@strapi/admin 5.57.0 → 5.59.0

package/dist/server/server/src/controllers/authentication.js

@@ -5,6 +5,8 @@ var compose = require('koa-compose');
 require('@strapi/types');
 var utils = require('@strapi/utils');
 var index = require('../utils/index.js');
+var auth$1 = require('../audit-logs/auth.js');
+var auth = require('../services/auth.js');
 var sessionAuth = require('../../../shared/utils/session-auth.js');
 var register = require('../validation/authentication/register.js');
 var forgotPassword = require('../validation/authentication/forgot-password.js');
@@ -17,6 +19,36 @@ var passport__default = /*#__PURE__*/_interopDefault(passport);
 var compose__default = /*#__PURE__*/_interopDefault(compose);
 
 const { ApplicationError, ValidationError } = utils.errors;
+/**
+ * Emits `admin.auth.error` without delaying the response. The account is looked up by
+ * the email of the request, as the local strategy does, because passport does not pass
+ * the user along with an error.
+ */ const emitLocalLoginFailure = (ctx, error, reason)=>{
+    const { email } = ctx.request.body ?? {};
+    const emit = (user)=>auth$1.emitLoginFailure({
+            strapi
+        }, {
+            error,
+            reason,
+            provider: 'local',
+            ...user ? {
+                user: {
+                    id: user.id,
+                    email: user.email
+                }
+            } : {}
+        });
+    // A failed lookup still emits, without the account
+    Promise.resolve().then(()=>typeof email === 'string' ? strapi.db.query('admin::user').findOne({
+            select: [
+                'id',
+                'email'
+            ],
+            where: {
+                email: email.toLowerCase()
+            }
+        }) : null).then(emit, ()=>emit());
+};
 var authentication = {
     login: compose__default.default([
         async (ctx, next)=>{
@@ -28,10 +60,7 @@ var authentication = {
                 session: false
             }, (err, user, info)=>{
                 if (err) {
-                    strapi.eventHub.emit('admin.auth.error', {
-                        error: err,
-                        provider: 'local'
-                    });
+                    emitLocalLoginFailure(ctx, err, err.details?.code === 'LOGIN_NOT_ALLOWED' ? 'login_not_allowed' : 'unexpected_error');
                     // if this is a recognized error, allow it to bubble up to user
                     if (err.details?.code === 'LOGIN_NOT_ALLOWED') {
                         throw err;
@@ -40,10 +69,7 @@ var authentication = {
                     return ctx.notImplemented();
                 }
                 if (!user) {
-                    strapi.eventHub.emit('admin.auth.error', {
-                        error: new Error(info.message),
-                        provider: 'local'
-                    });
+                    emitLocalLoginFailure(ctx, new Error(info.message), info.message === auth.USER_NOT_ACTIVE_MESSAGE ? 'account_inactive' : 'invalid_credentials');
                     throw new ApplicationError(info.message);
                 }
                 const query = ctx.state;

package/dist/server/server/src/controllers/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n  resolveLogoutDeviceId,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegisterAdmin,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError, ValidationError } = errors;\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          strapi.eventHub.emit('admin.auth.error', {\n            error: new Error(info.message),\n            provider: 'local',\n          });\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n          metadata: buildSessionMetadataFromContext(ctx),\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt,\n          ctx.request.secure\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as RegisterAdmin.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const user = await getService('user').createFirstAdmin(input);\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies RegisterAdmin.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    // Not awaited: the response must not reveal whether the email exists. The call runs\n    // synchronously so a broken service still surfaces as a 500; only a rejection of the\n    // returned promise is caught here, since nothing else would handle it.\n    Promise.resolve(getService('auth').forgotPassword(input)).catch((error: unknown) => {\n      strapi.log.error('Failed to process the forgot-password request', { error });\n    });\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(\n        rotation.type,\n        rotation.absoluteExpiresAt,\n        ctx.request.secure\n      );\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(ctx.request.secure),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        const bodyDeviceId = (ctx.request.body as { deviceId?: string } | undefined)?.deviceId;\n        const sessionId = (ctx.state.session as { id?: string } | undefined)?.id;\n\n        if (typeof bodyDeviceId === 'string' && bodyDeviceId.length > 0) {\n          const deviceId = await resolveLogoutDeviceId(userId, sessionId, bodyDeviceId);\n          await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n        } else {\n          await sessionManager('admin').invalidateRefreshToken(userId);\n        }\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["ApplicationError","ValidationError","errors","login","compose","ctx","next","validateLoginSessionInput","request","body","passport","authenticate","session","err","user","info","strapi","eventHub","emit","error","provider","details","code","notImplemented","Error","message","query","state","sanitizedUser","getService","sanitizeUser","sessionManager","getSessionManager","internalServerError","userId","String","id","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","secure","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","createFirstAdmin","telemetry","send","forgotPassword","validateForgotPasswordInput","Promise","resolve","catch","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","getRefreshCookieOptions","expires","Date","bodyDeviceId","sessionId","length","resolveLogoutDeviceId"],"mappings":";;;;;;;;;;;;;;;;;;AAoCA,MAAM,EAAEA,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAE9C,qBAAe;AACbC,IAAAA,KAAAA,EAAOC,wBAAAA,CAAQ;AACb,QAAA,OAAOC,GAAAA,EAAcC,IAAAA,GAAAA;AACnB,YAAA,MAAMC,MAA0BF,GAAAA,CAAIG,OAAO,CAACC,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOH,IAAAA,EAAAA;AACT,QAAA,CAAA;AACA,QAAA,CAACD,GAAAA,EAAcC,IAAAA,GAAAA;YACb,OAAOI,yBAAAA,CAASC,YAAY,CAAC,OAAA,EAAS;gBAAEC,OAAAA,EAAS;aAAM,EAAG,CAACC,KAAKC,IAAAA,EAAMC,IAAAA,GAAAA;AACpE,gBAAA,IAAIF,GAAAA,EAAK;AACPG,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBAAEC,KAAAA,EAAON,GAAAA;wBAAKO,QAAAA,EAAU;AAAQ,qBAAA,CAAA;;AAEzE,oBAAA,IAAIP,GAAAA,CAAIQ,OAAO,EAAEC,IAAAA,KAAS,mBAAA,EAAqB;wBAC7C,MAAMT,GAAAA;AACR,oBAAA;;AAGA,oBAAA,OAAOR,IAAIkB,cAAc,EAAA;AAC3B,gBAAA;AAEA,gBAAA,IAAI,CAACT,IAAAA,EAAM;AACTE,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBACvCC,KAAAA,EAAO,IAAIK,KAAAA,CAAMT,IAAAA,CAAKU,OAAO,CAAA;wBAC7BL,QAAAA,EAAU;AACZ,qBAAA,CAAA;oBACA,MAAM,IAAIpB,gBAAAA,CAAiBe,IAAAA,CAAKU,OAAO,CAAA;AACzC,gBAAA;gBAEA,MAAMC,KAAAA,GAAQrB,IAAIsB,KAAK;AACvBD,gBAAAA,KAAAA,CAAMZ,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAMc,aAAAA,GAAgBC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;oBAAEJ,IAAAA,EAAMc,aAAAA;oBAAeR,QAAAA,EAAU;AAAQ,iBAAA,CAAA;gBAEpF,OAAOd,IAAAA,EAAAA;AACT,YAAA,CAAA,CAAA,CAAGD,GAAAA,EAAKC,IAAAA,CAAAA;AACV,QAAA,CAAA;QACA,OAAOD,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAES,IAAI,EAAE,GAAGT,IAAIsB,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMI,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,oBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,gBAAA;gBACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;gBAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,oBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,iBAAA,CAAA;gBAEA,MAAM0C,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,gBAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,gBAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,oBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,gBAAA;AAEA,gBAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,gBAAAA,GAAAA,CAAII,IAAI,GAAG;oBACT+C,IAAAA,EAAM;wBACJhB,KAAAA,EAAOe,WAAAA;AACPA,wBAAAA,WAAAA;AACAzC,wBAAAA,IAAAA,EAAMe,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACzB,GAAAA,CAAIsB,KAAK,CAACb,IAAI;AACtD;AACF,iBAAA;AACF,YAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,gBAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,wCAAA,EAA0CA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AACF,QAAA;AACD,KAAA,CAAA;AAED,IAAA,MAAMyB,kBAAiBrD,GAAY,EAAA;AACjC,QAAA,MAAMsD,sCAAAA,CAA8BtD,GAAAA,CAAIG,OAAO,CAACkB,KAAK,CAAA;AAErD,QAAA,MAAM,EAAEkC,iBAAiB,EAAE,GAAGvD,GAAAA,CAAIG,OAAO,CAACkB,KAAK;AAE/C,QAAA,MAAMgC,gBAAAA,GAAmB,MAAM7B,gBAAAA,CAAW,MAAA,CAAA,CAAQgC,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAAA,EAAkB;AACrB,YAAA,MAAM,IAAIzD,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,QAAA;AAEAI,QAAAA,GAAAA,CAAII,IAAI,GAAG;YAAE+C,IAAAA,EAAME;AAAiB,SAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMI,UAASzD,GAAY,EAAA;AACzB,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMuD,kCAAAA,CAA0BD,KAAAA,CAAAA;AAEhC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQiC,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAMhC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAM0C,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzC,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,wDAAA,EAA0DA,KAAAA,CAAAA;AAC3E,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMgC,eAAc5D,GAAY,EAAA;AAC9B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMyD,uCAAAA,CAA+BH,KAAAA,CAAAA;AAErC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQsC,gBAAgB,CAACJ,KAAAA,CAAAA;QAEvD/C,MAAAA,CAAOoD,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAMtC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAM0C,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzC,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,8DAAA,EAAgEA,KAAAA,CAAAA;AACjF,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqC,gBAAejE,GAAY,EAAA;AAC/B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAM8D,cAAAA,CAA4BR,KAAAA,CAAAA;;;;QAKlCS,OAAAA,CAAQC,OAAO,CAAC5C,gBAAAA,CAAW,MAAA,CAAA,CAAQyC,cAAc,CAACP,KAAAA,CAAAA,CAAAA,CAAQW,KAAK,CAAC,CAACvD,KAAAA,GAAAA;AAC/DH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,+CAAA,EAAiD;AAAEA,gBAAAA;AAAM,aAAA,CAAA;AAC5E,QAAA,CAAA,CAAA;AAEAd,QAAAA,GAAAA,CAAIsE,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAcvE,GAAY,EAAA;AAC9B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMoE,aAAAA,CAA2Bd,KAAAA,CAAAA;AAEjC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQ+C,aAAa,CAACb,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAMhC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;AAC7B,YAAA,MAAMC,QAAAA,GAAWyC,4BAAAA,EAAAA;;YAGjB,MAAM/C,cAAAA,CAAe,OAAA,CAAA,CAASgD,sBAAsB,CAAC7C,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEM,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;gBACvCO,IAAAA,EAAM,SAAA;AACNC,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;;AAGA,YAAA,MAAM0C,gBAAgBC,wCAAAA,CACpB,SAAA,EACAN,mBACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAM,EAAEO,KAAK,EAAE,GAAGa,YAAAA;AAElBhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;AACJhB,oBAAAA,KAAAA;oBACA1B,IAAAA,EAAMe,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOD,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,8DAAA,EAAgEN,GAAAA,CAAAA;AACjF,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMsB,aAAYlD,GAAY,EAAA;AAC5B,QAAA,MAAMoC,YAAAA,GAAepC,GAAAA,CAAI6C,OAAO,CAAC8B,GAAG,CAAC5B,+BAAAA,CAAAA;AAErC,QAAA,IAAI,CAACX,YAAAA,EAAc;YACjB,OAAOpC,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B,QAAA;QAEA,IAAI;AACF,YAAA,MAAMlD,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;;;AAIA,YAAA,MAAMiD,QAAAA,GAAW,MAAMnD,cAAAA,CAAe,OAAA,CAAA,CAASoD,kBAAkB,CAAC1C,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAWyC,QAAAA,EAAU;gBACvB,OAAO7E,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;AAEA,YAAA,MAAMG,SAAS,MAAMrD,cAAAA,CAAe,SAASuB,mBAAmB,CAAC4B,SAAS1C,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAW4C,MAAAA,EAAQ;gBACrB,OAAO/E,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;YAEA,MAAM,EAAEzC,KAAK,EAAE,GAAG4C,MAAAA;;YAElB,MAAMC,IAAAA,GAAOrC,wCAAAA,CACXkC,QAAAA,CAAStC,IAAI,EACbsC,QAAAA,CAASxC,iBAAiB,EAC1BrC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAGpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,+BAAAA,EAAqB8B,QAAAA,CAAS1C,KAAK,EAAE6C,IAAAA,CAAAA;AACrDhF,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBAAE+C,IAAAA,EAAM;AAAEhB,oBAAAA;AAAM;AAAE,aAAA;AAC/B,QAAA,CAAA,CAAE,OAAO3B,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,oDAAA,EAAsDN,GAAAA,CAAAA;AACvE,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqD,QAAOjF,GAAY,EAAA;QACvB,MAAMuB,aAAAA,GAAgBC,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACzB,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,cAAA,EAAgB;YAAEJ,IAAAA,EAAMc;AAAc,SAAA,CAAA;;AAG3DvB,QAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,iCAAqB,EAAA,EAAI;AACvC,YAAA,GAAGmC,mCAAAA,CAAwBlF,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAC;AAC9CuC,YAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAM1D,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAID,cAAAA,EAAgB;AAClB,gBAAA,MAAMG,SAASC,MAAAA,CAAO9B,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAACsB,EAAE,CAAA;AACvC,gBAAA,MAAMsD,YAAAA,GAAgBrF,GAAAA,CAAIG,OAAO,CAACC,IAAI,EAAwC4B,QAAAA;AAC9E,gBAAA,MAAMsD,SAAAA,GAAatF,GAAAA,CAAIsB,KAAK,CAACf,OAAO,EAAkCwB,EAAAA;AAEtE,gBAAA,IAAI,OAAOsD,YAAAA,KAAiB,QAAA,IAAYA,YAAAA,CAAaE,MAAM,GAAG,CAAA,EAAG;AAC/D,oBAAA,MAAMvD,QAAAA,GAAW,MAAMwD,iCAAAA,CAAsB3D,MAAAA,EAAQyD,SAAAA,EAAWD,YAAAA,CAAAA;AAChE,oBAAA,MAAM3D,cAAAA,CAAe,OAAA,CAAA,CAASgD,sBAAsB,CAAC7C,MAAAA,EAAQG,QAAAA,CAAAA;gBAC/D,CAAA,MAAO;oBACL,MAAMN,cAAAA,CAAe,OAAA,CAAA,CAASgD,sBAAsB,CAAC7C,MAAAA,CAAAA;AACvD,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAOrB,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,+CAAA,EAAiDN,GAAAA,CAAAA;AACpE,QAAA;AAEAR,QAAAA,GAAAA,CAAII,IAAI,GAAG;AAAE+C,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"authentication.js","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport type { Data } from '@strapi/types';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { emitLoginFailure, type LoginFailureReason } from '../audit-logs/auth';\nimport { USER_NOT_ACTIVE_MESSAGE } from '../services/auth';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n  resolveLogoutDeviceId,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegisterAdmin,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError, ValidationError } = errors;\n\n/**\n * Emits `admin.auth.error` without delaying the response. The account is looked up by\n * the email of the request, as the local strategy does, because passport does not pass\n * the user along with an error.\n */\nconst emitLocalLoginFailure = (ctx: Context, error: Error, reason: LoginFailureReason) => {\n  const { email } = (ctx.request.body ?? {}) as { email?: unknown };\n\n  const emit = (user?: { id: Data.ID; email: string } | null) =>\n    emitLoginFailure(\n      { strapi },\n      {\n        error,\n        reason,\n        provider: 'local',\n        ...(user ? { user: { id: user.id, email: user.email } } : {}),\n      }\n    );\n\n  // A failed lookup still emits, without the account\n  Promise.resolve()\n    .then(() =>\n      typeof email === 'string'\n        ? strapi.db\n            .query('admin::user')\n            .findOne({ select: ['id', 'email'], where: { email: email.toLowerCase() } })\n        : null\n    )\n    .then(emit, () => emit());\n};\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          emitLocalLoginFailure(\n            ctx,\n            err,\n            err.details?.code === 'LOGIN_NOT_ALLOWED' ? 'login_not_allowed' : 'unexpected_error'\n          );\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          emitLocalLoginFailure(\n            ctx,\n            new Error(info.message),\n            info.message === USER_NOT_ACTIVE_MESSAGE ? 'account_inactive' : 'invalid_credentials'\n          );\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n          metadata: buildSessionMetadataFromContext(ctx),\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt,\n          ctx.request.secure\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as RegisterAdmin.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const user = await getService('user').createFirstAdmin(input);\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies RegisterAdmin.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    // Not awaited: the response must not reveal whether the email exists. The call runs\n    // synchronously so a broken service still surfaces as a 500; only a rejection of the\n    // returned promise is caught here, since nothing else would handle it.\n    Promise.resolve(getService('auth').forgotPassword(input)).catch((error: unknown) => {\n      strapi.log.error('Failed to process the forgot-password request', { error });\n    });\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(\n        rotation.type,\n        rotation.absoluteExpiresAt,\n        ctx.request.secure\n      );\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(ctx.request.secure),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        const bodyDeviceId = (ctx.request.body as { deviceId?: string } | undefined)?.deviceId;\n        const sessionId = (ctx.state.session as { id?: string } | undefined)?.id;\n\n        if (typeof bodyDeviceId === 'string' && bodyDeviceId.length > 0) {\n          const deviceId = await resolveLogoutDeviceId(userId, sessionId, bodyDeviceId);\n          await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n        } else {\n          await sessionManager('admin').invalidateRefreshToken(userId);\n        }\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["ApplicationError","ValidationError","errors","emitLocalLoginFailure","ctx","error","reason","email","request","body","emit","user","emitLoginFailure","strapi","provider","id","Promise","resolve","then","db","query","findOne","select","where","toLowerCase","login","compose","next","validateLoginSessionInput","passport","authenticate","session","err","info","details","code","notImplemented","Error","message","USER_NOT_ACTIVE_MESSAGE","state","sanitizedUser","getService","sanitizeUser","eventHub","sessionManager","getSessionManager","internalServerError","userId","String","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","secure","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","createFirstAdmin","telemetry","send","forgotPassword","validateForgotPasswordInput","catch","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","getRefreshCookieOptions","expires","Date","bodyDeviceId","sessionId","length","resolveLogoutDeviceId"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuCA,MAAM,EAAEA,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,YAAAA;AAE9C;;;;AAIC,IACD,MAAMC,qBAAAA,GAAwB,CAACC,GAAAA,EAAcC,KAAAA,EAAcC,MAAAA,GAAAA;IACzD,MAAM,EAAEC,KAAK,EAAE,GAAIH,IAAII,OAAO,CAACC,IAAI,IAAI,EAAC;IAExC,MAAMC,IAAAA,GAAO,CAACC,IAAAA,GACZC,uBAAAA,CACE;AAAEC,YAAAA;SAAO,EACT;AACER,YAAAA,KAAAA;AACAC,YAAAA,MAAAA;YACAQ,QAAAA,EAAU,OAAA;AACV,YAAA,GAAIH,IAAAA,GAAO;gBAAEA,IAAAA,EAAM;AAAEI,oBAAAA,EAAAA,EAAIJ,KAAKI,EAAE;AAAER,oBAAAA,KAAAA,EAAOI,KAAKJ;AAAM;AAAE,aAAA,GAAI;AAC5D,SAAA,CAAA;;AAIJS,IAAAA,OAAAA,CAAQC,OAAO,EAAA,CACZC,IAAI,CAAC,IACJ,OAAOX,KAAAA,KAAU,QAAA,GACbM,MAAAA,CAAOM,EAAE,CACNC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;YAAEC,MAAAA,EAAQ;AAAC,gBAAA,IAAA;AAAM,gBAAA;AAAQ,aAAA;YAAEC,KAAAA,EAAO;AAAEhB,gBAAAA,KAAAA,EAAOA,MAAMiB,WAAW;AAAG;AAAE,SAAA,CAAA,GAC5E,IAAA,CAAA,CAELN,IAAI,CAACR,IAAAA,EAAM,IAAMA,IAAAA,EAAAA,CAAAA;AACtB,CAAA;AAEA,qBAAe;AACbe,IAAAA,KAAAA,EAAOC,wBAAAA,CAAQ;AACb,QAAA,OAAOtB,GAAAA,EAAcuB,IAAAA,GAAAA;AACnB,YAAA,MAAMC,MAA0BxB,GAAAA,CAAII,OAAO,CAACC,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOkB,IAAAA,EAAAA;AACT,QAAA,CAAA;AACA,QAAA,CAACvB,GAAAA,EAAcuB,IAAAA,GAAAA;YACb,OAAOE,yBAAAA,CAASC,YAAY,CAAC,OAAA,EAAS;gBAAEC,OAAAA,EAAS;aAAM,EAAG,CAACC,KAAKrB,IAAAA,EAAMsB,IAAAA,GAAAA;AACpE,gBAAA,IAAID,GAAAA,EAAK;AACP7B,oBAAAA,qBAAAA,CACEC,KACA4B,GAAAA,EACAA,GAAAA,CAAIE,OAAO,EAAEC,IAAAA,KAAS,sBAAsB,mBAAA,GAAsB,kBAAA,CAAA;;AAGpE,oBAAA,IAAIH,GAAAA,CAAIE,OAAO,EAAEC,IAAAA,KAAS,mBAAA,EAAqB;wBAC7C,MAAMH,GAAAA;AACR,oBAAA;;AAGA,oBAAA,OAAO5B,IAAIgC,cAAc,EAAA;AAC3B,gBAAA;AAEA,gBAAA,IAAI,CAACzB,IAAAA,EAAM;oBACTR,qBAAAA,CACEC,GAAAA,EACA,IAAIiC,KAAAA,CAAMJ,IAAAA,CAAKK,OAAO,GACtBL,IAAAA,CAAKK,OAAO,KAAKC,4BAAAA,GAA0B,kBAAA,GAAqB,qBAAA,CAAA;oBAElE,MAAM,IAAIvC,gBAAAA,CAAiBiC,IAAAA,CAAKK,OAAO,CAAA;AACzC,gBAAA;gBAEA,MAAMlB,KAAAA,GAAQhB,IAAIoC,KAAK;AACvBpB,gBAAAA,KAAAA,CAAMT,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAM8B,aAAAA,GAAgBC,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAO+B,QAAQ,CAAClC,IAAI,CAAC,oBAAA,EAAsB;oBAAEC,IAAAA,EAAM8B,aAAAA;oBAAe3B,QAAAA,EAAU;AAAQ,iBAAA,CAAA;gBAEpF,OAAOa,IAAAA,EAAAA;AACT,YAAA,CAAA,CAAA,CAAGvB,GAAAA,EAAKuB,IAAAA,CAAAA;AACV,QAAA,CAAA;QACA,OAAOvB,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAEO,IAAI,EAAE,GAAGP,IAAIoC,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMK,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,oBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,gBAAA;gBACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;gBAC7B,MAAM,EAAEmC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBhD,GAAAA,CAAII,OAAO,CAACC,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE4C,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,oBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCvD,GAAAA;AAC5C,iBAAA,CAAA;gBAEA,MAAMwD,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,gBAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,gBAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,oBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,gBAAA;AAEA,gBAAA,MAAM,EAAEM,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/B9D,gBAAAA,GAAAA,CAAIK,IAAI,GAAG;oBACT4D,IAAAA,EAAM;wBACJhB,KAAAA,EAAOe,WAAAA;AACPA,wBAAAA,WAAAA;AACAzD,wBAAAA,IAAAA,EAAM+B,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACvC,GAAAA,CAAIoC,KAAK,CAAC7B,IAAI;AACtD;AACF,iBAAA;AACF,YAAA,CAAA,CAAE,OAAON,KAAAA,EAAO;AACdQ,gBAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,wCAAA,EAA0CA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOD,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;AACF,QAAA;AACD,KAAA,CAAA;AAED,IAAA,MAAMwB,kBAAiBnE,GAAY,EAAA;AACjC,QAAA,MAAMoE,sCAAAA,CAA8BpE,GAAAA,CAAII,OAAO,CAACY,KAAK,CAAA;AAErD,QAAA,MAAM,EAAEqD,iBAAiB,EAAE,GAAGrE,GAAAA,CAAII,OAAO,CAACY,KAAK;AAE/C,QAAA,MAAMmD,gBAAAA,GAAmB,MAAM7B,gBAAAA,CAAW,MAAA,CAAA,CAAQgC,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAAA,EAAkB;AACrB,YAAA,MAAM,IAAItE,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,QAAA;AAEAG,QAAAA,GAAAA,CAAIK,IAAI,GAAG;YAAE4D,IAAAA,EAAME;AAAiB,SAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMI,UAASvE,GAAY,EAAA;AACzB,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMoE,kCAAAA,CAA0BD,KAAAA,CAAAA;AAEhC,QAAA,MAAMjE,IAAAA,GAAO,MAAM+B,gBAAAA,CAAW,MAAA,CAAA,CAAQiC,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAM/B,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;YAC7B,MAAM,EAAEmC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBhD,GAAAA,CAAII,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE4C,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCvD,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAMwD,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEM,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/B9D,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBACT4D,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzD,IAAAA,EAAM+B,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAON,KAAAA,EAAO;AACdQ,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,wDAAA,EAA0DA,KAAAA,CAAAA;AAC3E,YAAA,OAAOD,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAM+B,eAAc1E,GAAY,EAAA;AAC9B,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMsE,uCAAAA,CAA+BH,KAAAA,CAAAA;AAErC,QAAA,MAAMjE,IAAAA,GAAO,MAAM+B,gBAAAA,CAAW,MAAA,CAAA,CAAQsC,gBAAgB,CAACJ,KAAAA,CAAAA;QAEvD/D,MAAAA,CAAOoE,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAMrC,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;YAC7B,MAAM,EAAEmC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,+BAAAA,CAAoBhD,GAAAA,CAAII,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE4C,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCvD,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAMwD,aAAAA,GAAgBC,yCACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEM,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/B9D,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBACT4D,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzD,IAAAA,EAAM+B,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAON,KAAAA,EAAO;AACdQ,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,8DAAA,EAAgEA,KAAAA,CAAAA;AACjF,YAAA,OAAOD,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMoC,gBAAe/E,GAAY,EAAA;AAC/B,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAM2E,cAAAA,CAA4BR,KAAAA,CAAAA;;;;QAKlC5D,OAAAA,CAAQC,OAAO,CAACyB,gBAAAA,CAAW,MAAA,CAAA,CAAQyC,cAAc,CAACP,KAAAA,CAAAA,CAAAA,CAAQS,KAAK,CAAC,CAAChF,KAAAA,GAAAA;AAC/DQ,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,+CAAA,EAAiD;AAAEA,gBAAAA;AAAM,aAAA,CAAA;AAC5E,QAAA,CAAA,CAAA;AAEAD,QAAAA,GAAAA,CAAIkF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAcnF,GAAY,EAAA;AAC9B,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAM+E,aAAAA,CAA2BZ,KAAAA,CAAAA;AAEjC,QAAA,MAAMjE,IAAAA,GAAO,MAAM+B,gBAAAA,CAAW,MAAA,CAAA,CAAQ6C,aAAa,CAACX,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAM/B,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;AAC7B,YAAA,MAAMmC,QAAAA,GAAWuC,4BAAAA,EAAAA;;YAGjB,MAAM5C,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEK,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;gBACvCO,IAAAA,EAAM,SAAA;AACNC,gBAAAA,QAAAA,EAAUC,2CAAAA,CAAgCvD,GAAAA;AAC5C,aAAA,CAAA;;AAGA,YAAA,MAAMwD,gBAAgBC,wCAAAA,CACpB,SAAA,EACAN,mBACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,iCAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAM,EAAEM,KAAK,EAAE,GAAGa,YAAAA;AAElB9D,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBACT4D,IAAAA,EAAM;AACJhB,oBAAAA,KAAAA;oBACA1C,IAAAA,EAAM+B,gBAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOqB,GAAAA,EAAK;AACZnB,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,8DAAA,EAAgE2B,GAAAA,CAAAA;AACjF,YAAA,OAAO5B,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqB,aAAYhE,GAAY,EAAA;AAC5B,QAAA,MAAMkD,YAAAA,GAAelD,GAAAA,CAAI2D,OAAO,CAAC4B,GAAG,CAAC1B,+BAAAA,CAAAA;AAErC,QAAA,IAAI,CAACX,YAAAA,EAAc;YACjB,OAAOlD,GAAAA,CAAIwF,YAAY,CAAC,uBAAA,CAAA;AAC1B,QAAA;QAEA,IAAI;AACF,YAAA,MAAM/C,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;;;AAIA,YAAA,MAAM8C,QAAAA,GAAW,MAAMhD,cAAAA,CAAe,OAAA,CAAA,CAASiD,kBAAkB,CAACxC,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAWuC,QAAAA,EAAU;gBACvB,OAAOzF,GAAAA,CAAIwF,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;AAEA,YAAA,MAAMG,SAAS,MAAMlD,cAAAA,CAAe,SAASsB,mBAAmB,CAAC0B,SAASxC,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAW0C,MAAAA,EAAQ;gBACrB,OAAO3F,GAAAA,CAAIwF,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;YAEA,MAAM,EAAEvC,KAAK,EAAE,GAAG0C,MAAAA;;YAElB,MAAMC,IAAAA,GAAOnC,wCAAAA,CACXgC,QAAAA,CAASpC,IAAI,EACboC,QAAAA,CAAStC,iBAAiB,EAC1BnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAGpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,+BAAAA,EAAqB4B,QAAAA,CAASxC,KAAK,EAAE2C,IAAAA,CAAAA;AACrD5F,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBAAE4D,IAAAA,EAAM;AAAEhB,oBAAAA;AAAM;AAAE,aAAA;AAC/B,QAAA,CAAA,CAAE,OAAOrB,GAAAA,EAAK;AACZnB,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,oDAAA,EAAsD2B,GAAAA,CAAAA;AACvE,YAAA,OAAO5B,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMkD,QAAO7F,GAAY,EAAA;QACvB,MAAMqC,aAAAA,GAAgBC,iBAAW,MAAA,CAAA,CAAQC,YAAY,CAACvC,GAAAA,CAAIoC,KAAK,CAAC7B,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAO+B,QAAQ,CAAClC,IAAI,CAAC,cAAA,EAAgB;YAAEC,IAAAA,EAAM8B;AAAc,SAAA,CAAA;;AAG3DrC,QAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,iCAAqB,EAAA,EAAI;AACvC,YAAA,GAAGiC,mCAAAA,CAAwB9F,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAC;AAC9CqC,YAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAMvD,cAAAA,GAAiBC,6BAAAA,EAAAA;AACvB,YAAA,IAAID,cAAAA,EAAgB;AAClB,gBAAA,MAAMG,SAASC,MAAAA,CAAO7C,GAAAA,CAAIoC,KAAK,CAAC7B,IAAI,CAACI,EAAE,CAAA;AACvC,gBAAA,MAAMsF,YAAAA,GAAgBjG,GAAAA,CAAII,OAAO,CAACC,IAAI,EAAwCyC,QAAAA;AAC9E,gBAAA,MAAMoD,SAAAA,GAAalG,GAAAA,CAAIoC,KAAK,CAACT,OAAO,EAAkChB,EAAAA;AAEtE,gBAAA,IAAI,OAAOsF,YAAAA,KAAiB,QAAA,IAAYA,YAAAA,CAAaE,MAAM,GAAG,CAAA,EAAG;AAC/D,oBAAA,MAAMrD,QAAAA,GAAW,MAAMsD,iCAAAA,CAAsBxD,MAAAA,EAAQsD,SAAAA,EAAWD,YAAAA,CAAAA;AAChE,oBAAA,MAAMxD,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,EAAQE,QAAAA,CAAAA;gBAC/D,CAAA,MAAO;oBACL,MAAML,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,CAAAA;AACvD,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAOhB,GAAAA,EAAK;AACZnB,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,+CAAA,EAAiD2B,GAAAA,CAAAA;AACpE,QAAA;AAEA5B,QAAAA,GAAAA,CAAIK,IAAI,GAAG;AAAE4D,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB,IAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/controllers/authentication.mjs

@@ -3,6 +3,8 @@ import compose from 'koa-compose';
 import '@strapi/types';
 import { errors } from '@strapi/utils';
 import { getService } from '../utils/index.mjs';
+import { emitLoginFailure } from '../audit-logs/auth.mjs';
+import { USER_NOT_ACTIVE_MESSAGE } from '../services/auth.mjs';
 import { getSessionManager, extractDeviceParams, buildSessionMetadataFromContext, buildCookieOptionsWithExpiry, REFRESH_COOKIE_NAME, getRefreshCookieOptions, resolveLogoutDeviceId, generateDeviceId } from '../../../shared/utils/session-auth.mjs';
 import { validateAdminRegistrationInput, validateRegistrationInput, validateRegistrationInfoQuery } from '../validation/authentication/register.mjs';
 import validateForgotPasswordInput from '../validation/authentication/forgot-password.mjs';
@@ -10,6 +12,36 @@ import validateResetPasswordInput from '../validation/authentication/reset-passw
 import validateLoginSessionInput from '../validation/authentication/login.mjs';
 
 const { ApplicationError, ValidationError } = errors;
+/**
+ * Emits `admin.auth.error` without delaying the response. The account is looked up by
+ * the email of the request, as the local strategy does, because passport does not pass
+ * the user along with an error.
+ */ const emitLocalLoginFailure = (ctx, error, reason)=>{
+    const { email } = ctx.request.body ?? {};
+    const emit = (user)=>emitLoginFailure({
+            strapi
+        }, {
+            error,
+            reason,
+            provider: 'local',
+            ...user ? {
+                user: {
+                    id: user.id,
+                    email: user.email
+                }
+            } : {}
+        });
+    // A failed lookup still emits, without the account
+    Promise.resolve().then(()=>typeof email === 'string' ? strapi.db.query('admin::user').findOne({
+            select: [
+                'id',
+                'email'
+            ],
+            where: {
+                email: email.toLowerCase()
+            }
+        }) : null).then(emit, ()=>emit());
+};
 var authentication = {
     login: compose([
         async (ctx, next)=>{
@@ -21,10 +53,7 @@ var authentication = {
                 session: false
             }, (err, user, info)=>{
                 if (err) {
-                    strapi.eventHub.emit('admin.auth.error', {
-                        error: err,
-                        provider: 'local'
-                    });
+                    emitLocalLoginFailure(ctx, err, err.details?.code === 'LOGIN_NOT_ALLOWED' ? 'login_not_allowed' : 'unexpected_error');
                     // if this is a recognized error, allow it to bubble up to user
                     if (err.details?.code === 'LOGIN_NOT_ALLOWED') {
                         throw err;
@@ -33,10 +62,7 @@ var authentication = {
                     return ctx.notImplemented();
                 }
                 if (!user) {
-                    strapi.eventHub.emit('admin.auth.error', {
-                        error: new Error(info.message),
-                        provider: 'local'
-                    });
+                    emitLocalLoginFailure(ctx, new Error(info.message), info.message === USER_NOT_ACTIVE_MESSAGE ? 'account_inactive' : 'invalid_credentials');
                     throw new ApplicationError(info.message);
                 }
                 const query = ctx.state;

package/dist/server/server/src/controllers/authentication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.mjs","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n  resolveLogoutDeviceId,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegisterAdmin,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError, ValidationError } = errors;\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          strapi.eventHub.emit('admin.auth.error', {\n            error: new Error(info.message),\n            provider: 'local',\n          });\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n          metadata: buildSessionMetadataFromContext(ctx),\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt,\n          ctx.request.secure\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as RegisterAdmin.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const user = await getService('user').createFirstAdmin(input);\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies RegisterAdmin.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    // Not awaited: the response must not reveal whether the email exists. The call runs\n    // synchronously so a broken service still surfaces as a 500; only a rejection of the\n    // returned promise is caught here, since nothing else would handle it.\n    Promise.resolve(getService('auth').forgotPassword(input)).catch((error: unknown) => {\n      strapi.log.error('Failed to process the forgot-password request', { error });\n    });\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(\n        rotation.type,\n        rotation.absoluteExpiresAt,\n        ctx.request.secure\n      );\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(ctx.request.secure),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        const bodyDeviceId = (ctx.request.body as { deviceId?: string } | undefined)?.deviceId;\n        const sessionId = (ctx.state.session as { id?: string } | undefined)?.id;\n\n        if (typeof bodyDeviceId === 'string' && bodyDeviceId.length > 0) {\n          const deviceId = await resolveLogoutDeviceId(userId, sessionId, bodyDeviceId);\n          await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n        } else {\n          await sessionManager('admin').invalidateRefreshToken(userId);\n        }\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["ApplicationError","ValidationError","errors","login","compose","ctx","next","validateLoginSessionInput","request","body","passport","authenticate","session","err","user","info","strapi","eventHub","emit","error","provider","details","code","notImplemented","Error","message","query","state","sanitizedUser","getService","sanitizeUser","sessionManager","getSessionManager","internalServerError","userId","String","id","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","secure","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","createFirstAdmin","telemetry","send","forgotPassword","validateForgotPasswordInput","Promise","resolve","catch","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","getRefreshCookieOptions","expires","Date","bodyDeviceId","sessionId","length","resolveLogoutDeviceId"],"mappings":";;;;;;;;;;;AAoCA,MAAM,EAAEA,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,MAAAA;AAE9C,qBAAe;AACbC,IAAAA,KAAAA,EAAOC,OAAAA,CAAQ;AACb,QAAA,OAAOC,GAAAA,EAAcC,IAAAA,GAAAA;AACnB,YAAA,MAAMC,0BAA0BF,GAAAA,CAAIG,OAAO,CAACC,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOH,IAAAA,EAAAA;AACT,QAAA,CAAA;AACA,QAAA,CAACD,GAAAA,EAAcC,IAAAA,GAAAA;YACb,OAAOI,QAAAA,CAASC,YAAY,CAAC,OAAA,EAAS;gBAAEC,OAAAA,EAAS;aAAM,EAAG,CAACC,KAAKC,IAAAA,EAAMC,IAAAA,GAAAA;AACpE,gBAAA,IAAIF,GAAAA,EAAK;AACPG,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBAAEC,KAAAA,EAAON,GAAAA;wBAAKO,QAAAA,EAAU;AAAQ,qBAAA,CAAA;;AAEzE,oBAAA,IAAIP,GAAAA,CAAIQ,OAAO,EAAEC,IAAAA,KAAS,mBAAA,EAAqB;wBAC7C,MAAMT,GAAAA;AACR,oBAAA;;AAGA,oBAAA,OAAOR,IAAIkB,cAAc,EAAA;AAC3B,gBAAA;AAEA,gBAAA,IAAI,CAACT,IAAAA,EAAM;AACTE,oBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,kBAAA,EAAoB;wBACvCC,KAAAA,EAAO,IAAIK,KAAAA,CAAMT,IAAAA,CAAKU,OAAO,CAAA;wBAC7BL,QAAAA,EAAU;AACZ,qBAAA,CAAA;oBACA,MAAM,IAAIpB,gBAAAA,CAAiBe,IAAAA,CAAKU,OAAO,CAAA;AACzC,gBAAA;gBAEA,MAAMC,KAAAA,GAAQrB,IAAIsB,KAAK;AACvBD,gBAAAA,KAAAA,CAAMZ,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAMc,aAAAA,GAAgBC,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,oBAAA,EAAsB;oBAAEJ,IAAAA,EAAMc,aAAAA;oBAAeR,QAAAA,EAAU;AAAQ,iBAAA,CAAA;gBAEpF,OAAOd,IAAAA,EAAAA;AACT,YAAA,CAAA,CAAA,CAAGD,GAAAA,EAAKC,IAAAA,CAAAA;AACV,QAAA,CAAA;QACA,OAAOD,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAES,IAAI,EAAE,GAAGT,IAAIsB,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMI,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,oBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,gBAAA;gBACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;gBAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,mBAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,oBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCzC,GAAAA;AAC5C,iBAAA,CAAA;gBAEA,MAAM0C,aAAAA,GAAgBC,6BACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,gBAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,gBAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,oBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,gBAAA;AAEA,gBAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,gBAAAA,GAAAA,CAAII,IAAI,GAAG;oBACT+C,IAAAA,EAAM;wBACJhB,KAAAA,EAAOe,WAAAA;AACPA,wBAAAA,WAAAA;AACAzC,wBAAAA,IAAAA,EAAMe,WAAW,MAAA,CAAA,CAAQC,YAAY,CAACzB,GAAAA,CAAIsB,KAAK,CAACb,IAAI;AACtD;AACF,iBAAA;AACF,YAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,gBAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,wCAAA,EAA0CA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AACF,QAAA;AACD,KAAA,CAAA;AAED,IAAA,MAAMyB,kBAAiBrD,GAAY,EAAA;AACjC,QAAA,MAAMsD,6BAAAA,CAA8BtD,GAAAA,CAAIG,OAAO,CAACkB,KAAK,CAAA;AAErD,QAAA,MAAM,EAAEkC,iBAAiB,EAAE,GAAGvD,GAAAA,CAAIG,OAAO,CAACkB,KAAK;AAE/C,QAAA,MAAMgC,gBAAAA,GAAmB,MAAM7B,UAAAA,CAAW,MAAA,CAAA,CAAQgC,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAAA,EAAkB;AACrB,YAAA,MAAM,IAAIzD,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,QAAA;AAEAI,QAAAA,GAAAA,CAAII,IAAI,GAAG;YAAE+C,IAAAA,EAAME;AAAiB,SAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMI,UAASzD,GAAY,EAAA;AACzB,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMuD,yBAAAA,CAA0BD,KAAAA,CAAAA;AAEhC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,UAAAA,CAAW,MAAA,CAAA,CAAQiC,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAMhC,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,mBAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAM0C,aAAAA,GAAgBC,6BACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzC,IAAAA,EAAMe,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,wDAAA,EAA0DA,KAAAA,CAAAA;AAC3E,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMgC,eAAc5D,GAAY,EAAA;AAC9B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMyD,8BAAAA,CAA+BH,KAAAA,CAAAA;AAErC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,UAAAA,CAAW,MAAA,CAAA,CAAQsC,gBAAgB,CAACJ,KAAAA,CAAAA;QAEvD/C,MAAAA,CAAOoD,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAMtC,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;YAC7B,MAAM,EAAEC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,mBAAAA,CAAoBlC,GAAAA,CAAIG,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE+B,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAM0C,aAAAA,GAAgBC,6BACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEO,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/BhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzC,IAAAA,EAAMe,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOK,KAAAA,EAAO;AACdH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,8DAAA,EAAgEA,KAAAA,CAAAA;AACjF,YAAA,OAAOd,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqC,gBAAejE,GAAY,EAAA;AAC/B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAM8D,2BAAAA,CAA4BR,KAAAA,CAAAA;;;;QAKlCS,OAAAA,CAAQC,OAAO,CAAC5C,UAAAA,CAAW,MAAA,CAAA,CAAQyC,cAAc,CAACP,KAAAA,CAAAA,CAAAA,CAAQW,KAAK,CAAC,CAACvD,KAAAA,GAAAA;AAC/DH,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,+CAAA,EAAiD;AAAEA,gBAAAA;AAAM,aAAA,CAAA;AAC5E,QAAA,CAAA,CAAA;AAEAd,QAAAA,GAAAA,CAAIsE,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAcvE,GAAY,EAAA;AAC9B,QAAA,MAAM0D,KAAAA,GAAQ1D,GAAAA,CAAIG,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMoE,0BAAAA,CAA2Bd,KAAAA,CAAAA;AAEjC,QAAA,MAAMjD,IAAAA,GAAO,MAAMe,UAAAA,CAAW,MAAA,CAAA,CAAQ+C,aAAa,CAACb,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAMhC,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAMC,MAAAA,GAASC,MAAAA,CAAOrB,IAAAA,CAAKsB,EAAE,CAAA;AAC7B,YAAA,MAAMC,QAAAA,GAAWyC,gBAAAA,EAAAA;;YAGjB,MAAM/C,cAAAA,CAAe,OAAA,CAAA,CAASgD,sBAAsB,CAAC7C,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEM,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMX,cAAAA,CACvD,OAAA,CAAA,CACAY,oBAAoB,CAACT,QAAQG,QAAAA,EAAU;gBACvCO,IAAAA,EAAM,SAAA;AACNC,gBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCzC,GAAAA;AAC5C,aAAA,CAAA;;AAGA,YAAA,MAAM0C,gBAAgBC,4BAAAA,CACpB,SAAA,EACAN,mBACArC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAEpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMtB,cAAAA,CAAe,OAAA,CAAA,CAASuB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAOhD,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAM,EAAEO,KAAK,EAAE,GAAGa,YAAAA;AAElBhD,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBACT+C,IAAAA,EAAM;AACJhB,oBAAAA,KAAAA;oBACA1B,IAAAA,EAAMe,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChB,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOD,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,8DAAA,EAAgEN,GAAAA,CAAAA;AACjF,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMsB,aAAYlD,GAAY,EAAA;AAC5B,QAAA,MAAMoC,YAAAA,GAAepC,GAAAA,CAAI6C,OAAO,CAAC8B,GAAG,CAAC5B,mBAAAA,CAAAA;AAErC,QAAA,IAAI,CAACX,YAAAA,EAAc;YACjB,OAAOpC,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B,QAAA;QAEA,IAAI;AACF,YAAA,MAAMlD,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAO1B,IAAI4B,mBAAmB,EAAA;AAChC,YAAA;;;AAIA,YAAA,MAAMiD,QAAAA,GAAW,MAAMnD,cAAAA,CAAe,OAAA,CAAA,CAASoD,kBAAkB,CAAC1C,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAWyC,QAAAA,EAAU;gBACvB,OAAO7E,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;AAEA,YAAA,MAAMG,SAAS,MAAMrD,cAAAA,CAAe,SAASuB,mBAAmB,CAAC4B,SAAS1C,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAW4C,MAAAA,EAAQ;gBACrB,OAAO/E,GAAAA,CAAI4E,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;YAEA,MAAM,EAAEzC,KAAK,EAAE,GAAG4C,MAAAA;;YAElB,MAAMC,IAAAA,GAAOrC,4BAAAA,CACXkC,QAAAA,CAAStC,IAAI,EACbsC,QAAAA,CAASxC,iBAAiB,EAC1BrC,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAA;AAGpB5C,YAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,mBAAAA,EAAqB8B,QAAAA,CAAS1C,KAAK,EAAE6C,IAAAA,CAAAA;AACrDhF,YAAAA,GAAAA,CAAII,IAAI,GAAG;gBAAE+C,IAAAA,EAAM;AAAEhB,oBAAAA;AAAM;AAAE,aAAA;AAC/B,QAAA,CAAA,CAAE,OAAO3B,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,oDAAA,EAAsDN,GAAAA,CAAAA;AACvE,YAAA,OAAOR,IAAI4B,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqD,QAAOjF,GAAY,EAAA;QACvB,MAAMuB,aAAAA,GAAgBC,WAAW,MAAA,CAAA,CAAQC,YAAY,CAACzB,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAAC,cAAA,EAAgB;YAAEJ,IAAAA,EAAMc;AAAc,SAAA,CAAA;;AAG3DvB,QAAAA,GAAAA,CAAI6C,OAAO,CAACC,GAAG,CAACC,qBAAqB,EAAA,EAAI;AACvC,YAAA,GAAGmC,uBAAAA,CAAwBlF,GAAAA,CAAIG,OAAO,CAACyC,MAAM,CAAC;AAC9CuC,YAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAM1D,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAID,cAAAA,EAAgB;AAClB,gBAAA,MAAMG,SAASC,MAAAA,CAAO9B,GAAAA,CAAIsB,KAAK,CAACb,IAAI,CAACsB,EAAE,CAAA;AACvC,gBAAA,MAAMsD,YAAAA,GAAgBrF,GAAAA,CAAIG,OAAO,CAACC,IAAI,EAAwC4B,QAAAA;AAC9E,gBAAA,MAAMsD,SAAAA,GAAatF,GAAAA,CAAIsB,KAAK,CAACf,OAAO,EAAkCwB,EAAAA;AAEtE,gBAAA,IAAI,OAAOsD,YAAAA,KAAiB,QAAA,IAAYA,YAAAA,CAAaE,MAAM,GAAG,CAAA,EAAG;AAC/D,oBAAA,MAAMvD,QAAAA,GAAW,MAAMwD,qBAAAA,CAAsB3D,MAAAA,EAAQyD,SAAAA,EAAWD,YAAAA,CAAAA;AAChE,oBAAA,MAAM3D,cAAAA,CAAe,OAAA,CAAA,CAASgD,sBAAsB,CAAC7C,MAAAA,EAAQG,QAAAA,CAAAA;gBAC/D,CAAA,MAAO;oBACL,MAAMN,cAAAA,CAAe,OAAA,CAAA,CAASgD,sBAAsB,CAAC7C,MAAAA,CAAAA;AACvD,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAOrB,GAAAA,EAAK;AACZG,YAAAA,MAAAA,CAAOyC,GAAG,CAACtC,KAAK,CAAC,+CAAA,EAAiDN,GAAAA,CAAAA;AACpE,QAAA;AAEAR,QAAAA,GAAAA,CAAII,IAAI,GAAG;AAAE+C,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"authentication.mjs","sources":["../../../../../server/src/controllers/authentication.ts"],"sourcesContent":["import type { Context, Next } from 'koa';\nimport passport from 'koa-passport';\nimport compose from 'koa-compose';\nimport '@strapi/types';\nimport type { Data } from '@strapi/types';\nimport { errors } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { emitLoginFailure, type LoginFailureReason } from '../audit-logs/auth';\nimport { USER_NOT_ACTIVE_MESSAGE } from '../services/auth';\nimport {\n  REFRESH_COOKIE_NAME,\n  buildCookieOptionsWithExpiry,\n  buildSessionMetadataFromContext,\n  getSessionManager,\n  extractDeviceParams,\n  generateDeviceId,\n  getRefreshCookieOptions,\n  resolveLogoutDeviceId,\n} from '../../../shared/utils/session-auth';\n\nimport {\n  validateRegistrationInput,\n  validateAdminRegistrationInput,\n  validateRegistrationInfoQuery,\n  validateForgotPasswordInput,\n  validateResetPasswordInput,\n  validateLoginSessionInput,\n} from '../validation/authentication';\n\nimport type {\n  ForgotPassword,\n  Login,\n  Register,\n  RegisterAdmin,\n  RegistrationInfo,\n  ResetPassword,\n} from '../../../shared/contracts/authentication';\nimport { AdminUser } from '../../../shared/contracts/shared';\n\nconst { ApplicationError, ValidationError } = errors;\n\n/**\n * Emits `admin.auth.error` without delaying the response. The account is looked up by\n * the email of the request, as the local strategy does, because passport does not pass\n * the user along with an error.\n */\nconst emitLocalLoginFailure = (ctx: Context, error: Error, reason: LoginFailureReason) => {\n  const { email } = (ctx.request.body ?? {}) as { email?: unknown };\n\n  const emit = (user?: { id: Data.ID; email: string } | null) =>\n    emitLoginFailure(\n      { strapi },\n      {\n        error,\n        reason,\n        provider: 'local',\n        ...(user ? { user: { id: user.id, email: user.email } } : {}),\n      }\n    );\n\n  // A failed lookup still emits, without the account\n  Promise.resolve()\n    .then(() =>\n      typeof email === 'string'\n        ? strapi.db\n            .query('admin::user')\n            .findOne({ select: ['id', 'email'], where: { email: email.toLowerCase() } })\n        : null\n    )\n    .then(emit, () => emit());\n};\n\nexport default {\n  login: compose([\n    async (ctx: Context, next: Next) => {\n      await validateLoginSessionInput(ctx.request.body ?? {});\n      return next();\n    },\n    (ctx: Context, next: Next) => {\n      return passport.authenticate('local', { session: false }, (err, user, info) => {\n        if (err) {\n          emitLocalLoginFailure(\n            ctx,\n            err,\n            err.details?.code === 'LOGIN_NOT_ALLOWED' ? 'login_not_allowed' : 'unexpected_error'\n          );\n          // if this is a recognized error, allow it to bubble up to user\n          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {\n            throw err;\n          }\n\n          // for all other errors throw a generic error to prevent leaking info\n          return ctx.notImplemented();\n        }\n\n        if (!user) {\n          emitLocalLoginFailure(\n            ctx,\n            new Error(info.message),\n            info.message === USER_NOT_ACTIVE_MESSAGE ? 'account_inactive' : 'invalid_credentials'\n          );\n          throw new ApplicationError(info.message);\n        }\n\n        const query = ctx.state as Login.Request['query'];\n        query.user = user;\n\n        const sanitizedUser = getService('user').sanitizeUser(user);\n        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });\n\n        return next();\n      })(ctx, next);\n    },\n    async (ctx: Context) => {\n      const { user } = ctx.state as { user: AdminUser };\n\n      try {\n        const sessionManager = getSessionManager();\n        if (!sessionManager) {\n          return ctx.internalServerError();\n        }\n        const userId = String(user.id);\n        const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n        const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n          'admin'\n        ).generateRefreshToken(userId, deviceId, {\n          type: rememberMe ? 'refresh' : 'session',\n          metadata: buildSessionMetadataFromContext(ctx),\n        });\n\n        const cookieOptions = buildCookieOptionsWithExpiry(\n          rememberMe ? 'refresh' : 'session',\n          absoluteExpiresAt,\n          ctx.request.secure\n        );\n        ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n        const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n        if ('error' in accessResult) {\n          return ctx.internalServerError();\n        }\n\n        const { token: accessToken } = accessResult;\n\n        ctx.body = {\n          data: {\n            token: accessToken,\n            accessToken,\n            user: getService('user').sanitizeUser(ctx.state.user),\n          },\n        } satisfies Login.Response;\n      } catch (error) {\n        strapi.log.error('Failed to create admin refresh session', error);\n        return ctx.internalServerError();\n      }\n    },\n  ]),\n\n  async registrationInfo(ctx: Context) {\n    await validateRegistrationInfoQuery(ctx.request.query);\n\n    const { registrationToken } = ctx.request.query as RegistrationInfo.Request['query'];\n\n    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);\n\n    if (!registrationInfo) {\n      throw new ValidationError('Invalid registrationToken');\n    }\n\n    ctx.body = { data: registrationInfo } satisfies RegistrationInfo.Response;\n  },\n\n  async register(ctx: Context) {\n    const input = ctx.request.body as Register.Request['body'];\n\n    await validateRegistrationInput(input);\n\n    const user = await getService('user').register(input);\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies Register.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async registerAdmin(ctx: Context) {\n    const input = ctx.request.body as RegisterAdmin.Request['body'];\n\n    await validateAdminRegistrationInput(input);\n\n    const user = await getService('user').createFirstAdmin(input);\n\n    strapi.telemetry.send('didCreateFirstAdmin');\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n      const userId = String(user.id);\n      const { deviceId, rememberMe } = extractDeviceParams(ctx.request.body);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: rememberMe ? 'refresh' : 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        rememberMe ? 'refresh' : 'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token: accessToken } = accessResult;\n\n      ctx.body = {\n        data: {\n          token: accessToken,\n          accessToken,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies RegisterAdmin.Response;\n    } catch (error) {\n      strapi.log.error('Failed to create admin refresh session during register-admin', error);\n      return ctx.internalServerError();\n    }\n  },\n\n  async forgotPassword(ctx: Context) {\n    const input = ctx.request.body as ForgotPassword.Request['body'];\n\n    await validateForgotPasswordInput(input);\n\n    // Not awaited: the response must not reveal whether the email exists. The call runs\n    // synchronously so a broken service still surfaces as a 500; only a rejection of the\n    // returned promise is caught here, since nothing else would handle it.\n    Promise.resolve(getService('auth').forgotPassword(input)).catch((error: unknown) => {\n      strapi.log.error('Failed to process the forgot-password request', { error });\n    });\n\n    ctx.status = 204;\n  },\n\n  async resetPassword(ctx: Context) {\n    const input = ctx.request.body as ResetPassword.Request['body'];\n\n    await validateResetPasswordInput(input);\n\n    const user = await getService('auth').resetPassword(input);\n\n    // Issue a new admin refresh session and access token after password reset.\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      const userId = String(user.id);\n      const deviceId = generateDeviceId();\n\n      // Invalidate all existing sessions before creating a new one\n      await sessionManager('admin').invalidateRefreshToken(userId);\n\n      const { token: refreshToken, absoluteExpiresAt } = await sessionManager(\n        'admin'\n      ).generateRefreshToken(userId, deviceId, {\n        type: 'session',\n        metadata: buildSessionMetadataFromContext(ctx),\n      });\n\n      // No rememberMe flow here; expire with session by default (session cookie)\n      const cookieOptions = buildCookieOptionsWithExpiry(\n        'session',\n        absoluteExpiresAt,\n        ctx.request.secure\n      );\n      ctx.cookies.set(REFRESH_COOKIE_NAME, refreshToken, cookieOptions);\n\n      const accessResult = await sessionManager('admin').generateAccessToken(refreshToken);\n      if ('error' in accessResult) {\n        return ctx.internalServerError();\n      }\n\n      const { token } = accessResult;\n\n      ctx.body = {\n        data: {\n          token,\n          user: getService('user').sanitizeUser(user),\n        },\n      } satisfies ResetPassword.Response;\n    } catch (err) {\n      strapi.log.error('Failed to create admin refresh session during reset-password', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async accessToken(ctx: Context) {\n    const refreshToken = ctx.cookies.get(REFRESH_COOKIE_NAME);\n\n    if (!refreshToken) {\n      return ctx.unauthorized('Missing refresh token');\n    }\n\n    try {\n      const sessionManager = getSessionManager();\n      if (!sessionManager) {\n        return ctx.internalServerError();\n      }\n\n      // Single-use renewal: rotate on access exchange, then create access token\n      // from the new refresh token\n      const rotation = await sessionManager('admin').rotateRefreshToken(refreshToken);\n      if ('error' in rotation) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const result = await sessionManager('admin').generateAccessToken(rotation.token);\n      if ('error' in result) {\n        return ctx.unauthorized('Invalid refresh token');\n      }\n\n      const { token } = result;\n      // Preserve session-vs-remember mode using rotation.type and rotation.absoluteExpiresAt\n      const opts = buildCookieOptionsWithExpiry(\n        rotation.type,\n        rotation.absoluteExpiresAt,\n        ctx.request.secure\n      );\n\n      ctx.cookies.set(REFRESH_COOKIE_NAME, rotation.token, opts);\n      ctx.body = { data: { token } };\n    } catch (err) {\n      strapi.log.error('Failed to generate access token from refresh token', err as any);\n      return ctx.internalServerError();\n    }\n  },\n\n  async logout(ctx: Context) {\n    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);\n    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });\n\n    // Clear cookie regardless of token validity\n    ctx.cookies.set(REFRESH_COOKIE_NAME, '', {\n      ...getRefreshCookieOptions(ctx.request.secure),\n      expires: new Date(0),\n    });\n\n    try {\n      const sessionManager = getSessionManager();\n      if (sessionManager) {\n        const userId = String(ctx.state.user.id);\n        const bodyDeviceId = (ctx.request.body as { deviceId?: string } | undefined)?.deviceId;\n        const sessionId = (ctx.state.session as { id?: string } | undefined)?.id;\n\n        if (typeof bodyDeviceId === 'string' && bodyDeviceId.length > 0) {\n          const deviceId = await resolveLogoutDeviceId(userId, sessionId, bodyDeviceId);\n          await sessionManager('admin').invalidateRefreshToken(userId, deviceId);\n        } else {\n          await sessionManager('admin').invalidateRefreshToken(userId);\n        }\n      }\n    } catch (err) {\n      strapi.log.error('Failed to revoke admin sessions during logout', err as any);\n    }\n\n    ctx.body = { data: {} };\n  },\n};\n"],"names":["ApplicationError","ValidationError","errors","emitLocalLoginFailure","ctx","error","reason","email","request","body","emit","user","emitLoginFailure","strapi","provider","id","Promise","resolve","then","db","query","findOne","select","where","toLowerCase","login","compose","next","validateLoginSessionInput","passport","authenticate","session","err","info","details","code","notImplemented","Error","message","USER_NOT_ACTIVE_MESSAGE","state","sanitizedUser","getService","sanitizeUser","eventHub","sessionManager","getSessionManager","internalServerError","userId","String","deviceId","rememberMe","extractDeviceParams","token","refreshToken","absoluteExpiresAt","generateRefreshToken","type","metadata","buildSessionMetadataFromContext","cookieOptions","buildCookieOptionsWithExpiry","secure","cookies","set","REFRESH_COOKIE_NAME","accessResult","generateAccessToken","accessToken","data","log","registrationInfo","validateRegistrationInfoQuery","registrationToken","findRegistrationInfo","register","input","validateRegistrationInput","registerAdmin","validateAdminRegistrationInput","createFirstAdmin","telemetry","send","forgotPassword","validateForgotPasswordInput","catch","status","resetPassword","validateResetPasswordInput","generateDeviceId","invalidateRefreshToken","get","unauthorized","rotation","rotateRefreshToken","result","opts","logout","getRefreshCookieOptions","expires","Date","bodyDeviceId","sessionId","length","resolveLogoutDeviceId"],"mappings":";;;;;;;;;;;;;AAuCA,MAAM,EAAEA,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,MAAAA;AAE9C;;;;AAIC,IACD,MAAMC,qBAAAA,GAAwB,CAACC,GAAAA,EAAcC,KAAAA,EAAcC,MAAAA,GAAAA;IACzD,MAAM,EAAEC,KAAK,EAAE,GAAIH,IAAII,OAAO,CAACC,IAAI,IAAI,EAAC;IAExC,MAAMC,IAAAA,GAAO,CAACC,IAAAA,GACZC,gBAAAA,CACE;AAAEC,YAAAA;SAAO,EACT;AACER,YAAAA,KAAAA;AACAC,YAAAA,MAAAA;YACAQ,QAAAA,EAAU,OAAA;AACV,YAAA,GAAIH,IAAAA,GAAO;gBAAEA,IAAAA,EAAM;AAAEI,oBAAAA,EAAAA,EAAIJ,KAAKI,EAAE;AAAER,oBAAAA,KAAAA,EAAOI,KAAKJ;AAAM;AAAE,aAAA,GAAI;AAC5D,SAAA,CAAA;;AAIJS,IAAAA,OAAAA,CAAQC,OAAO,EAAA,CACZC,IAAI,CAAC,IACJ,OAAOX,KAAAA,KAAU,QAAA,GACbM,MAAAA,CAAOM,EAAE,CACNC,KAAK,CAAC,aAAA,CAAA,CACNC,OAAO,CAAC;YAAEC,MAAAA,EAAQ;AAAC,gBAAA,IAAA;AAAM,gBAAA;AAAQ,aAAA;YAAEC,KAAAA,EAAO;AAAEhB,gBAAAA,KAAAA,EAAOA,MAAMiB,WAAW;AAAG;AAAE,SAAA,CAAA,GAC5E,IAAA,CAAA,CAELN,IAAI,CAACR,IAAAA,EAAM,IAAMA,IAAAA,EAAAA,CAAAA;AACtB,CAAA;AAEA,qBAAe;AACbe,IAAAA,KAAAA,EAAOC,OAAAA,CAAQ;AACb,QAAA,OAAOtB,GAAAA,EAAcuB,IAAAA,GAAAA;AACnB,YAAA,MAAMC,0BAA0BxB,GAAAA,CAAII,OAAO,CAACC,IAAI,IAAI,EAAC,CAAA;YACrD,OAAOkB,IAAAA,EAAAA;AACT,QAAA,CAAA;AACA,QAAA,CAACvB,GAAAA,EAAcuB,IAAAA,GAAAA;YACb,OAAOE,QAAAA,CAASC,YAAY,CAAC,OAAA,EAAS;gBAAEC,OAAAA,EAAS;aAAM,EAAG,CAACC,KAAKrB,IAAAA,EAAMsB,IAAAA,GAAAA;AACpE,gBAAA,IAAID,GAAAA,EAAK;AACP7B,oBAAAA,qBAAAA,CACEC,KACA4B,GAAAA,EACAA,GAAAA,CAAIE,OAAO,EAAEC,IAAAA,KAAS,sBAAsB,mBAAA,GAAsB,kBAAA,CAAA;;AAGpE,oBAAA,IAAIH,GAAAA,CAAIE,OAAO,EAAEC,IAAAA,KAAS,mBAAA,EAAqB;wBAC7C,MAAMH,GAAAA;AACR,oBAAA;;AAGA,oBAAA,OAAO5B,IAAIgC,cAAc,EAAA;AAC3B,gBAAA;AAEA,gBAAA,IAAI,CAACzB,IAAAA,EAAM;oBACTR,qBAAAA,CACEC,GAAAA,EACA,IAAIiC,KAAAA,CAAMJ,IAAAA,CAAKK,OAAO,GACtBL,IAAAA,CAAKK,OAAO,KAAKC,uBAAAA,GAA0B,kBAAA,GAAqB,qBAAA,CAAA;oBAElE,MAAM,IAAIvC,gBAAAA,CAAiBiC,IAAAA,CAAKK,OAAO,CAAA;AACzC,gBAAA;gBAEA,MAAMlB,KAAAA,GAAQhB,IAAIoC,KAAK;AACvBpB,gBAAAA,KAAAA,CAAMT,IAAI,GAAGA,IAAAA;AAEb,gBAAA,MAAM8B,aAAAA,GAAgBC,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA,CAAAA;AACtDE,gBAAAA,MAAAA,CAAO+B,QAAQ,CAAClC,IAAI,CAAC,oBAAA,EAAsB;oBAAEC,IAAAA,EAAM8B,aAAAA;oBAAe3B,QAAAA,EAAU;AAAQ,iBAAA,CAAA;gBAEpF,OAAOa,IAAAA,EAAAA;AACT,YAAA,CAAA,CAAA,CAAGvB,GAAAA,EAAKuB,IAAAA,CAAAA;AACV,QAAA,CAAA;QACA,OAAOvB,GAAAA,GAAAA;AACL,YAAA,MAAM,EAAEO,IAAI,EAAE,GAAGP,IAAIoC,KAAK;YAE1B,IAAI;AACF,gBAAA,MAAMK,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,gBAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,oBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,gBAAA;gBACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;gBAC7B,MAAM,EAAEmC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,mBAAAA,CAAoBhD,GAAAA,CAAII,OAAO,CAACC,IAAI,CAAA;AAErE,gBAAA,MAAM,EAAE4C,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;AACvCO,oBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,oBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCvD,GAAAA;AAC5C,iBAAA,CAAA;gBAEA,MAAMwD,aAAAA,GAAgBC,6BACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,gBAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,gBAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,gBAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,oBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,gBAAA;AAEA,gBAAA,MAAM,EAAEM,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/B9D,gBAAAA,GAAAA,CAAIK,IAAI,GAAG;oBACT4D,IAAAA,EAAM;wBACJhB,KAAAA,EAAOe,WAAAA;AACPA,wBAAAA,WAAAA;AACAzD,wBAAAA,IAAAA,EAAM+B,WAAW,MAAA,CAAA,CAAQC,YAAY,CAACvC,GAAAA,CAAIoC,KAAK,CAAC7B,IAAI;AACtD;AACF,iBAAA;AACF,YAAA,CAAA,CAAE,OAAON,KAAAA,EAAO;AACdQ,gBAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,wCAAA,EAA0CA,KAAAA,CAAAA;AAC3D,gBAAA,OAAOD,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;AACF,QAAA;AACD,KAAA,CAAA;AAED,IAAA,MAAMwB,kBAAiBnE,GAAY,EAAA;AACjC,QAAA,MAAMoE,6BAAAA,CAA8BpE,GAAAA,CAAII,OAAO,CAACY,KAAK,CAAA;AAErD,QAAA,MAAM,EAAEqD,iBAAiB,EAAE,GAAGrE,GAAAA,CAAII,OAAO,CAACY,KAAK;AAE/C,QAAA,MAAMmD,gBAAAA,GAAmB,MAAM7B,UAAAA,CAAW,MAAA,CAAA,CAAQgC,oBAAoB,CAACD,iBAAAA,CAAAA;AAEvE,QAAA,IAAI,CAACF,gBAAAA,EAAkB;AACrB,YAAA,MAAM,IAAItE,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,QAAA;AAEAG,QAAAA,GAAAA,CAAIK,IAAI,GAAG;YAAE4D,IAAAA,EAAME;AAAiB,SAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMI,UAASvE,GAAY,EAAA;AACzB,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMoE,yBAAAA,CAA0BD,KAAAA,CAAAA;AAEhC,QAAA,MAAMjE,IAAAA,GAAO,MAAM+B,UAAAA,CAAW,MAAA,CAAA,CAAQiC,QAAQ,CAACC,KAAAA,CAAAA;QAE/C,IAAI;AACF,YAAA,MAAM/B,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;YAC7B,MAAM,EAAEmC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,mBAAAA,CAAoBhD,GAAAA,CAAII,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE4C,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCvD,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAMwD,aAAAA,GAAgBC,6BACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEM,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/B9D,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBACT4D,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzD,IAAAA,EAAM+B,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAON,KAAAA,EAAO;AACdQ,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,wDAAA,EAA0DA,KAAAA,CAAAA;AAC3E,YAAA,OAAOD,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAM+B,eAAc1E,GAAY,EAAA;AAC9B,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAMsE,8BAAAA,CAA+BH,KAAAA,CAAAA;AAErC,QAAA,MAAMjE,IAAAA,GAAO,MAAM+B,UAAAA,CAAW,MAAA,CAAA,CAAQsC,gBAAgB,CAACJ,KAAAA,CAAAA;QAEvD/D,MAAAA,CAAOoE,SAAS,CAACC,IAAI,CAAC,qBAAA,CAAA;QAEtB,IAAI;AACF,YAAA,MAAMrC,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YACA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;YAC7B,MAAM,EAAEmC,QAAQ,EAAEC,UAAU,EAAE,GAAGC,mBAAAA,CAAoBhD,GAAAA,CAAII,OAAO,CAACC,IAAI,CAAA;AAErE,YAAA,MAAM,EAAE4C,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;AACvCO,gBAAAA,IAAAA,EAAMN,aAAa,SAAA,GAAY,SAAA;AAC/BO,gBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCvD,GAAAA;AAC5C,aAAA,CAAA;YAEA,MAAMwD,aAAAA,GAAgBC,6BACpBV,UAAAA,GAAa,SAAA,GAAY,WACzBI,iBAAAA,EACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;AAEA,YAAA,MAAM,EAAEM,KAAAA,EAAOe,WAAW,EAAE,GAAGF,YAAAA;AAE/B9D,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBACT4D,IAAAA,EAAM;oBACJhB,KAAAA,EAAOe,WAAAA;AACPA,oBAAAA,WAAAA;oBACAzD,IAAAA,EAAM+B,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAON,KAAAA,EAAO;AACdQ,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,8DAAA,EAAgEA,KAAAA,CAAAA;AACjF,YAAA,OAAOD,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMoC,gBAAe/E,GAAY,EAAA;AAC/B,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAM2E,2BAAAA,CAA4BR,KAAAA,CAAAA;;;;QAKlC5D,OAAAA,CAAQC,OAAO,CAACyB,UAAAA,CAAW,MAAA,CAAA,CAAQyC,cAAc,CAACP,KAAAA,CAAAA,CAAAA,CAAQS,KAAK,CAAC,CAAChF,KAAAA,GAAAA;AAC/DQ,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,+CAAA,EAAiD;AAAEA,gBAAAA;AAAM,aAAA,CAAA;AAC5E,QAAA,CAAA,CAAA;AAEAD,QAAAA,GAAAA,CAAIkF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAcnF,GAAY,EAAA;AAC9B,QAAA,MAAMwE,KAAAA,GAAQxE,GAAAA,CAAII,OAAO,CAACC,IAAI;AAE9B,QAAA,MAAM+E,0BAAAA,CAA2BZ,KAAAA,CAAAA;AAEjC,QAAA,MAAMjE,IAAAA,GAAO,MAAM+B,UAAAA,CAAW,MAAA,CAAA,CAAQ6C,aAAa,CAACX,KAAAA,CAAAA;;QAGpD,IAAI;AACF,YAAA,MAAM/B,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAMC,MAAAA,GAASC,MAAAA,CAAOtC,IAAAA,CAAKI,EAAE,CAAA;AAC7B,YAAA,MAAMmC,QAAAA,GAAWuC,gBAAAA,EAAAA;;YAGjB,MAAM5C,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,CAAAA;AAErD,YAAA,MAAM,EAAEK,KAAAA,EAAOC,YAAY,EAAEC,iBAAiB,EAAE,GAAG,MAAMV,cAAAA,CACvD,OAAA,CAAA,CACAW,oBAAoB,CAACR,QAAQE,QAAAA,EAAU;gBACvCO,IAAAA,EAAM,SAAA;AACNC,gBAAAA,QAAAA,EAAUC,+BAAAA,CAAgCvD,GAAAA;AAC5C,aAAA,CAAA;;AAGA,YAAA,MAAMwD,gBAAgBC,4BAAAA,CACpB,SAAA,EACAN,mBACAnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAEpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,qBAAqBX,YAAAA,EAAcM,aAAAA,CAAAA;AAEnD,YAAA,MAAMM,YAAAA,GAAe,MAAMrB,cAAAA,CAAe,OAAA,CAAA,CAASsB,mBAAmB,CAACb,YAAAA,CAAAA;AACvE,YAAA,IAAI,WAAWY,YAAAA,EAAc;AAC3B,gBAAA,OAAO9D,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;YAEA,MAAM,EAAEM,KAAK,EAAE,GAAGa,YAAAA;AAElB9D,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBACT4D,IAAAA,EAAM;AACJhB,oBAAAA,KAAAA;oBACA1C,IAAAA,EAAM+B,UAAAA,CAAW,MAAA,CAAA,CAAQC,YAAY,CAAChC,IAAAA;AACxC;AACF,aAAA;AACF,QAAA,CAAA,CAAE,OAAOqB,GAAAA,EAAK;AACZnB,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,8DAAA,EAAgE2B,GAAAA,CAAAA;AACjF,YAAA,OAAO5B,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMqB,aAAYhE,GAAY,EAAA;AAC5B,QAAA,MAAMkD,YAAAA,GAAelD,GAAAA,CAAI2D,OAAO,CAAC4B,GAAG,CAAC1B,mBAAAA,CAAAA;AAErC,QAAA,IAAI,CAACX,YAAAA,EAAc;YACjB,OAAOlD,GAAAA,CAAIwF,YAAY,CAAC,uBAAA,CAAA;AAC1B,QAAA;QAEA,IAAI;AACF,YAAA,MAAM/C,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAI,CAACD,cAAAA,EAAgB;AACnB,gBAAA,OAAOzC,IAAI2C,mBAAmB,EAAA;AAChC,YAAA;;;AAIA,YAAA,MAAM8C,QAAAA,GAAW,MAAMhD,cAAAA,CAAe,OAAA,CAAA,CAASiD,kBAAkB,CAACxC,YAAAA,CAAAA;AAClE,YAAA,IAAI,WAAWuC,QAAAA,EAAU;gBACvB,OAAOzF,GAAAA,CAAIwF,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;AAEA,YAAA,MAAMG,SAAS,MAAMlD,cAAAA,CAAe,SAASsB,mBAAmB,CAAC0B,SAASxC,KAAK,CAAA;AAC/E,YAAA,IAAI,WAAW0C,MAAAA,EAAQ;gBACrB,OAAO3F,GAAAA,CAAIwF,YAAY,CAAC,uBAAA,CAAA;AAC1B,YAAA;YAEA,MAAM,EAAEvC,KAAK,EAAE,GAAG0C,MAAAA;;YAElB,MAAMC,IAAAA,GAAOnC,4BAAAA,CACXgC,QAAAA,CAASpC,IAAI,EACboC,QAAAA,CAAStC,iBAAiB,EAC1BnD,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAA;AAGpB1D,YAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,mBAAAA,EAAqB4B,QAAAA,CAASxC,KAAK,EAAE2C,IAAAA,CAAAA;AACrD5F,YAAAA,GAAAA,CAAIK,IAAI,GAAG;gBAAE4D,IAAAA,EAAM;AAAEhB,oBAAAA;AAAM;AAAE,aAAA;AAC/B,QAAA,CAAA,CAAE,OAAOrB,GAAAA,EAAK;AACZnB,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,oDAAA,EAAsD2B,GAAAA,CAAAA;AACvE,YAAA,OAAO5B,IAAI2C,mBAAmB,EAAA;AAChC,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMkD,QAAO7F,GAAY,EAAA;QACvB,MAAMqC,aAAAA,GAAgBC,WAAW,MAAA,CAAA,CAAQC,YAAY,CAACvC,GAAAA,CAAIoC,KAAK,CAAC7B,IAAI,CAAA;AACpEE,QAAAA,MAAAA,CAAO+B,QAAQ,CAAClC,IAAI,CAAC,cAAA,EAAgB;YAAEC,IAAAA,EAAM8B;AAAc,SAAA,CAAA;;AAG3DrC,QAAAA,GAAAA,CAAI2D,OAAO,CAACC,GAAG,CAACC,qBAAqB,EAAA,EAAI;AACvC,YAAA,GAAGiC,uBAAAA,CAAwB9F,GAAAA,CAAII,OAAO,CAACsD,MAAM,CAAC;AAC9CqC,YAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AACpB,SAAA,CAAA;QAEA,IAAI;AACF,YAAA,MAAMvD,cAAAA,GAAiBC,iBAAAA,EAAAA;AACvB,YAAA,IAAID,cAAAA,EAAgB;AAClB,gBAAA,MAAMG,SAASC,MAAAA,CAAO7C,GAAAA,CAAIoC,KAAK,CAAC7B,IAAI,CAACI,EAAE,CAAA;AACvC,gBAAA,MAAMsF,YAAAA,GAAgBjG,GAAAA,CAAII,OAAO,CAACC,IAAI,EAAwCyC,QAAAA;AAC9E,gBAAA,MAAMoD,SAAAA,GAAalG,GAAAA,CAAIoC,KAAK,CAACT,OAAO,EAAkChB,EAAAA;AAEtE,gBAAA,IAAI,OAAOsF,YAAAA,KAAiB,QAAA,IAAYA,YAAAA,CAAaE,MAAM,GAAG,CAAA,EAAG;AAC/D,oBAAA,MAAMrD,QAAAA,GAAW,MAAMsD,qBAAAA,CAAsBxD,MAAAA,EAAQsD,SAAAA,EAAWD,YAAAA,CAAAA;AAChE,oBAAA,MAAMxD,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,EAAQE,QAAAA,CAAAA;gBAC/D,CAAA,MAAO;oBACL,MAAML,cAAAA,CAAe,OAAA,CAAA,CAAS6C,sBAAsB,CAAC1C,MAAAA,CAAAA;AACvD,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAOhB,GAAAA,EAAK;AACZnB,YAAAA,MAAAA,CAAOyD,GAAG,CAACjE,KAAK,CAAC,+CAAA,EAAiD2B,GAAAA,CAAAA;AACpE,QAAA;AAEA5B,QAAAA,GAAAA,CAAIK,IAAI,GAAG;AAAE4D,YAAAA,IAAAA,EAAM;AAAG,SAAA;AACxB,IAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/domain/permission/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../../../../server/src/domain/permission/index.ts"],"sourcesContent":["import { objects, providerFactory } from '@strapi/utils';\nimport { pick, reject, merge, omit, get, curry } from 'lodash';\nimport type { Utils } from '@strapi/types';\n\nimport { Permission } from '../../../../shared/contracts/shared';\nimport { SanitizedPermission } from '../../../../shared/contracts/roles';\n\nexport type CreatePermissionPayload = Utils.Object.PartialBy<\n  Permission,\n  'actionParameters' | 'conditions' | 'properties' | 'subject' | 'id' | 'createdAt' | 'updatedAt'\n>;\n\ntype Provider = ReturnType<typeof providerFactory>;\n\nexport const permissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n  'role',\n  'apiToken',\n];\nexport const sanitizedPermissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n] as const;\n\nexport const sanitizePermissionFields: (p: Permission) => SanitizedPermission = (permission) =>\n  pick(permission, sanitizedPermissionFields);\n\n/**\n * Creates a permission with default values\n */\nconst getDefaultPermission = () => ({\n  actionParameters: {},\n  conditions: [],\n  properties: {},\n  subject: null,\n});\n\n/**\n * Returns a new permission with the given condition\n * @param condition - The condition to add\n * @param permission - The permission on which we want to add the condition\n * @return\n */\nexport const addCondition = curry((condition: string, permission: Permission): Permission => {\n  const { conditions } = permission;\n  const newConditions = Array.isArray(conditions)\n    ? [...new Set(conditions.concat(condition))]\n    : [condition];\n\n  return { ...permission, conditions: newConditions };\n});\n\n/**\n * Returns a new permission without the given condition\n * @param condition - The condition to remove\n * @param permission - The permission on which we want to remove the condition\n */\nexport const removeCondition = curry((condition: string, permission: Permission): Permission => {\n  return {\n    ...permission,\n    conditions: reject(permission.conditions, (value) => value === condition),\n  };\n});\n\n/**\n * Gets a property or a part of a property from a permission.\n * @param property - The property to get\n * @param permission - The permission on which we want to access the property\n */\nexport const getProperty = curry(\n  (property: string, permission: Permission): Permission =>\n    get(permission, `properties.${property}`)\n);\n\n/**\n * Set a value for a given property on a new permission object\n * @param property - The name of the property\n * @param value - The value of the property\n * @param permission - The permission on which we want to set the property\n */\nexport const setProperty = (\n  property: string,\n  value: unknown,\n  permission: Permission\n): Permission => {\n  return objects.set(permission, `properties.${property}`, value);\n};\n\n/**\n * Returns a new permission without the given property name set\n * @param property - The name of the property to delete\n * @param permission - The permission on which we want to remove the property\n */\nexport const deleteProperty = <TProperty extends string>(\n  property: TProperty,\n  permission: Permission\n) => omit(permission, `properties.${property}` as string) as Omit<Permission, TProperty>;\n\n/**\n * Creates a new {@link Permission} object from raw attributes. Set default values for certain fields\n * @param  attributes\n */\nexport const create = (attributes: CreatePermissionPayload) => {\n  return merge({}, getDefaultPermission(), pick(attributes, permissionFields)) as Permission;\n};\n\n/**\n * Using the given condition provider, check and remove invalid condition from the permission's condition array.\n * @param provider - The condition provider used to do the checks\n * @param permission - The condition to sanitize\n */\nexport const sanitizeConditions = curry(\n  (provider: Provider, permission: Permission): Permission => {\n    if (!Array.isArray(permission.conditions)) {\n      return permission;\n    }\n\n    return permission.conditions\n      .filter((condition: string) => !provider.has(condition))\n      .reduce(\n        (perm: Permission, condition: string) => removeCondition(condition, perm),\n        permission\n      );\n  }\n);\n\n/**\n * Transform raw attributes into valid permissions using the create domain function.\n * @param  payload - Can either be a single object of attributes or an array of those objects.\n */\n\nfunction toPermission<T extends CreatePermissionPayload>(payload: T[]): Permission[];\nfunction toPermission<T extends CreatePermissionPayload>(payload: T): Permission;\nfunction toPermission<T extends CreatePermissionPayload>(\n  payload: T[] | T\n): Permission[] | Permission {\n  if (Array.isArray(payload)) {\n    return Array.from(payload, (value) => create(value));\n  }\n\n  return create(payload);\n}\n\nexport { toPermission };\n\nexport default {\n  addCondition,\n  removeCondition,\n  create,\n  deleteProperty,\n  permissionFields,\n  getProperty,\n  sanitizedPermissionFields,\n  sanitizeConditions,\n  sanitizePermissionFields,\n  setProperty,\n  toPermission,\n};\n"],"names":["permissionFields","sanitizedPermissionFields","sanitizePermissionFields","permission","pick","getDefaultPermission","actionParameters","conditions","properties","subject","addCondition","curry","condition","newConditions","Array","isArray","Set","concat","removeCondition","reject","value","getProperty","property","get","setProperty","objects","set","deleteProperty","omit","create","attributes","merge","sanitizeConditions","provider","filter","has","reduce","perm","toPermission","payload","from"],"mappings":";;;;;;;MAcaA,gBAAAA,GAAmB;AAC9B,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA,YAAA;AACA,IAAA,MAAA;AACA,IAAA;;MAEWC,yBAAAA,GAA4B;AACvC,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA;;MAGWC,wBAAAA,GAAmE,CAACC,UAAAA,GAC/EC,MAAAA,CAAKD,YAAYF,yBAAAA;AAEnB;;IAGA,MAAMI,oBAAAA,GAAuB,KAAO;AAClCC,QAAAA,gBAAAA,EAAkB,EAAC;AACnBC,QAAAA,UAAAA,EAAY,EAAE;AACdC,QAAAA,UAAAA,EAAY,EAAC;QACbC,OAAAA,EAAS;KACX,CAAA;AAEA;;;;;AAKC,IACM,MAAMC,YAAAA,GAAeC,OAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACpD,MAAM,EAAEI,UAAU,EAAE,GAAGJ,UAAAA;AACvB,IAAA,MAAMU,aAAAA,GAAgBC,KAAAA,CAAMC,OAAO,CAACR,UAAAA,CAAAA,GAChC;WAAI,IAAIS,GAAAA,CAAIT,UAAAA,CAAWU,MAAM,CAACL,SAAAA,CAAAA;KAAY,GAC1C;AAACA,QAAAA;AAAU,KAAA;IAEf,OAAO;AAAE,QAAA,GAAGT,UAAU;QAAEI,UAAAA,EAAYM;AAAc,KAAA;AACpD,CAAA;AAEA;;;;AAIC,IACM,MAAMK,eAAAA,GAAkBP,OAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACvD,OAAO;AACL,QAAA,GAAGA,UAAU;AACbI,QAAAA,UAAAA,EAAYY,SAAOhB,UAAAA,CAAWI,UAAU,EAAE,CAACa,QAAUA,KAAAA,KAAUR,SAAAA;AACjE,KAAA;AACF,CAAA;AAEA;;;;AAIC,IACM,MAAMS,WAAAA,GAAcV,OAAAA,CACzB,CAACW,QAAAA,EAAkBnB,UAAAA,GACjBoB,KAAAA,CAAIpB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,CAAA;AAG5C;;;;;AAKC,IACM,MAAME,WAAAA,GAAc,CACzBF,UACAF,KAAAA,EACAjB,UAAAA,GAAAA;IAEA,OAAOsB,aAAAA,CAAQC,GAAG,CAACvB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,EAAEF,KAAAA,CAAAA;AAC3D;AAEA;;;;AAIC,IACM,MAAMO,cAAAA,GAAiB,CAC5BL,QAAAA,EACAnB,UAAAA,GACGyB,MAAAA,CAAKzB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,QAAAA,CAAAA,CAAU;AAE9C;;;IAIO,MAAMO,MAAAA,GAAS,CAACC,UAAAA,GAAAA;AACrB,IAAA,OAAOC,OAAAA,CAAM,EAAC,EAAG1B,oBAAAA,EAAAA,EAAwBD,OAAK0B,UAAAA,EAAY9B,gBAAAA,CAAAA,CAAAA;AAC5D;AAEA;;;;AAIC,IACM,MAAMgC,kBAAAA,GAAqBrB,OAAAA,CAChC,CAACsB,QAAAA,EAAoB9B,UAAAA,GAAAA;AACnB,IAAA,IAAI,CAACW,KAAAA,CAAMC,OAAO,CAACZ,UAAAA,CAAWI,UAAU,CAAA,EAAG;QACzC,OAAOJ,UAAAA;AACT,IAAA;AAEA,IAAA,OAAOA,WAAWI,UAAU,CACzB2B,MAAM,CAAC,CAACtB,YAAsB,CAACqB,QAAAA,CAASE,GAAG,CAACvB,SAAAA,CAAAA,CAAAA,CAC5CwB,MAAM,CACL,CAACC,MAAkBzB,SAAAA,GAAsBM,eAAAA,CAAgBN,WAAWyB,IAAAA,CAAAA,EACpElC,UAAAA,CAAAA;AAEN,CAAA;AAUF,SAASmC,aACPC,OAAgB,EAAA;IAEhB,IAAIzB,KAAAA,CAAMC,OAAO,CAACwB,OAAAA,CAAAA,EAAU;AAC1B,QAAA,OAAOzB,MAAM0B,IAAI,CAACD,OAAAA,EAAS,CAACnB,QAAUS,MAAAA,CAAOT,KAAAA,CAAAA,CAAAA;AAC/C,IAAA;AAEA,IAAA,OAAOS,MAAAA,CAAOU,OAAAA,CAAAA;AAChB;AAIA,uBAAe;AACb7B,IAAAA,YAAAA;AACAQ,IAAAA,eAAAA;AACAW,IAAAA,MAAAA;AACAF,IAAAA,cAAAA;AACA3B,IAAAA,gBAAAA;AACAqB,IAAAA,WAAAA;AACApB,IAAAA,yBAAAA;AACA+B,IAAAA,kBAAAA;AACA9B,IAAAA,wBAAAA;AACAsB,IAAAA,WAAAA;AACAc,IAAAA;AACF,CAAA;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":["../../../../../../server/src/domain/permission/index.ts"],"sourcesContent":["import { objects, providerFactory } from '@strapi/utils';\nimport { pick, reject, merge, omit, get, curry } from 'lodash';\nimport type { Utils } from '@strapi/types';\n\nimport { Permission } from '../../../../shared/contracts/shared';\nimport { SanitizedPermission } from '../../../../shared/contracts/roles';\n\nexport type CreatePermissionPayload = Utils.Object.PartialBy<\n  Permission,\n  'actionParameters' | 'conditions' | 'properties' | 'subject' | 'id' | 'createdAt' | 'updatedAt'\n>;\n\ntype Provider = ReturnType<typeof providerFactory>;\n\nexport const permissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n  'role',\n  'apiToken',\n];\nexport const sanitizedPermissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n] as const;\n\nexport const sanitizePermissionFields: (p: Permission) => SanitizedPermission = (permission) =>\n  pick(permission, sanitizedPermissionFields);\n\n/**\n * Creates a permission with default values\n */\nconst getDefaultPermission = () => ({\n  actionParameters: {},\n  conditions: [],\n  properties: {},\n  subject: null,\n});\n\n/**\n * Returns a new permission with the given condition\n * @param condition - The condition to add\n * @param permission - The permission on which we want to add the condition\n * @return\n */\nexport const addCondition = curry((condition: string, permission: Permission): Permission => {\n  const { conditions } = permission;\n  const newConditions = Array.isArray(conditions)\n    ? [...new Set(conditions.concat(condition))]\n    : [condition];\n\n  return { ...permission, conditions: newConditions };\n});\n\n/**\n * Returns a new permission without the given condition\n * @param condition - The condition to remove\n * @param permission - The permission on which we want to remove the condition\n */\nexport const removeCondition = curry((condition: string, permission: Permission): Permission => {\n  return {\n    ...permission,\n    conditions: reject(permission.conditions, (value) => value === condition),\n  };\n});\n\n/**\n * Gets a property or a part of a property from a permission.\n * @param property - The property to get\n * @param permission - The permission on which we want to access the property\n */\nexport const getProperty = curry((property: string, permission: Permission): Permission =>\n  get(permission, `properties.${property}`)\n);\n\n/**\n * Set a value for a given property on a new permission object\n * @param property - The name of the property\n * @param value - The value of the property\n * @param permission - The permission on which we want to set the property\n */\nexport const setProperty = (\n  property: string,\n  value: unknown,\n  permission: Permission\n): Permission => {\n  return objects.set(permission, `properties.${property}`, value);\n};\n\n/**\n * Returns a new permission without the given property name set\n * @param property - The name of the property to delete\n * @param permission - The permission on which we want to remove the property\n */\nexport const deleteProperty = <TProperty extends string>(\n  property: TProperty,\n  permission: Permission\n) => omit(permission, `properties.${property}` as string) as Omit<Permission, TProperty>;\n\n/**\n * Creates a new {@link Permission} object from raw attributes. Set default values for certain fields\n * @param  attributes\n */\nexport const create = (attributes: CreatePermissionPayload) => {\n  return merge({}, getDefaultPermission(), pick(attributes, permissionFields)) as Permission;\n};\n\n/**\n * Using the given condition provider, check and remove invalid condition from the permission's condition array.\n * @param provider - The condition provider used to do the checks\n * @param permission - The condition to sanitize\n */\nexport const sanitizeConditions = curry(\n  (provider: Provider, permission: Permission): Permission => {\n    if (!Array.isArray(permission.conditions)) {\n      return permission;\n    }\n\n    return permission.conditions\n      .filter((condition: string) => !provider.has(condition))\n      .reduce(\n        (perm: Permission, condition: string) => removeCondition(condition, perm),\n        permission\n      );\n  }\n);\n\n/**\n * Transform raw attributes into valid permissions using the create domain function.\n * @param  payload - Can either be a single object of attributes or an array of those objects.\n */\n\nfunction toPermission<T extends CreatePermissionPayload>(payload: T[]): Permission[];\nfunction toPermission<T extends CreatePermissionPayload>(payload: T): Permission;\nfunction toPermission<T extends CreatePermissionPayload>(\n  payload: T[] | T\n): Permission[] | Permission {\n  if (Array.isArray(payload)) {\n    return Array.from(payload, (value) => create(value));\n  }\n\n  return create(payload);\n}\n\nexport { toPermission };\n\nexport default {\n  addCondition,\n  removeCondition,\n  create,\n  deleteProperty,\n  permissionFields,\n  getProperty,\n  sanitizedPermissionFields,\n  sanitizeConditions,\n  sanitizePermissionFields,\n  setProperty,\n  toPermission,\n};\n"],"names":["permissionFields","sanitizedPermissionFields","sanitizePermissionFields","permission","pick","getDefaultPermission","actionParameters","conditions","properties","subject","addCondition","curry","condition","newConditions","Array","isArray","Set","concat","removeCondition","reject","value","getProperty","property","get","setProperty","objects","set","deleteProperty","omit","create","attributes","merge","sanitizeConditions","provider","filter","has","reduce","perm","toPermission","payload","from"],"mappings":";;;;;;;MAcaA,gBAAAA,GAAmB;AAC9B,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA,YAAA;AACA,IAAA,MAAA;AACA,IAAA;;MAEWC,yBAAAA,GAA4B;AACvC,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA;;MAGWC,wBAAAA,GAAmE,CAACC,UAAAA,GAC/EC,MAAAA,CAAKD,YAAYF,yBAAAA;AAEnB;;IAGA,MAAMI,oBAAAA,GAAuB,KAAO;AAClCC,QAAAA,gBAAAA,EAAkB,EAAC;AACnBC,QAAAA,UAAAA,EAAY,EAAE;AACdC,QAAAA,UAAAA,EAAY,EAAC;QACbC,OAAAA,EAAS;KACX,CAAA;AAEA;;;;;AAKC,IACM,MAAMC,YAAAA,GAAeC,OAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACpD,MAAM,EAAEI,UAAU,EAAE,GAAGJ,UAAAA;AACvB,IAAA,MAAMU,aAAAA,GAAgBC,KAAAA,CAAMC,OAAO,CAACR,UAAAA,CAAAA,GAChC;WAAI,IAAIS,GAAAA,CAAIT,UAAAA,CAAWU,MAAM,CAACL,SAAAA,CAAAA;KAAY,GAC1C;AAACA,QAAAA;AAAU,KAAA;IAEf,OAAO;AAAE,QAAA,GAAGT,UAAU;QAAEI,UAAAA,EAAYM;AAAc,KAAA;AACpD,CAAA;AAEA;;;;AAIC,IACM,MAAMK,eAAAA,GAAkBP,OAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACvD,OAAO;AACL,QAAA,GAAGA,UAAU;AACbI,QAAAA,UAAAA,EAAYY,SAAOhB,UAAAA,CAAWI,UAAU,EAAE,CAACa,QAAUA,KAAAA,KAAUR,SAAAA;AACjE,KAAA;AACF,CAAA;AAEA;;;;AAIC,IACM,MAAMS,WAAAA,GAAcV,OAAAA,CAAM,CAACW,QAAAA,EAAkBnB,UAAAA,GAClDoB,KAAAA,CAAIpB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,CAAA;AAG1C;;;;;AAKC,IACM,MAAME,WAAAA,GAAc,CACzBF,UACAF,KAAAA,EACAjB,UAAAA,GAAAA;IAEA,OAAOsB,aAAAA,CAAQC,GAAG,CAACvB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,EAAEF,KAAAA,CAAAA;AAC3D;AAEA;;;;AAIC,IACM,MAAMO,cAAAA,GAAiB,CAC5BL,QAAAA,EACAnB,UAAAA,GACGyB,MAAAA,CAAKzB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,QAAAA,CAAAA,CAAU;AAE9C;;;IAIO,MAAMO,MAAAA,GAAS,CAACC,UAAAA,GAAAA;AACrB,IAAA,OAAOC,OAAAA,CAAM,EAAC,EAAG1B,oBAAAA,EAAAA,EAAwBD,OAAK0B,UAAAA,EAAY9B,gBAAAA,CAAAA,CAAAA;AAC5D;AAEA;;;;AAIC,IACM,MAAMgC,kBAAAA,GAAqBrB,OAAAA,CAChC,CAACsB,QAAAA,EAAoB9B,UAAAA,GAAAA;AACnB,IAAA,IAAI,CAACW,KAAAA,CAAMC,OAAO,CAACZ,UAAAA,CAAWI,UAAU,CAAA,EAAG;QACzC,OAAOJ,UAAAA;AACT,IAAA;AAEA,IAAA,OAAOA,WAAWI,UAAU,CACzB2B,MAAM,CAAC,CAACtB,YAAsB,CAACqB,QAAAA,CAASE,GAAG,CAACvB,SAAAA,CAAAA,CAAAA,CAC5CwB,MAAM,CACL,CAACC,MAAkBzB,SAAAA,GAAsBM,eAAAA,CAAgBN,WAAWyB,IAAAA,CAAAA,EACpElC,UAAAA,CAAAA;AAEN,CAAA;AAUF,SAASmC,aACPC,OAAgB,EAAA;IAEhB,IAAIzB,KAAAA,CAAMC,OAAO,CAACwB,OAAAA,CAAAA,EAAU;AAC1B,QAAA,OAAOzB,MAAM0B,IAAI,CAACD,OAAAA,EAAS,CAACnB,QAAUS,MAAAA,CAAOT,KAAAA,CAAAA,CAAAA;AAC/C,IAAA;AAEA,IAAA,OAAOS,MAAAA,CAAOU,OAAAA,CAAAA;AAChB;AAIA,uBAAe;AACb7B,IAAAA,YAAAA;AACAQ,IAAAA,eAAAA;AACAW,IAAAA,MAAAA;AACAF,IAAAA,cAAAA;AACA3B,IAAAA,gBAAAA;AACAqB,IAAAA,WAAAA;AACApB,IAAAA,yBAAAA;AACA+B,IAAAA,kBAAAA;AACA9B,IAAAA,wBAAAA;AACAsB,IAAAA,WAAAA;AACAc,IAAAA;AACF,CAAA;;;;;;;;;;;;;;;"}

package/dist/server/server/src/domain/permission/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../../../../server/src/domain/permission/index.ts"],"sourcesContent":["import { objects, providerFactory } from '@strapi/utils';\nimport { pick, reject, merge, omit, get, curry } from 'lodash';\nimport type { Utils } from '@strapi/types';\n\nimport { Permission } from '../../../../shared/contracts/shared';\nimport { SanitizedPermission } from '../../../../shared/contracts/roles';\n\nexport type CreatePermissionPayload = Utils.Object.PartialBy<\n  Permission,\n  'actionParameters' | 'conditions' | 'properties' | 'subject' | 'id' | 'createdAt' | 'updatedAt'\n>;\n\ntype Provider = ReturnType<typeof providerFactory>;\n\nexport const permissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n  'role',\n  'apiToken',\n];\nexport const sanitizedPermissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n] as const;\n\nexport const sanitizePermissionFields: (p: Permission) => SanitizedPermission = (permission) =>\n  pick(permission, sanitizedPermissionFields);\n\n/**\n * Creates a permission with default values\n */\nconst getDefaultPermission = () => ({\n  actionParameters: {},\n  conditions: [],\n  properties: {},\n  subject: null,\n});\n\n/**\n * Returns a new permission with the given condition\n * @param condition - The condition to add\n * @param permission - The permission on which we want to add the condition\n * @return\n */\nexport const addCondition = curry((condition: string, permission: Permission): Permission => {\n  const { conditions } = permission;\n  const newConditions = Array.isArray(conditions)\n    ? [...new Set(conditions.concat(condition))]\n    : [condition];\n\n  return { ...permission, conditions: newConditions };\n});\n\n/**\n * Returns a new permission without the given condition\n * @param condition - The condition to remove\n * @param permission - The permission on which we want to remove the condition\n */\nexport const removeCondition = curry((condition: string, permission: Permission): Permission => {\n  return {\n    ...permission,\n    conditions: reject(permission.conditions, (value) => value === condition),\n  };\n});\n\n/**\n * Gets a property or a part of a property from a permission.\n * @param property - The property to get\n * @param permission - The permission on which we want to access the property\n */\nexport const getProperty = curry(\n  (property: string, permission: Permission): Permission =>\n    get(permission, `properties.${property}`)\n);\n\n/**\n * Set a value for a given property on a new permission object\n * @param property - The name of the property\n * @param value - The value of the property\n * @param permission - The permission on which we want to set the property\n */\nexport const setProperty = (\n  property: string,\n  value: unknown,\n  permission: Permission\n): Permission => {\n  return objects.set(permission, `properties.${property}`, value);\n};\n\n/**\n * Returns a new permission without the given property name set\n * @param property - The name of the property to delete\n * @param permission - The permission on which we want to remove the property\n */\nexport const deleteProperty = <TProperty extends string>(\n  property: TProperty,\n  permission: Permission\n) => omit(permission, `properties.${property}` as string) as Omit<Permission, TProperty>;\n\n/**\n * Creates a new {@link Permission} object from raw attributes. Set default values for certain fields\n * @param  attributes\n */\nexport const create = (attributes: CreatePermissionPayload) => {\n  return merge({}, getDefaultPermission(), pick(attributes, permissionFields)) as Permission;\n};\n\n/**\n * Using the given condition provider, check and remove invalid condition from the permission's condition array.\n * @param provider - The condition provider used to do the checks\n * @param permission - The condition to sanitize\n */\nexport const sanitizeConditions = curry(\n  (provider: Provider, permission: Permission): Permission => {\n    if (!Array.isArray(permission.conditions)) {\n      return permission;\n    }\n\n    return permission.conditions\n      .filter((condition: string) => !provider.has(condition))\n      .reduce(\n        (perm: Permission, condition: string) => removeCondition(condition, perm),\n        permission\n      );\n  }\n);\n\n/**\n * Transform raw attributes into valid permissions using the create domain function.\n * @param  payload - Can either be a single object of attributes or an array of those objects.\n */\n\nfunction toPermission<T extends CreatePermissionPayload>(payload: T[]): Permission[];\nfunction toPermission<T extends CreatePermissionPayload>(payload: T): Permission;\nfunction toPermission<T extends CreatePermissionPayload>(\n  payload: T[] | T\n): Permission[] | Permission {\n  if (Array.isArray(payload)) {\n    return Array.from(payload, (value) => create(value));\n  }\n\n  return create(payload);\n}\n\nexport { toPermission };\n\nexport default {\n  addCondition,\n  removeCondition,\n  create,\n  deleteProperty,\n  permissionFields,\n  getProperty,\n  sanitizedPermissionFields,\n  sanitizeConditions,\n  sanitizePermissionFields,\n  setProperty,\n  toPermission,\n};\n"],"names":["permissionFields","sanitizedPermissionFields","sanitizePermissionFields","permission","pick","getDefaultPermission","actionParameters","conditions","properties","subject","addCondition","curry","condition","newConditions","Array","isArray","Set","concat","removeCondition","reject","value","getProperty","property","get","setProperty","objects","set","deleteProperty","omit","create","attributes","merge","sanitizeConditions","provider","filter","has","reduce","perm","toPermission","payload","from"],"mappings":";;;MAcaA,gBAAAA,GAAmB;AAC9B,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA,YAAA;AACA,IAAA,MAAA;AACA,IAAA;;MAEWC,yBAAAA,GAA4B;AACvC,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA;;MAGWC,wBAAAA,GAAmE,CAACC,UAAAA,GAC/EC,IAAAA,CAAKD,YAAYF,yBAAAA;AAEnB;;IAGA,MAAMI,oBAAAA,GAAuB,KAAO;AAClCC,QAAAA,gBAAAA,EAAkB,EAAC;AACnBC,QAAAA,UAAAA,EAAY,EAAE;AACdC,QAAAA,UAAAA,EAAY,EAAC;QACbC,OAAAA,EAAS;KACX,CAAA;AAEA;;;;;AAKC,IACM,MAAMC,YAAAA,GAAeC,KAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACpD,MAAM,EAAEI,UAAU,EAAE,GAAGJ,UAAAA;AACvB,IAAA,MAAMU,aAAAA,GAAgBC,KAAAA,CAAMC,OAAO,CAACR,UAAAA,CAAAA,GAChC;WAAI,IAAIS,GAAAA,CAAIT,UAAAA,CAAWU,MAAM,CAACL,SAAAA,CAAAA;KAAY,GAC1C;AAACA,QAAAA;AAAU,KAAA;IAEf,OAAO;AAAE,QAAA,GAAGT,UAAU;QAAEI,UAAAA,EAAYM;AAAc,KAAA;AACpD,CAAA;AAEA;;;;AAIC,IACM,MAAMK,eAAAA,GAAkBP,KAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACvD,OAAO;AACL,QAAA,GAAGA,UAAU;AACbI,QAAAA,UAAAA,EAAYY,OAAOhB,UAAAA,CAAWI,UAAU,EAAE,CAACa,QAAUA,KAAAA,KAAUR,SAAAA;AACjE,KAAA;AACF,CAAA;AAEA;;;;AAIC,IACM,MAAMS,WAAAA,GAAcV,KAAAA,CACzB,CAACW,QAAAA,EAAkBnB,UAAAA,GACjBoB,GAAAA,CAAIpB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,CAAA;AAG5C;;;;;AAKC,IACM,MAAME,WAAAA,GAAc,CACzBF,UACAF,KAAAA,EACAjB,UAAAA,GAAAA;IAEA,OAAOsB,OAAAA,CAAQC,GAAG,CAACvB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,EAAEF,KAAAA,CAAAA;AAC3D;AAEA;;;;AAIC,IACM,MAAMO,cAAAA,GAAiB,CAC5BL,QAAAA,EACAnB,UAAAA,GACGyB,IAAAA,CAAKzB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,QAAAA,CAAAA,CAAU;AAE9C;;;IAIO,MAAMO,MAAAA,GAAS,CAACC,UAAAA,GAAAA;AACrB,IAAA,OAAOC,KAAAA,CAAM,EAAC,EAAG1B,oBAAAA,EAAAA,EAAwBD,KAAK0B,UAAAA,EAAY9B,gBAAAA,CAAAA,CAAAA;AAC5D;AAEA;;;;AAIC,IACM,MAAMgC,kBAAAA,GAAqBrB,KAAAA,CAChC,CAACsB,QAAAA,EAAoB9B,UAAAA,GAAAA;AACnB,IAAA,IAAI,CAACW,KAAAA,CAAMC,OAAO,CAACZ,UAAAA,CAAWI,UAAU,CAAA,EAAG;QACzC,OAAOJ,UAAAA;AACT,IAAA;AAEA,IAAA,OAAOA,WAAWI,UAAU,CACzB2B,MAAM,CAAC,CAACtB,YAAsB,CAACqB,QAAAA,CAASE,GAAG,CAACvB,SAAAA,CAAAA,CAAAA,CAC5CwB,MAAM,CACL,CAACC,MAAkBzB,SAAAA,GAAsBM,eAAAA,CAAgBN,WAAWyB,IAAAA,CAAAA,EACpElC,UAAAA,CAAAA;AAEN,CAAA;AAUF,SAASmC,aACPC,OAAgB,EAAA;IAEhB,IAAIzB,KAAAA,CAAMC,OAAO,CAACwB,OAAAA,CAAAA,EAAU;AAC1B,QAAA,OAAOzB,MAAM0B,IAAI,CAACD,OAAAA,EAAS,CAACnB,QAAUS,MAAAA,CAAOT,KAAAA,CAAAA,CAAAA;AAC/C,IAAA;AAEA,IAAA,OAAOS,MAAAA,CAAOU,OAAAA,CAAAA;AAChB;AAIA,uBAAe;AACb7B,IAAAA,YAAAA;AACAQ,IAAAA,eAAAA;AACAW,IAAAA,MAAAA;AACAF,IAAAA,cAAAA;AACA3B,IAAAA,gBAAAA;AACAqB,IAAAA,WAAAA;AACApB,IAAAA,yBAAAA;AACA+B,IAAAA,kBAAAA;AACA9B,IAAAA,wBAAAA;AACAsB,IAAAA,WAAAA;AACAc,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../../../../server/src/domain/permission/index.ts"],"sourcesContent":["import { objects, providerFactory } from '@strapi/utils';\nimport { pick, reject, merge, omit, get, curry } from 'lodash';\nimport type { Utils } from '@strapi/types';\n\nimport { Permission } from '../../../../shared/contracts/shared';\nimport { SanitizedPermission } from '../../../../shared/contracts/roles';\n\nexport type CreatePermissionPayload = Utils.Object.PartialBy<\n  Permission,\n  'actionParameters' | 'conditions' | 'properties' | 'subject' | 'id' | 'createdAt' | 'updatedAt'\n>;\n\ntype Provider = ReturnType<typeof providerFactory>;\n\nexport const permissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n  'role',\n  'apiToken',\n];\nexport const sanitizedPermissionFields = [\n  'id',\n  'action',\n  'actionParameters',\n  'subject',\n  'properties',\n  'conditions',\n] as const;\n\nexport const sanitizePermissionFields: (p: Permission) => SanitizedPermission = (permission) =>\n  pick(permission, sanitizedPermissionFields);\n\n/**\n * Creates a permission with default values\n */\nconst getDefaultPermission = () => ({\n  actionParameters: {},\n  conditions: [],\n  properties: {},\n  subject: null,\n});\n\n/**\n * Returns a new permission with the given condition\n * @param condition - The condition to add\n * @param permission - The permission on which we want to add the condition\n * @return\n */\nexport const addCondition = curry((condition: string, permission: Permission): Permission => {\n  const { conditions } = permission;\n  const newConditions = Array.isArray(conditions)\n    ? [...new Set(conditions.concat(condition))]\n    : [condition];\n\n  return { ...permission, conditions: newConditions };\n});\n\n/**\n * Returns a new permission without the given condition\n * @param condition - The condition to remove\n * @param permission - The permission on which we want to remove the condition\n */\nexport const removeCondition = curry((condition: string, permission: Permission): Permission => {\n  return {\n    ...permission,\n    conditions: reject(permission.conditions, (value) => value === condition),\n  };\n});\n\n/**\n * Gets a property or a part of a property from a permission.\n * @param property - The property to get\n * @param permission - The permission on which we want to access the property\n */\nexport const getProperty = curry((property: string, permission: Permission): Permission =>\n  get(permission, `properties.${property}`)\n);\n\n/**\n * Set a value for a given property on a new permission object\n * @param property - The name of the property\n * @param value - The value of the property\n * @param permission - The permission on which we want to set the property\n */\nexport const setProperty = (\n  property: string,\n  value: unknown,\n  permission: Permission\n): Permission => {\n  return objects.set(permission, `properties.${property}`, value);\n};\n\n/**\n * Returns a new permission without the given property name set\n * @param property - The name of the property to delete\n * @param permission - The permission on which we want to remove the property\n */\nexport const deleteProperty = <TProperty extends string>(\n  property: TProperty,\n  permission: Permission\n) => omit(permission, `properties.${property}` as string) as Omit<Permission, TProperty>;\n\n/**\n * Creates a new {@link Permission} object from raw attributes. Set default values for certain fields\n * @param  attributes\n */\nexport const create = (attributes: CreatePermissionPayload) => {\n  return merge({}, getDefaultPermission(), pick(attributes, permissionFields)) as Permission;\n};\n\n/**\n * Using the given condition provider, check and remove invalid condition from the permission's condition array.\n * @param provider - The condition provider used to do the checks\n * @param permission - The condition to sanitize\n */\nexport const sanitizeConditions = curry(\n  (provider: Provider, permission: Permission): Permission => {\n    if (!Array.isArray(permission.conditions)) {\n      return permission;\n    }\n\n    return permission.conditions\n      .filter((condition: string) => !provider.has(condition))\n      .reduce(\n        (perm: Permission, condition: string) => removeCondition(condition, perm),\n        permission\n      );\n  }\n);\n\n/**\n * Transform raw attributes into valid permissions using the create domain function.\n * @param  payload - Can either be a single object of attributes or an array of those objects.\n */\n\nfunction toPermission<T extends CreatePermissionPayload>(payload: T[]): Permission[];\nfunction toPermission<T extends CreatePermissionPayload>(payload: T): Permission;\nfunction toPermission<T extends CreatePermissionPayload>(\n  payload: T[] | T\n): Permission[] | Permission {\n  if (Array.isArray(payload)) {\n    return Array.from(payload, (value) => create(value));\n  }\n\n  return create(payload);\n}\n\nexport { toPermission };\n\nexport default {\n  addCondition,\n  removeCondition,\n  create,\n  deleteProperty,\n  permissionFields,\n  getProperty,\n  sanitizedPermissionFields,\n  sanitizeConditions,\n  sanitizePermissionFields,\n  setProperty,\n  toPermission,\n};\n"],"names":["permissionFields","sanitizedPermissionFields","sanitizePermissionFields","permission","pick","getDefaultPermission","actionParameters","conditions","properties","subject","addCondition","curry","condition","newConditions","Array","isArray","Set","concat","removeCondition","reject","value","getProperty","property","get","setProperty","objects","set","deleteProperty","omit","create","attributes","merge","sanitizeConditions","provider","filter","has","reduce","perm","toPermission","payload","from"],"mappings":";;;MAcaA,gBAAAA,GAAmB;AAC9B,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA,YAAA;AACA,IAAA,MAAA;AACA,IAAA;;MAEWC,yBAAAA,GAA4B;AACvC,IAAA,IAAA;AACA,IAAA,QAAA;AACA,IAAA,kBAAA;AACA,IAAA,SAAA;AACA,IAAA,YAAA;AACA,IAAA;;MAGWC,wBAAAA,GAAmE,CAACC,UAAAA,GAC/EC,IAAAA,CAAKD,YAAYF,yBAAAA;AAEnB;;IAGA,MAAMI,oBAAAA,GAAuB,KAAO;AAClCC,QAAAA,gBAAAA,EAAkB,EAAC;AACnBC,QAAAA,UAAAA,EAAY,EAAE;AACdC,QAAAA,UAAAA,EAAY,EAAC;QACbC,OAAAA,EAAS;KACX,CAAA;AAEA;;;;;AAKC,IACM,MAAMC,YAAAA,GAAeC,KAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACpD,MAAM,EAAEI,UAAU,EAAE,GAAGJ,UAAAA;AACvB,IAAA,MAAMU,aAAAA,GAAgBC,KAAAA,CAAMC,OAAO,CAACR,UAAAA,CAAAA,GAChC;WAAI,IAAIS,GAAAA,CAAIT,UAAAA,CAAWU,MAAM,CAACL,SAAAA,CAAAA;KAAY,GAC1C;AAACA,QAAAA;AAAU,KAAA;IAEf,OAAO;AAAE,QAAA,GAAGT,UAAU;QAAEI,UAAAA,EAAYM;AAAc,KAAA;AACpD,CAAA;AAEA;;;;AAIC,IACM,MAAMK,eAAAA,GAAkBP,KAAAA,CAAM,CAACC,SAAAA,EAAmBT,UAAAA,GAAAA;IACvD,OAAO;AACL,QAAA,GAAGA,UAAU;AACbI,QAAAA,UAAAA,EAAYY,OAAOhB,UAAAA,CAAWI,UAAU,EAAE,CAACa,QAAUA,KAAAA,KAAUR,SAAAA;AACjE,KAAA;AACF,CAAA;AAEA;;;;AAIC,IACM,MAAMS,WAAAA,GAAcV,KAAAA,CAAM,CAACW,QAAAA,EAAkBnB,UAAAA,GAClDoB,GAAAA,CAAIpB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,CAAA;AAG1C;;;;;AAKC,IACM,MAAME,WAAAA,GAAc,CACzBF,UACAF,KAAAA,EACAjB,UAAAA,GAAAA;IAEA,OAAOsB,OAAAA,CAAQC,GAAG,CAACvB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,UAAU,EAAEF,KAAAA,CAAAA;AAC3D;AAEA;;;;AAIC,IACM,MAAMO,cAAAA,GAAiB,CAC5BL,QAAAA,EACAnB,UAAAA,GACGyB,IAAAA,CAAKzB,UAAAA,EAAY,CAAC,WAAW,EAAEmB,QAAAA,CAAAA,CAAU;AAE9C;;;IAIO,MAAMO,MAAAA,GAAS,CAACC,UAAAA,GAAAA;AACrB,IAAA,OAAOC,KAAAA,CAAM,EAAC,EAAG1B,oBAAAA,EAAAA,EAAwBD,KAAK0B,UAAAA,EAAY9B,gBAAAA,CAAAA,CAAAA;AAC5D;AAEA;;;;AAIC,IACM,MAAMgC,kBAAAA,GAAqBrB,KAAAA,CAChC,CAACsB,QAAAA,EAAoB9B,UAAAA,GAAAA;AACnB,IAAA,IAAI,CAACW,KAAAA,CAAMC,OAAO,CAACZ,UAAAA,CAAWI,UAAU,CAAA,EAAG;QACzC,OAAOJ,UAAAA;AACT,IAAA;AAEA,IAAA,OAAOA,WAAWI,UAAU,CACzB2B,MAAM,CAAC,CAACtB,YAAsB,CAACqB,QAAAA,CAASE,GAAG,CAACvB,SAAAA,CAAAA,CAAAA,CAC5CwB,MAAM,CACL,CAACC,MAAkBzB,SAAAA,GAAsBM,eAAAA,CAAgBN,WAAWyB,IAAAA,CAAAA,EACpElC,UAAAA,CAAAA;AAEN,CAAA;AAUF,SAASmC,aACPC,OAAgB,EAAA;IAEhB,IAAIzB,KAAAA,CAAMC,OAAO,CAACwB,OAAAA,CAAAA,EAAU;AAC1B,QAAA,OAAOzB,MAAM0B,IAAI,CAACD,OAAAA,EAAS,CAACnB,QAAUS,MAAAA,CAAOT,KAAAA,CAAAA,CAAAA;AAC/C,IAAA;AAEA,IAAA,OAAOS,MAAAA,CAAOU,OAAAA,CAAAA;AAChB;AAIA,uBAAe;AACb7B,IAAAA,YAAAA;AACAQ,IAAAA,eAAAA;AACAW,IAAAA,MAAAA;AACAF,IAAAA,cAAAA;AACA3B,IAAAA,gBAAAA;AACAqB,IAAAA,WAAAA;AACApB,IAAAA,yBAAAA;AACA+B,IAAAA,kBAAAA;AACA9B,IAAAA,wBAAAA;AACAsB,IAAAA,WAAAA;AACAc,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/register.js

@@ -7,6 +7,7 @@ var contentApiToken = require('./strategies/content-api-token.js');
 var adminToken = require('./strategies/admin-token.js');
 var migratePreferedLanguageDkToDa = require('./migrations/database/migrate-prefered-language-dk-to-da.js');
 var renameFields = require('./services/permission/rename-fields.js');
+var entitlements = require('../../ee/server/src/audit-logs/entitlements.js');
 
 var register = (({ strapi })=>{
     strapi.db.migrations.providers.internal.register(migratePreferedLanguageDkToDa.migrateAdminPreferedLanguageDkToDa);
@@ -23,6 +24,9 @@ var register = (({ strapi })=>{
     strapi.add('ai.admin', ()=>ai.createAiAdminService({
             strapi
         }));
+    // Here rather than in the EE register: that module is only loaded when the license is valid at
+    // boot, and the Plan card still needs these limits for a license that lapsed before boot.
+    entitlements.registerAuditLogsEntitlements(strapi);
     const shouldServeAdminPanel = strapi.config.get('admin.serveAdminPanel');
     if (shouldServeAdminPanel) {
         serveAdminPanel.default({

package/dist/server/server/src/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sources":["../../../../server/src/register.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport registerAdminPanelRoute from './routes/serve-admin-panel';\nimport adminAuthStrategy from './strategies/admin';\nimport { createAiAdminService } from './ai/services/ai';\nimport contentApiTokenAuthStrategy from './strategies/content-api-token';\nimport adminTokenAuthStrategy from './strategies/admin-token';\nimport { migrateAdminPreferedLanguageDkToDa } from './migrations/database/migrate-prefered-language-dk-to-da';\nimport { createPermissionFieldRenamer } from './services/permission/rename-fields';\n\nexport default ({ strapi }: { strapi: Core.Strapi }) => {\n  strapi.db.migrations.providers.internal.register(migrateAdminPreferedLanguageDkToDa);\n  // Generated rename migrations carry field renames to admin permissions; this\n  // must be registered before user migrations run (during schema sync).\n  strapi.db.schema.registerAttributeRenameHandler(createPermissionFieldRenamer({ strapi }));\n\n  const passportMiddleware = strapi.service('admin::passport').init();\n\n  strapi.server.api('admin').use(passportMiddleware);\n  strapi.get('auth').register('admin', adminAuthStrategy);\n  strapi.get('auth').register('admin', adminTokenAuthStrategy);\n  strapi.get('auth').register('content-api', contentApiTokenAuthStrategy);\n\n  strapi.add('ai.admin', () => createAiAdminService({ strapi }));\n\n  const shouldServeAdminPanel = strapi.config.get('admin.serveAdminPanel');\n\n  if (shouldServeAdminPanel) {\n    registerAdminPanelRoute({ strapi });\n  }\n};\n"],"names":["strapi","db","migrations","providers","internal","register","migrateAdminPreferedLanguageDkToDa","schema","registerAttributeRenameHandler","createPermissionFieldRenamer","passportMiddleware","service","init","server","api","use","get","adminAuthStrategy","adminTokenAuthStrategy","contentApiTokenAuthStrategy","add","createAiAdminService","shouldServeAdminPanel","config","registerAdminPanelRoute"],"mappings":";;;;;;;;;;AASA,eAAe,CAAA,CAAC,EAAEA,MAAM,EAA2B,GAAA;IACjDA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAACC,QAAQ,CAACC,QAAQ,CAACC,gEAAAA,CAAAA;;;AAGjDN,IAAAA,MAAAA,CAAOC,EAAE,CAACM,MAAM,CAACC,8BAA8B,CAACC,yCAAAA,CAA6B;AAAET,QAAAA;AAAO,KAAA,CAAA,CAAA;AAEtF,IAAA,MAAMU,kBAAAA,GAAqBV,MAAAA,CAAOW,OAAO,CAAC,mBAAmBC,IAAI,EAAA;AAEjEZ,IAAAA,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,OAAA,CAAA,CAASC,GAAG,CAACL,kBAAAA,CAAAA;AAC/BV,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASY,aAAAA,CAAAA;AACrCjB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASa,kBAAAA,CAAAA;AACrClB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,aAAA,EAAec,uBAAAA,CAAAA;AAE3CnB,IAAAA,MAAAA,CAAOoB,GAAG,CAAC,UAAA,EAAY,IAAMC,uBAAAA,CAAqB;AAAErB,YAAAA;AAAO,SAAA,CAAA,CAAA;AAE3D,IAAA,MAAMsB,qBAAAA,GAAwBtB,MAAAA,CAAOuB,MAAM,CAACP,GAAG,CAAC,uBAAA,CAAA;AAEhD,IAAA,IAAIM,qBAAAA,EAAuB;QACzBE,uBAAAA,CAAwB;AAAExB,YAAAA;AAAO,SAAA,CAAA;AACnC,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"register.js","sources":["../../../../server/src/register.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport registerAdminPanelRoute from './routes/serve-admin-panel';\nimport adminAuthStrategy from './strategies/admin';\nimport { createAiAdminService } from './ai/services/ai';\nimport contentApiTokenAuthStrategy from './strategies/content-api-token';\nimport adminTokenAuthStrategy from './strategies/admin-token';\nimport { migrateAdminPreferedLanguageDkToDa } from './migrations/database/migrate-prefered-language-dk-to-da';\nimport { createPermissionFieldRenamer } from './services/permission/rename-fields';\nimport { registerAuditLogsEntitlements } from '../../ee/server/src/audit-logs/entitlements';\n\nexport default ({ strapi }: { strapi: Core.Strapi }) => {\n  strapi.db.migrations.providers.internal.register(migrateAdminPreferedLanguageDkToDa);\n  // Generated rename migrations carry field renames to admin permissions; this\n  // must be registered before user migrations run (during schema sync).\n  strapi.db.schema.registerAttributeRenameHandler(createPermissionFieldRenamer({ strapi }));\n\n  const passportMiddleware = strapi.service('admin::passport').init();\n\n  strapi.server.api('admin').use(passportMiddleware);\n  strapi.get('auth').register('admin', adminAuthStrategy);\n  strapi.get('auth').register('admin', adminTokenAuthStrategy);\n  strapi.get('auth').register('content-api', contentApiTokenAuthStrategy);\n\n  strapi.add('ai.admin', () => createAiAdminService({ strapi }));\n\n  // Here rather than in the EE register: that module is only loaded when the license is valid at\n  // boot, and the Plan card still needs these limits for a license that lapsed before boot.\n  registerAuditLogsEntitlements(strapi);\n\n  const shouldServeAdminPanel = strapi.config.get('admin.serveAdminPanel');\n\n  if (shouldServeAdminPanel) {\n    registerAdminPanelRoute({ strapi });\n  }\n};\n"],"names":["strapi","db","migrations","providers","internal","register","migrateAdminPreferedLanguageDkToDa","schema","registerAttributeRenameHandler","createPermissionFieldRenamer","passportMiddleware","service","init","server","api","use","get","adminAuthStrategy","adminTokenAuthStrategy","contentApiTokenAuthStrategy","add","createAiAdminService","registerAuditLogsEntitlements","shouldServeAdminPanel","config","registerAdminPanelRoute"],"mappings":";;;;;;;;;;;AAUA,eAAe,CAAA,CAAC,EAAEA,MAAM,EAA2B,GAAA;IACjDA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAACC,QAAQ,CAACC,QAAQ,CAACC,gEAAAA,CAAAA;;;AAGjDN,IAAAA,MAAAA,CAAOC,EAAE,CAACM,MAAM,CAACC,8BAA8B,CAACC,yCAAAA,CAA6B;AAAET,QAAAA;AAAO,KAAA,CAAA,CAAA;AAEtF,IAAA,MAAMU,kBAAAA,GAAqBV,MAAAA,CAAOW,OAAO,CAAC,mBAAmBC,IAAI,EAAA;AAEjEZ,IAAAA,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,OAAA,CAAA,CAASC,GAAG,CAACL,kBAAAA,CAAAA;AAC/BV,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASY,aAAAA,CAAAA;AACrCjB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASa,kBAAAA,CAAAA;AACrClB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,aAAA,EAAec,uBAAAA,CAAAA;AAE3CnB,IAAAA,MAAAA,CAAOoB,GAAG,CAAC,UAAA,EAAY,IAAMC,uBAAAA,CAAqB;AAAErB,YAAAA;AAAO,SAAA,CAAA,CAAA;;;IAI3DsB,0CAAAA,CAA8BtB,MAAAA,CAAAA;AAE9B,IAAA,MAAMuB,qBAAAA,GAAwBvB,MAAAA,CAAOwB,MAAM,CAACR,GAAG,CAAC,uBAAA,CAAA;AAEhD,IAAA,IAAIO,qBAAAA,EAAuB;QACzBE,uBAAAA,CAAwB;AAAEzB,YAAAA;AAAO,SAAA,CAAA;AACnC,IAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/register.mjs

@@ -5,6 +5,7 @@ import contentApiTokenAuthStrategy from './strategies/content-api-token.mjs';
 import adminTokenAuthStrategy from './strategies/admin-token.mjs';
 import { migrateAdminPreferedLanguageDkToDa } from './migrations/database/migrate-prefered-language-dk-to-da.mjs';
 import { createPermissionFieldRenamer } from './services/permission/rename-fields.mjs';
+import { registerAuditLogsEntitlements } from '../../ee/server/src/audit-logs/entitlements.mjs';
 
 var register = (({ strapi })=>{
     strapi.db.migrations.providers.internal.register(migrateAdminPreferedLanguageDkToDa);
@@ -21,6 +22,9 @@ var register = (({ strapi })=>{
     strapi.add('ai.admin', ()=>createAiAdminService({
             strapi
         }));
+    // Here rather than in the EE register: that module is only loaded when the license is valid at
+    // boot, and the Plan card still needs these limits for a license that lapsed before boot.
+    registerAuditLogsEntitlements(strapi);
     const shouldServeAdminPanel = strapi.config.get('admin.serveAdminPanel');
     if (shouldServeAdminPanel) {
         registerAdminPanelRoute({

package/dist/server/server/src/register.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"register.mjs","sources":["../../../../server/src/register.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport registerAdminPanelRoute from './routes/serve-admin-panel';\nimport adminAuthStrategy from './strategies/admin';\nimport { createAiAdminService } from './ai/services/ai';\nimport contentApiTokenAuthStrategy from './strategies/content-api-token';\nimport adminTokenAuthStrategy from './strategies/admin-token';\nimport { migrateAdminPreferedLanguageDkToDa } from './migrations/database/migrate-prefered-language-dk-to-da';\nimport { createPermissionFieldRenamer } from './services/permission/rename-fields';\n\nexport default ({ strapi }: { strapi: Core.Strapi }) => {\n  strapi.db.migrations.providers.internal.register(migrateAdminPreferedLanguageDkToDa);\n  // Generated rename migrations carry field renames to admin permissions; this\n  // must be registered before user migrations run (during schema sync).\n  strapi.db.schema.registerAttributeRenameHandler(createPermissionFieldRenamer({ strapi }));\n\n  const passportMiddleware = strapi.service('admin::passport').init();\n\n  strapi.server.api('admin').use(passportMiddleware);\n  strapi.get('auth').register('admin', adminAuthStrategy);\n  strapi.get('auth').register('admin', adminTokenAuthStrategy);\n  strapi.get('auth').register('content-api', contentApiTokenAuthStrategy);\n\n  strapi.add('ai.admin', () => createAiAdminService({ strapi }));\n\n  const shouldServeAdminPanel = strapi.config.get('admin.serveAdminPanel');\n\n  if (shouldServeAdminPanel) {\n    registerAdminPanelRoute({ strapi });\n  }\n};\n"],"names":["strapi","db","migrations","providers","internal","register","migrateAdminPreferedLanguageDkToDa","schema","registerAttributeRenameHandler","createPermissionFieldRenamer","passportMiddleware","service","init","server","api","use","get","adminAuthStrategy","adminTokenAuthStrategy","contentApiTokenAuthStrategy","add","createAiAdminService","shouldServeAdminPanel","config","registerAdminPanelRoute"],"mappings":";;;;;;;;AASA,eAAe,CAAA,CAAC,EAAEA,MAAM,EAA2B,GAAA;IACjDA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAACC,QAAQ,CAACC,QAAQ,CAACC,kCAAAA,CAAAA;;;AAGjDN,IAAAA,MAAAA,CAAOC,EAAE,CAACM,MAAM,CAACC,8BAA8B,CAACC,4BAAAA,CAA6B;AAAET,QAAAA;AAAO,KAAA,CAAA,CAAA;AAEtF,IAAA,MAAMU,kBAAAA,GAAqBV,MAAAA,CAAOW,OAAO,CAAC,mBAAmBC,IAAI,EAAA;AAEjEZ,IAAAA,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,OAAA,CAAA,CAASC,GAAG,CAACL,kBAAAA,CAAAA;AAC/BV,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASY,iBAAAA,CAAAA;AACrCjB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASa,sBAAAA,CAAAA;AACrClB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,aAAA,EAAec,2BAAAA,CAAAA;AAE3CnB,IAAAA,MAAAA,CAAOoB,GAAG,CAAC,UAAA,EAAY,IAAMC,oBAAAA,CAAqB;AAAErB,YAAAA;AAAO,SAAA,CAAA,CAAA;AAE3D,IAAA,MAAMsB,qBAAAA,GAAwBtB,MAAAA,CAAOuB,MAAM,CAACP,GAAG,CAAC,uBAAA,CAAA;AAEhD,IAAA,IAAIM,qBAAAA,EAAuB;QACzBE,uBAAAA,CAAwB;AAAExB,YAAAA;AAAO,SAAA,CAAA;AACnC,IAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"register.mjs","sources":["../../../../server/src/register.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\nimport registerAdminPanelRoute from './routes/serve-admin-panel';\nimport adminAuthStrategy from './strategies/admin';\nimport { createAiAdminService } from './ai/services/ai';\nimport contentApiTokenAuthStrategy from './strategies/content-api-token';\nimport adminTokenAuthStrategy from './strategies/admin-token';\nimport { migrateAdminPreferedLanguageDkToDa } from './migrations/database/migrate-prefered-language-dk-to-da';\nimport { createPermissionFieldRenamer } from './services/permission/rename-fields';\nimport { registerAuditLogsEntitlements } from '../../ee/server/src/audit-logs/entitlements';\n\nexport default ({ strapi }: { strapi: Core.Strapi }) => {\n  strapi.db.migrations.providers.internal.register(migrateAdminPreferedLanguageDkToDa);\n  // Generated rename migrations carry field renames to admin permissions; this\n  // must be registered before user migrations run (during schema sync).\n  strapi.db.schema.registerAttributeRenameHandler(createPermissionFieldRenamer({ strapi }));\n\n  const passportMiddleware = strapi.service('admin::passport').init();\n\n  strapi.server.api('admin').use(passportMiddleware);\n  strapi.get('auth').register('admin', adminAuthStrategy);\n  strapi.get('auth').register('admin', adminTokenAuthStrategy);\n  strapi.get('auth').register('content-api', contentApiTokenAuthStrategy);\n\n  strapi.add('ai.admin', () => createAiAdminService({ strapi }));\n\n  // Here rather than in the EE register: that module is only loaded when the license is valid at\n  // boot, and the Plan card still needs these limits for a license that lapsed before boot.\n  registerAuditLogsEntitlements(strapi);\n\n  const shouldServeAdminPanel = strapi.config.get('admin.serveAdminPanel');\n\n  if (shouldServeAdminPanel) {\n    registerAdminPanelRoute({ strapi });\n  }\n};\n"],"names":["strapi","db","migrations","providers","internal","register","migrateAdminPreferedLanguageDkToDa","schema","registerAttributeRenameHandler","createPermissionFieldRenamer","passportMiddleware","service","init","server","api","use","get","adminAuthStrategy","adminTokenAuthStrategy","contentApiTokenAuthStrategy","add","createAiAdminService","registerAuditLogsEntitlements","shouldServeAdminPanel","config","registerAdminPanelRoute"],"mappings":";;;;;;;;;AAUA,eAAe,CAAA,CAAC,EAAEA,MAAM,EAA2B,GAAA;IACjDA,MAAAA,CAAOC,EAAE,CAACC,UAAU,CAACC,SAAS,CAACC,QAAQ,CAACC,QAAQ,CAACC,kCAAAA,CAAAA;;;AAGjDN,IAAAA,MAAAA,CAAOC,EAAE,CAACM,MAAM,CAACC,8BAA8B,CAACC,4BAAAA,CAA6B;AAAET,QAAAA;AAAO,KAAA,CAAA,CAAA;AAEtF,IAAA,MAAMU,kBAAAA,GAAqBV,MAAAA,CAAOW,OAAO,CAAC,mBAAmBC,IAAI,EAAA;AAEjEZ,IAAAA,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,OAAA,CAAA,CAASC,GAAG,CAACL,kBAAAA,CAAAA;AAC/BV,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASY,iBAAAA,CAAAA;AACrCjB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,OAAA,EAASa,sBAAAA,CAAAA;AACrClB,IAAAA,MAAAA,CAAOgB,GAAG,CAAC,MAAA,CAAA,CAAQX,QAAQ,CAAC,aAAA,EAAec,2BAAAA,CAAAA;AAE3CnB,IAAAA,MAAAA,CAAOoB,GAAG,CAAC,UAAA,EAAY,IAAMC,oBAAAA,CAAqB;AAAErB,YAAAA;AAAO,SAAA,CAAA,CAAA;;;IAI3DsB,6BAAAA,CAA8BtB,MAAAA,CAAAA;AAE9B,IAAA,MAAMuB,qBAAAA,GAAwBvB,MAAAA,CAAOwB,MAAM,CAACR,GAAG,CAAC,uBAAA,CAAA;AAEhD,IAAA,IAAIO,qBAAAA,EAAuB;QACzBE,uBAAAA,CAAwB;AAAEzB,YAAAA;AAAO,SAAA,CAAA;AACnC,IAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/routes/admin.js

@@ -110,6 +110,24 @@ var admin = [
                 'admin::isAuthenticatedAdmin'
             ]
         }
+    },
+    {
+        method: 'GET',
+        path: '/debug-dump',
+        handler: 'admin.debugDump',
+        config: {
+            policies: [
+                'admin::isAuthenticatedAdmin',
+                {
+                    name: 'admin::hasPermissions',
+                    config: {
+                        actions: [
+                            'admin::debug-dump.read'
+                        ]
+                    }
+                }
+            ]
+        }
     }
 ];