../domain/action/index.js');
@@ -24,7 +23,7 @@ var ___default = /*#__PURE__*/_interopDefault(_);
         if (nonAuthorizableFields.includes(key)) return fields;
         const fieldPath = prefix ? `${prefix}.${key}` : key;
         const shouldBeIncluded = !requiredOnly || attr.required === true;
-        const insideExistingFields = existingFields && existingFields.some(fp.startsWith(fieldPath));
+        const insideExistingFields = existingFields && existingFields.some((field)=>field.startsWith(fieldPath));
         if (attr.type === 'component') {
             if (shouldBeIncluded || insideExistingFields) {
                 const compoFields = getNestedFields(components[attr.component], {
@@ -115,11 +114,13 @@ var ___default = /*#__PURE__*/_interopDefault(_);
             nestedFieldsCache.set(subject, possibleFields);
         }
         const currentFields = fields || [];
-        const validUserFields = fp.uniq(possibleFields.filter((pf)=>currentFields.some((cf)=>pf === cf || fp.startsWith(`${cf}.`, pf))));
+        const validUserFields = [
+            ...new Set(possibleFields.filter((pf)=>currentFields.some((cf)=>pf === cf || pf.startsWith(`${cf}.`))))
+        ];
         // A field is considered "not nested" if no other valid user field starts with this field's path followed by a dot.
         // This helps to remove redundant parent paths when a more specific child path is already included.
         // For example, if 'component.title' is present, 'component' would be filtered out by this condition.
-        const isNotNestedField = (field)=>!validUserFields.some((validUserField)=>validUserField !== field && fp.startsWith(`${field}.`, validUserField));
+        const isNotNestedField = (field)=>!validUserFields.some((validUserField)=>validUserField !== field && validUserField.startsWith(`${field}.`));
         // Filter out fields that are parent paths of other included fields.
         const newFields = validUserFields.filter(isNotNestedField);
         return index$2.default.setProperty('fields', newFields, permission);

package/dist/server/server/src/services/content-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-type.js","sources":["../../../../../server/src/services/content-type.ts"],"sourcesContent":["import _ from 'lodash';\nimport { uniq, startsWith } from 'lodash/fp';\nimport { contentTypes as contentTypesUtils } from '@strapi/utils';\nimport type { Modules, Struct } from '@strapi/types';\nimport { getService } from '../utils';\nimport actionDomain from '../domain/action';\nimport permissionDomain from '../domain/permission';\n\ninterface FieldOptions {\n  prefix?: string; // prefix to add to the path\n  nestingLevel?: number; // level of nesting to achieve\n  requiredOnly?: boolean; // only returns required nestedFields\n  existingFields?: string[]; // fields that are already selected, meaning that some sub-fields may be required\n  restrictedSubjects?: string[]; // subjectsId to ignore\n  components?: {\n    // components where components attributes can be found\n    [key: string]: any;\n  };\n}\n\n/**\n * Creates an array of paths to the fields and nested fields, without path nodes\n */\nconst getNestedFields = (\n  model: Struct.ContentTypeSchema,\n  {\n    prefix = '',\n    nestingLevel = 15,\n    components = {},\n    requiredOnly = false,\n    existingFields = [],\n  }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return prefix ? [prefix] : [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      const shouldBeIncluded = !requiredOnly || attr.required === true;\n      const insideExistingFields = existingFields && existingFields.some(startsWith(fieldPath));\n\n      if (attr.type === 'component') {\n        if (shouldBeIncluded || insideExistingFields) {\n          const compoFields = getNestedFields(components[attr.component], {\n            nestingLevel: nestingLevel - 1,\n            prefix: fieldPath,\n            components,\n            requiredOnly,\n            existingFields,\n          });\n\n          if (compoFields.length === 0 && shouldBeIncluded) {\n            return fields.concat(fieldPath);\n          }\n\n          return fields.concat(compoFields);\n        }\n        return fields;\n      }\n\n      if (shouldBeIncluded) {\n        return fields.concat(fieldPath);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of paths to the fields and nested fields, with path nodes\n */\nconst getNestedFieldsWithIntermediate = (\n  model: Struct.ContentTypeSchema,\n  { prefix = '', nestingLevel = 15, components = {} }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      fields.push(fieldPath);\n\n      if (attr.type === 'component') {\n        const compoFields = getNestedFieldsWithIntermediate(components[attr.component], {\n          nestingLevel: nestingLevel - 1,\n          prefix: fieldPath,\n          components,\n        });\n\n        fields.push(...compoFields);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of permissions with the \"properties.fields\" attribute filled\n */\nconst getPermissionsWithNestedFields = (\n  actions: any[],\n  { nestingLevel, restrictedSubjects = [] }: FieldOptions = {}\n): Modules.Permissions.PermissionRule[] => {\n  return actions.reduce((permissions, action) => {\n    const validSubjects = action.subjects.filter(\n      (subject: any) => !restrictedSubjects.includes(subject)\n    );\n\n    // Create a Permission for each subject (content-type uid) within the action\n    for (const subject of validSubjects) {\n      const fields = actionDomain.appliesToProperty('fields', action)\n        ? getNestedFields(strapi.contentTypes[subject], {\n            components: strapi.components,\n            nestingLevel,\n          })\n        : undefined;\n\n      const permission = permissionDomain.create({\n        action: action.actionId,\n        subject,\n        properties: { fields },\n      });\n\n      permissions.push(permission);\n    }\n\n    return permissions;\n  }, []);\n};\n\n/**\n * Cleans permissions' fields (add required ones, remove the non-existing ones)\n */\nconst cleanPermissionFields = (\n  permissions: Modules.Permissions.PermissionRule[]\n): Modules.Permissions.PermissionRule[] => {\n  const { actionProvider } = getService('permission');\n  const nestedFieldsCache = new Map<string, string[]>();\n\n  return permissions.map((permission: any) => {\n    const {\n      action: actionId,\n      subject,\n      properties: { fields },\n    } = permission;\n\n    const action = actionProvider.get(actionId) as any;\n\n    // todo see if it's possible to check property on action + subject (async)\n    if (!actionDomain.appliesToProperty('fields', action)) {\n      return permissionDomain.deleteProperty('fields', permission);\n    }\n\n    if (!subject || !strapi.contentTypes[subject]) {\n      return permission;\n    }\n\n    let possibleFields = nestedFieldsCache.get(subject);\n    if (!possibleFields) {\n      possibleFields = getNestedFieldsWithIntermediate(strapi.contentTypes[subject], {\n        components: strapi.components,\n      });\n      nestedFieldsCache.set(subject, possibleFields);\n    }\n\n    const currentFields: string[] = fields || [];\n\n    const validUserFields: string[] = uniq(\n      possibleFields.filter((pf) =>\n        currentFields.some((cf) => pf === cf || startsWith(`${cf}.`, pf))\n      )\n    );\n\n    // A field is considered \"not nested\" if no other valid user field starts with this field's path followed by a dot.\n    // This helps to remove redundant parent paths when a more specific child path is already included.\n    // For example, if 'component.title' is present, 'component' would be filtered out by this condition.\n    const isNotNestedField = (field: string) =>\n      !validUserFields.some(\n        (validUserField: string) =>\n          validUserField !== field && startsWith(`${field}.`, validUserField)\n      );\n\n    // Filter out fields that are parent paths of other included fields.\n    const newFields = validUserFields.filter(isNotNestedField);\n\n    return permissionDomain.setProperty('fields', newFields, permission);\n  }, []);\n};\n\nexport {\n  getNestedFields,\n  getPermissionsWithNestedFields,\n  cleanPermissionFields,\n  getNestedFieldsWithIntermediate,\n};\n"],"names":["getNestedFields","model","prefix","nestingLevel","components","requiredOnly","existingFields","nonAuthorizableFields","contentTypesUtils","getNonVisibleAttributes","_","reduce","attributes","fields","attr","key","includes","fieldPath","shouldBeIncluded","required","insideExistingFields","some","startsWith","type","compoFields","component","length","concat","getNestedFieldsWithIntermediate","push","getPermissionsWithNestedFields","actions","restrictedSubjects","permissions","action","validSubjects","subjects","filter","subject","actionDomain","appliesToProperty","strapi","contentTypes","undefined","permission","permissionDomain","create","actionId","properties","cleanPermissionFields","actionProvider","getService","nestedFieldsCache","Map","map","get","deleteProperty","possibleFields","set","currentFields","validUserFields","uniq","pf","cf","isNotNestedField","field","validUserField","newFields","setProperty"],"mappings":";;;;;;;;;;;;;AAoBA;;IAGA,MAAMA,kBAAkB,CACtBC,KAAAA,EACA,EACEC,MAAAA,GAAS,EAAE,EACXC,YAAAA,GAAe,EAAE,EACjBC,UAAAA,GAAa,EAAE,EACfC,YAAAA,GAAe,KAAK,EACpBC,cAAAA,GAAiB,EAAE,EACN,GAAA;AAEf,IAAA,IAAIH,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAOD,MAAAA,GAAS;AAACA,YAAAA;AAAO,SAAA,GAAG,EAAE;AAC/B,IAAA;IAEA,MAAMK,qBAAAA,GAAwBC,kBAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,kBAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChD,QAAA,MAAMG,gBAAAA,GAAmB,CAACb,YAAAA,IAAgBS,IAAAA,CAAKK,QAAQ,KAAK,IAAA;AAC5D,QAAA,MAAMC,oBAAAA,GAAuBd,cAAAA,IAAkBA,cAAAA,CAAee,IAAI,CAACC,aAAAA,CAAWL,SAAAA,CAAAA,CAAAA;QAE9E,IAAIH,IAAAA,CAAKS,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,IAAIL,oBAAoBE,oBAAAA,EAAsB;AAC5C,gBAAA,MAAMI,cAAcxB,eAAAA,CAAgBI,UAAU,CAACU,IAAAA,CAAKW,SAAS,CAAC,EAAE;AAC9DtB,oBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;oBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,oBAAAA,UAAAA;AACAC,oBAAAA,YAAAA;AACAC,oBAAAA;AACF,iBAAA,CAAA;AAEA,gBAAA,IAAIkB,WAAAA,CAAYE,MAAM,KAAK,CAAA,IAAKR,gBAAAA,EAAkB;oBAChD,OAAOL,MAAAA,CAAOc,MAAM,CAACV,SAAAA,CAAAA;AACvB,gBAAA;gBAEA,OAAOJ,MAAAA,CAAOc,MAAM,CAACH,WAAAA,CAAAA;AACvB,YAAA;YACA,OAAOX,MAAAA;AACT,QAAA;AAEA,QAAA,IAAIK,gBAAAA,EAAkB;YACpB,OAAOL,MAAAA,CAAOc,MAAM,CAACV,SAAAA,CAAAA;AACvB,QAAA;QAEA,OAAOJ,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMe,+BAAAA,GAAkC,CACtC3B,KAAAA,EACA,EAAEC,MAAAA,GAAS,EAAE,EAAEC,YAAAA,GAAe,EAAE,EAAEC,UAAAA,GAAa,EAAE,EAAgB,GAAA;AAEjE,IAAA,IAAID,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;IAEA,MAAMI,qBAAAA,GAAwBC,kBAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,kBAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChDF,QAAAA,MAAAA,CAAOgB,IAAI,CAACZ,SAAAA,CAAAA;QAEZ,IAAIH,IAAAA,CAAKS,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,MAAMC,cAAcI,+BAAAA,CAAgCxB,UAAU,CAACU,IAAAA,CAAKW,SAAS,CAAC,EAAE;AAC9EtB,gBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;gBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,gBAAAA;AACF,aAAA,CAAA;AAEAS,YAAAA,MAAAA,CAAOgB,IAAI,CAAA,GAAIL,WAAAA,CAAAA;AACjB,QAAA;QAEA,OAAOX,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMiB,8BAAAA,GAAiC,CACrCC,OAAAA,EACA,EAAE5B,YAAY,EAAE6B,kBAAAA,GAAqB,EAAE,EAAgB,GAAG,EAAE,GAAA;AAE5D,IAAA,OAAOD,OAAAA,CAAQpB,MAAM,CAAC,CAACsB,WAAAA,EAAaC,MAAAA,GAAAA;QAClC,MAAMC,aAAAA,GAAgBD,MAAAA,CAAOE,QAAQ,CAACC,MAAM,CAC1C,CAACC,OAAAA,GAAiB,CAACN,kBAAAA,CAAmBhB,QAAQ,CAACsB,OAAAA,CAAAA,CAAAA;;QAIjD,KAAK,MAAMA,WAAWH,aAAAA,CAAe;YACnC,MAAMtB,MAAAA,GAAS0B,OAAAA,CAAaC,iBAAiB,CAAC,QAAA,EAAUN,MAAAA,CAAAA,GACpDlC,eAAAA,CAAgByC,MAAAA,CAAOC,YAAY,CAACJ,OAAAA,CAAQ,EAAE;AAC5ClC,gBAAAA,UAAAA,EAAYqC,OAAOrC,UAAU;AAC7BD,gBAAAA;aACF,CAAA,GACAwC,SAAAA;YAEJ,MAAMC,UAAAA,GAAaC,eAAAA,CAAiBC,MAAM,CAAC;AACzCZ,gBAAAA,MAAAA,EAAQA,OAAOa,QAAQ;AACvBT,gBAAAA,OAAAA;gBACAU,UAAAA,EAAY;AAAEnC,oBAAAA;AAAO;AACvB,aAAA,CAAA;AAEAoB,YAAAA,WAAAA,CAAYJ,IAAI,CAACe,UAAAA,CAAAA;AACnB,QAAA;QAEA,OAAOX,WAAAA;AACT,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;AAEA;;IAGA,MAAMgB,wBAAwB,CAC5BhB,WAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEiB,cAAc,EAAE,GAAGC,gBAAAA,CAAW,YAAA,CAAA;AACtC,IAAA,MAAMC,oBAAoB,IAAIC,GAAAA,EAAAA;IAE9B,OAAOpB,WAAAA,CAAYqB,GAAG,CAAC,CAACV,UAAAA,GAAAA;QACtB,MAAM,EACJV,MAAAA,EAAQa,QAAQ,EAChBT,OAAO,EACPU,UAAAA,EAAY,EAAEnC,MAAM,EAAE,EACvB,GAAG+B,UAAAA;QAEJ,MAAMV,MAAAA,GAASgB,cAAAA,CAAeK,GAAG,CAACR,QAAAA,CAAAA;;AAGlC,QAAA,IAAI,CAACR,OAAAA,CAAaC,iBAAiB,CAAC,UAAUN,MAAAA,CAAAA,EAAS;YACrD,OAAOW,eAAAA,CAAiBW,cAAc,CAAC,QAAA,EAAUZ,UAAAA,CAAAA;AACnD,QAAA;AAEA,QAAA,IAAI,CAACN,OAAAA,IAAW,CAACG,OAAOC,YAAY,CAACJ,QAAQ,EAAE;YAC7C,OAAOM,UAAAA;AACT,QAAA;QAEA,IAAIa,cAAAA,GAAiBL,iBAAAA,CAAkBG,GAAG,CAACjB,OAAAA,CAAAA;AAC3C,QAAA,IAAI,CAACmB,cAAAA,EAAgB;AACnBA,YAAAA,cAAAA,GAAiB7B,+BAAAA,CAAgCa,MAAAA,CAAOC,YAAY,CAACJ,QAAQ,EAAE;AAC7ElC,gBAAAA,UAAAA,EAAYqC,OAAOrC;AACrB,aAAA,CAAA;YACAgD,iBAAAA,CAAkBM,GAAG,CAACpB,OAAAA,EAASmB,cAAAA,CAAAA;AACjC,QAAA;QAEA,MAAME,aAAAA,GAA0B9C,UAAU,EAAE;AAE5C,QAAA,MAAM+C,kBAA4BC,OAAAA,CAChCJ,cAAAA,CAAepB,MAAM,CAAC,CAACyB,KACrBH,aAAAA,CAActC,IAAI,CAAC,CAAC0C,EAAAA,GAAOD,OAAOC,EAAAA,IAAMzC,aAAAA,CAAW,GAAGyC,EAAAA,CAAG,CAAC,CAAC,EAAED,EAAAA,CAAAA,CAAAA,CAAAA,CAAAA;;;;AAOjE,QAAA,MAAME,mBAAmB,CAACC,KAAAA,GACxB,CAACL,eAAAA,CAAgBvC,IAAI,CACnB,CAAC6C,cAAAA,GACCA,cAAAA,KAAmBD,SAAS3C,aAAAA,CAAW,CAAA,EAAG2C,KAAAA,CAAM,CAAC,CAAC,EAAEC,cAAAA,CAAAA,CAAAA;;QAI1D,MAAMC,SAAAA,GAAYP,eAAAA,CAAgBvB,MAAM,CAAC2B,gBAAAA,CAAAA;AAEzC,QAAA,OAAOnB,eAAAA,CAAiBuB,WAAW,CAAC,QAAA,EAAUD,SAAAA,EAAWvB,UAAAA,CAAAA;AAC3D,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;;;;;;;"}
+{"version":3,"file":"content-type.js","sources":["../../../../../server/src/services/content-type.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { contentTypes as contentTypesUtils } from '@strapi/utils';\nimport type { Modules, Struct } from '@strapi/types';\nimport { getService } from '../utils';\nimport actionDomain from '../domain/action';\nimport permissionDomain from '../domain/permission';\n\ninterface FieldOptions {\n  prefix?: string; // prefix to add to the path\n  nestingLevel?: number; // level of nesting to achieve\n  requiredOnly?: boolean; // only returns required nestedFields\n  existingFields?: string[]; // fields that are already selected, meaning that some sub-fields may be required\n  restrictedSubjects?: string[]; // subjectsId to ignore\n  components?: {\n    // components where components attributes can be found\n    [key: string]: any;\n  };\n}\n\n/**\n * Creates an array of paths to the fields and nested fields, without path nodes\n */\nconst getNestedFields = (\n  model: Struct.ContentTypeSchema,\n  {\n    prefix = '',\n    nestingLevel = 15,\n    components = {},\n    requiredOnly = false,\n    existingFields = [],\n  }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return prefix ? [prefix] : [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      const shouldBeIncluded = !requiredOnly || attr.required === true;\n      const insideExistingFields =\n        existingFields && existingFields.some((field) => field.startsWith(fieldPath));\n\n      if (attr.type === 'component') {\n        if (shouldBeIncluded || insideExistingFields) {\n          const compoFields = getNestedFields(components[attr.component], {\n            nestingLevel: nestingLevel - 1,\n            prefix: fieldPath,\n            components,\n            requiredOnly,\n            existingFields,\n          });\n\n          if (compoFields.length === 0 && shouldBeIncluded) {\n            return fields.concat(fieldPath);\n          }\n\n          return fields.concat(compoFields);\n        }\n        return fields;\n      }\n\n      if (shouldBeIncluded) {\n        return fields.concat(fieldPath);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of paths to the fields and nested fields, with path nodes\n */\nconst getNestedFieldsWithIntermediate = (\n  model: Struct.ContentTypeSchema,\n  { prefix = '', nestingLevel = 15, components = {} }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      fields.push(fieldPath);\n\n      if (attr.type === 'component') {\n        const compoFields = getNestedFieldsWithIntermediate(components[attr.component], {\n          nestingLevel: nestingLevel - 1,\n          prefix: fieldPath,\n          components,\n        });\n\n        fields.push(...compoFields);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of permissions with the \"properties.fields\" attribute filled\n */\nconst getPermissionsWithNestedFields = (\n  actions: any[],\n  { nestingLevel, restrictedSubjects = [] }: FieldOptions = {}\n): Modules.Permissions.PermissionRule[] => {\n  return actions.reduce((permissions, action) => {\n    const validSubjects = action.subjects.filter(\n      (subject: any) => !restrictedSubjects.includes(subject)\n    );\n\n    // Create a Permission for each subject (content-type uid) within the action\n    for (const subject of validSubjects) {\n      const fields = actionDomain.appliesToProperty('fields', action)\n        ? getNestedFields(strapi.contentTypes[subject], {\n            components: strapi.components,\n            nestingLevel,\n          })\n        : undefined;\n\n      const permission = permissionDomain.create({\n        action: action.actionId,\n        subject,\n        properties: { fields },\n      });\n\n      permissions.push(permission);\n    }\n\n    return permissions;\n  }, []);\n};\n\n/**\n * Cleans permissions' fields (add required ones, remove the non-existing ones)\n */\nconst cleanPermissionFields = (\n  permissions: Modules.Permissions.PermissionRule[]\n): Modules.Permissions.PermissionRule[] => {\n  const { actionProvider } = getService('permission');\n  const nestedFieldsCache = new Map<string, string[]>();\n\n  return permissions.map((permission: any) => {\n    const {\n      action: actionId,\n      subject,\n      properties: { fields },\n    } = permission;\n\n    const action = actionProvider.get(actionId) as any;\n\n    // todo see if it's possible to check property on action + subject (async)\n    if (!actionDomain.appliesToProperty('fields', action)) {\n      return permissionDomain.deleteProperty('fields', permission);\n    }\n\n    if (!subject || !strapi.contentTypes[subject]) {\n      return permission;\n    }\n\n    let possibleFields = nestedFieldsCache.get(subject);\n    if (!possibleFields) {\n      possibleFields = getNestedFieldsWithIntermediate(strapi.contentTypes[subject], {\n        components: strapi.components,\n      });\n      nestedFieldsCache.set(subject, possibleFields);\n    }\n\n    const currentFields: string[] = fields || [];\n\n    const validUserFields: string[] = [\n      ...new Set(\n        possibleFields.filter((pf) =>\n          currentFields.some((cf) => pf === cf || pf.startsWith(`${cf}.`))\n        )\n      ),\n    ];\n\n    // A field is considered \"not nested\" if no other valid user field starts with this field's path followed by a dot.\n    // This helps to remove redundant parent paths when a more specific child path is already included.\n    // For example, if 'component.title' is present, 'component' would be filtered out by this condition.\n    const isNotNestedField = (field: string) =>\n      !validUserFields.some(\n        (validUserField: string) =>\n          validUserField !== field && validUserField.startsWith(`${field}.`)\n      );\n\n    // Filter out fields that are parent paths of other included fields.\n    const newFields = validUserFields.filter(isNotNestedField);\n\n    return permissionDomain.setProperty('fields', newFields, permission);\n  }, []);\n};\n\nexport {\n  getNestedFields,\n  getPermissionsWithNestedFields,\n  cleanPermissionFields,\n  getNestedFieldsWithIntermediate,\n};\n"],"names":["getNestedFields","model","prefix","nestingLevel","components","requiredOnly","existingFields","nonAuthorizableFields","contentTypesUtils","getNonVisibleAttributes","_","reduce","attributes","fields","attr","key","includes","fieldPath","shouldBeIncluded","required","insideExistingFields","some","field","startsWith","type","compoFields","component","length","concat","getNestedFieldsWithIntermediate","push","getPermissionsWithNestedFields","actions","restrictedSubjects","permissions","action","validSubjects","subjects","filter","subject","actionDomain","appliesToProperty","strapi","contentTypes","undefined","permission","permissionDomain","create","actionId","properties","cleanPermissionFields","actionProvider","getService","nestedFieldsCache","Map","map","get","deleteProperty","possibleFields","set","currentFields","validUserFields","Set","pf","cf","isNotNestedField","validUserField","newFields","setProperty"],"mappings":";;;;;;;;;;;;AAoBA;;IAGA,MAAMA,kBAAkB,CACtBC,KAAAA,EACA,EACEC,MAAAA,GAAS,EAAE,EACXC,YAAAA,GAAe,EAAE,EACjBC,UAAAA,GAAa,EAAE,EACfC,YAAAA,GAAe,KAAK,EACpBC,cAAAA,GAAiB,EAAE,EACN,GAAA;AAEf,IAAA,IAAIH,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAOD,MAAAA,GAAS;AAACA,YAAAA;AAAO,SAAA,GAAG,EAAE;AAC/B,IAAA;IAEA,MAAMK,qBAAAA,GAAwBC,kBAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,kBAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChD,QAAA,MAAMG,gBAAAA,GAAmB,CAACb,YAAAA,IAAgBS,IAAAA,CAAKK,QAAQ,KAAK,IAAA;QAC5D,MAAMC,oBAAAA,GACJd,kBAAkBA,cAAAA,CAAee,IAAI,CAAC,CAACC,KAAAA,GAAUA,KAAAA,CAAMC,UAAU,CAACN,SAAAA,CAAAA,CAAAA;QAEpE,IAAIH,IAAAA,CAAKU,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,IAAIN,oBAAoBE,oBAAAA,EAAsB;AAC5C,gBAAA,MAAMK,cAAczB,eAAAA,CAAgBI,UAAU,CAACU,IAAAA,CAAKY,SAAS,CAAC,EAAE;AAC9DvB,oBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;oBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,oBAAAA,UAAAA;AACAC,oBAAAA,YAAAA;AACAC,oBAAAA;AACF,iBAAA,CAAA;AAEA,gBAAA,IAAImB,WAAAA,CAAYE,MAAM,KAAK,CAAA,IAAKT,gBAAAA,EAAkB;oBAChD,OAAOL,MAAAA,CAAOe,MAAM,CAACX,SAAAA,CAAAA;AACvB,gBAAA;gBAEA,OAAOJ,MAAAA,CAAOe,MAAM,CAACH,WAAAA,CAAAA;AACvB,YAAA;YACA,OAAOZ,MAAAA;AACT,QAAA;AAEA,QAAA,IAAIK,gBAAAA,EAAkB;YACpB,OAAOL,MAAAA,CAAOe,MAAM,CAACX,SAAAA,CAAAA;AACvB,QAAA;QAEA,OAAOJ,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMgB,+BAAAA,GAAkC,CACtC5B,KAAAA,EACA,EAAEC,MAAAA,GAAS,EAAE,EAAEC,YAAAA,GAAe,EAAE,EAAEC,UAAAA,GAAa,EAAE,EAAgB,GAAA;AAEjE,IAAA,IAAID,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;IAEA,MAAMI,qBAAAA,GAAwBC,kBAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,kBAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChDF,QAAAA,MAAAA,CAAOiB,IAAI,CAACb,SAAAA,CAAAA;QAEZ,IAAIH,IAAAA,CAAKU,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,MAAMC,cAAcI,+BAAAA,CAAgCzB,UAAU,CAACU,IAAAA,CAAKY,SAAS,CAAC,EAAE;AAC9EvB,gBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;gBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,gBAAAA;AACF,aAAA,CAAA;AAEAS,YAAAA,MAAAA,CAAOiB,IAAI,CAAA,GAAIL,WAAAA,CAAAA;AACjB,QAAA;QAEA,OAAOZ,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMkB,8BAAAA,GAAiC,CACrCC,OAAAA,EACA,EAAE7B,YAAY,EAAE8B,kBAAAA,GAAqB,EAAE,EAAgB,GAAG,EAAE,GAAA;AAE5D,IAAA,OAAOD,OAAAA,CAAQrB,MAAM,CAAC,CAACuB,WAAAA,EAAaC,MAAAA,GAAAA;QAClC,MAAMC,aAAAA,GAAgBD,MAAAA,CAAOE,QAAQ,CAACC,MAAM,CAC1C,CAACC,OAAAA,GAAiB,CAACN,kBAAAA,CAAmBjB,QAAQ,CAACuB,OAAAA,CAAAA,CAAAA;;QAIjD,KAAK,MAAMA,WAAWH,aAAAA,CAAe;YACnC,MAAMvB,MAAAA,GAAS2B,OAAAA,CAAaC,iBAAiB,CAAC,QAAA,EAAUN,MAAAA,CAAAA,GACpDnC,eAAAA,CAAgB0C,MAAAA,CAAOC,YAAY,CAACJ,OAAAA,CAAQ,EAAE;AAC5CnC,gBAAAA,UAAAA,EAAYsC,OAAOtC,UAAU;AAC7BD,gBAAAA;aACF,CAAA,GACAyC,SAAAA;YAEJ,MAAMC,UAAAA,GAAaC,eAAAA,CAAiBC,MAAM,CAAC;AACzCZ,gBAAAA,MAAAA,EAAQA,OAAOa,QAAQ;AACvBT,gBAAAA,OAAAA;gBACAU,UAAAA,EAAY;AAAEpC,oBAAAA;AAAO;AACvB,aAAA,CAAA;AAEAqB,YAAAA,WAAAA,CAAYJ,IAAI,CAACe,UAAAA,CAAAA;AACnB,QAAA;QAEA,OAAOX,WAAAA;AACT,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;AAEA;;IAGA,MAAMgB,wBAAwB,CAC5BhB,WAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEiB,cAAc,EAAE,GAAGC,gBAAAA,CAAW,YAAA,CAAA;AACtC,IAAA,MAAMC,oBAAoB,IAAIC,GAAAA,EAAAA;IAE9B,OAAOpB,WAAAA,CAAYqB,GAAG,CAAC,CAACV,UAAAA,GAAAA;QACtB,MAAM,EACJV,MAAAA,EAAQa,QAAQ,EAChBT,OAAO,EACPU,UAAAA,EAAY,EAAEpC,MAAM,EAAE,EACvB,GAAGgC,UAAAA;QAEJ,MAAMV,MAAAA,GAASgB,cAAAA,CAAeK,GAAG,CAACR,QAAAA,CAAAA;;AAGlC,QAAA,IAAI,CAACR,OAAAA,CAAaC,iBAAiB,CAAC,UAAUN,MAAAA,CAAAA,EAAS;YACrD,OAAOW,eAAAA,CAAiBW,cAAc,CAAC,QAAA,EAAUZ,UAAAA,CAAAA;AACnD,QAAA;AAEA,QAAA,IAAI,CAACN,OAAAA,IAAW,CAACG,OAAOC,YAAY,CAACJ,QAAQ,EAAE;YAC7C,OAAOM,UAAAA;AACT,QAAA;QAEA,IAAIa,cAAAA,GAAiBL,iBAAAA,CAAkBG,GAAG,CAACjB,OAAAA,CAAAA;AAC3C,QAAA,IAAI,CAACmB,cAAAA,EAAgB;AACnBA,YAAAA,cAAAA,GAAiB7B,+BAAAA,CAAgCa,MAAAA,CAAOC,YAAY,CAACJ,QAAQ,EAAE;AAC7EnC,gBAAAA,UAAAA,EAAYsC,OAAOtC;AACrB,aAAA,CAAA;YACAiD,iBAAAA,CAAkBM,GAAG,CAACpB,OAAAA,EAASmB,cAAAA,CAAAA;AACjC,QAAA;QAEA,MAAME,aAAAA,GAA0B/C,UAAU,EAAE;AAE5C,QAAA,MAAMgD,eAAAA,GAA4B;AAC7B,YAAA,GAAA,IAAIC,IACLJ,cAAAA,CAAepB,MAAM,CAAC,CAACyB,EAAAA,GACrBH,cAAcvC,IAAI,CAAC,CAAC2C,EAAAA,GAAOD,EAAAA,KAAOC,MAAMD,EAAAA,CAAGxC,UAAU,CAAC,CAAA,EAAGyC,EAAAA,CAAG,CAAC,CAAC,CAAA,CAAA,CAAA;AAGnE,SAAA;;;;AAKD,QAAA,MAAMC,mBAAmB,CAAC3C,KAAAA,GACxB,CAACuC,eAAAA,CAAgBxC,IAAI,CACnB,CAAC6C,cAAAA,GACCA,cAAAA,KAAmB5C,SAAS4C,cAAAA,CAAe3C,UAAU,CAAC,CAAA,EAAGD,KAAAA,CAAM,CAAC,CAAC,CAAA,CAAA;;QAIvE,MAAM6C,SAAAA,GAAYN,eAAAA,CAAgBvB,MAAM,CAAC2B,gBAAAA,CAAAA;AAEzC,QAAA,OAAOnB,eAAAA,CAAiBsB,WAAW,CAAC,QAAA,EAAUD,SAAAA,EAAWtB,UAAAA,CAAAA;AAC3D,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;;;;;;;"}

package/dist/server/server/src/services/content-type.mjs

@@ -1,8 +1,7 @@
 import ___default from 'lodash';
-import { uniq, startsWith } from 'lodash/fp';
 import { contentTypes } from '@strapi/utils';
 import { getService } from '../utils/index.mjs';
-import actionDomain from '../domain/action/index.mjs';
+import domain from '../domain/action/index.mjs';
 import permissionDomain from '../domain/permission/index.mjs';
 
 /**
@@ -18,7 +17,7 @@ import permissionDomain from '../domain/permission/index.mjs';
         if (nonAuthorizableFields.includes(key)) return fields;
         const fieldPath = prefix ? `${prefix}.${key}` : key;
         const shouldBeIncluded = !requiredOnly || attr.required === true;
-        const insideExistingFields = existingFields && existingFields.some(startsWith(fieldPath));
+        const insideExistingFields = existingFields && existingFields.some((field)=>field.startsWith(fieldPath));
         if (attr.type === 'component') {
             if (shouldBeIncluded || insideExistingFields) {
                 const compoFields = getNestedFields(components[attr.component], {
@@ -70,7 +69,7 @@ import permissionDomain from '../domain/permission/index.mjs';
         const validSubjects = action.subjects.filter((subject)=>!restrictedSubjects.includes(subject));
         // Create a Permission for each subject (content-type uid) within the action
         for (const subject of validSubjects){
-            const fields = actionDomain.appliesToProperty('fields', action) ? getNestedFields(strapi.contentTypes[subject], {
+            const fields = domain.appliesToProperty('fields', action) ? getNestedFields(strapi.contentTypes[subject], {
                 components: strapi.components,
                 nestingLevel
             }) : undefined;
@@ -95,7 +94,7 @@ import permissionDomain from '../domain/permission/index.mjs';
         const { action: actionId, subject, properties: { fields } } = permission;
         const action = actionProvider.get(actionId);
         // todo see if it's possible to check property on action + subject (async)
-        if (!actionDomain.appliesToProperty('fields', action)) {
+        if (!domain.appliesToProperty('fields', action)) {
             return permissionDomain.deleteProperty('fields', permission);
         }
         if (!subject || !strapi.contentTypes[subject]) {
@@ -109,11 +108,13 @@ import permissionDomain from '../domain/permission/index.mjs';
             nestedFieldsCache.set(subject, possibleFields);
         }
         const currentFields = fields || [];
-        const validUserFields = uniq(possibleFields.filter((pf)=>currentFields.some((cf)=>pf === cf || startsWith(`${cf}.`, pf))));
+        const validUserFields = [
+            ...new Set(possibleFields.filter((pf)=>currentFields.some((cf)=>pf === cf || pf.startsWith(`${cf}.`))))
+        ];
         // A field is considered "not nested" if no other valid user field starts with this field's path followed by a dot.
         // This helps to remove redundant parent paths when a more specific child path is already included.
         // For example, if 'component.title' is present, 'component' would be filtered out by this condition.
-        const isNotNestedField = (field)=>!validUserFields.some((validUserField)=>validUserField !== field && startsWith(`${field}.`, validUserField));
+        const isNotNestedField = (field)=>!validUserFields.some((validUserField)=>validUserField !== field && validUserField.startsWith(`${field}.`));
         // Filter out fields that are parent paths of other included fields.
         const newFields = validUserFields.filter(isNotNestedField);
         return permissionDomain.setProperty('fields', newFields, permission);

package/dist/server/server/src/services/content-type.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"content-type.mjs","sources":["../../../../../server/src/services/content-type.ts"],"sourcesContent":["import _ from 'lodash';\nimport { uniq, startsWith } from 'lodash/fp';\nimport { contentTypes as contentTypesUtils } from '@strapi/utils';\nimport type { Modules, Struct } from '@strapi/types';\nimport { getService } from '../utils';\nimport actionDomain from '../domain/action';\nimport permissionDomain from '../domain/permission';\n\ninterface FieldOptions {\n  prefix?: string; // prefix to add to the path\n  nestingLevel?: number; // level of nesting to achieve\n  requiredOnly?: boolean; // only returns required nestedFields\n  existingFields?: string[]; // fields that are already selected, meaning that some sub-fields may be required\n  restrictedSubjects?: string[]; // subjectsId to ignore\n  components?: {\n    // components where components attributes can be found\n    [key: string]: any;\n  };\n}\n\n/**\n * Creates an array of paths to the fields and nested fields, without path nodes\n */\nconst getNestedFields = (\n  model: Struct.ContentTypeSchema,\n  {\n    prefix = '',\n    nestingLevel = 15,\n    components = {},\n    requiredOnly = false,\n    existingFields = [],\n  }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return prefix ? [prefix] : [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      const shouldBeIncluded = !requiredOnly || attr.required === true;\n      const insideExistingFields = existingFields && existingFields.some(startsWith(fieldPath));\n\n      if (attr.type === 'component') {\n        if (shouldBeIncluded || insideExistingFields) {\n          const compoFields = getNestedFields(components[attr.component], {\n            nestingLevel: nestingLevel - 1,\n            prefix: fieldPath,\n            components,\n            requiredOnly,\n            existingFields,\n          });\n\n          if (compoFields.length === 0 && shouldBeIncluded) {\n            return fields.concat(fieldPath);\n          }\n\n          return fields.concat(compoFields);\n        }\n        return fields;\n      }\n\n      if (shouldBeIncluded) {\n        return fields.concat(fieldPath);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of paths to the fields and nested fields, with path nodes\n */\nconst getNestedFieldsWithIntermediate = (\n  model: Struct.ContentTypeSchema,\n  { prefix = '', nestingLevel = 15, components = {} }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      fields.push(fieldPath);\n\n      if (attr.type === 'component') {\n        const compoFields = getNestedFieldsWithIntermediate(components[attr.component], {\n          nestingLevel: nestingLevel - 1,\n          prefix: fieldPath,\n          components,\n        });\n\n        fields.push(...compoFields);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of permissions with the \"properties.fields\" attribute filled\n */\nconst getPermissionsWithNestedFields = (\n  actions: any[],\n  { nestingLevel, restrictedSubjects = [] }: FieldOptions = {}\n): Modules.Permissions.PermissionRule[] => {\n  return actions.reduce((permissions, action) => {\n    const validSubjects = action.subjects.filter(\n      (subject: any) => !restrictedSubjects.includes(subject)\n    );\n\n    // Create a Permission for each subject (content-type uid) within the action\n    for (const subject of validSubjects) {\n      const fields = actionDomain.appliesToProperty('fields', action)\n        ? getNestedFields(strapi.contentTypes[subject], {\n            components: strapi.components,\n            nestingLevel,\n          })\n        : undefined;\n\n      const permission = permissionDomain.create({\n        action: action.actionId,\n        subject,\n        properties: { fields },\n      });\n\n      permissions.push(permission);\n    }\n\n    return permissions;\n  }, []);\n};\n\n/**\n * Cleans permissions' fields (add required ones, remove the non-existing ones)\n */\nconst cleanPermissionFields = (\n  permissions: Modules.Permissions.PermissionRule[]\n): Modules.Permissions.PermissionRule[] => {\n  const { actionProvider } = getService('permission');\n  const nestedFieldsCache = new Map<string, string[]>();\n\n  return permissions.map((permission: any) => {\n    const {\n      action: actionId,\n      subject,\n      properties: { fields },\n    } = permission;\n\n    const action = actionProvider.get(actionId) as any;\n\n    // todo see if it's possible to check property on action + subject (async)\n    if (!actionDomain.appliesToProperty('fields', action)) {\n      return permissionDomain.deleteProperty('fields', permission);\n    }\n\n    if (!subject || !strapi.contentTypes[subject]) {\n      return permission;\n    }\n\n    let possibleFields = nestedFieldsCache.get(subject);\n    if (!possibleFields) {\n      possibleFields = getNestedFieldsWithIntermediate(strapi.contentTypes[subject], {\n        components: strapi.components,\n      });\n      nestedFieldsCache.set(subject, possibleFields);\n    }\n\n    const currentFields: string[] = fields || [];\n\n    const validUserFields: string[] = uniq(\n      possibleFields.filter((pf) =>\n        currentFields.some((cf) => pf === cf || startsWith(`${cf}.`, pf))\n      )\n    );\n\n    // A field is considered \"not nested\" if no other valid user field starts with this field's path followed by a dot.\n    // This helps to remove redundant parent paths when a more specific child path is already included.\n    // For example, if 'component.title' is present, 'component' would be filtered out by this condition.\n    const isNotNestedField = (field: string) =>\n      !validUserFields.some(\n        (validUserField: string) =>\n          validUserField !== field && startsWith(`${field}.`, validUserField)\n      );\n\n    // Filter out fields that are parent paths of other included fields.\n    const newFields = validUserFields.filter(isNotNestedField);\n\n    return permissionDomain.setProperty('fields', newFields, permission);\n  }, []);\n};\n\nexport {\n  getNestedFields,\n  getPermissionsWithNestedFields,\n  cleanPermissionFields,\n  getNestedFieldsWithIntermediate,\n};\n"],"names":["getNestedFields","model","prefix","nestingLevel","components","requiredOnly","existingFields","nonAuthorizableFields","contentTypesUtils","getNonVisibleAttributes","_","reduce","attributes","fields","attr","key","includes","fieldPath","shouldBeIncluded","required","insideExistingFields","some","startsWith","type","compoFields","component","length","concat","getNestedFieldsWithIntermediate","push","getPermissionsWithNestedFields","actions","restrictedSubjects","permissions","action","validSubjects","subjects","filter","subject","actionDomain","appliesToProperty","strapi","contentTypes","undefined","permission","permissionDomain","create","actionId","properties","cleanPermissionFields","actionProvider","getService","nestedFieldsCache","Map","map","get","deleteProperty","possibleFields","set","currentFields","validUserFields","uniq","pf","cf","isNotNestedField","field","validUserField","newFields","setProperty"],"mappings":";;;;;;;AAoBA;;IAGA,MAAMA,kBAAkB,CACtBC,KAAAA,EACA,EACEC,MAAAA,GAAS,EAAE,EACXC,YAAAA,GAAe,EAAE,EACjBC,UAAAA,GAAa,EAAE,EACfC,YAAAA,GAAe,KAAK,EACpBC,cAAAA,GAAiB,EAAE,EACN,GAAA;AAEf,IAAA,IAAIH,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAOD,MAAAA,GAAS;AAACA,YAAAA;AAAO,SAAA,GAAG,EAAE;AAC/B,IAAA;IAEA,MAAMK,qBAAAA,GAAwBC,YAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,UAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChD,QAAA,MAAMG,gBAAAA,GAAmB,CAACb,YAAAA,IAAgBS,IAAAA,CAAKK,QAAQ,KAAK,IAAA;AAC5D,QAAA,MAAMC,oBAAAA,GAAuBd,cAAAA,IAAkBA,cAAAA,CAAee,IAAI,CAACC,UAAAA,CAAWL,SAAAA,CAAAA,CAAAA;QAE9E,IAAIH,IAAAA,CAAKS,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,IAAIL,oBAAoBE,oBAAAA,EAAsB;AAC5C,gBAAA,MAAMI,cAAcxB,eAAAA,CAAgBI,UAAU,CAACU,IAAAA,CAAKW,SAAS,CAAC,EAAE;AAC9DtB,oBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;oBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,oBAAAA,UAAAA;AACAC,oBAAAA,YAAAA;AACAC,oBAAAA;AACF,iBAAA,CAAA;AAEA,gBAAA,IAAIkB,WAAAA,CAAYE,MAAM,KAAK,CAAA,IAAKR,gBAAAA,EAAkB;oBAChD,OAAOL,MAAAA,CAAOc,MAAM,CAACV,SAAAA,CAAAA;AACvB,gBAAA;gBAEA,OAAOJ,MAAAA,CAAOc,MAAM,CAACH,WAAAA,CAAAA;AACvB,YAAA;YACA,OAAOX,MAAAA;AACT,QAAA;AAEA,QAAA,IAAIK,gBAAAA,EAAkB;YACpB,OAAOL,MAAAA,CAAOc,MAAM,CAACV,SAAAA,CAAAA;AACvB,QAAA;QAEA,OAAOJ,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMe,+BAAAA,GAAkC,CACtC3B,KAAAA,EACA,EAAEC,MAAAA,GAAS,EAAE,EAAEC,YAAAA,GAAe,EAAE,EAAEC,UAAAA,GAAa,EAAE,EAAgB,GAAA;AAEjE,IAAA,IAAID,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;IAEA,MAAMI,qBAAAA,GAAwBC,YAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,UAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChDF,QAAAA,MAAAA,CAAOgB,IAAI,CAACZ,SAAAA,CAAAA;QAEZ,IAAIH,IAAAA,CAAKS,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,MAAMC,cAAcI,+BAAAA,CAAgCxB,UAAU,CAACU,IAAAA,CAAKW,SAAS,CAAC,EAAE;AAC9EtB,gBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;gBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,gBAAAA;AACF,aAAA,CAAA;AAEAS,YAAAA,MAAAA,CAAOgB,IAAI,CAAA,GAAIL,WAAAA,CAAAA;AACjB,QAAA;QAEA,OAAOX,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMiB,8BAAAA,GAAiC,CACrCC,OAAAA,EACA,EAAE5B,YAAY,EAAE6B,kBAAAA,GAAqB,EAAE,EAAgB,GAAG,EAAE,GAAA;AAE5D,IAAA,OAAOD,OAAAA,CAAQpB,MAAM,CAAC,CAACsB,WAAAA,EAAaC,MAAAA,GAAAA;QAClC,MAAMC,aAAAA,GAAgBD,MAAAA,CAAOE,QAAQ,CAACC,MAAM,CAC1C,CAACC,OAAAA,GAAiB,CAACN,kBAAAA,CAAmBhB,QAAQ,CAACsB,OAAAA,CAAAA,CAAAA;;QAIjD,KAAK,MAAMA,WAAWH,aAAAA,CAAe;YACnC,MAAMtB,MAAAA,GAAS0B,YAAAA,CAAaC,iBAAiB,CAAC,QAAA,EAAUN,MAAAA,CAAAA,GACpDlC,eAAAA,CAAgByC,MAAAA,CAAOC,YAAY,CAACJ,OAAAA,CAAQ,EAAE;AAC5ClC,gBAAAA,UAAAA,EAAYqC,OAAOrC,UAAU;AAC7BD,gBAAAA;aACF,CAAA,GACAwC,SAAAA;YAEJ,MAAMC,UAAAA,GAAaC,gBAAAA,CAAiBC,MAAM,CAAC;AACzCZ,gBAAAA,MAAAA,EAAQA,OAAOa,QAAQ;AACvBT,gBAAAA,OAAAA;gBACAU,UAAAA,EAAY;AAAEnC,oBAAAA;AAAO;AACvB,aAAA,CAAA;AAEAoB,YAAAA,WAAAA,CAAYJ,IAAI,CAACe,UAAAA,CAAAA;AACnB,QAAA;QAEA,OAAOX,WAAAA;AACT,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;AAEA;;IAGA,MAAMgB,wBAAwB,CAC5BhB,WAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEiB,cAAc,EAAE,GAAGC,UAAAA,CAAW,YAAA,CAAA;AACtC,IAAA,MAAMC,oBAAoB,IAAIC,GAAAA,EAAAA;IAE9B,OAAOpB,WAAAA,CAAYqB,GAAG,CAAC,CAACV,UAAAA,GAAAA;QACtB,MAAM,EACJV,MAAAA,EAAQa,QAAQ,EAChBT,OAAO,EACPU,UAAAA,EAAY,EAAEnC,MAAM,EAAE,EACvB,GAAG+B,UAAAA;QAEJ,MAAMV,MAAAA,GAASgB,cAAAA,CAAeK,GAAG,CAACR,QAAAA,CAAAA;;AAGlC,QAAA,IAAI,CAACR,YAAAA,CAAaC,iBAAiB,CAAC,UAAUN,MAAAA,CAAAA,EAAS;YACrD,OAAOW,gBAAAA,CAAiBW,cAAc,CAAC,QAAA,EAAUZ,UAAAA,CAAAA;AACnD,QAAA;AAEA,QAAA,IAAI,CAACN,OAAAA,IAAW,CAACG,OAAOC,YAAY,CAACJ,QAAQ,EAAE;YAC7C,OAAOM,UAAAA;AACT,QAAA;QAEA,IAAIa,cAAAA,GAAiBL,iBAAAA,CAAkBG,GAAG,CAACjB,OAAAA,CAAAA;AAC3C,QAAA,IAAI,CAACmB,cAAAA,EAAgB;AACnBA,YAAAA,cAAAA,GAAiB7B,+BAAAA,CAAgCa,MAAAA,CAAOC,YAAY,CAACJ,QAAQ,EAAE;AAC7ElC,gBAAAA,UAAAA,EAAYqC,OAAOrC;AACrB,aAAA,CAAA;YACAgD,iBAAAA,CAAkBM,GAAG,CAACpB,OAAAA,EAASmB,cAAAA,CAAAA;AACjC,QAAA;QAEA,MAAME,aAAAA,GAA0B9C,UAAU,EAAE;AAE5C,QAAA,MAAM+C,kBAA4BC,IAAAA,CAChCJ,cAAAA,CAAepB,MAAM,CAAC,CAACyB,KACrBH,aAAAA,CAActC,IAAI,CAAC,CAAC0C,EAAAA,GAAOD,OAAOC,EAAAA,IAAMzC,UAAAA,CAAW,GAAGyC,EAAAA,CAAG,CAAC,CAAC,EAAED,EAAAA,CAAAA,CAAAA,CAAAA,CAAAA;;;;AAOjE,QAAA,MAAME,mBAAmB,CAACC,KAAAA,GACxB,CAACL,eAAAA,CAAgBvC,IAAI,CACnB,CAAC6C,cAAAA,GACCA,cAAAA,KAAmBD,SAAS3C,UAAAA,CAAW,CAAA,EAAG2C,KAAAA,CAAM,CAAC,CAAC,EAAEC,cAAAA,CAAAA,CAAAA;;QAI1D,MAAMC,SAAAA,GAAYP,eAAAA,CAAgBvB,MAAM,CAAC2B,gBAAAA,CAAAA;AAEzC,QAAA,OAAOnB,gBAAAA,CAAiBuB,WAAW,CAAC,QAAA,EAAUD,SAAAA,EAAWvB,UAAAA,CAAAA;AAC3D,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;;;;"}
+{"version":3,"file":"content-type.mjs","sources":["../../../../../server/src/services/content-type.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { contentTypes as contentTypesUtils } from '@strapi/utils';\nimport type { Modules, Struct } from '@strapi/types';\nimport { getService } from '../utils';\nimport actionDomain from '../domain/action';\nimport permissionDomain from '../domain/permission';\n\ninterface FieldOptions {\n  prefix?: string; // prefix to add to the path\n  nestingLevel?: number; // level of nesting to achieve\n  requiredOnly?: boolean; // only returns required nestedFields\n  existingFields?: string[]; // fields that are already selected, meaning that some sub-fields may be required\n  restrictedSubjects?: string[]; // subjectsId to ignore\n  components?: {\n    // components where components attributes can be found\n    [key: string]: any;\n  };\n}\n\n/**\n * Creates an array of paths to the fields and nested fields, without path nodes\n */\nconst getNestedFields = (\n  model: Struct.ContentTypeSchema,\n  {\n    prefix = '',\n    nestingLevel = 15,\n    components = {},\n    requiredOnly = false,\n    existingFields = [],\n  }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return prefix ? [prefix] : [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      const shouldBeIncluded = !requiredOnly || attr.required === true;\n      const insideExistingFields =\n        existingFields && existingFields.some((field) => field.startsWith(fieldPath));\n\n      if (attr.type === 'component') {\n        if (shouldBeIncluded || insideExistingFields) {\n          const compoFields = getNestedFields(components[attr.component], {\n            nestingLevel: nestingLevel - 1,\n            prefix: fieldPath,\n            components,\n            requiredOnly,\n            existingFields,\n          });\n\n          if (compoFields.length === 0 && shouldBeIncluded) {\n            return fields.concat(fieldPath);\n          }\n\n          return fields.concat(compoFields);\n        }\n        return fields;\n      }\n\n      if (shouldBeIncluded) {\n        return fields.concat(fieldPath);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of paths to the fields and nested fields, with path nodes\n */\nconst getNestedFieldsWithIntermediate = (\n  model: Struct.ContentTypeSchema,\n  { prefix = '', nestingLevel = 15, components = {} }: FieldOptions\n): string[] => {\n  if (nestingLevel === 0) {\n    return [];\n  }\n\n  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);\n\n  return _.reduce(\n    model.attributes,\n    (fields: any, attr: any, key: any) => {\n      if (nonAuthorizableFields.includes(key)) return fields;\n\n      const fieldPath = prefix ? `${prefix}.${key}` : key;\n      fields.push(fieldPath);\n\n      if (attr.type === 'component') {\n        const compoFields = getNestedFieldsWithIntermediate(components[attr.component], {\n          nestingLevel: nestingLevel - 1,\n          prefix: fieldPath,\n          components,\n        });\n\n        fields.push(...compoFields);\n      }\n\n      return fields;\n    },\n    []\n  );\n};\n\n/**\n * Creates an array of permissions with the \"properties.fields\" attribute filled\n */\nconst getPermissionsWithNestedFields = (\n  actions: any[],\n  { nestingLevel, restrictedSubjects = [] }: FieldOptions = {}\n): Modules.Permissions.PermissionRule[] => {\n  return actions.reduce((permissions, action) => {\n    const validSubjects = action.subjects.filter(\n      (subject: any) => !restrictedSubjects.includes(subject)\n    );\n\n    // Create a Permission for each subject (content-type uid) within the action\n    for (const subject of validSubjects) {\n      const fields = actionDomain.appliesToProperty('fields', action)\n        ? getNestedFields(strapi.contentTypes[subject], {\n            components: strapi.components,\n            nestingLevel,\n          })\n        : undefined;\n\n      const permission = permissionDomain.create({\n        action: action.actionId,\n        subject,\n        properties: { fields },\n      });\n\n      permissions.push(permission);\n    }\n\n    return permissions;\n  }, []);\n};\n\n/**\n * Cleans permissions' fields (add required ones, remove the non-existing ones)\n */\nconst cleanPermissionFields = (\n  permissions: Modules.Permissions.PermissionRule[]\n): Modules.Permissions.PermissionRule[] => {\n  const { actionProvider } = getService('permission');\n  const nestedFieldsCache = new Map<string, string[]>();\n\n  return permissions.map((permission: any) => {\n    const {\n      action: actionId,\n      subject,\n      properties: { fields },\n    } = permission;\n\n    const action = actionProvider.get(actionId) as any;\n\n    // todo see if it's possible to check property on action + subject (async)\n    if (!actionDomain.appliesToProperty('fields', action)) {\n      return permissionDomain.deleteProperty('fields', permission);\n    }\n\n    if (!subject || !strapi.contentTypes[subject]) {\n      return permission;\n    }\n\n    let possibleFields = nestedFieldsCache.get(subject);\n    if (!possibleFields) {\n      possibleFields = getNestedFieldsWithIntermediate(strapi.contentTypes[subject], {\n        components: strapi.components,\n      });\n      nestedFieldsCache.set(subject, possibleFields);\n    }\n\n    const currentFields: string[] = fields || [];\n\n    const validUserFields: string[] = [\n      ...new Set(\n        possibleFields.filter((pf) =>\n          currentFields.some((cf) => pf === cf || pf.startsWith(`${cf}.`))\n        )\n      ),\n    ];\n\n    // A field is considered \"not nested\" if no other valid user field starts with this field's path followed by a dot.\n    // This helps to remove redundant parent paths when a more specific child path is already included.\n    // For example, if 'component.title' is present, 'component' would be filtered out by this condition.\n    const isNotNestedField = (field: string) =>\n      !validUserFields.some(\n        (validUserField: string) =>\n          validUserField !== field && validUserField.startsWith(`${field}.`)\n      );\n\n    // Filter out fields that are parent paths of other included fields.\n    const newFields = validUserFields.filter(isNotNestedField);\n\n    return permissionDomain.setProperty('fields', newFields, permission);\n  }, []);\n};\n\nexport {\n  getNestedFields,\n  getPermissionsWithNestedFields,\n  cleanPermissionFields,\n  getNestedFieldsWithIntermediate,\n};\n"],"names":["getNestedFields","model","prefix","nestingLevel","components","requiredOnly","existingFields","nonAuthorizableFields","contentTypesUtils","getNonVisibleAttributes","_","reduce","attributes","fields","attr","key","includes","fieldPath","shouldBeIncluded","required","insideExistingFields","some","field","startsWith","type","compoFields","component","length","concat","getNestedFieldsWithIntermediate","push","getPermissionsWithNestedFields","actions","restrictedSubjects","permissions","action","validSubjects","subjects","filter","subject","actionDomain","appliesToProperty","strapi","contentTypes","undefined","permission","permissionDomain","create","actionId","properties","cleanPermissionFields","actionProvider","getService","nestedFieldsCache","Map","map","get","deleteProperty","possibleFields","set","currentFields","validUserFields","Set","pf","cf","isNotNestedField","validUserField","newFields","setProperty"],"mappings":";;;;;;AAoBA;;IAGA,MAAMA,kBAAkB,CACtBC,KAAAA,EACA,EACEC,MAAAA,GAAS,EAAE,EACXC,YAAAA,GAAe,EAAE,EACjBC,UAAAA,GAAa,EAAE,EACfC,YAAAA,GAAe,KAAK,EACpBC,cAAAA,GAAiB,EAAE,EACN,GAAA;AAEf,IAAA,IAAIH,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAOD,MAAAA,GAAS;AAACA,YAAAA;AAAO,SAAA,GAAG,EAAE;AAC/B,IAAA;IAEA,MAAMK,qBAAAA,GAAwBC,YAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,UAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChD,QAAA,MAAMG,gBAAAA,GAAmB,CAACb,YAAAA,IAAgBS,IAAAA,CAAKK,QAAQ,KAAK,IAAA;QAC5D,MAAMC,oBAAAA,GACJd,kBAAkBA,cAAAA,CAAee,IAAI,CAAC,CAACC,KAAAA,GAAUA,KAAAA,CAAMC,UAAU,CAACN,SAAAA,CAAAA,CAAAA;QAEpE,IAAIH,IAAAA,CAAKU,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,IAAIN,oBAAoBE,oBAAAA,EAAsB;AAC5C,gBAAA,MAAMK,cAAczB,eAAAA,CAAgBI,UAAU,CAACU,IAAAA,CAAKY,SAAS,CAAC,EAAE;AAC9DvB,oBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;oBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,oBAAAA,UAAAA;AACAC,oBAAAA,YAAAA;AACAC,oBAAAA;AACF,iBAAA,CAAA;AAEA,gBAAA,IAAImB,WAAAA,CAAYE,MAAM,KAAK,CAAA,IAAKT,gBAAAA,EAAkB;oBAChD,OAAOL,MAAAA,CAAOe,MAAM,CAACX,SAAAA,CAAAA;AACvB,gBAAA;gBAEA,OAAOJ,MAAAA,CAAOe,MAAM,CAACH,WAAAA,CAAAA;AACvB,YAAA;YACA,OAAOZ,MAAAA;AACT,QAAA;AAEA,QAAA,IAAIK,gBAAAA,EAAkB;YACpB,OAAOL,MAAAA,CAAOe,MAAM,CAACX,SAAAA,CAAAA;AACvB,QAAA;QAEA,OAAOJ,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMgB,+BAAAA,GAAkC,CACtC5B,KAAAA,EACA,EAAEC,MAAAA,GAAS,EAAE,EAAEC,YAAAA,GAAe,EAAE,EAAEC,UAAAA,GAAa,EAAE,EAAgB,GAAA;AAEjE,IAAA,IAAID,iBAAiB,CAAA,EAAG;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;IAEA,MAAMI,qBAAAA,GAAwBC,YAAAA,CAAkBC,uBAAuB,CAACR,KAAAA,CAAAA;IAExE,OAAOS,UAAAA,CAAEC,MAAM,CACbV,KAAAA,CAAMW,UAAU,EAChB,CAACC,QAAaC,IAAAA,EAAWC,GAAAA,GAAAA;AACvB,QAAA,IAAIR,qBAAAA,CAAsBS,QAAQ,CAACD,GAAAA,CAAAA,EAAM,OAAOF,MAAAA;AAEhD,QAAA,MAAMI,YAAYf,MAAAA,GAAS,CAAA,EAAGA,OAAO,CAAC,EAAEa,KAAK,GAAGA,GAAAA;AAChDF,QAAAA,MAAAA,CAAOiB,IAAI,CAACb,SAAAA,CAAAA;QAEZ,IAAIH,IAAAA,CAAKU,IAAI,KAAK,WAAA,EAAa;AAC7B,YAAA,MAAMC,cAAcI,+BAAAA,CAAgCzB,UAAU,CAACU,IAAAA,CAAKY,SAAS,CAAC,EAAE;AAC9EvB,gBAAAA,YAAAA,EAAcA,YAAAA,GAAe,CAAA;gBAC7BD,MAAAA,EAAQe,SAAAA;AACRb,gBAAAA;AACF,aAAA,CAAA;AAEAS,YAAAA,MAAAA,CAAOiB,IAAI,CAAA,GAAIL,WAAAA,CAAAA;AACjB,QAAA;QAEA,OAAOZ,MAAAA;AACT,IAAA,CAAA,EACA,EAAE,CAAA;AAEN;AAEA;;AAEC,IACD,MAAMkB,8BAAAA,GAAiC,CACrCC,OAAAA,EACA,EAAE7B,YAAY,EAAE8B,kBAAAA,GAAqB,EAAE,EAAgB,GAAG,EAAE,GAAA;AAE5D,IAAA,OAAOD,OAAAA,CAAQrB,MAAM,CAAC,CAACuB,WAAAA,EAAaC,MAAAA,GAAAA;QAClC,MAAMC,aAAAA,GAAgBD,MAAAA,CAAOE,QAAQ,CAACC,MAAM,CAC1C,CAACC,OAAAA,GAAiB,CAACN,kBAAAA,CAAmBjB,QAAQ,CAACuB,OAAAA,CAAAA,CAAAA;;QAIjD,KAAK,MAAMA,WAAWH,aAAAA,CAAe;YACnC,MAAMvB,MAAAA,GAAS2B,MAAAA,CAAaC,iBAAiB,CAAC,QAAA,EAAUN,MAAAA,CAAAA,GACpDnC,eAAAA,CAAgB0C,MAAAA,CAAOC,YAAY,CAACJ,OAAAA,CAAQ,EAAE;AAC5CnC,gBAAAA,UAAAA,EAAYsC,OAAOtC,UAAU;AAC7BD,gBAAAA;aACF,CAAA,GACAyC,SAAAA;YAEJ,MAAMC,UAAAA,GAAaC,gBAAAA,CAAiBC,MAAM,CAAC;AACzCZ,gBAAAA,MAAAA,EAAQA,OAAOa,QAAQ;AACvBT,gBAAAA,OAAAA;gBACAU,UAAAA,EAAY;AAAEpC,oBAAAA;AAAO;AACvB,aAAA,CAAA;AAEAqB,YAAAA,WAAAA,CAAYJ,IAAI,CAACe,UAAAA,CAAAA;AACnB,QAAA;QAEA,OAAOX,WAAAA;AACT,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;AAEA;;IAGA,MAAMgB,wBAAwB,CAC5BhB,WAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEiB,cAAc,EAAE,GAAGC,UAAAA,CAAW,YAAA,CAAA;AACtC,IAAA,MAAMC,oBAAoB,IAAIC,GAAAA,EAAAA;IAE9B,OAAOpB,WAAAA,CAAYqB,GAAG,CAAC,CAACV,UAAAA,GAAAA;QACtB,MAAM,EACJV,MAAAA,EAAQa,QAAQ,EAChBT,OAAO,EACPU,UAAAA,EAAY,EAAEpC,MAAM,EAAE,EACvB,GAAGgC,UAAAA;QAEJ,MAAMV,MAAAA,GAASgB,cAAAA,CAAeK,GAAG,CAACR,QAAAA,CAAAA;;AAGlC,QAAA,IAAI,CAACR,MAAAA,CAAaC,iBAAiB,CAAC,UAAUN,MAAAA,CAAAA,EAAS;YACrD,OAAOW,gBAAAA,CAAiBW,cAAc,CAAC,QAAA,EAAUZ,UAAAA,CAAAA;AACnD,QAAA;AAEA,QAAA,IAAI,CAACN,OAAAA,IAAW,CAACG,OAAOC,YAAY,CAACJ,QAAQ,EAAE;YAC7C,OAAOM,UAAAA;AACT,QAAA;QAEA,IAAIa,cAAAA,GAAiBL,iBAAAA,CAAkBG,GAAG,CAACjB,OAAAA,CAAAA;AAC3C,QAAA,IAAI,CAACmB,cAAAA,EAAgB;AACnBA,YAAAA,cAAAA,GAAiB7B,+BAAAA,CAAgCa,MAAAA,CAAOC,YAAY,CAACJ,QAAQ,EAAE;AAC7EnC,gBAAAA,UAAAA,EAAYsC,OAAOtC;AACrB,aAAA,CAAA;YACAiD,iBAAAA,CAAkBM,GAAG,CAACpB,OAAAA,EAASmB,cAAAA,CAAAA;AACjC,QAAA;QAEA,MAAME,aAAAA,GAA0B/C,UAAU,EAAE;AAE5C,QAAA,MAAMgD,eAAAA,GAA4B;AAC7B,YAAA,GAAA,IAAIC,IACLJ,cAAAA,CAAepB,MAAM,CAAC,CAACyB,EAAAA,GACrBH,cAAcvC,IAAI,CAAC,CAAC2C,EAAAA,GAAOD,EAAAA,KAAOC,MAAMD,EAAAA,CAAGxC,UAAU,CAAC,CAAA,EAAGyC,EAAAA,CAAG,CAAC,CAAC,CAAA,CAAA,CAAA;AAGnE,SAAA;;;;AAKD,QAAA,MAAMC,mBAAmB,CAAC3C,KAAAA,GACxB,CAACuC,eAAAA,CAAgBxC,IAAI,CACnB,CAAC6C,cAAAA,GACCA,cAAAA,KAAmB5C,SAAS4C,cAAAA,CAAe3C,UAAU,CAAC,CAAA,EAAGD,KAAAA,CAAM,CAAC,CAAC,CAAA,CAAA;;QAIvE,MAAM6C,SAAAA,GAAYN,eAAAA,CAAgBvB,MAAM,CAAC2B,gBAAAA,CAAAA;AAEzC,QAAA,OAAOnB,gBAAAA,CAAiBsB,WAAW,CAAC,QAAA,EAAUD,SAAAA,EAAWtB,UAAAA,CAAAA;AAC3D,IAAA,CAAA,EAAG,EAAE,CAAA;AACP;;;;"}

package/dist/server/server/src/services/debug-dump.js

@@ -0,0 +1,173 @@
+'use strict';
+
+var os = require('os');
+var path = require('path');
+var redact = require('../utils/debug-dump/redact.js');
+var getProjectType = require('../../../shared/utils/get-project-type.js');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var os__default = /*#__PURE__*/_interopDefault(os);
+var path__default = /*#__PURE__*/_interopDefault(path);
+
+// Only these process.env keys are ever emitted (never the whole environment).
+const ENV_ALLOWLIST = [
+    'NODE_ENV',
+    'STRAPI_HOSTING',
+    'STRAPI_DISABLE_LICENSE_PING',
+    'STRAPI_DISABLE_EE'
+];
+// Sensitive config subtrees masked wholesale (in addition to the key/value scrubber).
+const SENSITIVE_CONFIG_PATHS = [
+    'server.app.keys',
+    'database.connection.connection',
+    'admin.auth.secret',
+    'admin.apiToken.salt',
+    'admin.transfer.token.salt',
+    'admin.secrets',
+    'plugin::email.providerOptions',
+    'plugin::email.settings',
+    'plugin::upload.providerOptions'
+];
+const debugDumpService = ({ strapi })=>({
+        async generate () {
+            const appRoot = strapi.config.get('dirs.app.root', '');
+            const homeDir = os__default.default.homedir();
+            const packageJson = strapi.config.get('info', {}) ?? {};
+            // The config provider (packages/core/core/src/services/config.ts) spreads the config it was
+            // built with onto itself, next to its get/set/has methods, and `get('')` does not return the
+            // root. Module config (plugin::*, api::*) is stored later with config.set, so it is never an
+            // own property of the provider. Take the top-level names from both places and read every
+            // value through config.get, which always sees the live tree.
+            const configNames = new Set([
+                ...Object.keys(strapi.config).filter((key)=>![
+                        'get',
+                        'set',
+                        'has'
+                    ].includes(key)),
+                ...Object.keys(strapi.get('modules').getAll())
+            ]);
+            const rawConfig = {};
+            for (const name of configNames){
+                const value = strapi.config.get(name);
+                if (value !== undefined) {
+                    rawConfig[name] = value;
+                }
+            }
+            const fullConfig = redact.scrub(rawConfig, {
+                appRoot,
+                homeDir,
+                extraPaths: SENSITIVE_CONFIG_PATHS
+            });
+            const env = {};
+            for (const key of ENV_ALLOWLIST){
+                env[key] = process.env[key];
+            }
+            let uploadPrivate = false;
+            try {
+                uploadPrivate = await strapi.plugin('upload').provider.isPrivate();
+            } catch  {
+                uploadPrivate = false;
+            }
+            const retained = strapi.ee.retainedLicense;
+            // getInfo() makes a SQLite path relative to the working directory, which can still climb
+            // into a home directory (`../../home/<user>/...`). Resolve it and relativize it like every
+            // other path in the dump, so it reads `<app>/...` or `<home>/...`.
+            const databaseInfo = strapi.db.getInfo();
+            if (databaseInfo.client === 'sqlite' && databaseInfo.displayName) {
+                databaseInfo.displayName = redact.scrub(path__default.default.resolve(process.cwd(), databaseInfo.displayName), {
+                    appRoot,
+                    homeDir
+                });
+            }
+            const payload = {
+                dumpVersion: 1,
+                generatedAt: new Date().toISOString(),
+                strapi: {
+                    version: strapi.config.get('info.strapi', null),
+                    edition: strapi.EE ? 'EE' : 'CE',
+                    // `edition` is the edition actually running, so a lapsed license reports CE. The plan
+                    // still comes off the license, otherwise a dump from an expired Enterprise instance is
+                    // indistinguishable from a project that never had a license, which is exactly the case
+                    // Support is most likely to receive one for. `licenseStatus` below tells them apart.
+                    projectType: getProjectType.getLicensedPlan({
+                        licenseStatus: strapi.ee.licenseStatus,
+                        type: strapi.ee.type ?? retained?.type,
+                        planPriceId: strapi.ee.planPriceId ?? retained?.planPriceId
+                    }),
+                    environment: strapi.config.get('environment', ''),
+                    autoReload: strapi.config.get('autoReload', false)
+                },
+                system: {
+                    nodeVersion: process.version,
+                    os: {
+                        type: os__default.default.type(),
+                        platform: os__default.default.platform(),
+                        arch: os__default.default.arch(),
+                        release: os__default.default.release()
+                    },
+                    isHostedOnStrapiCloud: process.env.STRAPI_HOSTING === 'strapi.cloud'
+                },
+                database: databaseInfo,
+                plugins: Object.keys(strapi.plugins),
+                providers: {
+                    // A local provider is wired by its absolute path, so these go through scrub() too
+                    upload: {
+                        name: redact.scrub(strapi.config.get('plugin::upload.provider', 'local'), {
+                            appRoot,
+                            homeDir
+                        }),
+                        isPrivate: uploadPrivate
+                    },
+                    email: {
+                        name: redact.scrub(strapi.config.get('plugin::email.provider', undefined), {
+                            appRoot,
+                            homeDir
+                        })
+                    }
+                },
+                contentModel: {
+                    counts: {
+                        contentTypes: Object.keys(strapi.contentTypes).length,
+                        components: Object.keys(strapi.components).length
+                    },
+                    contentTypes: redact.scrub(Object.values(strapi.contentTypes), {
+                        appRoot,
+                        homeDir
+                    }),
+                    components: redact.scrub(Object.values(strapi.components), {
+                        appRoot,
+                        homeDir
+                    })
+                },
+                customizations: strapi.getCustomizations(),
+                config: fullConfig,
+                packageJson: redact.scrub(packageJson, {
+                    appRoot,
+                    homeDir
+                }),
+                env
+            };
+            // Emitted whenever this instance has ever had a license, not only while one is usable, so
+            // an expired license still reports its plan, seats and subscription. `disable()` wipes
+            // `licenseInfo` and keeps a display-only snapshot in `retainedLicense`, so read through to
+            // it the same way `licenseLimitInformation` does.
+            if (strapi.EE || retained) {
+                payload.license = {
+                    licenseStatus: strapi.ee.licenseStatus,
+                    type: strapi.ee.type ?? retained?.type ?? null,
+                    // Live only, like the license endpoint: disable() clears it, so an ended trial is not one.
+                    isTrial: strapi.ee.isTrial,
+                    expireAt: strapi.ee.expireAt ?? retained?.expireAt ?? null,
+                    seats: strapi.ee.seats ?? retained?.seats ?? null,
+                    subscriptionId: strapi.ee.subscriptionId ?? retained?.subscriptionId ?? null,
+                    features: strapi.EE ? strapi.ee.features.list() : retained?.features ?? [],
+                    entitlements: strapi.EE ? strapi.ee.entitlements.list() : strapi.ee.entitlements.listRetained()
+                };
+            }
+            return payload;
+        }
+    });
+
+module.exports = debugDumpService;
+//# sourceMappingURL=debug-dump.js.map

package/dist/server/server/src/services/debug-dump.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-dump.js","sources":["../../../../../server/src/services/debug-dump.ts"],"sourcesContent":["import os from 'os';\nimport path from 'path';\nimport type { Core } from '@strapi/types';\nimport { scrub } from '../utils/debug-dump/redact';\nimport type { DebugDumpPayload } from '../../../shared/contracts/admin';\nimport { getLicensedPlan } from '../../../shared/utils/get-project-type';\n\n// Only these process.env keys are ever emitted (never the whole environment).\nconst ENV_ALLOWLIST = [\n  'NODE_ENV',\n  'STRAPI_HOSTING',\n  'STRAPI_DISABLE_LICENSE_PING',\n  'STRAPI_DISABLE_EE',\n] as const;\n\n// Sensitive config subtrees masked wholesale (in addition to the key/value scrubber).\nconst SENSITIVE_CONFIG_PATHS = [\n  'server.app.keys',\n  'database.connection.connection',\n  'admin.auth.secret',\n  'admin.apiToken.salt',\n  'admin.transfer.token.salt',\n  'admin.secrets',\n  'plugin::email.providerOptions',\n  'plugin::email.settings',\n  'plugin::upload.providerOptions',\n];\n\nconst debugDumpService = ({ strapi }: { strapi: Core.Strapi }) => ({\n  async generate(): Promise<DebugDumpPayload> {\n    const appRoot: string = strapi.config.get('dirs.app.root', '') as string;\n    const homeDir = os.homedir();\n\n    const packageJson = (strapi.config.get('info', {}) ?? {}) as Record<string, unknown>;\n\n    // The config provider (packages/core/core/src/services/config.ts) spreads the config it was\n    // built with onto itself, next to its get/set/has methods, and `get('')` does not return the\n    // root. Module config (plugin::*, api::*) is stored later with config.set, so it is never an\n    // own property of the provider. Take the top-level names from both places and read every\n    // value through config.get, which always sees the live tree.\n    const configNames = new Set([\n      ...Object.keys(strapi.config).filter((key) => !['get', 'set', 'has'].includes(key)),\n      ...Object.keys(strapi.get('modules').getAll()),\n    ]);\n    const rawConfig: Record<string, unknown> = {};\n    for (const name of configNames) {\n      const value = strapi.config.get(name);\n      if (value !== undefined) {\n        rawConfig[name] = value;\n      }\n    }\n    const fullConfig = scrub(rawConfig, {\n      appRoot,\n      homeDir,\n      extraPaths: SENSITIVE_CONFIG_PATHS,\n    }) as Record<string, unknown>;\n\n    const env: Record<string, string | undefined> = {};\n    for (const key of ENV_ALLOWLIST) {\n      env[key] = process.env[key];\n    }\n\n    let uploadPrivate = false;\n    try {\n      uploadPrivate = await strapi.plugin('upload').provider.isPrivate();\n    } catch {\n      uploadPrivate = false;\n    }\n\n    const retained = strapi.ee.retainedLicense;\n\n    // getInfo() makes a SQLite path relative to the working directory, which can still climb\n    // into a home directory (`../../home/<user>/...`). Resolve it and relativize it like every\n    // other path in the dump, so it reads `<app>/...` or `<home>/...`.\n    const databaseInfo = strapi.db.getInfo();\n    if (databaseInfo.client === 'sqlite' && databaseInfo.displayName) {\n      databaseInfo.displayName = scrub(path.resolve(process.cwd(), databaseInfo.displayName), {\n        appRoot,\n        homeDir,\n      }) as string;\n    }\n\n    const payload: DebugDumpPayload = {\n      dumpVersion: 1,\n      generatedAt: new Date().toISOString(),\n      strapi: {\n        version: strapi.config.get('info.strapi', null) as string | null,\n        edition: strapi.EE ? 'EE' : 'CE',\n        // `edition` is the edition actually running, so a lapsed license reports CE. The plan\n        // still comes off the license, otherwise a dump from an expired Enterprise instance is\n        // indistinguishable from a project that never had a license, which is exactly the case\n        // Support is most likely to receive one for. `licenseStatus` below tells them apart.\n        projectType: getLicensedPlan({\n          licenseStatus: strapi.ee.licenseStatus,\n          type: strapi.ee.type ?? retained?.type,\n          planPriceId: strapi.ee.planPriceId ?? retained?.planPriceId,\n        }),\n        environment: strapi.config.get('environment', '') as string,\n        autoReload: strapi.config.get('autoReload', false) as boolean,\n      },\n      system: {\n        nodeVersion: process.version,\n        os: { type: os.type(), platform: os.platform(), arch: os.arch(), release: os.release() },\n        isHostedOnStrapiCloud: process.env.STRAPI_HOSTING === 'strapi.cloud',\n      },\n      database: databaseInfo,\n      plugins: Object.keys(strapi.plugins),\n      providers: {\n        // A local provider is wired by its absolute path, so these go through scrub() too\n        upload: {\n          name: scrub(strapi.config.get('plugin::upload.provider', 'local'), {\n            appRoot,\n            homeDir,\n          }) as string,\n          isPrivate: uploadPrivate,\n        },\n        email: {\n          name: scrub(strapi.config.get('plugin::email.provider', undefined), {\n            appRoot,\n            homeDir,\n          }) as string | undefined,\n        },\n      },\n      contentModel: {\n        counts: {\n          contentTypes: Object.keys(strapi.contentTypes).length,\n          components: Object.keys(strapi.components).length,\n        },\n        contentTypes: scrub(Object.values(strapi.contentTypes), { appRoot, homeDir }) as unknown[],\n        components: scrub(Object.values(strapi.components), { appRoot, homeDir }) as unknown[],\n      },\n      customizations: strapi.getCustomizations(),\n      config: fullConfig,\n      packageJson: scrub(packageJson, { appRoot, homeDir }) as Record<string, unknown>,\n      env,\n    };\n\n    // Emitted whenever this instance has ever had a license, not only while one is usable, so\n    // an expired license still reports its plan, seats and subscription. `disable()` wipes\n    // `licenseInfo` and keeps a display-only snapshot in `retainedLicense`, so read through to\n    // it the same way `licenseLimitInformation` does.\n    if (strapi.EE || retained) {\n      payload.license = {\n        licenseStatus: strapi.ee.licenseStatus,\n        type: strapi.ee.type ?? retained?.type ?? null,\n        // Live only, like the license endpoint: disable() clears it, so an ended trial is not one.\n        isTrial: strapi.ee.isTrial,\n        expireAt: strapi.ee.expireAt ?? retained?.expireAt ?? null,\n        seats: strapi.ee.seats ?? retained?.seats ?? null,\n        subscriptionId: strapi.ee.subscriptionId ?? retained?.subscriptionId ?? null,\n        features: strapi.EE ? strapi.ee.features.list() : (retained?.features ?? []),\n        entitlements: strapi.EE\n          ? strapi.ee.entitlements.list()\n          : strapi.ee.entitlements.listRetained(),\n      };\n    }\n\n    return payload;\n  },\n});\n\nexport default debugDumpService;\n"],"names":["ENV_ALLOWLIST","SENSITIVE_CONFIG_PATHS","debugDumpService","strapi","generate","appRoot","config","get","homeDir","os","homedir","packageJson","configNames","Set","Object","keys","filter","key","includes","getAll","rawConfig","name","value","undefined","fullConfig","scrub","extraPaths","env","process","uploadPrivate","plugin","provider","isPrivate","retained","ee","retainedLicense","databaseInfo","db","getInfo","client","displayName","path","resolve","cwd","payload","dumpVersion","generatedAt","Date","toISOString","version","edition","EE","projectType","getLicensedPlan","licenseStatus","type","planPriceId","environment","autoReload","system","nodeVersion","platform","arch","release","isHostedOnStrapiCloud","STRAPI_HOSTING","database","plugins","providers","upload","email","contentModel","counts","contentTypes","length","components","values","customizations","getCustomizations","license","isTrial","expireAt","seats","subscriptionId","features","list","entitlements","listRetained"],"mappings":";;;;;;;;;;;;AAOA;AACA,MAAMA,aAAAA,GAAgB;AACpB,IAAA,UAAA;AACA,IAAA,gBAAA;AACA,IAAA,6BAAA;AACA,IAAA;AACD,CAAA;AAED;AACA,MAAMC,sBAAAA,GAAyB;AAC7B,IAAA,iBAAA;AACA,IAAA,gCAAA;AACA,IAAA,mBAAA;AACA,IAAA,qBAAA;AACA,IAAA,2BAAA;AACA,IAAA,eAAA;AACA,IAAA,+BAAA;AACA,IAAA,wBAAA;AACA,IAAA;AACD,CAAA;AAED,MAAMC,mBAAmB,CAAC,EAAEC,MAAM,EAA2B,IAAM;QACjE,MAAMC,QAAAA,CAAAA,GAAAA;AACJ,YAAA,MAAMC,UAAkBF,MAAAA,CAAOG,MAAM,CAACC,GAAG,CAAC,eAAA,EAAiB,EAAA,CAAA;YAC3D,MAAMC,OAAAA,GAAUC,oBAAGC,OAAO,EAAA;YAE1B,MAAMC,WAAAA,GAAeR,OAAOG,MAAM,CAACC,GAAG,CAAC,MAAA,EAAQ,EAAC,CAAA,IAAM,EAAC;;;;;;YAOvD,MAAMK,WAAAA,GAAc,IAAIC,GAAAA,CAAI;mBACvBC,MAAAA,CAAOC,IAAI,CAACZ,MAAAA,CAAOG,MAAM,EAAEU,MAAM,CAAC,CAACC,GAAAA,GAAQ,CAAC;AAAC,wBAAA,KAAA;AAAO,wBAAA,KAAA;AAAO,wBAAA;AAAM,qBAAA,CAACC,QAAQ,CAACD,GAAAA,CAAAA,CAAAA;AAC3EH,gBAAAA,GAAAA,MAAAA,CAAOC,IAAI,CAACZ,MAAAA,CAAOI,GAAG,CAAC,WAAWY,MAAM,EAAA;AAC5C,aAAA,CAAA;AACD,YAAA,MAAMC,YAAqC,EAAC;YAC5C,KAAK,MAAMC,QAAQT,WAAAA,CAAa;AAC9B,gBAAA,MAAMU,KAAAA,GAAQnB,MAAAA,CAAOG,MAAM,CAACC,GAAG,CAACc,IAAAA,CAAAA;AAChC,gBAAA,IAAIC,UAAUC,SAAAA,EAAW;oBACvBH,SAAS,CAACC,KAAK,GAAGC,KAAAA;AACpB,gBAAA;AACF,YAAA;YACA,MAAME,UAAAA,GAAaC,aAAML,SAAAA,EAAW;AAClCf,gBAAAA,OAAAA;AACAG,gBAAAA,OAAAA;gBACAkB,UAAAA,EAAYzB;AACd,aAAA,CAAA;AAEA,YAAA,MAAM0B,MAA0C,EAAC;YACjD,KAAK,MAAMV,OAAOjB,aAAAA,CAAe;AAC/B2B,gBAAAA,GAAG,CAACV,GAAAA,CAAI,GAAGW,OAAAA,CAAQD,GAAG,CAACV,GAAAA,CAAI;AAC7B,YAAA;AAEA,YAAA,IAAIY,aAAAA,GAAgB,KAAA;YACpB,IAAI;AACFA,gBAAAA,aAAAA,GAAgB,MAAM1B,MAAAA,CAAO2B,MAAM,CAAC,QAAA,CAAA,CAAUC,QAAQ,CAACC,SAAS,EAAA;AAClE,YAAA,CAAA,CAAE,OAAM;gBACNH,aAAAA,GAAgB,KAAA;AAClB,YAAA;AAEA,YAAA,MAAMI,QAAAA,GAAW9B,MAAAA,CAAO+B,EAAE,CAACC,eAAe;;;;AAK1C,YAAA,MAAMC,YAAAA,GAAejC,MAAAA,CAAOkC,EAAE,CAACC,OAAO,EAAA;AACtC,YAAA,IAAIF,aAAaG,MAAM,KAAK,QAAA,IAAYH,YAAAA,CAAaI,WAAW,EAAE;gBAChEJ,YAAAA,CAAaI,WAAW,GAAGf,YAAAA,CAAMgB,qBAAAA,CAAKC,OAAO,CAACd,OAAAA,CAAQe,GAAG,EAAA,EAAIP,YAAAA,CAAaI,WAAW,CAAA,EAAG;AACtFnC,oBAAAA,OAAAA;AACAG,oBAAAA;AACF,iBAAA,CAAA;AACF,YAAA;AAEA,YAAA,MAAMoC,OAAAA,GAA4B;gBAChCC,WAAAA,EAAa,CAAA;gBACbC,WAAAA,EAAa,IAAIC,OAAOC,WAAW,EAAA;gBACnC7C,MAAAA,EAAQ;AACN8C,oBAAAA,OAAAA,EAAS9C,MAAAA,CAAOG,MAAM,CAACC,GAAG,CAAC,aAAA,EAAe,IAAA,CAAA;oBAC1C2C,OAAAA,EAAS/C,MAAAA,CAAOgD,EAAE,GAAG,IAAA,GAAO,IAAA;;;;;AAK5BC,oBAAAA,WAAAA,EAAaC,8BAAAA,CAAgB;wBAC3BC,aAAAA,EAAenD,MAAAA,CAAO+B,EAAE,CAACoB,aAAa;AACtCC,wBAAAA,IAAAA,EAAMpD,MAAAA,CAAO+B,EAAE,CAACqB,IAAI,IAAItB,QAAAA,EAAUsB,IAAAA;AAClCC,wBAAAA,WAAAA,EAAarD,MAAAA,CAAO+B,EAAE,CAACsB,WAAW,IAAIvB,QAAAA,EAAUuB;AAClD,qBAAA,CAAA;AACAC,oBAAAA,WAAAA,EAAatD,MAAAA,CAAOG,MAAM,CAACC,GAAG,CAAC,aAAA,EAAe,EAAA,CAAA;AAC9CmD,oBAAAA,UAAAA,EAAYvD,MAAAA,CAAOG,MAAM,CAACC,GAAG,CAAC,YAAA,EAAc,KAAA;AAC9C,iBAAA;gBACAoD,MAAAA,EAAQ;AACNC,oBAAAA,WAAAA,EAAahC,QAAQqB,OAAO;oBAC5BxC,EAAAA,EAAI;AAAE8C,wBAAAA,IAAAA,EAAM9C,oBAAG8C,IAAI,EAAA;AAAIM,wBAAAA,QAAAA,EAAUpD,oBAAGoD,QAAQ,EAAA;AAAIC,wBAAAA,IAAAA,EAAMrD,oBAAGqD,IAAI,EAAA;AAAIC,wBAAAA,OAAAA,EAAStD,oBAAGsD,OAAO;AAAG,qBAAA;AACvFC,oBAAAA,qBAAAA,EAAuBpC,OAAAA,CAAQD,GAAG,CAACsC,cAAc,KAAK;AACxD,iBAAA;gBACAC,QAAAA,EAAU9B,YAAAA;AACV+B,gBAAAA,OAAAA,EAASrD,MAAAA,CAAOC,IAAI,CAACZ,MAAAA,CAAOgE,OAAO,CAAA;gBACnCC,SAAAA,EAAW;;oBAETC,MAAAA,EAAQ;AACNhD,wBAAAA,IAAAA,EAAMI,aAAMtB,MAAAA,CAAOG,MAAM,CAACC,GAAG,CAAC,2BAA2B,OAAA,CAAA,EAAU;AACjEF,4BAAAA,OAAAA;AACAG,4BAAAA;AACF,yBAAA,CAAA;wBACAwB,SAAAA,EAAWH;AACb,qBAAA;oBACAyC,KAAAA,EAAO;AACLjD,wBAAAA,IAAAA,EAAMI,aAAMtB,MAAAA,CAAOG,MAAM,CAACC,GAAG,CAAC,0BAA0BgB,SAAAA,CAAAA,EAAY;AAClElB,4BAAAA,OAAAA;AACAG,4BAAAA;AACF,yBAAA;AACF;AACF,iBAAA;gBACA+D,YAAAA,EAAc;oBACZC,MAAAA,EAAQ;AACNC,wBAAAA,YAAAA,EAAc3D,OAAOC,IAAI,CAACZ,MAAAA,CAAOsE,YAAY,EAAEC,MAAM;AACrDC,wBAAAA,UAAAA,EAAY7D,OAAOC,IAAI,CAACZ,MAAAA,CAAOwE,UAAU,EAAED;AAC7C,qBAAA;AACAD,oBAAAA,YAAAA,EAAchD,aAAMX,MAAAA,CAAO8D,MAAM,CAACzE,MAAAA,CAAOsE,YAAY,CAAA,EAAG;AAAEpE,wBAAAA,OAAAA;AAASG,wBAAAA;AAAQ,qBAAA,CAAA;AAC3EmE,oBAAAA,UAAAA,EAAYlD,aAAMX,MAAAA,CAAO8D,MAAM,CAACzE,MAAAA,CAAOwE,UAAU,CAAA,EAAG;AAAEtE,wBAAAA,OAAAA;AAASG,wBAAAA;AAAQ,qBAAA;AACzE,iBAAA;AACAqE,gBAAAA,cAAAA,EAAgB1E,OAAO2E,iBAAiB,EAAA;gBACxCxE,MAAAA,EAAQkB,UAAAA;AACRb,gBAAAA,WAAAA,EAAac,aAAMd,WAAAA,EAAa;AAAEN,oBAAAA,OAAAA;AAASG,oBAAAA;AAAQ,iBAAA,CAAA;AACnDmB,gBAAAA;AACF,aAAA;;;;;YAMA,IAAIxB,MAAAA,CAAOgD,EAAE,IAAIlB,QAAAA,EAAU;AACzBW,gBAAAA,OAAAA,CAAQmC,OAAO,GAAG;oBAChBzB,aAAAA,EAAenD,MAAAA,CAAO+B,EAAE,CAACoB,aAAa;AACtCC,oBAAAA,IAAAA,EAAMpD,OAAO+B,EAAE,CAACqB,IAAI,IAAItB,UAAUsB,IAAAA,IAAQ,IAAA;;oBAE1CyB,OAAAA,EAAS7E,MAAAA,CAAO+B,EAAE,CAAC8C,OAAO;AAC1BC,oBAAAA,QAAAA,EAAU9E,OAAO+B,EAAE,CAAC+C,QAAQ,IAAIhD,UAAUgD,QAAAA,IAAY,IAAA;AACtDC,oBAAAA,KAAAA,EAAO/E,OAAO+B,EAAE,CAACgD,KAAK,IAAIjD,UAAUiD,KAAAA,IAAS,IAAA;AAC7CC,oBAAAA,cAAAA,EAAgBhF,OAAO+B,EAAE,CAACiD,cAAc,IAAIlD,UAAUkD,cAAAA,IAAkB,IAAA;AACxEC,oBAAAA,QAAAA,EAAUjF,MAAAA,CAAOgD,EAAE,GAAGhD,MAAAA,CAAO+B,EAAE,CAACkD,QAAQ,CAACC,IAAI,EAAA,GAAMpD,QAAAA,EAAUmD,QAAAA,IAAY,EAAE;AAC3EE,oBAAAA,YAAAA,EAAcnF,MAAAA,CAAOgD,EAAE,GACnBhD,MAAAA,CAAO+B,EAAE,CAACoD,YAAY,CAACD,IAAI,KAC3BlF,MAAAA,CAAO+B,EAAE,CAACoD,YAAY,CAACC,YAAY;AACzC,iBAAA;AACF,YAAA;YAEA,OAAO3C,OAAAA;AACT,QAAA;KACF;;;;"}