@strapi/admin 5.57.0 → 5.58.0

package/dist/server/ee/server/src/controllers/admin.mjs

@@ -1,6 +1,9 @@
 import { env } from '@strapi/utils';
 import { getService } from '../utils/index.mjs';
 
+const findRetainedFeature = (retainedFeatures, featureName)=>retainedFeatures?.map((entry)=>typeof entry === 'string' ? {
+            name: entry
+        } : entry).find((entry)=>entry.name === featureName);
 var admin = {
     // NOTE: Overrides CE admin controller
     async getProjectType () {
@@ -36,6 +39,14 @@ var admin = {
     },
     async licenseLimitInformation () {
         const permittedSeats = strapi.ee.seats;
+        // Display-only fallback so an expired/unknown license can still show its plan, seats
+        // and subscription. Never used for enforcement (permittedSeats above is untouched).
+        const retained = strapi.ee.retainedLicense;
+        const isActiveLicense = strapi.ee.licenseStatus === 'active';
+        const activeEntitlements = strapi.ee.entitlements.list();
+        // A lapsed license resolves through the same resolvers against its retained snapshot, so the
+        // card shows the defaulted, clamped limits the plan enforced rather than raw options.
+        const retainedEntitlements = isActiveLicense ? [] : strapi.ee.entitlements.listRetained();
         let shouldNotify = false;
         let licenseLimitStatus = null;
         let enforcementUserCount;
@@ -54,17 +65,79 @@ var admin = {
             shouldNotify = true;
             licenseLimitStatus = 'AT_LIMIT';
         }
+        const eeInformation = await strapi.db.query('strapi::core-store').findOne({
+            where: {
+                key: 'ee_information'
+            }
+        }).then((row)=>row ? JSON.parse(row.value) : null).catch(()=>null);
+        // disable() wipes the live type on expiry but keeps it on the retained snapshot, so resolve
+        // it once here: an expired offline gold license must still report `offline` (and show its
+        // real expiry) rather than the online check-in line.
+        const licenseType = strapi.ee.type ?? retained?.type ?? null;
+        const licenseMode = licenseType === 'gold' && process.env.STRAPI_DISABLE_LICENSE_PING?.toLowerCase() === 'true' ? 'offline' : 'online';
+        // Registry re-check cron cadence ('0 0 */12 * * *', shifted to the startup time -> every 12h).
+        const REGISTRY_CHECK_INTERVAL_MS = 12 * 60 * 60 * 1000;
+        const lastRegistrySyncAt = eeInformation?.lastCheckAt ?? null;
+        let nextRegistrySyncAt = null;
+        if (licenseMode === 'online' && typeof lastRegistrySyncAt === 'number') {
+            // Step forward from the last check-in in 12h increments until we land in the
+            // future, so a stale last check-in never reports a "next check-in" in the past.
+            const now = Date.now();
+            let next = lastRegistrySyncAt + REGISTRY_CHECK_INTERVAL_MS;
+            while(next <= now){
+                next += REGISTRY_CHECK_INTERVAL_MS;
+            }
+            nextRegistrySyncAt = next;
+        }
+        // An offline instance never contacts the registry, so an error (and the cached license that
+        // came with it) stored by an earlier online run says nothing about its current state.
+        const registryState = licenseMode === 'online' ? eeInformation : null;
         const data = {
             enforcementUserCount,
             currentActiveUserCount,
-            permittedSeats,
+            // Typed `number` in the published contract; null at runtime without a seat limit
+            permittedSeats: permittedSeats ?? null,
+            seats: strapi.ee.seats ?? retained?.seats ?? null,
+            subscriptionId: strapi.ee.subscriptionId ?? retained?.subscriptionId ?? null,
+            expireAt: strapi.ee.expireAt ?? retained?.expireAt ?? null,
+            licenseStatus: strapi.ee.licenseStatus,
+            planPriceId: strapi.ee.planPriceId ?? retained?.planPriceId ?? null,
+            renewalDate: strapi.ee.renewalDate,
+            planEntitlements: strapi.ee.planFeatureCatalog.map((feature)=>{
+                if (isActiveLicense) {
+                    // Every resolver runs for an active license and falls back to its default for a
+                    // missing feature, so only an included feature keeps its limits.
+                    const available = strapi.ee.features.isEnabled(feature);
+                    return {
+                        feature,
+                        available,
+                        limits: available ? activeEntitlements.find((entry)=>entry.feature === feature)?.limits ?? [] : []
+                    };
+                }
+                const retainedFeature = findRetainedFeature(retained?.features, feature);
+                return {
+                    feature,
+                    available: Boolean(retainedFeature),
+                    limits: retainedFeature ? retainedEntitlements.find((entry)=>entry.feature === feature)?.limits ?? [] : []
+                };
+            }),
+            licenseMode,
+            lastRegistrySyncAt,
+            nextRegistrySyncAt,
+            usingCachedLicense: Boolean(registryState?.error && registryState?.license),
+            registrySyncError: registryState?.error ?? null,
+            registrySyncErrorKind: registryState?.errorKind ?? null,
             shouldNotify,
             shouldStopCreate: permittedSeats == null ? false : currentActiveUserCount >= permittedSeats,
             licenseLimitStatus,
             isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',
-            type: strapi.ee.type,
+            // Typed `string` in the published contract; null at runtime without a license
+            type: licenseType,
             isTrial: strapi.ee.isTrial,
-            features: strapi.ee.features.list() ?? []
+            // `features.list()` is loosely typed at the source (`{ name: string; [k]: any }[]`);
+            // narrow it to the contract's named-feature union so consumers (e.g. useLicenseLimits) keep their types.
+            features: strapi.ee.features.list() ?? [],
+            entitlements: strapi.ee.entitlements.list()
         };
         return {
             data

package/dist/server/ee/server/src/controllers/admin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import { env } from '@strapi/utils';\n\nimport { getService } from '../utils';\n\nimport type { GetProjectType } from '../../../../shared/contracts/admin';\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType(): Promise<GetProjectType.Response> {\n    const flags = strapi.config.get('admin.flags', {});\n\n    try {\n      return {\n        data: {\n          // The license fields are nullable internally; the contract is not.\n          isEE: Boolean(strapi.EE),\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type ?? undefined,\n          planPriceId: strapi.ee.planPriceId ?? undefined,\n          ai: {\n            enabled: strapi.ai.admin.isStrapiManagedAiEnabled(),\n          },\n        },\n      };\n    } catch {\n      return { data: { isEE: false, isTrial: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (permittedSeats != null && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (permittedSeats != null && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const data = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      permittedSeats,\n      shouldNotify,\n      shouldStopCreate: permittedSeats == null ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      type: strapi.ee.type,\n      isTrial: strapi.ee.isTrial,\n      features: strapi.ee.features.list() ?? [],\n    };\n\n    return { data };\n  },\n};\n"],"names":["getProjectType","flags","strapi","config","get","data","isEE","Boolean","EE","isTrial","ee","features","list","type","undefined","planPriceId","ai","enabled","admin","isStrapiManagedAiEnabled","licenseLimitInformation","permittedSeats","seats","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","shouldStopCreate","isHostedOnStrapiCloud","env"],"mappings":";;;AAMA,YAAe;;IAEb,MAAMA,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;QAEhD,IAAI;YACF,OAAO;gBACLC,IAAAA,EAAM;;oBAEJC,IAAAA,EAAMC,OAAAA,CAAQL,OAAOM,EAAE,CAAA;oBACvBC,OAAAA,EAASP,MAAAA,CAAOQ,EAAE,CAACD,OAAO;AAC1BE,oBAAAA,QAAAA,EAAUT,MAAAA,CAAOQ,EAAE,CAACC,QAAQ,CAACC,IAAI,EAAA;AACjCX,oBAAAA,KAAAA;AACAY,oBAAAA,IAAAA,EAAMX,MAAAA,CAAOQ,EAAE,CAACG,IAAI,IAAIC,SAAAA;AACxBC,oBAAAA,WAAAA,EAAab,MAAAA,CAAOQ,EAAE,CAACK,WAAW,IAAID,SAAAA;oBACtCE,EAAAA,EAAI;AACFC,wBAAAA,OAAAA,EAASf,MAAAA,CAAOc,EAAE,CAACE,KAAK,CAACC,wBAAwB;AACnD;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAM;YACN,OAAO;gBAAEd,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;oBAAOG,OAAAA,EAAS,KAAA;AAAOE,oBAAAA,QAAAA,EAAU,EAAE;AAAEV,oBAAAA,KAAAA;oBAAOe,EAAAA,EAAI;wBAAEC,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9F,QAAA;AACF,IAAA,CAAA;IAEA,MAAMG,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOQ,EAAE,CAACY,KAAK;AAEtC,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;QAEA,IAAIL,cAAAA,IAAkB,IAAA,IAAQI,oBAAAA,GAAuBJ,cAAAA,EAAgB;YACnEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;QAEA,IAAIH,cAAAA,IAAkB,IAAA,IAAQI,oBAAAA,KAAyBJ,cAAAA,EAAgB;YACrEE,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;AAEA,QAAA,MAAMnB,IAAAA,GAAO;AACXoB,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;AACAL,YAAAA,cAAAA;AACAE,YAAAA,YAAAA;YACAS,gBAAAA,EAAkBX,cAAAA,IAAkB,IAAA,GAAO,KAAA,GAAQK,sBAAAA,IAA0BL,cAAAA;AAC7EG,YAAAA,kBAAAA;YACAS,qBAAAA,EAAuBC,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;YACvDrB,IAAAA,EAAMX,MAAAA,CAAOQ,EAAE,CAACG,IAAI;YACpBJ,OAAAA,EAASP,MAAAA,CAAOQ,EAAE,CAACD,OAAO;AAC1BE,YAAAA,QAAAA,EAAUT,OAAOQ,EAAE,CAACC,QAAQ,CAACC,IAAI,MAAM;AACzC,SAAA;QAEA,OAAO;AAAEP,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"admin.mjs","sources":["../../../../../../ee/server/src/controllers/admin.ts"],"sourcesContent":["import { env } from '@strapi/utils';\n\nimport type {\n  GetLicenseLimitInformation,\n  GetProjectType,\n} from '../../../../shared/contracts/admin';\nimport { getService } from '../utils';\n\ntype RetainedFeature = { name: string; [key: string]: any };\n\nconst findRetainedFeature = (\n  retainedFeatures: Array<RetainedFeature | string> | undefined,\n  featureName: string\n): RetainedFeature | undefined =>\n  retainedFeatures\n    ?.map((entry) => (typeof entry === 'string' ? { name: entry } : entry))\n    .find((entry) => entry.name === featureName);\n\nexport default {\n  // NOTE: Overrides CE admin controller\n  async getProjectType(): Promise<GetProjectType.Response> {\n    const flags = strapi.config.get('admin.flags', {});\n\n    try {\n      return {\n        data: {\n          // The license fields are nullable internally; the contract is not.\n          isEE: Boolean(strapi.EE),\n          isTrial: strapi.ee.isTrial,\n          features: strapi.ee.features.list(),\n          flags,\n          type: strapi.ee.type ?? undefined,\n          planPriceId: strapi.ee.planPriceId ?? undefined,\n          ai: {\n            enabled: strapi.ai.admin.isStrapiManagedAiEnabled(),\n          },\n        },\n      };\n    } catch {\n      return { data: { isEE: false, isTrial: false, features: [], flags, ai: { enabled: false } } };\n    }\n  },\n\n  async licenseLimitInformation() {\n    const permittedSeats = strapi.ee.seats;\n    // Display-only fallback so an expired/unknown license can still show its plan, seats\n    // and subscription. Never used for enforcement (permittedSeats above is untouched).\n    const retained = strapi.ee.retainedLicense;\n    const isActiveLicense = strapi.ee.licenseStatus === 'active';\n    const activeEntitlements = strapi.ee.entitlements.list();\n    // A lapsed license resolves through the same resolvers against its retained snapshot, so the\n    // card shows the defaulted, clamped limits the plan enforced rather than raw options.\n    const retainedEntitlements = isActiveLicense ? [] : strapi.ee.entitlements.listRetained();\n\n    let shouldNotify = false;\n    let licenseLimitStatus = null;\n    let enforcementUserCount;\n\n    const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();\n\n    const eeDisabledUsers = await getService('seat-enforcement').getDisabledUserList();\n\n    if (eeDisabledUsers) {\n      enforcementUserCount = currentActiveUserCount + eeDisabledUsers.length;\n    } else {\n      enforcementUserCount = currentActiveUserCount;\n    }\n\n    if (permittedSeats != null && enforcementUserCount > permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'OVER_LIMIT';\n    }\n\n    if (permittedSeats != null && enforcementUserCount === permittedSeats) {\n      shouldNotify = true;\n      licenseLimitStatus = 'AT_LIMIT';\n    }\n\n    const eeInformation = await strapi.db\n      .query('strapi::core-store')\n      .findOne({ where: { key: 'ee_information' } })\n      .then((row: { value: string } | null) =>\n        row\n          ? (JSON.parse(row.value) as {\n              license?: string | null;\n              error?: string;\n              errorKind?: 'unreachable' | 'rejected';\n              lastCheckAt?: number;\n            })\n          : null\n      )\n      .catch(() => null);\n\n    // disable() wipes the live type on expiry but keeps it on the retained snapshot, so resolve\n    // it once here: an expired offline gold license must still report `offline` (and show its\n    // real expiry) rather than the online check-in line.\n    const licenseType = strapi.ee.type ?? retained?.type ?? null;\n    const licenseMode: 'online' | 'offline' =\n      licenseType === 'gold' && process.env.STRAPI_DISABLE_LICENSE_PING?.toLowerCase() === 'true'\n        ? 'offline'\n        : 'online';\n\n    // Registry re-check cron cadence ('0 0 */12 * * *', shifted to the startup time -> every 12h).\n    const REGISTRY_CHECK_INTERVAL_MS = 12 * 60 * 60 * 1000;\n    const lastRegistrySyncAt: number | null = eeInformation?.lastCheckAt ?? null;\n    let nextRegistrySyncAt: number | null = null;\n    if (licenseMode === 'online' && typeof lastRegistrySyncAt === 'number') {\n      // Step forward from the last check-in in 12h increments until we land in the\n      // future, so a stale last check-in never reports a \"next check-in\" in the past.\n      const now = Date.now();\n      let next = lastRegistrySyncAt + REGISTRY_CHECK_INTERVAL_MS;\n      while (next <= now) {\n        next += REGISTRY_CHECK_INTERVAL_MS;\n      }\n      nextRegistrySyncAt = next;\n    }\n\n    // An offline instance never contacts the registry, so an error (and the cached license that\n    // came with it) stored by an earlier online run says nothing about its current state.\n    const registryState = licenseMode === 'online' ? eeInformation : null;\n\n    const data: GetLicenseLimitInformation.Response['data'] = {\n      enforcementUserCount,\n      currentActiveUserCount,\n      // Typed `number` in the published contract; null at runtime without a seat limit\n      permittedSeats: (permittedSeats ?? null) as number,\n      seats: strapi.ee.seats ?? retained?.seats ?? null,\n      subscriptionId: strapi.ee.subscriptionId ?? retained?.subscriptionId ?? null,\n      expireAt: strapi.ee.expireAt ?? retained?.expireAt ?? null,\n      licenseStatus: strapi.ee.licenseStatus,\n      planPriceId: strapi.ee.planPriceId ?? retained?.planPriceId ?? null,\n      renewalDate: strapi.ee.renewalDate,\n      planEntitlements: strapi.ee.planFeatureCatalog.map((feature) => {\n        if (isActiveLicense) {\n          // Every resolver runs for an active license and falls back to its default for a\n          // missing feature, so only an included feature keeps its limits.\n          const available = strapi.ee.features.isEnabled(feature);\n          return {\n            feature,\n            available,\n            limits: available\n              ? (activeEntitlements.find((entry) => entry.feature === feature)?.limits ?? [])\n              : [],\n          };\n        }\n\n        const retainedFeature = findRetainedFeature(retained?.features, feature);\n\n        return {\n          feature,\n          available: Boolean(retainedFeature),\n          limits: retainedFeature\n            ? (retainedEntitlements.find((entry) => entry.feature === feature)?.limits ?? [])\n            : [],\n        };\n      }),\n      licenseMode,\n      lastRegistrySyncAt,\n      nextRegistrySyncAt,\n      usingCachedLicense: Boolean(registryState?.error && registryState?.license),\n      registrySyncError: registryState?.error ?? null,\n      registrySyncErrorKind: registryState?.errorKind ?? null,\n      shouldNotify,\n      shouldStopCreate: permittedSeats == null ? false : currentActiveUserCount >= permittedSeats,\n      licenseLimitStatus,\n      isHostedOnStrapiCloud: env('STRAPI_HOSTING', null) === 'strapi.cloud',\n      // Typed `string` in the published contract; null at runtime without a license\n      type: licenseType as string,\n      isTrial: strapi.ee.isTrial,\n      // `features.list()` is loosely typed at the source (`{ name: string; [k]: any }[]`);\n      // narrow it to the contract's named-feature union so consumers (e.g. useLicenseLimits) keep their types.\n      features: (strapi.ee.features.list() ??\n        []) as GetLicenseLimitInformation.Response['data']['features'],\n      entitlements: strapi.ee.entitlements.list(),\n    };\n\n    return { data } satisfies GetLicenseLimitInformation.Response;\n  },\n};\n"],"names":["findRetainedFeature","retainedFeatures","featureName","map","entry","name","find","getProjectType","flags","strapi","config","get","data","isEE","Boolean","EE","isTrial","ee","features","list","type","undefined","planPriceId","ai","enabled","admin","isStrapiManagedAiEnabled","licenseLimitInformation","permittedSeats","seats","retained","retainedLicense","isActiveLicense","licenseStatus","activeEntitlements","entitlements","retainedEntitlements","listRetained","shouldNotify","licenseLimitStatus","enforcementUserCount","currentActiveUserCount","getService","getCurrentActiveUserCount","eeDisabledUsers","getDisabledUserList","length","eeInformation","db","query","findOne","where","key","then","row","JSON","parse","value","catch","licenseType","licenseMode","process","env","STRAPI_DISABLE_LICENSE_PING","toLowerCase","REGISTRY_CHECK_INTERVAL_MS","lastRegistrySyncAt","lastCheckAt","nextRegistrySyncAt","now","Date","next","registryState","subscriptionId","expireAt","renewalDate","planEntitlements","planFeatureCatalog","feature","available","isEnabled","limits","retainedFeature","usingCachedLicense","error","license","registrySyncError","registrySyncErrorKind","errorKind","shouldStopCreate","isHostedOnStrapiCloud"],"mappings":";;;AAUA,MAAMA,mBAAAA,GAAsB,CAC1BC,gBAAAA,EACAC,WAAAA,GAEAD,gBAAAA,EACIE,IAAI,CAACC,KAAAA,GAAW,OAAOA,KAAAA,KAAU,QAAA,GAAW;YAAEC,IAAAA,EAAMD;AAAM,SAAA,GAAIA,OAC/DE,IAAAA,CAAK,CAACF,KAAAA,GAAUA,KAAAA,CAAMC,IAAI,KAAKH,WAAAA,CAAAA;AAEpC,YAAe;;IAEb,MAAMK,cAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,QAAQC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,eAAe,EAAC,CAAA;QAEhD,IAAI;YACF,OAAO;gBACLC,IAAAA,EAAM;;oBAEJC,IAAAA,EAAMC,OAAAA,CAAQL,OAAOM,EAAE,CAAA;oBACvBC,OAAAA,EAASP,MAAAA,CAAOQ,EAAE,CAACD,OAAO;AAC1BE,oBAAAA,QAAAA,EAAUT,MAAAA,CAAOQ,EAAE,CAACC,QAAQ,CAACC,IAAI,EAAA;AACjCX,oBAAAA,KAAAA;AACAY,oBAAAA,IAAAA,EAAMX,MAAAA,CAAOQ,EAAE,CAACG,IAAI,IAAIC,SAAAA;AACxBC,oBAAAA,WAAAA,EAAab,MAAAA,CAAOQ,EAAE,CAACK,WAAW,IAAID,SAAAA;oBACtCE,EAAAA,EAAI;AACFC,wBAAAA,OAAAA,EAASf,MAAAA,CAAOc,EAAE,CAACE,KAAK,CAACC,wBAAwB;AACnD;AACF;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAM;YACN,OAAO;gBAAEd,IAAAA,EAAM;oBAAEC,IAAAA,EAAM,KAAA;oBAAOG,OAAAA,EAAS,KAAA;AAAOE,oBAAAA,QAAAA,EAAU,EAAE;AAAEV,oBAAAA,KAAAA;oBAAOe,EAAAA,EAAI;wBAAEC,OAAAA,EAAS;AAAM;AAAE;AAAE,aAAA;AAC9F,QAAA;AACF,IAAA,CAAA;IAEA,MAAMG,uBAAAA,CAAAA,GAAAA;AACJ,QAAA,MAAMC,cAAAA,GAAiBnB,MAAAA,CAAOQ,EAAE,CAACY,KAAK;;;AAGtC,QAAA,MAAMC,QAAAA,GAAWrB,MAAAA,CAAOQ,EAAE,CAACc,eAAe;AAC1C,QAAA,MAAMC,eAAAA,GAAkBvB,MAAAA,CAAOQ,EAAE,CAACgB,aAAa,KAAK,QAAA;AACpD,QAAA,MAAMC,qBAAqBzB,MAAAA,CAAOQ,EAAE,CAACkB,YAAY,CAAChB,IAAI,EAAA;;;QAGtD,MAAMiB,oBAAAA,GAAuBJ,kBAAkB,EAAE,GAAGvB,OAAOQ,EAAE,CAACkB,YAAY,CAACE,YAAY,EAAA;AAEvF,QAAA,IAAIC,YAAAA,GAAe,KAAA;AACnB,QAAA,IAAIC,kBAAAA,GAAqB,IAAA;QACzB,IAAIC,oBAAAA;AAEJ,QAAA,MAAMC,sBAAAA,GAAyB,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQC,yBAAyB,EAAA;AAEjF,QAAA,MAAMC,eAAAA,GAAkB,MAAMF,UAAAA,CAAW,kBAAA,CAAA,CAAoBG,mBAAmB,EAAA;AAEhF,QAAA,IAAID,eAAAA,EAAiB;YACnBJ,oBAAAA,GAAuBC,sBAAAA,GAAyBG,gBAAgBE,MAAM;QACxE,CAAA,MAAO;YACLN,oBAAAA,GAAuBC,sBAAAA;AACzB,QAAA;QAEA,IAAIb,cAAAA,IAAkB,IAAA,IAAQY,oBAAAA,GAAuBZ,cAAAA,EAAgB;YACnEU,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,YAAA;AACvB,QAAA;QAEA,IAAIX,cAAAA,IAAkB,IAAA,IAAQY,oBAAAA,KAAyBZ,cAAAA,EAAgB;YACrEU,YAAAA,GAAe,IAAA;YACfC,kBAAAA,GAAqB,UAAA;AACvB,QAAA;QAEA,MAAMQ,aAAAA,GAAgB,MAAMtC,MAAAA,CAAOuC,EAAE,CAClCC,KAAK,CAAC,oBAAA,CAAA,CACNC,OAAO,CAAC;YAAEC,KAAAA,EAAO;gBAAEC,GAAAA,EAAK;AAAiB;AAAE,SAAA,CAAA,CAC3CC,IAAI,CAAC,CAACC,GAAAA,GACLA,MACKC,IAAAA,CAAKC,KAAK,CAACF,GAAAA,CAAIG,KAAK,CAAA,GAMrB,IAAA,CAAA,CAELC,KAAK,CAAC,IAAM,IAAA,CAAA;;;;AAKf,QAAA,MAAMC,cAAclD,MAAAA,CAAOQ,EAAE,CAACG,IAAI,IAAIU,UAAUV,IAAAA,IAAQ,IAAA;QACxD,MAAMwC,WAAAA,GACJD,WAAAA,KAAgB,MAAA,IAAUE,OAAAA,CAAQC,GAAG,CAACC,2BAA2B,EAAEC,WAAAA,EAAAA,KAAkB,MAAA,GACjF,SAAA,GACA,QAAA;;QAGN,MAAMC,0BAAAA,GAA6B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,IAAA;QAClD,MAAMC,kBAAAA,GAAoCnB,eAAeoB,WAAAA,IAAe,IAAA;AACxE,QAAA,IAAIC,kBAAAA,GAAoC,IAAA;AACxC,QAAA,IAAIR,WAAAA,KAAgB,QAAA,IAAY,OAAOM,kBAAAA,KAAuB,QAAA,EAAU;;;YAGtE,MAAMG,GAAAA,GAAMC,KAAKD,GAAG,EAAA;AACpB,YAAA,IAAIE,OAAOL,kBAAAA,GAAqBD,0BAAAA;AAChC,YAAA,MAAOM,QAAQF,GAAAA,CAAK;gBAClBE,IAAAA,IAAQN,0BAAAA;AACV,YAAA;YACAG,kBAAAA,GAAqBG,IAAAA;AACvB,QAAA;;;QAIA,MAAMC,aAAAA,GAAgBZ,WAAAA,KAAgB,QAAA,GAAWb,aAAAA,GAAgB,IAAA;AAEjE,QAAA,MAAMnC,IAAAA,GAAoD;AACxD4B,YAAAA,oBAAAA;AACAC,YAAAA,sBAAAA;;AAEAb,YAAAA,cAAAA,EAAiBA,cAAAA,IAAkB,IAAA;AACnCC,YAAAA,KAAAA,EAAOpB,OAAOQ,EAAE,CAACY,KAAK,IAAIC,UAAUD,KAAAA,IAAS,IAAA;AAC7C4C,YAAAA,cAAAA,EAAgBhE,OAAOQ,EAAE,CAACwD,cAAc,IAAI3C,UAAU2C,cAAAA,IAAkB,IAAA;AACxEC,YAAAA,QAAAA,EAAUjE,OAAOQ,EAAE,CAACyD,QAAQ,IAAI5C,UAAU4C,QAAAA,IAAY,IAAA;YACtDzC,aAAAA,EAAexB,MAAAA,CAAOQ,EAAE,CAACgB,aAAa;AACtCX,YAAAA,WAAAA,EAAab,OAAOQ,EAAE,CAACK,WAAW,IAAIQ,UAAUR,WAAAA,IAAe,IAAA;YAC/DqD,WAAAA,EAAalE,MAAAA,CAAOQ,EAAE,CAAC0D,WAAW;AAClCC,YAAAA,gBAAAA,EAAkBnE,OAAOQ,EAAE,CAAC4D,kBAAkB,CAAC1E,GAAG,CAAC,CAAC2E,OAAAA,GAAAA;AAClD,gBAAA,IAAI9C,eAAAA,EAAiB;;;AAGnB,oBAAA,MAAM+C,YAAYtE,MAAAA,CAAOQ,EAAE,CAACC,QAAQ,CAAC8D,SAAS,CAACF,OAAAA,CAAAA;oBAC/C,OAAO;AACLA,wBAAAA,OAAAA;AACAC,wBAAAA,SAAAA;AACAE,wBAAAA,MAAAA,EAAQF,SAAAA,GACH7C,kBAAAA,CAAmB5B,IAAI,CAAC,CAACF,KAAAA,GAAUA,KAAAA,CAAM0E,OAAO,KAAKA,OAAAA,CAAAA,EAAUG,MAAAA,IAAU,EAAE,GAC5E;AACN,qBAAA;AACF,gBAAA;gBAEA,MAAMC,eAAAA,GAAkBlF,mBAAAA,CAAoB8B,QAAAA,EAAUZ,QAAAA,EAAU4D,OAAAA,CAAAA;gBAEhE,OAAO;AACLA,oBAAAA,OAAAA;AACAC,oBAAAA,SAAAA,EAAWjE,OAAAA,CAAQoE,eAAAA,CAAAA;AACnBD,oBAAAA,MAAAA,EAAQC,eAAAA,GACH9C,oBAAAA,CAAqB9B,IAAI,CAAC,CAACF,KAAAA,GAAUA,KAAAA,CAAM0E,OAAO,KAAKA,OAAAA,CAAAA,EAAUG,MAAAA,IAAU,EAAE,GAC9E;AACN,iBAAA;AACF,YAAA,CAAA,CAAA;AACArB,YAAAA,WAAAA;AACAM,YAAAA,kBAAAA;AACAE,YAAAA,kBAAAA;YACAe,kBAAAA,EAAoBrE,OAAAA,CAAQ0D,aAAAA,EAAeY,KAAAA,IAASZ,aAAAA,EAAea,OAAAA,CAAAA;AACnEC,YAAAA,iBAAAA,EAAmBd,eAAeY,KAAAA,IAAS,IAAA;AAC3CG,YAAAA,qBAAAA,EAAuBf,eAAegB,SAAAA,IAAa,IAAA;AACnDlD,YAAAA,YAAAA;YACAmD,gBAAAA,EAAkB7D,cAAAA,IAAkB,IAAA,GAAO,KAAA,GAAQa,sBAAAA,IAA0Bb,cAAAA;AAC7EW,YAAAA,kBAAAA;YACAmD,qBAAAA,EAAuB5B,GAAAA,CAAI,kBAAkB,IAAA,CAAA,KAAU,cAAA;;YAEvD1C,IAAAA,EAAMuC,WAAAA;YACN3C,OAAAA,EAASP,MAAAA,CAAOQ,EAAE,CAACD,OAAO;;;AAG1BE,YAAAA,QAAAA,EAAWT,OAAOQ,EAAE,CAACC,QAAQ,CAACC,IAAI,MAChC,EAAE;AACJgB,YAAAA,YAAAA,EAAc1B,MAAAA,CAAOQ,EAAE,CAACkB,YAAY,CAAChB,IAAI;AAC3C,SAAA;QAEA,OAAO;AAAEP,YAAAA;AAAK,SAAA;AAChB,IAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
 var passport = require('koa-passport');
 var index = require('../../utils/index.js');
 var utils = require('./utils.js');
+var auth = require('../../../../../server/src/audit-logs/auth.js');
 var sessionAuth = require('../../../../../shared/utils/session-auth.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -21,9 +22,12 @@ const authenticate = async (ctx, next)=>{
             if (error) {
                 strapi.log.error(error);
             }
-            strapi.eventHub.emit('admin.auth.error', {
+            auth.emitLoginFailure({
+                strapi
+            }, {
                 error: error || defaultConnectionError(),
-                provider
+                provider,
+                reason: 'sso_connection_error'
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -35,9 +39,13 @@ const authenticate = async (ctx, next)=>{
 const existingUserScenario = (ctx, next)=>async (user, provider)=>{
         const redirectUrls = utils.default.getPrefixedRedirectUrls();
         if (!user.isActive) {
-            strapi.eventHub.emit('admin.auth.error', {
+            auth.emitLoginFailure({
+                strapi
+            }, {
                 error: new Error(`Deactivated user tried to login (${user.id})`),
-                provider
+                provider,
+                reason: 'account_inactive',
+                user
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -54,9 +62,12 @@ const nonExistingUserScenario = (ctx, next)=>async (profile, provider)=>{
         // We need at least the username or the firstname/lastname combination to register a new user
         const isMissingRegisterFields = !username && (!firstname || !lastname);
         if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {
-            strapi.eventHub.emit('admin.auth.error', {
+            auth.emitLoginFailure({
+                strapi
+            }, {
                 error: defaultConnectionError(),
-                provider
+                provider,
+                reason: 'sso_registration_disabled'
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -65,9 +76,12 @@ const nonExistingUserScenario = (ctx, next)=>async (profile, provider)=>{
         });
         // If the default role has been misconfigured, redirect with an error
         if (!defaultRole) {
-            strapi.eventHub.emit('admin.auth.error', {
+            auth.emitLoginFailure({
+                strapi
+            }, {
                 error: defaultConnectionError(),
-                provider
+                provider,
+                reason: 'sso_role_misconfigured'
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -136,9 +150,13 @@ const redirectWithAuth = async (ctx)=>{
         ctx.redirect(redirectUrls.success);
     } catch (error) {
         strapi.log.error('SSO authentication failed during token generation', error);
-        strapi.eventHub.emit('admin.auth.error', {
+        auth.emitLoginFailure({
+            strapi
+        }, {
             error: error instanceof Error ? error : new Error('Unknown SSO error'),
-            provider
+            provider,
+            reason: 'unexpected_error',
+            user
         });
         return ctx.redirect(redirectUrls.error);
     }

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.js.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;AAeA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,2CAAAA,CAAgCrD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMsD,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BhD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBnD,MAAAA,CAAOoD,MAAM,CAAChC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMiC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,iCAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,+BAAAA,EAAAA;AAEbxE,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACgB,mCAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB5D,gBAAAA,CAAW,MAAA,CAAA,CAAQ6D,YAAY,CAAC9D,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAM6D,aAAAA;AAAe1E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa2E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOvE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;;;"}
+{"version":3,"file":"middlewares.js","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport { emitLoginFailure } from '../../../../../server/src/audit-logs/auth';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      emitLoginFailure(\n        { strapi },\n        { error: error || defaultConnectionError(), provider, reason: 'sso_connection_error' }\n      );\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      emitLoginFailure(\n        { strapi },\n        {\n          error: new Error(`Deactivated user tried to login (${user.id})`),\n          provider,\n          reason: 'account_inactive',\n          user,\n        }\n      );\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      emitLoginFailure(\n        { strapi },\n        { error: defaultConnectionError(), provider, reason: 'sso_registration_disabled' }\n      );\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      emitLoginFailure(\n        { strapi },\n        { error: defaultConnectionError(), provider, reason: 'sso_role_misconfigured' }\n      );\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    emitLoginFailure(\n      { strapi },\n      {\n        error: error instanceof Error ? error : new Error('Unknown SSO error'),\n        provider,\n        reason: 'unexpected_error',\n        user,\n      }\n    );\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","emitLoginFailure","reason","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","eventHub","emit","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,0BAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;YAEAK,qBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;AAAEH,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAA0BM,gBAAAA,QAAAA;gBAAUW,MAAAA,EAAQ;AAAuB,aAAA,CAAA;AAGvF,YAAA,OAAOd,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,gBAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;YAClBT,qBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;gBACEH,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA,QAAAA;gBACAW,MAAAA,EAAQ,kBAAA;AACRE,gBAAAA;AACF,aAAA,CAAA;AAEF,YAAA,OAAOhB,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,aAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;YAChFpB,qBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;gBAAEH,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA,QAAAA;gBAAUW,MAAAA,EAAQ;AAA4B,aAAA,CAAA;AAEnF,YAAA,OAAOd,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,gBAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;YAChBtB,qBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;gBAAEH,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA,QAAAA;gBAAUW,MAAAA,EAAQ;AAAyB,aAAA,CAAA;AAEhF,YAAA,OAAOd,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,gBAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAO6B,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDzB,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMyC,mBAA2C,OAAO1C,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,cAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMmB,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnBhC,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMqC,MAAAA,GAASC,MAAAA,CAAO9B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMwB,QAAAA,GAAWC,4BAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,2CAAAA,CAAgCvD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMwD,aAAAA,GAAgBC,yCAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DnD,QAAAA,GAAAA,CAAI0D,OAAO,CAACC,GAAG,CAACC,iCAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BlD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEyC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBrD,MAAAA,CAAOsD,MAAM,CAAClC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMmC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,iCAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,+BAAAA,EAAAA;AAEb1E,QAAAA,GAAAA,CAAI0D,OAAO,CAACC,GAAG,CAACgB,mCAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB9D,gBAAAA,CAAW,MAAA,CAAA,CAAQ+D,YAAY,CAAChE,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAO6B,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEzB,IAAAA,EAAM+D,aAAAA;AAAe5E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa6E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOzE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;QACtEK,qBAAAA,CACE;AAAEF,YAAAA;SAAO,EACT;AACEH,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA,QAAAA;YACAW,MAAAA,EAAQ,kBAAA;AACRE,YAAAA;AACF,SAAA,CAAA;AAEF,QAAA,OAAOhB,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACA2C,IAAAA;AACF,CAAA;;;;;;"}

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs

@@ -1,6 +1,7 @@
 import passport from 'koa-passport';
 import { getService } from '../../utils/index.mjs';
 import utils from './utils.mjs';
+import { emitLoginFailure } from '../../../../../server/src/audit-logs/auth.mjs';
 import { getSessionManager, generateDeviceId, buildSessionMetadataFromContext, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getAccessCookieDomain, getAccessCookiePath, getAccessCookieName } from '../../../../../shared/utils/session-auth.mjs';
 
 const defaultConnectionError = ()=>new Error('Invalid connection payload');
@@ -13,9 +14,12 @@ const authenticate = async (ctx, next)=>{
             if (error) {
                 strapi.log.error(error);
             }
-            strapi.eventHub.emit('admin.auth.error', {
+            emitLoginFailure({
+                strapi
+            }, {
                 error: error || defaultConnectionError(),
-                provider
+                provider,
+                reason: 'sso_connection_error'
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -27,9 +31,13 @@ const authenticate = async (ctx, next)=>{
 const existingUserScenario = (ctx, next)=>async (user, provider)=>{
         const redirectUrls = utils.getPrefixedRedirectUrls();
         if (!user.isActive) {
-            strapi.eventHub.emit('admin.auth.error', {
+            emitLoginFailure({
+                strapi
+            }, {
                 error: new Error(`Deactivated user tried to login (${user.id})`),
-                provider
+                provider,
+                reason: 'account_inactive',
+                user
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -46,9 +54,12 @@ const nonExistingUserScenario = (ctx, next)=>async (profile, provider)=>{
         // We need at least the username or the firstname/lastname combination to register a new user
         const isMissingRegisterFields = !username && (!firstname || !lastname);
         if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {
-            strapi.eventHub.emit('admin.auth.error', {
+            emitLoginFailure({
+                strapi
+            }, {
                 error: defaultConnectionError(),
-                provider
+                provider,
+                reason: 'sso_registration_disabled'
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -57,9 +68,12 @@ const nonExistingUserScenario = (ctx, next)=>async (profile, provider)=>{
         });
         // If the default role has been misconfigured, redirect with an error
         if (!defaultRole) {
-            strapi.eventHub.emit('admin.auth.error', {
+            emitLoginFailure({
+                strapi
+            }, {
                 error: defaultConnectionError(),
-                provider
+                provider,
+                reason: 'sso_role_misconfigured'
             });
             return ctx.redirect(redirectUrls.error);
         }
@@ -128,9 +142,13 @@ const redirectWithAuth = async (ctx)=>{
         ctx.redirect(redirectUrls.success);
     } catch (error) {
         strapi.log.error('SSO authentication failed during token generation', error);
-        strapi.eventHub.emit('admin.auth.error', {
+        emitLoginFailure({
+            strapi
+        }, {
             error: error instanceof Error ? error : new Error('Unknown SSO error'),
-            provider
+            provider,
+            reason: 'unexpected_error',
+            user
         });
         return ctx.redirect(redirectUrls.error);
     }

package/dist/server/ee/server/src/controllers/authentication-utils/middlewares.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      strapi.eventHub.emit('admin.auth.error', {\n        error: error || defaultConnectionError(),\n        provider,\n      });\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      strapi.eventHub.emit('admin.auth.error', {\n        error: new Error(`Deactivated user tried to login (${user.id})`),\n        provider,\n      });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    strapi.eventHub.emit('admin.auth.error', {\n      error: error instanceof Error ? error : new Error('Unknown SSO error'),\n      provider,\n    });\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","eventHub","emit","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;AAeA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;AAEAG,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAChBM,gBAAAA;AACF,aAAA,CAAA;AAEA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;AAClBX,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBACvCN,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA;AACF,aAAA,CAAA;AACA,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;AAChFtB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;AAChBxB,YAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;gBAAEN,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA;AAAS,aAAA,CAAA;AACrF,YAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDE,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMuC,mBAA2C,OAAOxC,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMiB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnB9B,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMmC,MAAAA,GAASC,MAAAA,CAAO5B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMsB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,+BAAAA,CAAgCrD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMsD,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DjD,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACC,qBAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BhD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEuC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBnD,MAAAA,CAAOoD,MAAM,CAAChC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMiC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,qBAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,mBAAAA,EAAAA;AAEbxE,QAAAA,GAAAA,CAAIwD,OAAO,CAACC,GAAG,CAACgB,uBAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB5D,UAAAA,CAAW,MAAA,CAAA,CAAQ6D,YAAY,CAAC9D,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEE,IAAAA,EAAM6D,aAAAA;AAAe1E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa2E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOvE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;AACtEG,QAAAA,MAAAA,CAAOE,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;AACvCN,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA;AACF,SAAA,CAAA;AACA,QAAA,OAAOH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACAyC,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"middlewares.mjs","sources":["../../../../../../../ee/server/src/controllers/authentication-utils/middlewares.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport passport from 'koa-passport';\nimport { getService } from '../../utils';\nimport utils from './utils';\nimport { emitLoginFailure } from '../../../../../server/src/audit-logs/auth';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getAccessCookieName,\n  getAccessCookiePath,\n  getAccessCookieDomain,\n  getSessionManager,\n  generateDeviceId,\n} from '../../../../../shared/utils/session-auth';\n\nconst defaultConnectionError = () => new Error('Invalid connection payload');\n\nexport const authenticate: Core.MiddlewareHandler = async (ctx, next) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n\n  // @ts-expect-error - can not use null to authenticate\n  return passport.authenticate(provider, null, async (error, profile) => {\n    if (error || !profile || !profile.email) {\n      if (error) {\n        strapi.log.error(error);\n      }\n\n      emitLoginFailure(\n        { strapi },\n        { error: error || defaultConnectionError(), provider, reason: 'sso_connection_error' }\n      );\n\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const user = await getService('user').findOneByEmail(profile.email);\n    const scenario = user ? existingUserScenario : nonExistingUserScenario;\n\n    return scenario(ctx, next)(user || profile, provider);\n  })(ctx, next);\n};\n\nconst existingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (user: any, provider: any) => {\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n\n    if (!user.isActive) {\n      emitLoginFailure(\n        { strapi },\n        {\n          error: new Error(`Deactivated user tried to login (${user.id})`),\n          provider,\n          reason: 'account_inactive',\n          user,\n        }\n      );\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    ctx.state.user = user;\n    return next();\n  };\n\nconst nonExistingUserScenario: Core.MiddlewareHandler =\n  (ctx, next) => async (profile: any, provider: any) => {\n    const { email, firstname, lastname, username } = profile;\n    const redirectUrls = utils.getPrefixedRedirectUrls();\n    const adminStore = await utils.getAdminStore();\n    const { providers } = (await adminStore.get({ key: 'auth' })) as any;\n\n    // We need at least the username or the firstname/lastname combination to register a new user\n    const isMissingRegisterFields = !username && (!firstname || !lastname);\n\n    if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {\n      emitLoginFailure(\n        { strapi },\n        { error: defaultConnectionError(), provider, reason: 'sso_registration_disabled' }\n      );\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const defaultRole = await getService('role').findOne({ id: providers.defaultRole });\n\n    // If the default role has been misconfigured, redirect with an error\n    if (!defaultRole) {\n      emitLoginFailure(\n        { strapi },\n        { error: defaultConnectionError(), provider, reason: 'sso_role_misconfigured' }\n      );\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    // Register a new user with the information given by the provider and login with it\n    ctx.state.user = await getService('user').create({\n      email,\n      username,\n      firstname,\n      lastname,\n      roles: [defaultRole.id],\n      isActive: true,\n      registrationToken: null,\n    });\n\n    strapi.eventHub.emit('admin.auth.autoRegistration', {\n      user: ctx.state.user,\n      provider,\n    });\n\n    return next();\n  };\n\nexport const redirectWithAuth: Core.MiddlewareHandler = async (ctx) => {\n  const {\n    params: { provider },\n  } = ctx;\n  const redirectUrls = utils.getPrefixedRedirectUrls();\n  const { user } = ctx.state;\n\n  try {\n    const sessionManager = getSessionManager();\n    if (!sessionManager) {\n      strapi.log.error('SessionManager not available for SSO authentication');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const userId = String(user.id);\n    const deviceId = generateDeviceId();\n\n    const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n      'admin'\n    ).generateRefreshToken(userId, deviceId, {\n      type: 'refresh',\n      metadata: buildSessionMetadataFromContext(ctx),\n    });\n\n    const cookieOptions = buildCookieOptionsWithExpiry('refresh', absoluteExpiresAt);\n    ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n    const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n    if ('error' in accessResult) {\n      strapi.log.error('Failed to generate access token for SSO user');\n      return ctx.redirect(redirectUrls.error);\n    }\n\n    const { token: accessToken } = accessResult;\n\n    const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n    const isProduction = process.env.NODE_ENV === 'production';\n    const isSecure = typeof configuredSecure === 'boolean' ? configuredSecure : isProduction;\n\n    // Resolve through the shared helpers so the server write agrees with the\n    // client set/delete (which read the same config inlined at build time);\n    // any divergence leaves a cookie the admin panel cannot clear on logout.\n    const domain = getAccessCookieDomain();\n    const path = getAccessCookiePath();\n\n    ctx.cookies.set(getAccessCookieName(), accessToken, {\n      httpOnly: false,\n      secure: isSecure,\n      overwrite: true,\n      domain,\n      path,\n    });\n\n    const sanitizedUser = getService('user').sanitizeUser(user);\n    strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider });\n\n    ctx.redirect(redirectUrls.success);\n  } catch (error) {\n    strapi.log.error('SSO authentication failed during token generation', error);\n    emitLoginFailure(\n      { strapi },\n      {\n        error: error instanceof Error ? error : new Error('Unknown SSO error'),\n        provider,\n        reason: 'unexpected_error',\n        user,\n      }\n    );\n    return ctx.redirect(redirectUrls.error);\n  }\n};\n\nexport default {\n  authenticate,\n  redirectWithAuth,\n};\n"],"names":["defaultConnectionError","Error","authenticate","ctx","next","params","provider","redirectUrls","utils","getPrefixedRedirectUrls","passport","error","profile","email","strapi","log","emitLoginFailure","reason","redirect","user","getService","findOneByEmail","scenario","existingUserScenario","nonExistingUserScenario","isActive","id","state","firstname","lastname","username","adminStore","getAdminStore","providers","get","key","isMissingRegisterFields","autoRegister","defaultRole","findOne","create","roles","registrationToken","eventHub","emit","redirectWithAuth","sessionManager","getSessionManager","userId","String","deviceId","generateDeviceId","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","configuredSecure","config","isProduction","process","env","NODE_ENV","isSecure","domain","getAccessCookieDomain","path","getAccessCookiePath","getAccessCookieName","httpOnly","secure","overwrite","sanitizedUser","sanitizeUser","success"],"mappings":";;;;;;AAgBA,MAAMA,sBAAAA,GAAyB,IAAM,IAAIC,KAAAA,CAAM,4BAAA,CAAA;AAExC,MAAMC,YAAAA,GAAuC,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;AAC9D,IAAA,MAAM,EACJC,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;;AAGlD,IAAA,OAAOC,SAASR,YAAY,CAACI,QAAAA,EAAU,IAAA,EAAM,OAAOK,KAAAA,EAAOC,OAAAA,GAAAA;AACzD,QAAA,IAAID,SAAS,CAACC,OAAAA,IAAW,CAACA,OAAAA,CAAQC,KAAK,EAAE;AACvC,YAAA,IAAIF,KAAAA,EAAO;gBACTG,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAACA,KAAAA,CAAAA;AACnB,YAAA;YAEAK,gBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;AAAEH,gBAAAA,KAAAA,EAAOA,KAAAA,IAASX,sBAAAA,EAAAA;AAA0BM,gBAAAA,QAAAA;gBAAUW,MAAAA,EAAQ;AAAuB,aAAA,CAAA;AAGvF,YAAA,OAAOd,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAMQ,OAAO,MAAMC,UAAAA,CAAW,QAAQC,cAAc,CAACT,QAAQC,KAAK,CAAA;QAClE,MAAMS,QAAAA,GAAWH,OAAOI,oBAAAA,GAAuBC,uBAAAA;AAE/C,QAAA,OAAOF,QAAAA,CAASnB,GAAAA,EAAKC,IAAAA,CAAAA,CAAMe,IAAAA,IAAQP,OAAAA,EAASN,QAAAA,CAAAA;AAC9C,IAAA,CAAA,CAAA,CAAGH,GAAAA,EAAKC,IAAAA,CAAAA;AACV;AAEA,MAAMmB,oBAAAA,GACJ,CAACpB,GAAAA,EAAKC,IAAAA,GAAS,OAAOe,IAAAA,EAAWb,QAAAA,GAAAA;QAC/B,MAAMC,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAElD,IAAI,CAACU,IAAAA,CAAKM,QAAQ,EAAE;YAClBT,gBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;gBACEH,KAAAA,EAAO,IAAIV,MAAM,CAAC,iCAAiC,EAAEkB,IAAAA,CAAKO,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/DpB,gBAAAA,QAAAA;gBACAW,MAAAA,EAAQ,kBAAA;AACRE,gBAAAA;AACF,aAAA,CAAA;AAEF,YAAA,OAAOhB,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAGA,IAAAA;QACjB,OAAOf,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEF,MAAMoB,uBAAAA,GACJ,CAACrB,GAAAA,EAAKC,IAAAA,GAAS,OAAOQ,OAAAA,EAAcN,QAAAA,GAAAA;QAClC,MAAM,EAAEO,KAAK,EAAEe,SAAS,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAGlB,OAAAA;QACjD,MAAML,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;QAClD,MAAMsB,UAAAA,GAAa,MAAMvB,KAAAA,CAAMwB,aAAa,EAAA;AAC5C,QAAA,MAAM,EAAEC,SAAS,EAAE,GAAI,MAAMF,UAAAA,CAAWG,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAO,SAAA,CAAA;;AAG1D,QAAA,MAAMC,0BAA0B,CAACN,QAAAA,KAAa,CAACF,SAAAA,IAAa,CAACC,QAAO,CAAA;QAEpE,IAAI,CAACI,UAAUI,YAAY,IAAI,CAACJ,SAAAA,CAAUK,WAAW,IAAIF,uBAAAA,EAAyB;YAChFpB,gBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;gBAAEH,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA,QAAAA;gBAAUW,MAAAA,EAAQ;AAA4B,aAAA,CAAA;AAEnF,YAAA,OAAOd,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM2B,WAAAA,GAAc,MAAMlB,UAAAA,CAAW,MAAA,CAAA,CAAQmB,OAAO,CAAC;AAAEb,YAAAA,EAAAA,EAAIO,UAAUK;AAAY,SAAA,CAAA;;AAGjF,QAAA,IAAI,CAACA,WAAAA,EAAa;YAChBtB,gBAAAA,CACE;AAAEF,gBAAAA;aAAO,EACT;gBAAEH,KAAAA,EAAOX,sBAAAA,EAAAA;AAA0BM,gBAAAA,QAAAA;gBAAUW,MAAAA,EAAQ;AAAyB,aAAA,CAAA;AAEhF,YAAA,OAAOd,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;;QAGAR,GAAAA,CAAIwB,KAAK,CAACR,IAAI,GAAG,MAAMC,UAAAA,CAAW,MAAA,CAAA,CAAQoB,MAAM,CAAC;AAC/C3B,YAAAA,KAAAA;AACAiB,YAAAA,QAAAA;AACAF,YAAAA,SAAAA;AACAC,YAAAA,QAAAA;YACAY,KAAAA,EAAO;AAACH,gBAAAA,WAAAA,CAAYZ;AAAG,aAAA;YACvBD,QAAAA,EAAU,IAAA;YACViB,iBAAAA,EAAmB;AACrB,SAAA,CAAA;AAEA5B,QAAAA,MAAAA,CAAO6B,QAAQ,CAACC,IAAI,CAAC,6BAAA,EAA+B;YAClDzB,IAAAA,EAAMhB,GAAAA,CAAIwB,KAAK,CAACR,IAAI;AACpBb,YAAAA;AACF,SAAA,CAAA;QAEA,OAAOF,IAAAA,EAAAA;AACT,IAAA,CAAA;AAEK,MAAMyC,mBAA2C,OAAO1C,GAAAA,GAAAA;AAC7D,IAAA,MAAM,EACJE,MAAAA,EAAQ,EAAEC,QAAQ,EAAE,EACrB,GAAGH,GAAAA;IACJ,MAAMI,YAAAA,GAAeC,MAAMC,uBAAuB,EAAA;AAClD,IAAA,MAAM,EAAEU,IAAI,EAAE,GAAGhB,IAAIwB,KAAK;IAE1B,IAAI;AACF,QAAA,MAAMmB,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,QAAA,IAAI,CAACD,cAAAA,EAAgB;YACnBhC,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,qDAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;QAEA,MAAMqC,MAAAA,GAASC,MAAAA,CAAO9B,IAAAA,CAAKO,EAAE,CAAA;AAC7B,QAAA,MAAMwB,QAAAA,GAAWC,gBAAAA,EAAAA;AAEjB,QAAA,MAAM,EAAEC,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMR,cAAAA,CACvD,OAAA,CAAA,CACAS,oBAAoB,CAACP,QAAQE,QAAAA,EAAU;YACvCM,IAAAA,EAAM,SAAA;AACNC,YAAAA,QAAAA,EAAUC,+BAAAA,CAAgCvD,GAAAA;AAC5C,SAAA,CAAA;QAEA,MAAMwD,aAAAA,GAAgBC,6BAA6B,SAAA,EAAWN,iBAAAA,CAAAA;AAC9DnD,QAAAA,GAAAA,CAAI0D,OAAO,CAACC,GAAG,CAACC,qBAAqBV,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,QAAA,MAAMK,YAAAA,GAAe,MAAMlB,cAAAA,CAAe,OAAA,CAAA,CAASmB,mBAAmB,CAACZ,YAAAA,CAAAA;AACvE,QAAA,IAAI,WAAWW,YAAAA,EAAc;YAC3BlD,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,8CAAA,CAAA;AACjB,YAAA,OAAOR,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,QAAA;AAEA,QAAA,MAAM,EAAEyC,KAAAA,EAAOc,WAAW,EAAE,GAAGF,YAAAA;AAE/B,QAAA,MAAMG,gBAAAA,GAAmBrD,MAAAA,CAAOsD,MAAM,CAAClC,GAAG,CAAC,0BAAA,CAAA;AAC3C,QAAA,MAAMmC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAC9C,QAAA,MAAMC,QAAAA,GAAW,OAAON,gBAAAA,KAAqB,SAAA,GAAYA,gBAAAA,GAAmBE,YAAAA;;;;AAK5E,QAAA,MAAMK,MAAAA,GAASC,qBAAAA,EAAAA;AACf,QAAA,MAAMC,IAAAA,GAAOC,mBAAAA,EAAAA;AAEb1E,QAAAA,GAAAA,CAAI0D,OAAO,CAACC,GAAG,CAACgB,uBAAuBZ,WAAAA,EAAa;YAClDa,QAAAA,EAAU,KAAA;YACVC,MAAAA,EAAQP,QAAAA;YACRQ,SAAAA,EAAW,IAAA;AACXP,YAAAA,MAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEA,QAAA,MAAMM,aAAAA,GAAgB9D,UAAAA,CAAW,MAAA,CAAA,CAAQ+D,YAAY,CAAChE,IAAAA,CAAAA;AACtDL,QAAAA,MAAAA,CAAO6B,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;YAAEzB,IAAAA,EAAM+D,aAAAA;AAAe5E,YAAAA;AAAS,SAAA,CAAA;QAE3EH,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAa6E,OAAO,CAAA;AACnC,IAAA,CAAA,CAAE,OAAOzE,KAAAA,EAAO;AACdG,QAAAA,MAAAA,CAAOC,GAAG,CAACJ,KAAK,CAAC,mDAAA,EAAqDA,KAAAA,CAAAA;QACtEK,gBAAAA,CACE;AAAEF,YAAAA;SAAO,EACT;AACEH,YAAAA,KAAAA,EAAOA,KAAAA,YAAiBV,KAAAA,GAAQU,KAAAA,GAAQ,IAAIV,KAAAA,CAAM,mBAAA,CAAA;AAClDK,YAAAA,QAAAA;YACAW,MAAAA,EAAQ,kBAAA;AACRE,YAAAA;AACF,SAAA,CAAA;AAEF,QAAA,OAAOhB,GAAAA,CAAIe,QAAQ,CAACX,YAAAA,CAAaI,KAAK,CAAA;AACxC,IAAA;AACF;AAEA,kBAAe;AACbT,IAAAA,YAAAA;AACA2C,IAAAA;AACF,CAAA;;;;"}

package/dist/server/ee/server/src/index.js

@@ -16,6 +16,7 @@ var auditLogExport = require('../../../shared/utils/audit-log-export.js');
 var tokens = require('../../../server/src/audit-logs/tokens.js');
 var adminUsers = require('../../../server/src/audit-logs/admin-users.js');
 var webhooks = require('../../../server/src/audit-logs/webhooks.js');
+var auth = require('../../../server/src/audit-logs/auth.js');
 
 const getAdminEE = ()=>{
     const eeAdmin = {
@@ -69,6 +70,7 @@ const getAdminEE = ()=>{
                 tokens.registerTokenAuditEvents(auditLogsLifecycle);
                 adminUsers.registerAdminUserAuditEvents(auditLogsLifecycle);
                 webhooks.registerWebhookAuditEvents(auditLogsLifecycle);
+                auth.registerAuthAuditEvents(auditLogsLifecycle);
                 await auditLogsLifecycle.register();
             }
         },

package/dist/server/ee/server/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../../../ee/server/src/index.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport register from './register';\nimport bootstrap from './bootstrap';\nimport destroy from './destroy';\nimport adminContentTypes from './content-types';\nimport services from './services';\nimport controllers from './controllers';\nimport routes from './routes';\nimport auditLogsRoutes from './audit-logs/routes/audit-logs';\nimport auditLogsController from './audit-logs/controllers/audit-logs';\nimport { createAuditLogsService } from './audit-logs/services/audit-logs';\nimport { createAuditLogsLifecycleService } from './audit-logs/services/lifecycles';\nimport { auditLog } from './audit-logs/content-types/audit-log';\nimport { AUDIT_LOG_EXPORT_EVENT } from '../../../shared/utils/audit-log-export';\nimport { registerTokenAuditEvents } from '../../../server/src/audit-logs/tokens';\nimport { registerAdminUserAuditEvents } from '../../../server/src/audit-logs/admin-users';\nimport { registerWebhookAuditEvents } from '../../../server/src/audit-logs/webhooks';\n\nconst getAdminEE = () => {\n  const eeAdmin = {\n    register,\n    bootstrap,\n    destroy,\n    contentTypes: {\n      // Always register the audit-log content type to prevent data loss\n      'audit-log': auditLog,\n      ...adminContentTypes,\n    },\n    services,\n    controllers,\n    routes,\n  };\n\n  const isAuditLogsEnabled =\n    strapi.config.get('admin.auditLogs.enabled', true) &&\n    strapi.ee.features.isEnabled('audit-logs');\n  return {\n    ...eeAdmin,\n    controllers: {\n      ...eeAdmin.controllers,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsController } : {}),\n    },\n    routes: {\n      ...eeAdmin.routes,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsRoutes } : {}),\n    },\n    async register({ strapi }: { strapi: Core.Strapi }) {\n      // Run the default registration\n      await eeAdmin.register({ strapi });\n\n      if (isAuditLogsEnabled) {\n        // Register an internal audit logs service\n        strapi.add('audit-logs', createAuditLogsService(strapi));\n        // Register an internal audit logs lifecycle service\n        const auditLogsLifecycle = createAuditLogsLifecycleService(strapi);\n        strapi.add('audit-logs-lifecycle', auditLogsLifecycle);\n\n        auditLogsLifecycle.registerEvent(\n          AUDIT_LOG_EXPORT_EVENT,\n          (event: { filters?: unknown }) => ({\n            resource: { type: 'audit-log' },\n            details: { format: 'csv', filters: event?.filters ?? null },\n          })\n        );\n\n        registerTokenAuditEvents(auditLogsLifecycle);\n        registerAdminUserAuditEvents(auditLogsLifecycle);\n        registerWebhookAuditEvents(auditLogsLifecycle);\n\n        await auditLogsLifecycle.register();\n      }\n    },\n    async destroy({ strapi }: { strapi: Core.Strapi }) {\n      if (isAuditLogsEnabled) {\n        strapi.get('audit-logs-lifecycle').destroy();\n      }\n      await eeAdmin.destroy();\n    },\n  };\n};\n\nexport default getAdminEE;\n"],"names":["getAdminEE","eeAdmin","register","bootstrap","destroy","contentTypes","auditLog","adminContentTypes","services","controllers","routes","isAuditLogsEnabled","strapi","config","get","ee","features","isEnabled","auditLogsController","auditLogsRoutes","add","createAuditLogsService","auditLogsLifecycle","createAuditLogsLifecycleService","registerEvent","AUDIT_LOG_EXPORT_EVENT","event","resource","type","details","format","filters","registerTokenAuditEvents","registerAdminUserAuditEvents","registerWebhookAuditEvents"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBA,MAAMA,UAAAA,GAAa,IAAA;AACjB,IAAA,MAAMC,OAAAA,GAAU;AACdC,QAAAA,QAAAA;AACAC,QAAAA,SAAAA;AACAC,QAAAA,OAAAA;QACAC,YAAAA,EAAc;;YAEZ,WAAA,EAAaC,iBAAAA;AACb,YAAA,GAAGC;AACL,SAAA;AACAC,kBAAAA,OAAAA;AACAC,qBAAAA,OAAAA;AACAC,gBAAAA;AACF,KAAA;AAEA,IAAA,MAAMC,kBAAAA,GACJC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,yBAAA,EAA2B,IAAA,CAAA,IAC7CF,MAAAA,CAAOG,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,YAAA,CAAA;IAC/B,OAAO;AACL,QAAA,GAAGhB,OAAO;QACVQ,WAAAA,EAAa;AACX,YAAA,GAAGR,QAAQQ,WAAW;AACtB,YAAA,GAAIE,kBAAAA,GAAqB;gBAAE,YAAA,EAAcO;AAAoB,aAAA,GAAI;AACnE,SAAA;QACAR,MAAAA,EAAQ;AACN,YAAA,GAAGT,QAAQS,MAAM;AACjB,YAAA,GAAIC,kBAAAA,GAAqB;gBAAE,YAAA,EAAcQ;AAAgB,aAAA,GAAI;AAC/D,SAAA;AACA,QAAA,MAAMjB,QAAAA,CAAAA,CAAS,EAAEU,MAAAA,EAAAA,OAAM,EAA2B,EAAA;;YAEhD,MAAMX,OAAAA,CAAQC,QAAQ,CAAC;gBAAEU,MAAAA,EAAAA;AAAO,aAAA,CAAA;AAEhC,YAAA,IAAID,kBAAAA,EAAoB;;gBAEtBC,OAAAA,CAAOQ,GAAG,CAAC,YAAA,EAAcC,kCAAAA,CAAuBT,OAAAA,CAAAA,CAAAA;;AAEhD,gBAAA,MAAMU,qBAAqBC,0CAAAA,CAAgCX,OAAAA,CAAAA;gBAC3DA,OAAAA,CAAOQ,GAAG,CAAC,sBAAA,EAAwBE,kBAAAA,CAAAA;AAEnCA,gBAAAA,kBAAAA,CAAmBE,aAAa,CAC9BC,qCAAAA,EACA,CAACC,SAAkC;wBACjCC,QAAAA,EAAU;4BAAEC,IAAAA,EAAM;AAAY,yBAAA;wBAC9BC,OAAAA,EAAS;4BAAEC,MAAAA,EAAQ,KAAA;AAAOC,4BAAAA,OAAAA,EAASL,OAAOK,OAAAA,IAAW;AAAK;qBAC5D,CAAA,CAAA;gBAGFC,+BAAAA,CAAyBV,kBAAAA,CAAAA;gBACzBW,uCAAAA,CAA6BX,kBAAAA,CAAAA;gBAC7BY,mCAAAA,CAA2BZ,kBAAAA,CAAAA;AAE3B,gBAAA,MAAMA,mBAAmBpB,QAAQ,EAAA;AACnC,YAAA;AACF,QAAA,CAAA;AACA,QAAA,MAAME,OAAAA,CAAAA,CAAQ,EAAEQ,MAAAA,EAAAA,OAAM,EAA2B,EAAA;AAC/C,YAAA,IAAID,kBAAAA,EAAoB;gBACtBC,OAAAA,CAAOE,GAAG,CAAC,sBAAA,CAAA,CAAwBV,OAAO,EAAA;AAC5C,YAAA;AACA,YAAA,MAAMH,QAAQG,OAAO,EAAA;AACvB,QAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"index.js","sources":["../../../../../ee/server/src/index.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport register from './register';\nimport bootstrap from './bootstrap';\nimport destroy from './destroy';\nimport adminContentTypes from './content-types';\nimport services from './services';\nimport controllers from './controllers';\nimport routes from './routes';\nimport auditLogsRoutes from './audit-logs/routes/audit-logs';\nimport auditLogsController from './audit-logs/controllers/audit-logs';\nimport { createAuditLogsService } from './audit-logs/services/audit-logs';\nimport { createAuditLogsLifecycleService } from './audit-logs/services/lifecycles';\nimport { auditLog } from './audit-logs/content-types/audit-log';\nimport { AUDIT_LOG_EXPORT_EVENT } from '../../../shared/utils/audit-log-export';\nimport { registerTokenAuditEvents } from '../../../server/src/audit-logs/tokens';\nimport { registerAdminUserAuditEvents } from '../../../server/src/audit-logs/admin-users';\nimport { registerWebhookAuditEvents } from '../../../server/src/audit-logs/webhooks';\nimport { registerAuthAuditEvents } from '../../../server/src/audit-logs/auth';\n\nconst getAdminEE = () => {\n  const eeAdmin = {\n    register,\n    bootstrap,\n    destroy,\n    contentTypes: {\n      // Always register the audit-log content type to prevent data loss\n      'audit-log': auditLog,\n      ...adminContentTypes,\n    },\n    services,\n    controllers,\n    routes,\n  };\n\n  const isAuditLogsEnabled =\n    strapi.config.get('admin.auditLogs.enabled', true) &&\n    strapi.ee.features.isEnabled('audit-logs');\n  return {\n    ...eeAdmin,\n    controllers: {\n      ...eeAdmin.controllers,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsController } : {}),\n    },\n    routes: {\n      ...eeAdmin.routes,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsRoutes } : {}),\n    },\n    async register({ strapi }: { strapi: Core.Strapi }) {\n      // Run the default registration\n      await eeAdmin.register({ strapi });\n\n      if (isAuditLogsEnabled) {\n        // Register an internal audit logs service\n        strapi.add('audit-logs', createAuditLogsService(strapi));\n        // Register an internal audit logs lifecycle service\n        const auditLogsLifecycle = createAuditLogsLifecycleService(strapi);\n        strapi.add('audit-logs-lifecycle', auditLogsLifecycle);\n\n        auditLogsLifecycle.registerEvent(\n          AUDIT_LOG_EXPORT_EVENT,\n          (event: { filters?: unknown }) => ({\n            resource: { type: 'audit-log' },\n            details: { format: 'csv', filters: event?.filters ?? null },\n          })\n        );\n\n        registerTokenAuditEvents(auditLogsLifecycle);\n        registerAdminUserAuditEvents(auditLogsLifecycle);\n        registerWebhookAuditEvents(auditLogsLifecycle);\n        registerAuthAuditEvents(auditLogsLifecycle);\n\n        await auditLogsLifecycle.register();\n      }\n    },\n    async destroy({ strapi }: { strapi: Core.Strapi }) {\n      if (isAuditLogsEnabled) {\n        strapi.get('audit-logs-lifecycle').destroy();\n      }\n      await eeAdmin.destroy();\n    },\n  };\n};\n\nexport default getAdminEE;\n"],"names":["getAdminEE","eeAdmin","register","bootstrap","destroy","contentTypes","auditLog","adminContentTypes","services","controllers","routes","isAuditLogsEnabled","strapi","config","get","ee","features","isEnabled","auditLogsController","auditLogsRoutes","add","createAuditLogsService","auditLogsLifecycle","createAuditLogsLifecycleService","registerEvent","AUDIT_LOG_EXPORT_EVENT","event","resource","type","details","format","filters","registerTokenAuditEvents","registerAdminUserAuditEvents","registerWebhookAuditEvents","registerAuthAuditEvents"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmBA,MAAMA,UAAAA,GAAa,IAAA;AACjB,IAAA,MAAMC,OAAAA,GAAU;AACdC,QAAAA,QAAAA;AACAC,QAAAA,SAAAA;AACAC,QAAAA,OAAAA;QACAC,YAAAA,EAAc;;YAEZ,WAAA,EAAaC,iBAAAA;AACb,YAAA,GAAGC;AACL,SAAA;AACAC,kBAAAA,OAAAA;AACAC,qBAAAA,OAAAA;AACAC,gBAAAA;AACF,KAAA;AAEA,IAAA,MAAMC,kBAAAA,GACJC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,yBAAA,EAA2B,IAAA,CAAA,IAC7CF,MAAAA,CAAOG,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,YAAA,CAAA;IAC/B,OAAO;AACL,QAAA,GAAGhB,OAAO;QACVQ,WAAAA,EAAa;AACX,YAAA,GAAGR,QAAQQ,WAAW;AACtB,YAAA,GAAIE,kBAAAA,GAAqB;gBAAE,YAAA,EAAcO;AAAoB,aAAA,GAAI;AACnE,SAAA;QACAR,MAAAA,EAAQ;AACN,YAAA,GAAGT,QAAQS,MAAM;AACjB,YAAA,GAAIC,kBAAAA,GAAqB;gBAAE,YAAA,EAAcQ;AAAgB,aAAA,GAAI;AAC/D,SAAA;AACA,QAAA,MAAMjB,QAAAA,CAAAA,CAAS,EAAEU,MAAAA,EAAAA,OAAM,EAA2B,EAAA;;YAEhD,MAAMX,OAAAA,CAAQC,QAAQ,CAAC;gBAAEU,MAAAA,EAAAA;AAAO,aAAA,CAAA;AAEhC,YAAA,IAAID,kBAAAA,EAAoB;;gBAEtBC,OAAAA,CAAOQ,GAAG,CAAC,YAAA,EAAcC,kCAAAA,CAAuBT,OAAAA,CAAAA,CAAAA;;AAEhD,gBAAA,MAAMU,qBAAqBC,0CAAAA,CAAgCX,OAAAA,CAAAA;gBAC3DA,OAAAA,CAAOQ,GAAG,CAAC,sBAAA,EAAwBE,kBAAAA,CAAAA;AAEnCA,gBAAAA,kBAAAA,CAAmBE,aAAa,CAC9BC,qCAAAA,EACA,CAACC,SAAkC;wBACjCC,QAAAA,EAAU;4BAAEC,IAAAA,EAAM;AAAY,yBAAA;wBAC9BC,OAAAA,EAAS;4BAAEC,MAAAA,EAAQ,KAAA;AAAOC,4BAAAA,OAAAA,EAASL,OAAOK,OAAAA,IAAW;AAAK;qBAC5D,CAAA,CAAA;gBAGFC,+BAAAA,CAAyBV,kBAAAA,CAAAA;gBACzBW,uCAAAA,CAA6BX,kBAAAA,CAAAA;gBAC7BY,mCAAAA,CAA2BZ,kBAAAA,CAAAA;gBAC3Ba,4BAAAA,CAAwBb,kBAAAA,CAAAA;AAExB,gBAAA,MAAMA,mBAAmBpB,QAAQ,EAAA;AACnC,YAAA;AACF,QAAA,CAAA;AACA,QAAA,MAAME,OAAAA,CAAAA,CAAQ,EAAEQ,MAAAA,EAAAA,OAAM,EAA2B,EAAA;AAC/C,YAAA,IAAID,kBAAAA,EAAoB;gBACtBC,OAAAA,CAAOE,GAAG,CAAC,sBAAA,CAAA,CAAwBV,OAAO,EAAA;AAC5C,YAAA;AACA,YAAA,MAAMH,QAAQG,OAAO,EAAA;AACvB,QAAA;AACF,KAAA;AACF;;;;"}

package/dist/server/ee/server/src/index.mjs

@@ -14,6 +14,7 @@ import { AUDIT_LOG_EXPORT_EVENT } from '../../../shared/utils/audit-log-export.m
 import { registerTokenAuditEvents } from '../../../server/src/audit-logs/tokens.mjs';
 import { registerAdminUserAuditEvents } from '../../../server/src/audit-logs/admin-users.mjs';
 import { registerWebhookAuditEvents } from '../../../server/src/audit-logs/webhooks.mjs';
+import { registerAuthAuditEvents } from '../../../server/src/audit-logs/auth.mjs';
 
 const getAdminEE = ()=>{
     const eeAdmin = {
@@ -67,6 +68,7 @@ const getAdminEE = ()=>{
                 registerTokenAuditEvents(auditLogsLifecycle);
                 registerAdminUserAuditEvents(auditLogsLifecycle);
                 registerWebhookAuditEvents(auditLogsLifecycle);
+                registerAuthAuditEvents(auditLogsLifecycle);
                 await auditLogsLifecycle.register();
             }
         },

package/dist/server/ee/server/src/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../../../ee/server/src/index.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport register from './register';\nimport bootstrap from './bootstrap';\nimport destroy from './destroy';\nimport adminContentTypes from './content-types';\nimport services from './services';\nimport controllers from './controllers';\nimport routes from './routes';\nimport auditLogsRoutes from './audit-logs/routes/audit-logs';\nimport auditLogsController from './audit-logs/controllers/audit-logs';\nimport { createAuditLogsService } from './audit-logs/services/audit-logs';\nimport { createAuditLogsLifecycleService } from './audit-logs/services/lifecycles';\nimport { auditLog } from './audit-logs/content-types/audit-log';\nimport { AUDIT_LOG_EXPORT_EVENT } from '../../../shared/utils/audit-log-export';\nimport { registerTokenAuditEvents } from '../../../server/src/audit-logs/tokens';\nimport { registerAdminUserAuditEvents } from '../../../server/src/audit-logs/admin-users';\nimport { registerWebhookAuditEvents } from '../../../server/src/audit-logs/webhooks';\n\nconst getAdminEE = () => {\n  const eeAdmin = {\n    register,\n    bootstrap,\n    destroy,\n    contentTypes: {\n      // Always register the audit-log content type to prevent data loss\n      'audit-log': auditLog,\n      ...adminContentTypes,\n    },\n    services,\n    controllers,\n    routes,\n  };\n\n  const isAuditLogsEnabled =\n    strapi.config.get('admin.auditLogs.enabled', true) &&\n    strapi.ee.features.isEnabled('audit-logs');\n  return {\n    ...eeAdmin,\n    controllers: {\n      ...eeAdmin.controllers,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsController } : {}),\n    },\n    routes: {\n      ...eeAdmin.routes,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsRoutes } : {}),\n    },\n    async register({ strapi }: { strapi: Core.Strapi }) {\n      // Run the default registration\n      await eeAdmin.register({ strapi });\n\n      if (isAuditLogsEnabled) {\n        // Register an internal audit logs service\n        strapi.add('audit-logs', createAuditLogsService(strapi));\n        // Register an internal audit logs lifecycle service\n        const auditLogsLifecycle = createAuditLogsLifecycleService(strapi);\n        strapi.add('audit-logs-lifecycle', auditLogsLifecycle);\n\n        auditLogsLifecycle.registerEvent(\n          AUDIT_LOG_EXPORT_EVENT,\n          (event: { filters?: unknown }) => ({\n            resource: { type: 'audit-log' },\n            details: { format: 'csv', filters: event?.filters ?? null },\n          })\n        );\n\n        registerTokenAuditEvents(auditLogsLifecycle);\n        registerAdminUserAuditEvents(auditLogsLifecycle);\n        registerWebhookAuditEvents(auditLogsLifecycle);\n\n        await auditLogsLifecycle.register();\n      }\n    },\n    async destroy({ strapi }: { strapi: Core.Strapi }) {\n      if (isAuditLogsEnabled) {\n        strapi.get('audit-logs-lifecycle').destroy();\n      }\n      await eeAdmin.destroy();\n    },\n  };\n};\n\nexport default getAdminEE;\n"],"names":["getAdminEE","eeAdmin","register","bootstrap","destroy","contentTypes","auditLog","adminContentTypes","services","controllers","routes","isAuditLogsEnabled","strapi","config","get","ee","features","isEnabled","auditLogsController","auditLogsRoutes","add","createAuditLogsService","auditLogsLifecycle","createAuditLogsLifecycleService","registerEvent","AUDIT_LOG_EXPORT_EVENT","event","resource","type","details","format","filters","registerTokenAuditEvents","registerAdminUserAuditEvents","registerWebhookAuditEvents"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAMA,UAAAA,GAAa,IAAA;AACjB,IAAA,MAAMC,OAAAA,GAAU;AACdC,QAAAA,QAAAA;AACAC,QAAAA,SAAAA;AACAC,QAAAA,OAAAA;QACAC,YAAAA,EAAc;;YAEZ,WAAA,EAAaC,QAAAA;AACb,YAAA,GAAGC;AACL,SAAA;AACAC,QAAAA,QAAAA;AACAC,QAAAA,WAAAA;AACAC,QAAAA;AACF,KAAA;AAEA,IAAA,MAAMC,kBAAAA,GACJC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,yBAAA,EAA2B,IAAA,CAAA,IAC7CF,MAAAA,CAAOG,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,YAAA,CAAA;IAC/B,OAAO;AACL,QAAA,GAAGhB,OAAO;QACVQ,WAAAA,EAAa;AACX,YAAA,GAAGR,QAAQQ,WAAW;AACtB,YAAA,GAAIE,kBAAAA,GAAqB;gBAAE,YAAA,EAAcO;AAAoB,aAAA,GAAI;AACnE,SAAA;QACAR,MAAAA,EAAQ;AACN,YAAA,GAAGT,QAAQS,MAAM;AACjB,YAAA,GAAIC,kBAAAA,GAAqB;gBAAE,YAAA,EAAcQ;AAAgB,aAAA,GAAI;AAC/D,SAAA;AACA,QAAA,MAAMjB,QAAAA,CAAAA,CAAS,EAAEU,MAAAA,EAAAA,OAAM,EAA2B,EAAA;;YAEhD,MAAMX,OAAAA,CAAQC,QAAQ,CAAC;gBAAEU,MAAAA,EAAAA;AAAO,aAAA,CAAA;AAEhC,YAAA,IAAID,kBAAAA,EAAoB;;gBAEtBC,OAAAA,CAAOQ,GAAG,CAAC,YAAA,EAAcC,sBAAAA,CAAuBT,OAAAA,CAAAA,CAAAA;;AAEhD,gBAAA,MAAMU,qBAAqBC,+BAAAA,CAAgCX,OAAAA,CAAAA;gBAC3DA,OAAAA,CAAOQ,GAAG,CAAC,sBAAA,EAAwBE,kBAAAA,CAAAA;AAEnCA,gBAAAA,kBAAAA,CAAmBE,aAAa,CAC9BC,sBAAAA,EACA,CAACC,SAAkC;wBACjCC,QAAAA,EAAU;4BAAEC,IAAAA,EAAM;AAAY,yBAAA;wBAC9BC,OAAAA,EAAS;4BAAEC,MAAAA,EAAQ,KAAA;AAAOC,4BAAAA,OAAAA,EAASL,OAAOK,OAAAA,IAAW;AAAK;qBAC5D,CAAA,CAAA;gBAGFC,wBAAAA,CAAyBV,kBAAAA,CAAAA;gBACzBW,4BAAAA,CAA6BX,kBAAAA,CAAAA;gBAC7BY,0BAAAA,CAA2BZ,kBAAAA,CAAAA;AAE3B,gBAAA,MAAMA,mBAAmBpB,QAAQ,EAAA;AACnC,YAAA;AACF,QAAA,CAAA;AACA,QAAA,MAAME,OAAAA,CAAAA,CAAQ,EAAEQ,MAAAA,EAAAA,OAAM,EAA2B,EAAA;AAC/C,YAAA,IAAID,kBAAAA,EAAoB;gBACtBC,OAAAA,CAAOE,GAAG,CAAC,sBAAA,CAAA,CAAwBV,OAAO,EAAA;AAC5C,YAAA;AACA,YAAA,MAAMH,QAAQG,OAAO,EAAA;AACvB,QAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../../../ee/server/src/index.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport register from './register';\nimport bootstrap from './bootstrap';\nimport destroy from './destroy';\nimport adminContentTypes from './content-types';\nimport services from './services';\nimport controllers from './controllers';\nimport routes from './routes';\nimport auditLogsRoutes from './audit-logs/routes/audit-logs';\nimport auditLogsController from './audit-logs/controllers/audit-logs';\nimport { createAuditLogsService } from './audit-logs/services/audit-logs';\nimport { createAuditLogsLifecycleService } from './audit-logs/services/lifecycles';\nimport { auditLog } from './audit-logs/content-types/audit-log';\nimport { AUDIT_LOG_EXPORT_EVENT } from '../../../shared/utils/audit-log-export';\nimport { registerTokenAuditEvents } from '../../../server/src/audit-logs/tokens';\nimport { registerAdminUserAuditEvents } from '../../../server/src/audit-logs/admin-users';\nimport { registerWebhookAuditEvents } from '../../../server/src/audit-logs/webhooks';\nimport { registerAuthAuditEvents } from '../../../server/src/audit-logs/auth';\n\nconst getAdminEE = () => {\n  const eeAdmin = {\n    register,\n    bootstrap,\n    destroy,\n    contentTypes: {\n      // Always register the audit-log content type to prevent data loss\n      'audit-log': auditLog,\n      ...adminContentTypes,\n    },\n    services,\n    controllers,\n    routes,\n  };\n\n  const isAuditLogsEnabled =\n    strapi.config.get('admin.auditLogs.enabled', true) &&\n    strapi.ee.features.isEnabled('audit-logs');\n  return {\n    ...eeAdmin,\n    controllers: {\n      ...eeAdmin.controllers,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsController } : {}),\n    },\n    routes: {\n      ...eeAdmin.routes,\n      ...(isAuditLogsEnabled ? { 'audit-logs': auditLogsRoutes } : {}),\n    },\n    async register({ strapi }: { strapi: Core.Strapi }) {\n      // Run the default registration\n      await eeAdmin.register({ strapi });\n\n      if (isAuditLogsEnabled) {\n        // Register an internal audit logs service\n        strapi.add('audit-logs', createAuditLogsService(strapi));\n        // Register an internal audit logs lifecycle service\n        const auditLogsLifecycle = createAuditLogsLifecycleService(strapi);\n        strapi.add('audit-logs-lifecycle', auditLogsLifecycle);\n\n        auditLogsLifecycle.registerEvent(\n          AUDIT_LOG_EXPORT_EVENT,\n          (event: { filters?: unknown }) => ({\n            resource: { type: 'audit-log' },\n            details: { format: 'csv', filters: event?.filters ?? null },\n          })\n        );\n\n        registerTokenAuditEvents(auditLogsLifecycle);\n        registerAdminUserAuditEvents(auditLogsLifecycle);\n        registerWebhookAuditEvents(auditLogsLifecycle);\n        registerAuthAuditEvents(auditLogsLifecycle);\n\n        await auditLogsLifecycle.register();\n      }\n    },\n    async destroy({ strapi }: { strapi: Core.Strapi }) {\n      if (isAuditLogsEnabled) {\n        strapi.get('audit-logs-lifecycle').destroy();\n      }\n      await eeAdmin.destroy();\n    },\n  };\n};\n\nexport default getAdminEE;\n"],"names":["getAdminEE","eeAdmin","register","bootstrap","destroy","contentTypes","auditLog","adminContentTypes","services","controllers","routes","isAuditLogsEnabled","strapi","config","get","ee","features","isEnabled","auditLogsController","auditLogsRoutes","add","createAuditLogsService","auditLogsLifecycle","createAuditLogsLifecycleService","registerEvent","AUDIT_LOG_EXPORT_EVENT","event","resource","type","details","format","filters","registerTokenAuditEvents","registerAdminUserAuditEvents","registerWebhookAuditEvents","registerAuthAuditEvents"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,MAAMA,UAAAA,GAAa,IAAA;AACjB,IAAA,MAAMC,OAAAA,GAAU;AACdC,QAAAA,QAAAA;AACAC,QAAAA,SAAAA;AACAC,QAAAA,OAAAA;QACAC,YAAAA,EAAc;;YAEZ,WAAA,EAAaC,QAAAA;AACb,YAAA,GAAGC;AACL,SAAA;AACAC,QAAAA,QAAAA;AACAC,QAAAA,WAAAA;AACAC,QAAAA;AACF,KAAA;AAEA,IAAA,MAAMC,kBAAAA,GACJC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,yBAAA,EAA2B,IAAA,CAAA,IAC7CF,MAAAA,CAAOG,EAAE,CAACC,QAAQ,CAACC,SAAS,CAAC,YAAA,CAAA;IAC/B,OAAO;AACL,QAAA,GAAGhB,OAAO;QACVQ,WAAAA,EAAa;AACX,YAAA,GAAGR,QAAQQ,WAAW;AACtB,YAAA,GAAIE,kBAAAA,GAAqB;gBAAE,YAAA,EAAcO;AAAoB,aAAA,GAAI;AACnE,SAAA;QACAR,MAAAA,EAAQ;AACN,YAAA,GAAGT,QAAQS,MAAM;AACjB,YAAA,GAAIC,kBAAAA,GAAqB;gBAAE,YAAA,EAAcQ;AAAgB,aAAA,GAAI;AAC/D,SAAA;AACA,QAAA,MAAMjB,QAAAA,CAAAA,CAAS,EAAEU,MAAAA,EAAAA,OAAM,EAA2B,EAAA;;YAEhD,MAAMX,OAAAA,CAAQC,QAAQ,CAAC;gBAAEU,MAAAA,EAAAA;AAAO,aAAA,CAAA;AAEhC,YAAA,IAAID,kBAAAA,EAAoB;;gBAEtBC,OAAAA,CAAOQ,GAAG,CAAC,YAAA,EAAcC,sBAAAA,CAAuBT,OAAAA,CAAAA,CAAAA;;AAEhD,gBAAA,MAAMU,qBAAqBC,+BAAAA,CAAgCX,OAAAA,CAAAA;gBAC3DA,OAAAA,CAAOQ,GAAG,CAAC,sBAAA,EAAwBE,kBAAAA,CAAAA;AAEnCA,gBAAAA,kBAAAA,CAAmBE,aAAa,CAC9BC,sBAAAA,EACA,CAACC,SAAkC;wBACjCC,QAAAA,EAAU;4BAAEC,IAAAA,EAAM;AAAY,yBAAA;wBAC9BC,OAAAA,EAAS;4BAAEC,MAAAA,EAAQ,KAAA;AAAOC,4BAAAA,OAAAA,EAASL,OAAOK,OAAAA,IAAW;AAAK;qBAC5D,CAAA,CAAA;gBAGFC,wBAAAA,CAAyBV,kBAAAA,CAAAA;gBACzBW,4BAAAA,CAA6BX,kBAAAA,CAAAA;gBAC7BY,0BAAAA,CAA2BZ,kBAAAA,CAAAA;gBAC3Ba,uBAAAA,CAAwBb,kBAAAA,CAAAA;AAExB,gBAAA,MAAMA,mBAAmBpB,QAAQ,EAAA;AACnC,YAAA;AACF,QAAA,CAAA;AACA,QAAA,MAAME,OAAAA,CAAAA,CAAQ,EAAEQ,MAAAA,EAAAA,OAAM,EAA2B,EAAA;AAC/C,YAAA,IAAID,kBAAAA,EAAoB;gBACtBC,OAAAA,CAAOE,GAAG,CAAC,sBAAA,CAAA,CAAwBV,OAAO,EAAA;AAC5C,YAAA;AACA,YAAA,MAAMH,QAAQG,OAAO,EAAA;AACvB,QAAA;AACF,KAAA;AACF;;;;"}